openclaw-memory-atmem 2.2.6-beta.6 → 2.2.6

package/README.md

@@ -5,7 +5,7 @@ This npm package is the host bridge for AtMem. It is not a standalone memory eng
 Use the Python-owned installer:
 
 ```bash
-python -m pip install --pre --upgrade atmem==2.2.6b7
+python -m pip install --upgrade atmem==2.2.6
 atmem openclaw install
 ```
 
@@ -22,7 +22,8 @@ Existing AtMem 2.1 users run `atmem openclaw upgrade` after upgrading the Python
 package. This preserves the current memory mode and migration, verifies the new
 bridge with a self-test flight, and rolls back the bridge on failure.
 
-Bridge `2.2.6-beta.6` adds Spec 007 exact task-context delivery. When the host
+Bridge `2.2.6` includes exact task-context delivery, the shared
+calibrated retrieval decision, and delegated context correlation. When the host
 supplies `taskId` in hook context, the bridge requests only that governed task,
 checks its byte digest, contributes it separately from recalled memory, and
 confirms exposure. With no `taskId`, task delivery stays off and existing
@@ -34,3 +35,22 @@ In shadow mode the bridge observes native-memory changes without injecting AtMem
 The bridge also supplies Agent Black Box hooks. It records model/tool lifecycle digests and bounded metadata—not raw prompts, responses, parameters or results—so `atmem blackbox verify RUN_ID` can check timeline integrity and observed tool-hook closure. See the [Agent Black Box guide](../../docs/agent-blackbox.md) for the exact boundary.
 
 See the repository [OpenClaw setup](../../docs/openclaw-setup.md) and [control-plane guarantees](../../docs/control-plane.md).
+
+
+### Delegated local CLI identity and tool evidence in 2.2.6
+
+The default delegated user mapping requires `senderIsOwner: true`. Setting
+`requireOwner: false` alone no longer bypasses identity checks. A dedicated local
+CLI process can use the explicit [isolated mapping configuration](../../docs/delegated-context-provider.md#isolated-local-cli-identity-226)
+with matching workspace, agent and exact session generation. If CLI origin is
+absent, an explicitly configured private state directory and an unrouted
+`agent --local` process with no configured shared channels establish the local
+process boundary. Shared-channel and explicit non-owner turns are refused.
+
+Tool completion hooks use the event's invocation ID or, when absent, the host
+context's ID. The verifier requires matching tool, turn and scope and a request
+preceding completion. Missing completion observations remain `incomplete_evidence`;
+actual terminal host tool-event results supply fallback observations when typed
+completion hooks are absent. Only matched requests close, with content-free
+bounded caching and duplicate suppression. Fully observed
+terminal tool errors close evidence as `completed_with_tool_errors`, not success.

