openclaw-memory-atmem 2.2.6-beta.6 → 2.2.7-beta.1

package/README.md

@@ -5,7 +5,7 @@ This npm package is the host bridge for AtMem. It is not a standalone memory eng
 Use the Python-owned installer:
 
 ```bash
-python -m pip install --pre --upgrade atmem==2.2.6b7
+python -m pip install --upgrade atmem==2.2.7b1
 atmem openclaw install
 ```
 
@@ -22,7 +22,8 @@ Existing AtMem 2.1 users run `atmem openclaw upgrade` after upgrading the Python
 package. This preserves the current memory mode and migration, verifies the new
 bridge with a self-test flight, and rolls back the bridge on failure.
 
-Bridge `2.2.6-beta.6` adds Spec 007 exact task-context delivery. When the host
+Bridge `2.2.7-beta.1` includes exact task-context delivery, the shared
+calibrated retrieval decision, and delegated context correlation. When the host
 supplies `taskId` in hook context, the bridge requests only that governed task,
 checks its byte digest, contributes it separately from recalled memory, and
 confirms exposure. With no `taskId`, task delivery stays off and existing
@@ -34,3 +35,31 @@ In shadow mode the bridge observes native-memory changes without injecting AtMem
 The bridge also supplies Agent Black Box hooks. It records model/tool lifecycle digests and bounded metadata—not raw prompts, responses, parameters or results—so `atmem blackbox verify RUN_ID` can check timeline integrity and observed tool-hook closure. See the [Agent Black Box guide](../../docs/agent-blackbox.md) for the exact boundary.
 
 See the repository [OpenClaw setup](../../docs/openclaw-setup.md) and [control-plane guarantees](../../docs/control-plane.md).
+
+
+### Delegated local CLI identity and tool evidence in 2.2.7b1
+
+The default delegated user mapping requires `senderIsOwner: true`. Setting
+`requireOwner: false` alone no longer bypasses identity checks. A dedicated local
+CLI process can use the explicit [isolated mapping configuration](../../docs/delegated-context-provider.md#isolated-local-cli-identity-226)
+with matching workspace, agent and exact session generation. If CLI origin is
+absent, an explicitly configured private state directory and an unrouted
+`agent --local` process with no configured shared channels establish the local
+process boundary. Shared-channel and explicit non-owner turns are refused.
+
+Tool completion hooks use the event's invocation ID or, when absent, the host
+context's ID. The verifier requires matching tool, turn and scope and a request
+preceding completion. Missing completion observations remain `incomplete_evidence`;
+actual terminal host tool-event results supply fallback observations when typed
+completion hooks are absent. Only matched requests close, with content-free
+bounded caching and duplicate suppression. Fully observed
+terminal tool errors close evidence as `completed_with_tool_errors`, not success.
+
+Beta 2.2.7b1: automatic recall now requires calibrated direct
+query support by default (`recall.requireDirectSupport: true`). Persona is an
+explicit opt-in (`persona.enabled: true`); setup defaults it off to avoid adding
+unrelated personal facts to every request. When enabled, persona records are
+excluded from recall so each appears once. Existing explicit persona settings
+are respected; set `persona.enabled: false` to adopt selective recall. Explicit
+memory search remains available. The legacy rank-only mode is available with
+`recall.requireDirectSupport: false`; it can admit weak matches.

