@openagents-org/agent-launcher 0.2.127 → 0.2.130

package/src/adapters/workspace-prompt.js

@@ -78,11 +78,12 @@ function buildModePrompt(mode) {
  *
  * In plan mode, only read-only operations are documented.
  */
-function buildApiSkillsPrompt({ endpoint, workspaceId, token, agentName, channelName, disabledModules, mode = 'execute' }) {
+function buildApiSkillsPrompt({ endpoint, workspaceId, token, agentName, channelName, disabledModules, mode = 'execute', isWindows = process.platform === 'win32' }) {
   const disabled = disabledModules || new Set();
   const baseUrl = endpoint.replace(/\/+$/, '');
   const isPlan = mode === 'plan';
   const h = `X-Workspace-Token: ${token}`;
+  const curl = isWindows ? 'curl.exe' : 'curl';
 
   const sections = [];
 
@@ -115,34 +116,53 @@ function buildApiSkillsPrompt({ endpoint, workspaceId, token, agentName, channel
     let s = '\n### Shared Files\n\n';
 
     if (!isPlan) {
-      s += (
-        '**To upload a file**, exec this (replace filename/content):\n' +
-        `CONTENT=$(echo -n 'YOUR_CONTENT' | base64) && ` +
-        `curl -s -X POST ${baseUrl}/v1/files/base64 ` +
-        `-H "${h}" ` +
-        '-H "Content-Type: application/json" ' +
-        `-d '{"filename":"report.md",` +
-        `"content_base64":"'"$CONTENT"'",` +
-        `"content_type":"text/markdown",` +
-        `"network":"${workspaceId}",` +
-        `"source":"openagents:${agentName}",` +
-        `"channel_name":"${channelName}"}'\n\n`
-      );
+      if (isWindows) {
+        s += (
+          '**To upload a file**, exec this (replace filename/content):\n' +
+          `$CONTENT = [Convert]::ToBase64String([Text.Encoding]::UTF8.GetBytes('YOUR_CONTENT'))\n` +
+          `${curl} -s -X POST ${baseUrl}/v1/files/base64 ` +
+          `-H "${h}" ` +
+          '-H "Content-Type: application/json" ' +
+          `-d "{\\"filename\\":\\"report.md\\",` +
+          `\\"content_base64\\":\\"$CONTENT\\",` +
+          `\\"content_type\\":\\"text/markdown\\",` +
+          `\\"network\\":\\"${workspaceId}\\",` +
+          `\\"source\\":\\"openagents:${agentName}\\",` +
+          `\\"channel_name\\":\\"${channelName}\\"}"\n\n`
+        );
+      } else {
+        s += (
+          '**To upload a file**, exec this (replace filename/content):\n' +
+          `CONTENT=$(echo -n 'YOUR_CONTENT' | base64) && ` +
+          `${curl} -s -X POST ${baseUrl}/v1/files/base64 ` +
+          `-H "${h}" ` +
+          '-H "Content-Type: application/json" ' +
+          `-d '{"filename":"report.md",` +
+          `"content_base64":"'"$CONTENT"'",` +
+          `"content_type":"text/markdown",` +
+          `"network":"${workspaceId}",` +
+          `"source":"openagents:${agentName}",` +
+          `"channel_name":"${channelName}"}'\n\n`
+        );
+      }
     }
 
+    const tmpDir = isWindows ? '$env:TEMP' : '/tmp';
     s += (
       '**List files:**\n' +
-      `\`curl -s -H "${h}" ${baseUrl}/v1/files?network=${workspaceId}\`\n\n` +
-      '**Download file:**\n' +
-      `\`curl -s -H "${h}" ${baseUrl}/v1/files/{file_id}\`\n\n` +
+      `\`${curl} -s -H "${h}" ${baseUrl}/v1/files?network=${workspaceId}\`\n\n` +
+      '**Download file (text):**\n' +
+      `\`${curl} -s -H "${h}" ${baseUrl}/v1/files/{file_id}\`\n\n` +
+      '**Download file (binary/images) — save to disk, then use Read tool to view:**\n' +
+      `\`${curl} -s -H "${h}" ${baseUrl}/v1/files/{file_id} -o ${tmpDir}/{filename}\`\n\n` +
       '**File info (metadata):**\n' +
-      `\`curl -s -H "${h}" ${baseUrl}/v1/files/{file_id}/info\`\n`
+      `\`${curl} -s -H "${h}" ${baseUrl}/v1/files/{file_id}/info\`\n`
     );
 
