aismemory 0.7.0 → 0.7.2

package/dist/agent-key-mode.js

@@ -12,7 +12,7 @@
  *
  * Server-side contract (packages/agent-identity-service/src/api/middleware/
  * agentApiKeyAuth.ts): the key authenticates ONLY
- * `/v1/agents/:agentId/{memory,goals,dream,full-context}`, and only when
+ * `/v1/agents/:agentId/{memory,goals,dream,full-context,inbox}`, and only when
  * :agentId equals the key's own agent. Every other route (tenant-wide agent
  * listing, handoff, personality, key management, ...) is 403'd server-side.
  * This module honors that scope client-side too: tools that need an
@@ -21,7 +21,8 @@
  */
 import { AisHttpError } from './ais-http-error.js';
 import { emitTelemetry } from './telemetry.js';
-import { parseEmptyToolArgs, parseRecallArgs, parseRememberArgs, } from './tool-args.js';
+import { parseEmptyToolArgs, parseRecallArgs, parseFullContextArgs, parseRememberArgs, parseInboxSendArgs, parseInboxReadArgs, } from './tool-args.js';
+import { readInboxAndMaybeAck } from './inbox-client.js';
 /** Thrown by loadAgentApiKeyConfig when AIS_AGENT_API_KEY is set without AIS_AGENT_ID. */
 export class AgentApiKeyConfigError extends Error {
     constructor(message) {
@@ -146,11 +147,22 @@ export async function dispatchToolKeyMode(aisUrl, config, name, rawArgs, fetchIm
                 params.set('limit', String(args.limit));
             if (args.type !== undefined)
                 params.set('types', args.type);
+            if (args.principalAgentId !== undefined) {
+                params.set('principalAgentId', args.principalAgentId);
+            }
             return aisKeyGet(aisUrl, `/v1/agents/${agentId}/memory?${params}`, apiKey, fetchImpl);
         }
-        case 'full_context':
-            parseEmptyToolArgs(rawArgs);
-            return aisKeyGet(aisUrl, `/v1/agents/${agentId}/full-context`, apiKey, fetchImpl);
+        case 'full_context': {
+            const fcArgs = parseFullContextArgs(rawArgs);
+            const fcParams = new URLSearchParams();
+            if (fcArgs.principalAgentId !== undefined)
+                fcParams.set('principalAgentId', fcArgs.principalAgentId);
+            if (fcArgs.memoriesLimit !== undefined)
+                fcParams.set('memoriesLimit', String(fcArgs.memoriesLimit));
+            const fcQs = fcParams.toString();
+            const fcPath = `/v1/agents/${agentId}/full-context${fcQs ? `?${fcQs}` : ''}`;
+            return aisKeyGet(aisUrl, fcPath, apiKey, fetchImpl);
+        }
         case 'dream':
             parseEmptyToolArgs(rawArgs);
             return aisKeyPost(aisUrl, `/v1/agents/${agentId}/dream`, apiKey, {}, fetchImpl);
@@ -171,6 +183,28 @@ export async function dispatchToolKeyMode(aisUrl, config, name, rawArgs, fetchIm
                 },
             };
         }
+        case 'inbox_send': {
+            const args = parseInboxSendArgs(rawArgs);
+            return aisKeyPost(aisUrl, `/v1/agents/${agentId}/inbox`, apiKey, {
+                recipientAgentId: args.recipientAgentId,
+                kind: args.kind,
+                body: args.body,
+                ...(args.threadId !== undefined ? { threadId: args.threadId } : {}),
+                ...(args.taskId !== undefined ? { taskId: args.taskId } : {}),
+                ...(args.inReplyTo !== undefined ? { inReplyTo: args.inReplyTo } : {}),
+                ...(args.messageId !== undefined ? { messageId: args.messageId } : {}),
+                ...(args.ttlSeconds !== undefined ? { ttlSeconds: args.ttlSeconds } : {}),
+            }, fetchImpl);
+        }
+        case 'inbox_read': {
+            const args = parseInboxReadArgs(rawArgs);
+            const params = new URLSearchParams();
+            if (args.cursor !== undefined)
+                params.set('cursor', args.cursor);
+            params.set('limit', String(args.limit));
+            params.set('unreadOnly', String(args.unreadOnly));
+            return readInboxAndMaybeAck(args, () => aisKeyGet(aisUrl, `/v1/agents/${agentId}/inbox?${params}`, apiKey, fetchImpl), (messageIds) => aisKeyPost(aisUrl, `/v1/agents/${agentId}/inbox/ack`, apiKey, { messageIds }, fetchImpl));
+        }
         case 'handoff':
             throw new OutOfScopeToolError('handoff', "the handoff route is outside the key's allowed scope (memory, goals, dream, full-context).");
         case 'agent_load':

