blun-king-cli 9.1.257 → 9.1.258

package/bin/identity-context-policy.cjs

@@ -1,6 +1,7 @@
 const fs = require('node:fs');
 const os = require('node:os');
 const path = require('node:path');
+const { recordIdentityJournalCandidate } = require('./identity-journal-policy.cjs');
 
 const MAX_FILE_BYTES = 64 * 1024;
 const DEFAULT_MAX_CHARS = 1800;
@@ -206,7 +207,22 @@ function recordChannelIdentity(envelope, env = process.env) {
     purpose: '',
     relevant_roles: [],
   })) created.push('group');
-  return { actor_id: actorId, ...(groupId ? { group_id: groupId } : {}), created };
+  const journal = created.includes('relationship') && firstSeenAt
+    ? recordIdentityJournalCandidate({
+      kind: 'first_interaction',
+      tenant_id: tenantId,
+      agent_id: agentId,
+      actor_id: actorId,
+      ...(groupId ? { group_id: groupId } : {}),
+      occurred_at: firstSeenAt,
+    }, env)
+    : undefined;
+  return {
+    actor_id: actorId,
+    ...(groupId ? { group_id: groupId } : {}),
+    created,
+    ...(journal ? { journal } : {}),
+  };
 }
 
 function identitySystemBlock(env = process.env) {

package/bin/identity-journal-policy.cjs

@@ -0,0 +1,104 @@
+'use strict';
+
+const crypto = require('node:crypto');
+const fs = require('node:fs');
+const os = require('node:os');
+const path = require('node:path');
+
+const SAFE_ID_RE = /^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/u;
+const ALLOWED_KINDS = new Set(['first_interaction']);
+
+function enabled(env) {
+  return /^(?:1|true)$/iu.test(String(env.BLUN_IDENTITY_JOURNAL ?? '').trim());
+}
+
+function safeId(value) {
+  const normalized = String(value ?? '').trim();
+  return SAFE_ID_RE.test(normalized) ? normalized : '';
+}
+
+function isInside(parent, child) {
+  const relative = path.relative(parent, child);
+  return relative === '' || (!relative.startsWith(`..${path.sep}`) && relative !== '..' && !path.isAbsolute(relative));
+}
+
+function resolvedRoot(env) {
+  const configuredHome = String(env.BLUN_SHARED_HOME ?? env.BLUN_HOME ?? '').trim();
+  const home = path.resolve(configuredHome || path.join(os.homedir(), '.blun'));
+  const configuredRoot = String(env.BLUN_IDENTITY_ROOT ?? '').trim();
+  const root = path.resolve(configuredRoot || path.join(home, 'identity'));
+  if (!isInside(home, root)) return '';
+  try {
+    if (fs.lstatSync(root).isSymbolicLink()) return '';
+    const realHome = fs.realpathSync(home);
+    const realRoot = fs.realpathSync(root);
+    return isInside(realHome, realRoot) ? realRoot : '';
+  } catch {
+    return '';
+  }
+}
+
+function trustedTimestamp(value) {
+  const text = String(value ?? '').trim();
+  if (!text || text.length > 64 || Number.isNaN(Date.parse(text))) return '';
+  return text;
+}
+
+function createJsonOnce(root, target, value) {
+  if (!isInside(root, target)) return false;
+  let handle;
+  try {
+    const parent = path.dirname(target);
+    fs.mkdirSync(parent, { recursive: true });
+    if (!isInside(root, fs.realpathSync(parent))) return false;
+    handle = fs.openSync(target, 'wx', 0o600);
+    fs.writeFileSync(handle, `${JSON.stringify(value, null, 2)}\n`, 'utf8');
+    fs.fsyncSync(handle);
+    return true;
+  } catch {
+    return false;
+  } finally {
+    if (handle !== undefined) fs.closeSync(handle);
+  }
+}
+
+function recordIdentityJournalCandidate(signal, env = process.env) {
+  if (!enabled(env) || !signal || typeof signal !== 'object') return undefined;
+  const kind = String(signal.kind ?? '').trim();
+  const tenantId = safeId(signal.tenant_id);
+  const configuredTenantId = safeId(env.BLUN_IDENTITY_TENANT_ID);
+  const agentId = safeId(signal.agent_id);
+  const configuredAgentId = safeId(env.BLUN_AGENT_ID);
+  const actorId = safeId(signal.actor_id);
+  const groupId = safeId(signal.group_id);
+  const occurredAt = trustedTimestamp(signal.occurred_at);
+  if (!ALLOWED_KINDS.has(kind)
+      || !tenantId || tenantId !== configuredTenantId
+      || !agentId || agentId !== configuredAgentId
+      || !actorId || !occurredAt
+      || (signal.group_id !== undefined && !groupId)) return undefined;
+
+  const root = resolvedRoot(env);
+  if (!root) return undefined;
+  const identity = [kind, tenantId, agentId, actorId, groupId, occurredAt].join('\0');
+  const candidateId = crypto.createHash('sha256').update(identity).digest('hex').slice(0, 32);
+  const target = path.resolve(root, 'agents', agentId, 'journal', 'candidates', `${candidateId}.json`);
+  const value = {
+    version: 1,
+    candidate_id: candidateId,
+    status: 'pending',
+    kind,
+    tenant_id: tenantId,
+    agent_id: agentId,
+    actor_id: actorId,
+    ...(groupId ? { group_id: groupId } : {}),
+    occurred_at: occurredAt,
+    source: 'trusted_channel_metadata',
+  };
+  return {
+    candidate_id: candidateId,
+    created: createJsonOnce(root, target, value),
+  };
+}
+
+module.exports = { recordIdentityJournalCandidate };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "blun-king-cli",
-  "version": "9.1.257",
+  "version": "9.1.258",
   "description": "BLUN CLI - your own AI agent with a Telegram channel. Get it done. With BLUN.",
   "license": "MIT",
   "bin": {