@xopcai/xopc 0.0.189 → 0.0.191

package/dist/src/agent/image/generation/openai-images-provider.d.ts

@@ -43,7 +43,7 @@ export interface OpenAiImagesProviderOptions {
     /** Sync env / cfg lookup that decides if the provider has any usable credential. */
     isConfigured: (ctx: ImageGenerationProviderConfiguredContext) => boolean;
     /** Resolve API key for one request. May return null when using OAuth/header auth. */
-    resolveApiKey: (req: ImageGenerationRequest) => string | null | undefined;
+    resolveApiKey: (req: ImageGenerationRequest) => string | null | undefined | Promise<string | null | undefined>;
     /** Resolve endpoint info per-request (region, baseUrl override, Azure deployment, …). */
     resolveEndpoint: (req: ImageGenerationRequest) => OpenAiImagesEndpointResolution;
     /** Default per-call timeout. Combined with provider-level config in provider-http. */

package/dist/src/agent/image/generation/openai-images-provider.js

@@ -26,7 +26,7 @@ function createOpenAiImagesProvider(options) {
 		capabilities: options.capabilities,
 		isConfigured: options.isConfigured,
 		async generateImage(req) {
-			const apiKey = options.resolveApiKey(req) ?? null;
+			const apiKey = await options.resolveApiKey(req) ?? null;
 			const endpoint = options.resolveEndpoint(req);
 			const httpDefaults = resolveProviderHttpRequestConfig({
 				providerId: options.id,

package/dist/src/agent/image/generation/provider-registry.d.ts

@@ -2,6 +2,8 @@ import type { ModelsJsonConfig } from '../../../config/models-json.js';
 import type { ImageGenerationProvider, ImageGenerationProviderSummary } from './types.js';
 export declare function reloadImageGenerationProviders(config?: ModelsJsonConfig): void;
 export declare function getImageGenerationProvider(providerId: string): ImageGenerationProvider | undefined;
+/** Resolve the auth mode consistently for provider objects and catalog summaries. */
+export declare function resolveImageGenerationCredentialMode(provider: Pick<ImageGenerationProvider, 'credentialMode'>): NonNullable<ImageGenerationProvider['credentialMode']>;
 export declare function listImageGenerationProviders(): ImageGenerationProvider[];
 export declare function listImageGenerationProvidersSummary(): ImageGenerationProviderSummary[];
 export type { ImageGenerationProvider, ImageGenerationProviderSummary } from './types.js';