     if (!isPlan) {
       s += (
         '\n**Delete file:**\n' +
-        `\`curl -s -X DELETE -H "${h}" ${baseUrl}/v1/files/{file_id}\`\n`
+        `\`${curl} -s -X DELETE -H "${h}" ${baseUrl}/v1/files/{file_id}\`\n`
       );
     }
 
@@ -157,48 +177,48 @@ function buildApiSkillsPrompt({ endpoint, workspaceId, token, agentName, channel
       s += (
         '**To browse a website**, exec these steps (use exec for each):\n' +
         `Step 1 — open tab: ` +
-        `curl -s -X POST ${baseUrl}/v1/browser/tabs ` +
+        `${curl} -s -X POST ${baseUrl}/v1/browser/tabs ` +
         `-H "${h}" -H "Content-Type: application/json" ` +
         `-d '{"url":"https://example.com","network":"${workspaceId}",` +
         `"source":"openagents:${agentName}"}'\n` +
         `Step 2 — read content: ` +
-        `curl -s -H "${h}" ${baseUrl}/v1/browser/tabs/TAB_ID/snapshot\n` +
+        `${curl} -s -H "${h}" ${baseUrl}/v1/browser/tabs/TAB_ID/snapshot\n` +
         `Step 3 — close tab: ` +
-        `curl -s -X DELETE -H "${h}" ${baseUrl}/v1/browser/tabs/TAB_ID\n` +
+        `${curl} -s -X DELETE -H "${h}" ${baseUrl}/v1/browser/tabs/TAB_ID\n` +
         '(Replace TAB_ID with the id from step 1 response)\n\n'
       );
     }
 
     s += (
       '**List open tabs:**\n' +
-      `\`curl -s -H "${h}" ${baseUrl}/v1/browser/tabs?network=${workspaceId}\`\n\n` +
+      `\`${curl} -s -H "${h}" ${baseUrl}/v1/browser/tabs?network=${workspaceId}\`\n\n` +
       '**Get page content (text):**\n' +
-      `\`curl -s -H "${h}" ${baseUrl}/v1/browser/tabs/{tab_id}/snapshot\`\n\n` +
+      `\`${curl} -s -H "${h}" ${baseUrl}/v1/browser/tabs/{tab_id}/snapshot\`\n\n` +
       '**Get screenshot (PNG):**\n' +
-      `\`curl -s -H "${h}" ${baseUrl}/v1/browser/tabs/{tab_id}/screenshot\`\n`
+      `\`${curl} -s -H "${h}" ${baseUrl}/v1/browser/tabs/{tab_id}/screenshot\`\n`
     );
 
