@xopcai/xopc 0.0.276 → 0.0.278

package/dist/src/agent/background-review/run-background-review.js

@@ -4,17 +4,17 @@ import { finishContextExtractionRun } from "../../storage/sqlite/context-extract
 import { getSessionMetadata } from "../../storage/sqlite/session-repository.js";
 import { loadCompactionSourceSnapshot } from "../../storage/sqlite/transcript-repository.js";
 import "../../storage/sqlite/index.js";
-import { extractProfileAgentId } from "../../config/agent-profile.js";
 import { init_sync_provider_auth, resolveProviderApiKeySync } from "../../auth/sync-provider-auth.js";
 import { getApiKeySync, init_providers, resolveModel } from "../../providers/index.js";
 import { createExtensionAwareStreamFn } from "../../providers/extension-stream-bridge.js";
-import { extractTextContent } from "../context/workspace.js";
+import { extractProfileAgentId } from "../../config/agent-profile.js";
 import { listUserAssertions } from "../../user-model/repository.js";
+import { resolveModelIntentRef } from "../../config/agent-model-intents.js";
+import { claimRegisteredExtraction } from "../../user-context/extraction/registry.js";
+import { extractTextContent } from "../context/workspace.js";
 import { readAgentMessageContent } from "../memory/agent-message-access.js";
 import { isAssistantTurnAborted, isAssistantTurnFailed } from "../orchestration/llm-turn-retry.js";
 import { resolveAgentTurnTimeoutMs, runAgentTurnWithTimeout } from "../orchestration/run-agent-turn-with-timeout.js";
-import { resolveModelIntentRef } from "../../config/agent-model-intents.js";
-import { claimRegisteredExtraction } from "../../user-context/extraction/registry.js";
 import { emptyUserModelCaptureResult, executeUserModelInterpretation } from "../../user-model/capture/executor.js";
 import { parseUserModelInterpretation } from "../../user-model/capture/semantic.js";
 import "../../user-model/capture/index.js";

package/dist/src/agent/commands/command-isolation.d.ts

@@ -4,6 +4,7 @@ export type CommandIsolation = {
     mode: 'docker';
     image: string;
     network?: boolean;
+    workspaceAccess?: 'read-only' | 'read-write';
 };
 /** Docker is opt-in and never falls back to host execution or pulls an image implicitly. */
 export declare function isolatedCommand(input: {

package/dist/src/agent/commands/command-isolation.js

@@ -1,3 +1,5 @@
+import { validatePath } from "../sandbox/path-policy.js";
+import { credentialMounts } from "./commandMounts.js";
 import { isAbsolute, relative, sep } from "node:path";
 import { execFile } from "node:child_process";
 import { realpath } from "node:fs/promises";
@@ -15,7 +17,10 @@ async function isolatedCommand(input) {
 	const [workspace, cwd] = await Promise.all([realpath(input.workspace), realpath(input.cwd)]);
 	const rel = relative(workspace, cwd);
 	if (isAbsolute(rel) || rel === ".." || rel.startsWith(`..${sep}`)) throw new Error("Container cwd must be inside the workspace.");
+	const policy = validatePath(workspace);
+	if (!policy.allowed) throw new Error(`Container workspace blocked: ${policy.reason}`);
 	if (workspace.includes(",")) throw new Error("Container workspace paths cannot contain commas.");
+	const masks = credentialMounts(workspace);
 	const containerName = `xopc-command-${input.id}`;
 	return {
 		executable: "docker",
@@ -40,9 +45,20 @@ async function isolatedCommand(input) {
 			"--user",
 			`${process.getuid?.() || 65534}:${process.getgid?.() || 65534}`,
 			"--mount",
-			`type=bind,source=${workspace},target=/workspace`,
+			`type=bind,source=${workspace},target=/workspace${input.isolation.workspaceAccess === "read-write" ? "" : ",readonly"}`,
+			...masks,
 			"--tmpfs",
 			"/tmp:rw,nosuid,nodev,size=256m",
+			"--ulimit",
+			"nofile=1024:1024",
+			"--ulimit",
+			"core=0",
+			"--memory-swap=2g",
+			"--log-driver=none",
+			"--env",
+			"ENV=",
+			"--env",
+			"BASH_ENV=",
 			"--env",
 			"HOME=/tmp",
 			"--env",

package/dist/src/agent/commands/commandMounts.d.ts

@@ -0,0 +1,2 @@
+/** Mask credentials and multiply-linked files, including those below writable mounts. */
+export declare function credentialMounts(workspace: string): string[];

package/dist/src/agent/commands/commandMounts.js

@@ -0,0 +1,32 @@
+import { containsBlockedCredentialSegment, getBlockedPaths } from "../sandbox/path-policy.js";
+import { join, relative, sep } from "node:path";
+import { lstatSync, readdirSync } from "node:fs";
+//#region src/agent/commands/commandMounts.ts
+/** Mask credentials and multiply-linked files, including those below writable mounts. */
+function credentialMounts(workspace) {
+	const args = [];
+	const protectedPaths = new Set(getBlockedPaths());
+	let entries = 0;
+	const visit = (directory) => {
+		for (const entry of readdirSync(directory, { withFileTypes: true })) {
+			if (++entries > 2e5) throw new Error("Workspace exceeds safe container mount scan limit");
+			const path = join(directory, entry.name);
+			const destination = `/workspace/${relative(workspace, path).split(sep).join("/")}`;
+			const sensitive = entry.name === ".xopc" || protectedPaths.has(path.split(sep).join("/")) || containsBlockedCredentialSegment(destination);
+			const linked = entry.isFile() && lstatSync(path).nlink > 1;
+			if (sensitive || linked) {
+				if (destination.includes(",") || destination.includes(":")) throw new Error("Unsupported sensitive path in container workspace");
+				if (entry.isSymbolicLink()) throw new Error("Sensitive symlinks must be removed from the container workspace");
+				if (entry.isDirectory()) args.push("--tmpfs", `${destination}:ro,nosuid,nodev,noexec,size=4k,mode=000`);
+				else if (entry.isFile()) args.push("--mount", `type=bind,source=/dev/null,target=${destination},readonly`);
+				else throw new Error("Unsupported sensitive file in container workspace");
+			} else if (entry.isDirectory()) visit(path);
+			else if (!entry.isFile() && !entry.isSymbolicLink()) throw new Error("Container workspace must not contain sockets, devices or FIFOs");
+		}
+	};
+	visit(workspace);
+	if (args.length > 4096) throw new Error("Too many sensitive paths in container workspace");
+	return args;
+}
+//#endregion
+export { credentialMounts };

