npm - @xopcai/xopc - Versions diffs - 0.0.224 → 0.0.227 - Mend

@xopcai/xopc 0.0.224 → 0.0.227

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (232) hide show

package/dist/src/agent/mcp/oauth/mcp-oauth-session.d.ts ADDED Viewed

@@ -0,0 +1,29 @@
+import type { McpOAuthSessionSnapshot } from './mcp-oauth-types.js';
+export declare class McpOAuthSession {
+    readonly serverId: string;
+    readonly serverUrl: URL;
+    readonly id: string;
+    readonly state: string;
+    readonly createdAt: number;
+    readonly expiresAt: number;
+    private statusValue;
+    private authorizationUrlValue?;
+    private errorValue?;
+    private callbackServer?;
+    private redirectUrlValue?;
+    private settleCode?;
+    private callbackConsumed;
+    private readonly codePromise;
+    private timeout?;
+    constructor(serverId: string, serverUrl: URL, ttlMs?: number);
+    get redirectUrl(): URL;
+    start(): Promise<void>;
+    setAuthorizationUrl(url: URL): void;
+    waitForCode(): Promise<string>;
+    complete(): void;
+    fail(error: unknown): void;
+    cancel(): void;
+    snapshot(): McpOAuthSessionSnapshot;
+    close(): Promise<void>;
+    private closeServer;
+}