package/dist/index.js

@@ -23,6 +23,8 @@ import { createHash, randomUUID } from "node:crypto";
 import { createReadStream } from "node:fs";
 import { lstat, mkdir, readFile, realpath, rename, unlink, writeFile } from "node:fs/promises";
 import { spawnSync } from "node:child_process";
+import { ToolObservations, observationContext } from "./src/tool-observations.js";
+import { delegatedIdentity, isolatedCliProcess } from "./src/delegated-identity.js";
 import { AtmemClient } from "./src/rpc-client.js";
 import { runSetup } from "./src/setup.js";
 import { NOT_OWNER_MESSAGE, NO_IDENTITY_MESSAGE, describeDecision, isConversationOwner, ok, resolveBoundTaskForTool, refusal, sessionIdentityForTool, } from "./src/task-tools.js";
@@ -40,6 +42,7 @@ const TAKEOVER_GUIDANCE = "<atmem_memory_provider>\n" +
     "</atmem_memory_provider>";
 const INJECT_RE = /<(relevant_memories|user_persona|working_memory|episodic_memory|procedural_memory|atmem_control_plane|atmem_memory_provider)>[\s\S]*?<\/(relevant_memories|user_persona|working_memory|episodic_memory|procedural_memory|atmem_control_plane|atmem_memory_provider)>\s*/g;
 const PROMPT_CACHE_TTL_MS = 10 * 60 * 1000;
+const MAX_PENDING_PROMPTS = 256;
 function parseConfig(raw) {
     const cfg = (raw ?? {});
     const dbPath = expandHome(String(cfg.dbPath ?? "~/.atmem/memories.db"));
@@ -65,6 +68,14 @@ function parseConfig(raw) {
     const delegatedContext = {
         userId: String(cfg.delegatedContext?.userId ?? "").trim(),
         requireOwner: cfg.delegatedContext?.requireOwner !== false,
+        localOperator: cfg.delegatedContext?.localOperator ? {
+            isolated: cfg.delegatedContext.localOperator.isolated === true,
+            stateDir: expandHome(String(cfg.delegatedContext.localOperator.stateDir ?? "")),
+            agentId: String(cfg.delegatedContext.localOperator.agentId ?? "").trim(),
+            workspaceDir: expandHome(String(cfg.delegatedContext.localOperator.workspaceDir ?? "")),
+            sessionKey: String(cfg.delegatedContext.localOperator.sessionKey ?? "").trim(),
+            sessionId: String(cfg.delegatedContext.localOperator.sessionId ?? "").trim(),
+        } : undefined,
     };
     return {
         command: String(cfg.command ?? "atmem"),
@@ -329,9 +340,8 @@ function register(api) {
             stop: () => blackboxClient.close(),
         });
     }
-    // Per-turn recall state. Semantic admission uses a short-lived SQLite handoff
-    // because OpenClaw may run prompt hooks and agent tools in separate runtimes.
     const pendingPrompts = new Map();
+    const pendingPromptTimers = new Map();
     const observedTurnInputs = new Map();
     const inboundAttachments = new Map();
     const inboundAttachmentGeneration = new Map();
@@ -377,14 +387,20 @@ function register(api) {
         const workspace = cfg.agentWorkspaces[agentIdFor(ctx)];
         return workspace ? `ws_${digestText(workspace).slice(0, 16)}` : undefined;
     };
+    const verifiedIsolatedProcess = isolatedCliProcess(cfg.delegatedContext, api.config);
     const delegatedUserIdFor = (ctx) => {
-        if (!cfg.delegatedContext.userId)
-            return undefined;
-        if (cfg.delegatedContext.requireOwner && ctx.senderIsOwner !== true)
-            return undefined;
-        return cfg.delegatedContext.userId;
+        const identity = delegatedIdentity(cfg.delegatedContext, ctx, cfg.agentWorkspaces[agentIdFor(ctx)], verifiedIsolatedProcess);
+        if (!identity.userId && cfg.delegatedContext.userId) {
+            api.logger.warn(`${TAG} delegated identity withheld: ${identity.reason}. ` +
+                "Use authenticated owner metadata or an explicitly isolated, scope-bound CLI mapping; " +
+                "provider HMAC authentication does not establish sender identity.");
+        }
+        return identity.userId;
     };
     const scopedKey = (value, ctx) => `${agentIdFor(ctx)}:${value}`;
+    // Lifecycle hooks must resolve one key. An llm_input-only event.sessionId
+    // must not redirect confirmation away from before_prompt_build's entry.
+    const sessionKeyFor = (ctx) => scopedKey(ctx.sessionKey ?? ctx.sessionId ?? ctx.runId ?? "default-session", ctx);
     const contextIds = (ctx) => [...new Set([ctx.runId, ctx.sessionKey, ctx.sessionId].filter((value) => Boolean(value)).map((value) => scopedKey(value, ctx)))];
     const callFor = (ctx, name, args, timeoutMs = cfg.recall.timeoutMs) => {
         const scoped = cfg.controlPlane.enabled && !Object.keys(cfg.agentSubjects).length
@@ -586,8 +602,14 @@ function register(api) {
         await observeTurnInput(event.prompt, ctx, "before_model_resolve", Array.isArray(event.attachments) ? event.attachments.length : 0);
     });
     api.on("llm_input", async (event, ctx) => {
-        const sessionKey = scopedKey(ctx.sessionKey ?? ctx.sessionId ?? event.sessionId ?? "default-session", ctx);
+        const sessionKey = sessionKeyFor(ctx);
         const pending = pendingPrompts.get(sessionKey);
+        if (!pending &&
+            cfg.controlPlane.enabled &&
+            Boolean(cfg.delegatedContext.userId) &&
+            event.prompt.trim().length > 0) {
+            api.logger.warn(`${TAG} no pending prompt state for llm_input; exact delegated delivery confirmation is unavailable`);
+        }
         if (pending?.delegatedContext !== undefined) {
             const exact = pending.delegatedContext;
