@robota-sdk/agent-cli 3.0.0-beta.85 → 3.0.0-beta.87

package/CHANGELOG.md

@@ -1,11 +1,57 @@
 # @robota-sdk/agent-cli
 
+## 3.0.0-beta.87
+
+### Minor Changes
+
+- 7d9cc66: Preserve an explicitly supplied host tool scheduling policy through session assembly and CLI presentation modes, retaining permission admission and conservative handling of undeclared resources.
+
+### Patch Changes
+
+- 66af868: Restore portable default startup for generated Robota artifacts while preserving explicit product selection and immutable identity. Keep shared product configuration internal because existing SDK and CLI artifacts bundle its implementation and types.
+- Release the migrated Robota product with its public SDK namespace, robota command, compatible SDK exports, internal product configuration, and verified CLI startup and delivery corrections.
+- 7d9cc66: Expose declarative contribution descriptors for installed bundles and resolved MCP sources,
+  including source generations, host capability requirements and compatibility diagnostics.
+  Revalidate MCP approval, source identity and workspace trust before new dispatch, preserving
+  outcomes of calls already started and refusing retained tools after shutdown.
+- 7d9cc66: Resume hosted conversations in freshly provisioned workers using verified checkpoint records while rebuilding current prompts, policy and execution state.
+- 7d9cc66: Load declared JSON and inline bundle MCP configurations with selected-source containment, ordered whole-server replacement and file provenance. Route packaged servers through normal CLI/app MCP startup with namespaced identities, existing trust/approval/authority gates, disable overlays and value-free compatibility diagnostics.
+- 7d9cc66: Add owner-side clean E2B worker provisioning and verified filesystem recovery with fresh identity and epoch, explicit failure reconciliation, and no paused-memory execution fallback.
+- 7d9cc66: Add owner-hosted organization control and OpenAI-wire gateway composition with anchored authority, mandatory verified audit, durable effect reservations, provider inventory cleanup and private content receipts. OpenAI profiles can opt into operation identities preserved across SDK retries.
+- 7d9cc66: Load external name-only plugin manifests without inventing optional metadata. Select the recorded
+  installed source instead of the lexically last cached directory, refusing invalid, missing or
+  ambiguous revisions. Check the installed identity as well as the manifest name for disablement.
+- 7d9cc66: Pass the child execution root and restored sandbox to hook composition. The stock CLI explicitly refuses command and HTTP hooks for separate task workers whose hook capabilities are unavailable, instead of executing those hooks on the host.
+- 7d9cc66: Connect explicitly selected stateless MCP servers through product startup. Preserve and expose the selected protocol, bind activation approval to it, refuse unsupported selections, and report unavailable protocol capabilities without widening process or network authority.
+- 7d9cc66: Add explicit MCP Skills selection, bounded supervisor access and persistent host content consent.
+  Users can inspect verified instructions, approve the exact content fingerprint and withdraw consent;
+  models can discover metadata only. Consent stays separate from server admission and model-turn activation.
+- 7d9cc66: Route discovered MCP Skills through the shared skill command runtime with lazy verified content, source-bound invocation names, current user consent and execution-owned activation cleanup. Keep remote shell expressions inert and defer queued user skill reads until their own turn executes.
+- 7d9cc66: Connect the desktop to an owner-bound remote task through scoped TLS credentials, durable replay protection, current company authority and a separate native operator approval channel. Keep remote credentials and local filesystem capabilities outside the renderer's remote task connection.
+- 7d9cc66: Reconstruct visible session history from verified hosted conversation checkpoints without importing old system messages or execution events.
+- 7d9cc66: Retain an owner shutdown signal received while a served runtime initializes, and release its signal handlers when the run settles.
+- 7d9cc66: Require hosted admission protocol v2 with signed root-task ownership. Add a pinned E2B SDK connector that checks admitted worker ownership and network configuration before connecting, keeps management credentials outside task operations, and retains provider teardown failures.
+- 7d9cc66: Expose verified skill supporting resources only within their owning turn or fork, using the current host consent and manifest.
+- 7d9cc66: Run the stock hosted CLI inside an admitted E2B task worker with broker-signed scoped access, pinned worker artifacts, runtime-owned input/output and provider cleanup.
+- 7d9cc66: Observe scheduler queue intervals separately from pre-dispatch admission, permission and tool work.
+  Preserve valid duration totals when live trace detail is bounded, reporting invalid evidence explicitly
+  through content-free console and OTLP traces without altering dispatch, recovery or settlement.
+- 7d9cc66: Require version-3 hosted admission with broker-signed cumulative usage and owner-selected runtime ceilings. Collect accounting before dispatch, on refresh and at completion; stop and release owned execution when accounting or limits fail. Operator deployments and issuers must migrate from version 2.
+
+  Connect authenticated runtime loopback clients to the stock hosted worker daemon through owned provider command streams. Hosted serve requires a private owner-selected ingress configuration and uses a separate worker launch token; stop closes clients and the listener before cleanup settles.
+
+## 3.0.0-beta.86
+
+### Patch Changes
+
+- 44bd221: Allow the desktop CLI to start and reconnect to its workspace daemon on Windows using private storage and a native local control pipe that verifies process ownership.
+
 ## 3.0.0-beta.85
 
