@xopcai/xopc 0.0.176 → 0.0.178

package/dist/src/gateway/service.js

@@ -46,15 +46,6 @@ import { startConnectedKnowledgeCoordinator } from "../knowledge/coordinator.js"
 import "../knowledge/index.js";
 import { startConnectorLearningCoordinator } from "../connectors/learning-coordinator.js";
 import { startConnectorSupervisor } from "../connectors/supervisor.js";
-import { FocusService } from "../focuses/service.js";
-import { processFocusMonitorRun } from "../focuses/run-processor.js";
-import { startFocusReconciler } from "../focuses/reconciler.js";
-import "../focuses/index.js";
-import { LocalAppService } from "../local-apps/service.js";
-import "../local-apps/index.js";
-import { scheduleGatewayUpdateCheck } from "../infra/update-startup.js";
-import { runBootstrapMigrationsSync } from "../migrations/runner.js";
-import { MobileNotificationService } from "../mobile/notification-service.js";
 import { assertGatewayAuthConfigured, extractToken, resolveGatewayAuth, validateToken } from "./auth.js";
 import { reconcileDreamingAutomations } from "./dreaming-automation-reconciler.js";
 import { NotesStore } from "../notes/store.js";
@@ -80,8 +71,21 @@ import "./rate-limit/index.js";
 import { assertGatewayRuntimeConfig } from "./runtime-config.js";
 import { auditGatewayConfig } from "./security/audit.js";
 import { ModelCatalogSyncService } from "../providers/model-catalog-sync-service.js";
+import { runBootstrapMigrationsSync } from "../migrations/runner.js";
+import { MobileNotificationService } from "../mobile/notification-service.js";
+import { LocalAppService } from "../local-apps/service.js";
+import "../local-apps/index.js";
 import { createRuntimeBrowserRecipeService } from "../browser/recipes/runtime-service.js";
 import "../browser/recipes/index.js";
+import { ProactiveEventService } from "../proactive/service.js";
+import { ProactiveScenarioService } from "../proactive/scenarios/service.js";
+import { ReadonlyProactiveAgentExecutor } from "../proactive/execution/agent-executor.js";
+import { listInsights } from "../proactive/execution/repository.js";
+import { ProactiveWorker } from "../proactive/execution/worker.js";
+import { ProactiveInboxService } from "../proactive/inbox/service.js";
+import { ProactiveInboxWorker } from "../proactive/inbox/worker.js";
+import "../proactive/index.js";
+import { scheduleGatewayUpdateCheck } from "../infra/update-startup.js";
 import { resolveChannelConnectDeferSet } from "./resolve-channel-connect-defer.js";
 import { restartGatewayProcessWithFreshPid } from "./respawn.js";
 import { GatewaySessionsApi } from "./service/sessions-api.js";
@@ -163,7 +167,6 @@ var GatewayService = class {
 	connectedKnowledgeCoordinator = null;
 	stopAutomationProductEventBridge = null;
 	stopSessionTranscriptAutomationEvents = null;
-	stopFocusReconciler = null;
 	/**
 	* Webchat agent invocation surface (`runAgent`, `abortAgentRun`, `steer*`,
 	* `submitClarifyResponse`, clarify-bridge dispatch). Owns the
@@ -187,14 +190,27 @@ var GatewayService = class {
 	marketplace;
 	/** First-class project grouping surface. */
 	projects;
+	workItems;
 	/** Local user-created apps, their coder projects, previews, and installs. */
 	localApps;
+	/** Unified durable event spine for proactive scenarios. */
+	proactiveScenarios = new ProactiveScenarioService();
+	proactive = new ProactiveEventService(() => this.proactiveScenarios.routes());
+	proactiveInbox = new ProactiveInboxService();
+	proactiveInsights = listInsights;
+	proactiveWorker;
+	proactiveInboxWorker;
 	constructor(serviceConfig = {}) {
 		this.serviceConfig = serviceConfig;
 		this.bus = new MessageBus();
 		this.configPath = serviceConfig.configPath || resolveConfigPath();
 		runBootstrapMigrationsSync(this.configPath);
 		this.config = loadConfig(this.configPath);
+		this.proactiveWorker = new ProactiveWorker(new ReadonlyProactiveAgentExecutor(() => this.config));
+		this.proactiveInboxWorker = new ProactiveInboxWorker({ deliver: async ({ inboxItem }) => {
+			this.sse.emit("proactive.inbox.created", inboxItem);
+			await this.createMobileNotificationService().deliverGatewayEvent("proactive.inbox.created", inboxItem);
+		} });