     if (!isPlan) {
       s += (
         '\n**Open tab:**\n' +
-        `\`curl -s -X POST -H "${h}" -H "Content-Type: application/json"` +
+        `\`${curl} -s -X POST -H "${h}" -H "Content-Type: application/json"` +
         ` ${baseUrl}/v1/browser/tabs` +
         ` -d '{"url":"URL","network":"${workspaceId}",` +
         `"source":"openagents:${agentName}"}'\`\n\n` +
         '**Navigate:**\n' +
-        `\`curl -s -X POST -H "${h}" -H "Content-Type: application/json"` +
+        `\`${curl} -s -X POST -H "${h}" -H "Content-Type: application/json"` +
         ` ${baseUrl}/v1/browser/tabs/{tab_id}/navigate` +
         ` -d '{"url":"URL"}'\`\n\n` +
         '**Click element:**\n' +
-        `\`curl -s -X POST -H "${h}" -H "Content-Type: application/json"` +
+        `\`${curl} -s -X POST -H "${h}" -H "Content-Type: application/json"` +
         ` ${baseUrl}/v1/browser/tabs/{tab_id}/click` +
         ` -d '{"selector":"CSS_SELECTOR"}'\`\n\n` +
         '**Type text:**\n' +
-        `\`curl -s -X POST -H "${h}" -H "Content-Type: application/json"` +
+        `\`${curl} -s -X POST -H "${h}" -H "Content-Type: application/json"` +
         ` ${baseUrl}/v1/browser/tabs/{tab_id}/type` +
         ` -d '{"selector":"CSS_SELECTOR","text":"TEXT"}'\`\n\n` +
         '**Close tab:**\n' +
-        `\`curl -s -X DELETE -H "${h}" ${baseUrl}/v1/browser/tabs/{tab_id}\`\n`
+        `\`${curl} -s -X DELETE -H "${h}" ${baseUrl}/v1/browser/tabs/{tab_id}\`\n`
       );
     }
 
@@ -209,9 +229,9 @@ function buildApiSkillsPrompt({ endpoint, workspaceId, token, agentName, channel
   sections.push(
     '\n### Message History\n\n' +
     '**Get recent messages in the current channel:**\n' +
-    `\`curl -s -H "${h}" "${baseUrl}/v1/events?network=${workspaceId}&channel=${channelName}&type=workspace.message&sort=desc&limit=20"\`\n\n` +
+    `\`${curl} -s -H "${h}" "${baseUrl}/v1/events?network=${workspaceId}&channel=${channelName}&type=workspace.message&sort=desc&limit=20"\`\n\n` +
     '**Get messages from a specific channel:**\n' +
-    `\`curl -s -H "${h}" "${baseUrl}/v1/events?network=${workspaceId}&channel=CHANNEL_NAME&type=workspace.message&sort=desc&limit=20"\`\n`
+    `\`${curl} -s -H "${h}" "${baseUrl}/v1/events?network=${workspaceId}&channel=CHANNEL_NAME&type=workspace.message&sort=desc&limit=20"\`\n`
   );
 
