@xopcai/xopc 0.0.232 → 0.0.234

package/dist/gateway/static/root/index.html

@@ -11,7 +11,7 @@
     <link rel="apple-touch-icon" sizes="180x180" href="/apple-touch-icon.png?v=20260713-1" />
     <link rel="manifest" href="/site.webmanifest?v=20260713-1" />
     <title>XOPC — Keep what matters moving.</title>
-    <script type="module" crossorigin src="/assets/index-B2OJSXX9.js"></script>
+    <script type="module" crossorigin src="/assets/index-CXGQihfj.js"></script>
     <link rel="modulepreload" crossorigin href="/assets/rolldown-runtime-aKtaBQYM.js">
     <link rel="modulepreload" crossorigin href="/assets/preload-helper-zJ_50EbN.js">
     <link rel="modulepreload" crossorigin href="/assets/vendor-react-BOUWij0V.js">
@@ -25,13 +25,13 @@
     <link rel="modulepreload" crossorigin href="/assets/download-Dk-ZjtO6.js">
     <link rel="modulepreload" crossorigin href="/assets/plus-Q2yW6OE7.js">
     <link rel="modulepreload" crossorigin href="/assets/x-B_N4OPjy.js">
-    <link rel="modulepreload" crossorigin href="/assets/messages-Dp1OxSKt.js">
-    <link rel="modulepreload" crossorigin href="/assets/locale-store-DLwVxS3V.js">
+    <link rel="modulepreload" crossorigin href="/assets/messages-CoovNoMn.js">
+    <link rel="modulepreload" crossorigin href="/assets/locale-store-8k4mvYGL.js">
     <link rel="modulepreload" crossorigin href="/assets/cn-JdwAhgNB.js">
     <link rel="modulepreload" crossorigin href="/assets/schemas-zIBW3wiV.js">
     <link rel="modulepreload" crossorigin href="/assets/product-delivery-tRr-7IxY.js">
     <link rel="modulepreload" crossorigin href="/assets/copy-to-clipboard-HOJ79TWv.js">
-    <link rel="modulepreload" crossorigin href="/assets/markdown-view-B-BHEcNd.js">
+    <link rel="modulepreload" crossorigin href="/assets/markdown-view-D02mJdoU.js">
     <link rel="modulepreload" crossorigin href="/assets/dist-DqPZM2MH2.js">
     <link rel="modulepreload" crossorigin href="/assets/vendor-swr-BIWyz7Rc.js">
     <link rel="modulepreload" crossorigin href="/assets/check-DUBLcKHA.js">
@@ -46,7 +46,7 @@
     <link rel="modulepreload" crossorigin href="/assets/eye-off-DEAzt3g1.js">
     <link rel="modulepreload" crossorigin href="/assets/eye-CABVeTq0.js">
     <link rel="modulepreload" crossorigin href="/assets/globe-DSSGFWFn.js">
-    <link rel="modulepreload" crossorigin href="/assets/notes-api-DEdNKw0I.js">
+    <link rel="modulepreload" crossorigin href="/assets/notes-api-p2Pncp2B.js">
     <link rel="modulepreload" crossorigin href="/assets/loader-circle-CifKLtgG.js">
     <link rel="modulepreload" crossorigin href="/assets/rotate-cw-LIg3Am9S.js">
     <link rel="modulepreload" crossorigin href="/assets/search-DA7gz22f.js">
@@ -54,20 +54,20 @@
     <link rel="modulepreload" crossorigin href="/assets/files-Dp8_uGTO.js">
     <link rel="modulepreload" crossorigin href="/assets/tool-activity-R8V9l6nk.js">
     <link rel="modulepreload" crossorigin href="/assets/button-CSEbl4zT.js">
-    <link rel="modulepreload" crossorigin href="/assets/gateway-startup-retry-D2Rnh9fX.js">
-    <link rel="modulepreload" crossorigin href="/assets/registry-api-Cvr4Qm7N.js">
+    <link rel="modulepreload" crossorigin href="/assets/gateway-startup-retry-2rVSUvyw.js">
+    <link rel="modulepreload" crossorigin href="/assets/registry-api-B7b0LJgI.js">
     <link rel="modulepreload" crossorigin href="/assets/config-reload-event-Bjh2zoKp.js">
-    <link rel="modulepreload" crossorigin href="/assets/gateway-config-swr-BGQn8duh.js">
-    <link rel="modulepreload" crossorigin href="/assets/models-hub-cache-C8zjqmIv.js">
+    <link rel="modulepreload" crossorigin href="/assets/gateway-config-swr-R702lNJR.js">
+    <link rel="modulepreload" crossorigin href="/assets/models-hub-cache-CYr6LzvY.js">
     <link rel="modulepreload" crossorigin href="/assets/electron-env-DH5wF8X8.js">
-    <link rel="modulepreload" crossorigin href="/assets/oauth-api-BNCO2YK5.js">
+    <link rel="modulepreload" crossorigin href="/assets/oauth-api-DpLONwfK.js">
     <link rel="modulepreload" crossorigin href="/assets/form-field-width-DJw_jULe.js">
     <link rel="modulepreload" crossorigin href="/assets/interaction-BmQogeqz.js">
     <link rel="modulepreload" crossorigin href="/assets/is-masked-secret-DOkL5b_X.js">
-    <link rel="modulepreload" crossorigin href="/assets/activity-store-VXCWz43N.js">
-    <link rel="modulepreload" crossorigin href="/assets/theme-store-Cpd3Gd5R.js">
+    <link rel="modulepreload" crossorigin href="/assets/activity-store-BzswYHcj.js">
+    <link rel="modulepreload" crossorigin href="/assets/theme-store-CpcBI73Q.js">
     <link rel="stylesheet" crossorigin href="/assets/markdown-view-B1bGSQqt.css">
-    <link rel="stylesheet" crossorigin href="/assets/index-rHjAElxG.css">
+    <link rel="stylesheet" crossorigin href="/assets/index-BTUuTnc9.css">
   </head>
   <body>
     <div id="root"></div>