             const promptOccurrences = exact ? event.prompt.split(exact).length - 1 : 0;
@@ -615,7 +637,7 @@ function register(api) {
             if (delivered && pending.exposureId) {
                 await callFor(ctx, "control_exposure_shown", { exposure_id: pending.exposureId }, cfg.recall.timeoutMs);
             }
-            pendingPrompts.set(sessionKey, { ...pending, delegatedContext: undefined });
+            cachePendingPrompt(sessionKey, { ...pending, delegatedContext: undefined });
         }
         await recordBlackbox("model.input", event.runId, ctx, {
             provider: event.provider,
@@ -635,10 +657,10 @@ function register(api) {
         const visibleText = responses.map(String).join("");
         const assistantVisibleTextSha256 = digestText(visibleText);
         const modelOutputBundleSha256 = digestJson(responses);
-        const sessionKey = scopedKey(ctx.sessionKey ?? ctx.sessionId ?? event.sessionId ?? "default-session", ctx);
+        const sessionKey = sessionKeyFor(ctx);
         const pending = pendingPrompts.get(sessionKey);
         if (pending) {
-            pendingPrompts.set(sessionKey, {
+            cachePendingPrompt(sessionKey, {
                 ...pending,
                 assistantVisibleTextSha256,
                 modelOutputBundleSha256,
@@ -711,7 +733,7 @@ function register(api) {
         const now = Date.now();
         for (const [key, value] of pendingPrompts) {
             if (now - value.ts > PROMPT_CACHE_TTL_MS)
-                pendingPrompts.delete(key);
+                deletePendingPrompt(key);
         }
         for (const [key, value] of observedTurnInputs) {
             if (now - value.observedAt > PROMPT_CACHE_TTL_MS)
@@ -722,6 +744,30 @@ function register(api) {
                 inboundAttachments.delete(key);
         }
     };
+    function deletePendingPrompt(key) {
+        const timer = pendingPromptTimers.get(key);
+        if (timer)
+            clearTimeout(timer);
+        pendingPromptTimers.delete(key);
+        pendingPrompts.delete(key);
+    }
+    function cachePendingPrompt(key, value) {
+        deletePendingPrompt(key);
+        pendingPrompts.set(key, value);
+        const timer = setTimeout(() => {
+            const current = pendingPrompts.get(key);
+            if (current?.ts === value.ts)
+                deletePendingPrompt(key);
+        }, PROMPT_CACHE_TTL_MS);
+        timer.unref?.();
+        pendingPromptTimers.set(key, timer);
+        while (pendingPrompts.size > MAX_PENDING_PROMPTS) {
+            const oldest = pendingPrompts.keys().next().value;
+            if (oldest === undefined)
+                break;
+            deletePendingPrompt(oldest);
+        }
+    }
     async function personaBlock(sessionKey, ctx) {
         if (!cfg.persona.enabled)
             return { block: "", recordIds: [] };
@@ -753,10 +799,10 @@ function register(api) {
         if (!userText)
             return;
         await observeTurnInput(userText, ctx, "before_prompt_build");
-        const sessionKey = scopedKey(ctx.sessionKey ?? ctx.sessionId ?? "default-session", ctx);
+        const sessionKey = sessionKeyFor(ctx);
         const takeoverGuidance = cfg.takeoverActive ? TAKEOVER_GUIDANCE : "";
-        pendingPrompts.set(sessionKey, { text: userText, ts: Date.now() });
         sweep();
+        cachePendingPrompt(sessionKey, { text: userText, ts: Date.now() });
         if (cfg.controlPlane.enabled) {
             try {
                 const prepared = (await callFor(ctx, "control_prepare", {
@@ -789,7 +835,14 @@ function register(api) {
                         `sha256:${digestText(taskPrepared.context)}` !== taskPrepared.context_sha256)) {
                     throw new Error("governed task context failed exact handoff digest validation");
                 }
-                pendingPrompts.set(sessionKey, {
+                if (prepared.authority === "delegated" &&
+                    prepared.inject &&
+                    (!prepared.context ||
+                        !prepared.context_sha256 ||
+                        digestText(prepared.context) !== prepared.context_sha256)) {
+                    throw new Error("delegated context failed exact handoff digest validation");
+                }
+                cachePendingPrompt(sessionKey, {
                     text: userText,
                     ts: Date.now(),
                     exposureId: prepared.exposure_id,
@@ -815,13 +868,6 @@ function register(api) {
                         task_reason_codes: taskPrepared?.reason_codes ?? [],
                     });
                 }
-                if (prepared.authority === "delegated" &&
-                    prepared.inject &&
-                    (!prepared.context ||
-                        !prepared.context_sha256 ||
-                        digestText(prepared.context) !== prepared.context_sha256)) {
-                    throw new Error("delegated context failed exact handoff digest validation");
-                }
                 if (prepared.authority === "delegated" || prepared.authority === "atmem_fallback") {
                     await recordBlackbox("context.provider_authorization", undefined, ctx, {
                         disposition: prepared.decision ?? "provider_failure",
@@ -835,20 +881,43 @@ function register(api) {