package/dist/agent-key-mode.js.map

@@ -1 +1 @@
-{"version":3,"file":"agent-key-mode.js","sourceRoot":"","sources":["../src/agent-key-mode.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACnD,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAC/C,OAAO,EACL,kBAAkB,EAClB,eAAe,EACf,iBAAiB,GAClB,MAAM,gBAAgB,CAAC;AAOxB,0FAA0F;AAC1F,MAAM,OAAO,sBAAuB,SAAQ,KAAK;IAC/C,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,wBAAwB,CAAC;IACvC,CAAC;CACF;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,qBAAqB,CACnC,MAA0C,OAAO,CAAC,GAAG;IAErD,MAAM,SAAS,GAAG,GAAG,CAAC,mBAAmB,CAAC,CAAC;IAC3C,4EAA4E;IAC5E,qEAAqE;IACrE,2EAA2E;IAC3E,6DAA6D;IAC7D,IAAI,SAAS,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IAEzC,4EAA4E;IAC5E,2EAA2E;IAC3E,2DAA2D;IAC3D,MAAM,MAAM,GAAG,SAAS,CAAC,IAAI,EAAE,CAAC;IAChC,IAAI,MAAM,KAAK,EAAE,EAAE,CAAC;QAClB,MAAM,IAAI,sBAAsB,CAC9B,4DAA4D;YAC1D,oEAAoE;YACpE,yCAAyC;YACzC,uEAAuE,CAC1E,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAClC,MAAM,IAAI,sBAAsB,CAC9B,uEAAuE;YACrE,kEAAkE;YAClE,mDAAmD,CACtD,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,GAAG,CAAC,cAAc,CAAC,EAAE,IAAI,EAAE,CAAC;IAC5C,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,sBAAsB,CAC9B,yDAAyD;YACvD,8EAA8E;YAC9E,wEAAwE;YACxE,uEAAuE;YACvE,4DAA4D,CAC/D,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;AAC7B,CAAC;AAMD,KAAK,UAAU,QAAQ,CAAC,GAAa;IACnC,OAAO,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;AACtC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,MAAc,EACd,IAAY,EACZ,MAAc,EACd,IAAa,EACb,YAAuB,UAAU,CAAC,KAAK;IAEvC,MAAM,OAAO,GAA2B;QACtC,cAAc,EAAE,kBAAkB;QAClC,iBAAiB,EAAE,MAAM;KAC1B,CAAC;IACF,IAAI,GAAa,CAAC;IAClB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,SAAS,CAAC,GAAG,MAAM,GAAG,IAAI,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACrG,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,aAAa,CAAC,EAAE,KAAK,EAAE,kBAAkB,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC5G,MAAM,GAAG,CAAC;IACZ,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAC;IACjC,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,aAAa,CAAC,EAAE,KAAK,EAAE,kBAAkB,EAAE,IAAI,EAAE,UAAU,EAAE,GAAG,CAAC,MAAM,EAAE,KAAK,EAAE,QAAQ,GAAG,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QACxG,MAAM,IAAI,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IACjD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,MAAc,EACd,IAAY,EACZ,MAAc,EACd,YAAuB,UAAU,CAAC,KAAK;IAEvC,IAAI,GAAa,CAAC;IAClB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,SAAS,CAAC,GAAG,MAAM,GAAG,IAAI,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,iBAAiB,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;IACxF,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,aAAa,CAAC,EAAE,KAAK,EAAE,kBAAkB,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC5G,MAAM,GAAG,CAAC;IACZ,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAC;IACjC,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,aAAa,CAAC,EAAE,KAAK,EAAE,kBAAkB,EAAE,IAAI,EAAE,UAAU,EAAE,GAAG,CAAC,MAAM,EAAE,KAAK,EAAE,QAAQ,GAAG,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QACxG,MAAM,IAAI,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IACjD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,4EAA4E;AAE5E,2EAA2E;AAC3E,MAAM,CAAC,MAAM,qBAAqB,GAAG,MAAM,CAAC,uBAAuB,CAAC,CAAC;AAErE;;;;;;GAMG;AACH,MAAM,OAAO,mBAAoB,SAAQ,KAAK;IAC5C,YAAY,IAAY,EAAE,MAAc;QACtC,KAAK,CAAC,GAAG,IAAI,mEAAmE,MAAM,EAAE,CAAC,CAAC;QAC1F,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;IACpC,CAAC;CACF;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,MAAc,EACd,MAAyB,EACzB,IAAY,EACZ,OAAgB,EAChB,YAAuB,UAAU,CAAC,KAAK;IAEvC,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,MAAM,CAAC;IAEnC,QAAQ,IAAI,EAAE,CAAC;QACf,KAAK,UAAU,CAAC,CAAC,CAAC;YAChB,MAAM,IAAI,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;YACxC,OAAO,UAAU,CAAC,MAAM,EAAE,cAAc,OAAO,SAAS,EAAE,MAAM,EAAE;gBAChE,OAAO,EAAE,IAAI,CAAC,OAAO;gBACrB,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,UAAU,EAAE,IAAI,CAAC,UAAU;aAC5B,EAAE,SAAS,CAAC,CAAC;QAChB,CAAC;QAED,KAAK,QAAQ,CAAC,CAAC,CAAC;YACd,MAAM,IAAI,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;YACtC,MAAM,MAAM,GAAG,IAAI,eAAe,EAAE,CAAC;YACrC,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;YAChC,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS;gBAAE,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;YACtE,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS;gBAAE,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;YAC5D,OAAO,SAAS,CAAC,MAAM,EAAE,cAAc,OAAO,WAAW,MAAM,EAAE,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC;QACxF,CAAC;QAED,KAAK,cAAc;YACjB,kBAAkB,CAAC,OAAO,CAAC,CAAC;YAC5B,OAAO,SAAS,CAAC,MAAM,EAAE,cAAc,OAAO,eAAe,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC;QAEpF,KAAK,OAAO;YACV,kBAAkB,CAAC,OAAO,CAAC,CAAC;YAC5B,OAAO,UAAU,CAAC,MAAM,EAAE,cAAc,OAAO,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,SAAS,CAAC,CAAC;QAElF,KAAK,QAAQ,CAAC,CAAC,CAAC;YACd,kBAAkB,CAAC,OAAO,CAAC,CAAC;YAC5B,sEAAsE;YACtE,kEAAkE;YAClE,iEAAiE;YACjE,sEAAsE;YACtE,yEAAyE;YACzE,MAAM,SAAS,CAAC,MAAM,EAAE,cAAc,OAAO,iBAAiB,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC;YACnF,OAAO;gBACL,OAAO,EAAE,IAAI;gBACb,IAAI,EAAE;oBACJ,OAAO;oBACP,QAAQ,EAAE,eAAe;oBACzB,QAAQ,EAAE,IAAI;iBACf;aACF,CAAC;QACJ,CAAC;QAED,KAAK,SAAS;YACZ,MAAM,IAAI,mBAAmB,CAC3B,SAAS,EACT,4FAA4F,CAC7F,CAAC;QAEJ,KAAK,YAAY;YACf,MAAM,IAAI,mBAAmB,CAC3B,YAAY,EACZ,oFAAoF;gBAClF,8FAA8F,CACjG,CAAC;QAEJ;YACE,OAAO,qBAAqB,CAAC;IAC/B,CAAC;AACH,CAAC"}
+{"version":3,"file":"agent-key-mode.js","sourceRoot":"","sources":["../src/agent-key-mode.