package/dist/package.js

@@ -1,4 +1,4 @@
 //#region package.json
-var version = "0.0.232";
+var version = "0.0.234";
 //#endregion
 export { version };

package/dist/packages/endpoint-tools-protocol/src/index.js

@@ -18,6 +18,7 @@ const endpointResultKindSchema = z.enum([
 	"json",
 	"file"
 ]);
+const endpointSensitivitySchema = z.enum(["public", "personal"]);
 const identifierSchema = z.string().min(1).max(160);
 const turnTokenSchema = z.string().min(32).max(160).regex(/^[A-Za-z0-9_-]+$/);
 const turnOriginSchema = z.discriminatedUnion("type", [
@@ -49,6 +50,9 @@ const endpointToolDescriptorSchema = z.strictObject({
 	title: z.string().min(1).max(120),
 	description: z.string().min(1).max(2e3),
 	inputSchema: jsonObjectSchema,
+	outputSchema: jsonObjectSchema,
+	policyId: z.string().regex(/^[a-z][a-z0-9_.-]+$/).max(120),
+	sensitivity: endpointSensitivitySchema,
 	effect: endpointEffectSchema,
 	confirmation: endpointConfirmationSchema,
 	requiresForeground: z.boolean(),
@@ -66,6 +70,42 @@ const endpointPrincipalRegistrationSchema = z.strictObject({
 	platform: z.string().min(1).max(80),
 	publicKey: z.string().min(32).max(2048)
 });
+const endpointSessionBindingRequestSchema = z.strictObject({ endpointId: identifierSchema });
+const backgroundCapabilitySchema = z.string().regex(/^[a-z][a-z0-9_]*(?:\.[a-z][a-z0-9_]*)+$/).max(120);
+z.strictObject({
+	jobId: z.uuid(),
+	endpointId: identifierSchema,
+	capability: backgroundCapabilitySchema,
+	input: jsonObjectSchema,
+	idempotencyKey: identifierSchema,
+	consentGrantId: identifierSchema,
+	createdAt: timestampSchema,
+	expiresAt: timestampSchema
+});
+z.strictObject({
+	jobId: z.uuid(),
+	status: z.enum([
+		"queued",
+		"running",
+		"succeeded",
+		"failed",
+		"cancelled"
+	]),
+	updatedAt: timestampSchema,
+	output: jsonObjectSchema.optional(),
+	error: z.strictObject({
+		code: identifierSchema,
+		message: z.string().min(1).max(2e3)
+	}).optional()
+});
+z.strictObject({
+	eventId: z.uuid(),
+	endpointId: identifierSchema,
+	subscriptionId: identifierSchema,
+	eventType: backgroundCapabilitySchema,
+	data: jsonObjectSchema,
+	occurredAt: timestampSchema
+});
 const endpointHelloPayloadSchema = z.strictObject({
 	principalId: identifierSchema,
 	endpointId: identifierSchema,
@@ -135,7 +175,7 @@ const endpointToolErrorCodeSchema = z.enum([
 	"PROTOCOL_ERROR"
 ]);
 const envelope = (type, payload) => z.strictObject({
-	protocolVersion: z.literal(1),
+	protocolVersion: z.literal(2),
 	messageId: messageIdSchema,
 	type: z.literal(type),
 	sentAt: timestampSchema,
@@ -162,6 +202,126 @@ const clientEndpointMessageSchema = z.discriminatedUnion("type", [
 	envelope("tool.cancelled", invocationPayloadSchema)
 ]);
 const serverEndpointMessageSchema = z.discriminatedUnion("type", [envelope("tool.invoke", toolInvokePayloadSchema), envelope("tool.cancel", toolCancelPayloadSchema)]);
+const ENDPOINT_TEXT_OUTPUT_SCHEMA = {
+	type: "array",
+	minItems: 1,
+	maxItems: 20,
+	items: {
+		type: "object",
