@robota-sdk/agent-cli 3.0.0-beta.95 → 3.0.0-beta.97

package/CHANGELOG.md

@@ -1,5 +1,74 @@
 # @robota-sdk/agent-cli
 
+## 3.0.0-beta.97
+### Minor Changes
+
+- 0d43f37: **An editor can reopen an earlier conversation over ACP and offer the agent's slash commands.**
+
+  `@robota-sdk/agent-transport-acp` sends `available_commands_update` once the editor holds the session
+  id — the runtime's commands and the user-invocable skills, each with its argument hint — and again
+  after a prompt that changed the list (a plugin reload, a preset). A host can supply `loadSession`;
+  the agent then offers `session/load`, checks it exactly like `session/new` (the served directory, no
+  editor MCP servers or extra roots, workspace trust), refuses it while a prompt runs, and replays the
+  loaded conversation — what was typed, what the agent answered, and each finished tool call, a reused
+  call id getting a row of its own — before it answers. The port makes the stored session current in
+  the object the transport was attached to, so a host attaches a forwarder such as a session slot.
+  The published narrow `IAcpTransportSession` contract remains supported: command listing and history
+  display reads are optional capabilities. Loading is offered only with both the host port and the
+  history read, so a session cannot be replaced without replaying its conversation.
+
+  `robota acp` supplies the load: the editor may load a stored session of the folder it serves that
+  this version can read, and the agent replaces its session with it and shuts the old one down. A load
+  is refused while the current session has work in progress, and for a stored session with an active
+  goal, a live loop or a schedule that restore would re-arm to fire, which would otherwise run unseen
+  by the editor. With `--no-session-persistence` nothing is stored, so loading is not offered.
+
+### Patch Changes
+
+- e5a4254: **An editor that offers its file system carries the file tools' reads and writes.**
+
+  `Read`, `Write` and `Edit` take an optional `editorFiles` port (`IEditorFileAccess`), asked at each
+  call. On the host, after the tool's containment check (the permission gate has already decided),
+  `Read` returns the editor's text, unsaved changes included, and `Write` hands the content to the
+  editor; `Edit` reads where `Read` reads and writes where `Write` writes. The editor's text keeps
+  `Read`'s byte budget, binary refusal, formatting and cancellation, and an editor failure becomes the
+  tool's error result. `Glob` and `Grep` still search the disk and end their result with a note saying
+  so while an editor is attached. A sandbox with its own filesystem still carries every file tool, and
+  commands never use the editor. `createDefaultTools` and `createCodingPack` pass `editorFiles` through
+  to those tools only.
+
+  The ACP agent transport records the editor's `clientCapabilities.fs` and, once `session/new` binds the
+  session, hands the host an access through the new `onEditorFileAccess` option that sends
+  `fs/read_text_file` and `fs/write_text_file` for that session, for what the editor offered; stopping
+  the transport withdraws it. `robota acp` connects the two, so Read, Write and Edit go through the
+  editor in an editor that offers `fs`; `terminal/*` is not used.
+
+## 3.0.0-beta.96
+### Minor Changes
+
+- 68dda38: MCP Apps: a tool's declared view can ride its result to a surface that can host it.
+  
+  `agent-mcp` declares the `io.modelcontextprotocol/ui` extension only when the host opts in
+  (`IMCPOpenSessionOptions.apps`), on both protocol eras. A tool's `_meta.ui` reference (a `ui://`
+  resource and its audience) is kept in discovery and the catalog only when the server declared the
+  extension and resources too; a malformed declaration is reported by a fixed reason and the tool is
+  still offered without a view, and a tool the server hides from the model is rejected with a reason
+  rather than offered. `IMCPSession` gains `readResource` (a general `resources/read`, also on
+  `MCPConnectionSupervisor`) and `apps`; a custom `IMCPSession` implementation must add `readResource`.
+  After a successful call, `DiscoveredMCPTool` reads the declared resource and, when it is one
+  `text/html;profile=mcp-app` document within the size bound, attaches `IToolResult.view`; otherwise the
+  text result is unchanged and the omission is reported. The view never enters model context.
+  
+  `agent-cli` opts in only for the plain `--serve` host that the desktop app and web GUI drive, not the
+  TUI, print runs, `mcp serve` or the ACP agent.
+
+### Patch Changes
+
+- fbb287d: Show a finished MCP tool call's app in an opaque frame with a source-bound JSON-RPC bridge. App callbacks use the session's view authority and permission prompt. Session changes and frame disposal reject pending local requests.
+  
+  Hosts can provide a sandbox URL through `SessionSurface`. The web GUI serves a separate sandbox document with content restrictions and `Connection-Allowlist` enforcement. App execution requires Chromium 158 or newer and native network isolation; other browsers and hosts without the response policy show an unavailable message and retain the text result. A surface without a sandbox URL never reads the app document.
+- Keep E2B out of the base Node installation and defer SDK loading until stock hosted execution is selected. Install `e2b@2.51.0` alongside the CLI in the same project or global prefix to enable that capability. A missing SDK produces installation guidance before admission requests and never falls back to host execution. Public E2B exports and injected executors remain compatible; stock native binaries retain the embedded SDK, and consumer native builds require it as explicit build tooling.
+
 ## 3.0.0-beta.95
 ### Minor Changes