@securecoms/agent-bridge 0.8.0 → 0.9.0

package/dist/bin.js

@@ -27,6 +27,8 @@ function loadConfig(opts) {
   let memoryProvider;
   let memoryBaseDir;
   let memoryAgent;
+  let memoryWorkspaceDir;
+  let memoryFactsCharBudget;
   if (memProvRaw === "none") {
     memoryProvider = "none";
   } else if (memProvRaw === "hermes") {
@@ -40,6 +42,10 @@ function loadConfig(opts) {
     memoryBaseDir = typeof bd === "string" && bd ? bd : "~/.openclaw";
     const ag = oc?.agent;
     memoryAgent = typeof ag === "string" && ag ? ag : void 0;
+    const wd = oc?.workspace_dir;
+    memoryWorkspaceDir = typeof wd === "string" && wd ? wd : void 0;
+    const fb = oc?.facts_char_budget;
+    memoryFactsCharBudget = typeof fb === "number" && Number.isInteger(fb) && fb >= 0 ? fb : void 0;
   } else {
     memoryProvider = "securecoms";
   }
@@ -56,7 +62,9 @@ function loadConfig(opts) {
     rateLimitRefillPerMinute,
     memoryProvider,
     memoryBaseDir,
-    memoryAgent
+    memoryAgent,
+    memoryWorkspaceDir,
+    memoryFactsCharBudget
   };
 }
 function arg(argv, flag) {
@@ -3947,7 +3955,7 @@ function loadPackageMeta(importMetaUrl) {
 
 // src/bridge-agent.ts
 import { promises as fsp } from "node:fs";
-import { join as join7, dirname as dirname3 } from "node:path";
+import { join as join8, dirname as dirname3 } from "node:path";
 
 // src/latency.ts
 var DEFAULT_CAPACITY = 1024;
@@ -4460,29 +4468,153 @@ function readRecentTurns(baseDir, agent, sessionId, k) {
   return k > 0 ? turns.slice(-k) : [];
 }
 