+		additionalProperties: false,
+		required: ["type", "text"],
+		properties: {
+			type: { const: "text" },
+			text: {
+				type: "string",
+				maxLength: 256 * 1024
+			}
+		}
+	}
+};
+const ENDPOINT_FILE_OUTPUT_SCHEMA = {
+	type: "array",
+	minItems: 1,
+	maxItems: 20,
+	items: {
+		type: "object",
+		additionalProperties: false,
+		required: [
+			"type",
+			"fileId",
+			"name",
+			"mimeType",
+			"size",
+			"sha256"
+		],
+		properties: {
+			type: { const: "file" },
+			fileId: {
+				type: "string",
+				minLength: 1,
+				maxLength: 160
+			},
+			name: {
+				type: "string",
+				minLength: 1,
+				maxLength: 255
+			},
+			mimeType: {
+				type: "string",
+				minLength: 1,
+				maxLength: 255
+			},
+			size: {
+				type: "integer",
+				minimum: 0
+			},
+			sha256: {
+				type: "string",
+				pattern: "^[a-f0-9]{64}$"
+			}
+		}
+	}
+};
+const ENDPOINT_CONTACT_RECORD_SCHEMA = {
+	type: "object",
+	additionalProperties: false,
+	required: [
+		"id",
+		"name",
+		"phones",
+		"emails"
+	],
+	properties: {
+		id: {
+			type: "string",
+			minLength: 1,
+			maxLength: 512
+		},
+		name: {
+			type: "string",
+			minLength: 1,
+			maxLength: 500
+		},
+		phones: {
+			type: "array",
+			maxItems: 20,
+			items: {
+				type: "string",
+				maxLength: 100
+			}
+		},
+		emails: {
+			type: "array",
+			maxItems: 20,
+			items: {
+				type: "string",
+				maxLength: 320
+			}
+		}
+	}
+};
+function contactOutputSchema(multiple) {
+	return {
+		type: "array",
+		minItems: 1,
+		maxItems: 1,
+		items: {
+			type: "object",
+			additionalProperties: false,
+			required: ["type", "value"],
+			properties: {
+				type: { const: "json" },
+				value: multiple ? {
+					type: "array",
+					maxItems: 20,
+					items: ENDPOINT_CONTACT_RECORD_SCHEMA
+				} : ENDPOINT_CONTACT_RECORD_SCHEMA
+			}
+		}
+	};
+}
+const ENDPOINT_CONTACT_OUTPUT_SCHEMA = contactOutputSchema(false);
+const ENDPOINT_CONTACT_LIST_OUTPUT_SCHEMA = contactOutputSchema(true);
 function canonicalJson(value) {
 	if (value === null) return "null";
 	if (typeof value === "string" || typeof value === "boolean") return JSON.stringify(value);
@@ -181,4 +341,4 @@ function endpointHelloSigningPayload(payload) {
 	return canonicalJson(unsigned);
 }
 //#endregion
-export { ENDPOINT_INVOCATION_RECEIPT_TIMEOUT_MS, ENDPOINT_MAX_FILE_BYTES, canonicalJson, clientEndpointMessageSchema, endpointHelloPayloadSchema, endpointHelloSigningPayload, endpointPrincipalRegistrationSchema, endpointTurnClaimSchema, serverEndpointMessageSchema, turnOriginSchema };
+export { ENDPOINT_CONTACT_LIST_OUTPUT_SCHEMA, ENDPOINT_CONTACT_OUTPUT_SCHEMA, ENDPOINT_FILE_OUTPUT_SCHEMA, ENDPOINT_INVOCATION_RECEIPT_TIMEOUT_MS, ENDPOINT_MAX_FILE_BYTES, ENDPOINT_TEXT_OUTPUT_SCHEMA, canonicalJson, clientEndpointMessageSchema, endpointHelloPayloadSchema, endpointHelloSigningPayload, endpointPrincipalRegistrationSchema, endpointSessionBindingRequestSchema, endpointTurnClaimSchema, serverEndpointMessageSchema, turnOriginSchema };