package/dist/src/agent/mcp/oauth/mcp-oauth-session.js ADDED Viewed

@@ -0,0 +1,169 @@
+import { randomBytes, randomUUID } from "node:crypto";
+import { createServer } from "node:http";
+//#region src/agent/mcp/oauth/mcp-oauth-session.ts
+const CALLBACK_PATH = "/oauth/callback";
+const DEFAULT_SESSION_TTL_MS = 600 * 1e3;
+function callbackPage(title, message) {
+	return `<!doctype html><html><head><meta charset="utf-8"><title>${title}</title></head><body><h1>${title}</h1><p>${message}</p></body></html>`;
+}
+var McpOAuthSession = class {
+	id = `mcp_oauth_${randomUUID()}`;
+	state = randomBytes(24).toString("base64url");
+	createdAt = Date.now();
+	expiresAt;
+	statusValue = "starting";
+	authorizationUrlValue;
+	errorValue;
+	callbackServer;
+	redirectUrlValue;
+	settleCode;
+	callbackConsumed = false;
+	codePromise;
+	timeout;
+	constructor(serverId, serverUrl, ttlMs = DEFAULT_SESSION_TTL_MS) {
+		this.serverId = serverId;
+		this.serverUrl = serverUrl;
+		this.expiresAt = this.createdAt + ttlMs;
+		this.codePromise = new Promise((resolve) => {
+			this.settleCode = resolve;
+		});
+	}
+	get redirectUrl() {
+		if (!this.redirectUrlValue) throw new Error("MCP OAuth callback server has not started");
+		return this.redirectUrlValue;
+	}
+	async start() {
+		if (this.callbackServer) return;
+		const server = createServer((request, response) => {
+			response.setHeader("content-type", "text/html; charset=utf-8");
+			response.setHeader("cache-control", "no-store");
+			response.setHeader("referrer-policy", "no-referrer");
+			response.setHeader("x-content-type-options", "nosniff");
+			try {
+				const callback = new URL(request.url ?? "", "http://127.0.0.1");
+				if (callback.pathname !== CALLBACK_PATH) {
+					response.statusCode = 404;
+					response.end(callbackPage("Not found", "This is not an XOPC OAuth callback."));
+					return;
+				}
+				if (callback.searchParams.get("state") !== this.state) {
+					response.statusCode = 400;
+					response.end(callbackPage("Authorization failed", "MCP OAuth state mismatch"));
+					return;
+				}
+				if (this.callbackConsumed) {
+					response.statusCode = 409;
+					response.end(callbackPage("Authorization already handled", "Return to XOPC to continue."));
+					return;
+				}
+				const oauthError = callback.searchParams.get("error");
+				const code = callback.searchParams.get("code");
+				if (oauthError || !code) {
+					const error = /* @__PURE__ */ new Error(oauthError === "access_denied" ? "Authorization was denied" : "Authorization code is missing");
+					response.statusCode = 400;
+					response.end(callbackPage("Authorization failed", error.message));
+					this.fail(error);
+					return;
+				}
+				this.callbackConsumed = true;
+				this.statusValue = "exchanging_code";
+				response.statusCode = 200;
+				response.end(callbackPage("Authorization complete", "Return to XOPC to finish connecting the MCP server."));
+				this.settleCode?.({ code });
