@aexol/spectral 0.9.246 → 0.9.249

package/CHANGELOG.md

@@ -5,6 +5,33 @@ All notable changes to `@aexol/spectral` are documented here. Format follows
 
 ## [Unreleased]
 
+## [0.9.249] - 2026-10-06
+
+### Changed
+
+- Release housekeeping for v0.9.249: cli-node version bump to 0.9.249, npm
+  lockfile version sync in `package-lock.json` (the root and package entries
+  were left at 0.9.247 by the v0.9.248 release), and Nix package version sync
+  in `nix/packages/spectral-cli.nix`.
+
+## [0.9.247] - 2026-10-04
+
+### Added
+
+- Added a public built-in model catalog: new `publicModelCatalog` GraphQL
+  query (`BuiltInModelCatalogEntry`) exposing built-in UserModels with credit
+  pricing per 1M tokens, measured average TPS (output tokens over measured
+  duration rows only), owner-configured fallback tok/s on BaseModel,
+  last-request time, 30-day request count, and status. The `/models` landing
+  page was rebuilt around `models-catalog-section.tsx`.
+- Added `durationMs` capture on CreditUsageEvent in the backend generate and
+  refine flows, with database migrations `20261004122612` and
+  `20261004135152`.
+- Added cli-node attachment support: persist and cleanup in
+  `src/server/attachments` with tests, plus serve, agent-bridge,
+  session-stream, and storage changes.
+- Added a Fallback tok/s input to the admin base-models tab.
+
 ## [0.9.231] - 2026-09-23
 
 ### Added

package/dist/agent/agents.d.ts

@@ -1,4 +1,3 @@
-export type AgentScope = "user" | "project" | "both";
 export type AgentMode = "primary" | "subagent";
 export interface AgentConfig {
     name: string;
@@ -6,13 +5,9 @@ export interface AgentConfig {
     mode: AgentMode;
     model?: string;
     systemPrompt: string;
-    source: "user" | "project" | "cloud" | "system";
+    source: "cloud" | "system";
     filePath: string;
 }
-export interface AgentDiscoveryResult {
-    agents: AgentConfig[];
-    projectAgentsDir: string | null;
-}
 export declare const SYSTEM_AGENTS: AgentConfig[];
 export declare function setCloudAgents(agents: AgentConfig[], teamId?: string): void;
 /**
@@ -35,8 +30,15 @@ export declare function refreshCloudAgents(opts: {
     machineJwt: string;
     teamId?: string;
 }): Promise<CloudAgentRefreshResult>;
-export declare function discoverAgents(cwd: string, scope: AgentScope, agentDir?: string, teamId?: string): AgentDiscoveryResult;
-export declare function discoverPrimaryAgent(cwd: string, scope?: AgentScope, agentDir?: string, teamId?: string): AgentConfig | null;
+/**
+ * Discover all agents available to a session: built-in system agents
+ * (SYSTEM_AGENTS, read-only) plus cloud agents from the backend cache
+ * (refreshCloudAgents, managed in Aexol Studio). Cloud agents override
+ * system agents on name collision. Never throws and never touches the
+ * network — offline / logged-out sessions simply get the system agents.
+ */
+export declare function discoverAgents(teamId?: string): AgentConfig[];
+export declare function discoverPrimaryAgent(teamId?: string): AgentConfig | null;
 /**
  * Resolve the primary agent for a session.
  *
@@ -46,7 +48,7 @@ export declare function discoverPrimaryAgent(cwd: string, scope?: AgentScope, ag
  * resolves to `null` (no fallback to auto-detect), so a stale selection never
  * silently injects an arbitrary primary agent.
  */
-export declare function resolveSelectedPrimaryAgent(selectedName: string | null | undefined, cwd: string, agentDir?: string, teamId?: string): AgentConfig | null;
+export declare function resolveSelectedPrimaryAgent(selectedName: string | null | undefined, teamId?: string): AgentConfig | null;
 /**
  * Prepend the primary agent's system prompt above the base system prompt.
  *

