@robota-sdk/agent-framework 3.0.0-beta.85 → 3.0.0-beta.87

package/CHANGELOG.md

@@ -1,5 +1,84 @@
 # @robota-sdk/agent-framework
 
+## 3.0.0-beta.87
+
+### Minor Changes
+
+- 7d9cc66: Keep host-declared inline human controls reachable during active turns. Plugin disable and uninstall can withdraw future dispatch without changing model invocation or host command policy.
+- 7d9cc66: Expose declarative contribution descriptors for installed bundles and resolved MCP sources,
+  including source generations, host capability requirements and compatibility diagnostics.
+  Revalidate MCP approval, source identity and workspace trust before new dispatch, preserving
+  outcomes of calls already started and refusing retained tools after shutdown.
+- 7d9cc66: Preserve an explicitly supplied host tool scheduling policy through session assembly and CLI presentation modes, retaining permission admission and conservative handling of undeclared resources.
+
+### Patch Changes
+
+- Release the migrated Robota product with its public SDK namespace, robota command, compatible SDK exports, internal product configuration, and verified CLI startup and delivery corrections.
+- 7d9cc66: Load declared JSON and inline bundle MCP configurations with selected-source containment, ordered whole-server replacement and file provenance. Route packaged servers through normal CLI/app MCP startup with namespaced identities, existing trust/approval/authority gates, disable overlays and value-free compatibility diagnostics.
+- 7d9cc66: Load external name-only plugin manifests without inventing optional metadata. Select the recorded
+  installed source instead of the lexically last cached directory, refusing invalid, missing or
+  ambiguous revisions. Check the installed identity as well as the manifest name for disablement.
+- 7d9cc66: Add user-only project memory topic correction and forgetting, prevent automatic restoration after restart, refresh retained startup context, and reconcile semantic recall with current durable source content.
+- 7d9cc66: Allow consumer eval metrics to require a perfect outcome independently of aggregate scores, and reject interrupted runs as successful evaluations.
+- 7d9cc66: Add explicit MCP Skills selection, bounded supervisor access and persistent host content consent.
+  Users can inspect verified instructions, approve the exact content fingerprint and withdraw consent;
+  models can discover metadata only. Consent stays separate from server admission and model-turn activation.
+- 7d9cc66: Route discovered MCP Skills through the shared skill command runtime with lazy verified content, source-bound invocation names, current user consent and execution-owned activation cleanup. Keep remote shell expressions inert and defer queued user skill reads until their own turn executes.
+- 7d9cc66: Restore actual interactive tool observations, identities and outcomes from persisted event history.
+  Show denied calls as failed in live and restored GUI conversation views.
+- 7d9cc66: Retain registered tool source attribution in observations and preserve ordered outcome receipts independently of conversation summaries.
+- 7d9cc66: Expose verified skill supporting resources only within their owning turn or fork, using the current host consent and manifest.
+- 7d9cc66: Retain mixed tool observations alongside structured results through live session events and history
+  display. The shared app renderer previews inline raster images and keeps resource URIs inert, with
+  explicit diagnostics for unsupported media instead of silently dropping it.
+- 7d9cc66: Observe scheduler queue intervals separately from pre-dispatch admission, permission and tool work.
+  Preserve valid duration totals when live trace detail is bounded, reporting invalid evidence explicitly
+  through content-free console and OTLP traces without altering dispatch, recovery or settlement.
+- Updated dependencies
+- Updated dependencies [66af868]
+- Updated dependencies [7d9cc66]
+- Updated dependencies [7d9cc66]
+- Updated dependencies [7d9cc66]
+- Updated dependencies [7d9cc66]
+- Updated dependencies [7d9cc66]
+- Updated dependencies [7d9cc66]
+- Updated dependencies [7d9cc66]
+- Updated dependencies [7d9cc66]
+- Updated dependencies [7d9cc66]
+- Updated dependencies [7d9cc66]
+- Updated dependencies [7d9cc66]
+  - @robota-sdk/agent-core@3.0.0-beta.87
+  - @robota-sdk/agent-executor@3.0.0-beta.87
+  - @robota-sdk/agent-file-authority@3.0.0-beta.87
+  - @robota-sdk/agent-interface-analytics@3.0.0-beta.87
+  - @robota-sdk/agent-interface-command@3.0.0-beta.87
+  - @robota-sdk/agent-interface-execution@3.0.0-beta.87
+  - @robota-sdk/agent-interface-session@3.0.0-beta.87
+  - @robota-sdk/agent-interface-session-mobility@3.0.0-beta.87
+  - @robota-sdk/agent-interface-transport@3.0.0-beta.87
+  - @robota-sdk/agent-roundtable@3.0.0-beta.87
+  - @robota-sdk/agent-session@3.0.0-beta.87
+  - @robota-sdk/agent-tool-defaults@3.0.0-beta.87
+  - @robota-sdk/agent-tools@3.0.0-beta.87
+
+## 3.0.0-beta.86
+
+### Patch Changes
+
+- @robota-sdk/agent-core@3.0.0-beta.86
+- @robota-sdk/agent-executor@3.0.0-beta.86
+- @robota-sdk/agent-file-authority@3.0.0-beta.86
+- @robota-sdk/agent-interface-analytics@3.0.0-beta.86
+- @robota-sdk/agent-interface-command@3.0.0-beta.86
+- @robota-sdk/agent-interface-execution@3.0.0-beta.86
+- @robota-sdk/agent-interface-session@3.0.0-beta.86
+- @robota-sdk/agent-interface-session-mobility@3.0.0-beta.86
+- @robota-sdk/agent-interface-transport@3.0.0-beta.86
+- @robota-sdk/agent-roundtable@3.0.0-beta.86
+- @robota-sdk/agent-session@3.0.0-beta.86
+- @robota-sdk/agent-tool-defaults@3.0.0-beta.86
+- @robota-sdk/agent-tools@3.0.0-beta.86
+
 ## 3.0.0-beta.85
 