+// src/memory/openclaw-workspace-facts.ts
+import { readdirSync, readFileSync as readFileSync5, statSync as statSync2 } from "node:fs";
+import { join as join7 } from "node:path";
+var DEFAULT_FACTS_BUDGET = 8e3;
+var MEMORY_MD_CAP = 6e3;
+var MIN_FRAGMENT = 200;
+var MAX_SOURCE_BYTES = 1024 * 1024;
+var DAILY_RE = /^\d{4}-\d{2}-\d{2}\.md$/;
+function resolveWorkspaceDir(baseDir, agent, override) {
+  if (override) return expandHome(override);
+  const base = expandHome(baseDir);
+  const isMain2 = agent === "" || agent === "main";
+  try {
+    const cfg = JSON.parse(readFileSync5(join7(base, "openclaw.json"), "utf8"));
+    const agents = cfg?.agents;
+    if (agents && typeof agents === "object") {
+      const list = Array.isArray(agents.list) ? agents.list : [];
+      const wanted = isMain2 ? "main" : agent;
+      const entry = list.find((e) => e && typeof e === "object" && e.id === wanted);
+      const ws = entry?.workspace;
+      if (typeof ws === "string" && ws) return expandHome(ws);
+      const def = agents.defaults?.workspace;
+      if (typeof def === "string" && def) return expandHome(def);
+    }
+  } catch {
+  }
+  return isMain2 ? join7(base, "workspace") : join7(base, `workspace-${agent}`);
+}
+var TRUNC = "\u2026[truncated]";
+function headSlice(s, n) {
+  if (s.length <= n) return { text: s, clipped: false };
+  let out = s.slice(0, n);
+  const last = out.charCodeAt(out.length - 1);
+  if (last >= 55296 && last <= 56319) out = out.slice(0, -1);
+  return { text: out, clipped: true };
+}
+function tailSlice(s, n) {
+  if (s.length <= n) return { text: s, clipped: false };
+  let out = s.slice(s.length - n);
+  const first = out.charCodeAt(0);
+  if (first >= 56320 && first <= 57343) out = out.slice(1);
+  return { text: out, clipped: true };
+}
+function readBounded(path) {
+  if (statSync2(path).size > MAX_SOURCE_BYTES) return { text: null, oversize: true };
+  return { text: readFileSync5(path, "utf8"), oversize: false };
+}
+function readWorkspaceFacts(baseDir, agent, opts) {
+  const raw = opts?.charBudget;
+  const budget = typeof raw === "number" && Number.isInteger(raw) && raw >= 0 ? raw : DEFAULT_FACTS_BUDGET;
+  if (budget === 0) return { facts: [], truncated: false, missing: false };
+  const dir = resolveWorkspaceDir(baseDir, agent, opts?.workspaceDir);
+  const facts = [];
+  let truncated = false;
+  let remaining = budget;
+  try {
+    const r = readBounded(join7(dir, "MEMORY.md"));
+    if (r.oversize) truncated = true;
+    else if (r.text && r.text.trim()) {
+      const { text, clipped } = headSlice(r.text, Math.min(MEMORY_MD_CAP, budget));
+      truncated ||= clipped;
+      facts.push(`workspace MEMORY.md:
+${text}${clipped ? `
+${TRUNC}` : ""}`);
+      remaining -= text.length;
+    }
+  } catch {
+  }
+  try {
+    const dailies = readdirSync(join7(dir, "memory")).filter((f) => DAILY_RE.test(f)).sort().reverse().slice(0, 2);
+    for (const f of dailies) {
+      if (remaining < MIN_FRAGMENT) {
+        truncated = true;
+        break;
+      }
+      let r;
+      try {
+        r = readBounded(join7(dir, "memory", f));
+      } catch {
+        continue;
+      }
+      if (r.oversize) {
+        truncated = true;
+        continue;
+      }
+      if (!r.text || !r.text.trim()) continue;
+      const { text, clipped } = tailSlice(r.text, remaining);
+      truncated ||= clipped;
+      facts.push(`workspace memory/${f} (daily):
+${clipped ? `${TRUNC}
+` : ""}${text}`);
+      remaining -= text.length;
+    }
+  } catch {
+  }
+  return { facts, truncated, missing: facts.length === 0 };
+}
+
 // src/memory/openclaw-provider.ts
 var DEFAULT_K2 = 200;
 var OpenClawMemoryProvider = class {
-  constructor(store, baseDir, agent) {
+  // gauge: last successful returned total, including prefixes/markers
+  constructor(store, baseDir, agent, factsOpts) {
     this.store = store;
     this.baseDir = baseDir;
     this.agent = agent;
+    this.factsOpts = factsOpts;
   }
   noSession = 0;
   readFailed = 0;
+  factsMissing = 0;
+  // absence-shaped: resolved path missing or zero sources (per-call)
+  factsReadFailed = 0;
+  // anything THROWN out of the facts computation
+  factsTruncated = 0;
+  // budget clipped/dropped a source (incl. the 1MB skip)
+  factsChars = 0;
   async record(input) {
     if (input.modality !== "voice") return { seq: 0, deduped: true };
     return this.store.recordMemory({ ...input, text: `[voice] ${input.text}` });
   }
   async context(conversationId, limit) {
     const k = limit ?? DEFAULT_K2;
+    let wsFacts = [];
+    try {
+      const r = readWorkspaceFacts(this.baseDir, this.agent, {
+        workspaceDir: this.factsOpts?.workspaceDir,
+        charBudget: this.factsOpts?.factsCharBudget
+      });
+      wsFacts = r.facts;
+      if (r.missing) this.factsMissing++;
+      if (r.truncated) this.factsTruncated++;
+      this.factsChars = r.facts.reduce((n, f) => n + f.length, 0);
+    } catch {
+      this.factsReadFailed++;
+    }
+    const withFacts = (res) => ({
+      recent: res.recent,
+      facts: [...wsFacts, ...res.facts]
+    });
     const voice = await this.store.memoryContext(conversationId, k);
     let textTurns = [];
     try {
       const sid = resolveOwnerDmSession(this.baseDir, this.agent);
       if (!sid) {
         this.noSession++;
-        return voice;
+        return withFacts(voice);
       }
       textTurns = readRecentTurns(this.baseDir, this.agent, sid, k).map((t) => ({
         seq: 0,
@@ -4492,7 +4624,7 @@ var OpenClawMemoryProvider = class {
       }));
     } catch {
       this.readFailed++;
-      return voice;
+      return withFacts(voice);
     }
     const tagged = [
       ...textTurns.map((t, i) => ({ ...t, _src: 0, _i: i })),
@@ -4511,10 +4643,17 @@ var OpenClawMemoryProvider = class {
       text: t.text,
       ts: t.ts
     }));
-    return { recent, facts: voice.facts };
+    return withFacts({ recent, facts: voice.facts });
   }
   stats() {
-    return { openclaw_no_session: this.noSession, openclaw_read_failed: this.readFailed };
+    return {
+      openclaw_no_session: this.noSession,
+      openclaw_read_failed: this.readFailed,
+      openclaw_facts_missing: this.factsMissing,
+      openclaw_facts_read_failed: this.factsReadFailed,
+      openclaw_facts_truncated: this.factsTruncated,
+      openclaw_facts_chars: this.factsChars
+    };
   }
 };
 
@@ -4538,10 +4677,10 @@ var NullMemory = class {
     return { recent: [], facts: [] };
   }
 };
-function createMemoryProvider(provider, store, baseDir, agent) {
+function createMemoryProvider(provider, store, baseDir, agent, openclawFacts) {
   if (provider === "none") return new NullMemory();
   if (provider === "hermes") return new HermesMemoryProvider(baseDir ?? "~/.hermes");
-  if (provider === "openclaw") return new OpenClawMemoryProvider(store, baseDir ?? "~/.openclaw", agent ?? "");
+  if (provider === "openclaw") return new OpenClawMemoryProvider(store, baseDir ?? "~/.openclaw", agent ?? "", openclawFacts);
   return new SecureComsLocalMemory(store);
 }
 
