blun-king-cli 9.1.387 → 9.1.389

package/bin/cognitive-memory-adapter.cjs

@@ -2,7 +2,7 @@
 
 const { openCognitiveStateStore } = require('./cognitive-state-store.cjs');
 
-const COGNITIVE_MEMORY_ADAPTER_VERSION = 2;
+const COGNITIVE_MEMORY_ADAPTER_VERSION = 4;
 const KIND_RE = /^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$/u;
 const ACCESS_KEYS = Object.freeze([
   'actorId', 'agentId', 'channelId', 'conversationId', 'permissionContext',
@@ -69,6 +69,47 @@ function normalizeMemoryAccess(access, request) {
   return Object.freeze(normalized);
 }
 
+function isInternalAgentAccess(access) {
+  return access.userId === access.agentId
+    && access.actorId === access.agentId
+    && access.portalId === 'cli'
+    && access.channelId === 'runtime'
+    && access.requestedScope === 'agent:memory'
+    && access.permissionContext.authority === 'runtime_internal'
+    && access.permissionContext.receiptId === access.conversationId;
+}
+
+function assertVisibleScope(scope, access) {
+  if (!isInternalAgentAccess(access) && safeId(scope) !== access.requestedScope) {
+    fail('COGNITIVE_MEMORY_VISIBILITY_DENIED');
+  }
+}
+
+function assertCommitAccess(input, access) {
+  if (isInternalAgentAccess(access)) return;
+  if (!Array.isArray(input?.observations) || input.observations.length < 1) {
+    fail('COGNITIVE_MEMORY_VISIBILITY_DENIED');
+  }
+  for (const observation of input.observations) assertVisibleScope(observation?.scope, access);
+  if (safeId(input?.source?.provider) !== access.portalId
+      || safeId(input?.source?.channel_id) !== access.channelId
+      || safeId(input?.source?.actor_id) !== access.actorId
+      || safeId(input?.source?.context_id) !== access.conversationId) {
+    fail('COGNITIVE_MEMORY_SOURCE_MISMATCH');
+  }
+}
+
+function projectReadableState(state, access) {
+  if (isInternalAgentAccess(access)) return state;
+  if (!state || typeof state !== 'object' || !Array.isArray(state.observations)) {
+    fail('COGNITIVE_MEMORY_ADAPTER_INVALID');
+  }
+  return {
+    ...state,
+    observations: state.observations.filter((item) => safeId(item?.scope) === access.requestedScope),
+  };
+}
+
 function assertCognitiveMemoryAdapter(adapter) {
   if (!adapter || typeof adapter !== 'object' || Array.isArray(adapter)) {
     fail('COGNITIVE_MEMORY_ADAPTER_INVALID');
@@ -88,17 +129,41 @@ function guardCognitiveMemoryAdapter(adapter) {
   const guarded = {
     contractVersion: raw.contractVersion,
     kind: raw.kind,
-    commit: (input, access) => raw.commit(input, normalizeMemoryAccess(access, input)),
-    read: (input, access) => raw.read(input, normalizeMemoryAccess(access, input)),
+    commit: (input, access) => {
+      const normalizedAccess = normalizeMemoryAccess(access, input);
+      assertCommitAccess(input, normalizedAccess);
+      return raw.commit(input, normalizedAccess);
+    },
+    read: (input, access) => {
+      const normalizedAccess = normalizeMemoryAccess(access, input);
+      return projectReadableState(raw.read(input, normalizedAccess), normalizedAccess);
+    },
     hasEvent: (input, access) => {
-      if (!exactKeys(input, ['agentId', 'eventId', 'tenantId']) || !safeId(input.eventId)) {
+      if (!exactKeys(input, ['agentId', 'eventId', 'tenantId', 'visibilityScope'])
+          || !safeId(input.eventId) || !safeId(input.visibilityScope)) {
         fail('COGNITIVE_MEMORY_ACCESS_INVALID');
       }
-      return raw.hasEvent(input, normalizeMemoryAccess(access, input));
+      const normalizedAccess = normalizeMemoryAccess(access, input);
+      assertVisibleScope(input.visibilityScope, normalizedAccess);
+      return raw.hasEvent(input, normalizedAccess);
+    },
+    verify: (input, access) => {
+      const normalizedAccess = normalizeMemoryAccess(access, input);
+      const result = raw.verify(input, normalizedAccess);
+      if (isInternalAgentAccess(normalizedAccess)) return result;
+      if (!result || typeof result.valid !== 'boolean') fail('COGNITIVE_MEMORY_ADAPTER_INVALID');
+      return { valid: result.valid };
+    },
+    claimAttention: (input, access) => {
+      const normalizedAccess = normalizeMemoryAccess(access, input);
+      assertVisibleScope(input?.candidate?.evidence_scope, normalizedAccess);
+      return raw.claimAttention(input, normalizedAccess);
+    },
+    authorizeAttention: (input, access) => {
+      const normalizedAccess = normalizeMemoryAccess(access, input);
+      assertVisibleScope(input?.candidate?.evidence_scope, normalizedAccess);
+      return raw.authorizeAttention(input, normalizedAccess);
     },
-    verify: (input, access) => raw.verify(input, normalizeMemoryAccess(access, input)),
-    claimAttention: (input, access) => raw.claimAttention(input, normalizeMemoryAccess(access, input)),
-    authorizeAttention: (input, access) => raw.authorizeAttention(input, normalizeMemoryAccess(access, input)),
     close: () => raw.close(),
   };
   return Object.freeze(guarded);
@@ -110,7 +175,10 @@ function createLocalCognitiveMemoryAdapter({ home } = {}) {
     contractVersion: COGNITIVE_MEMORY_ADAPTER_VERSION,
     kind: 'local-cognitive-event-store',
     commit: (input) => store.commit(input),
-    read: (input) => store.read(input),
+    read: (input, access) => store.read({
+      ...input,
+      visibilityScope: isInternalAgentAccess(access) ? 'agent:memory' : access.requestedScope,
+    }),
     hasEvent: (input) => store.hasEvent(input),
     verify: (input) => store.verify(input),
     claimAttention: (input) => store.claimAttention(input),

