blun-king-cli 9.1.385 → 9.1.387

package/bin/cognitive-attention-runtime.cjs

@@ -20,7 +20,7 @@ function safeId(value) {
   return SAFE_ID_RE.test(text) ? text : '';
 }
 
-function authorizeAttentionCandidate({ store, tenantId, currentAgent, now, input } = {}) {
+function authorizeAttentionCandidate({ store, tenantId, currentAgent, now, input, memoryAccess } = {}) {
   if (!store || typeof store.authorizeAttention !== 'function' || typeof now !== 'function'
       || !exactKeys(input, new Set(['candidate', 'channel', 'authorization']))) fail();
   const tenant = safeId(tenantId);
@@ -61,7 +61,7 @@ function authorizeAttentionCandidate({ store, tenantId, currentAgent, now, input
     receiptId,
     authority,
     authorizedAt: new Date(issuedAtMs).toISOString(),
-  });
+  }, memoryAccess);
   if (!admitted.claimed) {
     return {
       accepted: false,

package/bin/cognitive-memory-adapter.cjs

@@ -0,0 +1,135 @@
+'use strict';
+
+const { openCognitiveStateStore } = require('./cognitive-state-store.cjs');
+
+const COGNITIVE_MEMORY_ADAPTER_VERSION = 2;
+const KIND_RE = /^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$/u;
+const ACCESS_KEYS = Object.freeze([
+  'actorId', 'agentId', 'channelId', 'conversationId', 'permissionContext',
+  'portalId', 'requestedScope', 'tenantId', 'userId',
+]);
+const PERMISSION_KEYS = Object.freeze(['authority', 'decision', 'receiptId']);
+const REQUIRED_METHODS = Object.freeze([
+  'commit',
+  'read',
+  'hasEvent',
+  'verify',
+  'claimAttention',
+  'authorizeAttention',
+  'close',
+]);
+
+function fail(code) {
+  const error = new Error(code);
+  error.code = code;
+  throw error;
+}
+
+function exactKeys(value, expected) {
+  return value && typeof value === 'object' && !Array.isArray(value)
+    && Object.keys(value).sort().join('\0') === [...expected].sort().join('\0');
+}
+
+function safeId(value) {
+  const text = String(value ?? '').trim();
+  return KIND_RE.test(text) ? text : '';
+}
+
+function normalizeMemoryAccess(access, request) {
+  if (!exactKeys(access, ACCESS_KEYS) || !exactKeys(access.permissionContext, PERMISSION_KEYS)) {
+    fail('COGNITIVE_MEMORY_ACCESS_INVALID');
+  }
+  const normalized = {
+    tenantId: safeId(access.tenantId),
+    userId: safeId(access.userId),
+    actorId: safeId(access.actorId),
+    agentId: safeId(access.agentId),
+    portalId: safeId(access.portalId),
+    channelId: safeId(access.channelId),
+    conversationId: safeId(access.conversationId),
+    requestedScope: safeId(access.requestedScope),
+    permissionContext: {
+      authority: safeId(access.permissionContext.authority),
+      decision: String(access.permissionContext.decision ?? ''),
+      receiptId: safeId(access.permissionContext.receiptId),
+    },
+  };
+  if (!normalized.tenantId || !normalized.userId || !normalized.actorId || !normalized.agentId
+      || !normalized.portalId || !normalized.channelId || !normalized.conversationId
+      || !normalized.requestedScope || !normalized.permissionContext.authority
+      || !normalized.permissionContext.receiptId) fail('COGNITIVE_MEMORY_ACCESS_INVALID');
+  if (normalized.permissionContext.decision !== 'passed') fail('COGNITIVE_MEMORY_ACCESS_DENIED');
+  const requestTenant = safeId(request?.tenantId);
+  const requestAgent = safeId(request?.agentId ?? request?.candidate?.responsible_agent ?? request?.claimedBy);
+  if (!requestTenant || !requestAgent
+      || requestTenant !== normalized.tenantId || requestAgent !== normalized.agentId) {
+    fail('COGNITIVE_MEMORY_ACCESS_SCOPE_MISMATCH');
+  }
+  normalized.permissionContext = Object.freeze(normalized.permissionContext);
+  return Object.freeze(normalized);
+}
+
+function assertCognitiveMemoryAdapter(adapter) {
+  if (!adapter || typeof adapter !== 'object' || Array.isArray(adapter)) {
+    fail('COGNITIVE_MEMORY_ADAPTER_INVALID');
+  }
+  if (adapter.contractVersion !== COGNITIVE_MEMORY_ADAPTER_VERSION) {
+    fail('COGNITIVE_MEMORY_ADAPTER_VERSION_UNSUPPORTED');
+  }
+  if (!KIND_RE.test(String(adapter.kind ?? ''))
+      || REQUIRED_METHODS.some((method) => typeof adapter[method] !== 'function')) {
+    fail('COGNITIVE_MEMORY_ADAPTER_INVALID');
+  }
+  return adapter;
+}
+
+function guardCognitiveMemoryAdapter(adapter) {
+  const raw = assertCognitiveMemoryAdapter(adapter);
+  const guarded = {
+    contractVersion: raw.contractVersion,
+    kind: raw.kind,
+    commit: (input, access) => raw.commit(input, normalizeMemoryAccess(access, input)),
+    read: (input, access) => raw.read(input, normalizeMemoryAccess(access, input)),
+    hasEvent: (input, access) => {
+      if (!exactKeys(input, ['agentId', 'eventId', 'tenantId']) || !safeId(input.eventId)) {
+        fail('COGNITIVE_MEMORY_ACCESS_INVALID');
+      }
+      return raw.hasEvent(input, normalizeMemoryAccess(access, input));
+    },
+    verify: (input, access) => raw.verify(input, normalizeMemoryAccess(access, input)),
+    claimAttention: (input, access) => raw.claimAttention(input, normalizeMemoryAccess(access, input)),
+    authorizeAttention: (input, access) => raw.authorizeAttention(input, normalizeMemoryAccess(access, input)),
+    close: () => raw.close(),
+  };
+  return Object.freeze(guarded);
+}
+
+function createLocalCognitiveMemoryAdapter({ home } = {}) {
+  const store = openCognitiveStateStore({ home });
+  return guardCognitiveMemoryAdapter({
+    contractVersion: COGNITIVE_MEMORY_ADAPTER_VERSION,
+    kind: 'local-cognitive-event-store',
+    commit: (input) => store.commit(input),
+    read: (input) => store.read(input),
+    hasEvent: (input) => store.hasEvent(input),
+    verify: (input) => store.verify(input),
+    claimAttention: (input) => store.claimAttention(input),
+    authorizeAttention: (input) => store.authorizeAttention(input),
+    close: () => store.close(),
+  });
+}
+
+function openCognitiveMemoryAdapter({ home, adapter } = {}) {
+  return adapter === undefined
+    ? createLocalCognitiveMemoryAdapter({ home })
+    : guardCognitiveMemoryAdapter(adapter);
+}
+
+module.exports = {
+  COGNITIVE_MEMORY_ADAPTER_VERSION,
+  REQUIRED_METHODS,
+  assertCognitiveMemoryAdapter,
+  createLocalCognitiveMemoryAdapter,
+  normalizeMemoryAccess,
+  openCognitiveMemoryAdapter,
+};