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACnD,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAC/C,OAAO,EACL,kBAAkB,EAClB,eAAe,EACf,oBAAoB,EACpB,iBAAiB,EACjB,kBAAkB,EAClB,kBAAkB,GACnB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AAOzD,0FAA0F;AAC1F,MAAM,OAAO,sBAAuB,SAAQ,KAAK;IAC/C,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,wBAAwB,CAAC;IACvC,CAAC;CACF;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,qBAAqB,CACnC,MAA0C,OAAO,CAAC,GAAG;IAErD,MAAM,SAAS,GAAG,GAAG,CAAC,mBAAmB,CAAC,CAAC;IAC3C,4EAA4E;IAC5E,qEAAqE;IACrE,2EAA2E;IAC3E,6DAA6D;IAC7D,IAAI,SAAS,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IAEzC,4EAA4E;IAC5E,2EAA2E;IAC3E,2DAA2D;IAC3D,MAAM,MAAM,GAAG,SAAS,CAAC,IAAI,EAAE,CAAC;IAChC,IAAI,MAAM,KAAK,EAAE,EAAE,CAAC;QAClB,MAAM,IAAI,sBAAsB,CAC9B,4DAA4D;YAC1D,oEAAoE;YACpE,yCAAyC;YACzC,uEAAuE,CAC1E,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAClC,MAAM,IAAI,sBAAsB,CAC9B,uEAAuE;YACrE,kEAAkE;YAClE,mDAAmD,CACtD,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,GAAG,CAAC,cAAc,CAAC,EAAE,IAAI,EAAE,CAAC;IAC5C,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,sBAAsB,CAC9B,yDAAyD;YACvD,8EAA8E;YAC9E,wEAAwE;YACxE,uEAAuE;YACvE,4DAA4D,CAC/D,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;AAC7B,CAAC;AAMD,KAAK,UAAU,QAAQ,CAAC,GAAa;IACnC,OAAO,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;AACtC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,MAAc,EACd,IAAY,EACZ,MAAc,EACd,IAAa,EACb,YAAuB,UAAU,CAAC,KAAK;IAEvC,MAAM,OAAO,GAA2B;QACtC,cAAc,EAAE,kBAAkB;QAClC,iBAAiB,EAAE,MAAM;KAC1B,CAAC;IACF,IAAI,GAAa,CAAC;IAClB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,SAAS,CAAC,GAAG,MAAM,GAAG,IAAI,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACrG,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,aAAa,CAAC,EAAE,KAAK,EAAE,kBAAkB,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC5G,MAAM,GAAG,CAAC;IACZ,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAC;IACjC,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,aAAa,CAAC,EAAE,KAAK,EAAE,kBAAkB,EAAE,IAAI,EAAE,UAAU,EAAE,GAAG,CAAC,MAAM,EAAE,KAAK,EAAE,QAAQ,GAAG,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QACxG,MAAM,IAAI,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IACjD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,MAAc,EACd,IAAY,EACZ,MAAc,EACd,YAAuB,UAAU,CAAC,KAAK;IAEvC,IAAI,GAAa,CAAC;IAClB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,SAAS,CAAC,GAAG,MAAM,GAAG,IAAI,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,iBAAiB,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;IACxF,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,aAAa,CAAC,EAAE,KAAK,EAAE,kBAAkB,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC5G,MAAM,GAAG,CAAC;IACZ,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAC;IACjC,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,aAAa,CAAC,EAAE,KAAK,EAAE,kBAAkB,EAAE,IAAI,EAAE,UAAU,EAAE,GAAG,CAAC,MAAM,EAAE,KAAK,EAAE,QAAQ,GAAG,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QACxG,MAAM,IAAI,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IACjD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,4EAA4E;AAE5E,2EAA2E;AAC3E,MAAM,CAAC,MAAM,qBAAqB,GAAG,MAAM,CAAC,uBAAuB,CAAC,CAAC;AAErE;;;;;;GAMG;AACH,MAAM,OAAO,mBAAoB,SAAQ,KAAK;IAC5C,YAAY,IAAY,EAAE,MAAc;QACtC,KAAK,CAAC,GAAG,IAAI,mEAAmE,MAAM,EAAE,CAAC,CAAC;QAC1F,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;IACpC,CAAC;CACF;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,MAAc,EACd,MAAyB,EACzB,IAAY,EACZ,OAAgB,EAChB,YAAuB,UAAU,CAAC,KAAK;IAEvC,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,MAAM,CAAC;IAEnC,QAAQ,IAAI,EAAE,CAAC;QACf,KAAK,UAAU,CAAC,CAAC,CAAC;YAChB,MAAM,IAAI,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;YACxC,OAAO,UAAU,CAAC,MAAM,EAAE,cAAc,OAAO,SAAS,EAAE,MAAM,EAAE;gBAChE,OAAO,EAAE,IAAI,CAAC,OAAO;gBACrB,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,UAAU,EAAE,IAAI,CAAC,UAAU;aAC5B,EAAE,SAAS,CAAC,CAAC;QAChB,CAAC;QAED,KAAK,QAAQ,CAAC,CAAC,CAAC;YACd,MAAM,IAAI,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;YACtC,MAAM,MAAM,GAAG,IAAI,eAAe,EAAE,CAAC;YACrC,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;YAChC,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS;gBAAE,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;YACtE,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS;gBAAE,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;YAC5D,IAAI,IAAI,CAAC,gBAAgB,KAAK,SAAS,EAAE,CAAC;gBACxC,MAAM,CAAC,GAAG,CAAC,kBAAkB,EAAE,IAAI,CAAC,gBAAgB,CAAC,CAAC;YACxD,CAAC;YACD,OAAO,SAAS,CAAC,MAAM,EAAE,cAAc,OAAO,WAAW,MAAM,EAAE,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC;QACxF,CAAC;QAED,KAAK,cAAc,CAAC,CAAC,CAAC;YACpB,MAAM,MAAM,GAAG,oBAAoB,CAAC,OAAO,CAAC,CAAC;YAC7C,MAAM,QAAQ,GAAG,IAAI,eAAe,EAAE,CAAC;YACvC,IAAI,MAAM,CAAC,gBAAgB,KAAK,SAAS;gBAAE,QAAQ,CAAC,GAAG,CAAC,kBAAkB,EAAE,MAAM,CAAC,gBAAgB,CAAC,CAAC;YACrG,IAAI,MAAM,CAAC,aAAa,KAAK,SAAS;gBAAE,QAAQ,CAAC,GAAG,CAAC,eAAe,EAAE,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC;YACpG,MAAM,IAAI,GAAG,QAAQ,CAAC,QAAQ,EAAE,CAAC;YACjC,MAAM,MAAM,GAAG,cAAc,OAAO,gBAAgB,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;YAC7E,OAAO,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC;QACtD,CAAC;QAED,KAAK,OAAO;YACV,kBAAkB,CAAC,OAAO,CAAC,CAAC;YAC5B,OAAO,UAAU,CAAC,MAAM,EAAE,cAAc,OAAO,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,SAAS,CAAC,CAAC;QAElF,KAAK,QAAQ,CAAC,CAAC,CAAC;YACd,kBAAkB,CAAC,OAAO,CAAC,CAAC;YAC5B,sEAAsE;YACtE,kEAAkE;YAClE,iEAAiE;YACjE,sEAAsE;YACtE,yEAAyE;YACzE,MAAM,SAAS,CAAC,MAAM,EAAE,cAAc,OAAO,iBAAiB,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC;YACnF,OAAO;gBACL,OAAO,EAAE,IAAI;gBACb,IAAI,EAAE;oBACJ,OAAO;oBACP,QAAQ,EAAE,eAAe;oBACzB,QAAQ,EAAE,IAAI;iBACf;aACF,CAAC;QACJ,CAAC;QAED,KAAK,YAAY,CAAC,CAAC,CAAC;YAClB,MAAM,IAAI,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAC;YACzC,OAAO,UAAU,CAAC,MAAM,EAAE,cAAc,OAAO,QAAQ,EAAE,MAAM,EAAE;gBAC/D,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;gBACvC,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,GAAG,CAAC,IAAI,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACnE,GAAG,CAAC,IAAI,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC7D,GAAG,CAAC,IAAI,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACtE,GAAG,CAAC,IAAI,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACtE,GAAG,CAAC,IAAI,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC1E,EAAE,SAAS,CAAC,CAAC;QAChB,CAAC;QAED,KAAK,YAAY,CAAC,CAAC,CAAC;YAClB,MAAM,IAAI,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAC;YACzC,MAAM,MAAM,GAAG,IAAI,eAAe,EAAE,CAAC;YACrC,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS;gBAAE,MAAM,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;YACjE,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;YACxC,MAAM,CAAC,GAAG,CAAC,YAAY,EAAE,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC;YAClD,OAAO,oBAAoB,CACzB,IAAI,EACJ,GAAG,EAAE,CAAC,SAAS,CAAC,MAAM,EAAE,cAAc,OAAO,UAAU,MAAM,EAAE,EAAE,MAAM,EAAE,SAAS,CAAC,EACnF,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,MAAM,EAAE,cAAc,OAAO,YAAY,EAAE,MAAM,EAAE,EAAE,UAAU,EAAE,EAAE,SAAS,CAAC,CACzG,CAAC;QACJ,CAAC;QAED,KAAK,SAAS;YACZ,MAAM,IAAI,mBAAmB,CAC3B,SAAS,EACT,4FAA4F,CAC7F,CAAC;QAEJ,KAAK,YAAY;YACf,MAAM,IAAI,mBAAmB,CAC3B,YAAY,EACZ,oFAAoF;gBAClF,8FAA8F,CACjG,CAAC;QAEJ;YACE,OAAO,qBAAqB,CAAC;IAC/B,CAAC;AACH,CAAC"}