@@ -4649,7 +4788,10 @@ var BridgeAgent = class _BridgeAgent {
       identityId: cfg.identityId,
       cipherFor: () => new KeyedInboxCipher(deriveMlsStoreKey(seed))
     });
-    this.memory = createMemoryProvider(this.cfg.memoryProvider, this.store, this.cfg.memoryBaseDir, this.cfg.memoryAgent);
+    this.memory = createMemoryProvider(this.cfg.memoryProvider, this.store, this.cfg.memoryBaseDir, this.cfg.memoryAgent, {
+      workspaceDir: this.cfg.memoryWorkspaceDir,
+      factsCharBudget: this.cfg.memoryFactsCharBudget
+    });
     this.provider = new MlsGroupKeyProvider({
       store: this.store,
       backend: this.backend,
@@ -4729,7 +4871,7 @@ var BridgeAgent = class _BridgeAgent {
       const j = await res.json();
       return String(j.attachment_id);
     };
-    this.attachmentsDirImpl = deps.attachmentsDir ?? join7(dirname3(cfg.storePath), "attachments");
+    this.attachmentsDirImpl = deps.attachmentsDir ?? join8(dirname3(cfg.storePath), "attachments");
     this.action = {
       begin: (channelId) => this.actionBegin(channelId),
       start: (opts) => this.actionStart(opts),
@@ -6257,11 +6399,11 @@ var BridgeAgent = class _BridgeAgent {
 
 // src/auth.ts
 import { randomBytes as randomBytes3, timingSafeEqual } from "node:crypto";
-import { existsSync, readFileSync as readFileSync5, writeFileSync } from "node:fs";
+import { existsSync, readFileSync as readFileSync6, writeFileSync } from "node:fs";
 function resolveToken(opts) {
   if (opts.token) return opts.token;
   const f = opts.tokenFile;
-  if (f && existsSync(f)) return readFileSync5(f, "utf8").trim();
+  if (f && existsSync(f)) return readFileSync6(f, "utf8").trim();
   const tok = randomBytes3(32).toString("base64url");
   if (f) writeFileSync(f, tok, { mode: 384 });
   return tok;
@@ -6832,8 +6974,8 @@ async function handleInbound(sock, agent, data, inflight) {
 }
 
 // src/bin.ts
-import { readFileSync as readFileSync7, mkdirSync as mkdirSync2, writeFileSync as writeFileSync3, rmSync, existsSync as existsSync2, realpathSync, readdirSync, statSync as statSync2 } from "node:fs";
-import { join as join11, dirname as dirname7, isAbsolute as isAbsolute2, resolve as resolve2 } from "node:path";
+import { readFileSync as readFileSync8, mkdirSync as mkdirSync2, writeFileSync as writeFileSync3, rmSync, existsSync as existsSync2, realpathSync, readdirSync as readdirSync2, statSync as statSync3 } from "node:fs";
+import { join as join12, dirname as dirname7, isAbsolute as isAbsolute2, resolve as resolve2 } from "node:path";
 import { fileURLToPath as fileURLToPath2 } from "node:url";
 import { homedir as homedir2, userInfo } from "node:os";
 import { spawnSync } from "node:child_process";
@@ -7042,10 +7184,10 @@ function uninstallService(input, deps) {
 }
 
 // src/service/install-prep.ts
-import { join as join9 } from "node:path";
+import { join as join10 } from "node:path";
 
 // src/service/wire.ts
-import { join as join8, dirname as dirname5 } from "node:path";
+import { join as join9, dirname as dirname5 } from "node:path";
 import { fileURLToPath } from "node:url";
 