package/dist/src/agent/context/coordinator.js

@@ -1,9 +1,9 @@
 import { extractProfileAgentId } from "../../config/agent-profile.js";
-import { assembleTaskContext } from "../../tasks/task-context-assembler.js";
 import { recordExecutionContext } from "./audit.js";
-import { prependAgentContext } from "./prepend.js";
-import { extractAgentUserPlainText } from "../memory/user-message-text.js";
 import { buildExecutionContext, fitExecutionContextToChars } from "./execution-context.js";
+import { extractAgentUserPlainText } from "../memory/user-message-text.js";
+import { assembleTaskContext } from "../../tasks/task-context-assembler.js";
+import { prependAgentContext } from "./prepend.js";
 //#region src/agent/context/coordinator.ts
 var ExecutionContextCoordinator = class {
 	currentBySession = /* @__PURE__ */ new Map();

package/dist/src/agent/context/execution-context.js

@@ -1,13 +1,13 @@
 import { getSqliteDatabase } from "../../storage/sqlite/transaction.js";
 import { listCollaborationRules } from "../../storage/sqlite/collaboration-rule-repository.js";
-import { searchKnowledgeItems } from "../../knowledge-memory/repository.js";
-import "../../knowledge-memory/index.js";
-import { retrievalLexicalSimilarity } from "../../retrieval/textFeatures.js";
 import { calculateExecutionValue } from "../../user-model/importance.js";
 import { listUserAssertions } from "../../user-model/repository.js";
 import { isWorkingAssumption } from "../../user-model/usage-policy.js";
-import { getExecutionContextFeedbackScores } from "./audit.js";
+import { searchKnowledgeItems } from "../../knowledge-memory/repository.js";
+import "../../knowledge-memory/index.js";
+import { retrievalLexicalSimilarity } from "../../retrieval/textFeatures.js";
 import { buildUserContextBlock } from "../memory/context-fence.js";
+import { getExecutionContextFeedbackScores } from "./audit.js";
 import { randomUUID } from "node:crypto";
 //#region src/agent/context/execution-context.ts
 function scopeVisible(scope, context) {

package/dist/src/agent/context/execution-scope.js

@@ -1,10 +1,10 @@
 import { isXopcDatabaseOpen } from "../../storage/sqlite/connection.js";
 import { getSessionMetadata } from "../../storage/sqlite/session-repository.js";
 import "../../storage/sqlite/index.js";
-import { sanitizeForPromptLiteral } from "../prompt/sanitize-for-prompt.js";
 import { TaskRepository } from "../../tasks/task-repository.js";
-import { TaskConversationRepository } from "../../tasks/task-conversation-repository.js";
 import { TaskReadModelProjector } from "../../tasks/task-read-model-projector.js";
+import { TaskConversationRepository } from "../../tasks/task-conversation-repository.js";
+import { sanitizeForPromptLiteral } from "../prompt/sanitize-for-prompt.js";
 import { buildActiveProjectContextForPrompt } from "./project-context.js";
 //#region src/agent/context/execution-scope.ts
 const MAX_OBJECTIVE_TEXT = 1200;

package/dist/src/agent/context/project-context.js

@@ -1,11 +1,11 @@
-import { sanitizeForPromptLiteral } from "../prompt/sanitize-for-prompt.js";
-import { TaskRepository } from "../../tasks/task-repository.js";
-import { TaskReadModelProjector } from "../../tasks/task-read-model-projector.js";
-import { LocalAppStore } from "../../local-apps/store.js";
 import { ProjectStore } from "../../projects/project-store.js";
 import { getProjectForSession, getProjectWorkspacePathForSession } from "../../projects/workspace.js";
 import { knowledgeSourceAllowed, listKnowledgeItems, searchKnowledgeItems } from "../../knowledge-memory/repository.js";
 import "../../knowledge-memory/index.js";
+import { TaskRepository } from "../../tasks/task-repository.js";
+import { TaskReadModelProjector } from "../../tasks/task-read-model-projector.js";
+import { sanitizeForPromptLiteral } from "../prompt/sanitize-for-prompt.js";
+import { LocalAppStore } from "../../local-apps/store.js";
 //#region src/agent/context/project-context.ts
 const MAX_TEXT = 1200;
 const MAX_TASKS = 5;