package/dist/index.js

@@ -23,6 +23,10 @@ import { createHash, randomUUID } from "node:crypto";
 import { createReadStream } from "node:fs";
 import { lstat, mkdir, readFile, realpath, rename, unlink, writeFile } from "node:fs/promises";
 import { spawnSync } from "node:child_process";
+import { ToolObservations, observationContext } from "./src/tool-observations.js";
+import { progressCardComparison } from "./src/tool-result-comparison.js";
+import { toolErrorReason } from "./src/tool-errors.js";
+import { delegatedIdentity, isolatedCliProcess } from "./src/delegated-identity.js";
 import { AtmemClient } from "./src/rpc-client.js";
 import { runSetup } from "./src/setup.js";
 import { NOT_OWNER_MESSAGE, NO_IDENTITY_MESSAGE, describeDecision, isConversationOwner, ok, resolveBoundTaskForTool, refusal, sessionIdentityForTool, } from "./src/task-tools.js";
@@ -40,6 +44,7 @@ const TAKEOVER_GUIDANCE = "<atmem_memory_provider>\n" +
     "</atmem_memory_provider>";
 const INJECT_RE = /<(relevant_memories|user_persona|working_memory|episodic_memory|procedural_memory|atmem_control_plane|atmem_memory_provider)>[\s\S]*?<\/(relevant_memories|user_persona|working_memory|episodic_memory|procedural_memory|atmem_control_plane|atmem_memory_provider)>\s*/g;
 const PROMPT_CACHE_TTL_MS = 10 * 60 * 1000;
+const MAX_PENDING_PROMPTS = 256;
 function parseConfig(raw) {
     const cfg = (raw ?? {});
     const dbPath = expandHome(String(cfg.dbPath ?? "~/.atmem/memories.db"));
@@ -65,6 +70,14 @@ function parseConfig(raw) {
     const delegatedContext = {
         userId: String(cfg.delegatedContext?.userId ?? "").trim(),
         requireOwner: cfg.delegatedContext?.requireOwner !== false,
+        localOperator: cfg.delegatedContext?.localOperator ? {
+            isolated: cfg.delegatedContext.localOperator.isolated === true,
+            stateDir: expandHome(String(cfg.delegatedContext.localOperator.stateDir ?? "")),
+            agentId: String(cfg.delegatedContext.localOperator.agentId ?? "").trim(),
+            workspaceDir: expandHome(String(cfg.delegatedContext.localOperator.workspaceDir ?? "")),
+            sessionKey: String(cfg.delegatedContext.localOperator.sessionKey ?? "").trim(),
+            sessionId: String(cfg.delegatedContext.localOperator.sessionId ?? "").trim(),
+        } : undefined,
     };
     return {
         command: String(cfg.command ?? "atmem"),
@@ -86,10 +99,11 @@ function parseConfig(raw) {
             maxRecords: Number(cfg.recall?.maxRecords ?? 3),
             maxChars: Number(cfg.recall?.maxChars ?? 1200),
             minScore: Number(cfg.recall?.minScore ?? 0.3),
+            requireDirectSupport: cfg.recall?.requireDirectSupport !== false,
             timeoutMs: Number(cfg.recall?.timeoutMs ?? 4000),
         },
         persona: {
-            enabled: cfg.persona?.enabled !== false,
+            enabled: cfg.persona?.enabled === true,
             maxChars: Number(cfg.persona?.maxChars ?? 600),
             ttlSeconds: Number(cfg.persona?.ttlSeconds ?? 300),
         },
@@ -329,9 +343,8 @@ function register(api) {
             stop: () => blackboxClient.close(),
         });
     }
-    // Per-turn recall state. Semantic admission uses a short-lived SQLite handoff
-    // because OpenClaw may run prompt hooks and agent tools in separate runtimes.
     const pendingPrompts = new Map();
+    const pendingPromptTimers = new Map();
     const observedTurnInputs = new Map();
     const inboundAttachments = new Map();
     const inboundAttachmentGeneration = new Map();
@@ -377,14 +390,20 @@ function register(api) {
         const workspace = cfg.agentWorkspaces[agentIdFor(ctx)];
         return workspace ? `ws_${digestText(workspace).slice(0, 16)}` : undefined;
     };
+    const verifiedIsolatedProcess = isolatedCliProcess(cfg.delegatedContext, api.config);
     const delegatedUserIdFor = (ctx) => {
-        if (!cfg.delegatedContext.userId)
-            return undefined;
-        if (cfg.delegatedContext.requireOwner && ctx.senderIsOwner !== true)
-            return undefined;
-        return cfg.delegatedContext.userId;
+        const identity = delegatedIdentity(cfg.delegatedContext, ctx, cfg.agentWorkspaces[agentIdFor(ctx)], verifiedIsolatedProcess);
+        if (!identity.userId && cfg.delegatedContext.userId) {
+            api.logger.warn(`${TAG} delegated identity withheld: ${identity.reason}. ` +
+                "Use authenticated owner metadata or an explicitly isolated, scope-bound CLI mapping; " +
+                "provider HMAC authentication does not establish sender identity.");
+        }
+        return identity.userId;
     };
     const scopedKey = (value, ctx) => `${agentIdFor(ctx)}:${value}`;
+    // Lifecycle hooks must resolve one key. An llm_input-only event.sessionId
+    // must not redirect confirmation away from before_prompt_build's entry.
+    const sessionKeyFor = (ctx) => scopedKey(ctx.sessionKey ?? ctx.sessionId ?? ctx.runId ?? "default-session", ctx);
     const contextIds = (ctx) => [...new Set([ctx.runId, ctx.sessionKey, ctx.sessionId].filter((value) => Boolean(value)).map((value) => scopedKey(value, ctx)))];
     const callFor = (ctx, name, args, timeoutMs = cfg.recall.timeoutMs) => {
         const scoped = cfg.controlPlane.enabled && !Object.keys(cfg.agentSubjects).length
@@ -586,8 +605,14 @@ function register(api) {
         await observeTurnInput(event.prompt, ctx, "before_model_resolve", Array.isArray(event.attachments) ? event.attachments.length : 0);
     });
     api.on("llm_input", async (event, ctx) => {
-        const sessionKey = scopedKey(ctx.sessionKey ?? ctx.sessionId ?? event.sessionId ?? "default-session", ctx);
+        const sessionKey = sessionKeyFor(ctx);
         const pending = pendingPrompts.get(sessionKey);
+        if (!pending &&
+            cfg.controlPlane.enabled &&
+            Boolean(cfg.delegatedContext.userId) &&
+            event.prompt.trim().length > 0) {
+            api.logger.warn(`${TAG} no pending prompt state for llm_input; exact delegated delivery confirmation is unavailable`);
+        }
         if (pending?.delegatedContext !== undefined) {
             const exact = pending.delegatedContext;
             const promptOccurrences = exact ? event.prompt.split(exact).length - 1 : 0;
@@ -615,7 +640,7 @@ function register(api) {
             if (delivered && pending.exposureId) {
                 await callFor(ctx, "control_exposure_shown", { exposure_id: pending.exposureId }, cfg.recall.timeoutMs);
             }
-            pendingPrompts.set(sessionKey, { ...pending, delegatedContext: undefined });
+            cachePendingPrompt(sessionKey, { ...pending, delegatedContext: undefined });
         }
         await recordBlackbox("model.input", event.runId, ctx, {
             provider: event.provider,
@@ -635,10 +660,10 @@ function register(api) {
         const visibleText = responses.map(String).join("");
         const assistantVisibleTextSha256 = digestText(visibleText);
         const modelOutputBundleSha256 = digestJson(responses);
-        const sessionKey = scopedKey(ctx.sessionKey ?? ctx.sessionId ?? event.sessionId ?? "default-session", ctx);
+        const sessionKey = sessionKeyFor(ctx);
         const pending = pendingPrompts.get(sessionKey);
         if (pending) {
-            pendingPrompts.set(sessionKey, {
+            cachePendingPrompt(sessionKey, {
                 ...pending,
                 assistantVisibleTextSha256,
                 modelOutputBundleSha256,
@@ -711,7 +736,7 @@ function register(api) {
         const now = Date.now();
         for (const [key, value] of pendingPrompts) {
             if (now - value.ts > PROMPT_CACHE_TTL_MS)
-                pendingPrompts.delete(key);
+                deletePendingPrompt(key);
         }
         for (const [key, value] of observedTurnInputs) {
             if (now - value.observedAt > PROMPT_CACHE_TTL_MS)
@@ -722,6 +747,30 @@ function register(api) {