package/dist/agent-preference.d.ts

@@ -7,18 +7,53 @@ export interface AgentPreference {
  * Persist agent preference (schemaVersion + ids, no secrets) under
  * ~/.aismemory/credentials.json with restrictive POSIX permissions
  * (dir 0700, file 0600). Replaces legacy token-based persistence.
+ *
+ * F6 (CORBOT-48DD2E25): writes via a tmp file + renameSync so a crash
+ * mid-write can never leave a truncated/corrupt credentials.json behind,
+ * and two processes racing this same path never interleave partial writes
+ * (mirrors the atomic-write pattern in config.ts:59-62).
  */
 export declare function saveAgentPreference(pref: {
     agentId: string;
     tenantId: string;
 }, home?: string): void;
+/**
+ * Migrate a legacy v1 credentials.json (token/agentId/tenantId/expiresAt) to
+ * the v2 schema (schemaVersion + ids only) IN PLACE, atomically — but ONLY
+ * when a device key is enrolled.
+ *
+ * F5a (CORBOT-48DD2E25): once a device key exists, the TokenManager mints
+ * its own tokens via key auth and the disk bearer is no longer needed —
+ * it must not survive past the first process start that observes both the
+ * v1 file and the enrolled key ("zero secrets at rest" was false for that
+ * window before this fix; the bearer used to live on disk until the next
+ * unrelated write).
+ *
+ * F5b (CORBOT-48DD2E25): when NO device key is enrolled, migrating here
+ * would strand that cohort with neither a live disk token nor a key to
+ * silently re-auth with — every silent stdio respawn would then demand a
+ * fresh browser bond, which 0.6.2 never did (it kept the token on disk and
+ * reconnected silently). So the v1 token is deliberately left in place
+ * until a key gets enrolled (this same check migrates it on the very next
+ * load) or a fresh device-flow completion overwrites the file.
+ *
+ * Best-effort: any read/parse/write failure is swallowed — migration must
+ * never block startup or credential loading. `home`/`hasKey` are
+ * parameterized for tests; production callers use the defaults.
+ */
+export declare function migrateCredentialsFileIfNeeded(home?: string, hasKey?: () => boolean): void;
 /**
  * Load agent preference from ~/.aismemory/credentials.json.
  * Handles both v2 files (agentId/tenantId only) and legacy v1 files
  * (token/agentId/tenantId/expiresAt) — returns ids only.
  * Returns null if file is missing or corrupt.
+ *
+ * Triggers migrateCredentialsFileIfNeeded() first (F5a/F5b) so every
+ * caller on this path — including the TokenManager's per-acquire
+ * resolveIdentity() in index.ts — helps migrate a v1 file left over from
+ * before the device key was enrolled.
  */
-export declare function loadAgentPreference(home?: string): {
+export declare function loadAgentPreference(home?: string, hasKey?: () => boolean): {
     agentId: string;
     tenantId: string;
 } | null;