                         success: prepared.decision === "inject" || prepared.decision === "withhold",
                     }, undefined, { contextReceiptId: prepared.context_receipt_id });
                 }
+                const taskContext = taskPrepared?.disposition === "injected"
+                    ? taskPrepared.context ?? ""
+                    : "";
+                let contextEnvelope = {};
+                if (prepared.inject && prepared.context) {
+                    contextEnvelope = prepared.authority === "delegated"
+                        ? {
+                            prependContext: prepared.context,
+                            ...(taskContext ? { appendContext: taskContext } : {}),
+                        }
+                        : {
+                            appendContext: [prepared.context, taskContext].filter(Boolean).join("\n\n"),
+                        };
+                }
+                else if (taskContext) {
+                    contextEnvelope = { appendContext: taskContext };
+                }
+                const contextLocations = [
+                    contextEnvelope.prependContext ? "prependContext" : "",
+                    contextEnvelope.appendContext ? "appendContext" : "",
+                ].filter(Boolean);
+                const deliveredContext = [
+                    contextEnvelope.prependContext,
+                    contextEnvelope.appendContext,
+                ].filter((value) => Boolean(value)).join("\n\n");
                 await recordBlackbox("context.disposition", undefined, ctx, {
-                    disposition: prepared.inject && prepared.context
+                    disposition: deliveredContext
                         ? "injected"
                         : prepared.mode === "shadow" && (prepared.preview_context ?? "")
                             ? "withheld_by_policy"
                             : "no_relevant_memory",
-                    context_sha256: digestText(prepared.context ?? ""),
-                    context_block_sha256: digestText(prepared.context ?? ""),
-                    context_envelope_sha256: digestJson(prepared.authority === "delegated"
-                        ? { prependContext: prepared.context ?? "" }
-                        : { appendContext: prepared.context ?? "" }),
+                    context_sha256: digestText(deliveredContext),
+                    context_block_sha256: digestText(deliveredContext),
+                    context_envelope_sha256: digestJson(contextEnvelope),
                     context_receipt_sha256: prepared.manifest_sha256,
                     digest_profile: "atmem-context-envelope-canonical-json-v1",
-                    context_chars: (prepared.context ?? "").length,
+                    context_chars: deliveredContext.length,
                     candidate_ids: prepared.candidate_ids ?? [],
                     candidates_considered: prepared.retrieval?.eligible_candidate_count ?? 0,
                     retrieval_support_class: prepared.retrieval?.decision?.support_class ?? "not_recorded",
@@ -856,34 +925,20 @@ function register(api) {
                     retrieval_calibration_version: prepared.retrieval?.decision?.calibration_version,
                     exposure_id: prepared.exposure_id,
                     mode: prepared.mode,
-                    context_location: prepared.inject
-                        ? prepared.authority === "delegated" ? "prependContext" : "appendContext"
-                        : "none",
+                    context_location: contextLocations.length ? contextLocations.join("+") : "none",
                 }, undefined, {
                     contextReceiptId: prepared.context_receipt_id,
                 });
-                if (prepared.inject && prepared.context) {
+                if (Object.keys(contextEnvelope).length) {
                     api.logger.info(`${TAG} memory control plane ${prepared.mode ?? "active"} context exposed`);
-                    return prepared.authority === "delegated"
-                        ? {
-                            prependContext: prepared.context,
-                            appendContext: taskPrepared?.disposition === "injected"
-                                ? taskPrepared.context
-                                : undefined,
-                        }
-                        : {
-                            appendContext: [
-                                prepared.context,
-                                taskPrepared?.disposition === "injected" ? taskPrepared.context : "",
-                            ].filter(Boolean).join("\n\n"),
-                        };
-                }
-                if (taskPrepared?.disposition === "injected" && taskPrepared.context) {
-                    return { appendContext: taskPrepared.context };
+                    return contextEnvelope;
                 }
                 return;
             }
             catch (error) {
+                // Any exact delegated bytes retained while constructing evidence are
+                // discarded immediately on the fail-closed path.
+                cachePendingPrompt(sessionKey, { text: userText, ts: Date.now() });
                 await recordBlackbox("context.disposition", undefined, ctx, {
                     disposition: "recall_failed",
                     context_block_sha256: digestText(""),
@@ -949,7 +1004,7 @@ function register(api) {