package/dist/packages/gateway-contract/src/product-delivery.js

@@ -41,12 +41,16 @@ const ProductDeliveryOperationSchema = z.enum([
 	"completed",
 	"failed"
 ]);
-z.object({
+const ProductDeliveryEnvelopeSchema = z.object({
 	version: z.literal(1),
 	operation: ProductDeliveryOperationSchema,
 	primary: ProductReferenceSchema.optional(),
 	related: z.array(ProductReferenceSchema).optional()
 });
+function parseProductDeliveryEnvelope(value) {
+	const parsed = ProductDeliveryEnvelopeSchema.safeParse(value);
+	return parsed.success ? parsed.data : null;
+}
 const PRODUCT_DELIVERY_TEXT_PREFIX = "xopc-product-delivery:";
 function appendProductDeliveryText(text, delivery) {
 	if (!delivery) return text;
@@ -59,4 +63,4 @@ function productReferenceDeepLink(reference) {
 	}).toString()}`;
 }
 //#endregion
-export { appendProductDeliveryText };
+export { appendProductDeliveryText, parseProductDeliveryEnvelope };

package/dist/packages/gateway-contract/src/turn-outcome.js

@@ -106,9 +106,85 @@ const TurnOutcomeSchema = z.object({
 	evidence: z.array(TurnOutcomeEvidenceSchema),
 	createdAt: z.string()
 });
+const FILE_RESOURCE_ARTIFACT_URI_PREFIX = "xopc-file:";
+function fileResourceArtifactUri(fileResourceId) {
+	return `${FILE_RESOURCE_ARTIFACT_URI_PREFIX}${encodeURIComponent(fileResourceId)}`;
+}
+function turnOutcomeKindFromFileName(fileName) {
+	const extension = fileName.toLowerCase().split(".").pop() ?? "";
+	if (extension === "xlsx" || extension === "xls" || extension === "csv" || extension === "tsv") return "spreadsheet";
+	if (extension === "pptx" || extension === "ppt") return "presentation";
+	if (extension === "pdf") return "pdf";
+	if ([
+		"doc",
+		"docx",
+		"md",
+		"rtf",
+		"txt"
+	].includes(extension)) return "document";
+	if ([
+		"png",
+		"jpg",
+		"jpeg",
+		"gif",
+		"webp",
+		"svg",
+		"bmp"
+	].includes(extension)) return "image";
+	if ([
+		"mp4",
+		"mov",
+		"webm"
+	].includes(extension)) return "video";
+	if ([
+		"mp3",
+		"wav",
+		"ogg",
+		"m4a"
+	].includes(extension)) return "audio";
+	if ([
+		"zip",
+		"tar",
+		"gz",
+		"tgz"
+	].includes(extension)) return "archive";
+	if (extension === "html" || extension === "htm") return "site";
+	return "file";
+}
+function turnOutcomeMimeTypeFromFileName(fileName) {
+	return {
+		xlsx: "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet",
+		xls: "application/vnd.ms-excel",
+		csv: "text/csv",
+		tsv: "text/tab-separated-values",
+		pptx: "application/vnd.openxmlformats-officedocument.presentationml.presentation",
+		ppt: "application/vnd.ms-powerpoint",
+		docx: "application/vnd.openxmlformats-officedocument.wordprocessingml.document",
+		doc: "application/msword",
+		pdf: "application/pdf",
+		md: "text/markdown",
+		txt: "text/plain",
+		html: "text/html",
+		htm: "text/html",
+		png: "image/png",
+		jpg: "image/jpeg",
+		jpeg: "image/jpeg",
+		gif: "image/gif",
+		webp: "image/webp",
+		svg: "image/svg+xml",
+		mp4: "video/mp4",
+		mov: "video/quicktime",
+		webm: "video/webm",
+		mp3: "audio/mpeg",
+		wav: "audio/wav",
+		ogg: "audio/ogg",
+		m4a: "audio/mp4",
+		zip: "application/zip"
+	}[fileName.toLowerCase().split(".").pop() ?? ""];
+}
 function parseTurnOutcome(value) {
 	const parsed = TurnOutcomeSchema.safeParse(value);
 	return parsed.success ? parsed.data : null;
 }
 //#endregion
-export { TurnOutcomeDeliverableSchema, parseTurnOutcome };
+export { TurnOutcomeDeliverableSchema, fileResourceArtifactUri, parseTurnOutcome, turnOutcomeKindFromFileName, turnOutcomeMimeTypeFromFileName };