+				this.settleCode = void 0;
+			} catch {
+				const error = /* @__PURE__ */ new Error("MCP OAuth callback could not be processed");
+				response.statusCode = 500;
+				response.end(callbackPage("Authorization failed", error.message));
+				this.fail(error);
+			}
+		});
+		this.callbackServer = server;
+		try {
+			this.redirectUrlValue = await new Promise((resolve, reject) => {
+				server.once("error", reject);
+				server.listen(0, "127.0.0.1", () => {
+					server.removeListener("error", reject);
+					const address = server.address();
+					if (!address || typeof address === "string") {
+						reject(/* @__PURE__ */ new Error("MCP OAuth callback server did not expose a TCP port"));
+						return;
+					}
+					resolve(new URL(`http://127.0.0.1:${address.port}${CALLBACK_PATH}`));
+				});
+			});
+		} catch (error) {
+			this.callbackServer = void 0;
+			server.close();
+			throw error;
+		}
+		this.timeout = setTimeout(() => {
+			this.statusValue = "expired";
+			this.errorValue = "MCP OAuth session expired";
+			this.settleCode?.({ error: new Error(this.errorValue) });
+			this.settleCode = void 0;
+			this.closeServer();
+		}, Math.max(1, this.expiresAt - Date.now()));
+		this.timeout.unref?.();
+	}
+	setAuthorizationUrl(url) {
+		this.authorizationUrlValue = url.toString();
+		this.statusValue = "waiting_browser";
+	}
+	async waitForCode() {
+		const result = await this.codePromise;
+		if (result.error) throw result.error;
+		if (!result.code) throw new Error("MCP OAuth authorization code is unavailable");
+		return result.code;
+	}
+	complete() {
+		this.statusValue = "connected";
+		this.errorValue = void 0;
+		this.closeServer();
+	}
+	fail(error) {
+		this.statusValue = "failed";
+		this.errorValue = error instanceof Error ? error.message : String(error);
+		this.settleCode?.({ error: error instanceof Error ? error : new Error(String(error)) });
+		this.settleCode = void 0;
+		this.closeServer();
+	}
+	cancel() {
+		if ([
+			"connected",
+			"failed",
+			"expired",
+			"cancelled"
+		].includes(this.statusValue)) return;
+		this.statusValue = "cancelled";
+		this.settleCode?.({ error: /* @__PURE__ */ new Error("MCP OAuth session cancelled") });
+		this.settleCode = void 0;
+		this.closeServer();
+	}
+	snapshot() {
+		return {
+			id: this.id,
+			serverId: this.serverId,
+			serverUrl: this.serverUrl.toString(),
+			status: this.statusValue,
+			authorizationUrl: this.authorizationUrlValue,
+			error: this.errorValue,
+			createdAt: this.createdAt,
+			expiresAt: this.expiresAt
+		};
+	}
+	async close() {
+		this.cancel();
+		await this.closeServer();
+	}
+	async closeServer() {
+		if (this.timeout) clearTimeout(this.timeout);
+		this.timeout = void 0;
+		const server = this.callbackServer;
+		this.callbackServer = void 0;
+		if (!server) return;
+		await new Promise((resolve) => server.close(() => resolve()));
+	}
+};
+//#endregion
+export { McpOAuthSession };