package/dist/src/agent/embedded/index.js

@@ -1,12 +1,12 @@
-import { getEmbeddedExecutionRunId, getEmbeddedExecutionSession, runWithEmbeddedExecutionSession } from "./execution-context.js";
-import { abortEmbeddedRun, getEmbeddedRunBySessionKey, queueEmbeddedSteer } from "./runs.js";
 import { DEFAULT_MAX_LIVE_TOOL_RESULT_CHARS, resolveLiveToolResultMaxChars, truncateToolResultMessage } from "./tool-result-truncation.js";
+import { abortEmbeddedRun, getEmbeddedRunBySessionKey, queueEmbeddedSteer } from "./runs.js";
 import { getRawSessionAppendMessage, guardSessionManager, installSessionToolResultGuard } from "./session-tool-result-guard.js";
 import { acquireEmbeddedSessionRunner, buildEmbeddedRunnerFingerprint, evictAllEmbeddedSessionRunners, evictEmbeddedSessionRunner, getEmbeddedSessionRunnerIdleTtlMs, getEmbeddedSessionRunnerStats, isEmbeddedSessionRunnerEnabled, resetEmbeddedSessionRunnerForTest } from "./session-runner.js";
 import { repairAssistantUsageInSessionManager } from "./session-manager-init.js";
 import { openSqliteHydratingSessionManager } from "./sqlite-hydrating-session-manager.js";
 import { InMemoryTranscriptRuntime, createSqliteTranscriptRuntime } from "./transcript-runtime.js";
 import { runXopcEmbeddedTurn } from "./run-turn.js";
+import { getEmbeddedExecutionRunId, getEmbeddedExecutionSession, runWithEmbeddedExecutionSession } from "./execution-context.js";
 import { runEmbeddedTurnForSession } from "./run-for-session.js";
 import { CURRENT_SESSION_VERSION, PiTranscriptManager } from "./pi-transcript.js";
 export { CURRENT_SESSION_VERSION, DEFAULT_MAX_LIVE_TOOL_RESULT_CHARS, InMemoryTranscriptRuntime, PiTranscriptManager, abortEmbeddedRun, acquireEmbeddedSessionRunner, buildEmbeddedRunnerFingerprint, createSqliteTranscriptRuntime, evictAllEmbeddedSessionRunners, evictEmbeddedSessionRunner, getEmbeddedExecutionRunId, getEmbeddedExecutionSession, getEmbeddedRunBySessionKey, getEmbeddedSessionRunnerIdleTtlMs, getEmbeddedSessionRunnerStats, getRawSessionAppendMessage, guardSessionManager, installSessionToolResultGuard, isEmbeddedSessionRunnerEnabled, openSqliteHydratingSessionManager, queueEmbeddedSteer, repairAssistantUsageInSessionManager, resetEmbeddedSessionRunnerForTest, resolveLiveToolResultMaxChars, runEmbeddedTurnForSession, runWithEmbeddedExecutionSession, runXopcEmbeddedTurn, truncateToolResultMessage };

package/dist/src/agent/embedded/model-runtime.js

@@ -1,6 +1,6 @@
 import { init_paths, resolveModelsJsonPath } from "../../config/paths.js";
-import { init_sync_provider_auth, resolveProviderApiKeySync } from "../../auth/sync-provider-auth.js";
 import { CredentialResolver, init_credentials } from "../../auth/credentials.js";
+import { init_sync_provider_auth, resolveProviderApiKeySync } from "../../auth/sync-provider-auth.js";
 import { XopcModelCredentialStore, init_model_credential_store } from "../../auth/model-credential-store.js";
 import { init_register_bundled_oauth_flows, registerBundledOAuthFlows } from "../../providers/register-bundled-oauth-flows.js";
 import { init_register_runtime_providers, registerRuntimeProviders } from "../../providers/register-runtime-providers.js";

package/dist/src/agent/embedded/run-for-session.js

@@ -1,15 +1,15 @@
 import { createLogger } from "../../utils/logger/index.js";
 import { init_logger } from "../../utils/logger.js";
 import { parseTurnOutcome } from "../../../packages/gateway-contract/src/turn-outcome.js";
-import { resolveEffectiveAgentProfileForSession } from "../../config/agent-profile.js";
 import { init_providers, resolveModel } from "../../providers/index.js";
-import { runWithEmbeddedExecutionSession } from "./execution-context.js";
-import { resolveAgentTurnTimeoutMs } from "../orchestration/run-agent-turn-with-timeout.js";
-import { resolvePromptCachePolicy } from "../../providers/prompt-cache-plan.js";
+import { resolveEffectiveAgentProfileForSession } from "../../config/agent-profile.js";
 import { evaluateContextBudget } from "../memory/context-budget.js";
-import { runXopcEmbeddedTurn } from "./run-turn.js";
 import { resolveCompactionPolicy } from "../memory/compaction-policy.js";
 import { projectTurnOutcome } from "../../session/turn-outcome-projector.js";
+import { resolveAgentTurnTimeoutMs } from "../orchestration/run-agent-turn-with-timeout.js";
+import { resolvePromptCachePolicy } from "../../providers/prompt-cache-plan.js";
+import { runXopcEmbeddedTurn } from "./run-turn.js";
+import { runWithEmbeddedExecutionSession } from "./execution-context.js";
 import { voicePresentationPrompt } from "../prompt/voice-presentation.js";
 import { applyStartupContextToUserMessage } from "../reply/apply-turn-user-enrichment.js";
 import { AgentRunSupervisor } from "../orchestration/agent-run-supervisor.js";

