blun-king-cli 9.1.387 → 9.1.388

package/bin/cognitive-memory-adapter.cjs

@@ -2,7 +2,7 @@
 
 const { openCognitiveStateStore } = require('./cognitive-state-store.cjs');
 
-const COGNITIVE_MEMORY_ADAPTER_VERSION = 2;
+const COGNITIVE_MEMORY_ADAPTER_VERSION = 3;
 const KIND_RE = /^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$/u;
 const ACCESS_KEYS = Object.freeze([
   'actorId', 'agentId', 'channelId', 'conversationId', 'permissionContext',
@@ -69,6 +69,46 @@ function normalizeMemoryAccess(access, request) {
   return Object.freeze(normalized);
 }
 
+function isInternalAgentAccess(access) {
+  return access.userId === access.agentId
+    && access.actorId === access.agentId
+    && access.portalId === 'cli'
+    && access.channelId === 'runtime'
+    && access.requestedScope === 'agent:memory'
+    && access.permissionContext.authority === 'runtime_internal'
+    && access.permissionContext.receiptId === access.conversationId;
+}
+
+function assertVisibleScope(scope, access) {
+  if (!isInternalAgentAccess(access) && safeId(scope) !== access.requestedScope) {
+    fail('COGNITIVE_MEMORY_VISIBILITY_DENIED');
+  }
+}
+
+function assertCommitAccess(input, access) {
+  if (isInternalAgentAccess(access)) return;
+  if (!Array.isArray(input?.observations) || input.observations.length < 1) {
+    fail('COGNITIVE_MEMORY_VISIBILITY_DENIED');
+  }
+  for (const observation of input.observations) assertVisibleScope(observation?.scope, access);
+  if (safeId(input?.source?.provider) !== access.portalId
+      || safeId(input?.source?.actor_id) !== access.actorId
+      || safeId(input?.source?.context_id) !== access.conversationId) {
+    fail('COGNITIVE_MEMORY_SOURCE_MISMATCH');
+  }
+}
+
+function projectReadableState(state, access) {
+  if (isInternalAgentAccess(access)) return state;
+  if (!state || typeof state !== 'object' || !Array.isArray(state.observations)) {
+    fail('COGNITIVE_MEMORY_ADAPTER_INVALID');
+  }
+  return {
+    ...state,
+    observations: state.observations.filter((item) => safeId(item?.scope) === access.requestedScope),
+  };
+}
+
 function assertCognitiveMemoryAdapter(adapter) {
   if (!adapter || typeof adapter !== 'object' || Array.isArray(adapter)) {
     fail('COGNITIVE_MEMORY_ADAPTER_INVALID');
@@ -88,17 +128,41 @@ function guardCognitiveMemoryAdapter(adapter) {
   const guarded = {
     contractVersion: raw.contractVersion,
     kind: raw.kind,
-    commit: (input, access) => raw.commit(input, normalizeMemoryAccess(access, input)),
-    read: (input, access) => raw.read(input, normalizeMemoryAccess(access, input)),
+    commit: (input, access) => {
+      const normalizedAccess = normalizeMemoryAccess(access, input);
+      assertCommitAccess(input, normalizedAccess);
+      return raw.commit(input, normalizedAccess);
+    },
+    read: (input, access) => {
+      const normalizedAccess = normalizeMemoryAccess(access, input);
+      return projectReadableState(raw.read(input, normalizedAccess), normalizedAccess);
+    },
     hasEvent: (input, access) => {
-      if (!exactKeys(input, ['agentId', 'eventId', 'tenantId']) || !safeId(input.eventId)) {
+      if (!exactKeys(input, ['agentId', 'eventId', 'tenantId', 'visibilityScope'])
+          || !safeId(input.eventId) || !safeId(input.visibilityScope)) {
         fail('COGNITIVE_MEMORY_ACCESS_INVALID');
       }
-      return raw.hasEvent(input, normalizeMemoryAccess(access, input));
+      const normalizedAccess = normalizeMemoryAccess(access, input);
+      assertVisibleScope(input.visibilityScope, normalizedAccess);
+      return raw.hasEvent(input, normalizedAccess);
+    },
+    verify: (input, access) => {
+      const normalizedAccess = normalizeMemoryAccess(access, input);
+      const result = raw.verify(input, normalizedAccess);
+      if (isInternalAgentAccess(normalizedAccess)) return result;
+      if (!result || typeof result.valid !== 'boolean') fail('COGNITIVE_MEMORY_ADAPTER_INVALID');
+      return { valid: result.valid };
+    },
+    claimAttention: (input, access) => {
+      const normalizedAccess = normalizeMemoryAccess(access, input);
+      assertVisibleScope(input?.candidate?.evidence_scope, normalizedAccess);
+      return raw.claimAttention(input, normalizedAccess);
+    },
+    authorizeAttention: (input, access) => {
+      const normalizedAccess = normalizeMemoryAccess(access, input);
+      assertVisibleScope(input?.candidate?.evidence_scope, normalizedAccess);
+      return raw.authorizeAttention(input, normalizedAccess);
     },
-    verify: (input, access) => raw.verify(input, normalizeMemoryAccess(access, input)),
-    claimAttention: (input, access) => raw.claimAttention(input, normalizeMemoryAccess(access, input)),
-    authorizeAttention: (input, access) => raw.authorizeAttention(input, normalizeMemoryAccess(access, input)),
     close: () => raw.close(),
   };
   return Object.freeze(guarded);
@@ -110,7 +174,10 @@ function createLocalCognitiveMemoryAdapter({ home } = {}) {
     contractVersion: COGNITIVE_MEMORY_ADAPTER_VERSION,
     kind: 'local-cognitive-event-store',
     commit: (input) => store.commit(input),
-    read: (input) => store.read(input),
+    read: (input, access) => store.read({
+      ...input,
+      visibilityScope: isInternalAgentAccess(access) ? 'agent:memory' : access.requestedScope,
+    }),
     hasEvent: (input) => store.hasEvent(input),
     verify: (input) => store.verify(input),
     claimAttention: (input) => store.claimAttention(input),