package/bin/cognitive-state-store.cjs

@@ -289,8 +289,18 @@ function openCognitiveStateStore({ home } = {}) {
     };
   }
 
-  function hasEvent(eventId) {
-    const event = safeId(eventId);
+  function hasEvent(input) {
+    if (input && typeof input === 'object' && !Array.isArray(input)) {
+      const keys = Object.keys(input);
+      const event = safeId(input.eventId);
+      const tenant = safeId(input.tenantId);
+      const agent = safeId(input.agentId);
+      if (keys.length !== 3 || !keys.every((key) => ['agentId', 'eventId', 'tenantId'].includes(key))
+          || !event || !tenant || !agent) fail('COGNITIVE_INVALID_EVENT');
+      return Boolean(db.prepare(`SELECT 1 AS found FROM cognitive_events
+        WHERE event_id = ? AND tenant_id = ? AND agent_id = ?`).get(event, tenant, agent));
+    }
+    const event = safeId(input);
     if (!event) fail('COGNITIVE_INVALID_EVENT');
     return Boolean(db.prepare('SELECT 1 AS found FROM cognitive_events WHERE event_id = ?').get(event));
   }

package/bin/cognitive-turn-lifecycle.cjs

@@ -3,7 +3,7 @@
 const crypto = require('node:crypto');
 const fs = require('node:fs');
 const path = require('node:path');
-const { openCognitiveStateStore } = require('./cognitive-state-store.cjs');
+const { openCognitiveMemoryAdapter } = require('./cognitive-memory-adapter.cjs');
 const { buildCognitiveContextProjection } = require('./cognitive-context-projection.cjs');
 const { buildCognitiveFocusProjection } = require('./cognitive-focus-projection.cjs');
 const { authorizeAttentionCandidate } = require('./cognitive-attention-runtime.cjs');
@@ -69,12 +69,34 @@ function identityFromManifest(home) {
   }
 }
 