 		let bootstrapConfigChanged = initializeVoiceDefaults(this.config, inferProductLanguageFromEnvironment());
 		const starterResult = ensureStarterAgentsInitialized(this.config);
 		if (starterResult.changed) {
@@ -248,9 +264,10 @@ var GatewayService = class {
 		this.workspacePath = getWorkspacePath(this.config) || "./workspace";
 		this.initializeExtensionLoader();
 		this.sessionIndex = new SessionIndex({ config: this.config });
-		this.automationService = new AutomationService();
+		this.automationService = new AutomationService(this.proactive);
 		this.notesService = new NotesService(new NotesStore());
-		this.projects = new ProjectService();
+		this.projects = new ProjectService(void 0, this.proactive);
+		this.workItems = new WorkItemService(void 0, this.proactive);
 		this.localApps = new LocalAppService({
 			projects: this.projects,
 			workspaceRoot: this.workspacePath,
@@ -343,7 +360,7 @@ var GatewayService = class {
 			getBrowserRecipeService: () => this.browserRecipes,
 			getNotesService: () => this.notesService,
 			getProjectService: () => this.projects,
-			getWorkItemService: () => new WorkItemService(),
+			getWorkItemService: () => this.workItems,
 			getLocalAppService: () => this.localApps,
 			getWorkflowRunService: () => this.createWorkflowRunService(),
 			sourceContextResolver: async (binding) => {
@@ -357,7 +374,7 @@ var GatewayService = class {
 					});
 				}
 				if (binding.kind === "work_item") {
-					const item = new WorkItemService().getWorkItem(binding.sourceId);
+					const item = this.workItems.getWorkItem(binding.sourceId);
 					return item ? await buildWorkItemAgentContext(item) : null;
 				}
 				return null;
@@ -613,6 +630,8 @@ var GatewayService = class {
 		openXopcDatabase();
 		this.startTime = Date.now();
 		this.running = true;
+		this.proactiveWorker.start();
+		this.proactiveInboxWorker.start();
 		prepareConfiguredLocalVoiceModel(this.config);
 		this.startupTrace = createGatewayStartupTrace();
 		this.readiness.markStarting(this.startTime);
@@ -706,7 +725,6 @@ var GatewayService = class {
 		});
 		await trace.measure("automations.initialize", () => this.automationService.initialize());
 		await trace.measure("dreaming.reconcile", () => this.reconcileDreamingAutomations());
-		this.stopFocusReconciler = startFocusReconciler(new FocusService(this.automationService));
 		await this.notesService.initialize();
 		this.ensureHeartbeatService().start(heartbeatRunnerConfigFromConfig(this.config));
 		this.connectorSupervisor = startConnectorSupervisor({
@@ -831,6 +849,8 @@ var GatewayService = class {
 		setPairingBroadcastSink(null);
 		log.debug("Stopping gateway service...");
 		this.readiness.markStarting();
+		await this.proactiveWorker.stop();
+		await this.proactiveInboxWorker.stop();
 		await stopTailscaleExposure().catch((err) => {
 			log.warn({ err }, "Tailscale exposure shutdown failed");
 		});
@@ -866,8 +886,6 @@ var GatewayService = class {
 		this.lastChannelConnectDeferMode = "auto";
 		this.lastChannelConnectDeferSource = "off";
 		await this.channelManager.stop();
-		await this.stopFocusReconciler?.();
-		this.stopFocusReconciler = null;
 		await this.automationService.stop();
 		this.stopAutomationProductEventBridge?.();
 		this.stopAutomationProductEventBridge = null;
@@ -1272,25 +1290,7 @@ var GatewayService = class {
 		this.createMobileNotificationService().handleGatewayEvent(type, payload);
 	}
 	handleAutomationRunCompleted(run) {
-		try {
-			const focusResult = processFocusMonitorRun(run);
-			this.emit("automation.run.completed", {
-				run,
-				silent: focusResult.handled
-			});
-			if (focusResult.handled) this.emit("focus.run.updated", {
-				automationId: run.automationId,
-				run
-			});
-			if (focusResult.insight) this.emit("focus.insight.created", { insight: focusResult.insight });
-		} catch (err) {
-			log.warn({
-				err,
-				automationId: run.automationId,
-				runId: run.id
-			}, "Proactive result processing failed");
-			this.emit("automation.run.completed", { run });
-		}
+		this.emit("automation.run.completed", { run });
 	}
 	startAutomationProductEventBridge() {
 		this.stopAutomationProductEventBridge?.();

