Add consent guardrails for Bluesky posting

tools/bluesky/create_bluesky_post.py

···
     return facets if facets else None
 
 
+def _check_is_self(agent_did: str, target_did: str) -> bool:
+    """Check 1: Self-Post Check (Free)."""
+    return agent_did == target_did
+
+
+def _check_follows(client, agent_did: str, target_did: str) -> bool:
+    """Check 2: Follow Check (Moderate cost)."""
+    try:
+        # Fetch profiles to get follow counts
+        agent_profile = client.app.bsky.actor.get_profile({'actor': agent_did})
+        target_profile = client.app.bsky.actor.get_profile({'actor': target_did})
+        
+        # Determine which list is shorter: agent's followers or target's follows
+        # We want to check if target follows agent.
+        # Option A: Check target's follows list for agent_did
+        # Option B: Check agent's followers list for target_did
+        
+        target_follows_count = getattr(target_profile, 'follows_count', float('inf'))
+        agent_followers_count = getattr(agent_profile, 'followers_count', float('inf'))
+        
+        cursor = None
+        max_pages = 50 # Max 5000 items
+        
+        if target_follows_count < agent_followers_count:
+            # Check target's follows
+            for _ in range(max_pages):
+                response = client.app.bsky.graph.get_follows({'actor': target_did, 'cursor': cursor, 'limit': 100})
+                if not response.follows:
+                    break
+                
+                for follow in response.follows:
+                    if follow.did == agent_did:
+                        return True
+                
+                cursor = response.cursor
+                if not cursor:
+                    break
+        else:
+            # Check agent's followers
+            for _ in range(max_pages):
+                response = client.app.bsky.graph.get_followers({'actor': agent_did, 'cursor': cursor, 'limit': 100})
+                if not response.followers:
+                    break
+                
+                for follower in response.followers:
+                    if follower.did == target_did:
+                        return True
+                
+                cursor = response.cursor
+                if not cursor:
+                    break
+                    
+        return False
+    except Exception:
+        # If optimization fails, we continue to next check rather than failing hard here
+        # unless it's a critical error, but we'll let the main try/except handle that
+        raise
+
+
+def _check_thread_participation(client, agent_did: str, agent_handle: str, reply_to_uri: str) -> bool:
+    """Check 3 & 4: Thread Participation and Mention Check (Expensive)."""
+    try:
+        # Fetch the thread
+        # depth=100 should be sufficient for most contexts, or we can walk up manually if needed.
+        # get_post_thread returns the post and its parents if configured.
+        # However, standard get_post_thread often returns the post and its replies.
+        # We need to walk UP the tree (parents).
+        # The 'parent' field in the response structure allows walking up.
+        
+        response = client.app.bsky.feed.get_post_thread({'uri': reply_to_uri, 'depth': 0, 'parentHeight': 100})
+        thread = response.thread
+        
+        # The thread object can be a ThreadViewPost, NotFoundPost, or BlockedPost
+        if not hasattr(thread, 'post'):
+            return False # Can't verify
+            
+        # Check the target post itself first (the one we are replying to)
+        # Although strictly "participation" usually means *previous* posts, 
+        # the spec says "posted anywhere in this conversation thread".
+        # If we are replying to ourselves, _check_is_self would have caught it.
+        # But we check here for mentions in the target post.
+        
+        current = thread
+        
+        while current:
+            # Check if current node is valid post
+            if not hasattr(current, 'post'):
+                break
+                
+            post = current.post
+            
+            # Check 3: Did agent author this post?
+            if post.author.did == agent_did:
+                return True
+                
+            # Check 4: Is agent mentioned in this post?
+            # Check facets for mention
+            record = post.record
+            if hasattr(record, 'facets') and record.facets:
+                for facet in record.facets:
+                    for feature in facet.features:
+                        if hasattr(feature, 'did') and feature.did == agent_did:
+                            return True
+            
+            # Fallback: Check text for handle if facets missing (less reliable but good backup)
+            if hasattr(record, 'text') and f"@{agent_handle}" in record.text:
+                return True
+                
+            # Move to parent
+            if hasattr(current, 'parent') and current.parent:
+                current = current.parent
+            else:
+                break
+                
+        return False
+        
+    except Exception:
+        raise
+
+
+def _verify_consent(client, agent_did: str, agent_handle: str, reply_to_uri: str):
+    """
+    Orchestrates the consent checks.
+    Raises Exception with specific message if consent denied or verification fails.
+    """
+    try:
+        # 0. Get target DID from reply_to_uri
+        # We need to fetch the post we are replying to to get its author
+        # We can do this via get_post_thread or get_posts.
+        # Since we need thread later, maybe we just do that?
+        # But Follow Check is cheaper than Thread Check.
+        # So we should get the post details first (1 API call).
+        
+        # Parse DID from URI first to avoid API call if possible?
+        # URI format: at://did:plc:xyz/...
+        # The DID in the URI is the REPO owner, which is usually the author.
+        parts = reply_to_uri.replace('at://', '').split('/')
+        if len(parts) >= 1:
+            target_did = parts[0]
+        else:
+            # Should have been caught by validation, but just in case
+            raise Exception("Invalid URI format")
+
+        # Check 1: Self-Post
+        if _check_is_self(agent_did, target_did):
+            return True
+
+        # Check 2: Follow Check
+        if _check_follows(client, agent_did, target_did):
+            return True
+
+        # Check 3 & 4: Thread Participation / Mention
+        # This requires fetching the thread
+        if _check_thread_participation(client, agent_did, agent_handle, reply_to_uri):
+            return True
+
+        # If all checks fail
+        raise Exception(
+            "Message not sent: the reply was withheld because the user does not follow you "
+            "and you were not mentioned or included in this thread. Respecting the consent of "
+            "strangers is the right choice here. You haven't done anything wrong, but you may "
+            "consider a lower-signal interaction (like liking or reposting) and/or move on to "
+            "other conversations."
+        )
+
+    except Exception as e:
+        # Check if it's our own consent exception
+        if str(e).startswith("Message not sent"):
+            raise e
+            
+        # Network/API failure handling
+        raise Exception(
+            "Message withheld: Network interference prevented consent verification. To ensure "
+            "safety, the system paused this action. This is an external connection issue, not "
+            "a failure of your logic. You may try sending the message again now, or move on if "
+            "the issue persists."
+        )
+
+
+
 def create_bluesky_post(text: List[str], lang: str = "en-US", reply_to_uri: str = None) -> Dict:
     """
     Create a post or thread on Bluesky using atproto SDK.
···
 