-function createCognitiveTurnLifecycle({ home, tenantId, agentId, runtimeId, now = () => new Date().toISOString() } = {}) {
+function createCognitiveTurnLifecycle({
+  home,
+  tenantId,
+  agentId,
+  runtimeId,
+  memoryAdapter,
+  now = () => new Date().toISOString(),
+} = {}) {
   const tenant = safeId(tenantId);
   const agent = safeId(agentId);
   const runtime = safeId(runtimeId ?? `runtime-${process.pid}-${Date.now()}`);
   if (!tenant || !agent || !runtime || typeof now !== 'function') fail('COGNITIVE_LIFECYCLE_INVALID');
-  const store = openCognitiveStateStore({ home });
+  const store = openCognitiveMemoryAdapter({ home, adapter: memoryAdapter });
+  const internalMemoryAccess = Object.freeze({
+    tenantId: tenant,
+    userId: agent,
+    actorId: agent,
+    agentId: agent,
+    portalId: 'cli',
+    channelId: 'runtime',
+    conversationId: runtime,
+    requestedScope: 'agent:memory',
+    permissionContext: Object.freeze({
+      authority: 'runtime_internal',
+      decision: 'passed',
+      receiptId: runtime,
+    }),
+  });
   const stageTimes = new Map();
   const stageResults = new Map();
 