package/dist/agent/agents.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"agents.d.ts","sourceRoot":"","sources":["../../src/agent/agents.ts"],"names":[],"mappings":"AAUA,MAAM,MAAM,UAAU,GAAG,MAAM,GAAG,SAAS,GAAG,MAAM,CAAC;AACrD,MAAM,MAAM,SAAS,GAAG,SAAS,GAAG,UAAU,CAAC;AAC/C,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,SAAS,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,YAAY,EAAE,MAAM,CAAC;IACrB,MAAM,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,GAAG,QAAQ,CAAC;IAChD,QAAQ,EAAE,MAAM,CAAC;CAClB;AACD,MAAM,WAAW,oBAAoB;IACnC,MAAM,EAAE,WAAW,EAAE,CAAC;IACtB,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;CACjC;AA6ED,eAAO,MAAM,aAAa,EAAE,WAAW,EAkDtC,CAAC;AA0DF,wBAAgB,cAAc,CAAC,MAAM,EAAE,WAAW,EAAE,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAO3E;AACD;;;;GAIG;AACH,MAAM,MAAM,uBAAuB,GAAG;IACpC,yEAAyE;IACzE,YAAY,EAAE,IAAI,CAAC;IACnB,6CAA6C;IAC7C,MAAM,EAAE,MAAM,CAAC;CAChB,GAAG;IACF,YAAY,EAAE,KAAK,CAAC;IACpB,4EAA4E;IAC5E,KAAK,EAAE,MAAM,CAAC;CACf,CAAC;AAEF,wBAAsB,kBAAkB,CAAC,IAAI,EAAE;IAC7C,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,GAAG,OAAO,CAAC,uBAAuB,CAAC,CA6EnC;AAkBD,wBAAgB,cAAc,CAC5B,GAAG,EAAE,MAAM,EACX,KAAK,EAAE,UAAU,EACjB,QAAQ,CAAC,EAAE,MAAM,EACjB,MAAM,CAAC,EAAE,MAAM,GACd,oBAAoB,CAmBtB;AACD,wBAAgB,oBAAoB,CAClC,GAAG,EAAE,MAAM,EACX,KAAK,GAAE,UAAmB,EAC1B,QAAQ,CAAC,EAAE,MAAM,EACjB,MAAM,CAAC,EAAE,MAAM,GACd,WAAW,GAAG,IAAI,CAepB;AACD;;;;;;;;GAQG;AACH,wBAAgB,2BAA2B,CACzC,YAAY,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EACvC,GAAG,EAAE,MAAM,EACX,QAAQ,CAAC,EAAE,MAAM,EACjB,MAAM,CAAC,EAAE,MAAM,GACd,WAAW,GAAG,IAAI,CAgBpB;AACD;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CACtC,IAAI,EAAE,MAAM,GAAG,SAAS,EACxB,YAAY,EAAE,IAAI,CAChB,WAAW,EACX,MAAM,GAAG,aAAa,GAAG,cAAc,GAAG,OAAO,GAAG,QAAQ,CAC7D,GAAG,IAAI,GACP,MAAM,GAAG,SAAS,CAQpB;AAED;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAChC,KAAK,EAAE,IAAI,CACT,WAAW,EACX,MAAM,GAAG,aAAa,GAAG,cAAc,GAAG,OAAO,GAAG,QAAQ,CAC7D,GAAG,IAAI,GACP,MAAM,CAgBR"}
+{"version":3,"file":"agents.d.ts","sourceRoot":"","sources":["../../src/agent/agents.ts"],"names":[],"mappings":"AAOA,MAAM,MAAM,SAAS,GAAG,SAAS,GAAG,UAAU,CAAC;AAC/C,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,SAAS,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,YAAY,EAAE,MAAM,CAAC;IACrB,MAAM,EAAE,OAAO,GAAG,QAAQ,CAAC;IAC3B,QAAQ,EAAE,MAAM,CAAC;CAClB;AA6ED,eAAO,MAAM,aAAa,EAAE,WAAW,EAkDtC,CAAC;AAkBF,wBAAgB,cAAc,CAAC,MAAM,EAAE,WAAW,EAAE,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAO3E;AACD;;;;GAIG;AACH,MAAM,MAAM,uBAAuB,GAAG;IACpC,yEAAyE;IACzE,YAAY,EAAE,IAAI,CAAC;IACnB,6CAA6C;IAC7C,MAAM,EAAE,MAAM,CAAC;CAChB,GAAG;IACF,YAAY,EAAE,KAAK,CAAC;IACpB,4EAA4E;IAC5E,KAAK,EAAE,MAAM,CAAC;CACf,CAAC;AAEF,wBAAsB,kBAAkB,CAAC,IAAI,EAAE;IAC7C,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,GAAG,OAAO,CAAC,uBAAuB,CAAC,CA6EnC;AACD;;;;;;GAMG;AACH,wBAAgB,cAAc,CAC5B,MAAM,CAAC,EAAE,MAAM,GACd,WAAW,EAAE,CAMf;AACD,wBAAgB,oBAAoB,CAClC,MAAM,CAAC,EAAE,MAAM,GACd,WAAW,GAAG,IAAI,CAiBpB;AACD;;;;;;;;GAQG;AACH,wBAAgB,2BAA2B,CACzC,YAAY,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EACvC,MAAM,CAAC,EAAE,MAAM,GACd,WAAW,GAAG,IAAI,CAgBpB;AACD;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CACtC,IAAI,EAAE,MAAM,GAAG,SAAS,EACxB,YAAY,EAAE,IAAI,CAChB,WAAW,EACX,MAAM,GAAG,aAAa,GAAG,cAAc,GAAG,OAAO,GAAG,QAAQ,CAC7D,GAAG,IAAI,GACP,MAAM,GAAG,SAAS,CAQpB;AAED;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAChC,KAAK,EAAE,IAAI,CACT,WAAW,EACX,MAAM,GAAG,aAAa,GAAG,cAAc,GAAG,OAAO,GAAG,QAAQ,CAC7D,GAAG,IAAI,GACP,MAAM,CAYR"}