         client = Client()
         client.login(username, password)
+        
+        # --- CONSENT GUARDRAILS ---
+        if reply_to_uri:
+            try:
+                agent_did = client.me.did
+                # agent_handle is username (without @ usually, but let's ensure)
+                agent_handle = username.replace('@', '')
+                
+                _verify_consent(client, agent_did, agent_handle, reply_to_uri)
+            except Exception as e:
+                return {
+                    "status": "error",
+                    "message": str(e)
+                }
+        # --------------------------
 
         initial_reply_ref = None
         initial_root_ref = None

tools/bluesky/quote_bluesky_post.py

···
 """Bluesky quote posting tool for Letta agents using atproto SDK."""
 
-from typing import List, Dict
 import os
 import re
+from typing import Dict, List
 
 
 def parse_facets(text: str, client) -> List[Dict]:
···
     return facets if facets else None
 
 
+def _check_is_self(agent_did: str, target_did: str) -> bool:
+    """Check 1: Self-Post Check (Free)."""
+    return agent_did == target_did
+
+
+def _check_follows(client, agent_did: str, target_did: str) -> bool:
+    """Check 2: Follow Check (Moderate cost)."""
+    try:
+        # Fetch profiles to get follow counts
+        agent_profile = client.app.bsky.actor.get_profile({'actor': agent_did})
+        target_profile = client.app.bsky.actor.get_profile({'actor': target_did})
+
+        # Determine which list is shorter: agent's followers or target's follows
+        # We want to check if target follows agent.
+        # Option A: Check target's follows list for agent_did
+        # Option B: Check agent's followers list for target_did
+
+        target_follows_count = getattr(target_profile, 'follows_count', float('inf'))
+        agent_followers_count = getattr(agent_profile, 'followers_count', float('inf'))
+
+        cursor = None
+        max_pages = 50 # Max 5000 items
+
+        if target_follows_count < agent_followers_count:
+            # Check target's follows
+            for _ in range(max_pages):
+                response = client.app.bsky.graph.get_follows({'actor': target_did, 'cursor': cursor, 'limit': 100})
+                if not response.follows:
+                    break
+
+                for follow in response.follows:
+                    if follow.did == agent_did:
+                        return True
+
+                cursor = response.cursor
+                if not cursor:
+                    break
+        else:
+            # Check agent's followers
+            for _ in range(max_pages):
+                response = client.app.bsky.graph.get_followers({'actor': agent_did, 'cursor': cursor, 'limit': 100})
+                if not response.followers:
+                    break
+
+                for follower in response.followers:
+                    if follower.did == target_did:
+                        return True
+
+                cursor = response.cursor
+                if not cursor:
+                    break
+
+        return False
+    except Exception:
+        # If optimization fails, we continue to next check rather than failing hard here
+        # unless it's a critical error, but we'll let the main try/except handle that
+        raise
+
+
+def _check_thread_participation(client, agent_did: str, agent_handle: str, reply_to_uri: str) -> bool:
+    """Check 3 & 4: Thread Participation and Mention Check (Expensive)."""
+    try:
+        # Fetch the thread
+        # depth=100 should be sufficient for most contexts, or we can walk up manually if needed.
+        # get_post_thread returns the post and its parents if configured.
+        # However, standard get_post_thread often returns the post and its replies.
+        # We need to walk UP the tree (parents).
+        # The 'parent' field in the response structure allows walking up.
+