package/dist/src/agent/image/generation/provider-registry.js

@@ -7,24 +7,30 @@ import { buildFalImageGenerationProvider } from "./providers/fal.js";
 import { buildGoogleImageGenerationProvider } from "./providers/google.js";
 import { buildMinimaxImageGenerationProvider } from "./providers/minimax.js";
 import { buildOpenAIImageGenerationProvider } from "./providers/openai.js";
+import { buildXopcCloudImageGenerationProvider } from "./providers/xopc-cloud.js";
 //#region src/agent/image/generation/provider-registry.ts
 init_models_json();
 init_logger();
 const log = createLogger("ImageGenerationRegistry");
-const builtInProviders = [
-	buildOpenAIImageGenerationProvider(),
-	buildDashScopeImageGenerationProvider(),
-	buildMinimaxImageGenerationProvider(),
-	buildGoogleImageGenerationProvider(),
-	buildFalImageGenerationProvider()
-];
-let providers = [...builtInProviders];
+function buildBuiltInProviders() {
+	const cloud = buildXopcCloudImageGenerationProvider();
+	return [
+		...cloud ? [cloud] : [],
+		buildOpenAIImageGenerationProvider(),
+		buildDashScopeImageGenerationProvider(),
+		buildMinimaxImageGenerationProvider(),
+		buildGoogleImageGenerationProvider(),
+		buildFalImageGenerationProvider()
+	];
+}
+let providers = buildBuiltInProviders();
 let providersById = new Map(providers.map((provider) => [provider.id, provider]));
 let customProvidersLoaded = false;
 function ensureCustomProvidersLoaded() {
 	if (!customProvidersLoaded) reloadImageGenerationProviders();
 }
 function reloadImageGenerationProviders(config) {
+	const builtInProviders = buildBuiltInProviders();
 	let resolved = config;
 	if (!resolved) {
 		const loaded = loadModelsJson();
@@ -54,6 +60,10 @@ function getImageGenerationProvider(providerId) {
 	ensureCustomProvidersLoaded();
 	return providersById.get(providerId);
 }
+/** Resolve the auth mode consistently for provider objects and catalog summaries. */
+function resolveImageGenerationCredentialMode(provider) {
+	return provider.credentialMode ?? "api-key";
+}
 function listImageGenerationProviders() {
 	ensureCustomProvidersLoaded();
 	return [...providers];
@@ -64,7 +74,7 @@ function listImageGenerationProvidersSummary() {
 		id: provider.id,
 		label: provider.label,
 		source: provider.source ?? "builtin",
-		credentialMode: provider.credentialMode ?? "api-key",
+		credentialMode: resolveImageGenerationCredentialMode(provider),
 		...provider.documentationUrl ? { documentationUrl: provider.documentationUrl } : {},
 		...provider.apiKeyUrl ? { apiKeyUrl: provider.apiKeyUrl } : {},
 		defaultModel: provider.defaultModel,
@@ -74,4 +84,4 @@ function listImageGenerationProvidersSummary() {
 	}));
 }
 //#endregion
-export { getImageGenerationProvider, listImageGenerationProviders, listImageGenerationProvidersSummary, reloadImageGenerationProviders };
+export { getImageGenerationProvider, listImageGenerationProviders, listImageGenerationProvidersSummary, reloadImageGenerationProviders, resolveImageGenerationCredentialMode };

package/dist/src/agent/image/generation/providers/xopc-cloud.d.ts

@@ -0,0 +1,2 @@
+import type { ImageGenerationProvider } from '../types.js';
+export declare function buildXopcCloudImageGenerationProvider(): ImageGenerationProvider | undefined;

package/dist/src/agent/image/generation/providers/xopc-cloud.js

@@ -0,0 +1,74 @@
+import { getModelCatalogStore, init_model_catalog_store } from "../../../../providers/model-catalog-store.js";
+import { init_xopc_cloud_config, resolveXopcModelRouterUrl } from "../../../../providers/xopc-cloud-config.js";
+import { getProviderAuthService, init_provider_auth_service } from "../../../../providers/provider-auth-service.js";
+import { createOpenAiImagesProvider } from "../openai-images-provider.js";
+//#region src/agent/image/generation/providers/xopc-cloud.ts
+init_model_catalog_store();
+init_provider_auth_service();
+init_xopc_cloud_config();
+function buildXopcCloudImageGenerationProvider() {
+	const source = getModelCatalogStore().getSource("xopc-cloud");
+	const models = source?.models.filter((model) => model.availability === "available" && model.kind === "image" && model.operations.includes("images.generate")) ?? [];
+	if (models.length === 0) return void 0;
+	const modelCapabilities = Object.fromEntries(models.map((model) => [model.id, toProviderCapabilities(model)]));
+	const defaultModel = models[0].id;
+	const baseUrl = source?.baseUrl ?? resolveXopcModelRouterUrl();
+	const executors = new Map(models.map((model) => [model.id, createOpenAiImagesProvider({
+		id: "xopc-cloud",
+		label: "XOPC Model Service",
+		defaultModel: model.id,
+		models: [model.id],
+		capabilities: modelCapabilities[model.id],
+		isConfigured: () => true,
+		resolveApiKey: (request) => getProviderAuthService().resolveApiKey("xopc-cloud", request.signal),
+		resolveEndpoint: () => ({ baseUrl }),
+		...model.imageGeneration?.sizes[0] ? { defaultSize: model.imageGeneration.sizes[0] } : {}
+	})]));
+	return {
+		id: "xopc-cloud",
+		label: "XOPC Model Service",
+		credentialMode: "oauth",
+		defaultModel,
+		models: models.map((model) => model.id),
+		capabilities: modelCapabilities[defaultModel],
+		modelCapabilities,
+		isConfigured: () => true,
+		async generateImage(request) {
+			const executor = executors.get(request.model);
+			if (!executor) throw new Error(`Image model is not available from XOPC Model Service: ${request.model}`);
+			const geometry = modelCapabilities[request.model]?.geometry;
+			const size = request.size ?? (request.aspectRatio && geometry?.aspectRatios?.includes(request.aspectRatio) ? request.aspectRatio : void 0) ?? (request.resolution && geometry?.resolutions?.includes(request.resolution) ? request.resolution : void 0);
+			return executor.generateImage({
+				...request,
+				...size ? { size } : {}
+			});
+		}
+	};
+}
+function toProviderCapabilities(model) {
+	const image = model.imageGeneration;
+	return {
+		generate: {
+			maxCount: image?.maxCount ?? 1,
+			supportsSize: Boolean(image?.sizes.length),
+			supportsAspectRatio: Boolean(image?.aspectRatios?.length)
+		},
+		edit: {
+			enabled: model.operations.includes("images.edit"),
+			maxInputImages: image?.maxInputImages ?? 0,
+			supportsSize: Boolean(image?.sizes.length),
+			supportsAspectRatio: Boolean(image?.aspectRatios?.length)
+		},
+		geometry: {
+			sizes: image?.sizes ?? [],
+			aspectRatios: image?.aspectRatios ?? []
+		},
+		output: {
+			qualities: image?.qualities ?? [],
+			formats: image?.formats ?? [],
+			backgrounds: image?.backgrounds ?? []
+		}
+	};
+}
+//#endregion
+export { buildXopcCloudImageGenerationProvider };