package/dist/src/infra/gateway-processes.js

@@ -1,5 +1,5 @@
-import { isGatewayArgv, parseProcCmdline } from "./gateway-process-argv.js";
 import { listPortListeners } from "../gateway/ports.js";
+import { isGatewayArgv, parseProcCmdline } from "./gateway-process-argv.js";
 import fs from "node:fs";
 import { spawnSync } from "node:child_process";
 //#region src/infra/gateway-processes.ts

package/dist/src/infra/update-restart.js

@@ -4,8 +4,8 @@ import { init_paths, resolveConfigPath } from "../config/paths.js";
 import { init_loader, loadConfig } from "../config/loader.js";
 import { isRestartEnabled } from "../config/commands.flags.js";
 import { resolveGatewayService } from "../daemon/service.js";
-import { findVerifiedGatewayListenerPidsOnPortSync, signalVerifiedGatewayPidSync } from "./gateway-processes.js";
 import { authorizeGatewaySigusr1Restart, writeGatewayRestartIntentSync } from "./restart.js";
+import { findVerifiedGatewayListenerPidsOnPortSync, signalVerifiedGatewayPidSync } from "./gateway-processes.js";
 import { refreshGatewayServiceAfterUpdate } from "./update-service-refresh.js";
 //#region src/infra/update-restart.ts
 init_loader();

package/dist/src/infra/update-runner.js

@@ -1,11 +1,11 @@
 import { runPostUpdateExtensionSync } from "../extensions/update.js";
+import "./update-channels.js";
+import { compareSemver, resolveNpmChannelTag } from "./update-check.js";
 import { readPackageName, readPackageVersion } from "./package-json.js";
 import { createDefaultCommandRunner, runCommandWithTimeout } from "./run-command.js";
 import { XOPC_PACKAGE_NAME, cleanupGlobalRenameDirs, createGlobalInstallEnv, detectGlobalInstallManagerForRoot, resolveGlobalInstallSpec, resolveGlobalInstallTarget } from "./update-global.js";
 import { runGlobalPackageUpdateSteps } from "./package-update-steps.js";
 import { resolveStableNodePath } from "./stable-node-path.js";
-import "./update-channels.js";
-import { compareSemver, resolveNpmChannelTag } from "./update-check.js";
 import { trimLogTail } from "./update-log.js";
 import { maybeRestartGatewayAfterUpdate } from "./update-restart.js";
 import path from "node:path";

package/dist/src/infra/update-startup.js

@@ -3,9 +3,9 @@ import { init_paths_state, resolveUpdateCheckStatePath } from "../config/paths-s
 import { createLogger } from "../utils/logger/index.js";
 import { init_logger } from "../utils/logger.js";
 import { init_write_file_atomic, writeTextAtomic } from "./write-file-atomic.js";
+import { acquireUpdateLock } from "./update-lock.js";
 import { normalizeUpdateChannel } from "./update-channels.js";
 import { compareSemver, detectInstallKind, resolveNpmChannelTag, resolvePackageRoot } from "./update-check.js";
-import { acquireUpdateLock } from "./update-lock.js";
 import { createHash, randomUUID } from "node:crypto";
 import { readFile } from "node:fs/promises";
 //#region src/infra/update-startup.ts

