@xopcai/xopc 0.0.249 → 0.0.250

package/dist/src/agent/tools/session-search-tool.js

@@ -94,6 +94,13 @@ function createSessionSearchTool(deps) {
 		description: "Search other chat sessions by keywords and get short summaries, or omit `query` to list recent sessions (no LLM cost). Uses the same session store as the gateway. Narrow with roleFilter if needed.",
 		parameters: SessionSearchSchema,
 		async execute(_toolCallId, params, signal) {
+			if (deps.canAccess && !deps.canAccess()) return {
+				content: [{
+					type: "text",
+					text: "Cross-session history is disabled for this session."
+				}],
+				details: { error: "cross_session_history_disabled" }
+			};
 			const p = params;
 			const store = deps.getSessionStore();
 			const limit = Math.min(15, Math.max(1, p.limit ?? 5));

package/dist/src/agent/tools/user-context-tool.d.ts

@@ -3,6 +3,8 @@ export interface UserContextToolOptions {
     agentId: string;
     workspaceId: string;
     getSessionId: () => string | undefined;
+    getProjectId?: () => string | undefined;
+    canRead: () => boolean;
 }
 export declare function createUserContextSearchTool(options: UserContextToolOptions): AgentTool;
 export declare function createUserContextGetTool(options: UserContextToolOptions): AgentTool;

package/dist/src/agent/tools/user-context-tool.js

@@ -13,7 +13,10 @@ const SearchSchema = Type.Object({
 const GetSchema = Type.Object({ id: Type.String() });
 function visible(options, slotId) {
 	const scope = getAssertionSlot(slotId)?.scope;
-	return scope?.type === "global" || scope?.type === "agent" && scope.id === options.agentId || scope?.type === "workspace" && scope.id === options.workspaceId || scope?.type === "session" && scope.id === options.getSessionId();
+	return scope?.type === "global" || scope?.type === "agent" && scope.id === options.agentId || scope?.type === "workspace" && scope.id === options.workspaceId || scope?.type === "project" && scope.id === options.getProjectId?.() || scope?.type === "session" && scope.id === options.getSessionId();
+}
+function referenceable(assertion) {
+	return assertion.status === "active" && assertion.authority !== "external_untrusted" && assertion.sensitivity !== "secret" && assertion.sensitivity !== "regulated" && assertion.disclosurePolicy !== "ask_before_reference";
 }
 function createUserContextSearchTool(options) {
 	return {
@@ -22,11 +25,18 @@ function createUserContextSearchTool(options) {
 		description: "Search typed user assertions such as identity, preferences, routines, and current state.",
 		parameters: SearchSchema,
 		async execute(_toolCallId, raw) {
+			if (!options.canRead()) return {
+				content: [{
+					type: "text",
+					text: "User context is disabled for this session."
+				}],
+				details: { error: "user_context_disabled" }
+			};
 			const input = raw;
 			const results = listUserAssertions({
-				statuses: ["active", "needs_review"],
+				statuses: ["active"],
 				limit: 1e3
-			}).filter((assertion) => visible(options, assertion.slotId)).map((assertion) => ({
+			}).filter((assertion) => visible(options, assertion.slotId)).filter(referenceable).map((assertion) => ({
 				assertion,
 				score: retrievalLexicalSimilarity(input.query, `${assertion.statement} ${assertion.normalizedValue}`)
 			})).filter((item) => item.score > 0).sort((left, right) => right.score - left.score).slice(0, input.maxResults ?? 12).map(({ assertion, score }) => ({
@@ -54,9 +64,16 @@ function createUserContextGetTool(options) {
 		description: "Read one typed user assertion and its subject, predicate, and scope.",
 		parameters: GetSchema,
 		async execute(_toolCallId, raw) {
+			if (!options.canRead()) return {
+				content: [{
+					type: "text",
+					text: "User context is disabled for this session."
+				}],
+				details: { error: "user_context_disabled" }
+			};
 			const id = raw.id;
 			const assertion = getUserAssertion(id);
-			if (!assertion || !visible(options, assertion.slotId)) return {
+			if (!assertion || !visible(options, assertion.slotId) || !referenceable(assertion)) return {
 				content: [{
 					type: "text",
 					text: `User assertion not found: ${id}`

package/dist/src/automations/service/automation-service.d.ts

@@ -8,6 +8,7 @@ export declare class AutomationAlreadyRunningError extends Error {
 }
 export declare class AutomationService {
     private readonly signals?;
+    private readonly workspaceId;
     private readonly executor;
     private timer;
     private stopped;
@@ -17,7 +18,7 @@ export declare class AutomationService {
     private readonly activeRuns;
     private readonly heartbeatTimers;
     private readonly leaseOwner;
-    constructor(signals?: ProactiveSignalPublisher);
+    constructor(signals?: ProactiveSignalPublisher, workspaceId?: string);
     setDeps(deps: AutomationDeps): void;
     initialize(options?: {
         maxConcurrentRuns?: number;