package/dist/src/agent/image/generation/types.d.ts

@@ -52,7 +52,7 @@ export interface ImageGenerationProvider {
     id: string;
     label: string;
     source?: 'builtin' | 'custom';
-    credentialMode?: 'api-key' | 'none';
+    credentialMode?: 'api-key' | 'oauth' | 'none';
     documentationUrl?: string;
     apiKeyUrl?: string;
     defaultModel: string;
@@ -67,7 +67,7 @@ export interface ImageGenerationProviderSummary {
     id: string;
     label: string;
     source: 'builtin' | 'custom';
-    credentialMode: 'api-key' | 'none';
+    credentialMode: 'api-key' | 'oauth' | 'none';
     documentationUrl?: string;
     apiKeyUrl?: string;
     defaultModel: string;

package/dist/src/agent/memory/builtin-provider.d.ts

@@ -1,4 +1,4 @@
-import type { MemoryProvider, MemoryProviderInitOptions } from './provider.js';
+import type { MemoryProvider } from './provider.js';
 import type { MemoryDeleteRequest, MemoryListRequest, MemoryReadRequest, MemoryReadResult, MemoryRecord, MemorySearchRequest, MemorySearchResult, MemoryUpdateRequest, MemoryWriteRequest, MemoryWriteResult, MemorySyncEvent } from './types.js';
 /**
  * Builtin local memory provider backed exclusively by the structured SQLite store.
@@ -19,10 +19,8 @@ export declare class BuiltinMemoryProvider implements MemoryProvider {
         sync: boolean;
         local: boolean;
     };
-    private workspaceDir;
-    private agentId;
     isAvailable(): boolean;
-    initialize(_sessionId: string, options?: MemoryProviderInitOptions): Promise<void>;
+    initialize(): Promise<void>;
     systemPromptBlock(): string;
     queuePrefetch(): void;
     getToolSchemas(): any[];