                     recall = result.block;
                     const current = pendingPrompts.get(sessionKey);
                     if (current) {
-                        pendingPrompts.set(sessionKey, {
+                        cachePendingPrompt(sessionKey, {
                             ...current,
                             injectedRecordIds: result.record_ids ?? [],
                             retrievalId: result.retrieval_id,
@@ -1002,7 +1057,7 @@ function register(api) {
             ? `ctxr_${digestJson({ componentEventIds, contextEnvelopeSha256 })}`
             : undefined;
         if (current) {
-            pendingPrompts.set(sessionKey, { ...current, contextReceiptId });
+            cachePendingPrompt(sessionKey, { ...current, contextReceiptId });
         }
         await recordBlackbox("context.disposition", undefined, ctx, {
             disposition: memoryContext
@@ -1027,8 +1082,26 @@ function register(api) {
         if (Object.keys(result).length)
             return result;
     });
+    // Latest CLI harnesses emit terminal results on the agent-event stream.
+    // Feature-detect both API generations; never infer completion from a request.
+    const runContext = api.runContext ?? (api.setRunContext && api.getRunContext ? {
+        setRunContext: api.setRunContext.bind(api), getRunContext: api.getRunContext.bind(api),
+    } : undefined);
+    const subscribe = api.agent?.events?.registerAgentEventSubscription?.bind(api.agent.events)
+        ?? api.registerAgentEventSubscription?.bind(api);
+    const toolObservations = cfg.controlPlane.blackboxEnabled && subscribe
+        ? new ToolObservations(observationContext(runContext, digestJson({
+            command: cfg.command, args: cfg.commandArgs, state: cfg.controlPlane.statePath,
+            subjects: cfg.agentSubjects, workspaces: cfg.agentWorkspaces,
+        })), digestJson) : undefined;
+    if (toolObservations && subscribe)
+        subscribe({
+            id: "atmem-terminal-tool-observations", streams: ["tool"],
+            handle: event => toolObservations.observe(event),
+        });
     // ---- flight recorder + takeover enforcement --------------------------
     api.on("before_tool_call", async (event, ctx) => {
+        toolObservations?.request(event.toolName, event.toolCallId ?? ctx.toolCallId, { ...ctx, runId: event.runId ?? ctx.runId, agentId: agentIdFor(ctx) });
         await recordBlackbox("tool.requested", event.runId, ctx, {
             tool_name: event.toolName,
             tool_canonical_name: canonicalToolName(event.toolName),
@@ -1038,7 +1111,7 @@ function register(api) {
             derived_path_sha256: Array.isArray(event.derivedPaths)
                 ? event.derivedPaths.map((value) => digestText(String(value)))
                 : [],
-        }, event.toolCallId);
+        }, event.toolCallId ?? ctx.toolCallId);
         if (!cfg.takeoverActive || !cfg.nativeWorkspaces.some((workspace) => touchesNativeMemory(event, workspace)))
             return;
         const reason = "AtMem takeover blocked access to OpenClaw's frozen native memory " +
@@ -1051,11 +1124,12 @@ function register(api) {
             error_category: "blocked_by_memory_boundary",
             result_sha256: digestText(reason),
             duration_ms: 0,
-        }, event.toolCallId);
+        }, event.toolCallId ?? ctx.toolCallId);
         api.logger.warn(`${TAG} ${reason} Tool: ${event.toolName}`);
         return { block: true, blockReason: reason };
     });
     api.on("after_tool_call", async (event, ctx) => {
+        toolObservations?.completed(event.toolCallId ?? ctx.toolCallId, { ...ctx, runId: event.runId ?? ctx.runId, agentId: agentIdFor(ctx) });
         await recordBlackbox("tool.completed", event.runId, ctx, {
             tool_name: event.toolName,
             tool_canonical_name: canonicalToolName(event.toolName),
@@ -1063,14 +1137,22 @@ function register(api) {
             outcome: event.error ? "error" : "completed",
             error_category: event.error ? "tool_error" : undefined,
             duration_ms: event.durationMs ?? 0,
-        }, event.toolCallId);
+        }, event.toolCallId ?? ctx.toolCallId);
     });
     // ---- auto-capture: user turn through the pipeline, assistant as digest -
     api.on("agent_end", async (event, ctx) => {
-        const sessionKey = scopedKey(ctx.sessionKey ?? ctx.sessionId ?? "default-session", ctx);
+        await toolObservations?.flush({ ...ctx, runId: event.runId ?? ctx.runId, agentId: agentIdFor(ctx) }, async (saved) => {
+            await recordBlackbox("tool.completed", saved.ctx.runId, saved.ctx, {
+                tool_name: saved.name, tool_canonical_name: canonicalToolName(saved.name),
+                result_sha256: saved.result.digest, outcome: saved.result.error ? "error" : "completed",
+                error_category: saved.result.error ? "tool_error" : undefined,
+                reason: "observed_terminal_host_tool_event",
+            }, saved.callId);
+        });
+        const sessionKey = sessionKeyFor(ctx);
         const observedTurnInputKey = turnInputKey(ctx);
         const cached = pendingPrompts.get(sessionKey);
-        pendingPrompts.delete(sessionKey);
+        deletePendingPrompt(sessionKey);
         const userText = cached?.text?.replace(INJECT_RE, "").trim();
         try {
             if (cfg.takeoverActive) {