package/dist/src/agent/agent-manager.js

@@ -5,16 +5,16 @@ import { getSessionMetadata } from "../storage/sqlite/session-repository.js";
 import { getSessionConfig } from "../storage/sqlite/config-repository.js";
 import "../storage/sqlite/index.js";
 import { getAgentDefaultModelRef, init_schema } from "../config/schema.js";
-import { applyConfigOverrides } from "../config/runtime-overrides.js";
 import { expandWorkspacePathString, init_workspace_path } from "../config/workspace-path.js";
 import { init_agent_scope, resolveAgentProfileDir } from "./agent-scope.js";
-import { init_session_key, parseSessionKey } from "../routing/session-key.js";
-import { resolveEffectiveAgentProfile, resolveEffectiveAgentProfileForSession } from "../config/agent-profile.js";
 import { init_paths, resolveBundledSkillsDir } from "../config/paths.js";
-import { init_sync_provider_auth, resolveProviderApiKeySync } from "../auth/sync-provider-auth.js";
 import { CredentialResolver, init_credentials } from "../auth/credentials.js";
+import { init_session_key, parseSessionKey } from "../routing/session-key.js";
+import { init_sync_provider_auth, resolveProviderApiKeySync } from "../auth/sync-provider-auth.js";
 import { getApiKeySync, getDefaultModelSync, init_providers, resolveModel } from "../providers/index.js";
 import { createExtensionAwareStreamFn } from "../providers/extension-stream-bridge.js";
+import { applyConfigOverrides } from "../config/runtime-overrides.js";
+import { resolveEffectiveAgentProfile, resolveEffectiveAgentProfileForSession } from "../config/agent-profile.js";
 import { extractTextContent } from "./context/workspace.js";
 import { buildExecutionScopeContextForPrompt } from "./context/execution-scope.js";
 import { clearBootstrapSnapshot } from "./bootstrap/bootstrap-cache.js";

package/dist/src/agent/background-review/run-background-review.js

@@ -4,10 +4,10 @@ import { finishContextExtractionRun } from "../../storage/sqlite/context-extract
 import { getTurnPersonalization } from "../../storage/sqlite/user-context-repository.js";
 import { loadCompactionSourceSnapshot } from "../../storage/sqlite/transcript-repository.js";
 import "../../storage/sqlite/index.js";
-import { extractProfileAgentId } from "../../config/agent-profile.js";
 import { init_sync_provider_auth, resolveProviderApiKeySync } from "../../auth/sync-provider-auth.js";
 import { getApiKeySync, init_providers, resolveModel } from "../../providers/index.js";
 import { createExtensionAwareStreamFn } from "../../providers/extension-stream-bridge.js";
+import { extractProfileAgentId } from "../../config/agent-profile.js";
 import { extractTextContent } from "../context/workspace.js";
 import { readAgentMessageContent } from "../memory/agent-message-access.js";
 import { resolveAgentTurnTimeoutMs, runAgentTurnWithTimeout } from "../orchestration/run-agent-turn-with-timeout.js";