package/dist/agent/agents.js

@@ -1,7 +1,4 @@
-import * as fs from "node:fs";
-import * as path from "node:path";
 import chalk from "chalk";
-import { getAgentDir, parseFrontmatter } from "../sdk/coding-agent/index.js";
 import { classifyGraphqlError, createBackendClient, graphqlErrorMessage, scalars, } from "../generated/graphql-client.js";
 const GHOST_SYSTEM_PROMPT = [
     "You are ghost, the built-in system orchestrator. Your job is to plan, coordinate, and integrate — not to do the work yourself. Delegate through the `subagent` tool to these subagents:",
@@ -119,44 +116,6 @@ export const SYSTEM_AGENTS = [
         filePath: "system:fork",
     },
 ];
-function loadAgentsFromDir(dir, source) {
-    const agents = [];
-    if (!fs.existsSync(dir))
-        return agents;
-    let entries;
-    try {
-        entries = fs.readdirSync(dir, { withFileTypes: true });
-    }
-    catch {
-        return agents;
-    }
-    for (const entry of entries) {
-        if (!entry.name.endsWith(".md") ||
-            (!entry.isFile() && !entry.isSymbolicLink()))
-            continue;
-        const filePath = path.join(dir, entry.name);
-        let content;
-        try {
-            content = fs.readFileSync(filePath, "utf-8");
-        }
-        catch {
-            continue;
-        }
-        const { frontmatter, body } = parseFrontmatter(content);
-        if (!frontmatter.name || !frontmatter.description)
-            continue;
-        agents.push({
-            name: frontmatter.name,
-            description: frontmatter.description,
-            mode: frontmatter.mode === "primary" ? "primary" : "subagent",
-            model: frontmatter.model,
-            systemPrompt: body,
-            source,
-            filePath,
-        });
-    }
-    return agents;
-}
 const LEGACY_CLOUD_TEAM = "__legacy__";
 const cloudAgentsByTeam = new Map();
 function getCloudAgentCache(teamId) {
@@ -251,55 +210,32 @@ export async function refreshCloudAgents(opts) {
     cache.inFlight = refresh;
     return refresh;
 }
-function isDirectory(p) {
-    try {
-        return fs.statSync(p).isDirectory();
-    }
-    catch {
-        return false;
-    }
-}
-function findNearestProjectAgentsDir(cwd) {
-    let currentDir = cwd;
-    while (true) {
-        const candidate = path.join(currentDir, ".spectral", "agents");
-        if (isDirectory(candidate))
-            return candidate;
-        const parentDir = path.dirname(currentDir);
-        if (parentDir === currentDir)
-            return null;
-        currentDir = parentDir;
-    }
-}
-export function discoverAgents(cwd, scope, agentDir, teamId) {
-    const userDir = path.join(agentDir ?? getAgentDir(), "agents");
-    const projectAgentsDir = findNearestProjectAgentsDir(cwd);
-    const userAgents = scope === "project" ? [] : loadAgentsFromDir(userDir, "user");
-    const projectAgents = scope === "user" || !projectAgentsDir
-        ? []
-        : loadAgentsFromDir(projectAgentsDir, "project");
-    const cloudAgents = scope === "both"
-        ? getCloudAgentCache(teamId ?? LEGACY_CLOUD_TEAM).agents
-        : [];
+/**
+ * Discover all agents available to a session: built-in system agents
+ * (SYSTEM_AGENTS, read-only) plus cloud agents from the backend cache
+ * (refreshCloudAgents, managed in Aexol Studio). Cloud agents override
+ * system agents on name collision. Never throws and never touches the
+ * network — offline / logged-out sessions simply get the system agents.
+ */
+export function discoverAgents(teamId) {
+    const cloudAgents = getCloudAgentCache(teamId ?? LEGACY_CLOUD_TEAM).agents;
     const agentMap = new Map();
     for (const agent of SYSTEM_AGENTS)
         agentMap.set(agent.name, agent);
     for (const agent of cloudAgents)
         agentMap.set(agent.name, agent);
-    for (const agent of projectAgents)
-        agentMap.set(agent.name, agent);
-    for (const agent of userAgents)
-        agentMap.set(agent.name, agent);
-    return { agents: Array.from(agentMap.values()), projectAgentsDir };
+    return Array.from(agentMap.values());
 }
-export function discoverPrimaryAgent(cwd, scope = "both", agentDir, teamId) {
-    const { agents } = discoverAgents(cwd, scope, agentDir, teamId);
+export function discoverPrimaryAgent(teamId) {
+    const agents = discoverAgents(teamId);
     const primaries = agents.filter((a) => a.mode === "primary");
     if (primaries.length === 0)
         return null;
     if (primaries.length > 1) {
-        const userPrimary = primaries.find((a) => a.source === "user");
-        const chosen = userPrimary ?? primaries[0];
+        // Cloud agents override built-in system agents (same precedence as
+        // discovery): a cloud primary always wins over the built-in ghost.
+        const cloudPrimary = primaries.find((a) => a.source === "cloud");
+        const chosen = cloudPrimary ?? primaries[0];
         console.warn(chalk.yellow(`Multiple primary agents found (${primaries.map((a) => a.name).join(", ")}). Using "${chosen.name}".`));
         return chosen;
     }
@@ -314,7 +250,7 @@ export function discoverPrimaryAgent(cwd, scope = "both", agentDir, teamId) {
  * resolves to `null` (no fallback to auto-detect), so a stale selection never
  * silently injects an arbitrary primary agent.
  */
-export function resolveSelectedPrimaryAgent(selectedName, cwd, agentDir, teamId) {
+export function resolveSelectedPrimaryAgent(selectedName, teamId) {
     if (selectedName === undefined ||
         selectedName === null ||
         selectedName === "__auto__" ||
@@ -322,7 +258,7 @@ export function resolveSelectedPrimaryAgent(selectedName, cwd, agentDir, teamId)
         selectedName === "__none__") {
         return null;
     }
-    const { agents } = discoverAgents(cwd, "both", agentDir, teamId);
+    const agents = discoverAgents(teamId);
     return (agents.find((agent) => agent.mode === "primary" && agent.name === selectedName) ?? null);
 }
 /**
@@ -360,11 +296,7 @@ export function agentMetadataBlock(agent) {
     }
     const sourceLabel = agent.source === "cloud"
         ? "cloud backend (managed in Aexol Studio; not a local file)"
-        : agent.source === "project"
-            ? "project file (.spectral/agents)"
-            : agent.source === "system"
-                ? "built-in system agent (read-only)"
-                : "user file (~/.spectral/agents)";
+        : "built-in system agent (read-only)";
     lines.push(`Source: ${sourceLabel}`);
     return `\n\n## Agent metadata\n${lines.map((l) => `- ${l}`).join("\n")}`;
 }