 ### Minor Changes
 
 - db35dcd: MCP approvals now outlive the process, and an approval takes effect at once. The `robota` CLI keeps
-  activation decisions in `~/.robota/mcp-approvals.json` (owner-only) unless the host passes its own
+  activation decisions in `$PRODUCT_USER_STATE_DIR/mcp-approvals.json` (owner-only) unless the host passes its own
   `mcpApprovalStore`, so an approved server connects at later starts until its definition changes.
   `/mcp approve <server>` now also connects the server in the running session, the way `/mcp reload`
   does, instead of waiting for a restart. A remote server without OAuth therefore connects once
@@ -77,10 +123,10 @@
 - 12a5b15: CLI fixes from the docs-refresh findings (#3275):
 
   - `robota trust revoke` exits 0 when the revoke succeeds.
-  - `robota <subcommand> --help` prints that subcommand's help instead of running it, refusing an unknown option, or starting the terminal UI; commands with fuller help of their own (`usage`, `session list|view|attach`) keep printing it, and `robota mcp serve --help` prints to stdout.
+  - `Robota <subcommand> --help` prints that subcommand's help instead of running it, refusing an unknown option, or starting the terminal UI; commands with fuller help of their own (`usage`, `session list|view|attach`) keep printing it, and `robota mcp serve --help` prints to stdout.
   - `robota --help` lists every option the parser accepts (`--goal`, `--goal-max-iterations`, `--provider`, `--set-current`, `--type`, `--base-url`, `--api-key`, `--api-key-env`, `--settings-scope`, `--session-log`, `--serve`, `--restricted-workspace`, `--disable-update-check`), `--effort` lists `none` and `minimal`, and `--bare` is described as what it does: print mode without instruction files or plugins.
   - `robota session start --background --restricted-workspace` starts a background session Restricted, as the headless trust refusal already suggested.
-  - `robota "prompt"` opens the terminal UI with the prompt typed in, not yet sent.
+  - `Robota "prompt"` opens the terminal UI with the prompt typed in, not yet sent.
 
 - 29486da: A lost connection no longer drops a typed message or takes the person out of their session. While the
   transport is not `connected`, the composer keeps its draft and Send explains why it cannot submit
@@ -183,7 +229,7 @@
   - `agent-mcp` (breaking) — `MCP_EXTERNAL_EVENT_CAPABILITY`, `MCP_EXTERNAL_EVENT_METHOD`, `IMCPExternalEvent` and
     `TMCPExternalEventListener` are removed, as are `IMCPSession.externalEventsDeclared`,
     `IMCPSession.onExternalEvent`, `IMCPSession.onClose` and `MCPConnectionSupervisor.onExternalEvent`. A server
-    that declares `com.robota.external-event` or sends its notification is served as any other server and the
+    that declares `com.Robota.external-event` or sends its notification is served as any other server and the
     notification is ignored. The `zod` dependency is dropped.
   - `agent-cli` (breaking) — `IMcpClientComposition.subscribeExternalEvent` and
     `IMcpServerConnection.onExternalEvent` are removed.
@@ -321,7 +367,7 @@
     - Session notices keep only `session-error` and `protocol-error`.
     - The state gains `commandCatalog` and `sessionStatus`.
   - `agent-command` registers `/theme` and `/keybindings` even without a terminal. They then answer
-    that they belong to the robota terminal, instead of being unknown.
+    that they belong to the Robota terminal, instead of being unknown.
   - `agent-framework`:
     - `InteractiveSession.getStatusSnapshot()`.
     - The main-thread row previews the last chat message instead of the last record's type.
@@ -515,7 +561,7 @@
   - The device lists read from public records are bounded per paired device, each device's newest
     before any device's next, and the chunks of one list carry a shared version, so a read that finds
     chunks of two versions yields no list. Records written before this change are not read as lists.
-  - CLI processes that share `~/.robota/devices/address-cache.json` apply each change to the file as it
+  - CLI processes that share `$PRODUCT_USER_STATE_DIR/devices/address-cache.json` apply each change to the file as it
     is on disk, so one process no longer overwrites what another learned.
 
