@realtimex/sdk 2.0.35 → 2.0.37

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@realtimex/sdk",
-    "version": "2.0.35",
+    "version": "2.0.37",
     "description": "RealtimeX runtime SDK package and moderator agent skill assets.",
     "private": false,
     "main": "./index.js",

package/skills/realtimex-artifacts/SKILL.md

@@ -15,16 +15,16 @@ List, publish, inspect, pause, resume, and revoke RealTimeX workspace artifacts.
 
 ## CLI setup
 
-This skill uses `realtimex-pp-cli` version 2.0.35. Before using its commands:
+This skill uses `realtimex-pp-cli` version 2.0.37. Before using its commands:
 
 ```bash
 realtimex-pp-cli --version
 ```
 
-If it is missing or does not report `realtimex-pp-cli 2.0.35`, install the pinned version:
+If it is missing or does not report `realtimex-pp-cli 2.0.37`, install the pinned version:
 
 ```bash
-npm install -g @realtimex/pp-cli@2.0.35
+npm install -g @realtimex/pp-cli@2.0.37
 ```
 
 For requests about the current workspace or thread, resolve context first:

package/skills/realtimex-automation-flows/SKILL.md

@@ -15,16 +15,16 @@ Run RealTimeX automation workflows and guided automation-flow commands, includin
 
 ## CLI setup
 
-This skill uses `realtimex-pp-cli` version 2.0.35. Before using its commands:
+This skill uses `realtimex-pp-cli` version 2.0.37. Before using its commands:
 
 ```bash
 realtimex-pp-cli --version
 ```
 
-If it is missing or does not report `realtimex-pp-cli 2.0.35`, install the pinned version:
+If it is missing or does not report `realtimex-pp-cli 2.0.37`, install the pinned version:
 
 ```bash
-npm install -g @realtimex/pp-cli@2.0.35
+npm install -g @realtimex/pp-cli@2.0.37
 ```
 
 For requests about the current workspace or thread, resolve context first:
@@ -39,6 +39,10 @@ realtimex-pp-cli prepare --agent
 
 - `realtimex-pp-cli archive-active-thread-spa` — Verify archive and global-search thread navigation stay in one Electron renderer without eager TTS workers or runaway
 
+**chat-rich-content-containment** — Manage chat rich content containment
+
+- `realtimex-pp-cli chat-rich-content-containment` — Measure chat rich-content containment in the owned Electron renderer.
+
 **chat-with-terminal-agent** — Manage chat with terminal agent
 
 - `realtimex-pp-cli chat-with-terminal-agent` — Guide a user through sending a chat message to the terminal agent.
@@ -47,9 +51,9 @@ realtimex-pp-cli prepare --agent
 
 - `realtimex-pp-cli companion-host-capability-rename` — Verify Companion host-capability rename preview, navigation cancellation, confirmation, and terminal-session isolation.
 
-**delegate-rules-authoring** — Manage delegate rules authoring
+**delegate-human-task-fixture** — Manage delegate human task fixture
 
-- `realtimex-pp-cli delegate-rules-authoring` — Verify Delegate natural-language authoring, compilation states, simulation, activation CAS, and immutable history.
+- `realtimex-pp-cli delegate-human-task-fixture` — Create and deliver a valid synthetic Delegate Human-authorization task in an isolated development runtime.
 
 **dogfood-companion-scout** — Manage dogfood companion scout
 
@@ -83,6 +87,10 @@ realtimex-pp-cli prepare --agent
 
 - `realtimex-pp-cli setup-working-dir` — Add or edit an agent working directory from the desktop settings UI.
 