package/dist/src/agent/embedded/run-turn.js

@@ -2,6 +2,8 @@ import { createLogger } from "../../utils/logger/index.js";
 import { init_logger } from "../../utils/logger.js";
 import { getClarificationResumeInput, isClarificationSuspended } from "../../storage/sqlite/clarification-wait-repository.js";
 import { getConnectionResumeInput, isConnectionSuspended } from "../../storage/sqlite/connection-wait-repository.js";
+import { projectContextForModel } from "../memory/context-budget.js";
+import { markTurnToolResult } from "../memory/turn-provenance.js";
 import { EmbeddedRunConflictError, abortEmbeddedRun, acquireEmbeddedRunLease, queueEmbeddedSteer } from "./runs.js";
 import { lastAssistantPlainText, subscribeEmbeddedSessionEvents } from "./subscribe-session.js";
 import { isContextOverflowError } from "../orchestration/context-overflow.js";
@@ -12,11 +14,9 @@ import { tryApplySessionTranscriptHygiene } from "../transcript/transcript-hygie
 import { resolvePromptCachePolicy } from "../../providers/prompt-cache-plan.js";
 import { wrapStreamFnForXopcExtensions } from "./xopc-stream-bridge.js";
 import { acquireEmbeddedSessionRunner, evictEmbeddedSessionRunner } from "./session-runner.js";
-import { projectContextForModel } from "../memory/context-budget.js";
 import { createSqliteTranscriptRuntime } from "./transcript-runtime.js";
 import { buildPromptCacheSnapshot, observePromptCacheSnapshot } from "../../providers/prompt-cache-observability.js";
 import { isPromptCacheExpired, recordPromptCacheTouch } from "../../providers/prompt-cache-lifecycle.js";
-import { markTurnToolResult } from "../memory/turn-provenance.js";
 import { RepositoryInstructions } from "../coding/repository-instructions.js";
 import { RunVerification } from "../coding/run-verification.js";
 //#region src/agent/embedded/run-turn.ts

package/dist/src/agent/embedded/session-tool-result-guard.js

@@ -1,10 +1,10 @@
 import { init_string_coerce, normalizeOptionalString } from "../../utils/string-coerce.js";
+import { formatContextLimitTruncationNotice } from "./tool-result-context-guard.js";
+import { resolveLiveToolResultMaxChars, truncateToolResultMessage } from "./tool-result-truncation.js";
+import { emitSessionTranscriptUpdate } from "../../session/transcript-events.js";
 import { extractToolCallsFromAssistant, extractToolResultId } from "../transcript/tool-call-id.js";
 import { makeMissingToolResult, sanitizeToolCallInputs } from "../transcript/session-transcript-repair.js";
 import { boundedJsonUtf8Bytes, firstEnumerableOwnKeys, jsonUtf8BytesOrInfinity } from "../../infra/json-utf8-bytes.js";
-import { emitSessionTranscriptUpdate } from "../../session/transcript-events.js";
-import { formatContextLimitTruncationNotice } from "./tool-result-context-guard.js";
-import { resolveLiveToolResultMaxChars, truncateToolResultMessage } from "./tool-result-truncation.js";
 //#region src/agent/embedded/session-tool-result-guard.ts
 init_string_coerce();
 /**

package/dist/src/agent/external-tools/composio-provider.js

@@ -3,10 +3,10 @@ import { init_logger } from "../../utils/logger.js";
 import { connectionBinding, connectionBindings, publishConnectionWait, requireSessionConnection } from "../../storage/sqlite/connection-wait-repository.js";
 import { consumeConnectorApproval, createConnectorApproval, getConnectorApproval, getConnectorInstallation, listConnectorActionMetadata, listConnectorConnections, listConnectorInstallations, upsertConnectorActionMetadata, upsertConnectorInstallation } from "../../storage/sqlite/connector-repository.js";
 import "../../storage/sqlite/index.js";
-import { connectorArgumentsHash, connectorArgumentsPreview } from "../../connectors/approval.js";
 import { ComposioSessionsAdapter } from "../../connectors/composio-sessions.js";
 import { getComposioToolkitScope, getConfiguredComposioAuthConfigs, isComposioActionAllowedByCatalog, scopeForComposioAction } from "../../connectors/composio.js";
 import { getConnectorDefinition } from "../../connectors/catalog.js";
+import { connectorArgumentsHash, connectorArgumentsPreview } from "../../connectors/approval.js";
 import { isToolInputSchema } from "../../connectors/connection-capabilities.js";
 import { connectorPrincipalForSession } from "../../connectors/principal.js";
 import { ExternalToolSearchError } from "./search-error.js";

package/dist/src/agent/external-tools/gateway-tools.js

@@ -1,7 +1,7 @@
 import { connectionBindings, getActiveConnectionWait, publishConnectionWait, requireSessionConnection, reviseCurrentConnectionObjective } from "../../storage/sqlite/connection-wait-repository.js";
 import { listConnectorConnections } from "../../storage/sqlite/connector-repository.js";
-import { connectorPrincipalForSession } from "../../connectors/principal.js";
 import { connectionCandidates, resolveConnectionCandidate } from "../../connectors/connection-candidates.js";
+import { connectorPrincipalForSession } from "../../connectors/principal.js";
 import { ExternalToolService } from "./service.js";
 import { EXTERNAL_TOOL_SOURCES } from "./types.js";
 import { Type } from "@sinclair/typebox";

package/dist/src/agent/external-tools/mcp-provider.js

@@ -1,7 +1,7 @@
 import { resolveEffectiveAgentProfileForSession } from "../../config/agent-profile.js";
-import { externalToolRef, parseExternalToolRef } from "./refs.js";
-import { mcpToolPolicyId } from "../mcp/bundle-mcp-policy.js";
 import { getOrCreateSessionMcpRuntime } from "../mcp/bundle-mcp-runtime.js";
+import { mcpToolPolicyId } from "../mcp/bundle-mcp-policy.js";
+import { externalToolRef, parseExternalToolRef } from "./refs.js";
 //#region src/agent/external-tools/mcp-provider.ts
 function policyToolId(tool) {
 	return mcpToolPolicyId(tool.safeServerName, tool.toolName);