package/dist/src/agent/mcp/oauth/mcp-oauth-store.d.ts ADDED Viewed

@@ -0,0 +1,9 @@
+import type { McpOAuthRecord } from './mcp-oauth-types.js';
+export declare function canonicalMcpServerUrl(input: string | URL): string;
+export declare function mcpOAuthServerKey(input: string | URL): string;
+export declare class McpOAuthStore {
+    pathFor(serverUrl: string | URL): string;
+    load(serverUrlInput: string | URL): Promise<McpOAuthRecord | undefined>;
+    update(serverUrlInput: string | URL, update: (current: McpOAuthRecord | undefined) => McpOAuthRecord | undefined): Promise<McpOAuthRecord | undefined>;
+    delete(serverUrl: string | URL): Promise<void>;
+}

package/dist/src/agent/mcp/oauth/mcp-oauth-store.js ADDED Viewed

@@ -0,0 +1,79 @@
+import { init_paths, resolveMcpOAuthPath } from "../../../config/paths.js";
+import { init_write_file_atomic, writeTextAtomic } from "../../../infra/write-file-atomic.js";
+import { createHash } from "node:crypto";
+import { readFile, rm } from "node:fs/promises";
+//#region src/agent/mcp/oauth/mcp-oauth-store.ts
+init_paths();
+init_write_file_atomic();
+const writeTails = /* @__PURE__ */ new Map();
+function canonicalMcpServerUrl(input) {
+	const url = input instanceof URL ? new URL(input) : new URL(input);
+	url.hash = "";
+	return url.toString();
+}
+function mcpOAuthServerKey(input) {
+	return createHash("sha256").update(canonicalMcpServerUrl(input)).digest("hex");
+}
+function isStoredRecord(value, serverUrl) {
+	if (!value || typeof value !== "object" || Array.isArray(value)) return false;
+	const record = value;
+	if (record.version !== 1 || record.serverUrl !== serverUrl || typeof record.updatedAt !== "string") return false;
+	if (record.tokens !== void 0) {
+		const tokens = record.tokens;
+		if (typeof tokens.access_token !== "string" || typeof tokens.token_type !== "string") return false;
+	}
+	return true;
+}
+async function serializeWrite(key, operation) {
+	const previous = writeTails.get(key) ?? Promise.resolve();
+	let release;
+	const gate = new Promise((resolve) => {
+		release = resolve;
+	});
+	const tail = previous.catch(() => void 0).then(() => gate);
+	writeTails.set(key, tail);
+	await previous.catch(() => void 0);
+	try {
+		return await operation();
+	} finally {
+		release();
+		if (writeTails.get(key) === tail) writeTails.delete(key);
+	}
+}
+var McpOAuthStore = class {
+	pathFor(serverUrl) {
+		return resolveMcpOAuthPath(mcpOAuthServerKey(serverUrl));
+	}
+	async load(serverUrlInput) {
+		const serverUrl = canonicalMcpServerUrl(serverUrlInput);
+		try {
+			const parsed = JSON.parse(await readFile(this.pathFor(serverUrl), "utf8"));
+			return isStoredRecord(parsed, serverUrl) ? parsed : void 0;
+		} catch {
+			return;
+		}
+	}
+	async update(serverUrlInput, update) {
+		const serverUrl = canonicalMcpServerUrl(serverUrlInput);
+		return serializeWrite(mcpOAuthServerKey(serverUrl), async () => {
+			const next = update(await this.load(serverUrl));
+			if (!next) {
+				await rm(this.pathFor(serverUrl), { force: true });
+				return;
+			}
+			const normalized = {
+				...next,
+				version: 1,
+				serverUrl,
+				updatedAt: (/* @__PURE__ */ new Date()).toISOString()
+			};
+			await writeTextAtomic(this.pathFor(serverUrl), JSON.stringify(normalized, null, 2));
+			return normalized;
+		});
+	}
+	async delete(serverUrl) {
+		await this.update(serverUrl, () => void 0);
+	}
+};
+//#endregion
+export { McpOAuthStore, canonicalMcpServerUrl, mcpOAuthServerKey };