package/dist/agent-preference.js

@@ -1,14 +1,26 @@
-import { chmodSync, existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
+import { chmodSync, existsSync, mkdirSync, readFileSync, renameSync, writeFileSync } from 'node:fs';
 import { homedir } from 'node:os';
+import { join } from 'node:path';
 import { credentialsDir, credentialsFilePath } from './oauth-credentials.js';
+import { hasEnrolledKey } from './key-auth.js';
+/** Default hasKey() check for `home`, wired to the real on-disk key store. */
+function defaultHasKey(home) {
+    return () => hasEnrolledKey({ keysDir: join(home, '.aismemory', 'keys') });
+}
 /**
  * Persist agent preference (schemaVersion + ids, no secrets) under
  * ~/.aismemory/credentials.json with restrictive POSIX permissions
  * (dir 0700, file 0600). Replaces legacy token-based persistence.
+ *
+ * F6 (CORBOT-48DD2E25): writes via a tmp file + renameSync so a crash
+ * mid-write can never leave a truncated/corrupt credentials.json behind,
+ * and two processes racing this same path never interleave partial writes
+ * (mirrors the atomic-write pattern in config.ts:59-62).
  */
 export function saveAgentPreference(pref, home = homedir()) {
     const dir = credentialsDir(home);
     const file = credentialsFilePath(home);
+    const tmp = `${file}.tmp`;
     // Create directory with restrictive permissions (0700)
     mkdirSync(dir, { recursive: true, mode: 0o700 });
     // Write the file with schemaVersion + ids (no legacy token/expiresAt)
@@ -17,19 +29,83 @@ export function saveAgentPreference(pref, home = homedir()) {
         agentId: pref.agentId,
         tenantId: pref.tenantId,
     };
-    writeFileSync(file, JSON.stringify(data, null, 2), { mode: 0o600 });
+    writeFileSync(tmp, JSON.stringify(data, null, 2), { mode: 0o600 });
+    renameSync(tmp, file);
     // chmod is the reliable path on POSIX
     if (process.platform !== 'win32') {
         chmodSync(file, 0o600);
     }
 }
+/**
+ * Migrate a legacy v1 credentials.json (token/agentId/tenantId/expiresAt) to
+ * the v2 schema (schemaVersion + ids only) IN PLACE, atomically — but ONLY
+ * when a device key is enrolled.
+ *
+ * F5a (CORBOT-48DD2E25): once a device key exists, the TokenManager mints
+ * its own tokens via key auth and the disk bearer is no longer needed —
+ * it must not survive past the first process start that observes both the
+ * v1 file and the enrolled key ("zero secrets at rest" was false for that
+ * window before this fix; the bearer used to live on disk until the next
+ * unrelated write).
+ *
+ * F5b (CORBOT-48DD2E25): when NO device key is enrolled, migrating here
+ * would strand that cohort with neither a live disk token nor a key to
+ * silently re-auth with — every silent stdio respawn would then demand a
+ * fresh browser bond, which 0.6.2 never did (it kept the token on disk and
+ * reconnected silently). So the v1 token is deliberately left in place
+ * until a key gets enrolled (this same check migrates it on the very next
+ * load) or a fresh device-flow completion overwrites the file.
+ *
+ * Best-effort: any read/parse/write failure is swallowed — migration must
+ * never block startup or credential loading. `home`/`hasKey` are
+ * parameterized for tests; production callers use the defaults.
+ */
+export function migrateCredentialsFileIfNeeded(home = homedir(), hasKey = defaultHasKey(home)) {
+    const file = credentialsFilePath(home);
+    try {
+        if (!existsSync(file))
+            return;
+        const raw = readFileSync(file, 'utf-8');
+        const parsed = JSON.parse(raw);
+        // Already v2 (or an unrecognized shape) — nothing to migrate.
+        if (typeof parsed['token'] !== 'string')
+            return;
+        const agentId = parsed['agentId'];
+        const tenantId = parsed['tenantId'];
+        if (typeof agentId !== 'string' || typeof tenantId !== 'string')
+            return;
+        // F5b: do not strand the no-enrolled-key cohort.
+        if (!hasKey())
+            return;
+        const dir = credentialsDir(home);
+        const tmp = `${file}.tmp`;
+        mkdirSync(dir, { recursive: true, mode: 0o700 });
+        const data = { schemaVersion: 2, agentId, tenantId };
+        writeFileSync(tmp, JSON.stringify(data, null, 2), { mode: 0o600 });
+        renameSync(tmp, file);
+        if (process.platform !== 'win32') {
+            chmodSync(file, 0o600);
+        }
+    }
+    catch {
+        // Best-effort — a migration failure must never block startup. The
+        // existing v1-tolerant parse in loadAgentPreference (below) and
+        // loadCredentials (index.ts) still work even if migration didn't run.
+    }
+}
 /**
  * Load agent preference from ~/.aismemory/credentials.json.
  * Handles both v2 files (agentId/tenantId only) and legacy v1 files
  * (token/agentId/tenantId/expiresAt) — returns ids only.
  * Returns null if file is missing or corrupt.
+ *
+ * Triggers migrateCredentialsFileIfNeeded() first (F5a/F5b) so every
+ * caller on this path — including the TokenManager's per-acquire
+ * resolveIdentity() in index.ts — helps migrate a v1 file left over from
+ * before the device key was enrolled.
  */
-export function loadAgentPreference(home = homedir()) {
+export function loadAgentPreference(home = homedir(), hasKey = defaultHasKey(home)) {
+    migrateCredentialsFileIfNeeded(home, hasKey);
     const file = credentialsFilePath(home);
     try {
         if (!existsSync(file))