 - 4241fc5: Device mesh follow-ups.
@@ -552,7 +598,7 @@
 
   - **`agent-framework`:** `supportsWorkspaceProjectMutation(platform?)` tells a host in advance whether project writes can be proven to stay under the trusted root. The project writer uses the same answer, so the two cannot disagree.
   - **`agent-cli`:**
-    - Where project writes cannot be proven safe, a trusted workspace keeps its sessions in the user session store (`~/.robota/sessions`). They are listed for that workspace by their working directory, so `/resume`, the sessions sidebar, `--continue` and `robota session list` find them. Nothing is written under the project root.
+    - Where project writes cannot be proven safe, a trusted workspace keeps its sessions in the user session store (`$PRODUCT_USER_STATE_DIR/sessions`). They are listed for that workspace by their working directory, so `/resume`, the sessions sidebar, `--continue` and `robota session list` find them. Nothing is written under the project root.
     - Before this, every save in a trusted git workspace on macOS was refused, and those surfaces listed nothing.
     - Linux keeps trusted sessions in the project, as before.
     - `robota session list`, `robota usage` and `robota session analyze` report such sessions as user sessions, never as project sessions.
@@ -588,7 +634,7 @@
     stays inside the project (every platform but Linux), none is composed: a checkpoint could be
     neither saved nor restored there.
   - `agent-command` (patch): where a session has no checkpoints, `/rewind` says why: a restricted
-    workspace is told to run `robota trust --yes` and restart robota, and a host that cannot write
+    workspace is told to run `robota trust --yes` and restart Robota, and a host that cannot write
     the project safely says so. `/rewind list` reports this as a failed command instead of throwing.
   - `agent-framework` (minor): a checkpoint operation on a session without a store throws
     `EditCheckpointsUnavailableError`, whose `reason` is `host-cannot-write-project`,
@@ -628,14 +674,14 @@
     under. `sandboxApprovalFor` is exported.
   - `agent-subagent-runner` (minor): `ISubagentWorkerComposition` takes an optional `createSandbox`. The
     worker builds that sandbox once and hands the same instance to `createTools` and to the session.
-  - `agent-cli` (patch): robota's worker composition builds the OS sandbox through `createSandbox`, so
+  - `agent-cli` (patch): Robota's worker composition builds the OS sandbox through `createSandbox`, so
     a child-process subagent approves what its parent approves.
 
-- f8a8a4d: The GUI surface's design now applies inside a `robota-ui` scope that each of its root components opens,
+- f8a8a4d: The GUI surface's design now applies inside a `agent-ui` scope that each of its root components opens,
   so an app with design tokens of its own can embed the surface without either overriding the other. Such
   an app imports `@robota-sdk/agent-ui-web/styles/surface.css` into its Tailwind entry; a page that is only
-  the surface keeps importing `styles/theme.css` and puts `robota-ui` on its `<html>`. `RobotaMark` and
-  `RobotaWordmark` are exported. The browser remote client (`RemoteClient`) follows the same design, with
+  the surface keeps importing `styles/theme.css` and puts `agent-ui` on its `<html>`. `ProductMark` and
+  `ProductWordmark` are exported. The browser remote client (`RemoteClient`) follows the same design, with
   its pairing states centred on the page.
 - 122e82b: A child-process subagent confines and approves commands with its parent's sandbox settings as they
   stand when it starts. Before, it read its root's settings files, so a `/sandbox` change made in the
@@ -645,7 +691,7 @@
   - `agent-subagent-runner` (minor): the runner factory takes `parentSandboxSettings`, read at each
     spawn. The start payload carries it, the IPC guard checks it is a record, and the worker hands it to
     `createSandbox` as `parentSettings`.
-  - `agent-cli` (patch): robota sends its live sandbox's settings, and a child builds its sandbox from
+  - `agent-cli` (patch): Robota sends its live sandbox's settings, and a child builds its sandbox from
     them. It refuses settings it cannot read rather than falling back to the files.
 
 - 0368058: A running child-process subagent follows a `/sandbox` change made in its parent session. Before, it
@@ -660,7 +706,7 @@
     exits or fails to start. A composed sandbox may define `applyParentSettings`. The worker applies
     each change through it. On settings it cannot take, it aborts the run, lets a running command
     finish, and ends the run with that error.
-  - `agent-cli` (patch): robota watches its live sandbox, and a child applies each change to the
+  - `agent-cli` (patch): Robota watches its live sandbox, and a child applies each change to the
     instance its tools and approval read.
 
 - 5a0ee96: Workspace trust no longer drops on its own. A grant was keyed by the repository config file and the
@@ -696,7 +742,7 @@
     pairwise secret (`derivePairRendezvous(...).relayInbox()`).
   - `agent-cli` — a device holding the signing key reissues its roster and revocation list before they
     expire while an interactive session runs. The host can open this device's mesh endpoint from the
-    identity under `~/.robota/devices`, saving newer lists a peer hands over; no command starts it yet.
+    identity under `$PRODUCT_USER_STATE_DIR/devices`, saving newer lists a peer hands over; no command starts it yet.
   - `agent-command` — `/devices add|join` still reports that enrolment is not available yet.
 