package/dist/src/agent/mcp/oauth/mcp-oauth-types.d.ts ADDED Viewed

@@ -0,0 +1,22 @@
+import type { OAuthDiscoveryState } from '@modelcontextprotocol/sdk/client/auth.js';
+import type { OAuthClientInformationMixed, OAuthTokens } from '@modelcontextprotocol/sdk/shared/auth.js';
+export type McpOAuthRecord = {
+    version: 1;
+    serverUrl: string;
+    clientInformation?: OAuthClientInformationMixed;
+    discoveryState?: OAuthDiscoveryState;
+    tokens?: OAuthTokens;
+    tokensSavedAt?: number;
+    updatedAt: string;
+};
+export type McpOAuthSessionStatus = 'starting' | 'waiting_browser' | 'exchanging_code' | 'connected' | 'failed' | 'expired' | 'cancelled';
+export type McpOAuthSessionSnapshot = {
+    id: string;
+    serverId: string;
+    serverUrl: string;
+    status: McpOAuthSessionStatus;
+    authorizationUrl?: string;
+    error?: string;
+    createdAt: number;
+    expiresAt: number;
+};

package/dist/src/agent/mcp/oauth/mcp-oauth-types.js ADDED Viewed

	@@ -0,0 +1 @@
1	+ export {};

package/dist/src/agent/memory/builtin-provider.js CHANGED Viewed

@@ -1,6 +1,7 @@
 import { init_agent_session_key, normalizeAgentId } from "../../routing/agent-session-key.js";
 import { appendMemorySignal, deleteMemoryRecord, getMemoryRecord, listMemoryRecords, searchMemoryRecords, upsertMemoryRecord } from "../../storage/sqlite/memory-records-repository.js";
 import "../../storage/sqlite/index.js";
+import { resolveMemorySessionKind } from "./turn-provenance.js";
 //#region src/agent/memory/builtin-provider.ts
 init_agent_session_key();
 /**
@@ -44,7 +45,8 @@ var BuiltinMemoryProvider = class {
 			unscopedWorkspaceOnly: request.scope?.workspaceId == null,
 			kinds: request.kinds,
 			maxResults: request.maxResults,
-			minScore: request.minScore
+			minScore: request.minScore,
+			trustedOnly: request.trustedOnly
 		};
 		const [active, shadow] = [searchMemoryRecords(options), searchMemoryRecords({
 			...options,
@@ -90,10 +92,13 @@ var BuiltinMemoryProvider = class {
 		});
 	}
 	async write(request) {
+		const sourceAgentId = normalizeAgentId(request.sourceAgentId ?? "main");
+		const sourceSessionId = request.provenance?.sourceSessionId ?? request.scope?.sessionKey;
+		const originClass = request.confirmed ? "owner" : request.provenance?.originClass ?? "agent";
 		const record = upsertMemoryRecord({
 			providerId: this.id,
 			kind: request.kind,
-			sourceAgentId: normalizeAgentId(request.sourceAgentId ?? "main"),
+			sourceAgentId,
 			workspaceId: request.scope?.workspaceId,
 			sessionKey: request.scope?.sessionKey,
 			projectId: request.scope?.projectId,
@@ -117,7 +122,14 @@ var BuiltinMemoryProvider = class {
 			reviewAfter: request.reviewAfter,
 			expiresAt: request.expiresAt,
 			supersedesRecordId: request.supersedesRecordId,
-			conflictGroupId: request.conflictGroupId
+			conflictGroupId: request.conflictGroupId,
+			originClass,
+			sessionKind: request.provenance?.sessionKind ?? (sourceSessionId ? resolveMemorySessionKind(sourceSessionId) : "unknown"),
+			observedAt: request.provenance?.observedAt,
+			sourceSessionId,
+			sourceTurnId: request.provenance?.sourceTurnId,
+			supersedesKey: request.provenance?.supersedesKey,
+			derivedFromRecalledContext: request.confirmed ? false : request.provenance?.derivedFromRecalledContext
 		});
 		return {
 			success: true,
@@ -164,7 +176,14 @@ var BuiltinMemoryProvider = class {
 				reviewAfter: existing.reviewAfter,
 				expiresAt: existing.expiresAt,
 				supersedesRecordId: existing.supersedesRecordId,
-				conflictGroupId: existing.conflictGroupId
+				conflictGroupId: existing.conflictGroupId,
+				originClass: existing.provenance.originClass,
+				sessionKind: existing.provenance.sessionKind,
+				observedAt: existing.provenance.observedAt,
+				sourceSessionId: existing.provenance.sourceSessionId,
+				sourceTurnId: existing.provenance.sourceTurnId,
+				supersedesKey: existing.provenance.supersedesKey,
+				derivedFromRecalledContext: existing.provenance.derivedFromRecalledContext
 			})
 		};
 	}