                 inboundAttachments.delete(key);
         }
     };
+    function deletePendingPrompt(key) {
+        const timer = pendingPromptTimers.get(key);
+        if (timer)
+            clearTimeout(timer);
+        pendingPromptTimers.delete(key);
+        pendingPrompts.delete(key);
+    }
+    function cachePendingPrompt(key, value) {
+        deletePendingPrompt(key);
+        pendingPrompts.set(key, value);
+        const timer = setTimeout(() => {
+            const current = pendingPrompts.get(key);
+            if (current?.ts === value.ts)
+                deletePendingPrompt(key);
+        }, PROMPT_CACHE_TTL_MS);
+        timer.unref?.();
+        pendingPromptTimers.set(key, timer);
+        while (pendingPrompts.size > MAX_PENDING_PROMPTS) {
+            const oldest = pendingPrompts.keys().next().value;
+            if (oldest === undefined)
+                break;
+            deletePendingPrompt(oldest);
+        }
+    }
     async function personaBlock(sessionKey, ctx) {
         if (!cfg.persona.enabled)
             return { block: "", recordIds: [] };
@@ -753,10 +802,10 @@ function register(api) {
         if (!userText)
             return;
         await observeTurnInput(userText, ctx, "before_prompt_build");
-        const sessionKey = scopedKey(ctx.sessionKey ?? ctx.sessionId ?? "default-session", ctx);
+        const sessionKey = sessionKeyFor(ctx);
         const takeoverGuidance = cfg.takeoverActive ? TAKEOVER_GUIDANCE : "";
-        pendingPrompts.set(sessionKey, { text: userText, ts: Date.now() });
         sweep();
+        cachePendingPrompt(sessionKey, { text: userText, ts: Date.now() });
         if (cfg.controlPlane.enabled) {
             try {
                 const prepared = (await callFor(ctx, "control_prepare", {
@@ -789,7 +838,14 @@ function register(api) {
                         `sha256:${digestText(taskPrepared.context)}` !== taskPrepared.context_sha256)) {
                     throw new Error("governed task context failed exact handoff digest validation");
                 }
-                pendingPrompts.set(sessionKey, {
+                if (prepared.authority === "delegated" &&
+                    prepared.inject &&
+                    (!prepared.context ||
+                        !prepared.context_sha256 ||
+                        digestText(prepared.context) !== prepared.context_sha256)) {
+                    throw new Error("delegated context failed exact handoff digest validation");
+                }
+                cachePendingPrompt(sessionKey, {
                     text: userText,
                     ts: Date.now(),
                     exposureId: prepared.exposure_id,
@@ -815,13 +871,6 @@ function register(api) {
                         task_reason_codes: taskPrepared?.reason_codes ?? [],
                     });
                 }
-                if (prepared.authority === "delegated" &&
-                    prepared.inject &&
-                    (!prepared.context ||
-                        !prepared.context_sha256 ||
-                        digestText(prepared.context) !== prepared.context_sha256)) {
-                    throw new Error("delegated context failed exact handoff digest validation");
-                }
                 if (prepared.authority === "delegated" || prepared.authority === "atmem_fallback") {
                     await recordBlackbox("context.provider_authorization", undefined, ctx, {
                         disposition: prepared.decision ?? "provider_failure",
@@ -835,20 +884,43 @@ function register(api) {
                         success: prepared.decision === "inject" || prepared.decision === "withhold",
                     }, undefined, { contextReceiptId: prepared.context_receipt_id });
                 }
+                const taskContext = taskPrepared?.disposition === "injected"
+                    ? taskPrepared.context ?? ""
+                    : "";
+                let contextEnvelope = {};
+                if (prepared.inject && prepared.context) {
+                    contextEnvelope = prepared.authority === "delegated"
+                        ? {
+                            prependContext: prepared.context,
+                            ...(taskContext ? { appendContext: taskContext } : {}),
+                        }
+                        : {
+                            appendContext: [prepared.context, taskContext].filter(Boolean).join("\n\n"),
+                        };
+                }
+                else if (taskContext) {
+                    contextEnvelope = { appendContext: taskContext };
+                }
+                const contextLocations = [
+                    contextEnvelope.prependContext ? "prependContext" : "",
+                    contextEnvelope.appendContext ? "appendContext" : "",
+                ].filter(Boolean);
+                const deliveredContext = [
+                    contextEnvelope.prependContext,
+                    contextEnvelope.appendContext,
+                ].filter((value) => Boolean(value)).join("\n\n");
                 await recordBlackbox("context.disposition", undefined, ctx, {
-                    disposition: prepared.inject && prepared.context
+                    disposition: deliveredContext
                         ? "injected"
                         : prepared.mode === "shadow" && (prepared.preview_context ?? "")
                             ? "withheld_by_policy"
                             : "no_relevant_memory",
-                    context_sha256: digestText(prepared.context ?? ""),
-                    context_block_sha256: digestText(prepared.context ?? ""),
-                    context_envelope_sha256: digestJson(prepared.authority === "delegated"
-                        ? { prependContext: prepared.context ?? "" }
-                        : { appendContext: prepared.context ?? "" }),
+                    context_sha256: digestText(deliveredContext),
+                    context_block_sha256: digestText(deliveredContext),
+                    context_envelope_sha256: digestJson(contextEnvelope),
                     context_receipt_sha256: prepared.manifest_sha256,
                     digest_profile: "atmem-context-envelope-canonical-json-v1",
-                    context_chars: (prepared.context ?? "").length,
+                    context_chars: deliveredContext.length,
                     candidate_ids: prepared.candidate_ids ?? [],
                     candidates_considered: prepared.retrieval?.eligible_candidate_count ?? 0,
                     retrieval_support_class: prepared.retrieval?.decision?.support_class ?? "not_recorded",
@@ -856,34 +928,20 @@ function register(api) {
                     retrieval_calibration_version: prepared.retrieval?.decision?.calibration_version,
                     exposure_id: prepared.exposure_id,
                     mode: prepared.mode,
-                    context_location: prepared.inject
-                        ? prepared.authority === "delegated" ? "prependContext" : "appendContext"
-                        : "none",
+                    context_location: contextLocations.length ? contextLocations.join("+") : "none",
                 }, undefined, {
                     contextReceiptId: prepared.context_receipt_id,
                 });
-                if (prepared.inject && prepared.context) {
+                if (Object.keys(contextEnvelope).length) {
                     api.logger.info(`${TAG} memory control plane ${prepared.mode ?? "active"} context exposed`);
-                    return prepared.authority === "delegated"
-                        ? {
-                            prependContext: prepared.context,
-                            appendContext: taskPrepared?.disposition === "injected"
-                                ? taskPrepared.context
-                                : undefined,
-                        }
-                        : {
