@realtimex/sdk 2.0.36 → 2.0.38

package/index.d.ts

@@ -243,8 +243,27 @@ export type CreateSecretParams = Record<string, never>;
 export type CreateSecretQuery = Record<string, never>;
 export type CreateSecretHeaders = Record<string, never>;
 export type CreateSecretBody = {
+  ssoCredentialIds?: Array<string>;
+  moveValueTo?: "password" | "apiToken";
+  displayName?: string;
+  fields?: {
+  [key: string]: string | null;
+};
+  notes?: string;
+  tags?: Array<string>;
+  websites?: Array<string>;
+  customFields?: Array<{
   name: string;
-  value: string;
+  label: string;
+  type: "text" | "hidden";
+}>;
+  name?: string;
+  value?: string;
+  kind?: "login" | "card" | "identity" | "note" | "ssh_key" | "secret";
+  username?: string;
+  password?: string;
+  loginUrl?: string;
+  allowedOrigins?: Array<string>;
   description?: string;
   enabled?: boolean;
   workspaceSlugs?: Array<string> | null;
@@ -347,6 +366,25 @@ export interface CreateWorkspaceAgentSkillOptions extends RealtimeXRequestOption
   body?: CreateWorkspaceAgentSkillBody;
 }
 
+export type DelegateHumanTaskFixtureParams = Record<string, never>;
+export type DelegateHumanTaskFixtureQuery = Record<string, never>;
+export type DelegateHumanTaskFixtureHeaders = Record<string, never>;
+export type DelegateHumanTaskFixtureBody = {
+  workspaceSlug?: string;
+  threadSlug?: string;
+  storageUser?: string;
+  artifactPath?: string;
+  timeoutMs?: number;
+  confirmDestructive?: boolean;
+};
+export type DelegateHumanTaskFixtureResponse = Record<string, unknown>;
+export interface DelegateHumanTaskFixtureOptions extends RealtimeXRequestOptions {
+  params?: DelegateHumanTaskFixtureParams;
+  query?: DelegateHumanTaskFixtureQuery;
+  headers?: DelegateHumanTaskFixtureHeaders & Record<string, string>;
+  body?: DelegateHumanTaskFixtureBody;
+}
+
 export type DeleteBrowserSessionParams = {
   sessionName: string;
 };
@@ -1103,6 +1141,34 @@ export interface PauseArtifactOptions extends RealtimeXRequestOptions {
   body?: PauseArtifactBody;
 }
 
+export type PostCliDelegateConsultationsConsultationIdReplyParams = {
+  consultationId: string;
+};
+export type PostCliDelegateConsultationsConsultationIdReplyQuery = Record<string, never>;
+export type PostCliDelegateConsultationsConsultationIdReplyHeaders = Record<string, never>;
+export type PostCliDelegateConsultationsConsultationIdReplyBody = unknown;
+export type PostCliDelegateConsultationsConsultationIdReplyResponse = Record<string, unknown>;
+export interface PostCliDelegateConsultationsConsultationIdReplyOptions extends RealtimeXRequestOptions {
+  params?: PostCliDelegateConsultationsConsultationIdReplyParams;
+  query?: PostCliDelegateConsultationsConsultationIdReplyQuery;
+  headers?: PostCliDelegateConsultationsConsultationIdReplyHeaders & Record<string, string>;
+  body?: PostCliDelegateConsultationsConsultationIdReplyBody;
+}
+
+export type PostCliDelegateRunsRunIdConsultationsParams = {
+  runId: string;
+};
+export type PostCliDelegateRunsRunIdConsultationsQuery = Record<string, never>;
+export type PostCliDelegateRunsRunIdConsultationsHeaders = Record<string, never>;
+export type PostCliDelegateRunsRunIdConsultationsBody = unknown;
+export type PostCliDelegateRunsRunIdConsultationsResponse = Record<string, unknown>;
+export interface PostCliDelegateRunsRunIdConsultationsOptions extends RealtimeXRequestOptions {
+  params?: PostCliDelegateRunsRunIdConsultationsParams;
+  query?: PostCliDelegateRunsRunIdConsultationsQuery;
+  headers?: PostCliDelegateRunsRunIdConsultationsHeaders & Record<string, string>;
+  body?: PostCliDelegateRunsRunIdConsultationsBody;
+}
+
 export type PostCliDelegateRunsRunIdDecisionParams = {
   runId: string;
 };
@@ -1320,6 +1386,20 @@ export interface ResolveDelegateOptions extends RealtimeXRequestOptions {
   body?: ResolveDelegateBody;
 }
 