package/dist/src/agent/image/generation/openai-images-provider.js

@@ -1,11 +1,11 @@
 import { createLogger } from "../../../utils/logger/index.js";
 import { init_logger } from "../../../utils/logger.js";
-import { imageAssetFromBase64, imageFileExtensionForMimeType } from "./image-assets.js";
 import { pickTimeoutMsOrFallback } from "../../../media-shared/http/deadline.js";
 import { privateNetworkPolicyToSsrfGuardOptions } from "../../../media-shared/http/private-network.js";
 import { resolveProviderHttpRequestConfig } from "../../../media-shared/http/resolve-provider-http-request-config.js";
 import { postJsonRequest, postMultipartRequest, readJsonResponseLimited } from "../../../media-shared/http/provider-http.js";
 import "../../../media-shared/http/index.js";
+import { imageAssetFromBase64, imageFileExtensionForMimeType } from "./image-assets.js";
 //#region src/agent/image/generation/openai-images-provider.ts
 init_logger();
 const log = createLogger("ImageGen:OpenAIImages");

package/dist/src/agent/image/generation/providers/dashscope.js

@@ -1,6 +1,5 @@
 import { createLogger } from "../../../../utils/logger/index.js";
 import { init_logger } from "../../../../utils/logger.js";
-import { imageFileExtensionForMimeType } from "../image-assets.js";
 import { pickTimeoutMsOrFallback } from "../../../../media-shared/http/deadline.js";
 import { privateNetworkPolicyToSsrfGuardOptions } from "../../../../media-shared/http/private-network.js";
 import { resolveProviderHttpRequestConfig } from "../../../../media-shared/http/resolve-provider-http-request-config.js";
@@ -9,6 +8,7 @@ import "../../../../media-shared/http/index.js";
 import { resolveApiKeyForProvider } from "../../../../providers/auth-runtime/resolve-api-key.js";
 import { isProviderApiKeyConfigured } from "../../../../providers/auth-runtime/is-configured.js";
 import "../../../../providers/auth-runtime/index.js";
+import { imageFileExtensionForMimeType } from "../image-assets.js";
 //#region src/agent/image/generation/providers/dashscope.ts
 /**
 * Built-in DashScope (Alibaba Model Studio) image-generation provider.

package/dist/src/agent/image/generation/providers/fal.js

@@ -1,6 +1,5 @@
 import { createLogger } from "../../../../utils/logger/index.js";
 import { init_logger } from "../../../../utils/logger.js";
-import { imageFileExtensionForMimeType } from "../image-assets.js";
 import { pickTimeoutMsOrFallback } from "../../../../media-shared/http/deadline.js";
 import { privateNetworkPolicyToSsrfGuardOptions } from "../../../../media-shared/http/private-network.js";
 import { resolveProviderHttpRequestConfig } from "../../../../media-shared/http/resolve-provider-http-request-config.js";
@@ -9,6 +8,7 @@ import "../../../../media-shared/http/index.js";
 import { resolveApiKeyForProvider } from "../../../../providers/auth-runtime/resolve-api-key.js";
 import { isProviderApiKeyConfigured } from "../../../../providers/auth-runtime/is-configured.js";
 import "../../../../providers/auth-runtime/index.js";
+import { imageFileExtensionForMimeType } from "../image-assets.js";
 //#region src/agent/image/generation/providers/fal.ts
 /**
 * Built-in Fal.ai image-generation provider.

package/dist/src/agent/image/generation/providers/google.js

@@ -1,6 +1,5 @@
 import { createLogger } from "../../../../utils/logger/index.js";
 import { init_logger } from "../../../../utils/logger.js";
-import { imageFileExtensionForMimeType } from "../image-assets.js";
 import { pickTimeoutMsOrFallback } from "../../../../media-shared/http/deadline.js";
 import { privateNetworkPolicyToSsrfGuardOptions } from "../../../../media-shared/http/private-network.js";
 import { resolveProviderHttpRequestConfig } from "../../../../media-shared/http/resolve-provider-http-request-config.js";
@@ -9,6 +8,7 @@ import "../../../../media-shared/http/index.js";
 import { resolveApiKeyForProvider } from "../../../../providers/auth-runtime/resolve-api-key.js";
 import { isProviderApiKeyConfigured } from "../../../../providers/auth-runtime/is-configured.js";
 import "../../../../providers/auth-runtime/index.js";
+import { imageFileExtensionForMimeType } from "../image-assets.js";
 //#region src/agent/image/generation/providers/google.ts
 /**
 * Built-in Google Gemini image-generation provider.

package/dist/src/agent/image/generation/runtime.js

@@ -1,12 +1,12 @@
 import { createLogger } from "../../../utils/logger/index.js";
 import { init_logger } from "../../../utils/logger.js";
 import { PROVIDER_ENV_MAP, init_env_keys } from "../../../providers/env-keys.js";
+import { getImageGenerationProvider, listImageGenerationProviders, listImageGenerationProvidersSummary as listImageGenerationProvidersSummary$1 } from "./provider-registry.js";
 import { describeFailoverError, isFailoverError } from "../../failover-error.js";
 import { buildMediaGenerationNormalizationMetadata, buildNoCapabilityModelConfiguredMessage, recordCapabilityCandidateFailure, resolveCapabilityModelCandidates, throwCapabilityGenerationFailure } from "../../media-generation/runtime-shared.js";
 import "../../media-generation/index.js";
 import { parseImageGenerationModelRef } from "./model-ref.js";
 import { resolveImageGenerationOverrides } from "./normalization.js";
-import { getImageGenerationProvider, listImageGenerationProviders, listImageGenerationProvidersSummary as listImageGenerationProvidersSummary$1 } from "./provider-registry.js";
 //#region src/agent/image/generation/runtime.ts
 init_env_keys();
 init_logger();

