@lensagent/core 0.1.1 → 0.1.2

package/README.md

@@ -4,7 +4,7 @@
 
 ## 仓库与运行
 
-仓库根目录本身就是可安装、构建和运行的 Node.js 项目。文件、终端、Git 和搜索能力由独立仓库 `lens-remote-executor` 提供；本仓库通过 gRPC 与其通信。两侧各自维护一份 `proto/executor.proto`，修改 RPC 契约时需要同步。
+仓库根目录本身就是可安装、构建和运行的 Node.js 项目。文件和终端能力由独立仓库 `lens-remote-executor` 提供；本仓库通过 gRPC 与其通信。两侧各自维护一份 `proto/executor.proto`，修改 RPC 契约时需要同步。
 
 要求 Node.js 24 或更高版本。
 
@@ -13,12 +13,18 @@ pnpm install
 pnpm run typecheck
 pnpm run lint
 pnpm run build
-pnpm run secret-scan
 pnpm run dev
 ```
 
 默认配置模板位于 `config/lens.example.jsonc`。本地运行时复制为 `config/lens.jsonc`。配置与 `config/pair.json` 的相对路径均以进程 `cwd` 为根。
 
+客户端首次连接会登记未批准身份。本机管理员使用 `pnpm run pair:approve -- --client <client-id> --strong-trust` 批准并签发凭据；已安装包可执行 `node dist/entry/pair.js --client <client-id> --strong-trust`。省略 `--strong-trust` 签发只读客户端凭据。命令只返回一次凭据，管理员应通过受保护渠道交给客户端；再次签发会撤销旧凭据。
+
+在 Facet 侧栏输入凭据。凭据只保存在当前页面内存中，HTTP、Artifact 和 SSE 请求统一携带认证。Pair 记录的 `strongTrust` 默认关闭；单独设置 `isVerified` 或复制设备身份字段不能获得访问权限。强信任客户端可在 General 中编辑受管理配置文件原文，包括 Pair 信任记录；普通客户端不允许配置原文读取或修改，也不能启动 Agent/工具等可绕过配置权限的操作。配置原文不进入请求日志。
+
+配置文件接口列出 Core 主配置、Pair 文件，以及主配置所在目录中现有的非模板 JSON/JSONC 配置文件。其他配置保存后由其 owner 在重启时读取；API 不接受任意路径。远端组件的独立配置由该组件的本机管理员管理，不通过 Core 猜测远端文件路径。LAN 上传输凭据应使用 HTTPS。
+
+
 已安装包的入口与构建产物入口：
 