+export type ResolveWorkingDirectoryParams = {
+  id: number;
+};
+export type ResolveWorkingDirectoryQuery = Record<string, never>;
+export type ResolveWorkingDirectoryHeaders = Record<string, never>;
+export type ResolveWorkingDirectoryBody = unknown;
+export type ResolveWorkingDirectoryResponse = unknown;
+export interface ResolveWorkingDirectoryOptions extends RealtimeXRequestOptions {
+  params?: ResolveWorkingDirectoryParams;
+  query?: ResolveWorkingDirectoryQuery;
+  headers?: ResolveWorkingDirectoryHeaders & Record<string, string>;
+  body?: ResolveWorkingDirectoryBody;
+}
+
 export type RespondTerminalIdlePromptParams = {
   sessionId: string;
 };
@@ -1495,15 +1575,6 @@ export type SendMessageHeaders = {
 };
 export type SendMessageBody = {
   message: string;
-  externalSource?: {
-  type: string;
-  origin: string;
-  name?: string;
-  participantName?: string;
-  fromRole?: string;
-  toRole?: string;
-  loopId?: string;
-};
   attachments?: Array<Record<string, unknown>>;
   webSearchEnabled?: boolean;
   broadcastThreadEvents?: boolean;
@@ -1530,15 +1601,6 @@ export type SendTerminalSessionMessageHeaders = {
 };
 export type SendTerminalSessionMessageBody = {
   message: string;
-  externalSource?: {
-  type: string;
-  origin: string;
-  name?: string;
-  participantName?: string;
-  fromRole?: string;
-  toRole?: string;
-  loopId?: string;
-};
   attachments?: Array<Record<string, unknown>>;
   webSearchEnabled?: boolean;
   broadcastThreadEvents?: boolean;
@@ -2048,8 +2110,27 @@ export type UpdateSecretParams = {
 export type UpdateSecretQuery = Record<string, never>;
 export type UpdateSecretHeaders = Record<string, never>;
 export type UpdateSecretBody = {
+  ssoCredentialIds?: Array<string>;
+  moveValueTo?: "password" | "apiToken";
+  displayName?: string;
+  fields?: {
+  [key: string]: string | null;
+};
+  notes?: string;
+  tags?: Array<string>;
+  websites?: Array<string>;
+  customFields?: Array<{
+  name: string;
+  label: string;
+  type: "text" | "hidden";
+}>;
   name?: string;
   value?: string;
+  kind?: "login" | "card" | "identity" | "note" | "ssh_key" | "secret";
+  username?: string;
+  password?: string;
+  loginUrl?: string;
+  allowedOrigins?: Array<string>;
   description?: string;
   enabled?: boolean;
   workspaceSlugs?: Array<string> | null;
@@ -2263,6 +2344,9 @@ export declare class RealtimeXClient {
   /** Create a managed agent skill owned by one workspace. Terminal agents should use this instead of writing final skill content into runtime skill directories. */
   createWorkspaceAgentSkill(options?: CreateWorkspaceAgentSkillOptions): Promise<CreateWorkspaceAgentSkillResponse>;
   createWorkspaceAgentSkill(workspaceSlug: string, body: CreateWorkspaceAgentSkillBody, options?: Omit<CreateWorkspaceAgentSkillOptions, 'params' | 'body'>): Promise<CreateWorkspaceAgentSkillResponse>;
+  /** Create and deliver a valid synthetic Delegate Human-authorization task in an isolated development runtime. */
+  delegateHumanTaskFixture(options?: DelegateHumanTaskFixtureOptions): Promise<DelegateHumanTaskFixtureResponse>;
+  delegateHumanTaskFixture(body: DelegateHumanTaskFixtureBody, options?: Omit<DelegateHumanTaskFixtureOptions, 'body'>): Promise<DelegateHumanTaskFixtureResponse>;
   /** Delete a stopped named RealTimeX Browser session and its isolated profile. */
   deleteBrowserSession(options?: DeleteBrowserSessionOptions): Promise<DeleteBrowserSessionResponse>;
   deleteBrowserSession(sessionName: string, options?: Omit<DeleteBrowserSessionOptions, 'params'>): Promise<DeleteBrowserSessionResponse>;
@@ -2385,6 +2469,10 @@ export declare class RealtimeXClient {
   /** Pause one published artifact by artifact id. Paused artifacts remain listed but stop serving publicly. */
   pauseArtifact(options?: PauseArtifactOptions): Promise<PauseArtifactResponse>;
   pauseArtifact(artifactId: string, options?: Omit<PauseArtifactOptions, 'params'>): Promise<PauseArtifactResponse>;
+  postCliDelegateConsultationsConsultationIdReply(options?: PostCliDelegateConsultationsConsultationIdReplyOptions): Promise<PostCliDelegateConsultationsConsultationIdReplyResponse>;
+  postCliDelegateConsultationsConsultationIdReply(consultationId: string, options?: Omit<PostCliDelegateConsultationsConsultationIdReplyOptions, 'params'>): Promise<PostCliDelegateConsultationsConsultationIdReplyResponse>;