+**workspace-avatar-acceptance** — Manage workspace avatar acceptance
+
+- `realtimex-pp-cli workspace-avatar-acceptance` — Exercise deterministic Bloub approval, failed-turn, and persisted-history acceptance fixtures.
+
 **workspace-shell-layout** — Manage workspace shell layout
 
 - `realtimex-pp-cli workspace-shell-layout` — Verify workspace navigation, title-bar containment, Files dock behavior

package/skills/realtimex-browser-sessions/SKILL.md

@@ -15,16 +15,16 @@ List, create, start, stop, and delete isolated RealTimeX browser sessions. Use f
 
 ## CLI setup
 
-This skill uses `realtimex-pp-cli` version 2.0.35. Before using its commands:
+This skill uses `realtimex-pp-cli` version 2.0.37. Before using its commands:
 
 ```bash
 realtimex-pp-cli --version
 ```
 
-If it is missing or does not report `realtimex-pp-cli 2.0.35`, install the pinned version:
+If it is missing or does not report `realtimex-pp-cli 2.0.37`, install the pinned version:
 
 ```bash
-npm install -g @realtimex/pp-cli@2.0.35
+npm install -g @realtimex/pp-cli@2.0.37
 ```
 
 For requests about the current workspace or thread, resolve context first:

package/skills/realtimex-channels/SKILL.md

@@ -15,16 +15,16 @@ Create, configure, start, stop, and delete RealTimeX chat channels, approve pair
 
 ## CLI setup
 
-This skill uses `realtimex-pp-cli` version 2.0.35. Before using its commands:
+This skill uses `realtimex-pp-cli` version 2.0.37. Before using its commands:
 
 ```bash
 realtimex-pp-cli --version
 ```
 
-If it is missing or does not report `realtimex-pp-cli 2.0.35`, install the pinned version:
+If it is missing or does not report `realtimex-pp-cli 2.0.37`, install the pinned version:
 
 ```bash
-npm install -g @realtimex/pp-cli@2.0.35
+npm install -g @realtimex/pp-cli@2.0.37
 ```
 
 For requests about the current workspace or thread, resolve context first:

package/skills/realtimex-delegates/SKILL.md

@@ -15,16 +15,16 @@ Manage RealTimeX Delegate scope bindings, policy drafts and compiler jobs, activ
 
 ## CLI setup
 
-This skill uses `realtimex-pp-cli` version 2.0.35. Before using its commands:
+This skill uses `realtimex-pp-cli` version 2.0.37. Before using its commands:
 
 ```bash
 realtimex-pp-cli --version
 ```
 
-If it is missing or does not report `realtimex-pp-cli 2.0.35`, install the pinned version:
+If it is missing or does not report `realtimex-pp-cli 2.0.37`, install the pinned version:
 
 ```bash
-npm install -g @realtimex/pp-cli@2.0.35
+npm install -g @realtimex/pp-cli@2.0.37
 ```
 
 For requests about the current workspace or thread, resolve context first:
@@ -35,89 +35,17 @@ realtimex-pp-cli prepare --agent
 
 ## Command reference
 
-**activate-delegate-policy** — Manage activate delegate policy
+**get-delegate-mandate** — Manage get delegate mandate
 
-- `realtimex-pp-cli activate-delegate-policy <instanceId>` — Activate a compiled candidate with exact optimistic revisions and explicit instance confirmation.
+- `realtimex-pp-cli get-delegate-mandate` — Get delegate mandate
 
-**cancel-delegate-compiler-job** — Manage cancel delegate compiler job
+**propose-delegate-mandate** — Manage propose delegate mandate
 