package/dist/src/agent/capabilities/definitions.d.ts

@@ -156,7 +156,7 @@ export declare const AGENT_CAPABILITY_DEFINITIONS: readonly [{
     readonly label: "Data analysis";
     readonly description: "Analyze local structured data and produce derived tables, summaries, or artifacts.";
     readonly category: "analysis";
-    readonly tools: readonly ["read_file", "write_file", "list_dir", "grep", "find"];
+    readonly tools: readonly ["read_file", "write_file", "list_dir", "grep", "find", "publish_artifacts"];
     readonly activation: {
         readonly mode: "explicit";
         readonly ttl: "session";

package/dist/src/agent/capabilities/definitions.js

@@ -159,7 +159,8 @@ const AGENT_CAPABILITY_DEFINITIONS = [
 			"write_file",
 			"list_dir",
 			"grep",
-			"find"
+			"find",
+			"publish_artifacts"
 		],
 		activation: {
 			mode: "explicit",

package/dist/src/agent/embedded/model-runtime.js

@@ -1,6 +1,6 @@
 import { init_paths, resolveModelsJsonPath } from "../../config/paths.js";
-import { init_sync_provider_auth, resolveProviderApiKeySync } from "../../auth/sync-provider-auth.js";
 import { CredentialResolver, init_credentials } from "../../auth/credentials.js";
+import { init_sync_provider_auth, resolveProviderApiKeySync } from "../../auth/sync-provider-auth.js";
 import { XopcModelCredentialStore, init_model_credential_store } from "../../auth/model-credential-store.js";
 import { init_register_bundled_oauth_flows, registerBundledOAuthFlows } from "../../providers/register-bundled-oauth-flows.js";
 import { init_register_runtime_providers, registerRuntimeProviders } from "../../providers/register-runtime-providers.js";

package/dist/src/agent/embedded/run-for-session.js

@@ -1,11 +1,13 @@
 import { createLogger } from "../../utils/logger/index.js";
 import { init_logger } from "../../utils/logger.js";
-import { resolveEffectiveAgentProfileForSession } from "../../config/agent-profile.js";
 import { init_providers, resolveModel } from "../../providers/index.js";
+import { resolveEffectiveAgentProfileForSession } from "../../config/agent-profile.js";
+import { parseTurnOutcome } from "../../../packages/gateway-contract/src/turn-outcome.js";
 import { resolveAgentTurnTimeoutMs } from "../orchestration/run-agent-turn-with-timeout.js";
 import { resolvePromptCachePolicy } from "../../providers/prompt-cache-plan.js";
 import { evaluateContextBudget } from "../memory/context-budget.js";
 import { resolveCompactionPolicy } from "../memory/compaction-policy.js";
+import { projectTurnOutcome } from "../../session/turn-outcome-projector.js";
 import { runXopcEmbeddedTurn } from "./run-turn.js";
 import { applyStartupContextToUserMessage } from "../reply/apply-turn-user-enrichment.js";
 import { AgentRunSupervisor } from "../orchestration/agent-run-supervisor.js";
@@ -23,6 +25,41 @@ async function runEmbeddedTurnForSession(params) {
 		deadlineAtMs: params.deadlineAtMs,
 		parentSignal: params.abortSignal
 	});
+	const finish = async (result) => {
+		try {
+			const rows = await sessionStore.loadTranscriptRows(sessionKey);
+			const hasTurn = rows.some((source) => {
+				return source.turnId === runId;
+			});
+			const alreadyPersisted = rows.some((source) => {
+				const row = source;
+				return row.type === "custom" && row.customType === "turn_outcome" && parseTurnOutcome(row.data)?.turnId === runId;
+			});
+			if (!hasTurn || alreadyPersisted) return result;
+			const outcome = projectTurnOutcome({
+				rows,
+				turnId: runId,
+				runStatus: result.ok ? "success" : result.errorMessage === "aborted" ? "cancelled" : "error",
+				summary: result.errorMessage
+			});
+			await sessionStore.appendTranscriptCustomEntry(sessionKey, {
+				customType: "turn_outcome",
+				data: outcome
+			});
+			params.onEvent?.({
+				type: "turn_outcome",
+				runId,
+				outcome
+			});
+		} catch (err) {
+			log.warn({
+				err,
+				sessionKey,
+				runId
+			}, "Turn outcome persistence failed");
+		}
+		return result;
+	};
 	try {
 		await params.beforeTurn?.();
 		if (supervisor.signal.aborted) return {
@@ -169,7 +206,7 @@ async function runEmbeddedTurnForSession(params) {
 						attempt: i + 1,
 						total: resolvedCandidates.length
 					}, "Agent model fallback succeeded");
-					return turnResult;
+					return finish(turnResult);
 				}
 				lastResult = turnResult;
 				if (supervisor.signal.aborted || turnResult.retryable === false) break;
@@ -184,7 +221,13 @@ async function runEmbeddedTurnForSession(params) {
 				}, hasNextCandidate ? "Agent model turn failed, trying fallback" : "Agent model turn failed, no fallback remains");
 			} catch (err) {
 				lastError = err;
-				if (err instanceof DOMException && err.name === "AbortError") throw err;
+				if (err instanceof DOMException && err.name === "AbortError") {
+					await finish({
+						ok: false,
+						errorMessage: "aborted"
+					});
+					throw err;
+				}
 				log.warn({
 					err,
 					sessionKey,
@@ -209,13 +252,19 @@ async function runEmbeddedTurnForSession(params) {
 				resumeLastUserMessage = preparation === "resume";
 			}
 		}
-		if (lastResult) return lastResult;
-		if (lastError instanceof Error) throw lastError;
-		if (lastError != null) throw new Error(String(lastError));
-		return {
+		if (lastResult) return finish(lastResult);
+		if (lastError != null) {
+			const result = await finish({
+				ok: false,
+				errorMessage: lastError instanceof Error ? lastError.message : String(lastError)
+			});
+			if (lastError instanceof Error) throw lastError;
+			throw new Error(result.errorMessage);
+		}
+		return finish({
 			ok: false,
 			errorMessage: "No model candidates available"
-		};
+		});
 	} finally {
 		supervisor.dispose();
 	}