 ### Minor Changes
@@ -257,7 +336,7 @@
     - Session notices keep only `session-error` and `protocol-error`.
     - The state gains `commandCatalog` and `sessionStatus`.
   - `agent-command` registers `/theme` and `/keybindings` even without a terminal. They then answer
-    that they belong to the robota terminal, instead of being unknown.
+    that they belong to the Robota terminal, instead of being unknown.
   - `agent-framework`:
     - `InteractiveSession.getStatusSnapshot()`.
     - The main-thread row previews the last chat message instead of the last record's type.
@@ -268,7 +347,7 @@
 
   - **`agent-framework`:** `supportsWorkspaceProjectMutation(platform?)` tells a host in advance whether project writes can be proven to stay under the trusted root. The project writer uses the same answer, so the two cannot disagree.
   - **`agent-cli`:**
-    - Where project writes cannot be proven safe, a trusted workspace keeps its sessions in the user session store (`~/.robota/sessions`). They are listed for that workspace by their working directory, so `/resume`, the sessions sidebar, `--continue` and `robota session list` find them. Nothing is written under the project root.
+    - Where project writes cannot be proven safe, a trusted workspace keeps its sessions in the user session store (`$PRODUCT_USER_STATE_DIR/sessions`). They are listed for that workspace by their working directory, so `/resume`, the sessions sidebar, `--continue` and `robota session list` find them. Nothing is written under the project root.
     - Before this, every save in a trusted git workspace on macOS was refused, and those surfaces listed nothing.
     - Linux keeps trusted sessions in the project, as before.
     - `robota session list`, `robota usage` and `robota session analyze` report such sessions as user sessions, never as project sessions.
@@ -389,7 +468,7 @@
     stays inside the project (every platform but Linux), none is composed: a checkpoint could be
     neither saved nor restored there.
   - `agent-command` (patch): where a session has no checkpoints, `/rewind` says why: a restricted
-    workspace is told to run `robota trust --yes` and restart robota, and a host that cannot write
+    workspace is told to run `robota trust --yes` and restart Robota, and a host that cannot write
     the project safely says so. `/rewind list` reports this as a failed command instead of throwing.
   - `agent-framework` (minor): a checkpoint operation on a session without a store throws
     `EditCheckpointsUnavailableError`, whose `reason` is `host-cannot-write-project`,
@@ -424,7 +503,7 @@
     under. `sandboxApprovalFor` is exported.
   - `agent-subagent-runner` (minor): `ISubagentWorkerComposition` takes an optional `createSandbox`. The
     worker builds that sandbox once and hands the same instance to `createTools` and to the session.
-  - `agent-cli` (patch): robota's worker composition builds the OS sandbox through `createSandbox`, so
+  - `agent-cli` (patch): Robota's worker composition builds the OS sandbox through `createSandbox`, so
     a child-process subagent approves what its parent approves.
 