+  postCliDelegateRunsRunIdConsultations(options?: PostCliDelegateRunsRunIdConsultationsOptions): Promise<PostCliDelegateRunsRunIdConsultationsResponse>;
+  postCliDelegateRunsRunIdConsultations(runId: string, options?: Omit<PostCliDelegateRunsRunIdConsultationsOptions, 'params'>): Promise<PostCliDelegateRunsRunIdConsultationsResponse>;
   postCliDelegateRunsRunIdDecision(options?: PostCliDelegateRunsRunIdDecisionOptions): Promise<PostCliDelegateRunsRunIdDecisionResponse>;
   postCliDelegateRunsRunIdDecision(runId: string, options?: Omit<PostCliDelegateRunsRunIdDecisionOptions, 'params'>): Promise<PostCliDelegateRunsRunIdDecisionResponse>;
   postCliDelegateRunsRunIdEvidence(options?: PostCliDelegateRunsRunIdEvidenceOptions): Promise<PostCliDelegateRunsRunIdEvidenceResponse>;
@@ -2414,6 +2502,9 @@ export declare class RealtimeXClient {
   renameWorkspace(workspaceSlug: string, body: RenameWorkspaceBody, options?: Omit<RenameWorkspaceOptions, 'params' | 'body'>): Promise<RenameWorkspaceResponse>;
   resolveDelegate(options?: ResolveDelegateOptions): Promise<ResolveDelegateResponse>;
   resolveDelegate(query?: ResolveDelegateQuery, options?: Omit<ResolveDelegateOptions, 'query'>): Promise<ResolveDelegateResponse>;
+  /** Resolve a working directory mentioned in the current message to its local path. Pass the numeric ID from the message facts. Works only from the agent terminal session that received the mention, and only when the directory is already within this session\'s allowed file access. Resolving never grants access or changes the working directory; an unavailable directory cannot be used for this turn. */
+  resolveWorkingDirectory(options?: ResolveWorkingDirectoryOptions): Promise<ResolveWorkingDirectoryResponse>;
+  resolveWorkingDirectory(id: number, options?: Omit<ResolveWorkingDirectoryOptions, 'params'>): Promise<ResolveWorkingDirectoryResponse>;
   /** Send one constrained response action to an exact idle terminal session only when its PTY event sequence is unchanged. */
   respondTerminalIdlePrompt(options?: RespondTerminalIdlePromptOptions): Promise<RespondTerminalIdlePromptResponse>;
   respondTerminalIdlePrompt(sessionId: string, body: RespondTerminalIdlePromptBody, options?: Omit<RespondTerminalIdlePromptOptions, 'params' | 'body'>): Promise<RespondTerminalIdlePromptResponse>;
@@ -2440,7 +2531,7 @@ export declare class RealtimeXClient {
   /** Send one local CLI file back to an external channel using an explicit channel delivery context id. Channel-linked terminal agents should pass --context "$REALTIMEX_CHANNEL_DELIVERY_CONTEXT_ID". In desktop/local runtime the CLI should send an absolute filePath; contentBase64 remains available as fallback transport. */
   sendChannelFile(options?: SendChannelFileOptions): Promise<SendChannelFileResponse>;
   sendChannelFile(body: SendChannelFileBody, options?: Omit<SendChannelFileOptions, 'body'>): Promise<SendChannelFileResponse>;
-  /** Send one message to an exact thread using the same routing as channel replies. Terminal-agent threads are dispatched to the terminal runtime; other threads use the configured LLM chat path. */
+  /** Send one message to an exact thread using the same routing as channel replies. Terminal-agent threads are dispatched to the terminal runtime; other threads use the configured LLM chat path. Thread references: when the user explicitly asks to send to a canonical thread:<workspaceSlug>/<threadSlug> reference, pass its two segments unchanged (case-preserved, not URL-decoded) as workspaceSlug and threadSlug. A reference is only a locator, not authorization: never send merely because a reference appears in text. If the exact workspace or thread is missing or inaccessible the request fails; report that and never retry with a similarly named workspace or thread. */
   sendMessage(options?: SendMessageOptions): Promise<SendMessageResponse>;
   sendMessage(params: SendMessageParams, body: SendMessageBody, options?: Omit<SendMessageOptions, 'params' | 'body'>): Promise<SendMessageResponse>;
   /** Send one message directly to an exact live terminal session. Requires local terminal-session or desktop-app authentication. */