 ```bash
@@ -28,6 +34,56 @@ node dist/entry/node.js
 
 Executor 需要独立启动；`pnpm run dev` 不会自动启动它。
 
+## 图片输入
+
+`view_image({ "path": "截图.png" })` 通过 Executor 读取工作区图片，支持 PNG、JPEG、GIF、WebP，单张不超过 5 MiB；路径权限与 `read_file` 一致。新 Agent 默认加载该工具，已有 Agent 可通过 Capability 分配和加载启用。需要同时更新 Core 和 Executor（`core-executor-rpc: 8`），并选择支持图片输入的模型。
+
+工具和 MCP 返回的图片保存为 Artifact，在下一次模型请求中作为图片内容发送；PTC 子调用的图片也会随根结果传递。图片只以 Artifact 文件持久化；Full Context 仅保存 Artifact ID，Working Context 的图片项仅保存 projectId/artifactId，MIME 和 SHA-256 留在 Artifact 元数据中。Working Context 的 Snip 可以移除较早的图片，手动 Include Result 会重新附带图片。请求快照也只保存 Artifact ID 引用；发送模型请求前才在内存中加载、校验并编码图片字节，不把 base64 或 data URL 回写到 Context、数据库或请求诊断。图片预算目前按每张约 4096 token 估算，实际消耗由模型决定。
+
+本阶段提供工具图片输入，不包含聊天附件上传入口、图片生成、音频或视频。
+
+## 文件工具
+
+`read_file` 可读取 UTF-8 文件或列出目录。目录包含隐藏项，名称按序排列，子目录带 `/` 后缀；响应的 `kind` 为 `file` 或 `directory`。`start_line` 从 1 开始选择行或目录项，`max_lines` 限定返回数量；`offset` 和 `next_offset` 始终表示 UTF-8 字节位置，配合 `eof` 分页。目录在分页期间发生变化时应重新读取。
+
+`edit_file` 合并创建、整文件重写和批量字符串替换：
+
+- `create`：提供 `content`，目标必须不存在；创建父目录并原子发布，拒绝覆盖已有目标。
+- `rewrite`：提供 `content`，目标必须为现有 UTF-8 常规文件。
+- `edit`：提供非空 `edits` 数组，省略 `content`。每项包含 `old_string`、`new_string` 和可选 `replace_all`，按顺序在内存中替换；默认要求唯一精确匹配，全部成功后提交一次。
+
+`patch_file` 接受单个 `path` 与 `patch` 更新块正文。块头为 `@@` 或 `@@ 精确行锚点`，正文分别用空格、`+`、`-` 标记上下文、新增、删除行。所有块基于同一份原文件，必须唯一命中且区间不重叠；`*** End of File` 限定匹配到文件末尾。没有旧内容的纯新增块仅用于空文件，且只能有一个块。未修改区段保持原字节；新增行采用附近的行尾风格。
+
+edit 最多 128 个替换项，patch 最多 128 个块；输入文本总量、原文件和最终文件分别不超过 8 MiB。成功结果的 `structured_content` 为 `{path, changed, units_applied, bytes_written}`，未发生内容变化时 `bytes_written` 为 0。两个工具共用文件历史、调用重放、原子提交和 `revert_call`。原 `write_file` 与旧的单替换 `edit_file` 输入已移除；调用方需使用协议 8 的新合同，在途调用的原始参数不会自动改写。
+
+## 历史读取
+
+`history_search` 默认检索当前 Project 内各 Session、Task 和 Agent 的可见 Full Context，包括子代理和 Compact 之前的记录。可用 `agent_id`、`session_id`、`task_id` 筛选。结果携带来源身份与 `context_item_id`；分页使用返回的 `next_after_context_item_id` 作为下一次的 `after_context_item_id`，保持原筛选条件，避免不同代理重复的 ordinal 导致漏读。
+
+`history_read` 根据 `context_item_id` 读取上述范围内的完整条目，用 UTF-8 字节 `offset`/`limit` 分页，并用 `digest` 检查连续读取期间的变化。用户隐藏的记录和其他 Project 的记录不开放；历史消息和工具调用仅作为证据，不自动成为当前指令或待执行调用。
+
+## Skill 工具
+
+`skill({})` 列出分配给当前 Agent 的 Skill 名称、描述和加载状态；`skill({"name":"名称"})` 返回完整指令、资源基目录和最多 10 个资源文件样本，并持久化加载状态，后续模型请求继续包含这些指令。目录中的符号链接不作为资源遍历。
+
+工作区 Skill 可位于 `skills/`、`.agents/skills/` 或 `.codex/skills/` 下的子目录。`SKILL.md` 可用 YAML 前置元数据声明 `name` 和 `description`；没有元数据时沿用目录名称和正文标题。文件资源仅在实际加载该 Skill 时枚举，目录刷新不重复扫描所有资源。工作区仍须通过共享文件系统验证。
+
+## 网页工具
+
+`web_search` 接受 `query`，并支持 `num_results`（1–50）、`livecrawl`（`fallback` / `preferred`）、`type`（`auto` / `fast` / `deep`）和 `context_max_characters`（1–1048576）。搜索使用公共搜索服务，返回带来源的检索文本；总超时 25 秒。
+
+`web_fetch` 接受 HTTP(S) `url`、`format`（默认 `markdown`，也可为 `text` / `html`）和秒数 `timeout`（默认 30，最大 120）。超时覆盖域名解析、最多 5 次重定向、响应头与响应体；流式读取和解压后的响应均限制为 5 MiB。Markdown 中的相对链接按最终 URL 解析，二进制响应作为 Artifact 保存。
+
+默认只允许公共网络地址；持有 `full_access` 的调用可访问私有地址。URL 不接受内嵌凭据，每次重定向重新校验目标并固定连接到已验证的解析地址。网页和搜索结果作为外部证据处理，工具返回内容不授予新的指令权限。
+
+搜索与 `full_access` 网页获取遵循 Node 的标准代理设置，可通过 `NODE_USE_ENV_PROXY=1` 或 `--use-env-proxy` 启用。仅公共地址的网页获取使用直接连接，保证连接地址与本地校验结果一致。
+
+## 时间工具
+
+`get_system_time({})` 返回 `unix_ms`、`utc` 和 `local`，三个字段表示同一时刻。UTC 使用 `YYYY-MM-DDTHH:mm:ssZ`；本地时间使用 `YYYY-MM-DDTHH:mm:ss±HH:mm`，仅包含偏移，不包含地区或时区名称。
+
+`sleep_milliseconds({"milliseconds":1000})` 在当前工具调用中等待固定毫秒数，然后返回 `started_at_unix_ms` 和 `ended_at_unix_ms`。支持取消；`0` 立即返回，最大值为 `2147483647`。实际结束时刻可能因事件循环调度延后。
+
 ## 文档
 
