@xopcai/xopc 0.0.277 → 0.0.282

package/dist/src/agent/tools/review-workspace.js

@@ -1,7 +1,10 @@
 import { readWorkspaceRevision } from "../coding/workspace-revision.js";
+import { prepareSafeToolEnv } from "../sandbox/sanitize-env-vars.js";
+import { evaluateFilePolicy } from "../sandbox/exec-policy.js";
+import { checkedFilePath, readWorkspaceFile } from "../sandbox/fileAccess.js";
 import { resolve } from "node:path";
 import { execFile } from "node:child_process";
-import { lstat, readFile, readlink, realpath } from "node:fs/promises";
+import { lstat, readlink, realpath } from "node:fs/promises";
 import { promisify } from "node:util";
 import { Type } from "@sinclair/typebox";
 //#region src/agent/tools/review-workspace.ts
@@ -15,62 +18,125 @@ function createReviewWorkspaceTool(workspace) {
 		supportsParallel: true,
 		idempotent: true,
 		async execute(_id, _args, signal) {
-			let cwd = workspace;
+			let cwd = checkedFilePath(workspace, workspace, "read");
 			const git = async (args) => (await exec("git", [
 				"-c",
 				"core.fsmonitor=false",
 				...args
 			], {
 				cwd,
+				env: prepareSafeToolEnv(process.env),
 				signal,
 				timeout: 1e4,
 				maxBuffer: 8 * 1024 * 1024
 			})).stdout;
-			cwd = await realpath((await git(["rev-parse", "--show-toplevel"])).trim());
+			cwd = checkedFilePath(workspace, await realpath((await git(["rev-parse", "--show-toplevel"])).trim()), "read");
 			const startRevision = await readWorkspaceRevision(cwd);
 			const head = await git([
 				"rev-parse",
 				"--verify",
 				"HEAD"
 			]).catch(() => "");
-			const [diff, names] = await Promise.all([head ? git([
+			const changedNames = head ? await git([
 				"diff",
+				"--no-renames",
+				"--name-only",
+				"-z",
+				"HEAD",
+				"--"
+			]) : (await Promise.all([git([
+				"diff",
+				"--name-only",
+				"-z",
+				"--cached",
+				"--"
+			]), git([
+				"diff",
+				"--name-only",
+				"-z",
+				"--"
+			])])).join("");
+			const safePaths = [];
+			let complete = true;
+			for (const path of new Set(changedNames.split("\0").filter(Boolean))) {
+				const file = resolve(cwd, path);
+				if (!evaluateFilePolicy({
+					workspaceRoot: workspace,
+					path: file,
+					operation: "read"
+				}).allowed) {
+					complete = false;
+					continue;
+				}
+				const info = await lstat(file).catch((error) => {
+					if (error.code === "ENOENT") return null;
+					throw error;
+				});
+				if (info && (!info.isFile() || info.nlink !== 1)) {
+					complete = false;
+					continue;
+				}
+				safePaths.push(`:(literal)${path}`);
+			}
+			if (safePaths.length > 1e3) throw new Error("Too many changed files for a bounded workspace review");
+			const [diff, names] = await Promise.all([safePaths.length === 0 ? Promise.resolve("") : head ? git([
+				"diff",
+				"--no-renames",
 				"--no-ext-diff",
 				"--no-textconv",
 				"--binary",
 				"HEAD",
-				"--"
+				"--",
+				...safePaths
 			]) : Promise.all([git([
 				"diff",
+				"--no-renames",
 				"--no-ext-diff",
 				"--no-textconv",
 				"--binary",
 				"--cached",
-				"--"
+				"--",
+				...safePaths
 			]), git([
 				"diff",
+				"--no-renames",
 				"--no-ext-diff",
 				"--no-textconv",
 				"--binary",
-				"--"
+				"--",
+				...safePaths
 			])]).then((parts) => parts.join("\n")), git([
 				"ls-files",
 				"--others",
 				"--exclude-standard",
 				"-z"
 			])]);
-			let text = diff.slice(0, 2e5), complete = diff.length <= 2e5;
+			let text = diff.slice(0, 2e5);
+			complete &&= diff.length <= 2e5;
 			for (const path of names.split("\0").filter(Boolean)) {
 				signal?.throwIfAborted();
 				if (text.length >= 2e5) {
 					complete = false;
 					break;
 				}
-				const file = resolve(cwd, path), info = await lstat(file);
+				const file = resolve(cwd, path);
+				if (!evaluateFilePolicy({
+					workspaceRoot: workspace,
+					path: file,
+					operation: "read"
+				}).allowed) {
+					complete = false;
+					continue;
+				}
+				const info = await lstat(file);
+				if (info.isFile() && info.nlink !== 1) {
+					complete = false;
+					continue;
+				}
 				text += `\nUntracked file: ${path}\n`;
 				if (info.isSymbolicLink()) text += `Symlink to ${await readlink(file)}\n`;
 				else if (info.isFile() && info.size <= 5e4) {
-					const content = await readFile(file);
+					const content = readWorkspaceFile(workspace, file, 5e4);
 					if (content.includes(0)) {
 						text += "(binary file; inspect separately)\n";
 						complete = false;