package/bin/cognitive-memory-command.cjs

@@ -110,6 +110,7 @@ function matchesRevisionReplay(items, target, command, commandSource) {
       : item.withdraws === target.observationId && item.value === 'withdrawn';
     return linked
       && item.source?.provider === commandSource.source.provider
+      && item.source?.channel_id === commandSource.source.channelId
       && item.source?.actor_id === commandSource.source.actorId
       && item.source?.context_id === commandSource.source.contextId
       && item.source?.message_id === commandSource.source.messageId
@@ -133,6 +134,7 @@ function normalizeTelegramSource(source) {
     occurredAt: timestamp,
     source: {
       provider: 'telegram',
+      channelId: 'direct',
       actorId: `tg_user_${userId}`,
       contextId: `tg_chat_${chatId}`,
       messageId: `tg_message_${messageId}`,
@@ -153,6 +155,7 @@ function localSource({ env, sessionId, occurredAt, nonce }) {
     occurredAt,
     source: {
       provider: 'cli',
+      channelId: 'terminal',
       actorId: digestId('localuser', [actor]),
       contextId: digestId('clisession', [session]),
       messageId: digestId('cliinput', [unique]),

package/bin/cognitive-state-store.cjs

@@ -42,10 +42,11 @@ function exactKeys(value, keys) {
 }
 
 function normalizeSource(source) {
-  const allowed = new Set(['provider', 'actor_id', 'context_id', 'message_id']);
+  const allowed = new Set(['provider', 'channel_id', 'actor_id', 'context_id', 'message_id']);
   if (!exactKeys(source, allowed) || hasForbiddenKey(source)) fail('COGNITIVE_FORBIDDEN_FIELD');
   const normalized = {
     provider: safeId(source.provider),
+    channel_id: safeId(source.channel_id),
     actor_id: safeId(source.actor_id),
     context_id: safeId(source.context_id),
     message_id: safeId(source.message_id),
@@ -167,6 +168,8 @@ function initialize(db) {
     );
     CREATE INDEX IF NOT EXISTS cognitive_observations_stream
       ON cognitive_observations (tenant_id, agent_id, occurred_at, observation_id);
+    CREATE INDEX IF NOT EXISTS cognitive_observations_visibility
+      ON cognitive_observations (tenant_id, agent_id, scope, occurred_at, observation_id);
     CREATE TABLE IF NOT EXISTS cognitive_attention_claims (
       tenant_id TEXT NOT NULL,
       candidate_id TEXT NOT NULL,
@@ -262,14 +265,20 @@ function openCognitiveStateStore({ home } = {}) {
     }
   }
 