 2026-09-19 之前的架构设计、Context、计划、研究、审查、日期快照及相关生成物已归档到 `waste/2026-09-19/`，不再作为当前规范。
@@ -37,8 +93,9 @@ Executor 需要独立启动；`pnpm run dev` 不会自动启动它。
 - [AGENTS.md](./AGENTS.md) — 仓库级工程与 Agent 工作规则。
 - [CLAUDE.md](./CLAUDE.md) — Claude Code 的最小入口。
 - [CONTEXT.md](./CONTEXT.md) — 当前术语、事实边界与工程共享语境。
-- [docs/2026-09-19/current-system-architecture.md](./docs/2026-09-19/current-system-architecture.md) — 基于当前源码与 CodeGraph 重建的系统架构快照。
-- [docs/DOCUMENT-LIFECYCLE.md](./docs/DOCUMENT-LIFECYCLE.md) — 文档治理与归档规则。
+- [docs/2026-09-19-01/current-system-architecture.md](./docs/2026-09-19-01/current-system-architecture.md) — 基于 `5195e0a` 源码与 CodeGraph 重建的系统架构快照。
+- [docs/2026-09-21-01/code-quality-review.md](./docs/2026-09-21-01/code-quality-review.md) — 基于 `e7325fd` 的模型、上下文、工具 schema、外部接入及 HTTP 质量审查、根因和修复建议；建议尚未实施。
+- [docs/document-lifecycle.md](./docs/document-lifecycle.md) — 文档命名、治理与归档规则。
 - [waste/manifest.md](./waste/manifest.md) — 历史归档清单。
 
 不要根据 `waste/` 中的历史资料推断当前行为；需要确认时直接检查当前代码和可执行证据。
@@ -46,3 +103,5 @@ Executor 需要独立启动；`pnpm run dev` 不会自动启动它。
 ## 许可证
 
 本项目使用 [MIT License](./LICENSE)。
+
+本地 LSP 和工作区 Skills 要求在 `executor` 中显式设置 `sharedFilesystem: true`。Core 使用短暂的随机文件探针验证 Executor 能读取同一工作区，探针随后删除；未通过验证的路径不用于本地 Skills，LSP 请求明确失败。默认按远端文件系统处理。文件读、写、任意命令和 revert 在单 Core 调度器内使用保守的执行域锁，写操作串行、读操作可并发，不根据 Core 的 OS 猜测远端路径。该锁不约束其他 Core 或外部进程；未引入跨进程分布式锁或新的 RPC。