package/dist/agent-preference.js.map

@@ -1 +1 @@
-{"version":3,"file":"agent-preference.js","sourceRoot":"","sources":["../src/agent-preference.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACxF,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,cAAc,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAQ7E;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CACjC,IAA2C,EAC3C,OAAe,OAAO,EAAE;IAExB,MAAM,GAAG,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;IACjC,MAAM,IAAI,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC;IAEvC,uDAAuD;IACvD,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAEjD,sEAAsE;IACtE,MAAM,IAAI,GAAG;QACX,aAAa,EAAE,CAAC;QAChB,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,QAAQ,EAAE,IAAI,CAAC,QAAQ;KACxB,CAAC;IAEF,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAEpE,sCAAsC;IACtC,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QACjC,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACzB,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CAAC,OAAe,OAAO,EAAE;IAI1D,MAAM,IAAI,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC;IACvC,IAAI,CAAC;QACH,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;QAEnC,MAAM,OAAO,GAAG,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QAC5C,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAA4B,CAAC;QAE9D,uEAAuE;QACvE,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;QAC/B,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;QAEjC,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ,EAAE,CAAC;YAChE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC;QAC/B,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC"}
+{"version":3,"file":"agent-preference.js","sourceRoot":"","sources":["../src/agent-preference.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACpG,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,cAAc,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAC7E,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAQ/C,8EAA8E;AAC9E,SAAS,aAAa,CAAC,IAAY;IACjC,OAAO,GAAG,EAAE,CAAC,cAAc,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,IAAI,EAAE,YAAY,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;AAC7E,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,mBAAmB,CACjC,IAA2C,EAC3C,OAAe,OAAO,EAAE;IAExB,MAAM,GAAG,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;IACjC,MAAM,IAAI,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC;IACvC,MAAM,GAAG,GAAG,GAAG,IAAI,MAAM,CAAC;IAE1B,uDAAuD;IACvD,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAEjD,sEAAsE;IACtE,MAAM,IAAI,GAAG;QACX,aAAa,EAAE,CAAC;QAChB,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,QAAQ,EAAE,IAAI,CAAC,QAAQ;KACxB,CAAC;IAEF,aAAa,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACnE,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAEtB,sCAAsC;IACtC,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QACjC,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACzB,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,UAAU,8BAA8B,CAC5C,OAAe,OAAO,EAAE,EACxB,SAAwB,aAAa,CAAC,IAAI,CAAC;IAE3C,MAAM,IAAI,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC;IACvC,IAAI,CAAC;QACH,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,OAAO;QAE9B,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QACxC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAA4B,CAAC;QAE1D,8DAA8D;QAC9D,IAAI,OAAO,MAAM,CAAC,OAAO,CAAC,KAAK,QAAQ;YAAE,OAAO;QAEhD,MAAM,OAAO,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC;QAClC,MAAM,QAAQ,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC;QACpC,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ;YAAE,OAAO;QAExE,iDAAiD;QACjD,IAAI,CAAC,MAAM,EAAE;YAAE,OAAO;QAEtB,MAAM,GAAG,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;QACjC,MAAM,GAAG,GAAG,GAAG,IAAI,MAAM,CAAC;QAC1B,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACjD,MAAM,IAAI,GAAG,EAAE,aAAa,EAAE,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC;QACrD,aAAa,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACnE,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QACtB,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;YACjC,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QACzB,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,kEAAkE;QAClE,gEAAgE;QAChE,sEAAsE;IACxE,CAAC;AACH,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,mBAAmB,CACjC,OAAe,OAAO,EAAE,EACxB,SAAwB,aAAa,CAAC,IAAI,CAAC;IAK3C,8BAA8B,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAE7C,MAAM,IAAI,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC;IACvC,IAAI,CAAC;QACH,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;QAEnC,MAAM,OAAO,GAAG,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QAC5C,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAA4B,CAAC;QAE9D,uEAAuE;QACvE,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;QAC/B,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;QAEjC,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ,EAAE,CAAC;YAChE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC;QAC/B,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC"}

package/dist/ais-http.d.ts

@@ -0,0 +1,6 @@
+/**
+ * AIS HTTP helpers — extracted from index.ts for reuse without MCP side effects.
+ * CORBOT-282AE4FE
+ */
+export declare function aisPost(path: string, body: unknown, token?: string): Promise<unknown>;
+export declare function aisGet(path: string, token: string): Promise<unknown>;