package/dist/src/mcp/channel-bridge.js

@@ -1,9 +1,9 @@
 import { createLogger } from "../utils/logger/index.js";
 import { init_logger } from "../utils/logger.js";
 import { init_loader, loadConfig } from "../config/loader.js";
+import { gatewayCredentialAuthorization } from "../gateway/credential.js";
 import { loadUndiciRuntimeDeps } from "../infra/undici-fetch.js";
 import { toConversation } from "./channel-shared.js";
-import { gatewayCredentialAuthorization } from "../gateway/credential.js";
 import { createGatewayHttpClientFromConfig, resolveGatewayHttpBaseUrl } from "./gateway-http-client.js";
 //#region src/mcp/channel-bridge.ts
 init_loader();

package/dist/src/mobile/notification-service.d.ts

@@ -4,5 +4,6 @@ export declare function mobileNotificationEventFromGatewayEvent(type: string, pa
 export declare class MobileNotificationService {
     private readonly sent;
     handleGatewayEvent(type: string, payload: unknown): void;
+    deliverGatewayEvent(type: string, payload: unknown): Promise<void>;
     private deliver;
 }

package/dist/src/mobile/notification-service.js

@@ -9,6 +9,7 @@ function shouldDeliver(type, preferences) {
 	if (type === "goal.needs_input") return preferences.needsInput;
 	if (type === "goal.blocked") return preferences.failed;
 	if (type === "automation.failed") return preferences.automationFailed;
+	if (type === "proactive.insight") return preferences.needsInput;
 	return preferences.completed;
 }
 function goalEvent(payload) {
@@ -66,10 +67,33 @@ function automationEvent(payload) {
 		}
 	};
 }
+function proactiveInsightEvent(payload) {
+	if (!payload || typeof payload !== "object") return null;
+	const item = payload;
+	if (typeof item.id !== "string" || typeof item.insight?.id !== "string" || typeof item.insight.title !== "string") return null;
+	const route = `/inbox?item=${encodeURIComponent(item.id)}`;
+	return {
+		type: "proactive.insight",
+		entity: {
+			kind: "insight",
+			id: item.insight.id
+		},
+		priority: item.insight.urgency === "high" || item.insight.urgency === "critical" ? "high" : "normal",
+		title: item.insight.title.slice(0, 120),
+		body: typeof item.insight.summary === "string" ? item.insight.summary.slice(0, 180) : void 0,
+		deepLink: route,
+		payload: {
+			route,
+			inboxItemId: item.id,
+			eventType: "proactive.insight"
+		}
+	};
+}
 /** Converts gateway domain events into a portable mobile activity and push payload. */
 function mobileNotificationEventFromGatewayEvent(type, payload) {
 	if (type === "goal.status.updated") return goalEvent(payload);
 	if (type === "automation.run.completed") return automationEvent(payload);
+	if (type === "proactive.inbox.created") return proactiveInsightEvent(payload);
 	return null;
 }
 async function sendExpoPush(token, event) {
@@ -105,33 +129,29 @@ async function sendExpoPush(token, event) {
 var MobileNotificationService = class {
 	sent = /* @__PURE__ */ new Set();
 	handleGatewayEvent(type, payload) {
+		this.deliverGatewayEvent(type, payload).catch((err) => {
+			log.warn({
+				err,
+				eventType: type
+			}, "Mobile notification delivery failed");
+		});
+	}
+	async deliverGatewayEvent(type, payload) {
 		const event = mobileNotificationEventFromGatewayEvent(type, payload);
 		if (!event) return;
 		const dedupeKey = `${event.type}:${event.entity.kind}:${event.entity.id}:${JSON.stringify(event.payload)}`;
 		if (this.sent.has(dedupeKey)) return;
 		this.sent.add(dedupeKey);
-		this.deliver(event).catch((err) => {
-			log.warn({
-				err,
-				eventType: event.type,
-				entityId: event.entity.id
-			}, "Mobile notification delivery failed");
-		}).finally(() => this.sent.delete(dedupeKey));
+		try {
+			await this.deliver(event);
+		} finally {
+			this.sent.delete(dedupeKey);
+		}
 	}
 	async deliver(input) {
 		const event = createMobileActivityEvent(input);
 		const devices = listEnabledMobileDevices().filter((device) => shouldDeliver(event.type, device.preferences));
-		await Promise.all(devices.map(async (device) => {
-			try {
-				await sendExpoPush(device.pushToken, event);
-			} catch (err) {
-				log.warn({
-					err,
-					eventId: event.id,
-					deviceId: device.id
-				}, "Mobile push request failed");
-			}
-		}));
+		await Promise.all(devices.map((device) => sendExpoPush(device.pushToken, event)));
 	}
 };
 //#endregion