   // Post status update
@@ -219,7 +239,7 @@ function buildApiSkillsPrompt({ endpoint, workspaceId, token, agentName, channel
     sections.push(
       '\n### Post Status Update\n\n' +
       'Post a status/thinking message (visible in the workspace UI as an intermediate step):\n' +
-      `\`curl -s -X POST -H "${h}" -H "Content-Type: application/json" ` +
+      `\`${curl} -s -X POST -H "${h}" -H "Content-Type: application/json" ` +
       `${baseUrl}/v1/events -d '{"type":"workspace.message.posted",` +
       `"source":"openagents:${agentName}","target":"channel/${channelName}",` +
       `"payload":{"content":"YOUR_STATUS","message_type":"status"}}'\`\n`
@@ -234,14 +254,14 @@ function buildApiSkillsPrompt({ endpoint, workspaceId, token, agentName, channel
       'is replaced each time (send the full list with current statuses).\n\n' +
       '**Status values:** `pending`, `in_progress`, `completed`\n\n' +
       '**Update your to-do list:**\n' +
-      `\`curl -s -X PUT -H "${h}" -H "Content-Type: application/json" ` +
+      `\`${curl} -s -X PUT -H "${h}" -H "Content-Type: application/json" ` +
       `${baseUrl}/v1/todos -d '{"todos":[` +
       `{"content":"First task","status":"in_progress"},` +
       `{"content":"Second task","status":"pending"}` +
       `],"network":"${workspaceId}","channel":"${channelName}",` +
       `"source":"openagents:${agentName}"}'\`\n\n` +
       '**Get your to-do list:**\n' +
-      `\`curl -s -H "${h}" "${baseUrl}/v1/todos?network=${workspaceId}&channel=${channelName}"\`\n\n` +
+      `\`${curl} -s -H "${h}" "${baseUrl}/v1/todos?network=${workspaceId}&channel=${channelName}"\`\n\n` +
       '**IMPORTANT:** When you receive a task with multiple steps or a list of things to do, ' +
       'ALWAYS create a to-do list first before starting work. This lets the user see your ' +
       'progress in real time. Update statuses as you work through each item.\n' +
@@ -259,14 +279,14 @@ function buildApiSkillsPrompt({ endpoint, workspaceId, token, agentName, channel
       'Use cases: check back on a deploy, retry after a rate limit, remind ' +
       'yourself to follow up.\n\n' +
       '**Create a timer:**\n' +
-      `\`curl -s -X POST -H "${h}" -H "Content-Type: application/json" ` +
+      `\`${curl} -s -X POST -H "${h}" -H "Content-Type: application/json" ` +
       `${baseUrl}/v1/timers -d '{"delay":300,"message":"Check the build",` +
       `"network":"${workspaceId}","channel":"${channelName}",` +
       `"source":"openagents:${agentName}"}'\`\n\n` +
       '**List active timers:**\n' +
-      `\`curl -s -H "${h}" "${baseUrl}/v1/timers?network=${workspaceId}&channel=${channelName}"\`\n\n` +
+      `\`${curl} -s -H "${h}" "${baseUrl}/v1/timers?network=${workspaceId}&channel=${channelName}"\`\n\n` +
       '**Cancel a timer:**\n' +
-      `\`curl -s -X DELETE -H "${h}" ${baseUrl}/v1/timers/TIMER_ID\`\n`
+      `\`${curl} -s -X DELETE -H "${h}" ${baseUrl}/v1/timers/TIMER_ID\`\n`
     );
   }
 
@@ -280,21 +300,21 @@ function buildApiSkillsPrompt({ endpoint, workspaceId, token, agentName, channel
       '**Schedule:** Specify `hour` (0-23 UTC), `minute` (0-59), and optional ' +
       '`days` array (0=Mon, 6=Sun). Omit `days` for every day.\n\n' +
       '**Create a routine:**\n' +
-      `\`curl -s -X POST -H "${h}" -H "Content-Type: application/json" ` +
+      `\`${curl} -s -X POST -H "${h}" -H "Content-Type: application/json" ` +
       `${baseUrl}/v1/routines -d '{"name":"Daily PR Review","message":"Review open PRs",` +
       `"hour":8,"minute":0,` +
       `"network":"${workspaceId}","channel":"${channelName}",` +
       `"source":"openagents:${agentName}"}'\`\n\n` +
       '**Create a weekday-only routine (Mon-Fri):**\n' +
-      `\`curl -s -X POST -H "${h}" -H "Content-Type: application/json" ` +
+      `\`${curl} -s -X POST -H "${h}" -H "Content-Type: application/json" ` +
       `${baseUrl}/v1/routines -d '{"name":"Morning Standup","message":"Post standup summary",` +
       `"hour":9,"minute":0,"days":[0,1,2,3,4],` +
       `"network":"${workspaceId}","channel":"${channelName}",` +
       `"source":"openagents:${agentName}"}'\`\n\n` +
       '**List active routines:**\n' +
-      `\`curl -s -H "${h}" "${baseUrl}/v1/routines?network=${workspaceId}&channel=${channelName}"\`\n\n` +
+      `\`${curl} -s -H "${h}" "${baseUrl}/v1/routines?network=${workspaceId}&channel=${channelName}"\`\n\n` +
       '**Cancel a routine:**\n' +
-      `\`curl -s -X DELETE -H "${h}" ${baseUrl}/v1/routines/ROUTINE_ID\`\n`
+      `\`${curl} -s -X DELETE -H "${h}" ${baseUrl}/v1/routines/ROUTINE_ID\`\n`
     );
   }
 