package/dist/agent/index.d.ts

@@ -12,9 +12,9 @@
  *   - Parallel: { tasks: [{ agent, task }, ...] }  (max 8, 4 concurrent)
  *   - Chain:    { chain: [{ agent, task: "... {previous} ..." }, ...] }
  *
- * Agent definitions live as markdown files with YAML frontmatter:
- *   - ~/.spectral/agent/agents/*.md    (user-level, always loaded)
- *   - .spectral/agents/*.md            (project-level, opt-in via agentScope)
+ * Agents come from two sources only:
+ *   - Built-in system agents (SYSTEM_AGENTS, read-only)
+ *   - Cloud agents from the backend cache (managed in Aexol Studio /agents)
  *
  * Subagents use an in-process `agentLoop()` for:
  *   - Clean context isolation (fresh messages array)

package/dist/agent/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/agent/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH,OAAO,KAAK,EAEX,UAAU,EAEV,SAAS,EAET,MAAM,4BAA4B,CAAC;AAqBpC,OAAO,EACN,KAAK,YAAY,EACjB,KAAK,gBAAgB,EAKrB,MAAM,8BAA8B,CAAC;AAItC,OAAO,EACN,KAAK,WAAW,EAKhB,MAAM,aAAa,CAAC;AAErB,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AACrD,OAAO,EAGN,KAAK,cAAc,EACnB,MAAM,uCAAuC,CAAC;AAS/C,OAAO,KAAK,EAAE,sBAAsB,EAAgB,MAAM,6CAA6C,CAAC;AAyGxG;;;;;;;;;GASG;AACH,wBAAgB,yBAAyB,CACxC,gBAAgB,EAAE,MAAM,GAAG,SAAS,EACpC,KAAK,EAAE,IAAI,CAAC,WAAW,EAAE,MAAM,GAAG,aAAa,GAAG,cAAc,GAAG,OAAO,GAAG,QAAQ,CAAC,GACpF,MAAM,CAYR;AA2ND;;;GAGG;AACH,wBAAgB,oCAAoC,CACnD,cAAc,EAAE,gBAAgB,CAAC,gBAAgB,CAAC,GAChD,IAAI,CAAC,sBAAsB,EAAE,WAAW,GAAG,cAAc,CAAC,CAe5D;AAgCD,wBAAgB,oBAAoB,CACnC,GAAG,EAAE,MAAM,EACX,GAAG,EAAE,YAAY,EACjB,GAAG,EAAE,gBAAgB,EACrB,SAAS,CAAC,EAAE,MAAM,GAChB,SAAS,EAAE,CAkDb;AAyBD;;;;;;;;;;GAUG;AACH;;;;;;GAMG;AACH,MAAM,WAAW,wBAAwB;IACxC,IAAI,EAAE,uBAAuB,CAAC;IAC9B,6EAA6E;IAC7E,GAAG,EAAE,cAAc,CAAC;CACpB;AAED,8EAA8E;AAC9E,MAAM,MAAM,qBAAqB,GAAG,UAAU,GAAG,wBAAwB,CAAC;AAmF1E,2FAA2F;AAC3F,wBAAgB,+BAA+B,CAC9C,EAAE,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,WAAW,KAAK,OAAO,CAAC,IAAI,CAAC,GACtD,IAAI,CAEN;AAmBD;;;;;;GAMG;AACH,wBAAgB,0BAA0B,CACzC,QAAQ,EAAE,MAAM,GAAG,SAAS,EAC5B,QAAQ,EAAE;IAAE,OAAO,CAAC,EAAE,OAAO,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,GAC9D,MAAM,CAiBR;AAmmBD,MAAM,CAAC,OAAO,UAAU,iBAAiB,CACxC,GAAG,EAAE,YAAY,EACjB,IAAI,CAAC,EAAE;IACN,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B,iBAAiB,CAAC,EAAE,CAAC,KAAK,EAAE,WAAW,KAAK,IAAI,CAAC;IACjD,MAAM,CAAC,EAAE,MAAM,CAAC;CAChB,GACC,IAAI,CA+cN"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/agent/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH,OAAO,KAAK,EAEX,UAAU,EAEV,SAAS,EAET,MAAM,4BAA4B,CAAC;AAoBpC,OAAO,EACN,KAAK,YAAY,EACjB,KAAK,gBAAgB,EAKrB,MAAM,8BAA8B,CAAC;AAItC,OAAO,EACN,KAAK,WAAW,EAIhB,MAAM,aAAa,CAAC;AAErB,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AACrD,OAAO,EAGN,KAAK,cAAc,EACnB,MAAM,uCAAuC,CAAC;AAS/C,OAAO,KAAK,EAAE,sBAAsB,EAAgB,MAAM,6CAA6C,CAAC;AAyGxG;;;;;;;;;GASG;AACH,wBAAgB,yBAAyB,CACxC,gBAAgB,EAAE,MAAM,GAAG,SAAS,EACpC,KAAK,EAAE,IAAI,CAAC,WAAW,EAAE,MAAM,GAAG,aAAa,GAAG,cAAc,GAAG,OAAO,GAAG,QAAQ,CAAC,GACpF,MAAM,CAYR;AAyND;;;GAGG;AACH,wBAAgB,oCAAoC,CACnD,cAAc,EAAE,gBAAgB,CAAC,gBAAgB,CAAC,GAChD,IAAI,CAAC,sBAAsB,EAAE,WAAW,GAAG,cAAc,CAAC,CAe5D;AAgCD,wBAAgB,oBAAoB,CACnC,GAAG,EAAE,MAAM,EACX,GAAG,EAAE,YAAY,EACjB,GAAG,EAAE,gBAAgB,EACrB,SAAS,CAAC,EAAE,MAAM,GAChB,SAAS,EAAE,CAkDb;AAyBD;;;;;;;;;;GAUG;AACH;;;;;;GAMG;AACH,MAAM,WAAW,wBAAwB;IACxC,IAAI,EAAE,uBAAuB,CAAC;IAC9B,6EAA6E;IAC7E,GAAG,EAAE,cAAc,CAAC;CACpB;AAED,8EAA8E;AAC9E,MAAM,MAAM,qBAAqB,GAAG,UAAU,GAAG,wBAAwB,CAAC;AAmF1E,2FAA2F;AAC3F,wBAAgB,+BAA+B,CAC9C,EAAE,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,WAAW,KAAK,OAAO,CAAC,IAAI,CAAC,GACtD,IAAI,CAEN;AAmBD;;;;;;GAMG;AACH,wBAAgB,0BAA0B,CACzC,QAAQ,EAAE,MAAM,GAAG,SAAS,EAC5B,QAAQ,EAAE;IAAE,OAAO,CAAC,EAAE,OAAO,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,GAC9D,MAAM,CAiBR;AAqlBD,MAAM,CAAC,OAAO,UAAU,iBAAiB,CACxC,GAAG,EAAE,YAAY,EACjB,IAAI,CAAC,EAAE;IACN,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B,iBAAiB,CAAC,EAAE,CAAC,KAAK,EAAE,WAAW,KAAK,IAAI,CAAC;IACjD,MAAM,CAAC,EAAE,MAAM,CAAC;CAChB,GACC,IAAI,CAmaN"}