package/dist/src/mobile/notification-types.d.ts

@@ -1,7 +1,7 @@
 export type MobilePlatform = 'ios' | 'android';
 export type MobileNotificationPermission = 'granted' | 'denied' | 'unknown';
 export type MobileNotificationPriority = 'normal' | 'high';
-export type MobileNotificationEventType = 'goal.needs_input' | 'goal.blocked' | 'goal.completed' | 'automation.failed' | 'automation.completed';
+export type MobileNotificationEventType = 'goal.needs_input' | 'goal.blocked' | 'goal.completed' | 'automation.failed' | 'automation.completed' | 'proactive.insight';
 export type MobileNotificationPreferences = {
     needsInput: boolean;
     failed: boolean;
@@ -24,7 +24,7 @@ export type MobileActivityEvent = {
     id: string;
     type: MobileNotificationEventType;
     entity: {
-        kind: 'goal' | 'automation';
+        kind: 'goal' | 'automation' | 'insight';
         id: string;
     };
     priority: MobileNotificationPriority;

package/dist/src/proactive/events/envelope.d.ts

@@ -0,0 +1,2 @@
+import { type EventEnvelope, type PublishEventInput } from './types.js';
+export declare function normalizeEventEnvelope(input: PublishEventInput, now?: Date): EventEnvelope;

package/dist/src/proactive/events/envelope.js

@@ -0,0 +1,54 @@
+import { EVENT_ACTOR_KINDS, EVENT_SENSITIVITIES } from "./types.js";
+import { randomUUID } from "node:crypto";
+//#region src/proactive/events/envelope.ts
+const EVENT_TYPE_PATTERN = /^[a-z][a-z0-9_]*(?:\.[a-z][a-z0-9_]*)+\.v[1-9][0-9]*$/;
+function required(value, field) {
+	const normalized = value.trim();
+	if (!normalized) throw new Error(`${field} is required`);
+	if (normalized.length > 300) throw new Error(`${field} is too long`);
+	return normalized;
+}
+function timestamp(value, field) {
+	const time = Date.parse(value);
+	if (!Number.isFinite(time)) throw new Error(`${field} must be an ISO timestamp`);
+	return new Date(time).toISOString();
+}
+function normalizeEventEnvelope(input, now = /* @__PURE__ */ new Date()) {
+	if (!EVENT_TYPE_PATTERN.test(input.type)) throw new Error("type must use the domain.event.vN convention");
+	if (!Number.isInteger(input.schemaVersion) || input.schemaVersion < 1) throw new Error("schemaVersion must be a positive integer");
+	if (!EVENT_ACTOR_KINDS.includes(input.actor.kind)) throw new Error("actor.kind is invalid");
+	if (!EVENT_SENSITIVITIES.includes(input.sensitivity)) throw new Error("sensitivity is invalid");
+	if (!input.payload || Array.isArray(input.payload) || typeof input.payload !== "object") throw new Error("payload must be an object");
+	return {
+		id: required(input.id ?? randomUUID(), "id"),
+		type: input.type,
+		schemaVersion: input.schemaVersion,
+		source: {
+			kind: required(input.source.kind, "source.kind"),
+			id: required(input.source.id, "source.id"),
+			...input.source.deviceId ? { deviceId: required(input.source.deviceId, "source.deviceId") } : {}
+		},
+		subject: {
+			kind: required(input.subject.kind, "subject.kind"),
+			id: required(input.subject.id, "subject.id")
+		},
+		actor: {
+			kind: input.actor.kind,
+			...input.actor.id ? { id: required(input.actor.id, "actor.id") } : {}
+		},
+		scope: {
+			workspaceId: required(input.scope.workspaceId, "scope.workspaceId"),
+			...input.scope.projectId ? { projectId: required(input.scope.projectId, "scope.projectId") } : {},
+			...input.scope.agentId ? { agentId: required(input.scope.agentId, "scope.agentId") } : {}
+		},
+		occurredAt: timestamp(input.occurredAt, "occurredAt"),
+		observedAt: timestamp(input.observedAt ?? now.toISOString(), "observedAt"),
+		correlationId: required(input.correlationId ?? randomUUID(), "correlationId"),
+		...input.causationId ? { causationId: required(input.causationId, "causationId") } : {},
+		dedupeKey: required(input.dedupeKey, "dedupeKey"),
+		sensitivity: input.sensitivity,
+		payload: input.payload
+	};
+}
+//#endregion
+export { normalizeEventEnvelope };