 // src/service/hermes-config.ts
@@ -7211,7 +7353,7 @@ function connectorTargetDir(home, harness) {
 }
 function connectorsSrcDir(importMetaUrl, harness) {
   const pkgRoot = dirname5(dirname5(fileURLToPath(importMetaUrl)));
-  return join8(pkgRoot, "connectors", harness);
+  return join9(pkgRoot, "connectors", harness);
 }
 function hermesConfigPath(home) {
   return `${home}/.hermes/config.yaml`;
@@ -7430,10 +7572,10 @@ function assertReadableCredential(absPath, deps) {
   return { deviceId: json2.device_id, identityId: json2.identity_id, issuedAt };
 }
 function durableDir(home, slug) {
-  return join9(home, `securecoms-agent-${slug}`);
+  return join10(home, `securecoms-agent-${slug}`);
 }
 function durableCredentialPath(home, slug) {
-  return join9(durableDir(home, slug), `${slug}.json`);
+  return join10(durableDir(home, slug), `${slug}.json`);
 }
 function takeCustody(args2, deps) {
   const dir = durableDir(args2.home, args2.slug);
@@ -7480,7 +7622,7 @@ function readSiblingDefs(dir, prefix, deps) {
   for (const n of names) {
     if (!n.startsWith(prefix)) continue;
     try {
-      out.push(deps.readFile(join9(dir, n)));
+      out.push(deps.readFile(join10(dir, n)));
     } catch {
     }
   }
@@ -7676,29 +7818,29 @@ function renderStatusTable(rows) {
 import {
   chmodSync,
   mkdirSync,
-  readFileSync as readFileSync6,
+  readFileSync as readFileSync7,
   renameSync,
   unlinkSync,
   writeFileSync as writeFileSync2
 } from "node:fs";
 import { randomUUID } from "node:crypto";
-import { join as join10 } from "node:path";
+import { join as join11 } from "node:path";
 var REAL_FS = {
   mkdir: (p, mode) => mkdirSync(p, { recursive: true, mode }),
   chmod: (p, mode) => chmodSync(p, mode),
   writeFile: (p, data, mode) => writeFileSync2(p, data, { mode }),
   rename: (a, b) => renameSync(a, b),
-  readFile: (p) => readFileSync6(p, "utf8"),
+  readFile: (p) => readFileSync7(p, "utf8"),
   unlink: (p) => unlinkSync(p)
 };
 function securecomsDir(home) {
-  return join10(home, ".securecoms");
+  return join11(home, ".securecoms");
 }
 function connectionsDir(home) {
-  return join10(securecomsDir(home), "connections");
+  return join11(securecomsDir(home), "connections");
 }
 function connectionFilePath(home, identityId) {
-  return join10(connectionsDir(home), `${identityId}.json`);
+  return join11(connectionsDir(home), `${identityId}.json`);
 }
 function newInstanceId() {
   return randomUUID();
@@ -7813,7 +7955,7 @@ function realResolveDeps() {
 }
 function realPrepDeps() {
   return {
-    readFile: (p) => readFileSync7(p, "utf8"),
+    readFile: (p) => readFileSync8(p, "utf8"),
     writeFileMode: (p, data, mode) => writeFileSync3(p, data, { mode }),
     mkdirp: (p, mode) => {
       mkdirSync2(p, { recursive: true, mode: mode ?? 493 });
@@ -7822,7 +7964,7 @@ function realPrepDeps() {
     realpath: (p) => realpathSync(p),
     listDir: (p) => {
       try {
-        return readdirSync(p);
+        return readdirSync2(p);
       } catch {
         return [];
       }
@@ -7864,12 +8006,12 @@ function realReadFleet() {
     home: homedir2(),
     listDir: (p) => {
       try {
-        return readdirSync(p);
+        return readdirSync2(p);
       } catch {
         return [];
       }
     },
-    readFile: (p) => readFileSync7(p, "utf8")
+    readFile: (p) => readFileSync8(p, "utf8")
   });
 }
 function runStatus() {
@@ -7892,43 +8034,43 @@ function runStatus() {
 function realCopyConnector(srcDir, dstDir, harness) {
   const allowedExt = CONNECTOR_FILE_EXTENSIONS[harness];
   mkdirSync2(dstDir, { recursive: true });
-  for (const name of readdirSync(srcDir)) {
-    const srcPath = join11(srcDir, name);
-    if (statSync2(srcPath).isDirectory()) {
+  for (const name of readdirSync2(srcDir)) {
+    const srcPath = join12(srcDir, name);
+    if (statSync3(srcPath).isDirectory()) {
       if (CONNECTOR_SKIP_DIRS.has(name)) continue;
-      realCopyConnector(srcPath, join11(dstDir, name), harness);
+      realCopyConnector(srcPath, join12(dstDir, name), harness);
       continue;
     }
     if (name.includes(".test.")) continue;
     if (!allowedExt.some((ext) => name.endsWith(ext))) continue;
-    writeFileSync3(join11(dstDir, name), readFileSync7(srcPath));
+    writeFileSync3(join12(dstDir, name), readFileSync8(srcPath));
   }
 }
 function realWriteBinding(dstDir, identityId) {
   mkdirSync2(dstDir, { recursive: true });
-  writeFileSync3(join11(dstDir, "securecoms.binding.json"), JSON.stringify({ identity_id: identityId }) + "\n", { mode: 384 });
+  writeFileSync3(join12(dstDir, "securecoms.binding.json"), JSON.stringify({ identity_id: identityId }) + "\n", { mode: 384 });
 }
 function realReadBinding(dstDir) {
   try {
-    const parsed = JSON.parse(readFileSync7(join11(dstDir, "securecoms.binding.json"), "utf8"));
+    const parsed = JSON.parse(readFileSync8(join12(dstDir, "securecoms.binding.json"), "utf8"));
     return parsed.identity_id ?? null;
   } catch {
     return null;
   }
 }
 function realRemoveBinding(dstDir) {
-  rmSync(join11(dstDir, "securecoms.binding.json"), { force: true });
+  rmSync(join12(dstDir, "securecoms.binding.json"), { force: true });
 }
 function realStatDir(p) {
   try {
-    return statSync2(p).isDirectory();
+    return statSync3(p).isDirectory();
   } catch {
     return false;
   }
 }
 function realReadHermesConfig(p) {
   try {
-    return readFileSync7(p, "utf8");
+    return readFileSync8(p, "utf8");
   } catch {
     return null;
   }
@@ -8087,11 +8229,11 @@ async function main() {
 `);
     process.exit(1);
   }
-  const tokenFile = daemon.tokenFile ?? join11(dirname7(credentialPath), "bridge-token");
+  const tokenFile = daemon.tokenFile ?? join12(dirname7(credentialPath), "bridge-token");
   const token = resolveToken({ tokenFile, token: daemon.token });
   const agent = new BridgeAgent(cfg);
   await agent.start();
-  const tls = daemon.tls ? { cert: readFileSync7(daemon.tlsCert, "utf8"), key: readFileSync7(daemon.tlsKey, "utf8") } : void 0;
+  const tls = daemon.tls ? { cert: readFileSync8(daemon.tlsCert, "utf8"), key: readFileSync8(daemon.tlsKey, "utf8") } : void 0;
   const { server, closeAllSseStreams } = createHttpServer(agent, { token, allowOrigins: daemon.allowOrigins, tls, websocket: true });
   const agentWs = attachAgentWebSocket(server, agent, { token, allowOrigins: daemon.allowOrigins });
   let down = false;

package/dist/bridge-agent.d.ts

@@ -842,6 +842,10 @@ export declare class BridgeAgent {
         hermes_write_failed?: number;
         openclaw_no_session?: number;
         openclaw_read_failed?: number;
+        openclaw_facts_missing?: number;
+        openclaw_facts_read_failed?: number;
+        openclaw_facts_truncated?: number;
+        openclaw_facts_chars?: number;
     };
     /**
      * Loopback observability snapshot served at GET /v1/metrics.