package/dist/agent/index.js

@@ -12,9 +12,9 @@
  *   - Parallel: { tasks: [{ agent, task }, ...] }  (max 8, 4 concurrent)
  *   - Chain:    { chain: [{ agent, task: "... {previous} ..." }, ...] }
  *
- * Agent definitions live as markdown files with YAML frontmatter:
- *   - ~/.spectral/agent/agents/*.md    (user-level, always loaded)
- *   - .spectral/agents/*.md            (project-level, opt-in via agentScope)
+ * Agents come from two sources only:
+ *   - Built-in system agents (SYSTEM_AGENTS, read-only)
+ *   - Cloud agents from the backend cache (managed in Aexol Studio /agents)
  *
  * Subagents use an in-process `agentLoop()` for:
  *   - Clean context isolation (fresh messages array)
@@ -31,7 +31,7 @@
  */
 import { agentLoop, agentLoopContinue, } from "../sdk/agent-core/index.js";
 import { buildIsolatedRequestTimePrunedMessagesResult, COMPACT_CONTEXT_TOOL_NAME, } from "../memory/tools/compact-context.js";
-import { isRateLimitError, isTransientApiError, isContextOverflow, isPaymentRequiredError, StringEnum, streamSimple, } from "../sdk/ai/index.js";
+import { isRateLimitError, isTransientApiError, isContextOverflow, isPaymentRequiredError, streamSimple, } from "../sdk/ai/index.js";
 import { RETRY_DEFAULT_BASE_DELAY_MS, RETRY_DEFAULT_MAX_RETRIES, RETRY_MAX_BACKOFF_DELAY_MS, } from "../sdk/coding-agent/index.js";
 import { mutateSystemPrompt } from "../sdk/coding-agent/core/system-prompt-mutator.js";
 import { sleep } from "../sdk/coding-agent/utils/sleep.js";
@@ -929,10 +929,6 @@ const ChainItem = Type.Object({
     }),
     cwd: Type.Optional(Type.String({ description: "Working directory for the agent process" })),
 });
-const AgentScopeSchema = StringEnum(["user", "project", "both"], {
-    description: 'Which agent directories to use. Default: "both" (user + project agents).',
-    default: "both",
-});
 const SubagentParams = Type.Object({
     agent: Type.Optional(Type.String({
         description: "Known agent name to invoke (single mode; use names from the available agents list)",
@@ -948,11 +944,6 @@ const SubagentParams = Type.Object({
         description: "Sequential steps of {agent, task}; {previous} substitutes the previous step's output (max 8 steps)",
         minItems: 1,
     })),
-    agentScope: Type.Optional(AgentScopeSchema),
-    confirmProjectAgents: Type.Optional(Type.Boolean({
-        description: "Prompt before running project-local agents. Default: true.",
-        default: true,
-    })),
     cwd: Type.Optional(Type.String({
         description: "Working directory for the agent process (single mode)",
     })),
@@ -972,8 +963,8 @@ export default function subagentExtension(ext, opts) {
         description: [
             "Delegate tasks to specialized subagents with isolated context.",
             "Modes: single (agent + task), parallel (tasks array), chain (sequential with {previous} placeholder).",
-            'Default agent scope is "both" (user agents from ~/.spectral/agent/agents + project agents from .spectral/agents).',
-            'Set agentScope: "user" or "project" to limit scope.',
+            "Agents come from two sources only: built-in system agents (read-only) and cloud agents from the backend cache (managed in Aexol Studio /agents).",
+            "Local agent files are not read; manage cloud agents in the Studio /agents page.",
             "Exactly one mode per call.",
             'Single (one task): {"agent":"researcher","task":"<full self-contained task text>"}',
             'Parallel (independent tasks; max 8, 4 run concurrently): {"tasks":[{"agent":"researcher","task":"..."},{"agent":"executor","task":"..."}]}',
@@ -1003,30 +994,23 @@ export default function subagentExtension(ext, opts) {
                     ],
                     details: {
                         mode: "single",
-                        agentScope: (params.agentScope ?? "both"),
-                        projectAgentsDir: null,
                         results: [],
                     },
                 };
             }
-            const agentScope = params.agentScope ?? "both";
-            const discovery = discoverAgents(ctx.cwd, agentScope, undefined, opts?.teamId);
             // Merge registration-time disabled list (from session start) with the
             // live disabled list (just read from disk) so both are honored.
             const disabledSet = new Set([
                 ...(opts?.disabledAgents ?? []),
                 ...(liveSettings.disabledSubagents ?? []),
             ]);
-            const agents = discovery.agents.filter((a) => !disabledSet.has(a.name));
-            const confirmProjectAgents = params.confirmProjectAgents ?? false;
+            const agents = discoverAgents(opts?.teamId).filter((a) => !disabledSet.has(a.name));
             const hasChain = (params.chain?.length ?? 0) > 0;
             const hasTasks = (params.tasks?.length ?? 0) > 0;
             const hasSingle = Boolean(params.agent && params.task);
             const modeCount = Number(hasChain) + Number(hasTasks) + Number(hasSingle);
             const makeDetails = (mode) => (results) => ({
                 mode,
-                agentScope,
-                projectAgentsDir: discovery.projectAgentsDir,
                 results,
             });
             // Forward internal subagent tool lifecycle events to the bridge so the
@@ -1112,37 +1096,6 @@ export default function subagentExtension(ext, opts) {
                     details: makeDetails("single")([]),
                 };
             }
-            // Security: if project-local agents are enabled, confirm with user.
-            // In headless mode (no TUI), project-local agents are silently allowed —
-            // the caller is already trusted (it's the coding agent itself).
-            if ((agentScope === "project" || agentScope === "both") &&
-                confirmProjectAgents &&
-                ctx.hasUI) {
-                const requestedAgentNames = new Set();
-                if (params.chain)
-                    for (const step of params.chain)
-                        requestedAgentNames.add(step.agent.replace(/^@/, ""));
-                if (params.tasks)
-                    for (const t of params.tasks)
-                        requestedAgentNames.add(t.agent.replace(/^@/, ""));
-                if (params.agent)
-                    requestedAgentNames.add(params.agent.replace(/^@/, ""));
-                const projectAgentsRequested = Array.from(requestedAgentNames)
-                    .map((name) => agents.find((a) => a.name === name))
-                    .filter((a) => a?.source === "project");
-                if (projectAgentsRequested.length > 0) {
-                    const names = projectAgentsRequested.map((a) => a.name).join(", ");
-                    const dir = discovery.projectAgentsDir ?? "(unknown)";
-                    const ok = await ctx.ui.confirm("Run project-local agents?", `Agents: ${names}\nSource: ${dir}\n\nProject agents are repo-controlled. Only continue for trusted repositories.`);
-                    if (!ok)
-                        return {
-                            content: [
-                                { type: "text", text: "Canceled: project-local agents not approved." },
-                            ],
-                            details: makeDetails(hasChain ? "chain" : hasTasks ? "parallel" : "single")([]),
-                        };
-                }
-            }
             // ── Chain mode ──────────────────────────────────────────────
             if (params.chain && params.chain.length > 0) {
                 if (params.chain.length > MAX_CHAIN_STEPS)