 - e15e22b: The Node WebRTC transport runs on `node-datachannel` (libdatachannel, DTLS by OpenSSL). The DTLS stack
@@ -720,7 +766,7 @@
     The tool reaches only files inside the workspace whose path does not look like it holds secrets
     (`.env*`, `~/.ssh`, keys and credentials), and it does not exist in a turn a peer's message started.
   - The receiving operator approves every file. A received file is kept as an inert copy (mode 0600)
-    under `~/.robota/peer-files/<sender>/`. It is never run and never placed in the model's context.
+    under `$PRODUCT_USER_STATE_DIR/peer-files/<sender>/`. It is never run and never placed in the model's context.
     The conversation is told only its name, size and sha256. A name that leaves that directory is
     refused, a symbolic link is never written through, and nothing is overwritten.
   - Transfers travel on a channel of their own (a separate connection on this host, a separate data
@@ -812,7 +858,7 @@
     rate. Discovery yields candidates only: admission is still the device handshake, and an address is
     remembered only after an admission it carried.
   - `agent-cli` — the device mesh endpoint can look on the local network (`lan` option), remembering
-    the addresses that worked in an owner-only `~/.robota/devices/address-cache.json`; no command starts
+    the addresses that worked in an owner-only `$PRODUCT_USER_STATE_DIR/devices/address-cache.json`; no command starts
     it yet.
 
 ## 3.0.0-beta.81
@@ -852,13 +898,13 @@
     driver is ignored. External-event turns keep their tool-less baseline.
   - `agent-cli`: incoming peer turns carry only their reply route.
 
-- ec5e477: Add a credential store port (`ICredentialStore` in `agent-core`) and keep the CLI's secrets behind it: the OS keychain through the optional `@napi-rs/keyring` binding (macOS Keychain, Windows Credential Manager, Linux Secret Service), else an owner-only file under `~/.robota/credentials`. The backend is chosen at first use, recorded, and named by `/remote-control status`; a recorded keychain that stops working fails closed instead of degrading to the file.
+- ec5e477: Add a credential store port (`ICredentialStore` in `agent-core`) and keep the CLI's secrets behind it: the OS keychain through the optional `@napi-rs/keyring` binding (macOS Keychain, Windows Credential Manager, Linux Secret Service), else an owner-only file under `$PRODUCT_USER_STATE_DIR/credentials`. The backend is chosen at first use, recorded, and named by `/remote-control status`; a recorded keychain that stops working fails closed instead of degrading to the file.
 
-  The remote-control host identity key moves into the store. The old `~/.robota/remote-host-identity.json` may have been copied by backups or dotfile sync, so it is not carried over: on the first run after upgrading a new host key is generated, the old file is removed, and the operator is told once that trusted devices must pair again.
+  The remote-control host identity key moves into the store. The old `$PRODUCT_USER_STATE_DIR/remote-host-identity.json` may have been copied by backups or dotfile sync, so it is not carried over: on the first run after upgrading a new host key is generated, the old file is removed, and the operator is told once that trusted devices must pair again.
 
 - 44fc732: Add `/devices` for this device's identity among the user's devices: `list`, `init` (creates the identity: a recovery phrase, the master-certified signing key, this device's keys and certificate, the first roster and revocation list), `revoke <device-id>` (signing key only, no phrase; confirmed at the terminal) and `recover` (rotates the signing key from the phrase and revokes the old ones). Enrolling another device (`add` / `join`) comes with the device connection.
 
-  The recovery phrase never enters the session: it is shown once and read with no echo on the controlling terminal (opened apart from the session's input), on the alternate screen that is cleared afterwards, and never reaches prompt history, conversation history, transcripts, traces or the model. Without an interactive terminal the phrase commands refuse. `/devices` is operator-only: never model-invocable and refused from remote surfaces. Private keys live in the host credential store; certificates, roster, revocation lists and sequence marks are kept in owner-only files under `~/.robota/devices`.
+  The recovery phrase never enters the session: it is shown once and read with no echo on the controlling terminal (opened apart from the session's input), on the alternate screen that is cleared afterwards, and never reaches prompt history, conversation history, transcripts, traces or the model. Without an interactive terminal the phrase commands refuse. `/devices` is operator-only: never model-invocable and refused from remote surfaces. Private keys live in the host credential store; certificates, roster, revocation lists and sequence marks are kept in owner-only files under `$PRODUCT_USER_STATE_DIR/devices`.
 
   `agent-remote-pairing` adds `isRecoveryPhraseWord`, so a phrase can be checked one word at a time.
 
@@ -1088,7 +1134,7 @@
   with an advisor. Sending history to a destination (provider type and endpoint host) the main model
   does not already use needs a one-time consent per destination, kept in the user settings file; a
   refusal is remembered for the session. The organization's `allowedProviders` applies, and
-  `ROBOTA_DISABLE_ADVISOR=1` turns it off completely. In-process subagents inherit the advisor, bound
+  `PRODUCT_DISABLE_ADVISOR=1` turns it off completely. In-process subagents inherit the advisor, bound
   to their own conversation; child-process subagents do not get it.
 