package/dist/src/automations/service/automation-service.js

@@ -34,8 +34,9 @@ var AutomationService = class {
 	activeRuns = /* @__PURE__ */ new Map();
 	heartbeatTimers = /* @__PURE__ */ new Map();
 	leaseOwner = `automation-service:${process.pid}:${randomUUID()}`;
-	constructor(signals) {
+	constructor(signals, workspaceId = "default") {
 		this.signals = signals;
+		this.workspaceId = workspaceId;
 	}
 	setDeps(deps) {
 		this.deps = {
@@ -462,7 +463,10 @@ var AutomationService = class {
 						id: run.id
 					},
 					actor: { kind: "system" },
-					scope: { workspaceId: "default" },
+					scope: {
+						workspaceId: this.workspaceId,
+						...automation.projectId ? { projectId: automation.projectId } : {}
+					},
 					occurredAt: new Date(endedAtMs).toISOString(),
 					dedupeKey: `automation_run:${run.id}:failed`,
 					sensitivity: "personal",

package/dist/src/cli/commands/doctor/checks/database-schema.js

@@ -52,7 +52,7 @@ async function checkDatabaseSchema(ctx) {
 		id: "database-schema",
 		label: "Database schema",
 		status: "pass",
-		message: `SQLite schema v${status.dbVersion} (current release v150).`,
+		message: `SQLite schema v${status.dbVersion} (current release v152).`,
 		hints: []
 	};
 }

package/dist/src/connectors/connection-recovery-service.d.ts

@@ -33,6 +33,7 @@ export declare class ConnectionRecoveryService {
     private get adapter();
     snapshot(sessionKey: string): ConnectionWaitSnapshot;
     private view;
+    private ensureInstallation;
     private checkCapabilities;
     preflight(input: SessionInput): Promise<boolean>;
     act(sessionKey: string, action: ConnectionAction): Promise<{