package/dist/commands/serve.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"serve.d.ts","sourceRoot":"","sources":["../../src/commands/serve.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAwBH,OAAO,EAAE,WAAW,EAAmB,MAAM,oBAAoB,CAAC;AAclE,OAAO,KAAK,EAAE,aAAa,EAAc,MAAM,6BAA6B,CAAC;AAC7E,OAAO,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AAGnE,OAAO,EAAmB,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAsBrE;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAazD;AAED,MAAM,WAAW,eAAe;IAC9B,8CAA8C;IAC9C,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;OAGG;IACH,cAAc,EAAE,OAAO,CAAC;CACzB;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,eAAe,CA6B9D;AAED,MAAM,WAAW,eAAe;IAC9B,iEAAiE;IACjE,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,4CAA4C;IAC5C,qBAAqB,CAAC,EAAE,OAAO,CAAC;IAChC,uCAAuC;IACvC,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,wCAAwC;IACxC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,yDAAyD;IACzD,aAAa,CAAC,EAAE,aAAa,CAAC;IAC9B,6EAA6E;IAC7E,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;OAGG;IACH,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B;;;OAGG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,4CAA4C;IAC5C,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IACzB,+DAA+D;IAC/D,aAAa,CAAC,EAAE,qBAAqB,CAAC,OAAO,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC;IAC9E;;;;;OAKG;IACH,UAAU,CAAC,EAAE,OAAO,CAAC;CACtB;AAED,MAAM,WAAW,cAAc;IAC7B,qCAAqC;IACrC,KAAK,EAAE,YAAY,CAAC;IACpB,wDAAwD;IACxD,OAAO,EAAE,oBAAoB,CAAC;IAC9B,4CAA4C;IAC5C,KAAK,EAAE,WAAW,CAAC;IACnB,+CAA+C;IAC/C,SAAS,EAAE,MAAM,CAAC;IAClB,4CAA4C;IAC5C,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB;AAED,wBAAsB,QAAQ,CAAC,IAAI,GAAE,eAAoB,GAAG,OAAO,CAAC,cAAc,CAAC,CAoqBlF;AAmFD;;;;GAIG;AACH,wBAAsB,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,cAAc,CAAC,CAsB5E"}
+{"version":3,"file":"serve.d.ts","sourceRoot":"","sources":["../../src/commands/serve.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAwBH,OAAO,EAAE,WAAW,EAAmB,MAAM,oBAAoB,CAAC;AAgBlE,OAAO,KAAK,EAAE,aAAa,EAAc,MAAM,6BAA6B,CAAC;AAC7E,OAAO,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AAGnE,OAAO,EAAmB,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAsBrE;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAazD;AAED,MAAM,WAAW,eAAe;IAC9B,8CAA8C;IAC9C,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;OAGG;IACH,cAAc,EAAE,OAAO,CAAC;CACzB;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,eAAe,CA6B9D;AAED,MAAM,WAAW,eAAe;IAC9B,iEAAiE;IACjE,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,4CAA4C;IAC5C,qBAAqB,CAAC,EAAE,OAAO,CAAC;IAChC,uCAAuC;IACvC,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,wCAAwC;IACxC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,yDAAyD;IACzD,aAAa,CAAC,EAAE,aAAa,CAAC;IAC9B,6EAA6E;IAC7E,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;OAGG;IACH,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B;;;OAGG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,4CAA4C;IAC5C,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IACzB,+DAA+D;IAC/D,aAAa,CAAC,EAAE,qBAAqB,CAAC,OAAO,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC;IAC9E;;;;;OAKG;IACH,UAAU,CAAC,EAAE,OAAO,CAAC;CACtB;AAED,MAAM,WAAW,cAAc;IAC7B,qCAAqC;IACrC,KAAK,EAAE,YAAY,CAAC;IACpB,wDAAwD;IACxD,OAAO,EAAE,oBAAoB,CAAC;IAC9B,4CAA4C;IAC5C,KAAK,EAAE,WAAW,CAAC;IACnB,+CAA+C;IAC/C,SAAS,EAAE,MAAM,CAAC;IAClB,4CAA4C;IAC5C,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB;AAED,wBAAsB,QAAQ,CAAC,IAAI,GAAE,eAAoB,GAAG,OAAO,CAAC,cAAc,CAAC,CAurBlF;AAmFD;;;;GAIG;AACH,wBAAsB,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,cAAc,CAAC,CAsB5E"}