   **`@robota-sdk/agent-framework` is `major` for one reason: `ICommandHostSessionAccess` gains a
@@ -1132,10 +1178,10 @@
 
   - **Running it** (`agent-cli`):
     - No shell. It runs in the project directory for a `project`/`local` definition, and in
-      `~/.robota` otherwise.
+      `$PRODUCT_USER_STATE_DIR` otherwise.
     - Its environment is the host's without runtime-loading variables (`NODE_OPTIONS`, `LD_*`,
       `BASH_ENV`, …). A `project`/`local` helper also gets no credential-shaped variables.
-      `ROBOTA_MCP_SERVER_NAME` and `ROBOTA_MCP_SERVER_URL` are set. For a `project`/`local` helper
+      `PRODUCT_MCP_SERVER_NAME` and `PRODUCT_MCP_SERVER_URL` are set. For a `project`/`local` helper
       the URL keeps its `${VAR}` references instead of what the environment expanded them to.
     - Limits: 10 s and 64 KiB of stdout. Stderr is discarded. The process tree is killed on timeout
       or cancel.
@@ -1228,7 +1274,7 @@
     of following it; registration, token and refresh requests use it.
   - **Storage:** `IMCPOAuthCredentialStore` (`get`/`set`/`delete`), keyed by the server's security
     identity and canonical URL together. `createFileOAuthCredentialStore` keeps 0600 files in a 0700
-    `~/.robota/mcp-credentials/`. The issuer, token endpoint and client (with its secret, if any, and
+    `$PRODUCT_USER_STATE_DIR/mcp-credentials/`. The issuer, token endpoint and client (with its secret, if any, and
     the client authentication method dynamic registration returned) are stored with the tokens. A
     sign-in stores its credential under the refresh lock, so a refresh in flight cannot overwrite it.
   - **Sessions** (`createOAuthAuthenticator`, wired for every `oauth` definition):
@@ -1266,10 +1312,10 @@
 
 - af2f2ad: `/cd <directory>` continues the conversation in another directory.
 
-  - **A move is a new session in the target directory.** In the TUI, robota saves a copy of the
+  - **A move is a new session in the target directory.** In the TUI, Robota saves a copy of the
     conversation where the target's session store will find it, ends the current run through its
     normal end-of-life flow, and starts again in the target directory resuming that copy. The target's
-    settings, trust decision, tools, skills and `AGENTS.md` apply, exactly as if robota had been
+    settings, trust decision, tools, skills and `AGENTS.md` apply, exactly as if Robota had been
     launched there. The process boundary makes the move atomic, so no tool call can straddle it.
   - **The system prompt is kept as recorded**, so a provider's prompt cache survives. One appended
     `<workspace-move>` message tells the model the new directory, and which project instructions now
@@ -1312,8 +1358,8 @@
     construction alongside `allow` and `deny`.
   - **Never auto-approved, bypass included:** removing a critical path with `rm`/`rmdir` (the root, a
     top-level directory, home, the working directory or a parent), and a modify-class write into
-    `.git`, `.robota`, `.claude`, `.agents`, `.mcp.json`, `.gitconfig`, `.npmrc` or a shell rc file.
-    Files inside an isolated worktree (`.robota/worktrees/<name>/…`) are ordinary files. With no
+    `.git`, `.Robota`, `.claude`, `.agents`, `.mcp.json`, `.gitconfig`, `.npmrc` or a shell rc file.
+    Files inside an isolated worktree (`$PRODUCT_PROJECT_STATE_DIR/worktrees/<name>/…`) are ordinary files. With no
     approver attached, an ask is a denial.
   - **A ceiling is checked before bypass and before any ask.** A subagent's `inherit-allowlist` ceiling
     is now the parent's _effective_ rules, read live at spawn: settings, preset lists and command
@@ -1450,7 +1496,7 @@
     project/user definitions > injected > built-in. `AgentDefinitionLoader` now dedupes within that tier
     (first wins). Absent ⇒ unchanged behavior.
   - **`@robota-sdk/agent-transport` / `@robota-sdk/agent-transport-tui`** — forward the optional
-    `agentDefinitions` through the headless and TUI channels so every robota surface carries the seam.
+    `agentDefinitions` through the headless and TUI channels so every Robota surface carries the seam.
   - **`@robota-sdk/agent-cli`** — `robota`'s identity (branding, provider surface, presets,
     `packs: [codingPack]`, base command modules, injected transports/runners/subagent factory) is declared as
     data in a product profile and folded by `assembleProduct`. The coding command modules (`/shell`,
@@ -1497,7 +1543,7 @@
   End-user `robota` behavior is unchanged: the assembled command-module set, provider surface, tool set,
   subagent roster, preset resolution, and permission posture all match the pre-change assembly.
 