-- `realtimex-pp-cli cancel-delegate-compiler-job <instanceId> <jobId>` — Cancel delegate compiler job
-
-**compile-delegate-policy** — Manage compile delegate policy
-
-- `realtimex-pp-cli compile-delegate-policy <instanceId> <revision>` — Start a strictly idempotent compilation for one immutable draft revision.
-
-**get-delegate** — Manage get delegate
-
-- `realtimex-pp-cli get-delegate <instanceId>` — Inspect one owned Delegate, including safe health, policy, runtime, recent decision, and execution state.
-
-**get-delegate-compiler-job** — Manage get delegate compiler job
-
-- `realtimex-pp-cli get-delegate-compiler-job <instanceId> <jobId>` — Get delegate compiler job
-
-**get-delegate-decision** — Manage get delegate decision
-
-- `realtimex-pp-cli get-delegate-decision <instanceId> <decisionId>` — Get delegate decision
-
-**get-delegate-execution** — Manage get delegate execution
-
-- `realtimex-pp-cli get-delegate-execution <instanceId> <executionId>` — Get delegate execution
-
-**get-delegate-policy-candidate** — Manage get delegate policy candidate
-
-- `realtimex-pp-cli get-delegate-policy-candidate <instanceId>` — Get delegate policy candidate
-
-**get-delegate-policy-draft** — Manage get delegate policy draft
-
-- `realtimex-pp-cli get-delegate-policy-draft <instanceId>` — Get delegate policy draft
-
-**get-delegate-policy-version** — Manage get delegate policy version
-
-- `realtimex-pp-cli get-delegate-policy-version <instanceId> <version>` — Get delegate policy version
-
-**list-delegate-compiler-jobs** — Manage list delegate compiler jobs
-
-- `realtimex-pp-cli list-delegate-compiler-jobs <instanceId>` — List delegate compiler jobs
-
-**list-delegate-executions** — Manage list delegate executions
-
-- `realtimex-pp-cli list-delegate-executions <instanceId>` — List a stable page of safe execution summaries.
-
-**list-delegate-policy-versions** — Manage list delegate policy versions
-
-- `realtimex-pp-cli list-delegate-policy-versions <instanceId>` — List delegate policy versions
-
-**provision-delegate** — Manage provision delegate
-
-- `realtimex-pp-cli provision-delegate` — Provision and bind the authenticated user as the Delegate for an explicit scope.
+- `realtimex-pp-cli propose-delegate-mandate <authorityId>` — Propose delegate mandate
 
 **resolve-delegate** — Manage resolve delegate
 
-- `realtimex-pp-cli resolve-delegate` — Resolve the authenticated user Delegate for an explicit supported consumer scope without provisioning it.
-
-**resume-delegate** — Manage resume delegate
-
-- `realtimex-pp-cli resume-delegate <instanceId>` — Resume delegate
-
-**retry-delegate-compiler-job** — Manage retry delegate compiler job
-
-- `realtimex-pp-cli retry-delegate-compiler-job <instanceId> <jobId>` — Create or return the one durable direct retry of an eligible terminal compiler job.
-
-**revoke-delegate-outstanding** — Manage revoke delegate outstanding
-
-- `realtimex-pp-cli revoke-delegate-outstanding <instanceId>` — Revoke delegate outstanding
-
-**save-delegate-policy-draft** — Manage save delegate policy draft
-
-- `realtimex-pp-cli save-delegate-policy-draft <instanceId>` — Save a policy draft with an explicit optimistic revision. Use expectedRevision zero for the first save.
-
-**simulate-delegate-policy** — Manage simulate delegate policy
-
-- `realtimex-pp-cli simulate-delegate-policy <instanceId>` — Simulate delegate policy
-
-**suspend-delegate** — Manage suspend delegate
-
-- `realtimex-pp-cli suspend-delegate <instanceId>` — Suspend delegate
+- `realtimex-pp-cli resolve-delegate` — Resolve delegate
 
 ## Domain rules
 

package/skills/realtimex-heartbeat/SKILL.md

@@ -15,16 +15,16 @@ Configure RealTimeX heartbeat scheduling, agents, active hours, timezone, autopi
 
 ## CLI setup
 
-This skill uses `realtimex-pp-cli` version 2.0.35. Before using its commands:
+This skill uses `realtimex-pp-cli` version 2.0.37. Before using its commands:
 
 ```bash
 realtimex-pp-cli --version
 ```
 
-If it is missing or does not report `realtimex-pp-cli 2.0.35`, install the pinned version:
+If it is missing or does not report `realtimex-pp-cli 2.0.37`, install the pinned version:
 
 ```bash
-npm install -g @realtimex/pp-cli@2.0.35
+npm install -g @realtimex/pp-cli@2.0.37
 ```
 