package/bin/cognitive-state-store.cjs

@@ -167,6 +167,8 @@ function initialize(db) {
     );
     CREATE INDEX IF NOT EXISTS cognitive_observations_stream
       ON cognitive_observations (tenant_id, agent_id, occurred_at, observation_id);
+    CREATE INDEX IF NOT EXISTS cognitive_observations_visibility
+      ON cognitive_observations (tenant_id, agent_id, scope, occurred_at, observation_id);
     CREATE TABLE IF NOT EXISTS cognitive_attention_claims (
       tenant_id TEXT NOT NULL,
       candidate_id TEXT NOT NULL,
@@ -262,14 +264,20 @@ function openCognitiveStateStore({ home } = {}) {
     }
   }
 
-  function read({ tenantId, agentId } = {}) {
+  function read({ tenantId, agentId, visibilityScope } = {}) {
     const tenant = safeId(tenantId);
     const agent = safeId(agentId);
-    if (!tenant || !agent) fail('COGNITIVE_INVALID_EVENT');
+    const requestedVisibility = visibilityScope === undefined ? '' : safeId(visibilityScope);
+    if (!tenant || !agent || (visibilityScope !== undefined && !requestedVisibility)) {
+      fail('COGNITIVE_INVALID_EVENT');
+    }
     const stream = db.prepare('SELECT version, updated_at FROM cognitive_streams WHERE tenant_id = ? AND agent_id = ?').get(tenant, agent);
-    const rows = db.prepare(`SELECT domain, fact_key, value_text, confidence, epistemic_state, scope, source_json, occurred_at, observation_id,
-      supersedes_observation_id, withdraws_observation_id
-      FROM cognitive_observations WHERE tenant_id = ? AND agent_id = ? ORDER BY occurred_at, rowid`).all(tenant, agent);
+    const select = `SELECT domain, fact_key, value_text, confidence, epistemic_state, scope, source_json, occurred_at, observation_id,
+      supersedes_observation_id, withdraws_observation_id FROM cognitive_observations`;
+    const rows = requestedVisibility && requestedVisibility !== 'agent:memory'
+      ? db.prepare(`${select} WHERE tenant_id = ? AND agent_id = ? AND scope = ? ORDER BY occurred_at, rowid`)
+        .all(tenant, agent, requestedVisibility)
+      : db.prepare(`${select} WHERE tenant_id = ? AND agent_id = ? ORDER BY occurred_at, rowid`).all(tenant, agent);
     return {
       version: Number(stream?.version ?? 0),
       ...(stream?.updated_at ? { updated_at: stream.updated_at } : {}),
@@ -295,8 +303,16 @@ function openCognitiveStateStore({ home } = {}) {
       const event = safeId(input.eventId);
       const tenant = safeId(input.tenantId);
       const agent = safeId(input.agentId);
-      if (keys.length !== 3 || !keys.every((key) => ['agentId', 'eventId', 'tenantId'].includes(key))
-          || !event || !tenant || !agent) fail('COGNITIVE_INVALID_EVENT');
+      const visibilityScope = safeId(input.visibilityScope);
+      if (keys.length !== 4