package/dist/src/agent/embedded/types.d.ts

@@ -1,5 +1,6 @@
 import type { AgentMessage, AgentToolResult, ThinkingLevel } from '@earendil-works/pi-agent-core';
 import type { AssistantMessageEvent, Model, Api, ImageContent } from '@earendil-works/pi-ai';
+import type { TurnOutcome } from '@xopcai/gateway-contract';
 import type { SessionStore } from '../../session/store.js';
 import type { EmbeddedTranscriptRuntime } from './transcript-runtime.js';
 import type { AgentTurnPolicy } from '../orchestration/agent-turn-policy.js';
@@ -76,6 +77,10 @@ export type EmbeddedStreamEvent = {
     type: 'error';
     runId?: string;
     content: string;
+} | {
+    type: 'turn_outcome';
+    runId?: string;
+    outcome: TurnOutcome;
 } | {
     type: 'compaction';
     runId?: string;

package/dist/src/agent/external-tools/endpoint-provider.js

@@ -66,13 +66,17 @@ var EndpointToolProvider = class {
 			details: {
 				endpointId: resolved.endpointId,
 				endpointToolName: resolved.tool.descriptor.name,
+				endpointSensitivity: resolved.tool.descriptor.sensitivity,
 				...result.details ?? {},
 				...files.length === 0 ? {} : { endpointFiles: files }
 			}
 		};
 	}
 	currentEndpoint() {
-		const origin = this.deps.getCurrentContext()?.origin;
+		const context = this.deps.getCurrentContext();
+		if (!context) return void 0;
+		if (this.deps.runtime.bindings.get(context.sessionKey)) return this.deps.runtime.bindings.resolve(context.sessionKey);
+		const origin = context.origin;
 		if (origin?.type !== "endpoint") return void 0;
 		return this.deps.runtime.registry.get(origin.endpointId);
 	}

package/dist/src/agent/image/tool-model-config.js

@@ -1,7 +1,7 @@
 import { getAgentDefaultImageModelConfig, getAgentDefaultModelRef, init_schema, parseModelRef } from "../../config/schema.js";
 import { init_agent_scope, resolveDefaultAgentId } from "../agent-scope.js";
-import { resolveEffectiveAgentConfigForAgent } from "../../config/agent-profile.js";
 import { getDefaultModelSync, getModelsByProvider, init_providers, isProviderConfiguredSync, resolveModel } from "../../providers/index.js";
+import { resolveEffectiveAgentConfigForAgent } from "../../config/agent-profile.js";
 import { resolveAgentModelFallbackValues, resolveAgentModelPrimaryValue } from "../../config/model-input.js";
 import { buildCapabilityPlansForConfig } from "../../capabilities/readiness/from-config.js";
 import "../../capabilities/readiness/index.js";