package/dist/src/agent/tools/send-media.js

@@ -1,13 +1,14 @@
 import { turnOutcomeKindFromFileName } from "../../../packages/gateway-contract/src/turn-outcome.js";
+import { readWorkspaceFile } from "../sandbox/fileAccess.js";
 import { checkFileSafety } from "../prompt/safety.js";
 import { resolvePathUnderWorkspace } from "./tool-paths.js";
+import { MEDIA_MAX_BYTES } from "../../media/store.js";
 import { persistToolMedia } from "./tool-media.js";
 import { basename } from "node:path";
-import { readFile } from "fs/promises";
 import { Type } from "@sinclair/typebox";
 //#region src/agent/tools/send-media.ts
 const SendMediaSchema = Type.Object({
-	filePath: Type.String({ description: "File to send. Relative paths are under the current agent workspace; absolute paths are used as given." }),
+	filePath: Type.String({ description: "File to send. Relative paths are under the current agent workspace; absolute paths must remain inside the workspace." }),
 	mediaType: Type.Optional(Type.Enum({
 		photo: "photo",
 		video: "video",
@@ -42,7 +43,7 @@ function createSendMediaTool(workspace, bus, getContext) {
 				details: {}
 			};
 			try {
-				const fileBuffer = await readFile(resolved);
+				const fileBuffer = readWorkspaceFile(workspace, resolved, MEDIA_MAX_BYTES);
 				const media = await persistToolMedia({
 					buffer: fileBuffer,
 					filePath: resolved,

package/dist/src/agent/tools/tool-paths.js

@@ -16,7 +16,9 @@ function resolvePathUnderWorkspace(userPath, workspaceRoot) {
 }
 /** True if `userPath` is only a profile-system filename, e.g. `SOUL.md` or `.\SOUL.md` (basename matches). */
 function isBareProfileMarkdownFileName(userPath) {
-	const b = basename(userPath.replace(/\\/g, "/"));
+	const normalized = userPath.replace(/\\/g, "/").replace(/^\.\//, "");
+	if (normalized.includes("/")) return false;
+	const b = basename(normalized);
 	if (!b || b === "." || b === "..") return false;
 	return PROFILE_SYSTEM_MARKDOWN_NAME_LOWER.has(b.toLowerCase());
 }