@@ -302,12 +322,32 @@ function buildApiSkillsPrompt({ endpoint, workspaceId, token, agentName, channel
   sections.push(
     '\n### Discover Agents\n\n' +
     '**List all agents in the workspace (with status and role):**\n' +
-    `\`curl -s -H "${h}" ${baseUrl}/v1/discover?network=${workspaceId}\`\n`
+    `\`${curl} -s -H "${h}" ${baseUrl}/v1/discover?network=${workspaceId}\`\n`
   );
 
   return sections.join('\n');
 }
 
+/**
+ * Guardrails shared across all adapter prompt builders.
+ */
+function buildGuardrails() {
+  return (
+    '\nIMPORTANT: Never use AskUserQuestion. ' +
+    'AskUserQuestion blocks the subprocess and will hang the thread. ' +
+    'If you need to ask the user something, just write the question ' +
+    'as your text response.\n' +
+    '\nIMPORTANT: When the user gives you a numbered list, bulleted list, or ' +
+    'multiple tasks in a single message, you MUST create a to-do list BEFORE ' +
+    'doing any work. This is mandatory — no exceptions, even for simple tasks. ' +
+    'The to-do list lets the user track your progress in real time.\n' +
+    '\nIMPORTANT: Do NOT use built-in scheduling tools (CronCreate, CronDelete, ' +
+    'CronList, ScheduleWakeup). For timers, routines, and recurring tasks, ' +
+    'ALWAYS use the workspace REST API (curl commands in your skill instructions). ' +
+    'Built-in scheduling is local-only and won\'t appear in the workspace.\n'
+  );
+}
+
 /**
  * Build the system prompt for Claude adapter (MCP-based).
  * Claude gets identity + collaboration instructions but NOT API skills.
@@ -323,6 +363,7 @@ function buildClaudeSystemPrompt({ agentName, workspaceId, channelName, mode = '
     'Use workspace_create_routine to set up recurring scheduled tasks (e.g. daily reviews).\n'
   );
   parts.push(buildCollaborationPrompt());
+  parts.push(buildA2UIPrompt());
 
   if (mode === 'plan') {
     parts.push(
@@ -331,28 +372,86 @@ function buildClaudeSystemPrompt({ agentName, workspaceId, channelName, mode = '
     );
   }
 
-  parts.push(
-    '\nIMPORTANT: Never use AskUserQuestion. ' +
-    'AskUserQuestion blocks the subprocess and will hang the thread. ' +
-    'If you need to ask the user something, just write the question ' +
-    'as your text response.\n'
-  );
+  parts.push(buildGuardrails());
 
-  parts.push(
-    '\nIMPORTANT: When the user gives you a numbered list, bulleted list, or ' +
-    'multiple tasks in a single message, you MUST create a to-do list BEFORE ' +
-    'doing any work. This is mandatory — no exceptions, even for simple tasks. ' +
-    'The to-do list lets the user track your progress in real time.\n'
-  );
+  return parts.join('\n');
+}
 