package/dist/src/agent/image/index.js

@@ -1,9 +1,9 @@
+import { getImageGenerationProvider, listImageGenerationProviders } from "./generation/provider-registry.js";
 import { getImageUnderstandingProvider, listImageUnderstandingProviders, registerImageUnderstandingProvider } from "./understanding/provider-registry.js";
 import { resolveImageModelConfigForTool } from "./tool-model-config.js";
 import { describeImages, describeImagesWithFallback } from "./understanding/runtime.js";
 import { modelSupportsVision, resolveImageHandlingStrategy } from "./vision-detection.js";
 import { runWithImageModelFallback } from "./image-model-fallback.js";
 import { loadImageForToolInput } from "./load-image-media.js";
-import { getImageGenerationProvider, listImageGenerationProviders } from "./generation/provider-registry.js";
 import { generateImage, listImageGenerationProvidersSummary } from "./generation/runtime.js";
 export { describeImages, describeImagesWithFallback, generateImage, getImageGenerationProvider, getImageUnderstandingProvider, listImageGenerationProviders, listImageGenerationProvidersSummary, listImageUnderstandingProviders, loadImageForToolInput, modelSupportsVision, registerImageUnderstandingProvider, resolveImageHandlingStrategy, resolveImageModelConfigForTool, runWithImageModelFallback };

package/dist/src/agent/image/load-image-media.js

@@ -1,5 +1,5 @@
-import { checkFileSafety } from "../prompt/safety.js";
 import { decodeDataUrl } from "./image-helpers.js";
+import { checkFileSafety } from "../prompt/safety.js";
 import { homedir } from "node:os";
 import path from "node:path";
 import { promises } from "node:fs";

package/dist/src/agent/image/tool-model-config.js

@@ -1,7 +1,7 @@
 import { getAgentDefaultImageModelConfig, getAgentDefaultModelRef, init_schema, parseModelRef } from "../../config/schema.js";
 import { init_agent_scope, resolveDefaultAgentId } from "../agent-scope.js";
-import { resolveEffectiveAgentConfigForAgent } from "../../config/agent-profile.js";
 import { getDefaultModelSync, getModelsByProvider, init_providers, isProviderConfiguredSync, resolveModel } from "../../providers/index.js";
+import { resolveEffectiveAgentConfigForAgent } from "../../config/agent-profile.js";
 import { resolveAgentModelFallbackValues, resolveAgentModelPrimaryValue } from "../../config/model-input.js";
 import { buildCapabilityPlansForConfig } from "../../capabilities/readiness/from-config.js";
 import "../../capabilities/readiness/index.js";

package/dist/src/agent/inbound/attachment-pipeline.js

@@ -1,7 +1,7 @@
 import { stripRuntimeUserMessageEnvelope } from "../../../packages/gateway-contract/src/user-message-display.js";
 import { extractProfileAgentId } from "../../config/agent-profile.js";
-import { mimeTypeFromMediaPath } from "../../media/store.js";
 import { readAgentMessageContent } from "../memory/agent-message-access.js";
+import { mimeTypeFromMediaPath } from "../../media/store.js";
 import { readMediaReference } from "../../media/media-reference.js";
 import { isImageInboundAttachment } from "../../channels/attachments/attachment-classifiers.js";
 import "../../channels/attachments/inbound-persist.js";

package/dist/src/agent/inbound/inbound-loop.js

@@ -1,9 +1,9 @@
 import { runWithLogContext, updateAsyncLogContext } from "../../utils/logger/context.js";
 import { init_logger } from "../../utils/logger.js";
-import { shouldSkipResetOverlapCommand } from "../../session/reset-triggers.js";
-import { initSessionTurn } from "../../session/init-session-turn.js";
 import { MessageBusShutdownError } from "../../infra/bus/queue.js";
 import "../../infra/bus/index.js";
+import { shouldSkipResetOverlapCommand } from "../../session/reset-triggers.js";
+import { initSessionTurn } from "../../session/init-session-turn.js";
 import { runEmbeddedTurnForSession } from "../embedded/run-for-session.js";
 import { inboundMessageLogRequestId } from "../service-inbound-utils.js";
 //#region src/agent/inbound/inbound-loop.ts

package/dist/src/agent/index.js

@@ -3,12 +3,12 @@ import { dropThinkingBlocks } from "./transcript/thinking.js";
 import { extractToolCallsFromAssistant, extractToolResultId, sanitizeToolCallId, sanitizeToolCallIdsForCloudCodeAssist } from "./transcript/tool-call-id.js";
 import { makeMissingToolResult, repairToolUseResultPairing, sanitizeToolCallInputs, sanitizeToolUseResultPairing, stripToolResultDetails } from "./transcript/session-transcript-repair.js";
 import { applySessionTranscriptHygiene, applySessionTranscriptHygieneForPersistence, applySessionTranscriptHygieneWithPolicy, resolvePolicyForModel, tryApplySessionTranscriptHygiene, tryApplySessionTranscriptHygieneForPersistence } from "./transcript/transcript-hygiene.js";
+import { AgentService } from "./service.js";
 import { createResponseMessage, createSignalMessage, createTaskMessage, isValidIPCMessage } from "./ipc/types.js";
 import { AgentInbox } from "./ipc/inbox.js";
 import { AgentBus } from "./ipc/bus.js";
 import { AgentSocketClient, AgentSocketServer, isSocketAvailable } from "./ipc/socket.js";
 import "./ipc/index.js";
-import { AgentService } from "./service.js";
 import { stripToolMessages } from "./transcript/strip-tool-messages.js";
 import "./transcript/index.js";
 export { AgentBus, AgentInbox, AgentService, AgentSocketClient, AgentSocketServer, applySessionTranscriptHygiene, applySessionTranscriptHygieneForPersistence, applySessionTranscriptHygieneWithPolicy, createResponseMessage, createSignalMessage, createTaskMessage, dropThinkingBlocks, extractToolCallsFromAssistant, extractToolResultId, isSocketAvailable, isValidIPCMessage, makeMissingToolResult, repairToolUseResultPairing, resolvePolicyForModel, resolveTranscriptPolicy, sanitizeToolCallId, sanitizeToolCallIdsForCloudCodeAssist, sanitizeToolCallInputs, sanitizeToolUseResultPairing, stripToolMessages, stripToolResultDetails, tryApplySessionTranscriptHygiene, tryApplySessionTranscriptHygieneForPersistence };