package/dist/src/delegated-identity.js

@@ -0,0 +1,62 @@
+import path from "node:path";
+import { lstatSync, realpathSync } from "node:fs";
+/** Verify the dedicated CLI process when the host omits origin metadata.
+ * This is an explicit local operator trust boundary, never shared-channel auth.
+ */
+export function isolatedCliProcess(config, hostConfig, runtime = { argv: process.argv.slice(2), stateDir: process.env.OPENCLAW_STATE_DIR, uid: process.getuid?.() }) {
+    const local = config.localOperator;
+    if (!local?.isolated || !local.stateDir || !runtime.stateDir || !hostConfig)
+        return false;
+    if (!runtime.argv.includes("agent") || !runtime.argv.includes("--local"))
+        return false;
+    const routed = ["--deliver", "--channel", "--to", "--reply-channel", "--reply-to", "--reply-account"];
+    if (runtime.argv.some(arg => routed.some(flag => arg === flag || arg.startsWith(flag + "="))))
+        return false;
+    const channels = hostConfig.channels;
+    if (channels !== undefined && (!channels || typeof channels !== "object" || Array.isArray(channels) || Object.keys(channels).length))
+        return false;
+    try {
+        const directory = lstatSync(local.stateDir);
+        return path.isAbsolute(local.stateDir) && directory.isDirectory() && !directory.isSymbolicLink()
+            && (directory.mode & 0o077) === 0 && directory.uid === runtime.uid
+            && realpathSync(local.stateDir) === realpathSync(runtime.stateDir);
+    }
+    catch {
+        return false;
+    }
+}
+/** Host metadata and operator configuration only; never prompt/model input. */
+export function delegatedIdentity(config, ctx, configuredWorkspace, verifiedIsolatedProcess = false) {
+    if (!config.userId)
+        return { reason: "delegated_user_unconfigured" };
+    if (ctx.senderIsOwner === false)
+        return { reason: "delegated_sender_not_owner" };
+    if (ctx.senderIsOwner !== undefined && ctx.senderIsOwner !== true) {
+        return { reason: "delegated_owner_metadata_invalid" };
+    }
+    if (config.requireOwner) {
+        return ctx.senderIsOwner === true
+            ? { userId: config.userId }
+            : { reason: "delegated_owner_metadata_missing" };
+    }
+    // Legacy requireOwner:false is no longer an unrestricted identity bypass.
+    const local = config.localOperator;
+    if (!local || local.isolated !== true) {
+        return { reason: "delegated_local_isolation_required" };
+    }
+    if ((ctx.messageProvider !== "cli" && !(ctx.messageProvider === undefined && verifiedIsolatedProcess)) || ctx.channel || ctx.channelId ||
+        ctx.accountId || ctx.chatId || ctx.senderId) {
+        return { reason: "delegated_local_origin_unverified" };
+    }
+    if (!local.agentId || !local.sessionKey || !local.sessionId || !local.workspaceDir ||
+        !ctx.runId || !ctx.workspaceDir || !configuredWorkspace ||
+        !path.isAbsolute(local.workspaceDir) || !path.isAbsolute(ctx.workspaceDir) ||
+        !path.isAbsolute(configuredWorkspace) ||
+        ctx.agentId !== local.agentId || ctx.sessionKey !== local.sessionKey ||
+        ctx.sessionId !== local.sessionId ||
+        path.resolve(ctx.workspaceDir) !== path.resolve(local.workspaceDir) ||
+        path.resolve(configuredWorkspace) !== path.resolve(local.workspaceDir)) {
+        return { reason: "delegated_local_scope_mismatch" };
+    }
+    return { userId: config.userId };
+}