package/dist/src/agent/memory/builtin-provider.js

@@ -16,21 +16,16 @@ var BuiltinMemoryProvider = class {
 		update: true,
 		delete: true,
 		keywordSearch: true,
-		semanticSearch: false,
-		hybridSearch: false,
+		semanticSearch: true,
+		hybridSearch: true,
 		citations: true,
 		sync: false,
 		local: true
 	};
-	workspaceDir = "";
-	agentId = "main";
 	isAvailable() {
 		return true;
 	}
-	async initialize(_sessionId, options) {
-		this.workspaceDir = options?.workspace ?? options?.agentWorkspace ?? this.workspaceDir;
-		this.agentId = normalizeAgentId(String(options?.agentId ?? this.agentId));
-	}
+	async initialize() {}
 	systemPromptBlock() {
 		return "";
 	}
@@ -39,17 +34,40 @@ var BuiltinMemoryProvider = class {
 		return [];
 	}
 	async search(request) {
-		return searchMemoryRecords({
+		const options = {
 			query: request.query,
 			visibleToSessionKey: request.scope?.sessionKey,
 			unscopedSessionOnly: request.scope?.sessionKey == null,
 			visibleToProjectId: request.scope?.projectId,
 			unscopedProjectOnly: request.scope?.projectId == null,
+			visibleToWorkspaceId: request.scope?.workspaceId,
+			unscopedWorkspaceOnly: request.scope?.workspaceId == null,
 			providerId: this.id,
 			kinds: request.kinds,
 			maxResults: request.maxResults,
 			minScore: request.minScore
-		}).filter((result) => this.canReadRecord(result.record, request.scope)).sort((left, right) => right.score - left.score).slice(0, request.maxResults ?? 5);
+		};
+		const [active, shadow] = [searchMemoryRecords(options), searchMemoryRecords({
+			...options,
+			statuses: ["candidate"],
+			maxResults: Math.min(5, request.maxResults ?? 5)
+		})];
+		for (const result of shadow) appendMemorySignal({
+			signal: {
+				source: "search_recall",
+				recordId: result.record.id,
+				score: result.score,
+				metadata: {
+					query: request.query,
+					shadow: true
+				}
+			},
+			providerId: this.id,
+			sourceAgentId: result.record.provenance.sourceAgentId,
+			workspaceId: request.scope?.workspaceId,
+			sessionKey: request.scope?.sessionKey
+		});
+		return active.filter((result) => this.canReadRecord(result.record, request.scope)).sort((left, right) => right.score - left.score).slice(0, request.maxResults ?? 5);
 	}
 	async read(request) {
 		if (!request.id) return null;
@@ -62,7 +80,8 @@ var BuiltinMemoryProvider = class {
 	async list(request) {
 		return listMemoryRecords({
 			providerId: this.id,
-			workspaceId: request.scope?.workspaceId ?? this.workspaceDir,
+			visibleToWorkspaceId: request.scope?.workspaceId,
+			unscopedWorkspaceOnly: request.scope?.workspaceId == null,
 			visibleToSessionKey: request.scope?.sessionKey,
 			visibleToProjectId: request.scope?.projectId,
 			kind: request.kind,
@@ -75,8 +94,8 @@ var BuiltinMemoryProvider = class {
 		const record = upsertMemoryRecord({
 			providerId: this.id,
 			kind: request.kind,
-			sourceAgentId: this.agentId,
-			workspaceId: request.scope?.workspaceId ?? this.workspaceDir,
+			sourceAgentId: normalizeAgentId(request.sourceAgentId ?? "main"),
+			workspaceId: request.scope?.workspaceId,
 			sessionKey: request.scope?.sessionKey,
 			projectId: request.scope?.projectId,
 			content: request.content,
@@ -171,8 +190,8 @@ var BuiltinMemoryProvider = class {
 		appendMemorySignal({
 			signal: event.signal,
 			providerId: this.id,
-			sourceAgentId: this.agentId,
-			workspaceId: this.workspaceDir,
+			sourceAgentId: typeof event.signal.metadata?.agentId === "string" ? normalizeAgentId(event.signal.metadata.agentId) : "main",
+			workspaceId: typeof event.signal.metadata?.workspaceId === "string" ? event.signal.metadata.workspaceId : void 0,
 			sessionKey: typeof event.signal.metadata?.sessionKey === "string" ? event.signal.metadata.sessionKey : void 0
 		});
 	}
@@ -180,6 +199,7 @@ var BuiltinMemoryProvider = class {
 	canReadRecord(record, scope) {
 		if (record.scope.sessionKey && record.scope.sessionKey !== scope?.sessionKey) return false;
 		if (record.scope.projectId && record.scope.projectId !== scope?.projectId) return false;
+		if (record.scope.workspaceId && record.scope.workspaceId !== scope?.workspaceId) return false;
 		return true;
 	}
 };