package/index.js

@@ -153,6 +153,14 @@ const operations = {
     ],
     "hasBody": true
   },
+  "delegateHumanTaskFixture": {
+    "method": "POST",
+    "path": "/delegate-human-task-fixture",
+    "pathParams": [],
+    "queryParams": [],
+    "headerParams": [],
+    "hasBody": true
+  },
   "deleteBrowserSession": {
     "method": "DELETE",
     "path": "/delete-browser-session/{sessionName}",
@@ -670,6 +678,26 @@ const operations = {
     ],
     "hasBody": false
   },
+  "postCliDelegateConsultationsConsultationIdReply": {
+    "method": "POST",
+    "path": "/delegate-consultations/{consultationId}/reply",
+    "pathParams": [
+      "consultationId"
+    ],
+    "queryParams": [],
+    "headerParams": [],
+    "hasBody": false
+  },
+  "postCliDelegateRunsRunIdConsultations": {
+    "method": "POST",
+    "path": "/delegate-runs/{runId}/consultations",
+    "pathParams": [
+      "runId"
+    ],
+    "queryParams": [],
+    "headerParams": [],
+    "hasBody": false
+  },
   "postCliDelegateRunsRunIdDecision": {
     "method": "POST",
     "path": "/delegate-runs/{runId}/decision",
@@ -796,6 +824,16 @@ const operations = {
     "headerParams": [],
     "hasBody": false
   },
+  "resolveWorkingDirectory": {
+    "method": "GET",
+    "path": "/resolve-working-directory/{id}",
+    "pathParams": [
+      "id"
+    ],
+    "queryParams": [],
+    "headerParams": [],
+    "hasBody": false
+  },
   "respondTerminalIdlePrompt": {
     "method": "POST",
     "path": "/respond-terminal-idle-prompt/{sessionId}",
@@ -1758,6 +1796,13 @@ class RealtimeXClient {
     );
   }
 
+  delegateHumanTaskFixture(...args) {
+    return this.request(
+      "delegateHumanTaskFixture",
+      normalizeOperationOptions(operations["delegateHumanTaskFixture"], args)
+    );
+  }
+
   deleteBrowserSession(...args) {
     return this.request(
       "deleteBrowserSession",
@@ -2087,6 +2132,20 @@ class RealtimeXClient {
     );
   }
 
+  postCliDelegateConsultationsConsultationIdReply(...args) {
+    return this.request(
+      "postCliDelegateConsultationsConsultationIdReply",
+      normalizeOperationOptions(operations["postCliDelegateConsultationsConsultationIdReply"], args)
+    );
+  }
+
+  postCliDelegateRunsRunIdConsultations(...args) {
+    return this.request(
+      "postCliDelegateRunsRunIdConsultations",
+      normalizeOperationOptions(operations["postCliDelegateRunsRunIdConsultations"], args)
+    );
+  }
+
   postCliDelegateRunsRunIdDecision(...args) {
     return this.request(
       "postCliDelegateRunsRunIdDecision",
@@ -2164,6 +2223,13 @@ class RealtimeXClient {
     );
   }
 
+  resolveWorkingDirectory(...args) {
+    return this.request(
+      "resolveWorkingDirectory",
+      normalizeOperationOptions(operations["resolveWorkingDirectory"], args)
+    );
+  }
+
   respondTerminalIdlePrompt(...args) {
     return this.request(
       "respondTerminalIdlePrompt",
@@ -2462,5 +2528,5 @@ module.exports = {
   createRealtimeXClient,
   createRealtimeXWebhookClient,
   operations,
-  version: "2.0.36",
+  version: "2.0.38",
 };

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@realtimex/sdk",
-    "version": "2.0.36",
+    "version": "2.0.38",
     "description": "RealtimeX runtime SDK package and moderator agent skill assets.",
     "private": false,
     "main": "./index.js",

package/skills/realtimex-artifacts/SKILL.md

@@ -15,16 +15,16 @@ List, publish, inspect, pause, resume, and revoke RealTimeX workspace artifacts.
 
 ## CLI setup
 
-This skill uses `realtimex-pp-cli` version 2.0.36. Before using its commands:
+This skill uses `realtimex-pp-cli` version 2.0.38. Before using its commands:
 
 ```bash
 realtimex-pp-cli --version
 ```
 
-If it is missing or does not report `realtimex-pp-cli 2.0.36`, install the pinned version:
+If it is missing or does not report `realtimex-pp-cli 2.0.38`, install the pinned version:
 
 ```bash
-npm install -g @realtimex/pp-cli@2.0.36
+npm install -g @realtimex/pp-cli@2.0.38
 ```
 
 For requests about the current workspace or thread, resolve context first:

package/skills/realtimex-automation-flows/SKILL.md

@@ -15,16 +15,16 @@ Run RealTimeX automation workflows and guided automation-flow commands, includin
 
 ## CLI setup
 
-This skill uses `realtimex-pp-cli` version 2.0.36. Before using its commands:
+This skill uses `realtimex-pp-cli` version 2.0.38. Before using its commands:
 
 ```bash
 realtimex-pp-cli --version
 ```
 
-If it is missing or does not report `realtimex-pp-cli 2.0.36`, install the pinned version:
+If it is missing or does not report `realtimex-pp-cli 2.0.38`, install the pinned version:
 
 ```bash
-npm install -g @realtimex/pp-cli@2.0.36
+npm install -g @realtimex/pp-cli@2.0.38
 ```
 
 For requests about the current workspace or thread, resolve context first:
@@ -51,6 +51,10 @@ realtimex-pp-cli prepare --agent
 
 - `realtimex-pp-cli companion-host-capability-rename` — Verify Companion host-capability rename preview, navigation cancellation, confirmation, and terminal-session isolation.
 