 ### Patch Changes
@@ -569,7 +648,7 @@
     The tool reaches only files inside the workspace whose path does not look like it holds secrets
     (`.env*`, `~/.ssh`, keys and credentials), and it does not exist in a turn a peer's message started.
   - The receiving operator approves every file. A received file is kept as an inert copy (mode 0600)
-    under `~/.robota/peer-files/<sender>/`. It is never run and never placed in the model's context.
+    under `$PRODUCT_USER_STATE_DIR/peer-files/<sender>/`. It is never run and never placed in the model's context.
     The conversation is told only its name, size and sha256. A name that leaves that directory is
     refused, a symbolic link is never written through, and nothing is overwritten.
   - Transfers travel on a channel of their own (a separate connection on this host, a separate data
@@ -702,9 +781,9 @@
     session on an earlier version cannot confirm, so its messages are refused; both sessions need this
     version to message each other.
 
-- ec5e477: Add a credential store port (`ICredentialStore` in `agent-core`) and keep the CLI's secrets behind it: the OS keychain through the optional `@napi-rs/keyring` binding (macOS Keychain, Windows Credential Manager, Linux Secret Service), else an owner-only file under `~/.robota/credentials`. The backend is chosen at first use, recorded, and named by `/remote-control status`; a recorded keychain that stops working fails closed instead of degrading to the file.
+- ec5e477: Add a credential store port (`ICredentialStore` in `agent-core`) and keep the CLI's secrets behind it: the OS keychain through the optional `@napi-rs/keyring` binding (macOS Keychain, Windows Credential Manager, Linux Secret Service), else an owner-only file under `$PRODUCT_USER_STATE_DIR/credentials`. The backend is chosen at first use, recorded, and named by `/remote-control status`; a recorded keychain that stops working fails closed instead of degrading to the file.
 
-  The remote-control host identity key moves into the store. The old `~/.robota/remote-host-identity.json` may have been copied by backups or dotfile sync, so it is not carried over: on the first run after upgrading a new host key is generated, the old file is removed, and the operator is told once that trusted devices must pair again.
+  The remote-control host identity key moves into the store. The old `$PRODUCT_USER_STATE_DIR/remote-host-identity.json` may have been copied by backups or dotfile sync, so it is not carried over: on the first run after upgrading a new host key is generated, the old file is removed, and the operator is told once that trusted devices must pair again.
 
 - 18b52cc: Built-in commands are offered to the model deliberately, each described for the model, and never
   with a trust, credential or permission-widening action.
@@ -855,7 +934,7 @@
   with an advisor. Sending history to a destination (provider type and endpoint host) the main model
   does not already use needs a one-time consent per destination, kept in the user settings file; a
   refusal is remembered for the session. The organization's `allowedProviders` applies, and
-  `ROBOTA_DISABLE_ADVISOR=1` turns it off completely. In-process subagents inherit the advisor, bound
+  `PRODUCT_DISABLE_ADVISOR=1` turns it off completely. In-process subagents inherit the advisor, bound
   to their own conversation; child-process subagents do not get it.
 