package/dist/src/proactive/events/publisher.d.ts

@@ -0,0 +1,4 @@
+import type { PublishEventInput, PublishedEvent } from './types.js';
+export interface ProactiveSignalPublisher {
+    publish(input: PublishEventInput, observedAt?: Date): PublishedEvent;
+}

package/dist/src/proactive/events/repository.d.ts

@@ -0,0 +1,9 @@
+import type { EventEnvelope } from './types.js';
+export declare function getEventByDedupeKey(dedupeKey: string): EventEnvelope | null;
+export declare function insertEvent(event: EventEnvelope): boolean;
+export declare function isEventRouted(eventId: string): boolean;
+export declare function markEventRouted(eventId: string, routedAt: string): void;
+export declare function listEvents(input?: {
+    limit?: number;
+    type?: string;
+}): EventEnvelope[];

package/dist/src/proactive/events/repository.js

@@ -0,0 +1,62 @@
+import { getSqliteDatabase, runSqliteWriteTransaction } from "../../storage/sqlite/transaction.js";
+//#region src/proactive/events/repository.ts
+function fromRow(row) {
+	return {
+		id: row.event_id,
+		type: row.type,
+		schemaVersion: row.schema_version,
+		source: {
+			kind: row.source_kind,
+			id: row.source_id,
+			...row.device_id ? { deviceId: row.device_id } : {}
+		},
+		subject: {
+			kind: row.subject_kind,
+			id: row.subject_id
+		},
+		actor: {
+			kind: row.actor_kind,
+			...row.actor_id ? { id: row.actor_id } : {}
+		},
+		scope: {
+			workspaceId: row.workspace_id,
+			...row.project_id ? { projectId: row.project_id } : {},
+			...row.agent_id ? { agentId: row.agent_id } : {}
+		},
+		occurredAt: row.occurred_at,
+		observedAt: row.observed_at,
+		correlationId: row.correlation_id,
+		...row.causation_id ? { causationId: row.causation_id } : {},
+		dedupeKey: row.dedupe_key,
+		sensitivity: row.sensitivity,
+		payload: JSON.parse(row.payload_json)
+	};
+}
+function getEventByDedupeKey(dedupeKey) {
+	const row = getSqliteDatabase().prepare("SELECT * FROM proactive_events WHERE dedupe_key = ?").get(dedupeKey);
+	return row ? fromRow(row) : null;
+}
+function insertEvent(event) {
+	return runSqliteWriteTransaction((db) => {
+		return db.prepare(`INSERT OR IGNORE INTO proactive_events (
+      event_id, type, schema_version, source_kind, source_id, device_id,
+      subject_kind, subject_id, actor_kind, actor_id, workspace_id, project_id, agent_id,
+      occurred_at, observed_at, correlation_id, causation_id, dedupe_key, sensitivity, payload_json
+    ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`).run(event.id, event.type, event.schemaVersion, event.source.kind, event.source.id, event.source.deviceId ?? null, event.subject.kind, event.subject.id, event.actor.kind, event.actor.id ?? null, event.scope.workspaceId, event.scope.projectId ?? null, event.scope.agentId ?? null, event.occurredAt, event.observedAt, event.correlationId, event.causationId ?? null, event.dedupeKey, event.sensitivity, JSON.stringify(event.payload)).changes === 1;
+	});
+}
+function isEventRouted(eventId) {
+	const row = getSqliteDatabase().prepare("SELECT routed_at FROM proactive_events WHERE event_id = ?").get(eventId);
+	return Boolean(row?.routed_at);
+}
+function markEventRouted(eventId, routedAt) {
+	runSqliteWriteTransaction((db) => {
+		db.prepare("UPDATE proactive_events SET routed_at = COALESCE(routed_at, ?) WHERE event_id = ?").run(routedAt, eventId);
+	});
+}
+function listEvents(input = {}) {
+	const limit = Math.min(200, Math.max(1, input.limit ?? 50));
+	return (input.type ? getSqliteDatabase().prepare("SELECT * FROM proactive_events WHERE type = ? ORDER BY observed_at DESC LIMIT ?").all(input.type, limit) : getSqliteDatabase().prepare("SELECT * FROM proactive_events ORDER BY observed_at DESC LIMIT ?").all(limit)).map(fromRow);
+}
+//#endregion
+export { getEventByDedupeKey, insertEvent, isEventRouted, listEvents, markEventRouted };