-                            appendContext: [
-                                prepared.context,
-                                taskPrepared?.disposition === "injected" ? taskPrepared.context : "",
-                            ].filter(Boolean).join("\n\n"),
-                        };
-                }
-                if (taskPrepared?.disposition === "injected" && taskPrepared.context) {
-                    return { appendContext: taskPrepared.context };
+                    return contextEnvelope;
                 }
                 return;
             }
             catch (error) {
+                // Any exact delegated bytes retained while constructing evidence are
+                // discarded immediately on the fail-closed path.
+                cachePendingPrompt(sessionKey, { text: userText, ts: Date.now() });
                 await recordBlackbox("context.disposition", undefined, ctx, {
                     disposition: "recall_failed",
                     context_block_sha256: digestText(""),
@@ -940,6 +998,8 @@ function register(api) {
                     max_records: cfg.recall.maxRecords,
                     max_chars: cfg.recall.maxChars,
                     min_score: cfg.recall.minScore,
+                    require_direct_support: cfg.recall.requireDirectSupport,
+                    exclude_record_ids: personaRecordIds,
                     reference_mode: cfg.cacheAware.enabled && cfg.cacheAware.compactReferences
                         ? "compact"
                         : "full",
@@ -949,7 +1009,7 @@ function register(api) {
                     recall = result.block;
                     const current = pendingPrompts.get(sessionKey);
                     if (current) {
-                        pendingPrompts.set(sessionKey, {
+                        cachePendingPrompt(sessionKey, {
                             ...current,
                             injectedRecordIds: result.record_ids ?? [],
                             retrievalId: result.retrieval_id,
@@ -1002,7 +1062,7 @@ function register(api) {
             ? `ctxr_${digestJson({ componentEventIds, contextEnvelopeSha256 })}`
             : undefined;
         if (current) {
-            pendingPrompts.set(sessionKey, { ...current, contextReceiptId });
+            cachePendingPrompt(sessionKey, { ...current, contextReceiptId });
         }
         await recordBlackbox("context.disposition", undefined, ctx, {
             disposition: memoryContext
@@ -1017,6 +1077,9 @@ function register(api) {
             context_chars: memoryContext.length,
             candidate_ids: candidateIds,
             context_component_event_ids: componentEventIds,
+            persona_record_count: personaRecordIds.length,
+            recall_record_count: (current?.injectedRecordIds ?? []).length,
+            context_selection_profile: cfg.recall.requireDirectSupport ? "direct-support-v1" : "rank-threshold-v1",
             mode: "direct",
             context_location: contextLocation,
         }, undefined, {
@@ -1027,8 +1090,26 @@ function register(api) {
         if (Object.keys(result).length)
             return result;
     });
+    // Latest CLI harnesses emit terminal results on the agent-event stream.
+    // Feature-detect both API generations; never infer completion from a request.
+    const runContext = api.runContext ?? (api.setRunContext && api.getRunContext ? {
+        setRunContext: api.setRunContext.bind(api), getRunContext: api.getRunContext.bind(api),
+    } : undefined);
+    const subscribe = api.agent?.events?.registerAgentEventSubscription?.bind(api.agent.events)
+        ?? api.registerAgentEventSubscription?.bind(api);
+    const toolObservations = cfg.controlPlane.blackboxEnabled && subscribe
+        ? new ToolObservations(observationContext(runContext, digestJson({
+            command: cfg.command, args: cfg.commandArgs, state: cfg.controlPlane.statePath,
+            subjects: cfg.agentSubjects, workspaces: cfg.agentWorkspaces,
+        })), digestJson) : undefined;
+    if (toolObservations && subscribe)
+        subscribe({
+            id: "atmem-terminal-tool-observations", streams: ["tool"],
+            handle: event => toolObservations.observe(event),
+        });
     // ---- flight recorder + takeover enforcement --------------------------
     api.on("before_tool_call", async (event, ctx) => {
+        toolObservations?.request(event.toolName, event.toolCallId ?? ctx.toolCallId, { ...ctx, runId: event.runId ?? ctx.runId, agentId: agentIdFor(ctx) });
         await recordBlackbox("tool.requested", event.runId, ctx, {
             tool_name: event.toolName,
             tool_canonical_name: canonicalToolName(event.toolName),
@@ -1038,7 +1119,7 @@ function register(api) {
             derived_path_sha256: Array.isArray(event.derivedPaths)
                 ? event.derivedPaths.map((value) => digestText(String(value)))
                 : [],
-        }, event.toolCallId);
+        }, event.toolCallId ?? ctx.toolCallId);
         if (!cfg.takeoverActive || !cfg.nativeWorkspaces.some((workspace) => touchesNativeMemory(event, workspace)))
             return;
         const reason = "AtMem takeover blocked access to OpenClaw's frozen native memory " +
@@ -1051,26 +1132,41 @@ function register(api) {
             error_category: "blocked_by_memory_boundary",
             result_sha256: digestText(reason),
             duration_ms: 0,
-        }, event.toolCallId);
+        }, event.toolCallId ?? ctx.toolCallId);
         api.logger.warn(`${TAG} ${reason} Tool: ${event.toolName}`);
         return { block: true, blockReason: reason };
     });
     api.on("after_tool_call", async (event, ctx) => {
+        toolObservations?.completed(event.toolCallId ?? ctx.toolCallId, { ...ctx, runId: event.runId ?? ctx.runId, agentId: agentIdFor(ctx) });
         await recordBlackbox("tool.completed", event.runId, ctx, {
             tool_name: event.toolName,
             tool_canonical_name: canonicalToolName(event.toolName),
             result_sha256: digestJson(event.result ?? null),
+            ...(!event.error ? progressCardComparison(event.toolName, event.result, digestJson) : {}),
             outcome: event.error ? "error" : "completed",
             error_category: event.error ? "tool_error" : undefined,
+            error_reason: event.error ? toolErrorReason(event.error) : undefined,
+            error_sha256: event.error ? digestText(event.error) : undefined,
+            result_present: event.result !== undefined,
             duration_ms: event.durationMs ?? 0,
-        }, event.toolCallId);
+        }, event.toolCallId ?? ctx.toolCallId);
     });
     // ---- auto-capture: user turn through the pipeline, assistant as digest -
     api.on("agent_end", async (event, ctx) => {
-        const sessionKey = scopedKey(ctx.sessionKey ?? ctx.sessionId ?? "default-session", ctx);
+        await toolObservations?.flush({ ...ctx, runId: event.runId ?? ctx.runId, agentId: agentIdFor(ctx) }, async (saved) => {
+            await recordBlackbox("tool.completed", saved.ctx.runId, saved.ctx, {
+                tool_name: saved.name, tool_canonical_name: canonicalToolName(saved.name),
+                result_sha256: saved.result.digest, outcome: saved.result.error ? "error" : "completed",
+                error_category: saved.result.error ? "tool_error" : undefined,
+                error_reason: saved.result.reason,
+                error_sha256: saved.result.errorDigest,
+                reason: "observed_terminal_host_tool_event",
+            }, saved.callId);
+        });
+        const sessionKey = sessionKeyFor(ctx);
         const observedTurnInputKey = turnInputKey(ctx);
         const cached = pendingPrompts.get(sessionKey);
-        pendingPrompts.delete(sessionKey);
+        deletePendingPrompt(sessionKey);
         const userText = cached?.text?.replace(INJECT_RE, "").trim();
         try {
             if (cfg.takeoverActive) {