+**delegate-human-task-fixture** — Manage delegate human task fixture
+
+- `realtimex-pp-cli delegate-human-task-fixture` — Create and deliver a valid synthetic Delegate Human-authorization task in an isolated development runtime.
+
 **dogfood-companion-scout** — Manage dogfood companion scout
 
 - `realtimex-pp-cli dogfood-companion-scout` — Preview and confirm one governed Dogfood Scout capability, prove confirmation idempotency, PM delivery

package/skills/realtimex-browser-sessions/SKILL.md

@@ -15,16 +15,16 @@ List, create, start, stop, and delete isolated RealTimeX browser sessions. Use f
 
 ## CLI setup
 
-This skill uses `realtimex-pp-cli` version 2.0.36. Before using its commands:
+This skill uses `realtimex-pp-cli` version 2.0.38. Before using its commands:
 
 ```bash
 realtimex-pp-cli --version
 ```
 
-If it is missing or does not report `realtimex-pp-cli 2.0.36`, install the pinned version:
+If it is missing or does not report `realtimex-pp-cli 2.0.38`, install the pinned version:
 
 ```bash
-npm install -g @realtimex/pp-cli@2.0.36
+npm install -g @realtimex/pp-cli@2.0.38
 ```
 
 For requests about the current workspace or thread, resolve context first:

package/skills/realtimex-channels/SKILL.md

@@ -15,16 +15,16 @@ Create, configure, start, stop, and delete RealTimeX chat channels, approve pair
 
 ## CLI setup
 
-This skill uses `realtimex-pp-cli` version 2.0.36. Before using its commands:
+This skill uses `realtimex-pp-cli` version 2.0.38. Before using its commands:
 
 ```bash
 realtimex-pp-cli --version
 ```
 
-If it is missing or does not report `realtimex-pp-cli 2.0.36`, install the pinned version:
+If it is missing or does not report `realtimex-pp-cli 2.0.38`, install the pinned version:
 
 ```bash
-npm install -g @realtimex/pp-cli@2.0.36
+npm install -g @realtimex/pp-cli@2.0.38
 ```
 
 For requests about the current workspace or thread, resolve context first:

package/skills/realtimex-delegates/SKILL.md

@@ -15,16 +15,16 @@ Manage RealTimeX Delegate scope bindings, policy drafts and compiler jobs, activ
 
 ## CLI setup
 
-This skill uses `realtimex-pp-cli` version 2.0.36. Before using its commands:
+This skill uses `realtimex-pp-cli` version 2.0.38. Before using its commands:
 
 ```bash
 realtimex-pp-cli --version
 ```
 
-If it is missing or does not report `realtimex-pp-cli 2.0.36`, install the pinned version:
+If it is missing or does not report `realtimex-pp-cli 2.0.38`, install the pinned version:
 
 ```bash
-npm install -g @realtimex/pp-cli@2.0.36
+npm install -g @realtimex/pp-cli@2.0.38
 ```
 
 For requests about the current workspace or thread, resolve context first:

package/skills/realtimex-heartbeat/SKILL.md

@@ -15,16 +15,16 @@ Configure RealTimeX heartbeat scheduling, agents, active hours, timezone, autopi
 
 ## CLI setup
 
-This skill uses `realtimex-pp-cli` version 2.0.36. Before using its commands:
+This skill uses `realtimex-pp-cli` version 2.0.38. Before using its commands:
 
 ```bash
 realtimex-pp-cli --version
 ```
 
-If it is missing or does not report `realtimex-pp-cli 2.0.36`, install the pinned version:
+If it is missing or does not report `realtimex-pp-cli 2.0.38`, install the pinned version:
 
 ```bash
-npm install -g @realtimex/pp-cli@2.0.36
+npm install -g @realtimex/pp-cli@2.0.38
 ```
 
 For requests about the current workspace or thread, resolve context first:

package/skills/realtimex-local-apps/SKILL.md

@@ -15,16 +15,16 @@ Create, inspect, configure, start, stop, restart, and delete RealTimeX Local App
 
 ## CLI setup
 
-This skill uses `realtimex-pp-cli` version 2.0.36. Before using its commands:
+This skill uses `realtimex-pp-cli` version 2.0.38. Before using its commands:
 
 ```bash
 realtimex-pp-cli --version
 ```
 