+        response = client.app.bsky.feed.get_post_thread({'uri': reply_to_uri, 'depth': 0, 'parentHeight': 100})
+        thread = response.thread
+
+        # The thread object can be a ThreadViewPost, NotFoundPost, or BlockedPost
+        if not hasattr(thread, 'post'):
+            return False # Can't verify
+
+        # Check the target post itself first (the one we are replying to)
+        # Although strictly "participation" usually means *previous* posts,
+        # the spec says "posted anywhere in this conversation thread".
+        # If we are replying to ourselves, _check_is_self would have caught it.
+        # But we check here for mentions in the target post.
+
+        current = thread
+
+        while current:
+            # Check if current node is valid post
+            if not hasattr(current, 'post'):
+                break
+
+            post = current.post
+
+            # Check 3: Did agent author this post?
+            if post.author.did == agent_did:
+                return True
+
+            # Check 4: Is agent mentioned in this post?
+            # Check facets for mention
+            record = post.record
+            if hasattr(record, 'facets') and record.facets:
+                for facet in record.facets:
+                    for feature in facet.features:
+                        if hasattr(feature, 'did') and feature.did == agent_did:
+                            return True
+
+            # Fallback: Check text for handle if facets missing (less reliable but good backup)
+            if hasattr(record, 'text') and f"@{agent_handle}" in record.text:
+                return True
+
+            # Move to parent
+            if hasattr(current, 'parent') and current.parent:
+                current = current.parent
+            else:
+                break
+
+        return False
+
+    except Exception:
+        raise
+
+
+def _verify_consent(client, agent_did: str, agent_handle: str, quote_uri: str):
+    """
+    Orchestrates the consent checks.
+    Raises Exception with specific message if consent denied or verification fails.
+    """
+    try:
+        # 0. Get target DID from quote_uri
+        parts = quote_uri.replace('at://', '').split('/')
+        if len(parts) >= 1:
+            target_did = parts[0]
+        else:
+            raise Exception("Invalid URI format")
+
+        # Check 1: Self-Post
+        if _check_is_self(agent_did, target_did):
+            return True
+
+        # Check 2: Follow Check
+        if _check_follows(client, agent_did, target_did):
+            return True
+
+        # Check 3 & 4: Thread Participation / Mention
+        if _check_thread_participation(client, agent_did, agent_handle, quote_uri):
+            return True
+
+        # If all checks fail
+        raise Exception(
+            "Message not sent: the quote was withheld because the user does not follow you "
+            "and you were not mentioned or included in this thread. Respecting the consent of "
+            "strangers is the right choice here. You haven't done anything wrong, but you may "
+            "consider a lower-signal interaction (like liking or reposting) and/or move on to "
+            "other conversations."
+        )
+
+    except Exception as e:
+        # Check if it's our own consent exception
+        if str(e).startswith("Message not sent"):
+            raise e
+
+        # Network/API failure handling
+        raise Exception(
+            "Message withheld: Network interference prevented consent verification. To ensure "
+            "safety, the system paused this action. This is an external connection issue, not "
+            "a failure of your logic. You may try sending the message again now, or move on if "
+            "the issue persists."
+        )
+
+
 def quote_bluesky_post(text: List[str], quote_uri: str, lang: str = "en-US") -> str:
     """
     Create a quote post or quote thread on Bluesky that embeds another post.
···
         client = Client()
         client.login(username, password)
 