package/dist/src/delegated-identity.js

@@ -0,0 +1,62 @@
+import path from "node:path";
+import { lstatSync, realpathSync } from "node:fs";
+/** Verify the dedicated CLI process when the host omits origin metadata.
+ * This is an explicit local operator trust boundary, never shared-channel auth.
+ */
+export function isolatedCliProcess(config, hostConfig, runtime = { argv: process.argv.slice(2), stateDir: process.env.OPENCLAW_STATE_DIR, uid: process.getuid?.() }) {
+    const local = config.localOperator;
+    if (!local?.isolated || !local.stateDir || !runtime.stateDir || !hostConfig)
+        return false;
+    if (!runtime.argv.includes("agent") || !runtime.argv.includes("--local"))
+        return false;
+    const routed = ["--deliver", "--channel", "--to", "--reply-channel", "--reply-to", "--reply-account"];
+    if (runtime.argv.some(arg => routed.some(flag => arg === flag || arg.startsWith(flag + "="))))
+        return false;
+    const channels = hostConfig.channels;
+    if (channels !== undefined && (!channels || typeof channels !== "object" || Array.isArray(channels) || Object.keys(channels).length))
+        return false;
+    try {
+        const directory = lstatSync(local.stateDir);
+        return path.isAbsolute(local.stateDir) && directory.isDirectory() && !directory.isSymbolicLink()
+            && (directory.mode & 0o077) === 0 && directory.uid === runtime.uid
+            && realpathSync(local.stateDir) === realpathSync(runtime.stateDir);
+    }
+    catch {
+        return false;
+    }
+}
+/** Host metadata and operator configuration only; never prompt/model input. */
+export function delegatedIdentity(config, ctx, configuredWorkspace, verifiedIsolatedProcess = false) {
+    if (!config.userId)
+        return { reason: "delegated_user_unconfigured" };
+    if (ctx.senderIsOwner === false)
+        return { reason: "delegated_sender_not_owner" };
+    if (ctx.senderIsOwner !== undefined && ctx.senderIsOwner !== true) {
+        return { reason: "delegated_owner_metadata_invalid" };
+    }
+    if (config.requireOwner) {
+        return ctx.senderIsOwner === true
+            ? { userId: config.userId }
+            : { reason: "delegated_owner_metadata_missing" };
+    }
+    // Legacy requireOwner:false is no longer an unrestricted identity bypass.
+    const local = config.localOperator;
+    if (!local || local.isolated !== true) {
+        return { reason: "delegated_local_isolation_required" };
+    }
+    if ((ctx.messageProvider !== "cli" && !(ctx.messageProvider === undefined && verifiedIsolatedProcess)) || ctx.channel || ctx.channelId ||
+        ctx.accountId || ctx.chatId || ctx.senderId) {
+        return { reason: "delegated_local_origin_unverified" };
+    }
+    if (!local.agentId || !local.sessionKey || !local.sessionId || !local.workspaceDir ||
+        !ctx.runId || !ctx.workspaceDir || !configuredWorkspace ||
+        !path.isAbsolute(local.workspaceDir) || !path.isAbsolute(ctx.workspaceDir) ||
+        !path.isAbsolute(configuredWorkspace) ||
+        ctx.agentId !== local.agentId || ctx.sessionKey !== local.sessionKey ||
+        ctx.sessionId !== local.sessionId ||
+        path.resolve(ctx.workspaceDir) !== path.resolve(local.workspaceDir) ||
+        path.resolve(configuredWorkspace) !== path.resolve(local.workspaceDir)) {
+        return { reason: "delegated_local_scope_mismatch" };
+    }
+    return { userId: config.userId };
+}