package/dist/src/agent/tools/write.js

@@ -1,10 +1,10 @@
 import { appendProductDeliveryText } from "../../../packages/gateway-contract/src/product-delivery.js";
+import { writeWorkspaceFile } from "../sandbox/fileAccess.js";
 import { checkFileSafety } from "../prompt/safety.js";
 import { isBareProfileMarkdownFileName, resolvePathUnderWorkspace, resolveProfileMarkdownPathIfBareName } from "./tool-paths.js";
 import { fileResourceId, fileSpaceId } from "../../files/file-service.js";
-import { evaluateFilePolicy } from "../sandbox/exec-policy.js";
-import { basename, dirname, relative, sep } from "path";
-import { mkdir, realpath, writeFile } from "fs/promises";
+import { basename, relative, sep } from "path";
+import { realpath } from "fs/promises";
 import { Type } from "@sinclair/typebox";
 //#region src/agent/tools/write.ts
 const MAX_FILE_SIZE = 10 * 1024 * 1024;
@@ -37,18 +37,6 @@ function createWriteFileTool(workspace, options) {
 				};
 				const writesProfileFile = Boolean(options?.profileMarkdownRoot && isBareProfileMarkdownFileName(p.path));
 				const workspaceRoot = writesProfileFile ? options.profileMarkdownRoot : workspace;
-				const pathPolicy = evaluateFilePolicy({
-					operation: "write",
-					path: p.path,
-					workspaceRoot
-				});
-				if (!pathPolicy.allowed) return {
-					content: [{
-						type: "text",
-						text: `🚫 Sandbox: ${pathPolicy.reason}`
-					}],
-					details: { status: "failed" }
-				};
 				const contentBytes = Buffer.byteLength(p.content, "utf-8");
 				if (contentBytes > MAX_FILE_SIZE) return {
 					content: [{
@@ -58,8 +46,7 @@ function createWriteFileTool(workspace, options) {
 					details: { status: "failed" }
 				};
 				const target = writesProfileFile ? resolveProfileMarkdownPathIfBareName(p.path, options.profileMarkdownRoot) : resolvePathUnderWorkspace(p.path, workspace);
-				await mkdir(dirname(target), { recursive: true });
-				await writeFile(target, p.content, "utf-8");
+				writeWorkspaceFile(workspaceRoot, target, p.content);
 				const delivery = writesProfileFile ? void 0 : await Promise.all([realpath(workspace), realpath(target)]).then(([root, canonicalTarget]) => ({
 					version: 1,
 					operation: "updated",

package/dist/src/agent/tools/xopc-use-tool.js

@@ -9,6 +9,8 @@ import "../../storage/sqlite/index.js";
 import { ObjectLinkService } from "../../activity/service.js";
 import "../../activity/index.js";
 import { getDefaultAgentId, init_resolve_route } from "../../routing/resolve-route.js";
+import { CreateAutomationSchema, UpdateAutomationSchema } from "../../automations/domain/validation.js";
+import "../../automations/index.js";
 import { TaskRepository } from "../../tasks/task-repository.js";
 import { TaskReadModelProjector } from "../../tasks/task-read-model-projector.js";
 import { isValidProjectAgentId, normalizeProjectAgentId, resolveProjectAgentId } from "../../projects/project-agent.js";
@@ -20,8 +22,6 @@ import { TaskDependencyError, TaskDependencyService } from "../../tasks/task-dep
 import { TaskApplicationService } from "../../tasks/task-application-service.js";
 import { getCard } from "../../proactive/inbox/cards.js";
 import { checkDelegation, delegationOverview, startDelegation } from "../../proactive/experience.js";
-import { CreateAutomationSchema, UpdateAutomationSchema } from "../../automations/domain/validation.js";
-import "../../automations/index.js";
 import { defineTaskContract } from "../../tasks/task-contract-definition.js";
 import { TaskDeletionService } from "../../tasks/task-deletion-service.js";
 import "../../tasks/index.js";