package/dist/src/agent/ipc/inbox.js

@@ -1,7 +1,7 @@
 import { createLogger } from "../../utils/logger/index.js";
 import { init_logger } from "../../utils/logger.js";
-import { init_paths, resolveAgentDir } from "../../config/paths.js";
 import { init_write_file_atomic, writeTextAtomic } from "../../infra/write-file-atomic.js";
+import { init_paths, resolveAgentDir } from "../../config/paths.js";
 import { join } from "path";
 import { existsSync, watch } from "fs";
 import { mkdir, readFile, readdir, rename } from "fs/promises";

package/dist/src/agent/mcp/oauth/mcp-oauth-store.js

@@ -1,5 +1,5 @@
-import { init_paths, resolveMcpOAuthPath } from "../../../config/paths.js";
 import { init_write_file_atomic, writeTextAtomic } from "../../../infra/write-file-atomic.js";
+import { init_paths, resolveMcpOAuthPath } from "../../../config/paths.js";
 import { createHash } from "node:crypto";
 import { readFile, rm } from "node:fs/promises";
 //#region src/agent/mcp/oauth/mcp-oauth-store.ts

package/dist/src/agent/prompt/sections/tooling.js

@@ -14,6 +14,7 @@ const CORE_TOOL_ORDER = [
 	"browser_use",
 	"send_message",
 	"send_media",
+	"publish_artifacts",
 	"memory_search",
 	"memory_get",
 	"session_recall",
@@ -51,6 +52,7 @@ const CORE_TOOL_SUMMARIES = {
 	browser_use: "Control the configured browser",
 	send_message: "Send messages to the current conversation or an explicit configured channel",
 	send_media: "Send media attachments to the current channel",
+	publish_artifacts: "Publish final generated files as durable chat deliverables",
 	memory_search: "Semantic search over indexed memory sources",
 	memory_get: "Read specific lines from memory sources returned by search",
 	session_recall: "Search exact raw turns in the current session, including compacted history",
@@ -117,6 +119,7 @@ function buildToolingSection(params) {
 	const hasFind = availableTools.has("find");
 	const hasExec = availableTools.has("exec_command");
 	const hasPlan = availableTools.has("update_plan");
+	const hasPublishArtifacts = availableTools.has("publish_artifacts");
 	const orchestrationLines = [];
 	if (hasDelegate) orchestrationLines.push("- Sub-agent delegation → use `delegate_task(goal, context?, toolset?)` for focused parallel work; results return to you automatically.");
 	if (hasWorkflow) orchestrationLines.push("- Multi-phase workflows → use `workflow` to start persisted runs with subagents when a script defines phases.");
@@ -131,6 +134,8 @@ function buildToolingSection(params) {
 		hasWrite ? `Use \`${writeToolName}\` only for new files or intentional complete rewrites.` : "",
 		hasGrep || hasFind ? `Use ${[hasGrep ? `\`${grepToolName}\`` : "", hasFind ? `\`${findToolName}\`` : ""].filter(Boolean).join(" and ")} for text/file discovery; use code graph or symbol tools when available for definitions and call relationships.` : "",
 		hasExec ? `Use \`${execToolName}\` for verification and safe inspection, not routine file editing.` : "",
+		hasWrite || hasExec ? "When delivering a user-facing workspace file, include a clickable Markdown link in the final response using `xopc://workspace/file?path=<workspace-relative-path>`; URL-encode spaces and special characters, and do not invent an HTTP or `file://` URL." : "",
+		hasPublishArtifacts ? "Declare final user-facing files in `exec_command.outputs`. Use `publish_artifacts` only when files were created by another runtime or were not known when the command started. Do not publish temporary files, code edits, or build intermediates." : "",
 		hasPlan ? `Use \`${planToolName}\` for multi-step coding work: keep exactly one active step when work is in progress, and update it after meaningful progress or review.` : "",
 		hasToolManual ? "Some complex tools have built-in manuals. Use `tool_manual(tool)` before non-trivial use." : "",
 		hasDelegate ? "If a task is complex or long-running, delegate it. Completion is push-based: the sub-agent result returns when done." : "",