package/config/lens.example.jsonc

@@ -8,7 +8,22 @@
   // -- a Worker ignoring cancellation, an LSP child not exiting -- stops holding the process past
   // this point; anything left unconfirmed is resolved by Recovery on the next start.
   "shutdown": { "graceMs": 30000 },
+  // For Executor per-Core directory policy, also set identityPath and credentialPath to private files
+  // relative to this Core's root. credentialPath contains the service token, not a browser Pair token.
+  // Remote service credentials require executor.tls.enabled=true. Restart Core after changing these.
   "executor": { "address": "127.0.0.1:50051" },
+  // Optional second Executor on the Core computer (loopback only). Start it separately on port
+  // 50052 with its own pairing, history, audit and evidence storage. Restart Core after configuring.
+  // Existing Workspaces remain bound to executor ("remote"); new ones explicitly select local/remote.
+  // Local Workspace Skills require a shared-filesystem byte probe; remote paths are never read by Core.
+  // "localExecutor": { "address": "127.0.0.1:50052", "identityPath": "config/local-executor-identity.json" },
+  // Additional named connections, managed by Launcher. Workspace executor_id selects the exact ID.
+  // Remote paths are entered in Facet and validated on that server; registration grants no access.
+  // "executors": {
+  //   "procurement": { "name": "Procurement server", "address": "server.example:50051",
+  //     "identityPath": "config/executor-procurement-identity.json", "credentialPath": "config/procurement-token.txt",
+  //     "tls": { "enabled": true, "caFile": "config/company-ca.pem" } }
+  // },
   "artifacts": { "directory": "artifacts" },
   "persistence": {
     "eventLog": { "enabled": false, "path": "data/lens.events.jsonl", "fsync": false },
@@ -23,6 +38,15 @@
   "providers": {
     "openai": {
       "adapter": "@ai-sdk/openai",
+      // Declare the exact effort strings accepted by your endpoint. Lens sends the selected
+      // value unchanged, including "none"; it does not infer thinking modes or budgets.
+      // A Model reasoningEfforts list replaces this Provider list. The first entry is
+      // the model picker's initial choice; roles below explicitly select their own effort.
+      "reasoningEfforts": ["medium", "none", "minimal", "low", "high"],
+      // Model promptCache overrides this Provider default. Explicit modes require Provider/model support.
+      "promptCache": { "mode": "implicit" },
+      // Optional compactionThresholdTokens here sets a Provider default. A Model value overrides it.
+      // When both are omitted: max(contextWindowTokens - 25000, contextWindowTokens * 0.95).
       "options": { "apiKey": { "env": "OPENAI_API_KEY", "optional": true } },
       "models": { "gpt-5": { "contextWindowTokens": 400000 } }
     }
@@ -33,7 +57,7 @@
       "model": "openai/gpt-5",
       "modelReasoningEffort": "high",
       "policyPreset": "Write",
-      "capabilities": ["capability_search", "programmatic_tool_run", "system_echo", "read_file", "write_file", "edit_file", "glob", "grep", "terminal_command_run", "git_run", "internet_search", "update_plan", "ask_user", "compact", "subagent_create", "subagent_message", "subagent_broadcast", "subagent_wait"],
+      "capabilities": ["capability_search", "get_system_time", "sleep_milliseconds", "skill", "history_search", "history_read", "programmatic_tool_run", "system_echo", "read_file", "view_image", "patch_file", "edit_file", "glob", "grep", "terminal_command_run", "web_search", "web_fetch", "todo", "ask_user", "subagent_create", "subagent_message", "subagent_broadcast", "subagent_wait"],
       "contextStrategy": "default",
       "providerRouting": { "retryMaxAttempts": 2, "fallback": [] }
     },
@@ -41,7 +65,7 @@
       "model": "openai/gpt-5",
       "modelReasoningEffort": "medium",
       "policyPreset": "Write",
-      "capabilities": ["capability_search", "programmatic_tool_run", "system_echo", "read_file", "write_file", "edit_file", "glob", "grep", "terminal_command_run", "git_run", "internet_search", "update_plan", "ask_user", "subagent_wait"],
+      "capabilities": ["capability_search", "get_system_time", "sleep_milliseconds", "skill", "history_search", "history_read", "programmatic_tool_run", "system_echo", "read_file", "view_image", "patch_file", "edit_file", "glob", "grep", "terminal_command_run", "web_search", "web_fetch", "todo", "ask_user", "subagent_wait"],
       "contextStrategy": "default",
       "providerRouting": { "retryMaxAttempts": 2, "fallback": [] }
     },
@@ -65,27 +89,26 @@
   "tokenizer": { "mode": "universal_tel", "version": 1 },
   "policyPresets": {
     "Read": { "capabilities": {
-      "capability_search": "read_only", "programmatic_tool_run": "full_access", "system_echo": "read_only", "read_file": "read_only", "glob": "read_only", "grep": "read_only", "git_run": "read_only", "internet_search": "external", "subagent_wait": "read_only"
+      "capability_search": "read_only", "get_system_time": "read_only", "sleep_milliseconds": "read_only", "skill": "read_only", "history_search": "read_only", "history_read": "read_only", "programmatic_tool_run": "full_access", "system_echo": "read_only", "read_file": "read_only", "view_image": "read_only", "glob": "read_only", "grep": "read_only", "subagent_wait": "read_only"
     } },
     "Write": { "capabilities": {
-      "capability_search": "read_only", "programmatic_tool_run": "full_access", "system_echo": "read_only", "read_file": "read_only", "write_file": "workspace_write", "edit_file": "workspace_write", "glob": "read_only", "grep": "read_only", "terminal_command_run": "external", "git_run": "workspace_write", "internet_search": "external", "update_plan": "workspace_write", "update_todo": "workspace_write", "ask_user": "read_only", "compact": "ask", "subagent_create": "workspace_write", "subagent_message": "workspace_write", "subagent_broadcast": "workspace_write", "subagent_wait": "read_only", "slash_command_list": "read_only", "slash_command_run": "ask"
+      "capability_search": "read_only", "get_system_time": "read_only", "sleep_milliseconds": "read_only", "skill": "read_only", "programmatic_tool_run": "full_access", "system_echo": "read_only", "read_file": "read_only", "view_image": "read_only", "patch_file": "workspace_write", "edit_file": "workspace_write", "glob": "read_only", "grep": "read_only", "terminal_command_run": "external", "web_search": "external", "web_fetch": "external", "todo": "workspace_write", "ask_user": "read_only", "subagent_create": "workspace_write", "subagent_message": "workspace_write", "subagent_broadcast": "workspace_write", "subagent_wait": "read_only", "slash_command": "ask"
     } }
   },
   "concurrency": { "instanceMax": 8, "perStepMax": 4, "perAdapterMax": 4 },
   "worker": { "timeoutMs": 120000, "outputLimitBytes": 1048576 },
   "contextBudget": { "outputReserveTokens": 8192, "safetyMarginTokens": 2048 },
+  // User controls which slash commands the LLM may discover and invoke.
+  "localPtc": { "timeoutMs": 30000, "maxToolCalls": 32 },
+  "slashCommands": { "llmVisible": [] },
   "capabilityInput": { "catalogMaxTokens": 4096, "searchResultMaxTokens": 4096 },
-  "contextProjection": {
-    "toolResultMaxTokens": 8192,
-    "snip": { "triggerTokens": 64000, "retainedTokens": 32000 },
-    "microcompact": { "triggerTokens": 96000, "projectedTokens": 48000 },
-    "contextCollapse": { "triggerTokens": 128000, "projectedTokens": 64000 },
-    "stageVersion": "v1"
-  },
-  "compaction": { "preservedSegmentTokens": 16000, "preservedSegmentBytes": 262144, "summaryMaxTokens": 8192 },
+  // Working Context Snip starts at 60% of the model window. Keep the newest 15 tool results;
+  // older results over 1500 estimated tokens retain 800 head + 400 tail tokens.
+  // Compaction retains at least 5000 tokens at whole-message/tool-exchange boundaries.
+  "compaction": { "summaryMaxTokens": 8192 },
   "autoReview": { "timeoutMs": 30000, "goalMaxBytes": 32768 },
   "executive": { "verification": [] },
-  "providerPromptCache": { "enabled": false, "minimumEligiblePrefixTokens": 1024, "maximumBreakpoints": 4 },
+  "providerPromptCache": { "enabled": true, "minimumEligiblePrefixTokens": 1024, "maximumBreakpoints": 4 },
   "historyRetention": { "purgeMode": "manual", "purgeArchivedAfterDays": null },
   "snapshot": { "maxRuntimeEntities": 50000, "pageSizeDefault": 100, "pageSizeMax": 500 },
   "sse": { "heartbeatIntervalMs": 15000, "maxBufferedEvents": 1024, "maxBufferedBytes": 1048576 }