package/dist/src/agent/memory/context/types.d.ts

@@ -1,7 +1,9 @@
 import type { AgentMessage } from '@earendil-works/pi-agent-core';
-export type UserContextRejectionReason = 'expired' | 'not_yet_valid' | 'sensitive' | 'requires_consent' | 'needs_review' | 'disabled' | 'conflict' | 'low_score' | 'budget';
+export type UserContextRejectionReason = 'expired' | 'not_yet_valid' | 'sensitive' | 'requires_consent' | 'needs_review' | 'scope_mismatch' | 'disabled' | 'conflict' | 'low_score' | 'budget';
 export interface PlannedUserContextItem {
     recordId: string;
+    objectType: 'profile' | 'rule' | 'understanding';
+    versionId?: string;
     content: string;
     score: number;
     section: 'task' | 'interaction' | 'safety';

package/dist/src/agent/memory/create-memory-manager.js

@@ -2,12 +2,14 @@ import { isMemorySubsystemEnabled } from "./memory-config.js";
 import { BuiltinMemoryProvider } from "./builtin-provider.js";
 import { MemoryManager } from "./manager.js";
 import { loadMemoryPluginProviders } from "./plugin-discovery.js";
+import { buildMemoryRuntime } from "../../agent-runtime/memory-runtime.js";
 //#region src/agent/memory/create-memory-manager.ts
 function createMemoryManagerFromConfig(config) {
 	const routing = resolveMemoryManagerOptions(config);
 	const enabled = isMemorySubsystemEnabled(config);
 	const mgr = new MemoryManager({
 		...routing,
+		...config ? { memoryRuntime: buildMemoryRuntime(config.userContext) } : {},
 		...enabled ? { loadProviders: () => loadMemoryPluginProviders({ config }) } : {}
 	});
 	mgr.addProvider(new BuiltinMemoryProvider());

package/dist/src/agent/memory/index.d.ts

@@ -1,6 +1,6 @@
 export { BuiltinMemoryProvider } from './builtin-provider.js';
 export { buildUserContextBlock, sanitizeUserContextFenceEscapes, } from './context-fence.js';
-export { UserContextPlanner } from './context/planner.js';
+export { UserContextPlanner } from '../../user-context/planner.js';
 export type { UserContextPlan } from './context/types.js';
 export { createMemoryManagerFromConfig } from './create-memory-manager.js';
 export { isMemorySubsystemEnabled, shouldPlanUserContextThisTurn, } from './memory-config.js';

package/dist/src/agent/memory/index.js

@@ -1,6 +1,6 @@
 import { isMemorySubsystemEnabled, shouldPlanUserContextThisTurn } from "./memory-config.js";
 import { buildUserContextBlock, sanitizeUserContextFenceEscapes } from "./context-fence.js";
-import { UserContextPlanner } from "./context/planner.js";
+import { UserContextPlanner } from "../../user-context/planner.js";
 import { extractAgentUserPlainText } from "./user-message-text.js";
 import { BuiltinMemoryProvider } from "./builtin-provider.js";
 import { UserUnderstandingService, extractExplicitUnderstandingCandidates } from "./understanding/service.js";