package/dist/src/agent/memory/compaction-promotion.d.ts ADDED Viewed

@@ -0,0 +1,18 @@
+import type { CompactionAudit, CompactionHandover } from '../../session/compaction-types.js';
+import type { TranscriptSourceEntry } from '../../storage/sqlite/transcript-repository.js';
+export interface PromoteCompactionLedgerInput {
+    sessionKey: string;
+    sessionId: string;
+    sourceAgentId: string;
+    workspaceId: string;
+    projectId?: string;
+    handover: CompactionHandover;
+    audit: CompactionAudit;
+    sourceEntries: readonly TranscriptSourceEntry[];
+}
+export interface PromoteCompactionLedgerResult {
+    episodicRecordIds: string[];
+    durableRecordIds: string[];
+    rejectedRecordIds: string[];
+}
+export declare function promoteCompactionLedger(input: PromoteCompactionLedgerInput): PromoteCompactionLedgerResult;

package/dist/src/agent/memory/compaction-promotion.js ADDED Viewed

@@ -0,0 +1,211 @@
+import { getMemoryRecord, setMemoryRecordStatus, upsertMemoryRecord } from "../../storage/sqlite/memory-records-repository.js";
+import { resolveMemorySessionKind } from "./turn-provenance.js";
+import { createHash } from "node:crypto";
+//#region src/agent/memory/compaction-promotion.ts
+const DURABLE_KINDS = new Set([
+	"objective",
+	"decision",
+	"pending_user_ask",
+	"todo",
+	"constraint",
+	"next_action"
+]);
+const RECALL_TOOL_RE = /^(?:memory_(?:search|get)|session_(?:search|recall))$/;
+const MEMORY_KIND_BY_HANDOVER_KIND = {
+	objective: "long_term_goal",
+	decision: "derived_insight",
+	pending_user_ask: "open_question",
+	todo: "commitment",
+	constraint: "project_context",
+	file_change: "workspace_fact",
+	tool_outcome: "task_lesson",
+	failure: "task_lesson",
+	current_state: "current_state",
+	next_action: "commitment"
+};
+function stableId(prefix, ...parts) {
+	return `${prefix}:${createHash("sha256").update(parts.join("\0")).digest("hex").slice(0, 32)}`;
+}
+function rowRole(entry) {
+	const row = entry.row;
+	return typeof row.role === "string" ? row.role : void 0;
+}
+function rowTurnId(entry) {
+	if (!entry) return void 0;
+	const row = entry.row;
+	return typeof row.turnId === "string" && row.turnId.trim() ? row.turnId : void 0;
+}
+function toolNames(entry) {
+	const row = entry.row;
+	const names = [];
+	if (typeof row.toolName === "string") names.push(row.toolName);
+	if (row.role === "assistant" && Array.isArray(row.content)) for (const block of row.content) {
+		if (!block || typeof block !== "object") continue;
+		const candidate = block;
+		if (candidate.type === "toolCall" && typeof candidate.name === "string") names.push(candidate.name);
+	}
+	return names;
+}
+function hasAttachedSourceContext(entry) {
+	const row = entry.row;
+	if (!row.metadata || typeof row.metadata !== "object" || Array.isArray(row.metadata)) return false;
+	return Array.isArray(row.metadata.sourceContexts) && row.metadata.sourceContexts.length > 0;
+}
+function classifyItemProvenance(item, sourceById, entriesByTurn, entriesByRound) {
+	const directSources = item.sources.flatMap((source) => {
+		const entry = sourceById.get(source.entryId);
+		return entry ? [entry] : [];
+	});
+	const expandedSources = /* @__PURE__ */ new Map();
+	for (const entry of directSources) {
+		expandedSources.set(entry.entryId, entry);
+		const turnId = rowTurnId(entry);
+		for (const peer of turnId ? entriesByTurn.get(turnId) ?? [] : []) expandedSources.set(peer.entryId, peer);
+		for (const peer of entriesByRound.get(entry.entryId) ?? []) expandedSources.set(peer.entryId, peer);
+	}
+	const sources = [...expandedSources.values()];
+	const names = sources.flatMap(toolNames);
+	const tainted = directSources.length !== item.sources.length || sources.some((entry) => {
+		const role = rowRole(entry);
+		return role === "tool" || role === "toolResult" || role === "system" || !role || hasAttachedSourceContext(entry);
+	});
+	const observedAtMs = Math.max(0, ...directSources.map((entry) => entry.createdAt));
+	return {
+		originClass: tainted ? "untrusted" : "agent",
+		derivedFromRecalledContext: names.some((name) => RECALL_TOOL_RE.test(name)),
+		observedAt: new Date(observedAtMs || Date.now()).toISOString()
+	};
+}
+function importanceFor(item) {
+	if (item.kind === "constraint" || item.kind === "decision") return .82;
+	if (item.kind === "objective" || item.kind === "pending_user_ask") return .75;
+	if (item.kind === "todo" || item.kind === "next_action") return .68;
+	return .5;
+}
+function promoteCompactionLedger(input) {
+	const sourceById = new Map(input.sourceEntries.map((entry) => [entry.entryId, entry]));