package/dist/adapters/executor-router.d.ts

@@ -0,0 +1,20 @@
+import { type CapabilityAdapter, type CapabilityInvocation, type CapabilityOutput, type Json } from '../core/domain.js';
+import type { Store } from '../store/store.js';
+import { type ExecutorClient } from './executor.js';
+import type { RegisteredCapability } from '../runtime/capabilities.js';
+export type ExecutorId = string;
+/** Workspace bindings, not path syntax or model declarations, select the machine. */
+export declare class ExecutorRouter implements CapabilityAdapter {
+    readonly store: Store;
+    readonly remote: ExecutorClient;
+    readonly local?: ExecutorClient | undefined;
+    readonly additional: ReadonlyMap<string, ExecutorClient>;
+    readonly id = "executor";
+    constructor(store: Store, remote: ExecutorClient, local?: ExecutorClient | undefined, additional?: ReadonlyMap<string, ExecutorClient>);
+    endpoint(id: ExecutorId): ExecutorClient;
+    workspace(projectId: string, workspaceId: string): ExecutorClient;
+    execute(invocation: CapabilityInvocation): Promise<CapabilityOutput>;
+    capabilities(): readonly RegisteredCapability[];
+    health(): Promise<Json>;
+    deleteCallHistory(workspaceId: string, callIds: readonly string[]): Promise<Json>;
+}

package/dist/adapters/executor-router.js

@@ -0,0 +1,86 @@
+import { digest } from '../core/codec.js';
+import { fail } from '../core/domain.js';
+import { executorCapabilities } from './executor.js';
+import { capabilityManifest } from '../runtime/manifests.js';
+/** Workspace bindings, not path syntax or model declarations, select the machine. */
+export class ExecutorRouter {
+    store;
+    remote;
+    local;
+    additional;
+    id = 'executor';
+    constructor(store, remote, local, additional = new Map()) {
+        this.store = store;
+        this.remote = remote;
+        this.local = local;
+        this.additional = additional;
+    }
+    endpoint(id) {
+        if (id === 'remote')
+            return this.remote;
+        const configured = this.additional.get(id);
+        if (configured)
+            return configured;
+        if (id !== 'local')
+            fail('EXECUTOR_NOT_CONFIGURED', 409, 'The Workspace Executor is not configured. Its files were not routed elsewhere.');
+        if (!this.local)
+            fail('LOCAL_EXECUTOR_NOT_CONFIGURED', 409, 'Configure a loopback local Executor before selecting local folders.');
+        return this.local;
+    }
+    workspace(projectId, workspaceId) {
+        const id = this.store.getWorkspace(projectId, workspaceId).executor_id;
+        if (typeof id !== 'string')
+            fail('EXECUTOR_NOT_CONFIGURED', 409, 'Workspace Executor binding is invalid.');
+        return this.endpoint(id);
+    }
+    async execute(invocation) {
+        if (invocation.capabilityId === 'list_workspaces')
+            return { content: { workspaces: this.store.listWorkspaces(invocation.projectId) } };
+        const input = invocation.arguments;
+        const targetId = typeof input.source_workspace_id === 'string' ? input.source_workspace_id : invocation.workspaceId;
+        const workspace = this.store.getWorkspace(invocation.projectId, targetId);
+        if (targetId !== invocation.workspaceId && !['read_file', 'view_image', 'glob', 'grep'].includes(invocation.capabilityId)) {
+            fail('WORKSPACE_WRITE_DENIED', 403, 'Cross-Workspace operations are read-only.');
+        }
+        const paths = Array.isArray(workspace.paths) ? workspace.paths.filter((value) => typeof value === 'string') : [];
+        return this.workspace(invocation.projectId, targetId).execute({ ...invocation, workspaceId: targetId, workspacePaths: paths,
+            // A mount never inherits the active Workspace's full-access escape hatch.
+            fullAccess: targetId === invocation.workspaceId && invocation.fullAccess === true });
+    }
+    capabilities() {
+        const discovery = {
+            id: 'list_workspaces', title: 'List Project Workspaces', description: 'List Project Workspace IDs, execution endpoints and paths. Use source_workspace_id on read_file/glob/grep to retrieve source material from another Workspace. Write reports in the active local Workspace. Listing does not guarantee access or complete search coverage.',
+            adapterId: 'executor', effect: 'read_only', loadMode: 'eager', outputLimitBytes: 65536, defaultAssignment: 'all_new_agents',
+            inputSchema: { type: 'object', properties: {}, additionalProperties: false }
+        };
+        return [{ definition: discovery, adapter: this, manifest: capabilityManifest(discovery), claims: () => [] }, ...executorCapabilities(this.remote).map(capability => {
+                const readable = ['read_file', 'view_image', 'glob', 'grep'].includes(capability.definition.id);
+                const schema = capability.definition.inputSchema;
+                const definition = readable ? { ...capability.definition,
+                    description: `${capability.definition.description} Defaults to the active Workspace. To read a different Workspace in this Project, set source_workspace_id from list_workspaces; never infer the machine from a path.`,
+                    inputSchema: { ...schema, properties: { ...schema.properties, source_workspace_id: { type: 'string', minLength: 1 } } }
+                } : capability.definition;
+                return { ...capability, definition, adapter: this, manifest: capabilityManifest(definition) };
+            })];
+    }
+    async health() {
+        const remote = await this.remote.health();
+        if (!this.local && this.additional.size === 0)
+            return remote;
+        const state = (value) => {
+            if (typeof value !== 'object' || value === null || !('state_id' in value) || typeof value.state_id !== 'string')
+                fail('EXECUTOR_IDENTITY_REQUIRED', 503, 'Executor state identity is unavailable.');
+            return value.state_id;
+        };
+        const states = { remote: state(remote) };
+        if (this.local)
+            states.local = state(await this.local.health());
+        for (const [id, client] of this.additional)
+            states[id] = state(await client.health());
+        return { state_id: digest(states) };
+    }
+    async deleteCallHistory(workspaceId, callIds) {
+        const workspace = this.store.workspaceOwner(workspaceId);
+        return this.workspace(workspace.projectId, workspaceId).deleteCallHistory(workspaceId, callIds);
+    }
+}