package/dist/src/connectors/connection-recovery-service.js

@@ -1,17 +1,19 @@
 import { createLogger } from "../utils/logger/index.js";
 import { init_logger } from "../utils/logger.js";
 import { getSqliteDatabase } from "../storage/sqlite/transaction.js";
-import { cancelConnectionObjective, getActiveConnectionWait, getConnectionWait, listConnectionWaitsToCheck, publishConnectionWait, queueConnectionResolution, updateConnectionWait } from "../storage/sqlite/connection-wait-repository.js";
-import { readCurrentSessionId } from "../storage/sqlite/session-repository.js";
+import { readCurrentSessionId } from "../storage/sqlite/session-instance-repository.js";
 import { getSessionInputState } from "../storage/sqlite/session-input-repository.js";
+import { cancelConnectionObjective, getActiveConnectionWait, getConnectionWait, listConnectionWaitsToCheck, publishConnectionWait, queueConnectionResolution, updateConnectionWait } from "../storage/sqlite/connection-wait-repository.js";
+import "../storage/sqlite/session-repository.js";
 import { getConnectorInstallation, listConnectorConnections, upsertConnectorInstallation } from "../storage/sqlite/connector-repository.js";
+import { getConnectorAccount } from "../storage/sqlite/connector-account-repository.js";
 import { ComposioSessionsAdapter } from "./composio-sessions.js";
 import { getConfiguredComposioAuthConfigs, isComposioActionAllowedByCatalog, scopeForComposioAction } from "./composio.js";
 import { getConnectorDefinition } from "./catalog.js";
 import { capabilityActions, isToolInputSchema, missingConnectionCapabilities } from "./connection-capabilities.js";
 import { connectorPrincipalForSession } from "./principal.js";
 import { resolveConnectionCandidate } from "./connection-candidates.js";
-import { getConnectorInstance } from "./instances.js";
+import { listConnectorInstances } from "./instances.js";
 import { installConnector } from "./install.js";
 import { persistConfigMutation } from "../config/config-mutation.js";
 import { randomUUID } from "node:crypto";
@@ -79,7 +81,7 @@ var ConnectionRecoveryService = class {
 	}
 	view(wait, verifiedIds) {
 		const needs = wait.needs.map((need) => {
-			const instance = getConnectorInstance(this.deps.getConfig(), need.connectorId);
+			const instance = listConnectorInstances(this.deps.getConfig()).find((instance) => instance.connectorId === need.connectorId);
 			const installation = getConnectorInstallation(`${need.connectorId}-${wait.principalId}`);
 			const scopeBlocked = Math.max(1, ...need.capabilities.filter((capability) => /^[A-Z]+_/.test(capability)).map((capability) => SCOPE_ORDER[scopeForComposioAction(capability).scope])) > SCOPE_ORDER[installation?.maxScope ?? "read"];
 			const blocked = scopeBlocked || instance?.enabled === false || installation?.enabled === false || Boolean(installation?.allowedAgentIds.length && !installation.allowedAgentIds.includes(wait.agentId));
@@ -87,9 +89,17 @@ var ConnectionRecoveryService = class {
 				principalId: wait.principalId,
 				connectorId: need.connectorId
 			});
-			const active = all.filter((connection) => connection.status === "active" && (!verifiedIds || verifiedIds.has(connection.id)) && (!need.accountId || connection.accountId === need.accountId) && (!installation?.selectedConnectionIds.length || installation.selectedConnectionIds.includes(connection.id)));
+			const eligible = all.filter((connection) => connection.status === "active" && (!verifiedIds || verifiedIds.has(connection.id)) && (!need.accountId || connection.accountId === need.accountId) && (!installation?.selectedConnectionIds.length || installation.selectedConnectionIds.includes(connection.id)));
+			const byAccount = /* @__PURE__ */ new Map();
+			for (const connection of eligible) {
+				const key = connection.accountId ?? connection.id;
+				const previous = byAccount.get(key);
+				const preferredId = need.connectionId ?? eligible.find((item) => item.providerConnectionId === need.attempt?.connectionId)?.id ?? (connection.accountId ? getConnectorAccount(connection.accountId)?.currentConnectionId : void 0);
+				if (!previous || connection.id === preferredId || previous.id !== preferredId && connection.updatedAt > previous.updatedAt) byAccount.set(key, connection);
+			}
+			const active = [...byAccount.values()];
 			const selected = !verifiedIds && need.unavailable ? void 0 : need.attempt ? active.find((connection) => connection.providerConnectionId === need.attempt?.connectionId) : need.connectionId ? active.find((connection) => connection.id === need.connectionId) : active.length === 1 && !need.accountSelector ? active[0] : void 0;
-			const phase = blocked || selected && need.capabilityError ? "blocked" : selected && instance ? "ready" : active.length > 1 || need.accountSelector && active.length > 0 && !need.connectionId ? "choose_account" : need.attempt && need.attempt.expiresAt > Date.now() ? "authorizing" : need.unavailable || all.some((connection) => [
+			const phase = blocked || selected && need.capabilityError ? "blocked" : selected ? "ready" : active.length > 1 || need.accountSelector && active.length > 0 && !need.connectionId ? "choose_account" : need.attempt && need.attempt.expiresAt > Date.now() ? "authorizing" : need.unavailable || all.some((connection) => [
 				"expired",
 				"revoked",
 				"failed"
@@ -121,6 +131,28 @@ var ConnectionRecoveryService = class {
 			phase: wait.status === "queued" ? "queued" : ready ? review ? "review_scope" : "ready" : "needs_connection"
 		};
 	}
+	async ensureInstallation(wait, connectorId) {
+		const config = this.deps.getConfig();
+		const instance = listConnectorInstances(config).find((item) => item.connectorId === connectorId);
+		const installationId = `${connectorId}-${wait.principalId}`;
+		const installation = getConnectorInstallation(installationId);
+		if (instance?.enabled === false || installation?.enabled === false || installation?.allowedAgentIds.length && !installation.allowedAgentIds.includes(wait.agentId)) throw new Error("Connector policy blocks this connection.");
+		if (!instance) await persistConfigMutation({
+			config,
+			mutate: () => installConnector(config, connectorId, {}),
+			save: () => this.deps.saveConfig(config)
+		});
+		if (!installation) upsertConnectorInstallation({
+			id: installationId,
+			connectorId,
+			principalId: wait.principalId,
+			enabled: true,
+			allowedAgentIds: [],
+			maxScope: "read",
+			confirmationPolicy: "writes",
+			selectedConnectionIds: []
+		});
+	}
 	async checkCapabilities(wait, verified) {
 		const views = this.view({
 			...wait,
@@ -135,6 +167,7 @@ var ConnectionRecoveryService = class {
 				capabilityError: void 0
 			};
 			try {
+				if (!listConnectorInstances(this.deps.getConfig()).some((instance) => instance.connectorId === need.connectorId && instance.enabled)) throw new Error("Connector setup is unavailable");
 				const definition = getConnectorDefinition(need.connectorId);
 				if (definition?.runtime.type !== "composio" || definition.runtime.role !== "toolkit") throw new Error("Unsupported connector");
 				const toolkit = definition.runtime.toolkit;
@@ -261,22 +294,8 @@ var ConnectionRecoveryService = class {
 				}, wait.version);
 				publishConnectionWait(sessionKey);
 				const config = this.deps.getConfig();
-				if (!getConnectorInstance(config, need.connectorId)) await persistConfigMutation({
-					config,
-					mutate: () => installConnector(config, need.connectorId, {}),
-					save: () => this.deps.saveConfig(config)
-				});
+				await this.ensureInstallation(wait, need.connectorId);
 				const installationId = `${need.connectorId}-${wait.principalId}`;
-				if (!getConnectorInstallation(installationId)) upsertConnectorInstallation({
-					id: installationId,
-					connectorId: need.connectorId,
-					principalId: wait.principalId,
-					enabled: true,
-					allowedAgentIds: [],
-					maxScope: "read",
-					confirmationPolicy: "writes",
-					selectedConnectionIds: []
-				});
 				const auth = await this.adapter.authorize({
 					principalId: wait.principalId,
 					toolkit: definition.runtime.toolkit,
@@ -335,9 +354,14 @@ var ConnectionRecoveryService = class {
 						...item,
 						connectionId: connection.id,
 						accountId: connection.accountId,
-						unavailable: false
+						unavailable: false,
+						attempt: void 0
 					} : item);
 				}
+				for (const selected of this.view({
+					...wait,
+					needs
+				}, verified).needs) if (selected.phase === "ready" || selected.capabilityError && selected.connectionId) await this.ensureInstallation(wait, selected.connectorId);
 				needs = await this.checkCapabilities({
 					...wait,
 					needs