package/dist/src/rpc-client.js

@@ -128,7 +128,7 @@ export class AtmemClient {
             capabilities: {},
             clientInfo: {
                 name: "openclaw-memory-atmem",
-                version: "2.2.6-beta.6",
+                version: "2.2.6",
             },
         });
         this.notify("notifications/initialized", {});

package/dist/src/setup.js

@@ -42,7 +42,7 @@ export function setupWrites(options) {
             minScore: 0.3,
             timeoutMs: 3000,
         },
-        persona: { enabled: true, maxChars: 600, ttlSeconds: 300 },
+        persona: { enabled: false, maxChars: 600, ttlSeconds: 300 },
         capture: { enabled: true, captureAssistant: true },
         cacheAware: { enabled: true, compactReferences: true },
         tools: { enabled: true },

package/dist/src/tool-errors.js

@@ -0,0 +1,31 @@
+/** Retain a bounded diagnostic, never the full tool result or stack trace. */
+export function toolErrorReason(value) {
+    let text = value;
+    if (value && typeof value === "object") {
+        const row = value;
+        text = row.error ?? row.message;
+        if (text && typeof text === "object")
+            text = text.message;
+        if (text === undefined && Array.isArray(row.content)) {
+            text = row.content.find(item => item?.type === "text" && typeof item.text === "string")?.text;
+        }
+    }
+    if (typeof text !== "string" || !text.trim())
+        return undefined;
+    const bounded = text.slice(0, 8192);
+    // OpenClaw wraps thrown web errors as untrusted API content. Extract only
+    // its narrow status prefix, never the page text or instructions beneath it.
+    if (bounded.startsWith("SECURITY NOTICE:")) {
+        const status = bounded.match(/<<<EXTERNAL_UNTRUSTED_CONTENT id="[a-f0-9]+">>>\r?\nSource: API\r?\n---\r?\n(Web fetch failed \([1-5][0-9]{2}\)):/);
+        return status?.[1];
+    }
+    return bounded.split(/[\r\n]/, 1)[0]
+        .replace(/https?:\/\/[^\s<>]+/gi, "[redacted-url]")
+        .replace(/\b(?:Bearer|Basic)\s+\S+/gi, "[redacted-auth]")
+        .replace(/\b(?:api[_-]?key|token|password|passwd|secret|authorization|cookie)\s*[:=]\s*(?:"[^"]*"|'[^']*'|\S+)/gi, "[redacted-credential]")
+        .replace(/\b(?:sk-|ghp_|github_pat_)[A-Za-z0-9_-]+/g, "[redacted-token]")
+        .replace(/\b[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,}\b/g, "[redacted-email]")
+        .replace(/(?:[A-Za-z]:\\|\/)[^\s<>"']+/g, "[redacted-path]")
+        .replace(/"[^"\r\n]*"|'[^'\r\n]*'/g, "[redacted-value]")
+        .replace(/[\x00-\x1f\x7f]/g, " ").trim().slice(0, 512) || undefined;
+}