package/dist/src/proactive/events/types.d.ts

@@ -0,0 +1,44 @@
+export declare const EVENT_SENSITIVITIES: readonly ["public", "personal", "confidential", "restricted"];
+export type EventSensitivity = (typeof EVENT_SENSITIVITIES)[number];
+export declare const EVENT_ACTOR_KINDS: readonly ["user", "agent", "system", "integration"];
+export type EventActorKind = (typeof EVENT_ACTOR_KINDS)[number];
+export interface EventEnvelope<TPayload extends Record<string, unknown> = Record<string, unknown>> {
+    id: string;
+    type: string;
+    schemaVersion: number;
+    source: {
+        kind: string;
+        id: string;
+        deviceId?: string;
+    };
+    subject: {
+        kind: string;
+        id: string;
+    };
+    actor: {
+        kind: EventActorKind;
+        id?: string;
+    };
+    scope: {
+        workspaceId: string;
+        projectId?: string;
+        agentId?: string;
+    };
+    occurredAt: string;
+    observedAt: string;
+    correlationId: string;
+    causationId?: string;
+    dedupeKey: string;
+    sensitivity: EventSensitivity;
+    payload: TPayload;
+}
+export type PublishEventInput<TPayload extends Record<string, unknown> = Record<string, unknown>> = Omit<EventEnvelope<TPayload>, 'id' | 'observedAt' | 'correlationId'> & {
+    id?: string;
+    observedAt?: string;
+    correlationId?: string;
+};
+export interface PublishedEvent {
+    event: EventEnvelope;
+    inserted: boolean;
+    batchIds: string[];
+}

package/dist/src/proactive/events/types.js

@@ -0,0 +1,15 @@
+//#region src/proactive/events/types.ts
+const EVENT_SENSITIVITIES = [
+	"public",
+	"personal",
+	"confidential",
+	"restricted"
+];
+const EVENT_ACTOR_KINDS = [
+	"user",
+	"agent",
+	"system",
+	"integration"
+];
+//#endregion
+export { EVENT_ACTOR_KINDS, EVENT_SENSITIVITIES };

package/dist/src/proactive/execution/agent-executor.d.ts

@@ -0,0 +1,16 @@
+import type { Config } from '../../config/schema.js';
+import type { ProactiveAgentExecutor } from './types.js';
+/** Runs an isolated, read-only agent over only the context authorized by the signal batch. */
+export declare class ReadonlyProactiveAgentExecutor implements ProactiveAgentExecutor {
+    private readonly config;
+    constructor(config: () => Config | undefined);
+    execute(input: {
+        systemPrompt: string;
+        userPrompt: string;
+        authorizedContext: Record<string, unknown>;
+        signal?: AbortSignal;
+    }): Promise<{
+        text: string;
+        modelRef: string;
+    }>;
+}

