@nextclaw/kernel 0.6.7 → 0.6.8

package/dist/index.js

@@ -1,6 +1,6 @@
 import { n as getUnsignedUpdateManifest, r as serializeUnsignedUpdateManifest, t as UpdateManifestReader } from "./update-manifest.types-C0qPrjGQ.js";
 import { createRequire } from "node:module";
-import { APP_NAME, AgentRouteResolver, BUILTIN_MAIN_AGENT_ID, CLEAR_THINKING_TOKENS, CONTEXT_COMPACTION_METADATA_KEY, ConfigSchema, ContextCompactionService, ContextWindowBudgetService, CronService, CronTool, DEFAULT_PANELS_DIR, DEFAULT_SERVICE_APPS_DIR, DEFAULT_SESSION_SEARCH_LIMIT, DEFAULT_WORKSPACE_REPOSITORY_IDENTITY_RESOLVER, EditFileTool, ExecTool, ExtensionChannelAdapter, GatewayTool, InputBudgetPruner, LLMProvider, ListDirTool, LiteLLMProvider, MAX_SESSION_SEARCH_LIMIT, MemoryGetTool, MemorySearchTool, MemoryStore, MessageBus, MessageTool, ProviderRegistry, ReadFileTool, RequestedSkillsMetadataReader, SILENT_REPLY_TOKEN, SessionProjectContextResolver, SessionSearchService, SkillsLoader, THINKING_LEVELS, ViewImageTool, WebFetchTool, WebSearchTool, WriteFileTool, buildCompressingCompactionCheckpoint, buildConfigSchema, buildContextWindowSnapshot, buildReloadPlan, buildSessionRequestToolResult, buildToolCatalogEntries, createAgentProfile, createAssistantStreamDeltaControlMessage, createAssistantStreamResetControlMessage, createCompletedSessionRequest, createFailedSessionRequest, createRunningSessionRequest, createRuntimeChildEnv, createTypingStopControlMessage, diffConfigPaths, ensureDir, evaluateSilentReply, expandHome, findEffectiveAgentProfile, getConfigPath, getDataDir, getDataPath, getSessionsPath, getWorkspacePath, getWorkspacePathFromConfig, isNextclawControlMessage, loadConfig, mergeExtensionConfigView, modelSupportsVision, normalizeAgentProfileId, normalizeInlineSecretRefs, normalizeModelThinkingCapability, normalizeProviderModelConfig, normalizeToolParams, parseAgentScopedSessionKey, parseThinkingLevel, readCompressedContextCompactionCheckpoint, readOptionalString, readParentSessionId, readSessionProjectRoot, redactConfigObject, removeAgentProfile, resolveConfigSecrets, resolveDefaultAgentProfileId, resolveEffectiveAgentProfiles, resolveNextclawSelfManageGuidePaths, resolveProviderRuntime, resolveSessionProjectContext, resolveSessionWorkspacePath, resolveThinkingLevel, sanitizeOutboundAssistantContent, saveConfig, summarizeSessionRequestTask, toExtensionConfigView, updateAgentProfile } from "@nextclaw/core";
+import { APP_NAME, AgentRouteResolver, BUILTIN_MAIN_AGENT_ID, CLEAR_THINKING_TOKENS, CONTEXT_COMPACTION_METADATA_KEY, ConfigSchema, ContextCompactionService, ContextWindowBudgetService, CronService, CronTool, DEFAULT_PANELS_DIR, DEFAULT_SERVICE_APPS_DIR, DEFAULT_SESSION_SEARCH_LIMIT, DEFAULT_WORKSPACE_REPOSITORY_IDENTITY_RESOLVER, EditFileTool, ExecTool, ExtensionChannelAdapter, GatewayTool, InputBudgetPruner, LLMProvider, ListDirTool, LiteLLMProvider, MAX_SESSION_SEARCH_LIMIT, MemoryGetTool, MemorySearchTool, MemoryStore, MessageBus, MessageTool, ProviderRegistry, ReadFileTool, RequestedSkillsMetadataReader, SILENT_REPLY_TOKEN, SessionProjectContextResolver, SessionSearchService, SkillsLoader, THINKING_LEVELS, ViewImageTool, WebFetchTool, WebSearchTool, WriteFileTool, buildCompressingCompactionCheckpoint, buildConfigSchema, buildContextWindowSnapshot, buildReloadPlan, buildSessionRequestToolResult, buildToolCatalogEntries, createAgentProfile, createAssistantStreamDeltaControlMessage, createAssistantStreamResetControlMessage, createCompletedSessionRequest, createFailedSessionRequest, createRunningSessionRequest, createRuntimeChildEnv, createTypingStopControlMessage, diffConfigPaths, ensureDir, evaluateSilentReply, expandHome, findEffectiveAgentProfile, getConfigPath, getDataDir, getDataPath, getSessionsPath, getWorkspacePath, getWorkspacePathFromConfig, isNextclawControlMessage, loadConfig, mergeExtensionConfigView, modelSupportsVision, normalizeAgentProfileId, normalizeInlineSecretRefs, normalizeModelThinkingCapability, normalizeProviderModelConfig, normalizeToolParams, parseAgentScopedSessionKey, parseThinkingLevel, readCompressedContextCompactionCheckpoint, readOptionalString, readParentSessionId, readSessionProjectRoot, redactConfigObject, removeAgentProfile, resolveConfigSecrets, resolveDefaultAgentProfileId, resolveEffectiveAgentProfiles, resolveNextclawSelfManageGuidePaths, resolveProviderRuntime, resolveSessionProjectContext, resolveSessionWorkspacePath, resolveThinkingLevel, safeFilename, sanitizeOutboundAssistantContent, saveConfig, summarizeSessionRequestTask, toExtensionConfigView, updateAgentProfile } from "@nextclaw/core";