-If it is missing or does not report `realtimex-pp-cli 2.0.36`, install the pinned version:
+If it is missing or does not report `realtimex-pp-cli 2.0.38`, install the pinned version:
 
 ```bash
-npm install -g @realtimex/pp-cli@2.0.36
+npm install -g @realtimex/pp-cli@2.0.38
 ```
 
 For requests about the current workspace or thread, resolve context first:

package/skills/realtimex-moderator-sdk/SKILL.md

@@ -15,16 +15,16 @@ Use this router to select the smallest RealTimeX skill that owns the requested o
 
 ## CLI setup
 
-This skill uses `realtimex-pp-cli` version 2.0.36. Before using its commands:
+This skill uses `realtimex-pp-cli` version 2.0.38. Before using its commands:
 
 ```bash
 realtimex-pp-cli --version
 ```
 
-If it is missing or does not report `realtimex-pp-cli 2.0.36`, install the pinned version:
+If it is missing or does not report `realtimex-pp-cli 2.0.38`, install the pinned version:
 
 ```bash
-npm install -g @realtimex/pp-cli@2.0.36
+npm install -g @realtimex/pp-cli@2.0.38
 ```
 
 For requests about the current workspace or thread, resolve context first:
@@ -37,7 +37,7 @@ realtimex-pp-cli prepare --agent
 
 | Skill | Use for |
 | --- | --- |
-| `realtimex-secrets` | Manage encrypted named secrets and workspace scope with the moderator CLI. Use saved secrets in terminal commands through rtxexec without handling raw values. |
+| `realtimex-secrets` | Manage encrypted Login, Card, Identity, SSH key and Secure note items, tags and workspace scope with the moderator CLI. Use saved fields in terminal commands or browser forms through rtxexec. |
 | `realtimex-workspaces` | Manage RealTimeX workspaces, threads, messages, workspace personality, LLM configuration, and default agents. Use for workspace and conversation operations. |
 | `realtimex-terminal-agents` | Manage RealTimeX terminal agents, terminal sessions, session messages, and idle prompts. Use for desktop terminal-agent runtime and terminal-session lifecycle work. |
 | `realtimex-browser-sessions` | List, create, start, stop, and delete isolated RealTimeX browser sessions. Use for named browser runtime and profile lifecycle work. |

package/skills/realtimex-plugin-and-skill/SKILL.md

@@ -15,16 +15,16 @@ Manage RealTimeX plugins and agent skills, including configuration, enablement,
 
 ## CLI setup
 
-This skill uses `realtimex-pp-cli` version 2.0.36. Before using its commands:
+This skill uses `realtimex-pp-cli` version 2.0.38. Before using its commands:
 
 ```bash
 realtimex-pp-cli --version
 ```
 
-If it is missing or does not report `realtimex-pp-cli 2.0.36`, install the pinned version:
+If it is missing or does not report `realtimex-pp-cli 2.0.38`, install the pinned version:
 
 ```bash
-npm install -g @realtimex/pp-cli@2.0.36
+npm install -g @realtimex/pp-cli@2.0.38
 ```
 
 For requests about the current workspace or thread, resolve context first:

package/skills/realtimex-secrets/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: realtimex-secrets
-description: "Manage encrypted named secrets and workspace scope with the moderator CLI. Use saved secrets in terminal commands through rtxexec without handling raw values."
+description: "Manage encrypted Login, Card, Identity, SSH key and Secure note items, tags and workspace scope with the moderator CLI. Use saved fields in terminal commands or browser forms through rtxexec."
 allowed-tools: "Read Bash"
 metadata:
   openclaw:
@@ -11,20 +11,20 @@ metadata:
 
 # RealTimeX Secrets
 
-Manage encrypted named secrets and workspace scope with the moderator CLI. Use saved secrets in terminal commands through rtxexec without handling raw values.
+Manage encrypted Login, Card, Identity, SSH key and Secure note items, tags and workspace scope with the moderator CLI. Use saved fields in terminal commands or browser forms through rtxexec.
 
 ## CLI setup
 
-This skill uses `realtimex-pp-cli` version 2.0.36. Before using its commands:
+This skill uses `realtimex-pp-cli` version 2.0.38. Before using its commands:
 
 ```bash
 realtimex-pp-cli --version
 ```
 
-If it is missing or does not report `realtimex-pp-cli 2.0.36`, install the pinned version:
+If it is missing or does not report `realtimex-pp-cli 2.0.38`, install the pinned version:
 
 ```bash
-npm install -g @realtimex/pp-cli@2.0.36
+npm install -g @realtimex/pp-cli@2.0.38
 ```
 
 For requests about the current workspace or thread, resolve context first:
@@ -39,7 +39,7 @@ realtimex-pp-cli prepare --agent
 
 - `realtimex-pp-cli create-secret` — Create secret
 
-Read a value with `--value-stdin` (raw stdin, not a shell literal). Use `--all-workspaces` to restore unrestricted scope, or `--workspace-slugs` for a comma-separated list. Omit `--value-stdin` on update to keep the saved value.
+Read a scalar value with `--value-stdin` (trusted raw stdin, never a shell literal). Secret-bearing stdin cannot be used with `--dry-run`. Use `--all-workspaces` to restore unrestricted scope, or `--workspace-slugs` for a comma-separated list.
 