package/dist/commands/serve.js

@@ -43,6 +43,8 @@ import { getFanoutManager } from "../server/fanout/fanout-manager.js";
 import { detachAllSubscribers, handleAutoOptimizeFrame, handleAutoResearchFrame, handleCancelTurn, handleClientMessage, handleRestRequest, handleStopToolCall, handleSubscribe, } from "../relay/dispatcher.js";
 import { ensureMachineRegistered } from "../relay/registration.js";
 import { saveMachine } from "../relay/machine-store.js";
+import { sweepAttachments } from "../server/attachments/cleanup.js";
+import { attachmentsRootFor } from "../server/attachments/persist.js";
 import { SessionStreamManager } from "../server/session-stream.js";
 import { gracefulShutdown } from "../server/shutdown.js";
 import { getLiveMcpState } from "../mcp/state-getter.js";
@@ -175,6 +177,25 @@ export async function runServe(opts = {}) {
             // Best-effort.
         }
     });
+    // GC for stale persisted chat attachments (`.spectral/attachments/<id>/`).
+    // Fire-and-forget like the offload sweep: never blocks server startup and
+    // never takes down serving. Sweeps every known project root (attachments
+    // live under the session's project cwd) plus the fallback cwd.
+    setImmediate(() => {
+        try {
+            const activeSessionIds = new Set(store.listAllSessionIds());
+            const roots = new Set([attachmentsRootFor(cwd)]);
+            for (const project of store.listProjects()) {
+                roots.add(attachmentsRootFor(project.path));
+            }
+            for (const root of roots) {
+                sweepAttachments({ root, activeSessionIds });
+            }
+        }
+        catch {
+            // Best-effort.
+        }
+    });
     // Mutable holder for the meta-event publisher. Bound below once we
     // have both `relay` (the send target) and `registration.record.machineId`
     // (the canonical machineId the backend uses to fan out). The manager

package/dist/generated/zeus/const.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"const.d.ts","sourceRoot":"","sources":["../../../src/generated/zeus/const.ts"],"names":[],"mappings":"AAEA,eAAO,MAAM,aAAa,EAAE,MAAM,CAAC,MAAM,EAAC,GAAG,CAy0B5C,CAAA;AAED,eAAO,MAAM,WAAW,EAAE,MAAM,CAAC,MAAM,EAAC,GAAG,CAqoC1C,CAAA;AAED,eAAO,MAAM,GAAG;;;;CAIf,CAAA"}
+{"version":3,"file":"const.d.ts","sourceRoot":"","sources":["../../../src/generated/zeus/const.ts"],"names":[],"mappings":"AAEA,eAAO,MAAM,aAAa,EAAE,MAAM,CAAC,MAAM,EAAC,GAAG,CAw4B5C,CAAA;AAED,eAAO,MAAM,WAAW,EAAE,MAAM,CAAC,MAAM,EAAC,GAAG,CAg1C1C,CAAA;AAED,eAAO,MAAM,GAAG;;;;CAIf,CAAA"}