-  parts.push(
-    '\nIMPORTANT: Do NOT use built-in scheduling tools (CronCreate, CronDelete, ' +
-    'CronList, ScheduleWakeup). For timers, routines, and recurring tasks, ' +
-    'ALWAYS use the workspace REST API (curl commands in your skill instructions). ' +
-    'Built-in scheduling is local-only and won\'t appear in the workspace.\n'
+/**
+ * Teach the LLM how to emit interactive UI alongside its text response.
+ * The frontend (OpenAgents Go) renders any A2UI-shaped JSON spec inline
+ * in the chat bubble; the agent-connector strips the fenced block before
+ * posting and ferries the spec via payload.spec.
+ */
+function buildA2UIPrompt() {
+  return (
+    '\n## Rendering interactive UI\n' +
+    'When you want the user to interact with structured UI (a button choice, ' +
+    'a form, a chart, a table, a confirmation dialog) instead of just reading ' +
+    'text, emit a fenced code block tagged `a2ui` containing a JSON spec. The ' +
+    "frontend renders it inline below any markdown narration you write.\n\n" +
+    "The spec is a tree of `{ type, props, children?, action? }` nodes. " +
+    'Supported component types include `Stack`, `Heading`, `Text`, `Image`, ' +
+    '`Icon`, `Button`, `ChoiceList`, `ConfirmDialog`, `AmountInput`, `Card`, ' +
+    '`Divider`, `Spacer`, `Alert`, `LineChart`, `PieChart`, `AssetPrice`, ' +
+    '`BalanceCard`, `TransactionList`, `TransactionRow`. Unknown types render ' +
+    'as a placeholder chip, so feel free to compose freely.\n\n' +
+    'Interactive components attach an `action` object with a `name` field you ' +
+    'choose. Example:\n\n' +
+    '```a2ui\n' +
+    '{\n' +
+    '  "type": "Stack",\n' +
+    '  "props": { "direction": "vertical", "spacing": 12 },\n' +
+    '  "children": [\n' +
+    '    { "type": "Heading", "props": { "text": "Pick a time", "level": 2 } },\n' +
+    '    { "type": "Button", "props": { "label": "Morning", "action": { "name": "pick_morning" } } },\n' +
+    '    { "type": "Button", "props": { "label": "Evening", "action": { "name": "pick_evening" } } }\n' +
+    '  ]\n' +
+    '}\n' +
+    '```\n\n' +
+    '### Exact prop names (these are checked verbatim — guessing will render "No data")\n\n' +
+    'Layout / content:\n' +
+    '- `Stack` — props: `direction` ("vertical"|"horizontal"), `spacing`, `alignment`\n' +
+    '- `Card` — props: `title`, `padding`, `cornerRadius`\n' +
+    '- `Divider`, `Spacer` — props: `size`, `orientation`\n' +
+    '- `Heading` — props: `text`, `level` (1–4)\n' +
+    '- `Text` — props: `content` **(NOT `text`)**, `style`, `weight`, `color`\n' +
+    '- `Image` — props: `url`, `name`, `contentMode`, `width`, `height`\n' +
+    '- `Icon` — props: `name`, `size`, `color`\n\n' +
+    'Interactive:\n' +
+    '- `Button` — props: `label`, `style` ("primary"|"secondary"|"destructive"), `icon`, `disabled`, `action: {name, params?}`\n' +
+    '- `ConfirmDialog` — props: `title`, `message`, `confirmLabel`, `cancelLabel`, `triggerLabel`, `action`\n' +
+    '- `ChoiceList` — props: `question`, `options: [{id, label}]`, `action`\n' +
+    '- `AmountInput` — props: `label`, `placeholder`, `currency`, `action`\n' +
+    '- `input` (lowercase) — props: `inputType` ("text"|"choice"|"number"|"date"), `id`, `label`, `placeholder`, `options`\n\n' +
+    'Feedback:\n' +
+    '- `Alert` — props: `title`, `message`, `severity` ("info"|"success"|"warning"|"error"), `dismissible`, `action`\n\n' +
+    'Charts (Swift Charts under the hood — needs **non-empty** data with the right key):\n' +
+    '- `LineChart` — props: `title`, `color`, `points: [{x, y}]` **(NOT `data`)**\n' +
+    '- `PieChart` — props: `title`, `segments: [{label, value, color?}]` **(NOT `slices`)**, `showLegend`\n' +
+    '- `chart` (lowercase) — simple sparkline/bar: props: `style` ("sparkline"|"bar"), `data: [number, ...]`, `labels`, `color`\n\n' +
+    'Data display:\n' +
+    '- `metric` (lowercase) — props: `label`, `value`, `caption`, `captionColor`, `icon`\n' +
+    '- `list` (lowercase) — props: `items: [{title, subtitle, trailing, icon}]`, `maxVisible`, `expandLabel`\n' +
+    '- `table` (lowercase) — **key-value rows only, not multi-column**: props: `rows: [{label, value}]`, `maxVisible`\n\n' +
+    'There is no multi-column data table in the catalog. For tabular data with ' +
+    'columns you have two choices: (a) use `list` with title/subtitle/trailing ' +
+    'mapped to your columns, or (b) compose a Stack of horizontal Stacks of Text ' +
+    'manually. Pick whichever reads better.\n\n' +
+    'If your data is empty or you can\'t fit it into the available primitives, ' +
+    'fall back to plain markdown — don\'t emit a spec just to wrap text in a card.\n\n' +
+    'When the user interacts with a rendered component, you will receive a ' +
+    "user message shaped like `[ui_action] action=pick_morning tool_call_id=... value=...`. " +
+    "Use the `action` name (which you chose) to decide what to do next; the " +
+    "spec you emitted earlier is in your conversation history for context.\n\n" +
+    'Use a spec when:\n' +
+    '- The user needs to make a discrete choice (offer buttons rather than ' +
+    'asking them to type a free-form answer).\n' +
+    '- Structured data is easier to scan as a chart or table than as prose.\n' +
+    '- You need explicit confirmation before a destructive action.\n' +
+    "- A form would gather several fields faster than back-and-forth chat.\n\n" +
+    "Don't emit a spec for ordinary prose answers — narration alone is fine.\n"
   );
-
-  return parts.join('\n');
 }
 