 **delete-secret** — Manage delete secret
 
@@ -61,14 +61,24 @@ Read a value with `--value-stdin` (raw stdin, not a shell literal). Use `--all-w
 
 - `realtimex-pp-cli update-secret <id>` — Update secret
 
-Read a value with `--value-stdin` (raw stdin, not a shell literal). Use `--all-workspaces` to restore unrestricted scope, or `--workspace-slugs` for a comma-separated list. Omit `--value-stdin` on update to keep the saved value.
+Read a scalar value with `--value-stdin` (trusted raw stdin, never a shell literal). Secret-bearing stdin cannot be used with `--dry-run`. Use `--all-workspaces` to restore unrestricted scope, or `--workspace-slugs` for a comma-separated list. Omit `--value-stdin` to retain the saved value.
 
 ## Domain rules
 
 - Use realtimex-pp-cli for secret management only. List/get responses contain metadata and references, never values.
-- Prefer the Secrets settings screen for entering or rotating values. Never put a raw secret in a command argument, shell history, chat, or a temporary file.
+- Prefer the Secrets settings screen for entering or rotating values. Never put a raw secret in a command argument, shell history, chat, or an agent-created temporary file.
 - Secrets default to all workspaces. Set workspaceSlugs to an explicit list to restrict execution; an empty list permits no workspace. Management remains app-wide in this single-user app.
-- Use rtxexec only for execution. Install @realtimex/rtxexec@0.1.0 if unavailable. It uses REALTIMEX_TERMINAL_SESSION_TOKEN and the app-provided local server URL; workspace scope comes from the authenticated session.
+- Use rtxexec only for execution. Install @realtimex/rtxexec@0.3.0 if unavailable. It uses REALTIMEX_TERMINAL_SESSION_TOKEN and the app-provided local server URL; workspace scope comes from the authenticated session.
+- The item kinds are login, card, identity, ssh_key and note. Login also covers token-only entries: username, password, apiToken and websites are optional. Use the built-in apiToken field for an API key/token and custom fields for additional values. Tags replace folders. Names shown to people are displayName; name/reference remains stable.
+- Create/edit values in Settings when possible. For moderator management use --display-name and --kind with --item-stdin containing JSON {"fields":{"password":"..."},"notes":"..."} from a trusted source. Never construct raw-value JSON in an agent command. Custom field definitions use --custom-fields JSON containing name,label,type (text or hidden); their values belong in fields. Omitted fields retain their values; null or empty clears them. Omit notes to retain, use empty notes to clear. Removing a custom definition deletes its stored value.
+- Use --tags and --websites for comma-separated metadata. Empty --tags= or --websites= clears the list. Browser use requires the destination in allowedOrigins (derived from websites by default). Old --value-stdin and --login-stdin remain compatible; do not combine stdin modes, and never use secret stdin with --dry-run.
+- List/get shows fieldNames, custom field definitions, hasNotes and references without values. Select a field with secret://name#field, e.g. secret://service#apiToken. Existing unqualified scalar references keep working; Login defaults to password when present, otherwise apiToken; Secure note defaults to notes. Moving a generic value to Password or API key / Token in Settings preserves legacy unqualified and #value references, including future rotations. Cards, Identity and SSH fields should be selected explicitly.
+- For Card or Identity forms use rtxexec browser-fill secret://name --cdp <port> --tab <target-id> --field number=#card-number --field securityCode=#cvv (choose fields appropriate to the item). Repeat --field only for values needed by the current form. The command fills visible top-level inputs, textareas or selects and never submits. Do not snapshot/read/record filled values; check a non-secret status. A later purchase or form submission requires the user-authorized task scope.
+- For SSH/Git use rtxexec ssh secret://key -- ssh user@host or rtxexec ssh secret://key -- git fetch origin. Requires OpenSSH. rtxexec creates an owner-restricted temporary key and removes it when the child exits; do not inspect or copy that file. No persistent CLI vault is created. Abrupt machine shutdown or SIGKILL can prevent cleanup. Keep normal host-key checks enabled.
+- For browser login on Node.js 22+, use agent-browser to prepare the page, then rtxexec browser-tabs --cdp <port>. Pass its exact CDP target ID (not agent-browser t1 aliases) to rtxexec browser-login secret://name --cdp <port> --tab <id> --username-selector <css> --password-selector <css> --submit-selector <css>. Selectors must each match one visible top-level control. No navigation or second vault is created. Iframe forms are not supported.
+- A Login can offer normal credentials and multiple SSO providers together. ssoCredentialIds lists linked Login IDs; read their metadata with get-secret and match their displayName/description to the website provider buttons (Google, Facebook, X, company SSO). No per-provider instructions or preference is stored. If the match or account choice is ambiguous, ask the user. Navigate with agent-browser first; after reaching the selected provider website, run rtxexec browser-login secret://site --sso secret://provider --cdp <port> --tab <id> with the current selectors. Use the site reference plus --sso, not the provider reference alone, so both items are checked and audited. Without --sso, the site uses its own normal credentials. Already signed-in provider sessions may only need account selection; verify a non-secret success state. The selected provider must permit the actual page origin; do not broaden it to the relying site. Links never copy passwords or automatically follow other SSO links. Manage links with --sso-credential-ids id1,id2; --sso-credential-ids= removes the links without deleting normal fields.
+- For multi-step login, supply only the current username or password selector; omit submit to fill only. Filled/submitted is not proof of authentication: check a non-secret success state. Let the user complete MFA/CAPTCHA as needed. Do not snapshot, screenshot, record or read field values while credentials are present. Pages may display the username after login.
+- Do not use agent-browser credential-provider flags on 0.27.0: that version silently ignores them. Use the rtxexec adapter instead. Origin denial requires correcting the saved website policy through normal management, never bypassing it.
 - Prefer environment or stdin injection: rtxexec --env API_TOKEN=secret://my-token -- program; rtxexec --stdin secret://my-password -- program.
 - For tools requiring arguments: rtxexec --secret token=secret://my-token -- curl -H "Authorization: Bearer {{token}}" https://api.example.com. Expanded arguments may be visible to local processes.
 - Do not request raw values, inspect the vault database or encryption keys, call the resolution endpoint directly, or run printenv/echo to inspect injected values. Use references and non-secret success checks.