+	const entriesByTurn = /* @__PURE__ */ new Map();
+	const entriesByRound = /* @__PURE__ */ new Map();
+	let currentRound = [];
+	const flushRound = () => {
+		for (const entry of currentRound) entriesByRound.set(entry.entryId, currentRound);
+	};
+	for (const entry of input.sourceEntries) {
+		const role = rowRole(entry);
+		if (role === "user") {
+			flushRound();
+			currentRound = [];
+		}
+		if (role === "user" || role === "assistant" || role === "tool" || role === "toolResult") currentRound.push(entry);
+		const turnId = rowTurnId(entry);
+		if (!turnId) continue;
+		const entries = entriesByTurn.get(turnId) ?? [];
+		entries.push(entry);
+		entriesByTurn.set(turnId, entries);
+	}
+	flushRound();
+	const result = {
+		episodicRecordIds: [],
+		durableRecordIds: [],
+		rejectedRecordIds: []
+	};
+	const sessionKind = resolveMemorySessionKind(input.sessionKey);
+	for (const item of input.handover.items) {
+		const episodeId = stableId("compaction-episode", input.sessionId, item.id);
+		const classified = classifyItemProvenance(item, sourceById, entriesByTurn, entriesByRound);
+		const originClass = sessionKind === "automation" || sessionKind === "workflow" || sessionKind === "background" ? "system" : sessionKind === "group" ? "untrusted" : classified.originClass;
+		const active = item.status === "active";
+		upsertMemoryRecord({
+			id: episodeId,
+			providerId: "compaction-ledger",
+			kind: MEMORY_KIND_BY_HANDOVER_KIND[item.kind],
+			sourceAgentId: input.sourceAgentId,
+			workspaceId: input.workspaceId,
+			sessionKey: input.sessionKey,
+			projectId: input.projectId,
+			content: item.text,
+			canonicalKey: `compaction:${input.sessionId}:${item.id}`,
+			source: {
+				provider: "compaction-ledger",
+				sessionEntryId: item.sources[0]?.entryId
+			},
+			confidence: input.audit.status === "passed" ? .82 : .65,
+			tags: [
+				"compaction",
+				"episodic",
+				item.kind,
+				item.status
+			],
+			status: active ? "candidate" : "archived",
+			sensitivity: "normal",
+			explicitness: "inferred",
+			durability: "ephemeral",
+			importance: importanceFor(item),
+			disclosurePolicy: "referenceable",
+			evidence: item.sources.map((source) => ({
+				sessionKey: input.sessionKey,
+				turnId: rowTurnId(sourceById.get(source.entryId)),
+				relation: "derived_from",
+				sourceText: `[transcript:${source.seq}] ${item.text}`,
+				observedAt: classified.observedAt
+			})),
+			originClass,
+			sessionKind,
+			observedAt: classified.observedAt,
+			sourceSessionId: input.sessionKey,
+			supersedesKey: item.id,
+			derivedFromRecalledContext: classified.derivedFromRecalledContext
+		});
+		result.episodicRecordIds.push(episodeId);
+		const durableId = stableId("compaction-durable", input.workspaceId, input.projectId ?? "", item.kind, item.text);
+		if (!(active && input.audit.status === "passed" && sessionKind === "interactive" && originClass === "agent" && !classified.derivedFromRecalledContext && DURABLE_KINDS.has(item.kind))) {
+			if ((!active ? getMemoryRecord(durableId) : null)?.provenance.sourceSessionId === input.sessionKey) setMemoryRecordStatus(durableId, "archived");
+			result.rejectedRecordIds.push(episodeId);
+			continue;
+		}
+		upsertMemoryRecord({
+			id: durableId,
+			providerId: "compaction-ledger",
+			kind: MEMORY_KIND_BY_HANDOVER_KIND[item.kind],
+			sourceAgentId: input.sourceAgentId,
+			workspaceId: input.workspaceId,
+			projectId: input.projectId,
+			content: item.text,
+			canonicalKey: `durable:${item.kind}:${stableId("fact", item.text)}`,
+			source: {
+				provider: "compaction-ledger",
+				sessionEntryId: item.sources[0]?.entryId
+			},
+			confidence: .82,
+			tags: [
+				"compaction",
+				"durable",
+				item.kind
+			],
+			status: "active",
+			sensitivity: "normal",
+			explicitness: "inferred",
+			durability: "durable",
+			importance: importanceFor(item),
+			disclosurePolicy: "referenceable",
+			evidence: [{
+				sessionKey: input.sessionKey,
+				turnId: item.sources[0] ? rowTurnId(sourceById.get(item.sources[0].entryId)) : void 0,
+				relation: "derived_from",
+				sourceText: item.text,
+				observedAt: classified.observedAt
+			}],
+			supersedesRecordId: episodeId,
+			originClass: "agent",
+			sessionKind,
+			observedAt: classified.observedAt,
+			sourceSessionId: input.sessionKey,
+			supersedesKey: item.id,
+			derivedFromRecalledContext: false
+		});
+		result.durableRecordIds.push(durableId);
+	}
+	return result;
+}
+//#endregion
+export { promoteCompactionLedger };