package/dist/config.d.ts

@@ -23,6 +23,10 @@ export interface BridgeConfig {
     memoryBaseDir?: string;
     /** For memoryProvider="openclaw": the OpenClaw agent dir slug, e.g. "cortina" (→ <base_dir>/agents/<agent>/). */
     memoryAgent?: string;
+    /** For memoryProvider="openclaw": explicit workspace dir override; wins over openclaw.json (spec D4 rung 1). */
+    memoryWorkspaceDir?: string;
+    /** For memoryProvider="openclaw": total facts cap in UTF-16 code units. 0 = facts kill switch (preserved via ?? downstream, never ||). Absent/junk → provider default 8000. */
+    memoryFactsCharBudget?: number;
 }
 export declare const REQUIRED: readonly ["api_key", "identity_id", "device_id", "signing_private_key", "enclave_id", "api_base"];
 export declare function loadConfig(opts: {

package/dist/http-server.d.ts

@@ -34,7 +34,7 @@ export declare const memoryRecordSchema: z.ZodEffects<z.ZodObject<{
     message_id: z.ZodOptional<z.ZodString>;
     idempotency_key: z.ZodOptional<z.ZodString>;
 }, "strip", z.ZodTypeAny, {
-    role: "peer" | "agent";
+    role: "agent" | "peer";
     text: string;
     conversation_id: string;
     modality: "text" | "voice";
@@ -42,7 +42,7 @@ export declare const memoryRecordSchema: z.ZodEffects<z.ZodObject<{
     idempotency_key?: string | undefined;
     peer_id?: string | undefined;
 }, {
-    role: "peer" | "agent";
+    role: "agent" | "peer";
     text: string;
     conversation_id: string;
     modality: "text" | "voice";
@@ -50,7 +50,7 @@ export declare const memoryRecordSchema: z.ZodEffects<z.ZodObject<{
     idempotency_key?: string | undefined;
     peer_id?: string | undefined;
 }>, {
-    role: "peer" | "agent";
+    role: "agent" | "peer";
     text: string;
     conversation_id: string;
     modality: "text" | "voice";
@@ -58,7 +58,7 @@ export declare const memoryRecordSchema: z.ZodEffects<z.ZodObject<{
     idempotency_key?: string | undefined;
     peer_id?: string | undefined;
 }, {
-    role: "peer" | "agent";
+    role: "agent" | "peer";
     text: string;
     conversation_id: string;
     modality: "text" | "voice";

package/dist/index.js

@@ -3811,7 +3811,7 @@ function loadPackageMeta(importMetaUrl) {
 
 // src/bridge-agent.ts
 import { promises as fsp } from "node:fs";
-import { join as join5, dirname } from "node:path";
+import { join as join6, dirname } from "node:path";
 
 // src/latency.ts
 var DEFAULT_CAPACITY = 1024;
@@ -4324,29 +4324,153 @@ function readRecentTurns(baseDir, agent, sessionId, k) {
   return k > 0 ? turns.slice(-k) : [];
 }
 