 /**
@@ -362,10 +461,12 @@ function buildOpenclawSystemPrompt({ agentName, workspaceId, channelName, endpoi
   const parts = [];
   parts.push(buildWorkspaceIdentity(agentName, workspaceId, channelName, mode));
   parts.push(buildCollaborationPrompt());
+  parts.push(buildA2UIPrompt());
   parts.push(buildModePrompt(mode));
   parts.push(buildApiSkillsPrompt({
     endpoint, workspaceId, token, agentName, channelName, disabledModules, mode,
   }));
+  parts.push(buildGuardrails());
   return parts.join('\n');
 }
 
@@ -394,7 +495,7 @@ function buildOpenclawSkillMd({ endpoint, workspaceId, token, agentName, channel
     '---\n\n'
   );
 
-  return frontmatter + identity + '\n' + collab + '\n' + body;
+  return frontmatter + identity + '\n' + collab + '\n' + body + '\n' + buildGuardrails();
 }
 
 /**
@@ -405,7 +506,7 @@ function buildOpenCodeSystemPrompt({ agentName, workspaceId, channelName, endpoi
   const collab = buildCollaborationPrompt();
   const modePrompt = buildModePrompt(mode);
   const api = buildApiSkillsPrompt({ endpoint, workspaceId, token, agentName, channelName, disabledModules, mode });
-  return identity + '\n' + collab + '\n' + modePrompt + '\n' + api;
+  return identity + '\n' + collab + '\n' + modePrompt + '\n' + api + '\n' + buildGuardrails();
 }
 
 /**
@@ -429,7 +530,7 @@ function buildOpenCodeSkillMd({ endpoint, workspaceId, token, agentName, channel
     `You are agent '${agentName}' connected to OpenAgents workspace ${workspaceId}.\n` +
     'Use these APIs via bash + curl to interact with the workspace.\n\n';
 
-  return frontmatter + identity + api;
+  return frontmatter + identity + api + '\n' + buildGuardrails();
 }
 
 /**
@@ -460,13 +561,44 @@ function buildClaudeSkillMd({ endpoint, workspaceId, token, agentName, channelNa
     '  or collaborating with other agents via @mentions.\n' +
     '---\n\n';
 