package/dist/src/proactive/execution/agent-executor.js

@@ -0,0 +1,104 @@
+import { init_sync_provider_auth, resolveProviderApiKeySync } from "../../auth/sync-provider-auth.js";
+import { getApiKeySync, getDefaultModelSync, init_providers, resolveModel } from "../../providers/index.js";
+import { createExtensionAwareStreamFn } from "../../providers/extension-stream-bridge.js";
+import { runAgentTurnWithTimeout } from "../../agent/orchestration/run-agent-turn-with-timeout.js";
+import { isAssistantTurnAborted, isAssistantTurnFailed } from "../../agent/orchestration/llm-turn-retry.js";
+import { Agent } from "@earendil-works/pi-agent-core";
+import { Type } from "@sinclair/typebox";
+//#region src/proactive/execution/agent-executor.ts
+init_sync_provider_auth();
+init_providers();
+const MAX_TOOL_CALLS = 6;
+const AGENT_TIMEOUT_MS = 9e4;
+function assistantText(messages) {
+	for (let index = messages.length - 1; index >= 0; index -= 1) {
+		const message = messages[index];
+		if (message.role !== "assistant") continue;
+		if (Array.isArray(message.content)) return message.content.flatMap((block) => block && typeof block === "object" && block.type === "text" ? [String(block.text ?? "")] : []).join("").trim();
+	}
+	return "";
+}
+function inspectionTool(context) {
+	return {
+		name: "inspect_authorized_context",
+		label: "Inspect authorized work context",
+		description: "Read one authorized evidence section. This tool cannot write or trigger any action.",
+		parameters: Type.Object({ section: Type.String({ description: "A top-level section name from the availableSections list." }) }),
+		async execute(_toolCallId, args) {
+			const values = args;
+			const section = typeof values.section === "string" ? values.section : "";
+			if (!Object.prototype.hasOwnProperty.call(context, section)) return {
+				content: [{
+					type: "text",
+					text: `Unknown section. Available: ${Object.keys(context).join(", ")}`
+				}],
+				details: { found: false }
+			};
+			return {
+				content: [{
+					type: "text",
+					text: JSON.stringify({
+						section,
+						evidence: context[section]
+					}, null, 2).slice(0, 6e4)
+				}],
+				details: {
+					found: true,
+					section
+				}
+			};
+		}
+	};
+}
+/** Runs an isolated, read-only agent over only the context authorized by the signal batch. */
+var ReadonlyProactiveAgentExecutor = class {
+	constructor(config) {
+		this.config = config;
+	}
+	async execute(input) {
+		const model = resolveModel(getDefaultModelSync(this.config()));
+		let toolCalls = 0;
+		const agent = new Agent({
+			initialState: {
+				systemPrompt: `${input.systemPrompt}\n\nYou are an autonomous background analysis agent. You MUST inspect relevant authorized context with the provided read-only tool before reaching a conclusion. You have no mutation, messaging, shell, network, or filesystem tools.`,
+				model,
+				thinkingLevel: "low",
+				tools: [inspectionTool(input.authorizedContext)],
+				messages: []
+			},
+			streamFn: createExtensionAwareStreamFn(),
+			getApiKey: (provider) => resolveProviderApiKeySync(provider) ?? getApiKeySync(provider) ?? "",
+			beforeToolCall: async () => {
+				if (toolCalls >= MAX_TOOL_CALLS) return {
+					block: true,
+					reason: `Maximum inspection calls reached (${MAX_TOOL_CALLS}).`
+				};
+			},
+			afterToolCall: async () => {
+				toolCalls += 1;
+			}
+		});
+		const abort = () => agent.abort();
+		input.signal?.addEventListener("abort", abort, { once: true });
+		try {
+			const sections = Object.keys(input.authorizedContext);
+			await runAgentTurnWithTimeout(agent, async () => {
+				await agent.prompt(`${input.userPrompt}\n\nAvailable authorized evidence sections: ${sections.join(", ") || "(none)"}.`);
+				await agent.waitForIdle();
+			}, AGENT_TIMEOUT_MS);
+			if (isAssistantTurnAborted(agent)) throw new Error("Proactive agent execution aborted");
+			if (isAssistantTurnFailed(agent)) throw new Error("Proactive agent execution failed");
+			const text = assistantText(agent.state.messages);
+			if (!text) throw new Error("Proactive agent returned empty output");
+			if (toolCalls === 0) throw new Error("Proactive agent did not inspect authorized evidence");
+			return {
+				text,
+				modelRef: `${model.provider}/${model.id}`
+			};
+		} finally {
+			input.signal?.removeEventListener("abort", abort);
+		}
+	}
+};
+//#endregion
+export { ReadonlyProactiveAgentExecutor };