package/dist/src/agent/memory/manager.d.ts

@@ -1,4 +1,5 @@
 import type { AgentTool } from '@earendil-works/pi-agent-core';
+import type { MemoryRuntime } from '../../agent-runtime/memory-runtime.js';
 import type { MemoryProvider, MemoryProviderInitOptions } from './provider.js';
 import type { UnderstandingCandidate } from './understanding/types.js';
 import type { MemoryDeleteRequest, MemoryListRequest, MemoryReadRequest, MemoryReadResult, MemorySearchRequest, MemorySearchResult, MemoryUpdateRequest, MemoryWriteRequest, MemoryWriteResult, MemoryRecord, MemorySignal, MemoryKind } from './types.js';
@@ -12,6 +13,7 @@ export interface MemoryRoutingOptions {
 export interface MemoryManagerOptions extends MemoryRoutingOptions {
     loadProviders?: () => Promise<MemoryProvider[]>;
     writePolicy?: MemoryWritePolicy;
+    memoryRuntime?: MemoryRuntime;
 }
 export interface MemoryWritePolicy {
     allowExternalWrites?: boolean;
@@ -26,8 +28,9 @@ export declare class MemoryManager {
     private readonly writePolicy;
     private pluginProvidersLoaded;
     private readonly understanding;
+    private readonly memoryRuntime?;
     private readonly lastTurnSourceItem;
-    private understandingAgentId;
+    private readonly sessionContexts;
     constructor(options?: MemoryManagerOptions);
     addProvider(provider: MemoryProvider): void;
     get providersList(): MemoryProvider[];
@@ -42,6 +45,9 @@ export declare class MemoryManager {
     captureTurnUnderstanding(userContent: string, assistantContent: string, options?: {
         agentId?: string;
         sessionId?: string;
+        turnId?: string;
+        workspaceId?: string;
+        projectId?: string;
         correctionTargetRecordIds?: string[];
     }): Promise<import('./understanding/types.js').UnderstandingReviewResult>;
     syncProvidersForTurn(userContent: string, assistantContent: string, options?: {
@@ -50,6 +56,8 @@ export declare class MemoryManager {
     applyUnderstandingCandidates(candidates: UnderstandingCandidate[], context?: {
         agentId?: string;
         sessionKey?: string;
+        workspaceId?: string;
+        projectId?: string;
         sourceItemId?: string;
         sourceItemIds?: string[];
         sourceText?: string;