-  return frontmatter + identity + '\n' + collab + '\n' + api;
+  return frontmatter + identity + '\n' + collab + '\n' + api + '\n' + buildGuardrails();
+}
+
+/**
+ * Build a SKILL.md file for Cursor CLI's skill auto-discovery.
+ *
+ * Written to .cursor/skills/openagents-workspace.md before each CLI spawn.
+ * Cursor discovers skills from the .cursor/skills/ directory automatically.
+ */
+function buildCursorSkillMd({ endpoint, workspaceId, token, agentName, channelName, disabledModules }) {
+  const api = buildApiSkillsPrompt({
+    endpoint, workspaceId, token, agentName,
+    channelName: channelName || 'general',
+    disabledModules,
+    mode: 'execute',
+  });
+
+  const identity = buildWorkspaceIdentity(agentName, workspaceId, channelName, 'execute');
+  const collab = buildCollaborationPrompt();
+
+  const frontmatter =
+    '---\n' +
+    'name: openagents-workspace\n' +
+    'description: |\n' +
+    '  OpenAgents Workspace collaboration tools — shared files, browser,\n' +
+    '  and multi-agent coordination. Use when: sharing files or reports,\n' +
+    '  browsing websites, reading shared files, checking workspace agents,\n' +
+    '  or collaborating with other agents via @mentions.\n' +
+    '---\n\n';
+
+  return frontmatter + identity + '\n' + collab + '\n' + api + '\n' + buildGuardrails();
 }
 
 module.exports = {
   buildWorkspaceIdentity,
   buildCollaborationPrompt,
   buildModePrompt,
+  buildGuardrails,
   buildApiSkillsPrompt,
   buildClaudeSystemPrompt,
   buildOpenclawSystemPrompt,
@@ -474,4 +606,5 @@ module.exports = {
   buildOpenCodeSystemPrompt,
   buildOpenCodeSkillMd,
   buildClaudeSkillMd,
+  buildCursorSkillMd,
 };

package/src/mcp-server.js

@@ -451,7 +451,14 @@ class McpServer {
           if (mt === 'status') return null;
           const sender = m.senderName || m.senderType || '';
           const content = m.content || '';
-          return `[${sender}] ${content}`;
+          let line = `[${sender}] ${content}`;
+          if (m.attachments && m.attachments.length > 0) {
+            const atts = m.attachments.map((a) =>
+              `[Attached: ${a.filename || 'file'} (file_id: ${a.fileId || '?'})]`
+            ).join(' ');
+            line += `\n  ${atts}`;
+          }
+          return line;
         }).filter(Boolean);
         if (!lines.length) return text('No messages yet.');
         return text(lines.join('\n'));

package/src/workspace-client.js

@@ -156,12 +156,15 @@ class WorkspaceClient {
    */
   async sendMessage(workspaceId, channelName, token, content, {
     senderType = 'agent', senderName, messageType = 'chat', metadata, attachments, sessionId,
+    spec, specToolCallId,
   } = {}) {
     const sourcePrefix = senderType === 'agent' ? 'openagents' : 'human';
     const source = senderName ? `${sourcePrefix}:${senderName}` : `${sourcePrefix}:unknown`;
 
     const payload = { content, message_type: messageType };
     if (attachments && attachments.length) payload.attachments = attachments;
+    if (spec) payload.spec = spec;
+    if (specToolCallId) payload.spec_tool_call_id = specToolCallId;
 
     return this.sendEvent(workspaceId, {
       type: 'workspace.message.posted',
@@ -172,6 +175,30 @@ class WorkspaceClient {
     }, token, sessionId);
   }
 
+  /**
+   * Poll workspace.tool_result events — the client's response to an agent's
+   * render_ui invocation. Returns events directly (no message normalization)
+   * because the caller treats them differently than chat messages.
+   */
+  async pollToolResults(workspaceId, token, { after, limit = 50 } = {}) {
+    const params = new URLSearchParams({
+      network: workspaceId,
+      type: 'workspace.tool_result',
+      limit: String(limit),
+    });
+    if (after) params.set('after', after);
+
+    const data = await this._get(`/v1/events?${params}`, this._wsHeaders(token));
+    const result = data.data || data;
+    const events = (result && result.events) || [];
+
+    let cursor = null;
+    if (events.length > 0) {
+      cursor = events[events.length - 1].id || null;
+    }
+    return { events, cursor };
+  }
+
   /**
    * Poll messages in a channel via GET /v1/events.
    * @returns {Array} message-compatible objects