package/dist/src/agent/mcp/bundle-mcp-gateway.js

@@ -1,5 +1,5 @@
-import { mcpToolPolicyId } from "./bundle-mcp-policy.js";
 import { createSessionMcpRuntime } from "./bundle-mcp-runtime.js";
+import { mcpToolPolicyId } from "./bundle-mcp-policy.js";
 import crypto from "node:crypto";
 //#region src/agent/mcp/bundle-mcp-gateway.ts
 function mapTools(tools, serverId) {

package/dist/src/agent/mcp/bundle-mcp-runtime.js

@@ -2,15 +2,15 @@ import { createLogger } from "../../utils/logger/index.js";
 import { init_logger } from "../../utils/logger.js";
 import { resolveGlobalSingleton } from "../../utils/global-singleton.js";
 import { init_string_coerce, normalizeOptionalString } from "../../utils/string-coerce.js";
+import { resolveConnectorSecretReferences } from "../../connectors/secret-store.js";
 import { redactSensitiveUrlLikeString } from "../../utils/redact-sensitive-url.js";
 import { loadEmbeddedMcpConfig } from "./embedded-mcp.js";
-import { resolveConnectorSecretReferences } from "../../connectors/secret-store.js";
 import { isMcpConfigRecord } from "./mcp-config-shared.js";
 import { resolveMcpTransport } from "./mcp-transport.js";
 import { sanitizeServerName } from "./bundle-mcp-names.js";
 import crypto from "node:crypto";
-import Ajv2020 from "ajv/dist/2020.js";
 import { Client } from "@modelcontextprotocol/sdk/client/index.js";
+import Ajv2020 from "ajv/dist/2020.js";
 import { AjvJsonSchemaValidator } from "@modelcontextprotocol/sdk/validation/ajv-provider.js";
 //#region src/agent/mcp/bundle-mcp-runtime.ts
 init_logger();

package/dist/src/agent/mcp/index.js

@@ -1,12 +1,12 @@
-import { mcpToolPolicyId } from "./bundle-mcp-policy.js";
 import { loadMergedBundleMcpConfig } from "./bundle-mcp-config.js";
 import { loadEmbeddedMcpConfig } from "./embedded-mcp.js";
 import { McpAuthorizationRequiredError, isMcpAuthorizationError } from "./oauth/mcp-oauth-errors.js";
 import { McpOAuthStore, canonicalMcpServerUrl, mcpOAuthServerKey } from "./oauth/mcp-oauth-store.js";
 import { XopcMcpOAuthClientProvider } from "./oauth/mcp-oauth-provider.js";
 import { __testing, createSessionMcpRuntime, disposeAllSessionMcpRuntimes, disposeSessionMcpRuntime, getOrCreateSessionMcpRuntime, getSessionMcpRuntimeManager, retireSessionMcpRuntime, retireSessionMcpRuntimeForSessionKey } from "./bundle-mcp-runtime.js";
-import "./bundle-mcp-tools.js";
 import { McpOAuthSession } from "./oauth/mcp-oauth-session.js";
 import { McpOAuthManager, getMcpOAuthManager } from "./oauth/mcp-oauth-manager.js";
+import { mcpToolPolicyId } from "./bundle-mcp-policy.js";
+import "./bundle-mcp-tools.js";
 import "./oauth/index.js";
 export { McpAuthorizationRequiredError, McpOAuthManager, McpOAuthSession, McpOAuthStore, XopcMcpOAuthClientProvider, __testing, canonicalMcpServerUrl, createSessionMcpRuntime, disposeAllSessionMcpRuntimes, disposeSessionMcpRuntime, getMcpOAuthManager, getOrCreateSessionMcpRuntime, getSessionMcpRuntimeManager, isMcpAuthorizationError, loadEmbeddedMcpConfig, loadMergedBundleMcpConfig, mcpOAuthServerKey, mcpToolPolicyId, retireSessionMcpRuntime, retireSessionMcpRuntimeForSessionKey };

package/dist/src/agent/mcp/mcp-transport.js

@@ -7,10 +7,10 @@ import { XopcStdioClientTransport } from "./mcp-stdio-transport.js";
 import { resolveMcpTransportConfig } from "./mcp-transport-config.js";
 import { McpOAuthStore } from "./oauth/mcp-oauth-store.js";
 import { XopcMcpOAuthClientProvider } from "./oauth/mcp-oauth-provider.js";
+import { fetch } from "undici";
 import { SSEClientTransport } from "@modelcontextprotocol/sdk/client/sse.js";
 import { StreamableHTTPClientTransport } from "@modelcontextprotocol/sdk/client/streamableHttp.js";
 import { getDefaultEnvironment } from "@modelcontextprotocol/sdk/client/stdio.js";
-import { fetch } from "undici";
 //#region src/agent/mcp/mcp-transport.ts
 init_paths_state();
 init_logger();