 For requests about the current workspace or thread, resolve context first:

package/skills/realtimex-local-apps/SKILL.md

@@ -15,16 +15,16 @@ Create, inspect, configure, start, stop, restart, and delete RealTimeX Local App
 
 ## CLI setup
 
-This skill uses `realtimex-pp-cli` version 2.0.35. Before using its commands:
+This skill uses `realtimex-pp-cli` version 2.0.37. Before using its commands:
 
 ```bash
 realtimex-pp-cli --version
 ```
 
-If it is missing or does not report `realtimex-pp-cli 2.0.35`, install the pinned version:
+If it is missing or does not report `realtimex-pp-cli 2.0.37`, install the pinned version:
 
 ```bash
-npm install -g @realtimex/pp-cli@2.0.35
+npm install -g @realtimex/pp-cli@2.0.37
 ```
 
 For requests about the current workspace or thread, resolve context first:

package/skills/realtimex-moderator-sdk/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: realtimex-moderator-sdk
-description: "Route RealTimeX API work to the focused workspace, terminal-agent, browser-session, local-app, heartbeat, automation-flow, artifact, channel, webhook, Delegate-authority, or plugin-and-skill capability. Use when a request spans capabilities or the correct RealTimeX skill is unclear."
+description: "Route RealTimeX API work to the focused workspace, terminal-agent, browser-session, local-app, heartbeat, automation-flow, artifact, channel, webhook, secret-management, Delegate-authority, or plugin-and-skill capability. Use when a request spans capabilities or the correct RealTimeX skill is unclear."
 allowed-tools: "Read Bash"
 metadata:
   openclaw:
@@ -15,16 +15,16 @@ Use this router to select the smallest RealTimeX skill that owns the requested o
 
 ## CLI setup
 
-This skill uses `realtimex-pp-cli` version 2.0.35. Before using its commands:
+This skill uses `realtimex-pp-cli` version 2.0.37. Before using its commands:
 
 ```bash
 realtimex-pp-cli --version
 ```
 
-If it is missing or does not report `realtimex-pp-cli 2.0.35`, install the pinned version:
+If it is missing or does not report `realtimex-pp-cli 2.0.37`, install the pinned version:
 
 ```bash
-npm install -g @realtimex/pp-cli@2.0.35
+npm install -g @realtimex/pp-cli@2.0.37
 ```
 
 For requests about the current workspace or thread, resolve context first:
@@ -37,6 +37,7 @@ realtimex-pp-cli prepare --agent
 
 | Skill | Use for |
 | --- | --- |
+| `realtimex-secrets` | Manage encrypted named secrets and workspace scope with the moderator CLI. Use saved secrets in terminal commands through rtxexec without handling raw values. |
 | `realtimex-workspaces` | Manage RealTimeX workspaces, threads, messages, workspace personality, LLM configuration, and default agents. Use for workspace and conversation operations. |
 | `realtimex-terminal-agents` | Manage RealTimeX terminal agents, terminal sessions, session messages, and idle prompts. Use for desktop terminal-agent runtime and terminal-session lifecycle work. |
 | `realtimex-browser-sessions` | List, create, start, stop, and delete isolated RealTimeX browser sessions. Use for named browser runtime and profile lifecycle work. |

package/skills/realtimex-plugin-and-skill/SKILL.md

@@ -15,16 +15,16 @@ Manage RealTimeX plugins and agent skills, including configuration, enablement,
 
 ## CLI setup
 
-This skill uses `realtimex-pp-cli` version 2.0.35. Before using its commands:
+This skill uses `realtimex-pp-cli` version 2.0.37. Before using its commands:
 
 ```bash
 realtimex-pp-cli --version
 ```
 
-If it is missing or does not report `realtimex-pp-cli 2.0.35`, install the pinned version:
+If it is missing or does not report `realtimex-pp-cli 2.0.37`, install the pinned version:
 
 ```bash
-npm install -g @realtimex/pp-cli@2.0.35
+npm install -g @realtimex/pp-cli@2.0.37
 ```
 