+          || !keys.every((key) => ['agentId', 'eventId', 'tenantId', 'visibilityScope'].includes(key))
+          || !event || !tenant || !agent || !visibilityScope) fail('COGNITIVE_INVALID_EVENT');
+      if (visibilityScope !== 'agent:memory') {
+        return Boolean(db.prepare(`SELECT 1 AS found FROM cognitive_events AS event
+          INNER JOIN cognitive_observations AS observation ON observation.event_id = event.event_id
+          WHERE event.event_id = ? AND event.tenant_id = ? AND event.agent_id = ? AND observation.scope = ?
+          LIMIT 1`).get(event, tenant, agent, visibilityScope));
+      }
       return Boolean(db.prepare(`SELECT 1 AS found FROM cognitive_events
         WHERE event_id = ? AND tenant_id = ? AND agent_id = ?`).get(event, tenant, agent));
     }

package/bin/cognitive-turn-lifecycle.cjs

@@ -147,7 +147,9 @@ function createCognitiveTurnLifecycle({
   function commitDurableStage(stageKey, observations) {
     if (stageResults.has(stageKey)) return { ...stageResults.get(stageKey), idempotent: true };
     const eventId = digestId('durable', [tenant, agent, stageKey]);
-    if (store.hasEvent({ eventId, tenantId: tenant, agentId: agent }, internalMemoryAccess)) {
+    if (store.hasEvent({
+      eventId, tenantId: tenant, agentId: agent, visibilityScope: 'agent:memory',
+    }, internalMemoryAccess)) {
       const result = { idempotent: true };
       stageResults.set(stageKey, result);
       return result;
@@ -158,7 +160,9 @@ function createCognitiveTurnLifecycle({
       ...item,
     }));
     for (let attempt = 0; attempt < 4; attempt += 1) {
-      if (store.hasEvent({ eventId, tenantId: tenant, agentId: agent }, internalMemoryAccess)) {
+      if (store.hasEvent({
+        eventId, tenantId: tenant, agentId: agent, visibilityScope: 'agent:memory',
+      }, internalMemoryAccess)) {
         const result = { idempotent: true };
         stageResults.set(stageKey, result);
         return result;

package/bin/personality-memory-adapter.cjs

@@ -102,7 +102,10 @@ function createPersonalityMemoryAdapter({ identityRoot, memoryAdapter } = {}) {
         receiptId: eventId,
       },
     };
-    if (store.hasEvent({ eventId, tenantId: value.tenantId, agentId: value.agentId }, memoryAccess)) {
+    if (store.hasEvent({
+      eventId, tenantId: value.tenantId, agentId: value.agentId,
+      visibilityScope: relationshipScope(value.actorId),
+    }, memoryAccess)) {
       return { claimed: true, idempotent: true };
     }
     const claim = store.claimAttention({

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "blun-king-cli",
-  "version": "9.1.387",
+  "version": "9.1.388",
   "description": "BLUN CLI - your own AI agent with a Telegram channel. Get it done. With BLUN.",
   "license": "MIT",
   "bin": {