package/dist/src/agent/memory/manager.js

@@ -1,7 +1,7 @@
 import { createLogger } from "../../utils/logger/index.js";
 import { init_logger } from "../../utils/logger.js";
-import { appendMemoryTraceEvent } from "../../storage/sqlite/memory-records-repository.js";
 import { setKnowledgeSourceItemSynthesisStatus } from "../../storage/sqlite/knowledge-repository.js";
+import { appendMemoryTraceEvent } from "../../storage/sqlite/memory-records-repository.js";
 import "../../storage/sqlite/index.js";
 import { UserUnderstandingService } from "./understanding/service.js";
 //#region src/agent/memory/manager.ts
@@ -15,8 +15,9 @@ var MemoryManager = class {
 	writePolicy;
 	pluginProvidersLoaded = false;
 	understanding;
+	memoryRuntime;
 	lastTurnSourceItem = /* @__PURE__ */ new Map();
-	understandingAgentId;
+	sessionContexts = /* @__PURE__ */ new Map();
 	constructor(options = {}) {
 		this.routing = {
 			searchStrategy: options.searchStrategy ?? "fanout",
@@ -24,15 +25,13 @@ var MemoryManager = class {
 			replicateTo: options.replicateTo ?? []
 		};
 		this.loadProviders = options.loadProviders;
+		this.memoryRuntime = options.memoryRuntime;
 		this.writePolicy = {
 			allowExternalWrites: options.writePolicy?.allowExternalWrites ?? false,
 			allowedProviderIds: options.writePolicy?.allowedProviderIds,
 			autoWriteKinds: options.writePolicy?.autoWriteKinds
 		};
-		this.understanding = new UserUnderstandingService({
-			write: (request) => this.write(request),
-			list: (canonicalKey) => this.list({ canonicalKey })
-		});
+		this.understanding = new UserUnderstandingService();
 	}
 	addProvider(provider) {
 		this.providers.push(provider);
@@ -87,11 +86,14 @@ var MemoryManager = class {
 		await this.syncProvidersForTurn(userContent, assistantContent, options);
 	}
 	async captureTurnUnderstanding(userContent, assistantContent, options) {
+		const sessionContext = options?.sessionId ? this.sessionContexts.get(options.sessionId) : void 0;
 		const review = await this.understanding.reviewTurn({
-			agentId: options?.agentId ?? this.understandingAgentId,
 			userContent,
 			assistantContent,
 			sessionKey: options?.sessionId,
+			turnId: options?.turnId,
+			workspaceId: options?.workspaceId ?? sessionContext?.workspace ?? sessionContext?.agentWorkspace,
+			projectId: options?.projectId,
 			correctionTargetRecordIds: options?.correctionTargetRecordIds
 		});
 		if (options?.sessionId && review.sourceItemId) this.lastTurnSourceItem.set(options.sessionId, review.sourceItemId);
@@ -127,10 +129,11 @@ var MemoryManager = class {
 		}
 	}
 	async applyUnderstandingCandidates(candidates, context = {}) {
+		const sessionContext = context.sessionKey ? this.sessionContexts.get(context.sessionKey) : void 0;
 		const sourceItemId = context.sourceItemId ?? (context.sessionKey ? this.lastTurnSourceItem.get(context.sessionKey) : void 0);
 		const result = await this.understanding.applyCandidates(candidates, {
 			...context,
-			agentId: context.agentId ?? this.understandingAgentId,
+			workspaceId: context.workspaceId ?? sessionContext?.workspace ?? sessionContext?.agentWorkspace,
 			sourceItemId
 		});
 		const sourceItemIds = [...new Set([...sourceItemId ? [sourceItemId] : [], ...context.sourceItemIds ?? []])];
@@ -272,6 +275,12 @@ var MemoryManager = class {
 		return this.writeWithStrategy("delete", request);
 	}
 	canReadRecord(record, scope) {
+		if (record.providerId !== "local") return true;
+		if (this.memoryRuntime && !this.memoryRuntime.canRead(memorySourceForRecord(record))) return false;
+		if (record.scope.userId && scope?.userId && record.scope.userId !== scope.userId) return false;
+		if (record.scope.sessionKey && record.scope.sessionKey !== scope?.sessionKey) return false;
+		if (record.scope.projectId && record.scope.projectId !== scope?.projectId) return false;
+		if (record.scope.workspaceId && record.scope.workspaceId !== scope?.workspaceId) return false;
 		return true;
 	}
 	recordSignal(signal) {
@@ -306,7 +315,7 @@ var MemoryManager = class {
 		}
 	}
 	async initializeAll(sessionId, options) {
-		this.understandingAgentId = options?.agentId;
+		if (options) this.sessionContexts.set(sessionId, { ...options });
 		await this.loadPluginProvidersOnce();
 		for (const p of this.providers) try {
 			await p.initialize(sessionId, options);
@@ -337,6 +346,7 @@ var MemoryManager = class {
 	}
 	async shutdownAll() {
 		this.lastTurnSourceItem.clear();
+		this.sessionContexts.clear();
 		for (const p of [...this.providers].reverse()) try {
 			await p.shutdown();
 		} catch (err) {
@@ -420,6 +430,17 @@ var MemoryManager = class {
 		if (!provider.capabilities.local && this.writePolicy.allowedProviderIds && this.writePolicy.allowedProviderIds.length > 0 && !this.writePolicy.allowedProviderIds.includes(provider.id)) return false;
 		if (operation === "write") {
 			const writeRequest = request;
+			if (provider.capabilities.local && this.memoryRuntime) {
+				const check = this.memoryRuntime.checkWrite({
+					target: writeRequest.writeTarget ?? writeTargetForRecord(writeRequest),
+					content: writeRequest.content,
+					source: writeRequest.source?.provider ?? "memory",
+					confidence: writeRequest.confidence,
+					sensitive: writeRequest.sensitivity != null && writeRequest.sensitivity !== "normal"
+				});
+				if (check.decision === "deny") return false;
+				if (check.decision === "confirm" && writeRequest.status !== "candidate" && !writeRequest.confirmed) return false;
+			}
 			if (writeRequest.status === "candidate" && !provider.capabilities.local) return false;
 			if (this.writePolicy.autoWriteKinds && this.writePolicy.autoWriteKinds.length > 0 && !this.writePolicy.autoWriteKinds.includes(writeRequest.kind)) return false;
 		}
@@ -442,6 +463,15 @@ var MemoryManager = class {
 		}
 	}
 };
+function memorySourceForRecord(record) {
+	if (record.source.provider === "agent-profile") return "agentProfile";
+	if (record.scope.sessionKey) return "session";
+	if (record.scope.workspaceId || record.kind === "workspace_fact" || record.kind === "project_context" || record.kind === "task_lesson") return "workspace";
+	return "understanding";
+}
+function writeTargetForRecord(request) {
+	return request.scope?.workspaceId || request.kind === "workspace_fact" || request.kind === "project_context" || request.kind === "task_lesson" ? "workspace" : "understanding";
+}
 function sanitizeTraceRequest(request) {
 	if (!request || typeof request !== "object") return request;
 	const copy = { ...request };