 For requests about the current workspace or thread, resolve context first:

package/skills/realtimex-secrets/SKILL.md

@@ -0,0 +1,88 @@
+---
+name: realtimex-secrets
+description: "Manage encrypted named secrets and workspace scope with the moderator CLI. Use saved secrets in terminal commands through rtxexec without handling raw values."
+allowed-tools: "Read Bash"
+metadata:
+  openclaw:
+    requires:
+      bins:
+        - realtimex-pp-cli
+---
+
+# RealTimeX Secrets
+
+Manage encrypted named secrets and workspace scope with the moderator CLI. Use saved secrets in terminal commands through rtxexec without handling raw values.
+
+## CLI setup
+
+This skill uses `realtimex-pp-cli` version 2.0.37. Before using its commands:
+
+```bash
+realtimex-pp-cli --version
+```
+
+If it is missing or does not report `realtimex-pp-cli 2.0.37`, install the pinned version:
+
+```bash
+npm install -g @realtimex/pp-cli@2.0.37
+```
+
+For requests about the current workspace or thread, resolve context first:
+
+```bash
+realtimex-pp-cli prepare --agent
+```
+
+## Command reference
+
+**create-secret** — Manage create secret
+
+- `realtimex-pp-cli create-secret` — Create secret
+
+Read a scalar value with `--value-stdin` (trusted raw stdin, never a shell literal). Secret-bearing stdin cannot be used with `--dry-run`. Use `--all-workspaces` to restore unrestricted scope, or `--workspace-slugs` for a comma-separated list.
+
+**delete-secret** — Manage delete secret
+
+- `realtimex-pp-cli delete-secret <id>` — Delete secret
+
+**get-secret** — Manage get secret
+
+- `realtimex-pp-cli get-secret <id>` — Get secret
+
+**list-secret-usage** — Manage list secret usage
+
+- `realtimex-pp-cli list-secret-usage <id>` — List secret usage
+
+**list-secrets** — Manage list secrets
+
+- `realtimex-pp-cli list-secrets` — List secrets
+
+**update-secret** — Manage update secret
+
+- `realtimex-pp-cli update-secret <id>` — Update secret
+
+Read a scalar value with `--value-stdin` (trusted raw stdin, never a shell literal). Secret-bearing stdin cannot be used with `--dry-run`. Use `--all-workspaces` to restore unrestricted scope, or `--workspace-slugs` for a comma-separated list. Omit `--value-stdin` to retain the saved value.
+
+## Domain rules
+
+- Use realtimex-pp-cli for secret management only. List/get responses contain metadata and references, never values.
+- Prefer the Secrets settings screen for entering or rotating values. Never put a raw secret in a command argument, shell history, chat, or a temporary file.
+- Secrets default to all workspaces. Set workspaceSlugs to an explicit list to restrict execution; an empty list permits no workspace. Management remains app-wide in this single-user app.
+- Use rtxexec only for execution. Install @realtimex/rtxexec@0.2.0 if unavailable. It uses REALTIMEX_TERMINAL_SESSION_TOKEN and the app-provided local server URL; workspace scope comes from the authenticated session.
+- Login credentials contain encrypted username/password plus loginUrl and allowedOrigins. Prefer Settings for entry. For CLI management use --kind login --login-url <url> --login-stdin with a trusted stdin source containing a JSON object with username/password; never construct that JSON from raw values in an agent command. On update omit either field to retain it.
+- For browser login on Node.js 22+, use agent-browser to prepare the page, then rtxexec browser-tabs --cdp <port>. Pass its exact CDP target ID (not agent-browser t1 aliases) to rtxexec browser-login secret://name --cdp <port> --tab <id> --username-selector <css> --password-selector <css> --submit-selector <css>. Selectors must each match one visible top-level control. No navigation or second vault is created. Iframe forms are not supported.
+- For multi-step login, supply only the current username or password selector; omit submit to fill only. Filled/submitted is not proof of authentication: check a non-secret success state. Let the user complete MFA/CAPTCHA as needed. Do not snapshot, screenshot, record or read field values while credentials are present. Pages may display the username after login.
+- Do not use agent-browser credential-provider flags on 0.27.0: that version silently ignores them. Use the rtxexec adapter instead. Origin denial requires correcting the saved website policy through normal management, never bypassing it.
+- Prefer environment or stdin injection: rtxexec --env API_TOKEN=secret://my-token -- program; rtxexec --stdin secret://my-password -- program.
+- For tools requiring arguments: rtxexec --secret token=secret://my-token -- curl -H "Authorization: Bearer {{token}}" https://api.example.com. Expanded arguments may be visible to local processes.
+- Do not request raw values, inspect the vault database or encryption keys, call the resolution endpoint directly, or run printenv/echo to inspect injected values. Use references and non-secret success checks.
+- rtxexec launches the command directly without a shell. Do not use secret placeholders inside sh -c, bash -c, cmd /c, PowerShell command strings, or other evaluated code.
+- Output masking is best effort for known values, not protection against arbitrary encoding, child-created files, or an agent deliberately reading secrets. Programs requiring an interactive TTY or Windows batch scripts need another supported invocation.
+- Usage records mean values were resolved for an executable, not that the command completed successfully. Disabled, deleted, or out-of-scope secrets fail before execution.
+
+## Shared constraints
+
+- Run documented commands with `--agent`.
+- Use exact identifiers returned by `prepare` or the relevant list/get command; do not guess values.
+- Do not bypass the CLI with raw HTTP calls. If a required operation is absent, report that limitation.
+- Ask one concise clarification when required target context is missing or ambiguous.