package/dist/src/agent/mcp/oauth/mcp-oauth-manager.js

@@ -1,8 +1,8 @@
 import { createLogger } from "../../../utils/logger/index.js";
 import { init_logger } from "../../../utils/logger.js";
 import { resolveGlobalSingleton } from "../../../utils/global-singleton.js";
-import { redactSensitiveUrlLikeString } from "../../../utils/redact-sensitive-url.js";
 import { resolveConnectorSecretReferences } from "../../../connectors/secret-store.js";
+import { redactSensitiveUrlLikeString } from "../../../utils/redact-sensitive-url.js";
 import { resolveMcpTransportConfig } from "../mcp-transport-config.js";
 import { isMcpAuthorizationError } from "./mcp-oauth-errors.js";
 import { McpOAuthStore, canonicalMcpServerUrl } from "./mcp-oauth-store.js";

package/dist/src/agent/mcp/oauth/mcp-oauth-store.js

@@ -1,5 +1,5 @@
-import { init_paths, resolveMcpOAuthPath } from "../../../config/paths.js";
 import { init_write_file_atomic, writeTextAtomic } from "../../../infra/write-file-atomic.js";
+import { init_paths, resolveMcpOAuthPath } from "../../../config/paths.js";
 import { createHash } from "node:crypto";
 import { readFile, rm } from "node:fs/promises";
 //#region src/agent/mcp/oauth/mcp-oauth-store.ts

package/dist/src/agent/memory/index.js

@@ -1,6 +1,6 @@
-import { isMemorySubsystemEnabled } from "./memory-config.js";
-import { extractAgentUserPlainText } from "./user-message-text.js";
 import { buildUserContextBlock, sanitizeUserContextFenceEscapes } from "./context-fence.js";
+import { extractAgentUserPlainText } from "./user-message-text.js";
+import { isMemorySubsystemEnabled } from "./memory-config.js";
 import { MemoryManager } from "./manager.js";
 import { discoverMemoryPlugins } from "./plugin-discovery.js";
 import { createMemoryManagerFromConfig } from "./create-memory-manager.js";

package/dist/src/agent/messaging/outbound-coordinator.js

@@ -1,7 +1,7 @@
 import { createLogger } from "../../utils/logger/index.js";
 import { init_logger } from "../../utils/logger.js";
-import { shouldSilence } from "../../heartbeat/tokens.js";
 import { createTypingController } from "../lifecycle/typing.js";
+import { shouldSilence } from "../../heartbeat/tokens.js";
 //#region src/agent/messaging/outbound-coordinator.ts
 init_logger();
 const log = createLogger("OutboundCoordinator");

package/dist/src/agent/orchestration/agent-orchestrator.js

@@ -1,14 +1,14 @@
 import { createLogger } from "../../utils/logger/index.js";
 import { init_logger } from "../../utils/logger.js";
-import { parseMaintenanceInstruction } from "../../memory-maintenance/schedule.js";
-import { runMemoryMaintenance } from "../../memory-maintenance/service.js";
-import "../../memory-maintenance/index.js";
+import { resolveEffectiveThinkingLevel } from "../../session/thinking-resolve.js";
 import { abortEmbeddedRun } from "../embedded/runs.js";
 import { persistInboundAttachments } from "../../channels/attachments/inbound-persist.js";
 import { buildTranscriptUserMessage, clearPendingTranscriptUserMessage, hydrateUserTurnForLlm, setPendingTranscriptUserMessage } from "../inbound/attachment-pipeline.js";
-import { extractAgentUserPlainText } from "../memory/user-message-text.js";
-import { resolveEffectiveThinkingLevel } from "../../session/thinking-resolve.js";
 import { runEmbeddedTurnForSession } from "../embedded/run-for-session.js";
+import { extractAgentUserPlainText } from "../memory/user-message-text.js";
+import { parseMaintenanceInstruction } from "../../memory-maintenance/schedule.js";
+import { runMemoryMaintenance } from "../../memory-maintenance/service.js";
+import "../../memory-maintenance/index.js";
 import { randomUUID } from "node:crypto";
 //#region src/agent/orchestration/agent-orchestrator.ts
 /**

package/dist/src/agent/prompt/service-prompt-builder.js

@@ -7,13 +7,13 @@ import { DEFAULT_USER_TRUST_LEVEL } from "../../user-context/trust-policy.js";
 import { getUserTrustPolicy } from "../../storage/sqlite/user-trust-repository.js";
 import "../../storage/sqlite/index.js";
 import { appendStablePromptSection } from "./cache-boundary.js";
+import { mergeTtsConfigFromAppConfig } from "../../voice/tts/merge-config.js";
+import { buildTtsSystemPromptHint } from "../../voice/tts/directives.js";
 import { getUserTimezone } from "../../user-model/repository.js";
 import "../../user-model/index.js";
 import { resolveSystemPromptBuildParams } from "./system-prompt-params.js";
 import { buildSystemPrompt } from "./system-prompt.js";
 import { resolveResponseLanguageForSession } from "./response-language.js";
-import { buildTtsSystemPromptHint } from "../../voice/tts/directives.js";
-import { mergeTtsConfigFromAppConfig } from "../../voice/tts/merge-config.js";
 //#region src/agent/prompt/service-prompt-builder.ts
 init_logger();
 const log = createLogger("SystemPromptBuilder");