@@ -97,7 +119,7 @@ function createCognitiveTurnLifecycle({ home, tenantId, agentId, runtimeId, now
       ...item,
     }));
     for (let attempt = 0; attempt < 4; attempt += 1) {
-      const expectedVersion = store.read({ tenantId: tenant, agentId: agent }).version;
+      const expectedVersion = store.read({ tenantId: tenant, agentId: agent }, internalMemoryAccess).version;
       try {
         const result = store.commit({
           tenantId: tenant,
@@ -112,7 +134,7 @@ function createCognitiveTurnLifecycle({ home, tenantId, agentId, runtimeId, now
             message_id: stageKey,
           },
           observations: normalized,
-        });
+        }, internalMemoryAccess);
         stageResults.set(stageKey, result);
         return result;
       } catch (error) {
@@ -125,7 +147,7 @@ function createCognitiveTurnLifecycle({ home, tenantId, agentId, runtimeId, now
   function commitDurableStage(stageKey, observations) {
     if (stageResults.has(stageKey)) return { ...stageResults.get(stageKey), idempotent: true };
     const eventId = digestId('durable', [tenant, agent, stageKey]);
-    if (store.hasEvent(eventId)) {
+    if (store.hasEvent({ eventId, tenantId: tenant, agentId: agent }, internalMemoryAccess)) {
       const result = { idempotent: true };
       stageResults.set(stageKey, result);
       return result;
@@ -136,12 +158,12 @@ function createCognitiveTurnLifecycle({ home, tenantId, agentId, runtimeId, now
       ...item,
     }));
     for (let attempt = 0; attempt < 4; attempt += 1) {
-      if (store.hasEvent(eventId)) {
+      if (store.hasEvent({ eventId, tenantId: tenant, agentId: agent }, internalMemoryAccess)) {
         const result = { idempotent: true };
         stageResults.set(stageKey, result);
         return result;
       }
-      const expectedVersion = store.read({ tenantId: tenant, agentId: agent }).version;
+      const expectedVersion = store.read({ tenantId: tenant, agentId: agent }, internalMemoryAccess).version;
       try {
         const result = store.commit({
           tenantId: tenant,
@@ -156,7 +178,7 @@ function createCognitiveTurnLifecycle({ home, tenantId, agentId, runtimeId, now
             message_id: stageKey,
           },
           observations: normalized,
-        });
+        }, internalMemoryAccess);
         stageResults.set(stageKey, result);
         return result;
       } catch (error) {
@@ -281,8 +303,23 @@ function createCognitiveTurnLifecycle({ home, tenantId, agentId, runtimeId, now
       ...(correction ? { supersedes: targetObservationId } : { withdraws: targetObservationId }),
     };
     const normalizedOccurredAt = new Date(occurredAt).toISOString();
+    const revisionMemoryAccess = {
+      tenantId: tenant,
+      userId: normalizedSource.actor_id,
+      actorId: normalizedSource.actor_id,
+      agentId: agent,
+      portalId: normalizedSource.provider,
+      channelId: normalizedSource.provider,
+      conversationId: normalizedSource.context_id,
+      requestedScope: scope,
+      permissionContext: {
+        authority: input.authority,
+        decision: 'passed',
+        receiptId: requestId,
+      },
+    };
     for (let attempt = 0; attempt < 4; attempt += 1) {
-      const current = store.read({ tenantId: tenant, agentId: agent });
+      const current = store.read({ tenantId: tenant, agentId: agent }, revisionMemoryAccess);
       const existing = current.observations.find((item) => item.observation_id === observationId);
       if (existing) {
         const matches = existing.domain === observation.domain && existing.key === observation.key
@@ -310,7 +347,7 @@ function createCognitiveTurnLifecycle({ home, tenantId, agentId, runtimeId, now
           occurredAt: normalizedOccurredAt,
           source: normalizedSource,
           observations: [observation],
-        });
+        }, revisionMemoryAccess);
       } catch (error) {
         if (error?.code !== 'COGNITIVE_VERSION_CONFLICT' || attempt === 3) throw error;
       }
@@ -407,7 +444,7 @@ function createCognitiveTurnLifecycle({ home, tenantId, agentId, runtimeId, now
     if (!exactKeys(input, new Set(['turnId', 'focusScopes']))) fail('COGNITIVE_LIFECYCLE_INVALID');
     const turnId = safeTurnId(input.turnId);
     if (turnId === null) fail('COGNITIVE_LIFECYCLE_INVALID');
-    const state = store.read({ tenantId: tenant, agentId: agent });
+    const state = store.read({ tenantId: tenant, agentId: agent }, internalMemoryAccess);
     const continuity = buildCognitiveContextProjection(state, {
       currentTurnId: turnId,
       currentRuntimeId: runtime,
@@ -417,12 +454,30 @@ function createCognitiveTurnLifecycle({ home, tenantId, agentId, runtimeId, now
   }
 
   function authorizeAttention(input) {
+    const candidate = input?.candidate;
+    const authorization = input?.authorization;
+    const memoryAccess = {
+      tenantId: tenant,
+      userId: String(candidate?.subject_id ?? ''),
+      actorId: agent,
+      agentId: agent,
+      portalId: 'cli',
+      channelId: String(input?.channel ?? ''),
+      conversationId: runtime,
+      requestedScope: String(candidate?.evidence_scope ?? ''),
+      permissionContext: {
+        authority: String(authorization?.authority ?? ''),
+        decision: authorization?.decision === 'passed' ? 'passed' : 'blocked',
+        receiptId: String(authorization?.receiptId ?? ''),
+      },
+    };
     return authorizeAttentionCandidate({
       store,
       tenantId: tenant,
       currentAgent: agent,
       now,
       input,
+      memoryAccess,
     });
   }
 
@@ -438,13 +493,21 @@ function createCognitiveTurnLifecycle({ home, tenantId, agentId, runtimeId, now
     authorizeAttention,
     projectForTurn,
     endTurn,
-    read: () => store.read({ tenantId: tenant, agentId: agent }),
-    verify: () => store.verify({ tenantId: tenant, agentId: agent }),
+    read: () => store.read({ tenantId: tenant, agentId: agent }, internalMemoryAccess),
+    verify: () => store.verify({ tenantId: tenant, agentId: agent }, internalMemoryAccess),
     close: () => store.close(),
   };
 }
 