package/dist/src/files/file-service.js

@@ -91,7 +91,10 @@ function capabilities(name, directory, writable) {
 	const extension = name.includes(".") ? name.split(".").pop().toLowerCase() : "";
 	const result = ["download", "share"];
 	if (MIME_TYPES[extension] || TEXT_EXTENSIONS.has(extension)) result.unshift("preview");
-	if (writable && TEXT_EXTENSIONS.has(extension)) result.push("edit");
+	if (writable) {
+		if (TEXT_EXTENSIONS.has(extension)) result.push("edit");
+		result.push("delete");
+	}
 	return result;
 }
 function fileSpaceId(root) {

package/dist/src/gateway/hono/routes/connectors.js

@@ -1,3 +1,4 @@
+import { hasGatewayScope } from "../../security/gateway-scopes.js";
 import { listConnectorLearningJobs } from "../../../storage/sqlite/connector-learning-repository.js";
 import { decideConnectorApproval, getConnectorApproval, listConnectorApprovals, listConnectorConnections } from "../../../storage/sqlite/connector-repository.js";
 import { getConnectorAccount } from "../../../storage/sqlite/connector-account-repository.js";
@@ -25,6 +26,7 @@ import { previewConnectorDefinition, testConnectorInstance } from "../../../conn
 import { listUnderstandingSourceGrants, revokeUnderstandingSourceGrant } from "../../../user-context/sources/repository.js";
 import { setConnectorEnabled } from "../../../connectors/lifecycle.js";
 import { projectComposioConnectionStatus } from "../../../connectors/runtime-status.js";
+import { getGatewayPrincipal } from "../../security/gateway-principal.js";
 import { markContextSourceAssertionsForReview } from "./context-sources.js";
 //#region src/gateway/hono/routes/connectors.ts
 init_agent_scope();
@@ -467,9 +469,15 @@ function registerConnectorRoutes(authenticated, deps) {
 			ok: false,
 			error: "Invalid approval status."
 		}, 400);
+		const principalId = c.req.query("principalId")?.trim() || "local-owner";
+		const sessionKey = c.req.query("sessionKey")?.trim() || void 0;
+		if (!hasGatewayScope(getGatewayPrincipal(c).scopes, "gateway.admin") && (!sessionKey || principalId !== "local-owner")) return c.json({
+			ok: false,
+			error: "A local-owner session is required to read confirmations."
+		}, 403);
 		const approvals = listConnectorApprovals({
-			principalId: c.req.query("principalId")?.trim() || "local-owner",
-			sessionKey: c.req.query("sessionKey")?.trim() || void 0,
+			principalId,
+			sessionKey,
 			status,
 			limit: Number(c.req.query("limit") ?? "100")
 		});
@@ -582,10 +590,16 @@ function registerConnectorRoutes(authenticated, deps) {
 			ok: false,
 			error: "Approval id and an approved or denied decision are required."
 		}, 400);
-		if (!getConnectorApproval(id)) return c.json({
+		const current = getConnectorApproval(id);
+		if (!current) return c.json({
 			ok: false,
 			error: "Connector approval not found."
 		}, 404);
+		const sessionKey = typeof record.sessionKey === "string" ? record.sessionKey.trim() : "";
+		if (!hasGatewayScope(getGatewayPrincipal(c).scopes, "gateway.admin") && (!sessionKey || current.sessionKey !== sessionKey || current.principalId !== "local-owner")) return c.json({
+			ok: false,
+			error: "Confirmation does not belong to the requested local-owner session."
+		}, 403);
 		const approval = decideConnectorApproval(id, decision);
 		if (!approval || approval.status !== decision) return c.json({
 			ok: false,