-  function read({ tenantId, agentId } = {}) {
+  function read({ tenantId, agentId, visibilityScope } = {}) {
     const tenant = safeId(tenantId);
     const agent = safeId(agentId);
-    if (!tenant || !agent) fail('COGNITIVE_INVALID_EVENT');
+    const requestedVisibility = visibilityScope === undefined ? '' : safeId(visibilityScope);
+    if (!tenant || !agent || (visibilityScope !== undefined && !requestedVisibility)) {
+      fail('COGNITIVE_INVALID_EVENT');
+    }
     const stream = db.prepare('SELECT version, updated_at FROM cognitive_streams WHERE tenant_id = ? AND agent_id = ?').get(tenant, agent);
-    const rows = db.prepare(`SELECT domain, fact_key, value_text, confidence, epistemic_state, scope, source_json, occurred_at, observation_id,
-      supersedes_observation_id, withdraws_observation_id
-      FROM cognitive_observations WHERE tenant_id = ? AND agent_id = ? ORDER BY occurred_at, rowid`).all(tenant, agent);
+    const select = `SELECT domain, fact_key, value_text, confidence, epistemic_state, scope, source_json, occurred_at, observation_id,
+      supersedes_observation_id, withdraws_observation_id FROM cognitive_observations`;
+    const rows = requestedVisibility && requestedVisibility !== 'agent:memory'
+      ? db.prepare(`${select} WHERE tenant_id = ? AND agent_id = ? AND scope = ? ORDER BY occurred_at, rowid`)
+        .all(tenant, agent, requestedVisibility)
+      : db.prepare(`${select} WHERE tenant_id = ? AND agent_id = ? ORDER BY occurred_at, rowid`).all(tenant, agent);
     return {
       version: Number(stream?.version ?? 0),
       ...(stream?.updated_at ? { updated_at: stream.updated_at } : {}),
@@ -295,8 +304,16 @@ function openCognitiveStateStore({ home } = {}) {
       const event = safeId(input.eventId);
       const tenant = safeId(input.tenantId);
       const agent = safeId(input.agentId);
-      if (keys.length !== 3 || !keys.every((key) => ['agentId', 'eventId', 'tenantId'].includes(key))
-          || !event || !tenant || !agent) fail('COGNITIVE_INVALID_EVENT');
+      const visibilityScope = safeId(input.visibilityScope);
+      if (keys.length !== 4
+          || !keys.every((key) => ['agentId', 'eventId', 'tenantId', 'visibilityScope'].includes(key))
+          || !event || !tenant || !agent || !visibilityScope) fail('COGNITIVE_INVALID_EVENT');
+      if (visibilityScope !== 'agent:memory') {
+        return Boolean(db.prepare(`SELECT 1 AS found FROM cognitive_events AS event
+          INNER JOIN cognitive_observations AS observation ON observation.event_id = event.event_id
+          WHERE event.event_id = ? AND event.tenant_id = ? AND event.agent_id = ? AND observation.scope = ?
+          LIMIT 1`).get(event, tenant, agent, visibilityScope));
+      }
       return Boolean(db.prepare(`SELECT 1 AS found FROM cognitive_events
         WHERE event_id = ? AND tenant_id = ? AND agent_id = ?`).get(event, tenant, agent));
     }