package/dist/src/agent/memory/memory-config.d.ts

@@ -1,5 +1,5 @@
 import type { Config } from '../../config/schema.js';
-/** When false, structured user understanding and external memory providers are off. */
+/** Whether generic workspace and provider-backed memory is available. */
 export declare function isMemorySubsystemEnabled(config: Config | undefined): boolean;
 /**
  * Whether to prefix the user message with prefetched external memory this turn.

package/dist/src/agent/memory/memory-config.js

@@ -1,5 +1,5 @@
 //#region src/agent/memory/memory-config.ts
-/** When false, structured user understanding and external memory providers are off. */
+/** Whether generic workspace and provider-backed memory is available. */
 function isMemorySubsystemEnabled(config) {
 	if (!config) return true;
 	return config.userContext.enabled && config.userContext.memory.mode !== "off";

package/dist/src/agent/memory/source-origin.js

@@ -2,8 +2,6 @@
 const INTERNAL_MEMORY_PROVIDERS = new Set([
 	"local",
 	"builtin",
-	"user-understanding",
-	"dreaming",
 	"workflow-run"
 ]);
 function classifyMemoryContextOrigin(record) {

package/dist/src/agent/memory/types.d.ts

@@ -100,6 +100,10 @@ export interface MemoryWriteRequest {
     content: string;
     canonicalKey?: string;
     scope?: Partial<MemoryScope>;
+    /** Agent that produced this record. This is request data, never provider state. */
+    sourceAgentId?: string;
+    writeTarget?: 'agentProfile' | 'understanding' | 'workspace';
+    confirmed?: boolean;
     tags?: string[];
     source?: MemoryRecord['source'];
     confidence?: number;
@@ -163,7 +167,7 @@ export type MemorySyncEvent = {
     signal: MemorySignal;
 };
 export interface MemorySignal {
-    source: 'search_recall' | 'context_injection' | 'session_summary' | 'explicit_remember' | 'background_review' | 'dreaming';
+    source: 'search_recall' | 'context_injection' | 'session_summary' | 'explicit_remember' | 'background_review';
     recordId?: string;
     score?: number;
     content?: string;

package/dist/src/agent/memory/understanding/service.d.ts

@@ -1,27 +1,27 @@
-import type { MemoryRecord, MemoryWriteRequest, MemoryWriteResult } from '../types.js';
 import type { UnderstandingCandidate, UnderstandingReviewResult } from './types.js';
 export declare function extractExplicitUnderstandingCandidates(userContent: string): UnderstandingCandidate[];
-export interface UserUnderstandingServiceOptions {
-    write: (request: MemoryWriteRequest) => Promise<MemoryWriteResult>;
-    list: (canonicalKey: string) => Promise<MemoryRecord[]>;
-}
 export declare class UserUnderstandingService {
-    private readonly options;
-    constructor(options: UserUnderstandingServiceOptions);
     reviewTurn(params: {
-        agentId?: string;
         userContent: string;
         assistantContent: string;
         sessionKey?: string;
+        turnId?: string;
+        workspaceId?: string;
+        projectId?: string;
         correctionTargetRecordIds?: string[];
     }): Promise<UnderstandingReviewResult>;
     applyCandidates(candidates: UnderstandingCandidate[], context: {
-        agentId?: string;
         sessionKey?: string;
+        workspaceId?: string;
+        projectId?: string;
         sourceItemId?: string;
         sourceItemIds?: string[];
         sourceText?: string;
-        source?: MemoryRecord['source'];
+        source?: {
+            provider?: string;
+            sourceInstanceId?: string;
+        };
+        evidenceIds?: string[];
         reviewSource?: 'turn' | 'background';
         supersedesRecordIds?: string[];
     }): Promise<Omit<UnderstandingReviewResult, 'sourceItemId'>>;