package/dist/src/gateway/hono/routes/files.js

@@ -1,9 +1,9 @@
-import { FileServiceError, fileResourceFromPath, resolveFilePath } from "../../../files/file-service.js";
+import { FileServiceError, fileResourceFromPath, parseFileResourceId, resolveFilePath } from "../../../files/file-service.js";
 import { getGatewayFileSpaceService } from "../../file-space-service.js";
 import { fuzzySearchWorkspaceFiles, fuzzySubsequenceScore } from "../../workspace-file-search.js";
 import { registerFileReferenceRoutes } from "./file-references.js";
 import { basename, join } from "node:path";
-import { readFile, writeFile } from "node:fs/promises";
+import { readFile, unlink, writeFile } from "node:fs/promises";
 //#region src/gateway/hono/routes/files.ts
 const mutationLocks = /* @__PURE__ */ new Map();
 async function withMutationLock(key, action) {
@@ -185,6 +185,27 @@ function registerFilesRoutes(authenticated, deps) {
 			return errorResponse(c, error);
 		}
 	});
+	authenticated.delete("/api/files/:id", async (c) => {
+		try {
+			const id = c.req.param("id");
+			const initial = await files.resource(id);
+			if (!initial.space.writable) throw new FileServiceError(403, "File space is read-only");
+			if (initial.resource.kind !== "file") throw new FileServiceError(400, "Resource is not a file");
+			await withMutationLock(initial.absolutePath, async () => {
+				const current = await files.resource(id);
+				if (current.absolutePath !== initial.absolutePath) throw new FileServiceError(409, "File has changed");
+				if (current.resource.kind !== "file") throw new FileServiceError(400, "Resource is not a file");
+				const { relativePath } = parseFileResourceId(id);
+				await unlink(await resolveFilePath(current.space.root, relativePath, false)).catch((error) => {
+					if (error.code === "ENOENT") throw new FileServiceError(404, "File not found");
+					throw error;
+				});
+			});
+			return c.json({ ok: true });
+		} catch (error) {
+			return errorResponse(c, error);
+		}
+	});
 	authenticated.post("/api/files/spaces/:id/upload", async (c) => {
 		try {
 			const space = await files.get(c.req.param("id"));

package/dist/src/gateway/hono/routes/tasks.js

@@ -25,7 +25,7 @@ function registerTaskRoutes(authenticated, deps) {
 	const taskRateLimit = deps.taskRateLimitMiddleware ?? deps.strictRateLimitMiddleware;
 	const application = new TaskApplicationService();
 	const operatingViews = new ProjectOperatingViewService(deps.service.projects);
-	const monitoring = new ProjectMonitoringService();
+	const monitoring = new ProjectMonitoringService(deps.service.currentWorkspacePath);
 	const metrics = new TaskValueMetricsService();
 	const tasks = new TaskRepository();
 	const runs = new TaskRunRepository();

package/dist/src/gateway/security/gateway-scopes.js

@@ -48,6 +48,8 @@ function requiredGatewayScope(method, path) {
 	if (path === "/api/device-auth/refresh" || path === "/api/devices/me") return "device.self";
 	if (path.startsWith("/api/devices/me/push")) return "notifications.self";
 	if (path.startsWith("/api/endpoint-tools")) return "device.self";
+	if (method === "GET" && path === "/api/connectors/approvals") return "sessions.read";
+	if (method === "POST" && path === "/api/connectors/approvals/respond") return "sessions.write";
 	if (path === "/api/agent" || path.startsWith("/api/agent/")) return "agents.run";
 	if (path.startsWith("/api/agents") || path.startsWith("/api/models")) return methodScope(method, "agents.read", "gateway.admin");
 	if (path.startsWith("/api/sessions") || path.startsWith("/api/side-chats")) return methodScope(method, "sessions.read", "sessions.write");

package/dist/src/gateway/service/agent-runner.js

@@ -1,7 +1,7 @@
 import { createLogger } from "../../utils/logger/index.js";
 import { init_logger } from "../../utils/logger.js";
-import { onConnectionWaitChanged } from "../../storage/sqlite/connection-wait-repository.js";
 import { listActiveSessionInputRuns } from "../../storage/sqlite/session-input-repository.js";
+import { onConnectionWaitChanged } from "../../storage/sqlite/connection-wait-repository.js";
 import "../../storage/sqlite/index.js";
 import { ClarifyBridge } from "../clarify-bridge.js";
 import { runGatewayAgent } from "./run-gateway-agent.js";