package/dist/ais-http.js

@@ -0,0 +1,75 @@
+/**
+ * AIS HTTP helpers — extracted from index.ts for reuse without MCP side effects.
+ * CORBOT-282AE4FE
+ */
+import { isAuthErrorResult } from './auth-staleness.js';
+import { AisHttpError } from './ais-http-error.js';
+import { emitTelemetry } from './telemetry.js';
+const AIS_URL = process.env['AIS_URL'] ?? 'https://ais.agentsandswarms.ai';
+export async function aisPost(path, body, token) {
+    const headers = { 'Content-Type': 'application/json' };
+    if (token)
+        headers['Authorization'] = `Bearer ${token}`;
+    let res;
+    try {
+        res = await fetch(`${AIS_URL}${path}`, {
+            method: 'POST',
+            headers,
+            body: JSON.stringify(body),
+        });
+    }
+    catch (err) {
+        emitTelemetry({
+            event: 'ais.http.failure',
+            path,
+            error: err instanceof Error ? err.message : String(err),
+        });
+        throw err;
+    }
+    const data = await res.json().catch(() => null);
+    if (!res.ok) {
+        emitTelemetry({
+            event: 'ais.http.failure',
+            path,
+            httpStatus: res.status,
+            error: `HTTP ${res.status}`,
+        });
+        // Token-rejection bodies feed the silent re-auth-and-retry loop; every
+        // other non-2xx must throw so a failed write surfaces as an MCP error
+        // instead of being mistaken for a successful one.
+        if (isAuthErrorResult(data))
+            return data;
+        throw new AisHttpError(res.status, path, data);
+    }
+    return data;
+}
+export async function aisGet(path, token) {
+    let res;
+    try {
+        res = await fetch(`${AIS_URL}${path}`, {
+            headers: { 'Authorization': `Bearer ${token}` },
+        });
+    }
+    catch (err) {
+        emitTelemetry({
+            event: 'ais.http.failure',
+            path,
+            error: err instanceof Error ? err.message : String(err),
+        });
+        throw err;
+    }
+    const data = await res.json().catch(() => null);
+    if (!res.ok) {
+        emitTelemetry({
+            event: 'ais.http.failure',
+            path,
+            httpStatus: res.status,
+            error: `HTTP ${res.status}`,
+        });
+        if (isAuthErrorResult(data))
+            return data;
+        throw new AisHttpError(res.status, path, data);
+    }
+    return data;
+}
+//# sourceMappingURL=ais-http.js.map

package/dist/ais-http.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ais-http.js","sourceRoot":"","sources":["../src/ais-http.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AACxD,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACnD,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAE/C,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,gCAAgC,CAAC;AAE3E,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,IAAY,EAAE,IAAa,EAAE,KAAc;IACvE,MAAM,OAAO,GAA2B,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC;IAC/E,IAAI,KAAK;QAAE,OAAO,CAAC,eAAe,CAAC,GAAG,UAAU,KAAK,EAAE,CAAC;IACxD,IAAI,GAAa,CAAC;IAClB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,OAAO,GAAG,IAAI,EAAE,EAAE;YACrC,MAAM,EAAE,MAAM;YACd,OAAO;YACP,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;SAC3B,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,aAAa,CAAC;YACZ,KAAK,EAAE,kBAAkB;YACzB,IAAI;YACJ,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;SACxD,CAAC,CAAC;QACH,MAAM,GAAG,CAAC;IACZ,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;IAChD,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,aAAa,CAAC;YACZ,KAAK,EAAE,kBAAkB;YACzB,IAAI;YACJ,UAAU,EAAE,GAAG,CAAC,MAAM;YACtB,KAAK,EAAE,QAAQ,GAAG,CAAC,MAAM,EAAE;SAC5B,CAAC,CAAC;QACH,uEAAuE;QACvE,sEAAsE;QACtE,kDAAkD;QAClD,IAAI,iBAAiB,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;QACzC,MAAM,IAAI,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IACjD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,MAAM,CAAC,IAAY,EAAE,KAAa;IACtD,IAAI,GAAa,CAAC;IAClB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,OAAO,GAAG,IAAI,EAAE,EAAE;YACrC,OAAO,EAAE,EAAE,eAAe,EAAE,UAAU,KAAK,EAAE,EAAE;SAChD,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,aAAa,CAAC;YACZ,KAAK,EAAE,kBAAkB;YACzB,IAAI;YACJ,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;SACxD,CAAC,CAAC;QACH,MAAM,GAAG,CAAC;IACZ,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;IAChD,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,aAAa,CAAC;YACZ,KAAK,EAAE,kBAAkB;YACzB,IAAI;YACJ,UAAU,EAAE,GAAG,CAAC,MAAM;YACtB,KAAK,EAAE,QAAQ,GAAG,CAAC,MAAM,EAAE;SAC5B,CAAC,CAAC;QACH,IAAI,iBAAiB,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;QACzC,MAAM,IAAI,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IACjD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/inbox-client.d.ts

@@ -0,0 +1,9 @@
+import type { InboxReadArgs } from './tool-args.js';
+/**
+ * Reads one inbox page via `getPage`, then acks the returned messageIds via
+ * `ackMessages` when `args.ack` is set. Both callbacks return AIS's raw
+ * response body (as `aisGet`/`aisPost`/`aisKeyGet`/`aisKeyPost` already do);
+ * an auth-error body from either call is returned as-is so the caller's
+ * existing re-auth-and-retry loop (`isAuthErrorResult`) still fires.
+ */
+export declare function readInboxAndMaybeAck(args: InboxReadArgs, getPage: () => Promise<unknown>, ackMessages: (messageIds: string[]) => Promise<unknown>): Promise<unknown>;