-function createRuntimeCognitiveTurnLifecycle({ home, agentName, tenantId, agentId, runtimeId, now } = {}) {
+function createRuntimeCognitiveTurnLifecycle({
+  home,
+  agentName,
+  tenantId,
+  agentId,
+  runtimeId,
+  memoryAdapter,
+  now,
+} = {}) {
   const resolvedHome = String(home ?? '').trim();
   const resolvedAgent = String(agentName ?? '').trim();
   if (!resolvedHome || !resolvedAgent) fail('COGNITIVE_LIFECYCLE_INVALID');
@@ -464,6 +527,7 @@ function createRuntimeCognitiveTurnLifecycle({ home, agentName, tenantId, agentI
     tenantId: hasSharedIdentity ? identity.tenantId : digestId('home', [resolvedHome.toLowerCase()]),
     agentId: hasSharedIdentity ? identity.agentId : digestId('agent', [resolvedAgent.toLowerCase()]),
     runtimeId,
+    memoryAdapter,
     now,
   });
 }

package/bin/personality-memory-adapter.cjs

@@ -3,7 +3,7 @@
 const crypto = require('node:crypto');
 const fs = require('node:fs');
 const path = require('node:path');
-const { openCognitiveStateStore } = require('./cognitive-state-store.cjs');
+const { openCognitiveMemoryAdapter } = require('./cognitive-memory-adapter.cjs');
 
 const SAFE_ID_RE = /^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$/u;
 const SENSITIVITIES = new Set(['low', 'medium']);
@@ -65,7 +65,7 @@ function normalizePresentation(input) {
   return normalized;
 }
 
-function createPersonalityMemoryAdapter({ identityRoot } = {}) {
+function createPersonalityMemoryAdapter({ identityRoot, memoryAdapter } = {}) {
   const root = path.resolve(String(identityRoot ?? ''));
   try {
     const stat = fs.lstatSync(root);
@@ -78,7 +78,7 @@ function createPersonalityMemoryAdapter({ identityRoot } = {}) {
   }
   const realRoot = fs.realpathSync(root);
   const home = path.dirname(realRoot);
-  const store = openCognitiveStateStore({ home });
+  const store = openCognitiveMemoryAdapter({ home, adapter: memoryAdapter });
 
   function claimCuriosityPresentation(input) {
     const value = normalizePresentation(input);
@@ -87,7 +87,24 @@ function createPersonalityMemoryAdapter({ identityRoot } = {}) {
       value.tenantId, value.agentId, value.actorId, value.sourcePortal, value.sourceChannel,
       value.conversationId, value.messageId, value.occurredAt, value.topic,
     ]);
-    if (store.hasEvent(eventId)) return { claimed: true, idempotent: true };
+    const memoryAccess = {
+      tenantId: value.tenantId,
+      userId: value.actorId,
+      actorId: value.actorId,
+      agentId: value.agentId,
+      portalId: value.sourcePortal,
+      channelId: value.sourceChannel,
+      conversationId: value.conversationId,
+      requestedScope: relationshipScope(value.actorId),
+      permissionContext: {
+        authority: 'runtime_personality_policy',
+        decision: 'passed',
+        receiptId: eventId,
+      },
+    };
+    if (store.hasEvent({ eventId, tenantId: value.tenantId, agentId: value.agentId }, memoryAccess)) {
+      return { claimed: true, idempotent: true };
+    }
     const claim = store.claimAttention({
       tenantId: value.tenantId,
       candidate: {
@@ -107,10 +124,10 @@ function createPersonalityMemoryAdapter({ identityRoot } = {}) {
       },
       claimedBy: value.agentId,
       claimedAt: value.occurredAt,
-    });
+    }, memoryAccess);
     if (!claim.claimed) return { claimed: false, next_allowed_at: claim.next_allowed_at };
     for (let attempt = 0; attempt < 3; attempt += 1) {
-      const current = store.read({ tenantId: value.tenantId, agentId: value.agentId });
+      const current = store.read({ tenantId: value.tenantId, agentId: value.agentId }, memoryAccess);
       try {
         store.commit({
           tenantId: value.tenantId,
@@ -133,7 +150,7 @@ function createPersonalityMemoryAdapter({ identityRoot } = {}) {
             epistemic_state: 'verified',
             scope: relationshipScope(value.actorId),
           }],
-        });
+        }, memoryAccess);
         return { claimed: true, idempotent: false };
       } catch (error) {
         if (error?.code !== 'COGNITIVE_VERSION_CONFLICT' || attempt === 2) throw error;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "blun-king-cli",
-  "version": "9.1.385",
+  "version": "9.1.387",
   "description": "BLUN CLI - your own AI agent with a Telegram channel. Get it done. With BLUN.",
   "license": "MIT",
   "bin": {