package/dist/src/gateway/service/run-gateway-agent.js

@@ -1,8 +1,8 @@
 import { inboundCorrelationMetadataFromAsyncLogContext, updateAsyncLogContext } from "../../utils/logger/context.js";
 import { createLogger } from "../../utils/logger/index.js";
 import { init_logger } from "../../utils/logger.js";
-import { getConnectionResumeInput, isConnectionSuspended } from "../../storage/sqlite/connection-wait-repository.js";
 import { updateInteractionStateFromMessage } from "../../storage/sqlite/interaction-state-repository.js";
+import { getConnectionResumeInput, isConnectionSuspended } from "../../storage/sqlite/connection-wait-repository.js";
 import "../../storage/sqlite/index.js";
 import { init_session_key, parseSessionKey } from "../../routing/session-key.js";
 import { resolveExecutionContext } from "../../tasks/execution-context.js";

package/dist/src/gateway/service/session-input-coordinator.js

@@ -1,8 +1,8 @@
 import { createLogger } from "../../utils/logger/index.js";
 import { init_logger } from "../../utils/logger.js";
-import { cancelConnectionObjective, consumeConnectionResume, invalidateConnectionResumeIntent, publishConnectionWait } from "../../storage/sqlite/connection-wait-repository.js";
 import { SessionInstanceChangedError, cancelQueuedSessionInput, claimNextSessionInput, findSessionInput, finishSessionInputRun, getSessionInputById, getSessionInputState, insertSessionInput, mutateQueuedSessionInput, recoverSessionInputState, setSessionInputStatus } from "../../storage/sqlite/session-input-repository.js";
 import { replaceLatestSessionTurnAndQueueInput, validateLatestSessionTurnTarget } from "../../storage/sqlite/session-turn-replace-repository.js";
+import { cancelConnectionObjective, consumeConnectionResume, invalidateConnectionResumeIntent, publishConnectionWait } from "../../storage/sqlite/connection-wait-repository.js";
 import "../../storage/sqlite/index.js";
 import { summarizeSourceContext } from "../../agent/source-context/types.js";
 import { deleteMediaUrisNoLongerReferenced } from "../../media/session-references.js";

package/dist/src/gateway/service.js

@@ -6,8 +6,8 @@ import { getRuntimeLogStats } from "../utils/logger/stats.js";
 import { createLogger } from "../utils/logger/index.js";
 import { init_logger } from "../utils/logger.js";
 import { closeXopcDatabase, openXopcDatabase } from "../storage/sqlite/connection.js";
-import { notifyUserContextChange } from "../user-context/changes.js";
 import { insertSessionInput } from "../storage/sqlite/session-input-repository.js";
+import { notifyUserContextChange } from "../user-context/changes.js";
 import { getSessionConfig } from "../storage/sqlite/config-repository.js";
 import "../storage/sqlite/index.js";
 import { getAgentDefaultModelRef, init_schema } from "../config/schema.js";
@@ -366,9 +366,9 @@ var GatewayService = class {
 		this.workspacePath = getWorkspacePath(this.config) || "./workspace";
 		this.initializeExtensionLoader();
 		this.sessionIndex = new SessionIndex({ config: this.config });
-		this.automationService = new AutomationService(this.proactive);
+		this.automationService = new AutomationService(this.proactive, this.workspacePath);
 		this.notesService = new NotesService(new NotesStore());
-		this.projects = new ProjectService(void 0, this.proactive);
+		this.projects = new ProjectService(void 0, this.proactive, this.workspacePath);
 		const emitDiscussion = (capture) => {
 			this.emit("discussion.updated", capture);
 		};
@@ -1096,7 +1096,11 @@ var GatewayService = class {
 		log.debug("Gateway service started");
 	}
 	ensureDefaultProactiveScenarioSubscriptions() {
-		for (const scenarioKey of ["meeting_preparation", "discussion_follow_up"]) {
+		for (const scenarioKey of [
+			"automation_failure_impact",
+			"meeting_preparation",
+			"discussion_follow_up"
+		]) {
 			if (this.proactiveScenarios.subscriptions(scenarioKey).some((subscription) => subscription.workspaceId === this.currentWorkspacePath)) continue;
 			this.proactiveScenarios.subscribe({
 				scenarioKey,

package/dist/src/knowledge-memory/domain.d.ts

@@ -3,6 +3,7 @@ export type KnowledgeKind = 'project_fact' | 'workspace_fact' | 'decision' | 'ta
 export type KnowledgeStatus = 'candidate' | 'active' | 'needs_review' | 'stale' | 'archived' | 'rejected';
 export type KnowledgeOriginClass = 'owner' | 'agent' | 'system' | 'untrusted';
 export type KnowledgeRecordClass = 'memory' | 'source_index';
+export type KnowledgeSource = 'session' | 'workspace' | 'project' | 'connector';
 export interface KnowledgeItem {
     id: string;
     principalId: string;