package/dist/src/tool-observations.js

@@ -0,0 +1,115 @@
+import { createHash } from "node:crypto";
+import { toolErrorReason } from "./tool-errors.js";
+const CACHE_KEY = Symbol.for("atmem.tool-observation-cache.v1");
+const sharedCache = globalThis;
+const cache = sharedCache[CACHE_KEY] ??= new Map();
+/** Some hosts deny run-context writes from tool hooks after registry reload.
+ * Keep a bounded content-minimized process fallback, isolated by installation config.
+ */
+export function observationContext(host, scope) {
+    const keyFor = (runId, namespace) => JSON.stringify([scope, runId, namespace]);
+    const sweep = () => {
+        for (const [key, entry] of cache)
+            if (entry.expires <= Date.now())
+                cache.delete(key);
+        while (cache.size >= 2048)
+            cache.delete(cache.keys().next().value);
+    };
+    return {
+        setRunContext(patch) {
+            sweep();
+            cache.set(keyFor(patch.runId, patch.namespace), { value: structuredClone(patch.value), expires: Date.now() + 600_000 });
+            try {
+                host?.setRunContext(patch);
+            }
+            catch { /* Process fallback remains bounded. */ }
+            return true;
+        },
+        getRunContext(params) {
+            sweep();
+            const entry = cache.get(keyFor(params.runId, params.namespace));
+            if (entry)
+                return structuredClone(entry.value);
+            try {
+                return host?.getRunContext(params);
+            }
+            catch {
+                return undefined;
+            }
+        },
+    };
+}
+const INDEX = "atmem-tool-observations-v1";
+const namespace = (id) => INDEX + "-" + createHash("sha256").update(id).digest("hex");
+/** The CLI exposes its native names; the request hook exposes OpenClaw names. */
+function canonical(name) {
+    const unwrapped = name.replace(/^mcp__openclaw__/, "");
+    return { Read: "read", Bash: "exec" }[unwrapped] ?? unwrapped;
+}
+/** Stores scope, names, digests and redacted error diagnostics in bounded ephemeral context. */
+export class ToolObservations {
+    access;
+    digest;
+    constructor(access, digest) {
+        this.access = access;
+        this.digest = digest;
+    }
+    request(name, id, ctx) {
+        if (!id || !ctx.runId || !ctx.agentId || !ctx.sessionId || !ctx.sessionKey)
+            return;
+        const runId = ctx.runId;
+        const ids = this.access.getRunContext({ runId, namespace: INDEX }) ?? [];
+        if (ids.includes(id) || ids.length >= 256)
+            return;
+        // Never store the full hook context: it may contain host config/credentials.
+        const scope = { runId, agentId: ctx.agentId, sessionId: ctx.sessionId, sessionKey: ctx.sessionKey };
+        if (this.access.setRunContext({ runId, namespace: namespace(id), value: { ctx: scope, name, callId: id } })) {
+            this.access.setRunContext({ runId, namespace: INDEX, value: [...ids, id] });
+        }
+    }
+    completed(id, ctx) {
+        if (!id || !ctx.runId)
+            return;
+        const key = { runId: ctx.runId, namespace: namespace(id) };
+        const saved = this.access.getRunContext(key);
+        if (saved && saved.ctx.sessionId === ctx.sessionId && saved.ctx.sessionKey === ctx.sessionKey && saved.ctx.agentId === ctx.agentId) {
+            this.access.setRunContext({ ...key, value: { ...saved, hookCompleted: true } });
+        }
+    }
+    observe(event) {
+        const d = event.data;
+        if (event.stream !== "tool" || d.phase !== "result" || typeof d.toolCallId !== "string" ||
+            typeof d.name !== "string" || typeof d.isError !== "boolean" ||
+            !Object.hasOwn(d, "result") || d.incomplete === true || d.synthetic === true)
+            return;
+        const key = { runId: event.runId, namespace: namespace(d.toolCallId) };
+        const saved = this.access.getRunContext(key);
+        if (!saved || event.sessionKey !== saved.ctx.sessionKey ||
+            (event.sessionId !== undefined && event.sessionId !== saved.ctx.sessionId) ||
+            (event.agentId !== undefined && event.agentId !== saved.ctx.agentId) ||
+            canonical(d.name) !== canonical(saved.name))
+            return;
+        const result = { digest: this.digest(d.result), error: d.isError,
+            reason: d.isError ? toolErrorReason(d.error ?? d.result) : undefined,
+            errorDigest: d.isError && d.error !== undefined ? this.digest(d.error) : undefined };
+        const conflict = saved.conflict || (saved.result !== undefined &&
+            (saved.result.digest !== result.digest || saved.result.error !== result.error ||
+                saved.result.errorDigest !== result.errorDigest));
+        this.access.setRunContext({ ...key, value: { ...saved, result, conflict } });
+    }
+    async flush(ctx, record) {
+        if (!ctx.runId)
+            return;
+        const runId = ctx.runId;
+        const ids = this.access.getRunContext({ runId, namespace: INDEX }) ?? [];
+        for (const id of ids) {
+            const key = { runId, namespace: namespace(id) };
+            const saved = this.access.getRunContext(key);
+            if (saved && !saved.hookCompleted && !saved.conflict && saved.result &&
+                saved.ctx.sessionKey === ctx.sessionKey && saved.ctx.sessionId === ctx.sessionId && saved.ctx.agentId === ctx.agentId) {
+                await record(saved);
+                this.access.setRunContext({ ...key, value: { ...saved, hookCompleted: true } });
+            }
+        }
+    }
+}

package/dist/src/tool-result-comparison.js

@@ -0,0 +1,45 @@
+// Exact OpenClaw progress_card ↔ native relay equivalence. Never discard raw digests.
+export function progressCardComparison(name, result, digest) {
+    if (name !== "progress_card")
+        return {};
+    const record = (v) => !!v && typeof v === "object" && !Array.isArray(v);
+    const keys = (v, expected) => Object.keys(v).sort().join(",") === [...expected].sort().join(",");
+    const native = Array.isArray(result);
+    if (!native && (!record(result) || !keys(result, ["content", "details"])))
+        return {};
+    const content = native ? result : result.content;
+    if (!Array.isArray(content) || content.length !== 2 || !content.every(v => record(v) && keys(v, ["type", "text"]) && v.type === (native ? "input_text" : "text") &&
+        typeof v.text === "string" && v.text.length <= 1024))
+        return {};
+    let payload;
+    try {
+        payload = JSON.parse(content[1].text);
+    }
+    catch {
+        return {};
+    }
+    if (!record(payload) || !keys(payload, ["revision", "steps"]))
+        return {};
+    const { revision, steps } = payload;
+    if (revision !== null && (!Number.isSafeInteger(revision) || revision < 1))
+        return {};
+    if (steps !== null && (!record(steps) || !keys(steps, ["completed", "total"]) ||
+        !Number.isSafeInteger(steps.completed) || !Number.isSafeInteger(steps.total) ||
+        steps.completed < 0 || steps.total < 1 || steps.total > 50 ||
+        steps.completed > steps.total))
+        return {};
+    if (revision === null && steps !== null)
+        return {};
+    const expected = revision === null ? "Progress card cleared" : steps === null
+        ? `Progress card updated (rev ${revision})`
+        : `Progress card updated (rev ${revision}, ${steps.completed}/${steps.total} done)`;
+    if (content[0].text !== expected || content[1].text !== JSON.stringify(payload, null, 2))
+        return {};
+    if (!native && digest(result.details) !== digest(payload))
+        return {};
+    return {
+        result_comparison_profile: "openclaw-progress-card-v1",
+        result_comparison_sha256: digest(payload),
+        result_observation_shape: native ? "native_input_text" : "tool_content_details",
+    };
+}