package/dist/src/agent-config/schema.d.ts

@@ -122,6 +122,10 @@ export declare const RuntimePolicySchema: z.ZodObject<{
         mode: z.ZodLiteral<"docker">;
         image: z.ZodString;
         network: z.ZodDefault<z.ZodBoolean>;
+        workspaceAccess: z.ZodDefault<z.ZodEnum<{
+            "read-only": "read-only";
+            "read-write": "read-write";
+        }>>;
     }, z.core.$strict>], "mode">>;
     maxTurns: z.ZodOptional<z.ZodNumber>;
     timeoutMs: z.ZodOptional<z.ZodNumber>;
@@ -192,6 +196,10 @@ export declare const AgentDefaultsSchema: z.ZodObject<{
             mode: z.ZodLiteral<"docker">;
             image: z.ZodString;
             network: z.ZodDefault<z.ZodBoolean>;
+            workspaceAccess: z.ZodDefault<z.ZodEnum<{
+                "read-only": "read-only";
+                "read-write": "read-write";
+            }>>;
         }, z.core.$strict>], "mode">>;
         maxTurns: z.ZodOptional<z.ZodNumber>;
         timeoutMs: z.ZodOptional<z.ZodNumber>;
@@ -275,6 +283,10 @@ export declare const AgentEntrySchema: z.ZodObject<{
             mode: z.ZodLiteral<"docker">;
             image: z.ZodString;
             network: z.ZodDefault<z.ZodBoolean>;
+            workspaceAccess: z.ZodDefault<z.ZodEnum<{
+                "read-only": "read-only";
+                "read-write": "read-write";
+            }>>;
         }, z.core.$strict>], "mode">>;
         maxTurns: z.ZodOptional<z.ZodNumber>;
         timeoutMs: z.ZodOptional<z.ZodNumber>;
@@ -348,6 +360,10 @@ export declare const AgentsConfigSchema: z.ZodObject<{
                 mode: z.ZodLiteral<"docker">;
                 image: z.ZodString;
                 network: z.ZodDefault<z.ZodBoolean>;
+                workspaceAccess: z.ZodDefault<z.ZodEnum<{
+                    "read-only": "read-only";
+                    "read-write": "read-write";
+                }>>;
             }, z.core.$strict>], "mode">>;
             maxTurns: z.ZodOptional<z.ZodNumber>;
             timeoutMs: z.ZodOptional<z.ZodNumber>;
@@ -427,6 +443,10 @@ export declare const AgentsConfigSchema: z.ZodObject<{
                 mode: z.ZodLiteral<"docker">;
                 image: z.ZodString;
                 network: z.ZodDefault<z.ZodBoolean>;
+                workspaceAccess: z.ZodDefault<z.ZodEnum<{
+                    "read-only": "read-only";
+                    "read-write": "read-write";
+                }>>;
             }, z.core.$strict>], "mode">>;
             maxTurns: z.ZodOptional<z.ZodNumber>;
             timeoutMs: z.ZodOptional<z.ZodNumber>;
@@ -506,6 +526,10 @@ export declare const EffectiveAgentConfigSchema: z.ZodObject<{
             mode: z.ZodLiteral<"docker">;
             image: z.ZodString;
             network: z.ZodDefault<z.ZodBoolean>;
+            workspaceAccess: z.ZodDefault<z.ZodEnum<{
+                "read-only": "read-only";
+                "read-write": "read-write";
+            }>>;
         }, z.core.$strict>], "mode">>;
         maxTurns: z.ZodOptional<z.ZodNumber>;
         timeoutMs: z.ZodOptional<z.ZodNumber>;

package/dist/src/agent-config/schema.js

@@ -80,7 +80,8 @@ var init_schema = __esmMin((() => {
 		commandIsolation: z.discriminatedUnion("mode", [z.object({ mode: z.literal("host") }).strict(), z.object({
 			mode: z.literal("docker"),
 			image: z.string().regex(/^[a-zA-Z0-9][a-zA-Z0-9./:_-]*@sha256:[a-f0-9]{64}$/),
-			network: z.boolean().default(false)
+			network: z.boolean().default(false),
+			workspaceAccess: z.enum(["read-only", "read-write"]).default("read-only")
 		}).strict()]).optional(),
 		maxTurns: z.number().int().positive().optional(),
 		timeoutMs: z.number().int().positive().optional(),