package/dist/src/knowledge-memory/index.js

@@ -1,2 +1,2 @@
-import { getKnowledgeItem, listKnowledgeItems, searchKnowledgeItems, setKnowledgeStatus, writeKnowledgeItem } from "./repository.js";
-export { getKnowledgeItem, listKnowledgeItems, searchKnowledgeItems, setKnowledgeStatus, writeKnowledgeItem };
+import { getKnowledgeItem, knowledgeSourceAllowed, listKnowledgeItems, searchKnowledgeItems, setKnowledgeStatus, writeKnowledgeItem } from "./repository.js";
+export { getKnowledgeItem, knowledgeSourceAllowed, listKnowledgeItems, searchKnowledgeItems, setKnowledgeStatus, writeKnowledgeItem };

package/dist/src/knowledge-memory/repository.d.ts

@@ -1,5 +1,5 @@
 import { type UserModelScope } from '../user-model/domain.js';
-import type { KnowledgeItem, KnowledgeKind, KnowledgeOriginClass, KnowledgeRecordClass, KnowledgeStatus, KnowledgeVisibilityContext } from './domain.js';
+import type { KnowledgeItem, KnowledgeKind, KnowledgeOriginClass, KnowledgeRecordClass, KnowledgeSource, KnowledgeStatus, KnowledgeVisibilityContext } from './domain.js';
 export interface WriteKnowledgeInput {
     principalId?: string;
     kind: KnowledgeKind;
@@ -41,5 +41,8 @@ export declare function searchKnowledgeItems(input: {
     principalId?: string;
     asOf?: number;
     recordClass?: KnowledgeRecordClass;
+    trustedOnly?: boolean;
+    sources?: readonly KnowledgeSource[];
     limit?: number;
 }): KnowledgeItem[];
+export declare function knowledgeSourceAllowed(item: KnowledgeItem, sources: readonly KnowledgeSource[]): boolean;

package/dist/src/knowledge-memory/repository.js

@@ -138,6 +138,14 @@ function searchKnowledgeItems(input) {
 	const asOf = input.asOf ?? Date.now();
 	const limit = Math.max(1, Math.min(100, input.limit ?? 12));
 	const visible = visibilityClause(input.context);
+	const sourceParts = [];
+	const sourceValues = [];
+	if (input.sources?.includes("connector")) sourceParts.push("k.record_class = 'source_index'");
+	const memoryScopes = input.sources?.filter((source) => source !== "connector") ?? [];
+	if (memoryScopes.length) {
+		sourceParts.push(`(k.record_class = 'memory' AND k.scope_type IN (${memoryScopes.map(() => "?").join(", ")}))`);
+		sourceValues.push(...memoryScopes);
+	}
 	const fts = buildFts5SearchQuery(input.query);
 	if (!fts) return [];
 	return getSqliteDatabase().prepare(`SELECT k.*, bm25(knowledge_items_fts) AS rank
@@ -147,8 +155,14 @@ function searchKnowledgeItems(input) {
       AND (k.valid_to IS NULL OR k.valid_to >= ?)
       AND (k.expires_at IS NULL OR k.expires_at >= ?)
       ${input.recordClass ? "AND k.record_class = ?" : ""}
+      ${input.trustedOnly ? "AND k.origin_class != 'untrusted'" : ""}
+      ${input.sources ? `AND (${sourceParts.length ? sourceParts.join(" OR ") : "0"})` : ""}
       AND ${visible.sql}
-    ORDER BY rank ASC, k.importance DESC, k.updated_at DESC LIMIT ?`).all(fts, principalId, asOf, asOf, asOf, ...input.recordClass ? [input.recordClass] : [], ...visible.values, limit).map(fromRow);
+    ORDER BY rank ASC, k.importance DESC, k.updated_at DESC LIMIT ?`).all(fts, principalId, asOf, asOf, asOf, ...input.recordClass ? [input.recordClass] : [], ...sourceValues, ...visible.values, limit).map(fromRow);
+}
+function knowledgeSourceAllowed(item, sources) {
+	if (item.recordClass === "source_index") return sources.includes("connector");
+	return item.scope.type === "session" ? sources.includes("session") : item.scope.type === "workspace" ? sources.includes("workspace") : item.scope.type === "project" ? sources.includes("project") : false;
 }
 //#endregion
-export { getKnowledgeItem, listKnowledgeItems, searchKnowledgeItems, setKnowledgeStatus, writeKnowledgeItem };
+export { getKnowledgeItem, knowledgeSourceAllowed, listKnowledgeItems, searchKnowledgeItems, setKnowledgeStatus, writeKnowledgeItem };