package/bin/cognitive-turn-lifecycle.cjs

@@ -129,6 +129,7 @@ function createCognitiveTurnLifecycle({
           occurredAt,
           source: {
             provider: 'runtime',
+            channel_id: 'runtime',
             actor_id: agent,
             context_id: runtime,
             message_id: stageKey,
@@ -147,7 +148,9 @@ function createCognitiveTurnLifecycle({
   function commitDurableStage(stageKey, observations) {
     if (stageResults.has(stageKey)) return { ...stageResults.get(stageKey), idempotent: true };
     const eventId = digestId('durable', [tenant, agent, stageKey]);
-    if (store.hasEvent({ eventId, tenantId: tenant, agentId: agent }, internalMemoryAccess)) {
+    if (store.hasEvent({
+      eventId, tenantId: tenant, agentId: agent, visibilityScope: 'agent:memory',
+    }, internalMemoryAccess)) {
       const result = { idempotent: true };
       stageResults.set(stageKey, result);
       return result;
@@ -158,7 +161,9 @@ function createCognitiveTurnLifecycle({
       ...item,
     }));
     for (let attempt = 0; attempt < 4; attempt += 1) {
-      if (store.hasEvent({ eventId, tenantId: tenant, agentId: agent }, internalMemoryAccess)) {
+      if (store.hasEvent({
+        eventId, tenantId: tenant, agentId: agent, visibilityScope: 'agent:memory',
+      }, internalMemoryAccess)) {
         const result = { idempotent: true };
         stageResults.set(stageKey, result);
         return result;
@@ -173,6 +178,7 @@ function createCognitiveTurnLifecycle({
           occurredAt,
           source: {
             provider: 'runtime',
+            channel_id: 'runtime',
             actor_id: agent,
             context_id: 'durable-focus',
             message_id: stageKey,
@@ -278,11 +284,12 @@ function createCognitiveTurnLifecycle({
     if (!requestId || !targetObservationId || !FOCUS_DOMAINS.has(domain) || !key
         || AUTHORITY_KEY_RE.test(key) || !scope || scope === 'runtime'
         || Number.isNaN(Date.parse(occurredAt))
-        || !exactKeys(source, new Set(['provider', 'actorId', 'contextId', 'messageId']))) {
+        || !exactKeys(source, new Set(['provider', 'channelId', 'actorId', 'contextId', 'messageId']))) {
       fail('COGNITIVE_REVISION_INVALID');
     }
     const normalizedSource = {
       provider: safeId(source.provider),
+      channel_id: safeId(source.channelId),
       actor_id: safeId(source.actorId),
       context_id: safeId(source.contextId),
       message_id: safeId(source.messageId),
@@ -309,7 +316,7 @@ function createCognitiveTurnLifecycle({
       actorId: normalizedSource.actor_id,
       agentId: agent,
       portalId: normalizedSource.provider,
-      channelId: normalizedSource.provider,
+      channelId: normalizedSource.channel_id,
       conversationId: normalizedSource.context_id,
       requestedScope: scope,
       permissionContext: {
@@ -328,6 +335,7 @@ function createCognitiveTurnLifecycle({
           && existing.supersedes === (observation.supersedes ?? null)
           && existing.withdraws === (observation.withdraws ?? null)
           && existing.source.provider === normalizedSource.provider
+          && existing.source.channel_id === normalizedSource.channel_id
           && existing.source.actor_id === normalizedSource.actor_id
           && existing.source.context_id === normalizedSource.context_id
           && existing.source.message_id === normalizedSource.message_id;

package/bin/personality-memory-adapter.cjs

@@ -102,7 +102,10 @@ function createPersonalityMemoryAdapter({ identityRoot, memoryAdapter } = {}) {
         receiptId: eventId,
       },
     };
-    if (store.hasEvent({ eventId, tenantId: value.tenantId, agentId: value.agentId }, memoryAccess)) {
+    if (store.hasEvent({
+      eventId, tenantId: value.tenantId, agentId: value.agentId,
+      visibilityScope: relationshipScope(value.actorId),
+    }, memoryAccess)) {
       return { claimed: true, idempotent: true };
     }
     const claim = store.claimAttention({
@@ -137,6 +140,7 @@ function createPersonalityMemoryAdapter({ identityRoot, memoryAdapter } = {}) {
           occurredAt: value.occurredAt,
           source: {
             provider: value.sourcePortal,
+            channel_id: value.sourceChannel,
             actor_id: value.actorId,
             context_id: value.conversationId,
             message_id: value.messageId,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "blun-king-cli",
-  "version": "9.1.387",
+  "version": "9.1.389",
   "description": "BLUN CLI - your own AI agent with a Telegram channel. Get it done. With BLUN.",
   "license": "MIT",
   "bin": {