-- 0116a29: ARCH-006 completion — robota's capability packs now OWN its tool surface, and `pack-coding` is built by a
+- 0116a29: ARCH-006 completion — Robota's capability packs now OWN its tool surface, and `pack-coding` is built by a
   context-bound factory.
 
   - **`@robota-sdk/pack-coding` (BREAKING)** — the module-level `codingPack` constant is **removed** and
@@ -1511,9 +1557,9 @@
     products in one process get independently-scoped file tools. Migration: replace `codingPack` with
     `createCodingPack({ cwd: process.cwd() })`.
   - **`@robota-sdk/agent-cli`** — `robota`'s packs are built from the shell's resolved `cwd`
-    (`createRobotaPacks({ cwd })`) before command setup, and the runtime seam passes
-    `ROBOTA_PACKS_OWN_TOOL_SURFACE` (an empty `defaultTools`) so the framework's `createDefaultTools()` tier
-    is REPLACED. Every tool robota runs now arrives from a capability pack: dropping a pack drops its tools,
+    (`createProductCapabilityPacks({ cwd })`) before command setup, and the runtime seam passes
+    `PRODUCT_PACKS_OWN_TOOL_SURFACE` (an empty `defaultTools`) so the framework's `createDefaultTools()` tier
+    is REPLACED. Every tool Robota runs now arrives from a capability pack: dropping a pack drops its tools,
     exactly as it already dropped its command modules and subagents.
   - **`@robota-sdk/agent-transport` / `@robota-sdk/agent-transport-tui`** — forward the optional
     `additionalTools` and `defaultTools` through the headless and TUI channels, mirroring the existing
@@ -1589,7 +1635,7 @@
 - 2711ec6: One broken skill or agent file no longer stops the session.
 
   Skill, command and agent definitions are shared with other hosts through `.claude`, and those hosts
-  define fields of their own. The frontmatter decoder now validates only the fields robota owns and
+  define fields of their own. The frontmatter decoder now validates only the fields Robota owns and
   ignores the rest (nested `metadata` entries included); a malformed value of an owned field is still
   refused. A refused file is skipped with a single warning and still claims its name, so a
   lower-priority definition cannot stand in for it. An empty `argument-hint` reads as no hint. When
@@ -1615,7 +1661,7 @@
     existing `presets` + `defaultPresetId` shape behaves exactly as before.
   - **`@robota-sdk/agent-cli`** — `resolveCliPreset` is replaced by `resolveShellPreset(externalPresets,
 args, settingsPreset)`, which builds the per-call registry, resolves over it, and returns
-    `{ registry, presetId, context, options }` as one value. `createRobotaProfile` takes that whole value,
+    `{ registry, presetId, context, options }` as one value. `createSelectedProductProfile` takes that whole value,
     so the shell cannot hand the kernel a registry, id, or override context other than the ones it actually
     resolved with. `robota`'s startup path no longer reads `agent-preset`'s module-global resolver; that
     registry remains only as the in-session `/preset` DISCOVERY surface, which is executed inside the
@@ -1623,7 +1669,7 @@ args, settingsPreset)`, which builds the per-call registry, resolves over it, an
     `loadExternalPresets()` call, so they cannot disagree.
 
   End-user `robota` behavior is unchanged: the same preset resolves to the same options, external presets
-  in `~/.robota/presets/*.json` remain visible to both `--preset <id>` and `/preset`, and the assembled
+  in `$PRODUCT_USER_STATE_DIR/presets/*.json` remain visible to both `--preset <id>` and `/preset`, and the assembled
   command-module set, provider surface, tool set, subagent roster, and permission posture are untouched.
 
 - e82215f: **ARCH-011: replace the ambiguous transport lifecycle stub with executable conformance.**
@@ -1647,7 +1693,7 @@ args, settingsPreset)`, which builds the per-call registry, resolves over it, an
 
 - 0c07176: **BREAKING — ARCH-021: child-process subagents compose the PRODUCT's surface, not imported defaults.**
 
-  The child-process worker built its surface from `createDefaultProviderDefinitions()` and `createDefaultTools()` — a fixed six-vendor registry and the framework's default tool tier — while the composition root had already handed the runner the fully composed surface and the runner dropped it. So a product's custom providers and pack-contributed tools reached an **in-process** subagent and not a **child-process** one, and ARCH-006's landed invariant "every tool robota runs comes from a pack" was **false in the child**: dropping a pack did not drop its tools.
+  The child-process worker built its surface from `createDefaultProviderDefinitions()` and `createDefaultTools()` — a fixed six-vendor registry and the framework's default tool tier — while the composition root had already handed the runner the fully composed surface and the runner dropped it. So a product's custom providers and pack-contributed tools reached an **in-process** subagent and not a **child-process** one, and ARCH-006's landed invariant "every tool Robota runs comes from a pack" was **false in the child**: dropping a pack did not drop its tools.
 