package/dist/src/notifications/planner.js

@@ -122,7 +122,11 @@ function automationPlan(payload) {
 function proactivePlan(payload) {
 	if (!payload || typeof payload !== "object") return null;
 	const item = payload;
-	if (typeof item.id !== "string" || typeof item.insight?.id !== "string" || typeof item.insight.title !== "string") return null;
+	if (typeof item.id !== "string" || typeof item.insightId !== "string" || typeof item.insight.title !== "string") return null;
+	const requiresDecision = item.insight.attentionKind === "decision";
+	const highUrgency = item.insight.urgency === "high" || item.insight.urgency === "critical";
+	if (item.insight.attentionKind === "receipt") return null;
+	if (!requiresDecision && !highUrgency) return null;
 	const title = item.insight.title.trim().slice(0, 120);
 	const summary = typeof item.insight.summary === "string" ? item.insight.summary.trim().slice(0, 180) : "";
 	return {
@@ -133,7 +137,7 @@ function proactivePlan(payload) {
 				kind: "insight",
 				inboxItemId: item.id
 			},
-			priority: item.insight.urgency === "high" || item.insight.urgency === "critical" ? "high" : "normal",
+			priority: requiresDecision || highUrgency ? "high" : "normal",
 			title: {
 				en: title,
 				zh: title
@@ -144,7 +148,7 @@ function proactivePlan(payload) {
 			} } : {},
 			payload: {
 				inboxItemId: item.id,
-				insightId: item.insight.id
+				insightId: item.insightId
 			}
 		}
 	};

package/dist/src/proactive/actions/service.d.ts

@@ -1,2 +1 @@
 export declare function executePendingProactiveActions(now?: Date): number;
-export declare function resolveProactiveActionDecision(inboxItemId: string, choice: string, now?: Date): void;

package/dist/src/proactive/actions/service.js

@@ -67,14 +67,5 @@ function executePendingProactiveActions(now = /* @__PURE__ */ new Date()) {
 		executed += 1;
 	}
 }
-function resolveProactiveActionDecision(inboxItemId, choice, now = /* @__PURE__ */ new Date()) {
-	const row = getSqliteDatabase().prepare(`SELECT x.insight_id, x.action_status
-    FROM proactive_inbox_items i JOIN proactive_insights x ON x.insight_id = i.insight_id
-    WHERE i.inbox_item_id = ?`).get(inboxItemId);
-	if (!row || row.action_status !== "approval_required") return;
-	getSqliteDatabase().prepare(`UPDATE proactive_insights SET action_status = ?, action_updated_at = ?
-    WHERE insight_id = ? AND action_status = 'approval_required'`).run(choice === "approve" ? "pending" : "rejected", now.toISOString(), row.insight_id);
-	if (choice === "approve") executePendingProactiveActions(now);
-}
 //#endregion
-export { executePendingProactiveActions, resolveProactiveActionDecision };
+export { executePendingProactiveActions };

package/dist/src/proactive/execution/context.d.ts

@@ -1,44 +1,42 @@
 import type { ContextProvider, ResolvedContext } from './types.js';
+import type { ScenarioDefinition } from '../scenarios/types.js';
 type ContextInput = Parameters<ContextProvider['collect']>[0];
 export declare class EventBatchContextProvider implements ContextProvider {
     readonly id = "event_batch";
-    supports(): boolean;
     collect(input: ContextInput): Promise<ResolvedContext>;
 }
 export declare class ConnectedSourceContextProvider implements ContextProvider {
     readonly id = "connected_source";
-    supports(): boolean;
     collect(input: ContextInput): Promise<ResolvedContext>;
 }
 export declare class InternalObjectContextProvider implements ContextProvider {
     readonly id = "internal_objects";
-    supports(): boolean;
     collect(input: ContextInput): Promise<ResolvedContext>;
 }
 export declare class UserModelContextProvider implements ContextProvider {
     readonly id = "user_model";
-    supports(): boolean;
     collect(input: ContextInput): Promise<ResolvedContext>;
 }
 export declare class MeetingWorkspaceContextProvider implements ContextProvider {
     readonly id = "meeting_workspace";
-    supports(scenarioKey: string): boolean;
     collect(input: ContextInput): Promise<ResolvedContext>;
 }
 export declare class ProjectStateContextProvider implements ContextProvider {
     readonly id = "project_state";
-    supports(scenarioKey: string): boolean;
     collect(input: ContextInput): Promise<ResolvedContext>;
 }
 export declare class AutomationStateContextProvider implements ContextProvider {
     readonly id = "automation_state";
-    supports(scenarioKey: string): boolean;
+    collect(input: ContextInput): Promise<ResolvedContext>;
+}
+export declare class DiscussionContextProvider implements ContextProvider {
+    readonly id = "discussion";
     collect(input: ContextInput): Promise<ResolvedContext>;
 }
 export declare class ContextProviderRegistry {
     private readonly providers;
     constructor(providers?: ContextProvider[]);
-    collect(scenarioKey: string, input: {
+    collect(scenario: ScenarioDefinition, input: {
         batchId: string;
         eventIds: string[];
         subscriptionId: string;