 import { NcpEventType, normalizeAssistantText, sanitizeAssistantReplyTags } from "@nextclaw/ncp";
 import { LocalAssetStore, buildAssetContentPath, buildNcpUserContent, buildOpenAiFunctionTool, ncpMessageToOpenAiMessages, validateToolArgs } from "@nextclaw/ncp-agent-runtime";
 import { createHash, createHmac, randomBytes, randomUUID, scryptSync, timingSafeEqual } from "node:crypto";
@@ -9364,28 +9364,35 @@ var ProjectContextProvider = class {
 };
 //#endregion
 //#region src/contributions/context-provider/providers/reply-format-context.provider.ts
+function resolveVisualizationAssetDirectory(request) {
+	const sessionId = safeFilename(request.sessionId ?? request.message.sessionId ?? "unscoped").replace(/^\.+$/, "unscoped") || "unscoped";
+	return resolve(getDataDir(), "assets", "visualizations", sessionId);
+}
 var ReplyFormatContextProvider = class {
-	provide = (_request) => [[
+	provide = (request) => [[
 		"## Agent Output & Reply Formatting Contract",
 		"Goal: make the directly visible final reply self-contained, concise, and easy to act on; make openable files clickable, show local images directly when appropriate, and use richer display surfaces only when they improve delivery.",
 		"Visible final reply: after a completed assistant turn, the UI collapses reasoning and tool activity through the last tool call under a Processed summary. Content after the last tool call remains directly visible. Therefore, after the final tool call, always write a self-contained final response with the outcome, important caveats, relevant links, and the next useful action. Do not put the final answer only before a tool call, and do not assume raw tool output remains directly visible.",
 		"Progress narration before or between tool calls may be brief and contextual, but do not repeat it in the final reply. The final reply must still make sense when all earlier narration and tool activity are collapsed.",
 		"Markdown structure: prefer short paragraphs. Use headings, lists, tables, blockquotes, and code blocks only when they materially improve scanning or comparison; do not over-format a simple answer. Keep link labels descriptive and plain, and place each link next to the claim or artifact it supports.",
 		"Mermaid diagrams: use a fenced `mermaid` block when a relationship, flow, sequence, state transition, or hierarchy is materially clearer as a diagram than as short prose or a small list. Keep diagrams focused, quote node labels that contain punctuation, and do not add a diagram merely because an answer has several steps.",
+		"Visualization: when an answer or result is materially clearer as a focused visual, infer the appropriate medium without requiring the user to name it or restate design rules. You MUST read the built-in `visualize-output` SKILL.md with `read_file` before any visualization tool call and follow its data-fidelity rules without inventing or reinterpreting missing facts. State only facts and mathematical relationships directly supported by the user's input; calculate every derived number with a tool and re-read the final artifact to compare every displayed value against the input and computed results. Without a supplied threshold, do not label values healthy, normal, good, bad, high, or low. Unless the user supplies evidence and asks for analysis, do not add causal hypotheses, diagnostic recommendations, industry ranges, targets, optimization effects, forecasts, or projected impact; when asked only to summarize supplied data, stop at what the data shows rather than why it happened or what to do. If it selects inline HTML, create the parent directory first, write and verify a real self-contained HTML file, then embed it with a `nextclaw-inline` `file` target; never represent generated local HTML as a URL or duplicate the visual with a second table/list. Keep simple answers in prose, and use `nextclaw-app-creator` for reusable apps or sustained workflows.",