package/skills/realtimex-terminal-agents/SKILL.md

@@ -15,16 +15,16 @@ Manage RealTimeX terminal agents, terminal sessions, session messages, and idle
 
 ## CLI setup
 
-This skill uses `realtimex-pp-cli` version 2.0.35. Before using its commands:
+This skill uses `realtimex-pp-cli` version 2.0.37. Before using its commands:
 
 ```bash
 realtimex-pp-cli --version
 ```
 
-If it is missing or does not report `realtimex-pp-cli 2.0.35`, install the pinned version:
+If it is missing or does not report `realtimex-pp-cli 2.0.37`, install the pinned version:
 
 ```bash
-npm install -g @realtimex/pp-cli@2.0.35
+npm install -g @realtimex/pp-cli@2.0.37
 ```
 
 For requests about the current workspace or thread, resolve context first:

package/skills/realtimex-webhooks/SKILL.md

@@ -15,16 +15,16 @@ Create, inspect, update, test, and delete RealTimeX public webhook endpoints and
 
 ## CLI setup
 
-This skill uses `realtimex-pp-cli` version 2.0.35. Before using its commands:
+This skill uses `realtimex-pp-cli` version 2.0.37. Before using its commands:
 
 ```bash
 realtimex-pp-cli --version
 ```
 
-If it is missing or does not report `realtimex-pp-cli 2.0.35`, install the pinned version:
+If it is missing or does not report `realtimex-pp-cli 2.0.37`, install the pinned version:
 
 ```bash
-npm install -g @realtimex/pp-cli@2.0.35
+npm install -g @realtimex/pp-cli@2.0.37
 ```
 
 For requests about the current workspace or thread, resolve context first:

package/skills/realtimex-workspaces/SKILL.md

@@ -15,16 +15,16 @@ Manage RealTimeX workspaces, threads, messages, workspace personality, LLM confi
 
 ## CLI setup
 
-This skill uses `realtimex-pp-cli` version 2.0.35. Before using its commands:
+This skill uses `realtimex-pp-cli` version 2.0.37. Before using its commands:
 
 ```bash
 realtimex-pp-cli --version
 ```
 
-If it is missing or does not report `realtimex-pp-cli 2.0.35`, install the pinned version:
+If it is missing or does not report `realtimex-pp-cli 2.0.37`, install the pinned version:
 
 ```bash
-npm install -g @realtimex/pp-cli@2.0.35
+npm install -g @realtimex/pp-cli@2.0.37
 ```
 
 For requests about the current workspace or thread, resolve context first: