zigmini 1.0.0-beta.2 → 1.1.0-beta.1

package/src/protocol.ts

@@ -11,8 +11,8 @@ export const ROTATION_HELD_MESSAGE: Text = {
 	ko: "진행 중이거나 확인되지 않은 작업이 있어 같은 세션을 유지합니다.",
 };
 
-export type Channel = "web" | "app" | "home" | "hud" | "discord";
-export type Trust = "owner" | "owner-voice" | "unknown";
+export type Channel = "web" | "app" | "home" | "hud" | "discord" | "gateway";
+export type Trust = "owner" | "owner-voice" | "unknown" | "delegated";
 
 export interface Source {
 	channel: Channel;
@@ -20,11 +20,15 @@ export interface Source {
 	device?: string;
 }
 
+import type { AttachmentMetadata } from "./attachments/types.ts";
+
 export interface MessageReference {
 	readonly seq: number;
 	readonly role: "user" | "assistant";
 	readonly text: string;
 	readonly images?: readonly string[];
+	/** Immutable metadata copied from the referenced message; a new Send still gets its own grant. */
+	readonly attachments?: readonly AttachmentMetadata[];
 }
 
 /** Measured across one native response turn, including its model calls around tools. */
@@ -92,9 +96,31 @@ export type DecisionAnswerRequest = { readonly expectedRevision: number; readonl
 	| { readonly mode: "request_permission" | "recheck"; readonly response?: never; readonly answers?: never; readonly value?: never; readonly confirmed?: never }
 );
 
+/**
+ * The owner's view of a held collaboration artifact read (payload purpose collaboration_artifact_review): what is needed
+ * to allow or deny it through POST /api/agent-collaboration/holds/:holdId, never the content or a flagged value.
+ */
+export interface ArtifactReviewInfo {
+	readonly holdId: string;
+	readonly revision: number;
+	readonly state: import("./security-allow.ts").ArtifactSecurityHold["state"];
+	readonly resumeState: import("./security-allow.ts").ArtifactSecurityHold["continuation"]["state"];
+	/** The agent whose read is held; null when the main conversation reads. */
+	readonly agentId: string | null;
+	readonly requestId: string;
+	readonly artifactId: string;
+	readonly fileName: string;
+	readonly view: "raw" | "text" | "pages";
+	/** Pages: first and last page number; text and raw: scalar/byte offsets. */
+	readonly range: { readonly start: number; readonly end: number };
+	/** null for a hold written before summaries were recorded. */
+	readonly summary: import("./security-allow.ts").ArtifactReviewSummary | null;
+}
+
 /** HTTP/event DTOs are separate from storage records; payload retains the existing action-card structure. */
 export interface DecisionInfo {
 	readonly security?: import("./security-allow.ts").HeldState;
+	readonly artifactReview?: ArtifactReviewInfo;
 	readonly id: string;
 	readonly revision: number;
 	readonly ownerConv: string;
@@ -116,7 +142,7 @@ export interface DecisionInfo {
 	readonly submissionMode: "answer" | "resume" | null;
 	readonly answer: unknown;
 	readonly commandId: string | null;
-	readonly answerRoute: "live_response" | "follow_up_command" | null;
+	readonly answerRoute: "live_response" | "follow_up_command" | "collaboration_stage" | null;
 	readonly supersededBy: string | null;
 	readonly reason: string | null;
 	readonly createdAt: string;
@@ -157,14 +183,23 @@ export interface ReplyNotification {
 }
 
 export type ClientMessage =
-	| { type: "hello"; data: { client: string; version: string } }
+	| { type: "hello"; data: { client: string; version: string; capabilities?: { hostFileAttachments?: unknown } } }
 	| { type: "client.presence"; data: { visible: boolean } }
 	| { type: "history.get"; conv: string; before?: number; after?: number; limit?: number }
 	| { type: "conversation.create"; data: { title: string } }
-	| { type: "input.text"; conv: string; data: { text: string; images?: string[]; references?: number[]; submissionId?: string } }
+	| { type: "input.text"; conv: string; data: { text: string; images?: string[]; references?: number[]; submissionId?: string; attachments?: string[] } }
 	| { type: "input.action"; conv: string; data: ActionAnswerData }
 	| { type: "input.interrupt"; conv: string; data: Record<string, never> }
-	| { type: "conversation.rotate"; conv: string }
+	// open: open the agent conversation's next session right after the rotation; any other present value is refused.
+	| { type: "conversation.rotate"; conv: string; open?: true }
 	| { type: "reminder.ack"; data: { id: string } }
 	| { type: "question.notification.ack"; data: { id: string } }
 	| { type: "reply.notification.ack"; data: { id: string } };
+
+/** 294 C3: compatibility marker a new client sends with tool permission requests. It is not a credential. */
+export const AGENT_TOOL_FEATURE = "agent-tool-permissions-v1";
+
+/** 294 C3: the only answer body a tool purpose decision accepts (besides { cancelled: true }). */
+export interface AgentToolGrantResponse {
+	readonly toolGrant: { readonly choice: "allow" | "deny"; readonly proposalDigest: string };
+}

package/src/security-allow.ts

@@ -37,14 +37,88 @@ export interface SecurityIntent {
 }
 export type SecurityReceipt =
 	| { readonly kind: "message"; readonly conv: string; readonly messageSeq: number }
-	| { readonly kind: "answer"; readonly decisionId: string; readonly submissionId: string };
-export interface SecurityHoldRecord {
+	| { readonly kind: "answer"; readonly decisionId: string; readonly submissionId: string }
+	| ArtifactReviewReceipt | ArtifactReleaseReceipt;
+export interface MessageSecurityHoldRecord {
 	readonly state: HeldState;
 	readonly key: string | null;
 	readonly intent: SecurityIntent | null;
 	readonly dispatchReserved: boolean;
 	readonly receipt: SecurityReceipt | null;
 }
+export type SecurityHoldRecord = MessageSecurityHoldRecord | ArtifactSecurityHold;
+export interface ArtifactReadBinding {
+	readonly inputId: string;
+	readonly activationId: string | null;
+	readonly managedBindingDigest: string;
+}
+export interface ArtifactReviewReceipt {
+	readonly kind: "collaboration_artifact_review";
+	readonly holdId: string;
+	readonly decisionId: string;
+	readonly revision: number;
+	readonly submissionId: string;
+	readonly scopeDigest: string;
+	readonly reviewState: "allowed" | "denied" | "cancelled";
+	readonly resource: { readonly requestId: string; readonly artifactId: string; readonly resultId: string };
+	readonly effect: "review_recorded";
+	readonly contentReleased: false;
+}
+export interface ArtifactReleaseReceipt {
+	readonly kind: "collaboration_artifact";
+	readonly readOperationId: string;
+	readonly holdId: string;
+	readonly requestId: string;
+	readonly artifactId: string;
+	readonly grantRevision: number;
+	readonly representationSha256: string;
+	readonly scopeDigest: string;
+	readonly continuationId: string | null;
+	readonly boundScopeDigest: string | null;
+	readonly releaseState: "claimed" | "released" | "unknown";
+}
+/**
+ * What the owner is told about a held read: the finding kinds with their counts (never a flagged value) and the pages
+ * the native reader rendered without any text layer, which no check could cover (held fail-closed).
+ */
+export interface ArtifactReviewSummary {
+	readonly findings: readonly { readonly kind: string; readonly count: number }[];
+	readonly unscannedPages: readonly number[];
+}
+export interface ArtifactSecurityHold {
+	readonly id: string;
+	readonly decisionId: string;
+	readonly revision: number;
+	readonly source: "collaboration_artifact";
+	readonly purpose: "collaboration_artifact_review";
+	readonly state: "pending" | "allowed" | "denied" | "cancelled" | "invalidated";
+	/** Absent on a hold written before summaries were recorded. */
+	readonly summary?: ArtifactReviewSummary;
+	readonly resourceRef: { readonly kind: "collaboration_artifact"; readonly requestId: string; readonly artifactId: string; readonly resultId: string; readonly originalSha256: string };
+	readonly representation: {
+		readonly sha256: string; readonly revision: number; readonly view: "raw" | "text" | "pages";
+		readonly range: { readonly start: number; readonly end: number }; readonly coverageDigest: string; readonly scanRevision: string;
+	};
+	readonly readScope: ArtifactReadBinding & {
+		readonly artifactGrantId: string; readonly grantRevision: number; readonly granteeConv: string;
+		readonly lifecycleEpoch: number; readonly recipientAuthorityEpoch?: number;
+	};
+	readonly scopeDigest: string;
+	readonly readOperationId: string;
+	readonly ownerPrincipalRef: string;
+	readonly answerSubmissionId: string | null;
+	readonly reviewReceipt: { readonly decisionRevision: number; readonly choice: "allow" | "deny" | "cancel" } | null;
+	readonly readArguments: { readonly requestId: string; readonly artifactId: string; readonly view?: "text" | "pages"; readonly cursor?: string; readonly limit?: number };
+	readonly continuation: {
+		readonly id: string; readonly originInputSeq: number; readonly originOwnerInputRevision: number;
+		readonly settledReceipt: (ArtifactReadBinding & { readonly settlementId: string }) | null;
+		readonly state: "unrequested" | "queued" | "dispatched" | "released" | "cancelled" | "invalidated" | "unknown";
+		readonly resumeSubmissionId: string | null; readonly reviewedScopeDigest: string | null;
+		readonly targetBinding: ArtifactReadBinding | null; readonly boundScopeDigest: string | null;
+		readonly dispatchReceiptId: string | null; readonly releaseReceiptId: string | null;
+	};
+	readonly invalidationReason: string | null;
+}
 export class SecurityRuntimeError extends Error {
 	constructor(
 		readonly code: "held_conflict" | "allowlist_conflict" | SecurityErrorCode,
@@ -55,6 +129,9 @@ export class SecurityRuntimeError extends Error {
 export const securityDecision = (decision: { readonly payload: unknown }): boolean =>
 	typeof decision.payload === "object" && decision.payload !== null &&
 	"kind" in decision.payload && decision.payload.kind === "security-check";
+/** The security decision of a held collaboration artifact read; every other security decision is a message or answer hold. */
+export const artifactReviewDecision = (decision: { readonly payload: unknown }): boolean =>
+	securityDecision(decision) && (decision.payload as { readonly purpose?: unknown }).purpose === "collaboration_artifact_review";
 
 /** A delimiter is meaningful only if its matching quote can be proved. No decoding or normalization. */
 function quotedEnd(text: string, start: number, quote: string): number | null {

package/src/security-check.ts

@@ -3,7 +3,7 @@ import ruleConfig from "../scripts/secret-scan.rules.json";
 import allowConfig from "../scripts/secret-scan.allow.json";
 import { readVoiceSetting, writeVoiceSetting } from "./voice-setting.ts";
 import { isDeepStrictEqual } from "node:util";
-import { canonicalSecurityValue, SecurityRuntimeError, type HeldState, type SecurityApprover, type SecurityHoldRecord, type SecurityIntent, type SecurityReceipt } from "./security-allow.ts";
+import { canonicalSecurityValue, SecurityRuntimeError, type HeldState, type SecurityApprover, type MessageSecurityHoldRecord as SecurityHoldRecord, type SecurityIntent, type SecurityReceipt } from "./security-allow.ts";
 import { SecurityBaselineError, type Store } from "./store.ts";
 import type { SecurityBaseline } from "./security-baseline.ts";
 import { say, type Text } from "./server-text.ts";