   This is the second finding at that line. ARCH-010 — judged BLOCKER, a subagent `Read` returning `/etc/hostname` — patched one argument there and left the reconstruction standing.
 
@@ -1752,7 +1798,7 @@ args, settingsPreset)`, which builds the per-call registry, resolves over it, an
   }
   ```
 
-  `IChildProcessSubagentRunnerOptions.workerPath` → **`workerEntry`**, and the runner `spawn`s `execPath args… --__robota-subagent-worker` instead of forking a module path. `robota`'s own entry enters worker mode through the new `runSubagentWorkerMain()`, so **there is no second artifact and no path to get wrong**. The one seam satisfies all three shapes: a bundled Node build names the file it is executing, a `tsx` source run names the same and adds `--import tsx`, and a compiled binary names _nothing_ — `process.execPath` is the binary, and re-executing it re-enters its embedded entry.
+  `IChildProcessSubagentRunnerOptions.workerPath` → **`workerEntry`**, and the runner `spawn`s `execPath args… --__agent-subagent-worker` instead of forking a module path. `robota`'s own entry enters worker mode through the new `runSubagentWorkerMain()`, so **there is no second artifact and no path to get wrong**. The one seam satisfies all three shapes: a bundled Node build names the file it is executing, a `tsx` source run names the same and adds `--import tsx`, and a compiled binary names _nothing_ — `process.execPath` is the binary, and re-executing it re-enters its embedded entry.
 
   **Per package, classified against each barrel:**
 
@@ -1767,13 +1813,13 @@ args, settingsPreset)`, which builds the per-call registry, resolves over it, an
   **Verified against the artifacts, not from source:** the built `dist/node/bin.js` and a real `bun --compile` single-file binary each complete the worker IPC handshake (`{type:'ready'}`), each refuse a hand-typed flag with no IPC channel (exit 2, "Silence is not success" — measured on both), and the shipped bundle no longer contains the string `child-process-subagent-worker.js` — there is nothing left to look for.
 
 - 1e40b5b: Move handoff source/destination orchestration and its contract from agent-framework to the session-mobility owner. Import `HandoffSource`, `HandoffDestination`, and their option types from `@robota-sdk/agent-interface-session-mobility`. Mobility now applies offer and authority decisions directly, while the CLI supplies wire effects and the session-record decoder. A successful offer no longer returns a mutable authority transaction.
-- f3fe3db: The terminal renderer no longer reads `ROBOTA_SCREEN_READER_STARTUP_QUIET_MS` or
-  `ROBOTA_SCREEN_READER_PREPARK_MS` from the process environment. SDK hosts calling `renderApp`
+- f3fe3db: The terminal renderer no longer reads `PRODUCT_SCREEN_READER_STARTUP_QUIET_MS` or
+  `PRODUCT_SCREEN_READER_PREPARK_MS` from the process environment. SDK hosts calling `renderApp`
   directly should pass raw timing choices and diagnostic labels through the new optional
   `screenReaderPacing` render option. Without it, the renderer uses its existing 900 ms startup
   quiet period and 50 ms pre-write park when screen-reader mode is enabled. The Robota CLI still
   reads the same environment variables and preserves their validation, bounds, and warnings.
-- 724d5b6: The terminal renderer no longer reads `ROBOTA_IME_CURSOR` or `ROBOTA_TURN_MARKS` from the process environment. SDK hosts calling `renderApp` directly should pass cursor and turn-mark choices through the optional `terminalCapabilities` render option. Without a host choice, the renderer keeps its terminal and TTY defaults. The Robota CLI still reads both environment variables and preserves its exact `1` and `0` overrides.
+- 724d5b6: The terminal renderer no longer reads `PRODUCT_IME_CURSOR` or `PRODUCT_TURN_MARKS` from the process environment. SDK hosts calling `renderApp` directly should pass cursor and turn-mark choices through the optional `terminalCapabilities` render option. Without a host choice, the renderer keeps its terminal and TTY defaults. The Robota CLI still reads both environment variables and preserves its exact `1` and `0` overrides.
 - c6c56a6: Move the concrete `GitWorktreeIsolationAdapter` (git CLI + filesystem I/O) out of the reusable
   `@robota-sdk/agent-executor` runtime-primitives package into the `@robota-sdk/agent-cli` composition
   root, restoring the executor's "creates no Git worktrees" boundary (ARL-02 / ARCH-FIX-024, INFRA-031).
@@ -1787,18 +1833,18 @@ args, settingsPreset)`, which builds the per-call registry, resolves over it, an
 
 - 4b76cfa: NEUT-005 (wave 2): restore an actionable context-capacity hint at the surface tier, neutrally. The zero-dependency `agent-core` layer emits a product-neutral hard-capacity notice and exposes the `IAgentConfig.contextCapacityHint` seam (wave 1). This wave wires that seam end-to-end without baking product vocabulary into a neutral library:
 