package/skills/realtimex-terminal-agents/SKILL.md

@@ -15,16 +15,16 @@ Manage RealTimeX terminal agents, terminal sessions, session messages, and idle
 
 ## CLI setup
 
-This skill uses `realtimex-pp-cli` version 2.0.36. Before using its commands:
+This skill uses `realtimex-pp-cli` version 2.0.38. Before using its commands:
 
 ```bash
 realtimex-pp-cli --version
 ```
 
-If it is missing or does not report `realtimex-pp-cli 2.0.36`, install the pinned version:
+If it is missing or does not report `realtimex-pp-cli 2.0.38`, install the pinned version:
 
 ```bash
-npm install -g @realtimex/pp-cli@2.0.36
+npm install -g @realtimex/pp-cli@2.0.38
 ```
 
 For requests about the current workspace or thread, resolve context first:

package/skills/realtimex-webhooks/SKILL.md

@@ -15,16 +15,16 @@ Create, inspect, update, test, and delete RealTimeX public webhook endpoints and
 
 ## CLI setup
 
-This skill uses `realtimex-pp-cli` version 2.0.36. Before using its commands:
+This skill uses `realtimex-pp-cli` version 2.0.38. Before using its commands:
 
 ```bash
 realtimex-pp-cli --version
 ```
 
-If it is missing or does not report `realtimex-pp-cli 2.0.36`, install the pinned version:
+If it is missing or does not report `realtimex-pp-cli 2.0.38`, install the pinned version:
 
 ```bash
-npm install -g @realtimex/pp-cli@2.0.36
+npm install -g @realtimex/pp-cli@2.0.38
 ```
 
 For requests about the current workspace or thread, resolve context first:

package/skills/realtimex-workspaces/SKILL.md

@@ -15,16 +15,16 @@ Manage RealTimeX workspaces, threads, messages, workspace personality, LLM confi
 
 ## CLI setup
 
-This skill uses `realtimex-pp-cli` version 2.0.36. Before using its commands:
+This skill uses `realtimex-pp-cli` version 2.0.38. Before using its commands:
 
 ```bash
 realtimex-pp-cli --version
 ```
 
-If it is missing or does not report `realtimex-pp-cli 2.0.36`, install the pinned version:
+If it is missing or does not report `realtimex-pp-cli 2.0.38`, install the pinned version:
 
 ```bash
-npm install -g @realtimex/pp-cli@2.0.36
+npm install -g @realtimex/pp-cli@2.0.38
 ```
 
 For requests about the current workspace or thread, resolve context first:
@@ -91,6 +91,10 @@ realtimex-pp-cli prepare --agent
 
 - `realtimex-pp-cli rename-workspace <workspaceSlug>` — Rename one workspace by exact workspace slug. Only the name is changed.
 
+**resolve-working-directory** — Manage resolve working directory
+
+- `realtimex-pp-cli resolve-working-directory <id>` — Resolve a working directory mentioned in the current message to its local path.
+
 **send-message** — Manage send message
 
 - `realtimex-pp-cli send-message <workspaceSlug> <threadSlug>` — Send one message to an exact thread using the same routing as channel replies.