+		`Persistent visualization assets: files generated only to render a visualization in this conversation belong under the exact session directory \`${resolveVisualizationAssetDirectory(request)}\`. Create that directory when needed, keep related self-contained files together there, and use the resulting absolute file path in the inline \`file\` target. Never put these generated visualization assets in \`/tmp\`, another temporary directory, the active project, or the working-directory root. Only write into the user's project when the user explicitly asks for a project-owned deliverable.`,
 		"File links: every concrete local file or directory mentioned in the final reply must be clickable. Use Markdown links only, with a plain text label and an openable href: [MEMORY.md](MEMORY.md), [report.docx](report.docx), [file](packages/example/file.ts), [notes.md](/Users/example/Documents/notes.md). Use project-relative hrefs for files under the active/session project root, and absolute hrefs for local files outside it. File links open source by default; supported visual and Office documents open their automatic preview. Use a viewer query such as [diagram.svg](diagram.svg?viewer=source) when source is explicitly required, or [preview.html](preview.html?viewer=rendered) when an HTML link should open rendered output.",
 		"Markdown syntax and resource availability are separate: emit a proper Markdown link even when you cannot verify that its target still exists. The UI will report missing or unavailable content when the user opens it; never downgrade a valid link to bare text preemptively.",
 		"Local images: prefer standard Markdown image syntax when the image should be visible in the reply: ![chart](assets/chart.png) or ![diagram](/Users/example/Pictures/diagram.svg). Local image hrefs follow the same project-relative or absolute path rules as file links. Do not invent an internal API URL or a file:// URL. Use `show_file` only when the file should immediately open in the side panel; `view_image` is only for giving the model visual input.",
 		"Display choice: Do not make every UI an inline card. Choose inline only for a compact, immediately usable card or short interaction. Use the side panel for normal Panel Apps, long reading, rich editing, file browsing, large tables, multi-page workflows, or sustained workspaces.",
 		"Inline display: when the final reply should include a non-clickable inline display placeholder, output a fenced `nextclaw-inline` JSON block:",
 		"```nextclaw-inline\n{\"target\":{\"type\":\"panel_app\",\"payload\":{\"appId\":\"timer\"}},\"title\":\"Timer\"}\n```",
-		"Supported targets are `panel_app`, `json`, `file`, and `url`. Prefer `panel_app` for inline Panel App display; use `file` and `url` only as non-clickable placeholders when a clickable link is not intended; use `json` for inert JSON snapshots.",
+		"Supported targets are `panel_app`, `json`, `file`, and `url`. Prefer `panel_app` for inline Panel App display; use `file` and `url` only as non-clickable placeholders when a clickable link is not intended; use `file` for generated local HTML and `url` only for a real http/https page, never for a local path or an invented root-relative URL; use `json` for inert JSON snapshots.",
 		"Inline display is Markdown-only and display-only: no opening, executing, or tool action. Never call `show_panel_app` for inline display, including when the user asks which Panel Apps are suitable for inline display or says to show them inline. `show_panel_app` is only for immediately opening a Panel App outside the final reply in the side panel. Use Markdown links for clickable resources and `show_file` / `show_url` / `show_panel_app` only when the UI should immediately show or run content outside the final reply.",
-		"For ordinary local HTML files or page prototypes, call `show_file` with `path` and `viewer=\"rendered\"`; use `viewer=\"source\"` when the user needs source text. Markdown file links open source by default; append `?viewer=rendered` only when the link itself should open the rendered HTML view. Do not convert a plain HTML file into a Panel App just to preview it.",