-  - `agent-session`: `ISessionOptions.contextCapacityHint` is forwarded into the Robota agent config (`buildRobota`), making the core seam reachable from the consuming layer.
+  - `agent-session`: `ISessionOptions.contextCapacityHint` is forwarded into the agent configuration factory, making the core seam reachable from the consuming layer.
   - `agent-framework`: new `deriveContextCapacityHint(commandModules)` derives the concrete remediation wording from the surface's OWN registered command set (names a registered `compact` command → `"Run /compact and retry."`; `undefined` when none, leaving the neutral core default). It is applied automatically in interactive session assembly across the TUI, print, and `--serve` surfaces.
   - `agent-cli`: the default command set registers `/compact`, so end users regain the actionable hint.
   - `agent-interface-transport`: reworded the `'allow-project'` permission comment so it no longer hardcodes a storage path (the location is owned by the consuming layer), matching the `agent-session` twin.
 
-- 796ddb4: Use a neutral default MCP client name and let hosts supply their own protocol identity. Robota CLI startup now explicitly supplies its prior `robota-agent-mcp` name, preserving its initialize handshake; embedders relying on that implicit name can set `clientInfo` explicitly.
+- 796ddb4: Use a neutral default MCP client name and let hosts supply their own protocol identity. Robota CLI startup now explicitly supplies its prior `Robota-agent-mcp` name, preserving its initialize handshake; embedders relying on that implicit name can set `clientInfo` explicitly.
 - e13c30c: MCP servers now publish a neutral submission tool by default. Hosts that need the previous
-  `robota_submit` tool must pass `submitTool: { name: 'robota_submit', description: '...' }` to
+  `PRODUCT_submit` tool must pass `submitTool: { name: 'PRODUCT_submit', description: '...' }` to
   `createAgentMcpServer`, `createMcpTransport`, or `createMcpHttpHost`. The Robota CLI supplies its
   existing name and description for both stdio and HTTP carriers.
 - 90e7a10: The default background observer warning code and exported `OBSERVER_FAILURE_WARNING_CODE` value
-  change from `ROBOTA_BACKGROUND_OBSERVER_FAILURE` to `BACKGROUND_OBSERVER_FAILURE`. Hosts matching
+  change from `PRODUCT_BACKGROUND_OBSERVER_FAILURE` to `BACKGROUND_OBSERVER_FAILURE`. Hosts matching
   the old warning code should match the new neutral code or provide `observerFailureWarningCode` in
   their background manager or session options. The Robota CLI supplies its existing code explicitly
   across print, goal, serve, MCP, and TUI sessions.
@@ -1855,7 +1901,7 @@ args, settingsPreset)`, which builds the per-call registry, resolves over it, an
   fragment-injected `spa/remote.html` static entry, and the REMOTE-007 permission/ask render+answer
   (the paired owner answers its own prompts — local == remote) shared by both the WS and RTC clients. It
   reuses the isomorphic `@robota-sdk/agent-remote-pairing` leaf and takes no node/werift dependency.
-  `agent-cli` removes the fabricated `robota-remote://pair` client-URL default and fails closed when
+  `agent-cli` removes the fabricated `Robota-remote://pair` client-URL default and fails closed when
   `transports.webrtc.options.clientUrl` is unset (no dead link).
 
   (Bump targets corrected during REL-023 triage: `@robota-sdk/agent-web-ui` was dissolved by GUI-006 (#1141, 2026-07-12) before this work was ever published; the browser client described here now lives in `@robota-sdk/agent-transport-webrtc-web` + `@robota-sdk/agent-remote-client`.)
@@ -1973,7 +2019,7 @@ args, settingsPreset)`, which builds the per-call registry, resolves over it, an
 
   - **Preset system (PRESET-001~017):** new `@robota-sdk/agent-preset` package layering framework
     assembly options into named, selectable profiles (`default`, `autonomous-builder`, `careful-reviewer`,
-    `neutral-executor`) plus user-authored external presets loaded from `~/.robota/presets/*.json`.
+    `neutral-executor`) plus user-authored external presets loaded from `$PRODUCT_USER_STATE_DIR/presets/*.json`.
   - **Live preset switching:** `/preset` command (list + active marker + switch) and a TUI active-preset
     display. Switching live re-applies permission posture, model/effort, persona, command-module
     selection, parallel-subagents gating, and a self-verification system-prompt section via the single
@@ -2324,7 +2370,7 @@ args, settingsPreset)`, which builds the per-call registry, resolves over it, an
 
 ### Patch Changes
 
-- Refresh package docs and robota.io content for the beta 57 feature set.
+- Refresh package docs and Robota.io content for the beta 57 feature set.
 - Updated dependencies
   - @robota-sdk/agent-command-agent@3.0.0-beta.58
   - @robota-sdk/agent-core@3.0.0-beta.58