package/dist/src/types.js

@@ -1,7 +1 @@
-/**
- * Minimal structural types for the OpenClaw plugin API surface this plugin
- * uses. Kept local (instead of importing "openclaw/plugin-sdk/core") so the
- * plugin builds without the SDK on the compile path; the shapes match the
- * hook/tool contracts observed in OpenClaw's plugin SDK.
- */
 export {};

package/openclaw.plugin.json

@@ -2,7 +2,7 @@
   "id": "memory-atmem",
   "name": "Memory (atmem)",
   "description": "OpenClaw bridge installed and managed by the AtMem memory control plane.",
-  "version": "2.2.6-beta.6",
+  "version": "2.2.7-beta.1",
   "commandAliases": ["memory-atmem"],
   "activation": {
     "onStartup": true,
@@ -81,15 +81,16 @@
           "enabled": { "type": "boolean", "default": true },
           "maxRecords": { "type": "number", "default": 3, "description": "Max memories injected per turn" },
           "maxChars": { "type": "number", "default": 1200, "description": "Total character budget for the injected block" },
+          "requireDirectSupport": { "type": "boolean", "default": true, "description": "Require direct query relevance for automatic recall; rank score alone is insufficient" },
           "minScore": { "type": "number", "default": 0.3, "description": "Minimum relevance score; 0.3 requires a lexical match (priors alone never inject)" },
           "timeoutMs": { "type": "number", "default": 4000, "description": "Recall timeout; on timeout the turn proceeds without injection" }
         }
       },
       "persona": {
         "type": "object",
-        "description": "L3 persona snapshot injected alongside recall",
+        "description": "Optional always-on persona snapshot; disabled by default to avoid unrelated context",
         "properties": {
-          "enabled": { "type": "boolean", "default": true },
+          "enabled": { "type": "boolean", "default": false },
           "maxChars": { "type": "number", "default": 600, "description": "Character budget for the <user_persona> block" },
           "ttlSeconds": { "type": "number", "default": 300, "description": "Persona cache lifetime; also invalidated whenever new memory is captured" }
         }
@@ -150,7 +151,21 @@
           "requireOwner": {
             "type": "boolean",
             "default": true,
-            "description": "Send the mapped user ID only when OpenClaw marks the sender as owner."
+            "description": "Require authenticated owner metadata (default). False requires the explicit isolated localOperator mapping; it is not an ownership bypass."
+          },
+          "localOperator": {
+            "type": "object",
+            "additionalProperties": false,
+            "required": ["isolated", "agentId", "workspaceDir", "sessionKey", "sessionId"],
+            "description": "Only for a dedicated local CLI process with channels disabled by the operator. Requires host messageProvider=cli, workspace and exact session generation; channel-originated turns are refused.",
+            "properties": {
+              "isolated": { "type": "boolean", "const": true, "description": "Operator assertion that this process is isolated from shared channels and other users." },
+              "stateDir": { "type": "string", "minLength": 1, "description": "Optional dedicated owner-only OPENCLAW_STATE_DIR. Required when a direct agent --local process omits CLI origin metadata; channels and delivery flags must be absent." },
+              "agentId": { "type": "string", "minLength": 1 },
+              "workspaceDir": { "type": "string", "minLength": 1 },
+              "sessionKey": { "type": "string", "minLength": 1 },
+              "sessionId": { "type": "string", "minLength": 1 }
+            }
           }
         }
       }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "openclaw-memory-atmem",
-  "version": "2.2.6-beta.6",
+  "version": "2.2.7-beta.1",
   "description": "OpenClaw Agent Black Box and memory control-plane bridge for AtMem",
   "type": "module",
   "main": "./dist/index.js",
@@ -40,8 +40,8 @@
   "scripts": {
     "build": "tsc -p tsconfig.json",
     "typecheck": "tsc -p tsconfig.json --noEmit",
-    "test": "node test/manifest.mjs && node test/hook-context-compat.mjs && node test/setup.mjs && node test/hooks.mjs && node test/task-tools.mjs && node test/delegated-context-contract.mjs",
-    "smoke": "node test/smoke.mjs && node test/task-journey.mjs",
+    "test": "node test/manifest.mjs && node test/hook-context-compat.mjs && node test/setup.mjs && node test/hooks.mjs && node test/delegated-identity.mjs && node test/tool-observations.mjs && node test/tool-result-comparison.mjs && node test/blackbox-diagnostics.mjs && node test/task-tools.mjs && node test/delegated-context-contract.mjs",
+    "smoke": "node test/smoke.mjs && node test/task-journey.mjs && node test/delegated-journey.mjs",
     "prepack": "npm run build && npm run typecheck && npm test && npm run smoke",
     "hook-context": "node test/hook-context-compat.mjs",
     "record-hook-context": "node test/lib/record-hook-context.mjs"