+// src/memory/openclaw-workspace-facts.ts
+import { readdirSync, readFileSync as readFileSync4, statSync } from "node:fs";
+import { join as join5 } from "node:path";
+var DEFAULT_FACTS_BUDGET = 8e3;
+var MEMORY_MD_CAP = 6e3;
+var MIN_FRAGMENT = 200;
+var MAX_SOURCE_BYTES = 1024 * 1024;
+var DAILY_RE = /^\d{4}-\d{2}-\d{2}\.md$/;
+function resolveWorkspaceDir(baseDir, agent, override) {
+  if (override) return expandHome(override);
+  const base = expandHome(baseDir);
+  const isMain = agent === "" || agent === "main";
+  try {
+    const cfg = JSON.parse(readFileSync4(join5(base, "openclaw.json"), "utf8"));
+    const agents = cfg?.agents;
+    if (agents && typeof agents === "object") {
+      const list = Array.isArray(agents.list) ? agents.list : [];
+      const wanted = isMain ? "main" : agent;
+      const entry = list.find((e) => e && typeof e === "object" && e.id === wanted);
+      const ws = entry?.workspace;
+      if (typeof ws === "string" && ws) return expandHome(ws);
+      const def = agents.defaults?.workspace;
+      if (typeof def === "string" && def) return expandHome(def);
+    }
+  } catch {
+  }
+  return isMain ? join5(base, "workspace") : join5(base, `workspace-${agent}`);
+}
+var TRUNC = "\u2026[truncated]";
+function headSlice(s, n) {
+  if (s.length <= n) return { text: s, clipped: false };
+  let out = s.slice(0, n);
+  const last = out.charCodeAt(out.length - 1);
+  if (last >= 55296 && last <= 56319) out = out.slice(0, -1);
+  return { text: out, clipped: true };
+}
+function tailSlice(s, n) {
+  if (s.length <= n) return { text: s, clipped: false };
+  let out = s.slice(s.length - n);
+  const first = out.charCodeAt(0);
+  if (first >= 56320 && first <= 57343) out = out.slice(1);
+  return { text: out, clipped: true };
+}
+function readBounded(path) {
+  if (statSync(path).size > MAX_SOURCE_BYTES) return { text: null, oversize: true };
+  return { text: readFileSync4(path, "utf8"), oversize: false };
+}
+function readWorkspaceFacts(baseDir, agent, opts) {
+  const raw = opts?.charBudget;
+  const budget = typeof raw === "number" && Number.isInteger(raw) && raw >= 0 ? raw : DEFAULT_FACTS_BUDGET;
+  if (budget === 0) return { facts: [], truncated: false, missing: false };
+  const dir = resolveWorkspaceDir(baseDir, agent, opts?.workspaceDir);
+  const facts = [];
+  let truncated = false;
+  let remaining = budget;
+  try {
+    const r = readBounded(join5(dir, "MEMORY.md"));
+    if (r.oversize) truncated = true;
+    else if (r.text && r.text.trim()) {
+      const { text, clipped } = headSlice(r.text, Math.min(MEMORY_MD_CAP, budget));
+      truncated ||= clipped;
+      facts.push(`workspace MEMORY.md:
+${text}${clipped ? `
+${TRUNC}` : ""}`);
+      remaining -= text.length;
+    }
+  } catch {
+  }
+  try {
+    const dailies = readdirSync(join5(dir, "memory")).filter((f) => DAILY_RE.test(f)).sort().reverse().slice(0, 2);
+    for (const f of dailies) {
+      if (remaining < MIN_FRAGMENT) {
+        truncated = true;
+        break;
+      }
+      let r;
+      try {
+        r = readBounded(join5(dir, "memory", f));
+      } catch {
+        continue;
+      }
+      if (r.oversize) {
+        truncated = true;
+        continue;
+      }
+      if (!r.text || !r.text.trim()) continue;
+      const { text, clipped } = tailSlice(r.text, remaining);
+      truncated ||= clipped;
+      facts.push(`workspace memory/${f} (daily):
+${clipped ? `${TRUNC}
+` : ""}${text}`);
+      remaining -= text.length;
+    }
+  } catch {
+  }
+  return { facts, truncated, missing: facts.length === 0 };
+}
+
 // src/memory/openclaw-provider.ts
 var DEFAULT_K2 = 200;
 var OpenClawMemoryProvider = class {
-  constructor(store, baseDir, agent) {
+  // gauge: last successful returned total, including prefixes/markers
+  constructor(store, baseDir, agent, factsOpts) {
     this.store = store;
     this.baseDir = baseDir;
     this.agent = agent;
+    this.factsOpts = factsOpts;
   }
   noSession = 0;
   readFailed = 0;
+  factsMissing = 0;
+  // absence-shaped: resolved path missing or zero sources (per-call)
+  factsReadFailed = 0;
+  // anything THROWN out of the facts computation
+  factsTruncated = 0;
+  // budget clipped/dropped a source (incl. the 1MB skip)
+  factsChars = 0;
   async record(input) {
     if (input.modality !== "voice") return { seq: 0, deduped: true };
     return this.store.recordMemory({ ...input, text: `[voice] ${input.text}` });
   }
   async context(conversationId, limit) {
     const k = limit ?? DEFAULT_K2;
+    let wsFacts = [];
+    try {
+      const r = readWorkspaceFacts(this.baseDir, this.agent, {
+        workspaceDir: this.factsOpts?.workspaceDir,
+        charBudget: this.factsOpts?.factsCharBudget
+      });
+      wsFacts = r.facts;
+      if (r.missing) this.factsMissing++;
+      if (r.truncated) this.factsTruncated++;
+      this.factsChars = r.facts.reduce((n, f) => n + f.length, 0);
+    } catch {
+      this.factsReadFailed++;
+    }
+    const withFacts = (res) => ({
+      recent: res.recent,
+      facts: [...wsFacts, ...res.facts]
+    });
     const voice = await this.store.memoryContext(conversationId, k);
     let textTurns = [];
     try {
       const sid = resolveOwnerDmSession(this.baseDir, this.agent);
       if (!sid) {
         this.noSession++;
-        return voice;
+        return withFacts(voice);
       }
       textTurns = readRecentTurns(this.baseDir, this.agent, sid, k).map((t) => ({
         seq: 0,
@@ -4356,7 +4480,7 @@ var OpenClawMemoryProvider = class {
       }));
     } catch {
       this.readFailed++;
-      return voice;
+      return withFacts(voice);
     }
     const tagged = [
       ...textTurns.map((t, i) => ({ ...t, _src: 0, _i: i })),
@@ -4375,10 +4499,17 @@ var OpenClawMemoryProvider = class {
       text: t.text,
       ts: t.ts
     }));
-    return { recent, facts: voice.facts };
+    return withFacts({ recent, facts: voice.facts });
   }
   stats() {
-    return { openclaw_no_session: this.noSession, openclaw_read_failed: this.readFailed };
+    return {
+      openclaw_no_session: this.noSession,
+      openclaw_read_failed: this.readFailed,
+      openclaw_facts_missing: this.factsMissing,
+      openclaw_facts_read_failed: this.factsReadFailed,
+      openclaw_facts_truncated: this.factsTruncated,
+      openclaw_facts_chars: this.factsChars
+    };
   }
 };
 