   **`@robota-sdk/agent-framework` is `major` for one reason: `ICommandHostSessionAccess` gains a
@@ -892,8 +971,8 @@
     construction alongside `allow` and `deny`.
   - **Never auto-approved, bypass included:** removing a critical path with `rm`/`rmdir` (the root, a
     top-level directory, home, the working directory or a parent), and a modify-class write into
-    `.git`, `.robota`, `.claude`, `.agents`, `.mcp.json`, `.gitconfig`, `.npmrc` or a shell rc file.
-    Files inside an isolated worktree (`.robota/worktrees/<name>/…`) are ordinary files. With no
+    `.git`, `.Robota`, `.claude`, `.agents`, `.mcp.json`, `.gitconfig`, `.npmrc` or a shell rc file.
+    Files inside an isolated worktree (`$PRODUCT_PROJECT_STATE_DIR/worktrees/<name>/…`) are ordinary files. With no
     approver attached, an ask is a denial.
   - **A ceiling is checked before bypass and before any ask.** A subagent's `inherit-allowlist` ceiling
     is now the parent's _effective_ rules, read live at spawn: settings, preset lists and command
@@ -1187,7 +1266,7 @@
   `createModelCommandToolProjection`, and `buildPromptWithFileReferences` for SDK consumers.
 
   To preserve the previous identifiers, pass `modelCommandToolPrefix: 'robota_command_'` and
-  `promptFileReferenceTag: 'robota_file_references'` in session options, or pass those values to
+  `promptFileReferenceTag: 'PRODUCT_file_references'` in session options, or pass those values to
   the projection and prompt-format helpers. The Robota product profile supplies both values, so
   the Robota CLI keeps its existing model tool names and prompt enclosure.
 
@@ -1308,10 +1387,10 @@
 - 4078a72: Model fallback chain. `--fallback-model a,b` (or the `fallbackModel` settings array; the flag wins) names up to three models a turn moves to when its model is overloaded, unavailable or failing on the server. An entry is a provider profile, `profile:model`, a bare model on the primary's provider, or `default`. The move happens only before any output has streamed, lasts for the current turn, and is shown as a system note; entries that cannot be built are passed over and entries outside the organization's `allowedProviders` are dropped with a notice. `FallbackProvider` in agent-framework implements it over the session's provider; `IChatOptions` gains `executionId`, `onModelFallback` and `preserveContextWindow`, `IAIProvider` gains optional `resolveModelRoute`, and the execution loop emits a `provider_fallback` event and attributes requests, call observations, committed replies, the response cache and usage to the model that answered. A turn that ran on more than one model records per-model `modelShares` on its usage observation, which personal usage reports split by model and provider. A `/provider` switch keeps the chain, read again for the new primary.
 - af2f2ad: `/cd <directory>` continues the conversation in another directory.
 
-  - **A move is a new session in the target directory.** In the TUI, robota saves a copy of the
+  - **A move is a new session in the target directory.** In the TUI, Robota saves a copy of the
     conversation where the target's session store will find it, ends the current run through its
     normal end-of-life flow, and starts again in the target directory resuming that copy. The target's
-    settings, trust decision, tools, skills and `AGENTS.md` apply, exactly as if robota had been
+    settings, trust decision, tools, skills and `AGENTS.md` apply, exactly as if Robota had been
     launched there. The process boundary makes the move atomic, so no tool call can straddle it.
   - **The system prompt is kept as recorded**, so a provider's prompt cache survives. One appended
     `<workspace-move>` message tells the model the new directory, and which project instructions now
@@ -1409,7 +1488,7 @@
 - 2711ec6: One broken skill or agent file no longer stops the session.
 