package/dist/src/rpc-client.js

@@ -128,7 +128,7 @@ export class AtmemClient {
             capabilities: {},
             clientInfo: {
                 name: "openclaw-memory-atmem",
-                version: "2.2.6-beta.6",
+                version: "2.2.6",
             },
         });
         this.notify("notifications/initialized", {});

package/dist/src/tool-observations.js

@@ -0,0 +1,111 @@
+import { createHash } from "node:crypto";
+const CACHE_KEY = Symbol.for("atmem.tool-observation-cache.v1");
+const sharedCache = globalThis;
+const cache = sharedCache[CACHE_KEY] ??= new Map();
+/** Some hosts deny run-context writes from tool hooks after registry reload.
+ * Keep a bounded content-free process fallback, isolated by installation config.
+ */
+export function observationContext(host, scope) {
+    const keyFor = (runId, namespace) => JSON.stringify([scope, runId, namespace]);
+    const sweep = () => {
+        for (const [key, entry] of cache)
+            if (entry.expires <= Date.now())
+                cache.delete(key);
+        while (cache.size >= 2048)
+            cache.delete(cache.keys().next().value);
+    };
+    return {
+        setRunContext(patch) {
+            sweep();
+            cache.set(keyFor(patch.runId, patch.namespace), { value: structuredClone(patch.value), expires: Date.now() + 600_000 });
+            try {
+                host?.setRunContext(patch);
+            }
+            catch { /* Process fallback remains bounded. */ }
+            return true;
+        },
+        getRunContext(params) {
+            sweep();
+            const entry = cache.get(keyFor(params.runId, params.namespace));
+            if (entry)
+                return structuredClone(entry.value);
+            try {
+                return host?.getRunContext(params);
+            }
+            catch {
+                return undefined;
+            }
+        },
+    };
+}
+const INDEX = "atmem-tool-observations-v1";
+const namespace = (id) => INDEX + "-" + createHash("sha256").update(id).digest("hex");
+/** The CLI exposes its native names; the request hook exposes OpenClaw names. */
+function canonical(name) {
+    const unwrapped = name.replace(/^mcp__openclaw__/, "");
+    return { Read: "read", Bash: "exec" }[unwrapped] ?? unwrapped;
+}
+/** Stores only scope, names and digests in bounded ephemeral observation context. */
+export class ToolObservations {
+    access;
+    digest;
+    constructor(access, digest) {
+        this.access = access;
+        this.digest = digest;
+    }
+    request(name, id, ctx) {
+        if (!id || !ctx.runId || !ctx.agentId || !ctx.sessionId || !ctx.sessionKey)
+            return;
+        const runId = ctx.runId;
+        const ids = this.access.getRunContext({ runId, namespace: INDEX }) ?? [];
+        if (ids.includes(id) || ids.length >= 256)
+            return;
+        // Never store the full hook context: it may contain host config/credentials.
+        const scope = { runId, agentId: ctx.agentId, sessionId: ctx.sessionId, sessionKey: ctx.sessionKey };
+        if (this.access.setRunContext({ runId, namespace: namespace(id), value: { ctx: scope, name, callId: id } })) {
+            this.access.setRunContext({ runId, namespace: INDEX, value: [...ids, id] });
+        }
+    }
+    completed(id, ctx) {
+        if (!id || !ctx.runId)
+            return;
+        const key = { runId: ctx.runId, namespace: namespace(id) };
+        const saved = this.access.getRunContext(key);
+        if (saved && saved.ctx.sessionId === ctx.sessionId && saved.ctx.sessionKey === ctx.sessionKey && saved.ctx.agentId === ctx.agentId) {
+            this.access.setRunContext({ ...key, value: { ...saved, hookCompleted: true } });
+        }
+    }
+    observe(event) {
+        const d = event.data;
+        if (event.stream !== "tool" || d.phase !== "result" || typeof d.toolCallId !== "string" ||
+            typeof d.name !== "string" || typeof d.isError !== "boolean" ||
+            !Object.hasOwn(d, "result") || d.incomplete === true || d.synthetic === true)
+            return;
+        const key = { runId: event.runId, namespace: namespace(d.toolCallId) };
+        const saved = this.access.getRunContext(key);
+        if (!saved || event.sessionKey !== saved.ctx.sessionKey ||
+            (event.sessionId !== undefined && event.sessionId !== saved.ctx.sessionId) ||
+            (event.agentId !== undefined && event.agentId !== saved.ctx.agentId) ||
+            canonical(d.name) !== canonical(saved.name))
+            return;
+        const result = { digest: this.digest(d.result), error: d.isError };
+        const conflict = saved.conflict || (saved.result !== undefined &&
+            (saved.result.digest !== result.digest || saved.result.error !== result.error));
+        this.access.setRunContext({ ...key, value: { ...saved, result, conflict } });
+    }
+    async flush(ctx, record) {
+        if (!ctx.runId)
+            return;
+        const runId = ctx.runId;
+        const ids = this.access.getRunContext({ runId, namespace: INDEX }) ?? [];
+        for (const id of ids) {
+            const key = { runId, namespace: namespace(id) };
+            const saved = this.access.getRunContext(key);
+            if (saved && !saved.hookCompleted && !saved.conflict && saved.result &&
+                saved.ctx.sessionKey === ctx.sessionKey && saved.ctx.sessionId === ctx.sessionId && saved.ctx.agentId === ctx.agentId) {
+                await record(saved);
+                this.access.setRunContext({ ...key, value: { ...saved, hookCompleted: true } });
+            }
+        }
+    }
+}