package/dist/src/ai-assist/text-assist.js

@@ -1,9 +1,9 @@
 import { createLogger } from "../utils/logger/index.js";
 import { init_logger } from "../utils/logger.js";
+import { getAssistantMessageErrorReason, stripCodeFences } from "../providers/model-response.js";
 import { getDefaultModelSync, init_providers, resolveModel } from "../providers/index.js";
 import { createExtensionAwareStreamFn } from "../providers/extension-stream-bridge.js";
 import { isLocalModelBaseUrl, resolveModelCallApiKey, resolveModelCallOptions } from "../providers/model-call.js";
-import { getAssistantMessageErrorReason, stripCodeFences } from "../providers/model-response.js";
 //#region src/ai-assist/text-assist.ts
 init_providers();
 init_logger();

package/dist/src/auth/credentials.js

@@ -1,10 +1,10 @@
 import { __esmMin } from "../../_virtual/_rolldown/runtime.js";
 import { createLogger } from "../utils/logger/index.js";
 import { init_logger } from "../utils/logger.js";
-import { init_paths, resolveAgentAuthProfilesPath, resolveAuthProfilesPath, resolveCredentialsDir, resolveOAuthPath } from "../config/paths.js";
 import { init_write_file_atomic, writeTextAtomic } from "../infra/write-file-atomic.js";
-import { getOAuthProviderDefinition, init_registry } from "./oauth/registry.js";
+import { init_paths, resolveAgentAuthProfilesPath, resolveAuthProfilesPath, resolveCredentialsDir, resolveOAuthPath } from "../config/paths.js";
 import { getApiKeyFromEnv, init_env_keys } from "../providers/env-keys.js";
+import { getOAuthProviderDefinition, init_registry } from "./oauth/registry.js";
 import { init_oauth_provider_lock, withOAuthProviderLock } from "./oauth-provider-lock.js";
 import { dirname, join } from "path";
 import { mkdir, readFile, readdir, rm } from "fs/promises";

package/dist/src/auth/oauth/xopc-cloud.js

@@ -1,6 +1,6 @@
 import { __esmMin } from "../../../_virtual/_rolldown/runtime.js";
-import { init_resolution, resolveConnectedPlatformEndpoint } from "../../platform/resolution.js";
 import { generatePKCE, init_pkce } from "./pkce.js";
+import { init_resolution, resolveConnectedPlatformEndpoint } from "../../platform/resolution.js";
 import { hostname } from "node:os";
 import { randomBytes } from "node:crypto";
 import http from "node:http";

package/dist/src/auth/profiles/store.js

@@ -1,5 +1,5 @@
-import { init_paths, resolveCredentialsDir } from "../../config/paths.js";
 import { init_write_file_atomic, writeTextAtomicSync } from "../../infra/write-file-atomic.js";
+import { init_paths, resolveCredentialsDir } from "../../config/paths.js";
 import path from "node:path";
 import { chmodSync, existsSync, mkdirSync, readFileSync } from "node:fs";
 //#region src/auth/profiles/store.ts

package/dist/src/auth/sync-provider-auth.js

@@ -1,8 +1,8 @@
 import { __esmMin } from "../../_virtual/_rolldown/runtime.js";
-import { getDefaultAgentId, init_resolve_route } from "../routing/resolve-route.js";
 import { init_paths, resolveAgentAuthProfilesPath, resolveAuthProfilesPath, resolveOAuthPath } from "../config/paths.js";
-import { init_loader, loadConfig } from "../config/loader.js";
 import { init_registry, isOAuthOnlyProvider } from "./oauth/registry.js";
+import { init_loader, loadConfig } from "../config/loader.js";
+import { getDefaultAgentId, init_resolve_route } from "../routing/resolve-route.js";
 import { existsSync, readFileSync } from "node:fs";
 //#region src/auth/sync-provider-auth.ts
 /**