package/dist/adapters/executor.d.ts

@@ -1,5 +1,7 @@
+import * as grpc from '@grpc/grpc-js';
 import { type CapabilityAdapter, type CapabilityInvocation, type CapabilityOutput, type Json } from '../core/domain.js';
 import type { ConfigRuntime } from '../config/runtime.js';
+import type { HarnessConfig } from '../config/schema.js';
 import type { RegisteredCapability } from '../runtime/capabilities.js';
 /**
  * Carries the Executor's gRPC status alongside the message. Without it every failure looked the
@@ -16,20 +18,24 @@ type ObjectValue = Readonly<Record<string, unknown>>;
 export declare class ExecutorClient implements CapabilityAdapter {
     #private;
     readonly config: ConfigRuntime;
+    readonly endpoint: HarnessConfig['executor'];
     readonly id = "executor";
     private constructor();
-    static create(root: string, runtime: ConfigRuntime): Promise<ExecutorClient>;
+    static create(root: string, runtime: ConfigRuntime, endpoint?: HarnessConfig['executor']): Promise<ExecutorClient>;
     close(): void;
     health(signal?: AbortSignal): Promise<Json>;
+    taskAudit(projectId: string, taskId: string, limit: number, cursor?: string): Promise<Json>;
     browse(path: string, signal?: AbortSignal): Promise<Json>;
     chooseFolder(_initialPath?: string, signal?: AbortSignal): Promise<Json>;
     open(workspacePaths: readonly string[], path: string, signal?: AbortSignal): Promise<Json>;
     validatePaths(paths: readonly string[], signal?: AbortSignal, createIfMissing?: boolean): Promise<Json>;
+    sharedWorkspace(path: string): boolean;
+    verifySharedPaths(paths: readonly string[], signal?: AbortSignal): Promise<void>;
     deleteCallHistory(workspaceId: string, callIds: readonly string[], signal?: AbortSignal): Promise<Json>;
     describeCallHistory(workspaceId: string, callIds: readonly string[], workspacePaths: readonly string[], fullAccess: boolean, signal?: AbortSignal): Promise<Json>;
     execute(invocation: CapabilityInvocation): Promise<CapabilityOutput>;
-    call(method: string, request: ObjectValue, timeoutMs: number, signal?: AbortSignal): Promise<Json>;
+    call(method: string, request: ObjectValue, timeoutMs: number, signal?: AbortSignal, audit?: grpc.Metadata): Promise<Json>;
 }
 export declare function executorCapabilities(adapter: ExecutorClient): readonly RegisteredCapability[];
-export declare function pathResource(path: string, workspacePaths: readonly string[]): string;
+export declare function verifySharedWorkspace(root: string, read: (path: string, expected: string) => Promise<boolean>): Promise<void>;
 export {};