@@ -4402,10 +4533,10 @@ var NullMemory = class {
     return { recent: [], facts: [] };
   }
 };
-function createMemoryProvider(provider, store, baseDir, agent) {
+function createMemoryProvider(provider, store, baseDir, agent, openclawFacts) {
   if (provider === "none") return new NullMemory();
   if (provider === "hermes") return new HermesMemoryProvider(baseDir ?? "~/.hermes");
-  if (provider === "openclaw") return new OpenClawMemoryProvider(store, baseDir ?? "~/.openclaw", agent ?? "");
+  if (provider === "openclaw") return new OpenClawMemoryProvider(store, baseDir ?? "~/.openclaw", agent ?? "", openclawFacts);
   return new SecureComsLocalMemory(store);
 }
 
@@ -4513,7 +4644,10 @@ var BridgeAgent = class _BridgeAgent {
       identityId: cfg.identityId,
       cipherFor: () => new KeyedInboxCipher(deriveMlsStoreKey(seed))
     });
-    this.memory = createMemoryProvider(this.cfg.memoryProvider, this.store, this.cfg.memoryBaseDir, this.cfg.memoryAgent);
+    this.memory = createMemoryProvider(this.cfg.memoryProvider, this.store, this.cfg.memoryBaseDir, this.cfg.memoryAgent, {
+      workspaceDir: this.cfg.memoryWorkspaceDir,
+      factsCharBudget: this.cfg.memoryFactsCharBudget
+    });
     this.provider = new MlsGroupKeyProvider({
       store: this.store,
       backend: this.backend,
@@ -4593,7 +4727,7 @@ var BridgeAgent = class _BridgeAgent {
       const j = await res.json();
       return String(j.attachment_id);
     };
-    this.attachmentsDirImpl = deps.attachmentsDir ?? join5(dirname(cfg.storePath), "attachments");
+    this.attachmentsDirImpl = deps.attachmentsDir ?? join6(dirname(cfg.storePath), "attachments");
     this.action = {
       begin: (channelId) => this.actionBegin(channelId),
       start: (opts) => this.actionStart(opts),
@@ -6120,13 +6254,13 @@ var BridgeAgent = class _BridgeAgent {
 };
 
 // src/config.ts
-import { readFileSync as readFileSync4, statSync } from "node:fs";
-import { dirname as dirname2, join as join6 } from "node:path";
+import { readFileSync as readFileSync5, statSync as statSync2 } from "node:fs";
+import { dirname as dirname2, join as join7 } from "node:path";
 var REQUIRED = ["api_key", "identity_id", "device_id", "signing_private_key", "enclave_id", "api_base"];
 function loadConfig(opts) {
-  const raw = readFileSync4(opts.credentialPath, "utf8");
+  const raw = readFileSync5(opts.credentialPath, "utf8");
   try {
-    const mode = statSync(opts.credentialPath).mode & 511;
+    const mode = statSync2(opts.credentialPath).mode & 511;
     if (mode & 63) process.stderr.write(`[bridge] WARNING: credential file ${opts.credentialPath} permission ${mode.toString(8)} is not 0600 \u2014 tighten it (chmod 600).
 `);
   } catch {
@@ -6138,7 +6272,7 @@ function loadConfig(opts) {
     throw new Error("credential file is not valid JSON");
   }
   for (const k of REQUIRED) if (typeof json2[k] !== "string" || !json2[k]) throw new Error(`credential file missing required field: ${k}`);
-  const storePath = opts.storePath ?? join6(dirname2(opts.credentialPath), "bridge-state.db");
+  const storePath = opts.storePath ?? join7(dirname2(opts.credentialPath), "bridge-state.db");
   const agentName = typeof json2.agent_name === "string" && json2.agent_name ? json2.agent_name : typeof json2.display_name === "string" && json2.display_name ? json2.display_name : void 0;
   const rateLimitCapacity = typeof json2.rate_limit_capacity === "number" ? json2.rate_limit_capacity : 20;
   const rateLimitRefillPerMinute = typeof json2.rate_limit_refill_per_minute === "number" ? json2.rate_limit_refill_per_minute : 20;
@@ -6146,6 +6280,8 @@ function loadConfig(opts) {
   let memoryProvider;
   let memoryBaseDir;
   let memoryAgent;
+  let memoryWorkspaceDir;
+  let memoryFactsCharBudget;
   if (memProvRaw === "none") {
     memoryProvider = "none";
   } else if (memProvRaw === "hermes") {
@@ -6159,6 +6295,10 @@ function loadConfig(opts) {
     memoryBaseDir = typeof bd === "string" && bd ? bd : "~/.openclaw";
     const ag = oc?.agent;
     memoryAgent = typeof ag === "string" && ag ? ag : void 0;
+    const wd = oc?.workspace_dir;
+    memoryWorkspaceDir = typeof wd === "string" && wd ? wd : void 0;
+    const fb = oc?.facts_char_budget;
+    memoryFactsCharBudget = typeof fb === "number" && Number.isInteger(fb) && fb >= 0 ? fb : void 0;
   } else {
     memoryProvider = "securecoms";
   }
@@ -6175,7 +6315,9 @@ function loadConfig(opts) {
     rateLimitRefillPerMinute,
     memoryProvider,
     memoryBaseDir,
-    memoryAgent
+    memoryAgent,
+    memoryWorkspaceDir,
+    memoryFactsCharBudget
   };
 }
 function arg(argv, flag) {
@@ -6219,11 +6361,11 @@ import { z } from "zod";
 