   Skill, command and agent definitions are shared with other hosts through `.claude`, and those hosts
-  define fields of their own. The frontmatter decoder now validates only the fields robota owns and
+  define fields of their own. The frontmatter decoder now validates only the fields Robota owns and
   ignores the rest (nested `metadata` entries included); a malformed value of an owned field is still
   refused. A refused file is skipped with a single warning and still claims its name, so a
   lower-priority definition cannot stand in for it. An empty `argument-hint` reads as no hint. When
@@ -1457,7 +1536,7 @@
     project/user definitions > injected > built-in. `AgentDefinitionLoader` now dedupes within that tier
     (first wins). Absent ⇒ unchanged behavior.
   - **`@robota-sdk/agent-transport` / `@robota-sdk/agent-transport-tui`** — forward the optional
-    `agentDefinitions` through the headless and TUI channels so every robota surface carries the seam.
+    `agentDefinitions` through the headless and TUI channels so every Robota surface carries the seam.
   - **`@robota-sdk/agent-cli`** — `robota`'s identity (branding, provider surface, presets,
     `packs: [codingPack]`, base command modules, injected transports/runners/subagent factory) is declared as
     data in a product profile and folded by `assembleProduct`. The coding command modules (`/shell`,
@@ -1560,7 +1639,7 @@
   every `packages/*/src` production tree.
 - 4b76cfa: NEUT-005 (wave 2): restore an actionable context-capacity hint at the surface tier, neutrally. The zero-dependency `agent-core` layer emits a product-neutral hard-capacity notice and exposes the `IAgentConfig.contextCapacityHint` seam (wave 1). This wave wires that seam end-to-end without baking product vocabulary into a neutral library:
 
-  - `agent-session`: `ISessionOptions.contextCapacityHint` is forwarded into the Robota agent config (`buildRobota`), making the core seam reachable from the consuming layer.
+  - `agent-session`: `ISessionOptions.contextCapacityHint` is forwarded into the agent configuration factory, making the core seam reachable from the consuming layer.
   - `agent-framework`: new `deriveContextCapacityHint(commandModules)` derives the concrete remediation wording from the surface's OWN registered command set (names a registered `compact` command → `"Run /compact and retry."`; `undefined` when none, leaving the neutral core default). It is applied automatically in interactive session assembly across the TUI, print, and `--serve` surfaces.
   - `agent-cli`: the default command set registers `/compact`, so end users regain the actionable hint.
   - `agent-interface-transport`: reworded the `'allow-project'` permission comment so it no longer hardcodes a storage path (the location is owned by the consuming layer), matching the `agent-session` twin.
@@ -1573,7 +1652,7 @@
   constructor-injectable with the previous bilingual/dev set as the documented default; session-name
   sanitizer is Unicode-aware (non-Latin titles preserved).
 - 90e7a10: The default background observer warning code and exported `OBSERVER_FAILURE_WARNING_CODE` value
-  change from `ROBOTA_BACKGROUND_OBSERVER_FAILURE` to `BACKGROUND_OBSERVER_FAILURE`. Hosts matching
+  change from `PRODUCT_BACKGROUND_OBSERVER_FAILURE` to `BACKGROUND_OBSERVER_FAILURE`. Hosts matching
   the old warning code should match the new neutral code or provide `observerFailureWarningCode` in
   their background manager or session options. The Robota CLI supplies its existing code explicitly
   across print, goal, serve, MCP, and TUI sessions.
@@ -1978,7 +2057,7 @@
 