package/dist/src/agent/memory/context/types.d.ts CHANGED Viewed

@@ -26,6 +26,11 @@ export interface UserContextPlan {
         purpose: string;
     }>;
     estimatedTokens: number;
+    /** Exact rendered context characters prepended before the user's message. */
+    contextChars: number;
+    contextItemCount: number;
+    /** Generic durable memory records selected by the trusted automatic recall lane. */
+    memoryRecordIds?: string[];
     allocation?: {
         profile: 'standard' | 'deep' | 'critical';
         maxResults: number;

package/dist/src/agent/memory/manager.d.ts CHANGED Viewed

@@ -3,6 +3,7 @@ import type { MemoryRuntime } from '../../agent-runtime/memory-runtime.js';
 import type { MemoryProvider, MemoryProviderInitOptions } from './provider.js';
 import type { UnderstandingCandidate } from './understanding/types.js';
 import type { MemoryDeleteRequest, MemoryListRequest, MemoryReadRequest, MemoryReadResult, MemorySearchRequest, MemorySearchResult, MemoryUpdateRequest, MemoryWriteRequest, MemoryWriteResult, MemoryRecord, MemorySignal, MemoryKind } from './types.js';
+import type { TurnMemoryProvenance } from './turn-provenance.js';
 export type MemorySearchStrategy = 'local-first' | 'external-first' | 'fanout' | 'local-only' | 'external-only';
 export type MemoryWriteStrategy = 'local-first' | 'external-first' | 'write-through' | 'local-only' | 'external-only';
 export interface MemoryRoutingOptions {
@@ -51,6 +52,8 @@ export declare class MemoryManager {
     }): Promise<import('./understanding/types.js').UnderstandingReviewResult>;
     syncProvidersForTurn(userContent: string, assistantContent: string, options?: {
         sessionId?: string;
+        turnId?: string;
+        provenance?: TurnMemoryProvenance;
     }): Promise<void>;
     applyUnderstandingCandidates(candidates: UnderstandingCandidate[], context?: {
         agentId?: string;

package/dist/src/agent/memory/manager.js CHANGED Viewed

@@ -98,11 +98,20 @@ var MemoryManager = class {
 		});
 	}
 	async syncProvidersForTurn(userContent, assistantContent, options) {
+		const provenance = options?.provenance;
 		const event = {
 			type: "turn",
 			userContent,
 			assistantContent,
-			sessionId: options?.sessionId
+			sessionId: options?.sessionId,
+			turnId: options?.turnId,
+			provenance: {
+				originClass: provenance?.originClass ?? "untrusted",
+				sessionKind: provenance?.sessionKind ?? "unknown",
+				sourceSessionId: provenance?.sourceSessionId ?? options?.sessionId,
+				sourceTurnId: provenance?.sourceTurnId ?? options?.turnId,
+				derivedFromRecalledContext: provenance?.derivedFromRecalledContext ?? false
+			}
 		};
 		for (const p of this.providers) {
 			const started = Date.now();
@@ -198,7 +207,7 @@ var MemoryManager = class {
 			}
 		}
 		const seen = /* @__PURE__ */ new Set();
-		return results.sort((a, b) => b.score - a.score).filter((result) => this.canReadRecord(result.record, request.scope)).filter((result) => {
+		return results.sort((a, b) => b.score - a.score).filter((result) => this.canReadRecord(result.record, request.scope)).filter((result) => !request.trustedOnly || (result.record.provenance?.originClass === "owner" || result.record.provenance?.originClass === "agent") && result.record.provenance?.derivedFromRecalledContext === false).filter((result) => {
 			const key = `${result.citation.providerId}:${result.citation.recordId}`;
 			if (seen.has(key)) return false;
 			seen.add(key);
@@ -427,6 +436,7 @@ var MemoryManager = class {
 		if (!provider.capabilities.local && this.writePolicy.allowedProviderIds && this.writePolicy.allowedProviderIds.length > 0 && !this.writePolicy.allowedProviderIds.includes(provider.id)) return false;
 		if (operation === "write") {
 			const writeRequest = request;
+			if (writeRequest.provenance?.derivedFromRecalledContext && writeRequest.status !== "candidate" && !writeRequest.confirmed) return false;
 			if (provider.capabilities.local && this.memoryRuntime) {
 				const check = this.memoryRuntime.checkWrite({
 					target: writeRequest.writeTarget ?? writeTargetForRecord(writeRequest),