 // src/auth.ts
 import { randomBytes as randomBytes3, timingSafeEqual } from "node:crypto";
-import { existsSync, readFileSync as readFileSync5, writeFileSync } from "node:fs";
+import { existsSync, readFileSync as readFileSync6, writeFileSync } from "node:fs";
 function resolveToken(opts) {
   if (opts.token) return opts.token;
   const f = opts.tokenFile;
-  if (f && existsSync(f)) return readFileSync5(f, "utf8").trim();
+  if (f && existsSync(f)) return readFileSync6(f, "utf8").trim();
   const tok = randomBytes3(32).toString("base64url");
   if (f) writeFileSync(f, tok, { mode: 384 });
   return tok;

package/dist/memory/openclaw-provider.d.ts

@@ -1,5 +1,9 @@
 import type { MemoryProvider } from "./provider.js";
 import type { SqliteMlsStateStore, MemoryRecordInput, MemoryContextResult } from "@agentvault/connect-mls-store";
+export interface OpenClawFactsOptions {
+    workspaceDir?: string;
+    factsCharBudget?: number;
+}
 /**
  * MemoryProvider for an OpenClaw-hosted agent (Cortina). context() merges
  * OpenClaw's own text history (read-only, plain session .jsonl) with the
@@ -12,9 +16,14 @@ export declare class OpenClawMemoryProvider implements MemoryProvider {
     private readonly store;
     private readonly baseDir;
     private readonly agent;
+    private readonly factsOpts?;
     private noSession;
     private readFailed;
-    constructor(store: SqliteMlsStateStore, baseDir: string, agent: string);
+    private factsMissing;
+    private factsReadFailed;
+    private factsTruncated;
+    private factsChars;
+    constructor(store: SqliteMlsStateStore, baseDir: string, agent: string, factsOpts?: OpenClawFactsOptions | undefined);
     record(input: MemoryRecordInput): Promise<{
         seq: number;
         deduped: boolean;

package/dist/memory/openclaw-workspace-facts.d.ts

@@ -0,0 +1,38 @@
+/** Spec D2 constants — pinned so tests are deterministic. "Chars" = UTF-16 code units. */
+export declare const DEFAULT_FACTS_BUDGET = 8000;
+export declare const MEMORY_MD_CAP = 6000;
+export declare const MIN_FRAGMENT = 200;
+export declare const MAX_SOURCE_BYTES: number;
+/**
+ * Resolve the agent's OpenClaw workspace dir (spec D4). Ladder, first hit wins:
+ *  1. explicit override (credential workspace_dir) — operator beats everything;
+ *  2. openclaw.json, resolved the way OpenClaw itself would:
+ *     2a. agents.list entry with id===agent and a NON-EMPTY string workspace (verbatim,
+ *         never case-transformed — the live config declares "workspace-cortina" for an
+ *         on-disk "workspace-Cortina" and works only because APFS is case-insensitive);
+ *     2b. else agents.defaults.workspace when it is a non-empty string (covers main,
+ *         whose live entry has the workspace key ABSENT, and named agents w/o one);
+ *  3. derivation, LAST resort (openclaw.json missing/malformed/silent):
+ *     main/"" → <base>/workspace, else <base>/workspace-<agent> verbatim.
+ * Empty agent is treated as "main" throughout (the factory passes agent ?? "").
+ * Total: always returns a path; existence is checked at read time, fail-safe.
+ */
+export declare function resolveWorkspaceDir(baseDir: string, agent: string, override?: string): string;
+export interface WorkspaceFactsResult {
+    /** 0..3 provenance-prefixed facts: MEMORY.md first, then dailies newest-first. */
+    facts: string[];
+    /** True when the budget clipped or dropped any source (includes the >1MB skip). */
+    truncated: boolean;
+    /** True when the resolved workspace yielded zero usable sources. False on budget-0 kill switch. */
+    missing: boolean;
+}
+/**
+ * Read the workspace facts (spec D1-D3). READ-ONLY, total: never throws for any
+ * filesystem state — absence degrades to fewer/zero facts. Only MEMORY.md and
+ * memory/\d{4}-\d{2}-\d{2}\.md under the resolved dir are ever opened.
+ * Budget accounting is content-only; prefixes and markers are exempt (audit M2).
+ */
+export declare function readWorkspaceFacts(baseDir: string, agent: string, opts?: {
+    workspaceDir?: string;
+    charBudget?: number;
+}): WorkspaceFactsResult;

package/dist/memory/provider.d.ts

@@ -1,4 +1,5 @@
 import type { SqliteMlsStateStore, MemoryRecordInput, MemoryContextResult } from "@agentvault/connect-mls-store";
+import type { OpenClawFactsOptions } from "./openclaw-provider.js";
 export interface MemoryProvider {
     record(input: MemoryRecordInput): Promise<{
         seq: number;
@@ -26,4 +27,4 @@ export declare class NullMemory implements MemoryProvider {
     }>;
     context(): Promise<MemoryContextResult>;
 }
-export declare function createMemoryProvider(provider: "securecoms" | "none" | "hermes" | "openclaw", store: SqliteMlsStateStore, baseDir?: string, agent?: string): MemoryProvider;
+export declare function createMemoryProvider(provider: "securecoms" | "none" | "hermes" | "openclaw", store: SqliteMlsStateStore, baseDir?: string, agent?: string, openclawFacts?: OpenClawFactsOptions): MemoryProvider;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@securecoms/agent-bridge",
-  "version": "0.8.0",
+  "version": "0.9.0",
   "type": "module",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",