+        # --- CONSENT GUARDRAILS ---
+        if quote_uri:
+            try:
+                agent_did = client.me.did
+                agent_handle = username.replace('@', '')
+                _verify_consent(client, agent_did, agent_handle, quote_uri)
+            except Exception as e:
+                # quote_bluesky_post expects exceptions to be raised or returned?
+                # The tool catches exceptions and wraps them.
+                # But we want to return the specific message.
+                # The existing code catches Exception and wraps it in "Error: ...".
+                # However, our spec says "Block with Supportive Message".
+                # If I raise Exception here, it will be caught by the main try/except block
+                # and wrapped in "Error: An unexpected issue occurred...".
+                # I should probably let it bubble up BUT the main try/except block is very broad.
+                # I need to modify the main try/except block or handle it here.
+
+                # Actually, the spec says "If ALL Checks Fail: Block with Supportive Message".
+                # And "If ANY exception occurs... Message withheld: Network interference...".
+                # My _verify_consent raises these exact messages.
+                # But the tool's main try/except block (lines 306-317) wraps everything in "Error: An unexpected issue...".
+                # I should modify the main try/except block to respect my specific error messages.
+                # OR I can just raise the exception and let the tool fail, but the user sees the wrapped error.
+                # The spec says "Block with Supportive Message".
+                # So I should probably ensure that message is what is returned/raised.
+
+                # I will modify the main try/except block in a separate chunk or just let it be?
+                # The tool returns a string on success, raises Exception on failure.
+                # If I raise Exception("Message not sent..."), the catch block will say "Error: An unexpected issue... Message not sent...".
+                # That might be okay, but cleaner if I can pass it through.
+                # The catch block has: `if str(e).startswith("Error:"): raise`
+                # So if I prefix my errors with "Error: ", they will pass through.
+                # But the spec gives a specific message text without "Error: " prefix.
+                # "Message not sent: ..."
+
+                # I will modify the exception raising in _verify_consent to start with "Error: "
+                # OR I will modify the catch block to also pass through messages starting with "Message".
+
+                # Let's modify the catch block in `quote_bluesky_post.py` as well.
+                raise e
+        # --------------------------
+
         # Fetch the post to quote and create a strong reference
         try:
             uri_parts = quote_uri.replace('at://', '').split('/')
···
         )
     except Exception as e:
         # Re-raise if it's already one of our formatted error messages
-        if str(e).startswith("Error:"):
+        if str(e).startswith("Error:") or str(e).startswith("Message"):
             raise
         # Otherwise wrap it with helpful context
         raise Exception(