package/dist/inbox-client.js

@@ -0,0 +1,74 @@
+/**
+ * Client-side composition for `inbox_read` (CORBOT-7115B8AE).
+ *
+ * AIS's own `inbox_read` MCP handler
+ * (agent-identity-service/src/mcp/handlers/agent-inbox-handlers.ts) folds a
+ * conditional ack into one call because it already holds the
+ * AgentMessageService in-process. This package instead talks to AIS over
+ * REST (GET /v1/agents/:agentId/inbox, POST .../inbox/ack), so the same
+ * "read a page, then ack what it returned" composition has to happen here —
+ * shaped to match handleInboxRead's result exactly (messages, nextCursor,
+ * unreadRemaining?, acked?) so a caller sees the same contract regardless of
+ * which AIS entrypoint served it.
+ */
+import { isAuthErrorResult } from './auth-staleness.js';
+/** Mirrors AIS core/inbox/types.ts MAX_ACK_IDS. A page never exceeds it (MAX_PAGE_SIZE === MAX_ACK_IDS), so no chunking is needed. */
+const MAX_ACK_IDS = 100;
+function isInboxMessageArray(value) {
+    return (Array.isArray(value) &&
+        value.every((item) => typeof item === 'object' && item !== null && typeof item.messageId === 'string'));
+}
+function isInboxListResponse(value) {
+    if (typeof value !== 'object' || value === null)
+        return false;
+    const r = value;
+    if (r.success !== true || typeof r.data !== 'object' || r.data === null)
+        return false;
+    const d = r.data;
+    return isInboxMessageArray(d.messages) && (typeof d.nextCursor === 'string' || d.nextCursor === null) && typeof d.hasMore === 'boolean';
+}
+function isAckResponse(value) {
+    if (typeof value !== 'object' || value === null)
+        return false;
+    const r = value;
+    if (r.success !== true || typeof r.data !== 'object' || r.data === null)
+        return false;
+    const acked = r.data.acked;
+    return Array.isArray(acked) && acked.every((id) => typeof id === 'string');
+}
+/**
+ * Reads one inbox page via `getPage`, then acks the returned messageIds via
+ * `ackMessages` when `args.ack` is set. Both callbacks return AIS's raw
+ * response body (as `aisGet`/`aisPost`/`aisKeyGet`/`aisKeyPost` already do);
+ * an auth-error body from either call is returned as-is so the caller's
+ * existing re-auth-and-retry loop (`isAuthErrorResult`) still fires.
+ */
+export async function readInboxAndMaybeAck(args, getPage, ackMessages) {
+    const page = await getPage();
+    if (isAuthErrorResult(page))
+        return page;
+    if (!isInboxListResponse(page)) {
+        // AIS's response envelope changed shape underneath us — surface it
+        // verbatim rather than guessing, same as every other tool's `result`.
+        return page;
+    }
+    const { messages, nextCursor, hasMore } = page.data;
+    const result = { messages, nextCursor };
+    if (args.ack && messages.length > 0) {
+        const ids = messages.slice(0, MAX_ACK_IDS).map((m) => m.messageId);
+        const ackResult = await ackMessages(ids);
+        if (isAuthErrorResult(ackResult))
+            return ackResult;
+        result.acked = isAckResponse(ackResult) ? ackResult.data.acked : ids;
+    }
+    else if (args.ack) {
+        result.acked = [];
+    }
+    // Exact only when this read reached the end of the unread stream — see
+    // handleInboxRead's identical comment in agent-inbox-handlers.ts.
+    if (args.unreadOnly && !hasMore) {
+        result.unreadRemaining = args.ack ? 0 : messages.length;
+    }
+    return { success: true, data: result };
+}
+//# sourceMappingURL=inbox-client.js.map

package/dist/inbox-client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"inbox-client.js","sourceRoot":"","sources":["../src/inbox-client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAGxD,sIAAsI;AACtI,MAAM,WAAW,GAAG,GAAG,CAAC;AAMxB,SAAS,mBAAmB,CAAC,KAAc;IACzC,OAAO,CACL,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QACpB,KAAK,CAAC,KAAK,CACT,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI,IAAI,OAAQ,IAAgC,CAAC,SAAS,KAAK,QAAQ,CACvH,CACF,CAAC;AACJ,CAAC;AAWD,SAAS,mBAAmB,CAAC,KAAc;IACzC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IAC9D,MAAM,CAAC,GAAG,KAA8C,CAAC;IACzD,IAAI,CAAC,CAAC,OAAO,KAAK,IAAI,IAAI,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,CAAC,IAAI,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IACtF,MAAM,CAAC,GAAG,CAAC,CAAC,IAAuE,CAAC;IACpF,OAAO,mBAAmB,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,UAAU,KAAK,QAAQ,IAAI,CAAC,CAAC,UAAU,KAAK,IAAI,CAAC,IAAI,OAAO,CAAC,CAAC,OAAO,KAAK,SAAS,CAAC;AAC1I,CAAC;AAOD,SAAS,aAAa,CAAC,KAAc;IACnC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IAC9D,MAAM,CAAC,GAAG,KAA8C,CAAC;IACzD,IAAI,CAAC,CAAC,OAAO,KAAK,IAAI,IAAI,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,CAAC,IAAI,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IACtF,MAAM,KAAK,GAAI,CAAC,CAAC,IAA4B,CAAC,KAAK,CAAC;IACpD,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,OAAO,EAAE,KAAK,QAAQ,CAAC,CAAC;AAC7E,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,IAAmB,EACnB,OAA+B,EAC/B,WAAuD;IAEvD,MAAM,IAAI,GAAG,MAAM,OAAO,EAAE,CAAC;IAC7B,IAAI,iBAAiB,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACzC,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,EAAE,CAAC;QAC/B,mEAAmE;QACnE,sEAAsE;QACtE,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,EAAE,QAAQ,EAAE,UAAU,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC;IACpD,MAAM,MAAM,GAKR,EAAE,QAAQ,EAAE,UAAU,EAAE,CAAC;IAE7B,IAAI,IAAI,CAAC,GAAG,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACpC,MAAM,GAAG,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QACnE,MAAM,SAAS,GAAG,MAAM,WAAW,CAAC,GAAG,CAAC,CAAC;QACzC,IAAI,iBAAiB,CAAC,SAAS,CAAC;YAAE,OAAO,SAAS,CAAC;QACnD,MAAM,CAAC,KAAK,GAAG,aAAa,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC;IACvE,CAAC;SAAM,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;QACpB,MAAM,CAAC,KAAK,GAAG,EAAE,CAAC;IACpB,CAAC;IAED,uEAAuE;IACvE,kEAAkE;IAClE,IAAI,IAAI,CAAC,UAAU,IAAI,CAAC,OAAO,EAAE,CAAC;QAChC,MAAM,CAAC,eAAe,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC;IAC1D,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;AACzC,CAAC"}