+		"For ordinary local HTML files or page prototypes that should open outside the reply, call `show_file` with `path` and `viewer=\"rendered\"`; use `viewer=\"source\"` when the user needs source text. This rule does not apply to an inline visualization selected under the Visualization contract or to a request that says the result must appear directly in the current reply: in those cases do not call `show_file`, `show_url`, a browser-opening command, or any other external display action. Markdown file links open source by default; append `?viewer=rendered` only when the link itself should open the rendered HTML view. Do not convert a plain HTML file into a Panel App just to preview it.",
 		"A Panel Card must be card-first: prefer a landscape composition where width carries the main information and the card is wider than it is tall; collapse to one column only in narrow containers. Core value must be visible in the first 220-420px, with no horizontal scrolling, no reliance on document-level internal scrolling, compact controls, at most one primary action, clear loading/empty/error states, and an obvious expand path for details.",
 		"Typical Panel Card fits: weather cards, calculators, timers, checklists, pickers, compact forms, previews, and small dashboards. If the UI needs more space than a card, use the side panel. Inline hosts may pass `nextclawDisplayMode=card` and `nextclawPlacement=inline`; use those hints to render a compact card layout instead of a full page.",
 		"Forbidden forms: bare file names or paths, inline-code file names, bold-only file names, code-styled link labels, code blocks for file references, file:// URLs, internal API URLs, action semantics inside `nextclaw-inline`, tool calls for inline display, and unlinked comma-separated file lists.",
 		"Examples: bad `MEMORY.md` -> good [MEMORY.md](MEMORY.md); bad `memory/` -> good [memory/](memory/); bad `report.docx` -> good [report.docx](report.docx); bad `/Users/example/chart.png` -> good ![chart](/Users/example/chart.png); bad `2026-03-07.md` / `feishu-notes.md` -> good [2026-03-07.md](memory/2026-03-07.md) / [feishu-notes.md](memory/feishu-notes.md).",
-		"Self-check before sending: scan the final visible reply for local file names, paths, and images. Make every concrete file clickable, render intended images with Markdown image syntax, or ensure it is intentionally represented by `nextclaw-inline`; otherwise remove the exact names and summarize instead."
+		"Self-check before sending: scan the final visible reply for local file names, paths, and images. Make every concrete file clickable, render intended images with Markdown image syntax, or ensure it is intentionally represented by `nextclaw-inline`; otherwise remove the exact names and summarize instead.",
+		"Mandatory visualization gate for the current turn: if the user's request asks for a visualization, chart, diagram, visual comparison, timeline, dashboard, status/result view, or direct visual presentation, your FIRST tool call MUST be `read_file` for the built-in `visualize-output` SKILL.md; calling `exec`, `write_file`, `show_file`, image tools, or any other visualization-related tool first is invalid. Once you choose generated inline HTML for the answer, never call `show_file`, `show_url`, a browser-opening command, or an external display tool during that turn, regardless of whether the user explicitly said inline; verify with non-display file reads or commands instead. Use a verified file in the persistent session visualization directory named above and emit its absolute `file` payload path with `viewer: \"rendered\"`; never use `/tmp`, a temporary directory, the active project, or the working-directory root for a conversation-only generated visualization. After the final verification tool returns, perform the comparison silently. The final visible reply must contain only the fenced `nextclaw-inline` declaration: no sentence before it, no validation table, calculations, pass/fail narration, data recap, conclusion, bullet list, or second visualization; the declaration's closing fence must be the final content, with nothing after it. Unless the user asks for them, do not add extra month-over-month, year-over-year, compound-growth, or cumulative-growth metrics merely because they can be calculated."
 	].join("\n")];
 };
 //#endregion