   - **Preset system (PRESET-001~017):** new `@robota-sdk/agent-preset` package layering framework
     assembly options into named, selectable profiles (`default`, `autonomous-builder`, `careful-reviewer`,
-    `neutral-executor`) plus user-authored external presets loaded from `~/.robota/presets/*.json`.
+    `neutral-executor`) plus user-authored external presets loaded from `$PRODUCT_USER_STATE_DIR/presets/*.json`.
   - **Live preset switching:** `/preset` command (list + active marker + switch) and a TUI active-preset
     display. Switching live re-applies permission posture, model/effort, persona, command-module
     selection, parallel-subagents gating, and a self-verification system-prompt section via the single
@@ -2199,7 +2278,7 @@
 
 ### Patch Changes
 
-- Refresh package docs and robota.io content for the beta 57 feature set.
+- Refresh package docs and Robota.io content for the beta 57 feature set.
 - Updated dependencies
   - @robota-sdk/agent-core@3.0.0-beta.58
   - @robota-sdk/agent-executor@3.0.0-beta.58

package/README.md

@@ -14,8 +14,8 @@ It has three main entry points:
   one configuration, for headless and multi-session hosts.
 
 The package has no React dependency, and it never imports a concrete provider: you create the
-provider (for example from `@robota-sdk/agent-provider-anthropic`) and pass it in. The `robota` CLI
-(`@robota-sdk/agent-cli`) is a reference app built on this package.
+provider (for example from `@robota-sdk/agent-provider-anthropic`) and pass it in. The configured CLI
+(`@robota-sdk/agent-cli`) is a maintained agent interface built on this package.
 