package/dist/src/types.js

@@ -1,7 +1 @@
-/**
- * Minimal structural types for the OpenClaw plugin API surface this plugin
- * uses. Kept local (instead of importing "openclaw/plugin-sdk/core") so the
- * plugin builds without the SDK on the compile path; the shapes match the
- * hook/tool contracts observed in OpenClaw's plugin SDK.
- */
 export {};

package/openclaw.plugin.json

@@ -2,7 +2,7 @@
   "id": "memory-atmem",
   "name": "Memory (atmem)",
   "description": "OpenClaw bridge installed and managed by the AtMem memory control plane.",
-  "version": "2.2.6-beta.6",
+  "version": "2.2.6",
   "commandAliases": ["memory-atmem"],
   "activation": {
     "onStartup": true,
@@ -150,7 +150,21 @@
           "requireOwner": {
             "type": "boolean",
             "default": true,
-            "description": "Send the mapped user ID only when OpenClaw marks the sender as owner."
+            "description": "Require authenticated owner metadata (default). False requires the explicit isolated localOperator mapping; it is not an ownership bypass."
+          },
+          "localOperator": {
+            "type": "object",
+            "additionalProperties": false,
+            "required": ["isolated", "agentId", "workspaceDir", "sessionKey", "sessionId"],
+            "description": "Only for a dedicated local CLI process with channels disabled by the operator. Requires host messageProvider=cli, workspace and exact session generation; channel-originated turns are refused.",
+            "properties": {
+              "isolated": { "type": "boolean", "const": true, "description": "Operator assertion that this process is isolated from shared channels and other users." },
+              "stateDir": { "type": "string", "minLength": 1, "description": "Optional dedicated owner-only OPENCLAW_STATE_DIR. Required when a direct agent --local process omits CLI origin metadata; channels and delivery flags must be absent." },
+              "agentId": { "type": "string", "minLength": 1 },
+              "workspaceDir": { "type": "string", "minLength": 1 },
+              "sessionKey": { "type": "string", "minLength": 1 },
+              "sessionId": { "type": "string", "minLength": 1 }
+            }
           }
         }
       }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "openclaw-memory-atmem",
-  "version": "2.2.6-beta.6",
+  "version": "2.2.6",
   "description": "OpenClaw Agent Black Box and memory control-plane bridge for AtMem",
   "type": "module",
   "main": "./dist/index.js",
@@ -40,8 +40,8 @@
   "scripts": {
     "build": "tsc -p tsconfig.json",
     "typecheck": "tsc -p tsconfig.json --noEmit",
-    "test": "node test/manifest.mjs && node test/hook-context-compat.mjs && node test/setup.mjs && node test/hooks.mjs && node test/task-tools.mjs && node test/delegated-context-contract.mjs",
-    "smoke": "node test/smoke.mjs && node test/task-journey.mjs",
+    "test": "node test/manifest.mjs && node test/hook-context-compat.mjs && node test/setup.mjs && node test/hooks.mjs && node test/delegated-identity.mjs && node test/tool-observations.mjs && node test/task-tools.mjs && node test/delegated-context-contract.mjs",
+    "smoke": "node test/smoke.mjs && node test/task-journey.mjs && node test/delegated-journey.mjs",
     "prepack": "npm run build && npm run typecheck && npm test && npm run smoke",
     "hook-context": "node test/hook-context-compat.mjs",
     "record-hook-context": "node test/lib/record-hook-context.mjs"