 For walkthroughs, see the [SDK guide](../../content/guide/sdk.md) and
 [Building agents](../../content/guide/building-agents.md).
@@ -26,7 +26,7 @@ For walkthroughs, see the [SDK guide](../../content/guide/sdk.md) and
 npm install @robota-sdk/agent-framework @robota-sdk/agent-provider-anthropic
 ```
 
-Requires Node.js 22.12 or later. `InteractiveSession` and `createQuery` work with any Robota provider
+Requires Node.js 22.12 or later. `InteractiveSession` and `createQuery` work with any provider
 package given a `model`; without one they use the settings files, or Anthropic's default model.
 
 ## Quick start
@@ -230,7 +230,7 @@ const session = runtime.createSession({ permissionMode: 'plan' });
 
 `buildRuntimeSession()` is the one place a session is built from resolved options, and
 `startRuntimeHost()` adds transport start/stop and a bounded shutdown on top of it; the CLI's
-`robota --serve` uses both. `SessionPool` keeps several live sessions for a runtime that serves more
+`<cli-name> --serve` uses both. `SessionPool` keeps several live sessions for a runtime that serves more
 than one client. Headless output is available through `createHeadlessRunner` and
 `createHeadlessTransport`, and `createProgrammaticAgent` drives a session from code.
 
@@ -378,15 +378,60 @@ that supports snapshots, `shutdown()` stores the sandbox snapshot ID, and resumi
 | Self-hosting verification   | `planSelfHostingVerification`, `transitionSelfHostingLoop`                                            |
 
 Bundle plugins use the Claude Code plugin layout: a directory with `.claude-plugin/plugin.json`
-(`name`, `version`, `description`, `features`) that can contribute skills, commands, hooks, MCP
-server configuration and agent definitions.
+(`name` is required; `version` and `description` are optional) that can contribute skills,
+commands, hooks, MCP server configuration and agent definitions. The loader selects the source
+recorded in `installed_plugins.json`, validates its cache location and refuses invalid or missing
+selected sources. Without a registry, a single cached revision is supported; multiple revisions
+require an explicit installation record and are reported as `revision-unselected`. Cache directory
+sorting never selects an execution source. Missing manifest versions remain absent. Enablement
+checks both the installed identity and the manifest name, so renaming a manifest cannot bypass a
+disabled installation. MCP dispatch revalidates this selection; other component lifetimes remain
+owned by their host execution surfaces.
+
+The loader also exposes a versioned `IContributionDescriptor` on each loaded bundle. It binds
+installed identity, cache revision and source location to namespaced contributions and required
+host capabilities without importing contributor code or exposing MCP credential values. A
+supported declaration still requires host admission. Agent names without execution definitions
+are unavailable; unconsumed custom component paths and invalid transports carry compatibility
+diagnostics. The descriptor records host ownership of active-call policy; it does not establish
+live retirement behavior for every component kind.
+
+The documented MCP declaration subset supports `mcpServers` as a plugin-relative `./` JSON path,
+an inline server map, or an ordered array of either. The default `.mcp.json` is read first; later
+declarations replace whole server entries, with each winning entry retaining its declaring file.
+Paths are checked against the selected installed revision, including symlinks. Unsupported paths
+and malformed declarations produce value-free compatibility codes. Binary MCP bundles are not
+supported by this adapter. See the [foreign manifest reference](https://code.claude.com/docs/en/plugins-reference).
+
+CLI and app startup route these definitions through the existing `plugin` MCP source tier, with
+`plugin-name:server-name` identities, ordinary precedence, workspace trust, approval and host stdio
+authority. Inspection never connects. `${CLAUDE_PLUGIN_ROOT}` resolves to the selected plugin root;
+other environment materialization remains owned by the MCP definition layer. Startup honors the
+current disable overlay. Before each MCP call the host rereads enablement and the selected source;
+disable, uninstall, source replacement or changed trust refuses new dispatch. Already dispatched
+calls settle with their real outcomes. Fresh startup reuses durable approvals only when their
+source identity and trust still match; a new revision cannot silently replace an in-flight tool.
+
+The documented MCP declaration subset supports `mcpServers` as a plugin-relative `./` JSON path,
+an inline server map, or an ordered array of either. The default `.mcp.json` is read first; later
+declarations replace whole server entries, with each winning entry retaining its declaring file.
+Paths are checked against the selected installed revision, including symlinks. Unsupported paths
+and malformed declarations produce value-free compatibility codes. Binary MCP bundles are not
+supported by this adapter. See the [foreign manifest reference](https://code.claude.com/docs/en/plugins-reference).
+
+CLI and app startup route these definitions through the existing `plugin` MCP source tier, with
+`plugin-name:server-name` identities, ordinary precedence, workspace trust, approval and host stdio
+authority. Inspection never connects. `${CLAUDE_PLUGIN_ROOT}` resolves to the selected plugin root;
+other environment materialization remains owned by the MCP definition layer. Startup honors the
+current disable overlay; active-chain update/disable and restored-work revalidation still require
+their separate lifecycle implementation.
 
 ## Settings
 
 Settings are JSON files merged in the order the host gives them, later layers winning.
-`$ENV:NAME` values in provider credentials are replaced with the environment variable. The Robota
-CLI reads `~/.robota/settings.json`, `~/.claude/settings.json`, `.robota/settings.json`,
-`.robota/settings.local.json`, `.claude/settings.json` and `.claude/settings.local.json`, in that
+`$ENV:NAME` values in provider credentials are replaced with the environment variable. The configured
+CLI reads `$PRODUCT_USER_STATE_DIR/settings.json`, `~/.claude/settings.json`, `$PRODUCT_PROJECT_STATE_DIR/settings.json`,
+`$PRODUCT_PROJECT_STATE_DIR/settings.local.json`, `.claude/settings.json` and `.claude/settings.local.json`, in that
 order; project files are read only in a trusted project.
 
 ```json
@@ -433,4 +478,4 @@ examples (no provider credentials needed).
 
 ## License
 
-Robota is dual-licensed under the [GNU AGPL-3.0](../../LICENSE) or a [commercial license](../../COMMERCIAL.md). See [LICENSING.md](../../LICENSING.md).
+This package is dual-licensed under the [GNU AGPL-3.0](../../LICENSE) or a [commercial license](../../COMMERCIAL.md). See [LICENSING.md](../../LICENSING.md).