package/dist/src/browser/providers/browser-ext-install.js

@@ -2,8 +2,8 @@ import { PACKAGE_VERSION, init_package_version } from "../../package-version.js"
 import { resolveStateDir } from "../../config/paths-state.js";
 import { createLogger } from "../../utils/logger/index.js";
 import { init_logger } from "../../utils/logger.js";
-import { init_paths, resolveBinDir, resolveConfigPath } from "../../config/paths.js";
 import { init_write_file_atomic, writeTextAtomic } from "../../infra/write-file-atomic.js";
+import { init_paths, resolveBinDir, resolveConfigPath } from "../../config/paths.js";
 import { assertCacheDir } from "../cache-dir-policy.js";
 import { BROWSER_EXTENSION_ID, BROWSER_NATIVE_HOST_NAME } from "../extension-identity.js";
 import "../native-messaging-host.js";

package/dist/src/cli/commands/doctor/checks/database-schema.js

@@ -52,7 +52,7 @@ async function checkDatabaseSchema(ctx) {
 		id: "database-schema",
 		label: "Database schema",
 		status: "pass",
-		message: `SQLite schema v${status.dbVersion} (current release v165).`,
+		message: `SQLite schema v${status.dbVersion} (current release v173).`,
 		hints: []
 	};
 }

package/dist/src/cli/commands/doctor/checks/provider-auth.js

@@ -1,8 +1,14 @@
 import { getAgentDefaultModelRef, init_schema, parseModelRef } from "../../../../config/schema.js";
+import { PROVIDER_ENV_MAP, init_env_keys } from "../../../../providers/env-keys.js";
+import { getModelOAuthProviderIds, init_registry } from "../../../../auth/oauth/registry.js";
+import { CredentialResolver, init_credentials } from "../../../../auth/credentials.js";
 import { init_loader, loadConfig } from "../../../../config/loader.js";
-import { PROVIDER_ENV_MAP, getApiKeyFromEnv, init_env_keys } from "../../../../providers/env-keys.js";
+import { getDefaultAgentId, init_resolve_route } from "../../../../routing/resolve-route.js";
 import { existsSync } from "node:fs";
 //#region src/cli/commands/doctor/checks/provider-auth.ts
+init_credentials();
+init_registry();
+init_resolve_route();
 init_loader();
 init_schema();
 init_env_keys();
@@ -30,14 +36,6 @@ function collectProviderIdsFromConfig(cfg) {
 	}
 	return ids;
 }
-function anyProviderEnvPresent() {
-	for (const vars of Object.values(PROVIDER_ENV_MAP)) for (const v of vars) if (process.env[v]?.trim()) return true;
-	for (const [k, val] of Object.entries(process.env)) {
-		if (!val?.trim()) continue;
-		if (k.endsWith("_API_KEY") || k.endsWith("_TOKEN")) return true;
-	}
-	return false;
-}
 async function checkProviderAuth(ctx) {
 	if (!existsSync(ctx.configPath)) return {
 		id: "provider-auth",
@@ -58,20 +56,23 @@ async function checkProviderAuth(ctx) {
 			hints: []
 		};
 	}
-	const fromConfig = collectProviderIdsFromConfig(cfg);
-	const checkIds = fromConfig.size > 0 ? [...fromConfig] : Object.keys(PROVIDER_ENV_MAP);
-	for (const id of checkIds) if (getApiKeyFromEnv(id)?.trim()) return {
-		id: "provider-auth",
-		label: "Provider auth",
-		status: "pass",
-		message: "At least one LLM provider API key is available.",
-		hints: []
-	};
-	if (anyProviderEnvPresent()) return {
+	const credentials = new CredentialResolver({
+		stateDir: ctx.stateDir,
+		agentId: getDefaultAgentId(cfg),
+		appConfig: cfg
+	});
+	const profiles = await credentials.listProfiles();
+	const checkIds = new Set([
+		...collectProviderIdsFromConfig(cfg),
+		...Object.keys(PROVIDER_ENV_MAP),
+		...getModelOAuthProviderIds(),
+		...profiles.map((profile) => profile.provider)
+	]);
+	for (const id of checkIds) if (await credentials.hasCredentials(id)) return {
 		id: "provider-auth",
 		label: "Provider auth",
 		status: "pass",
-		message: "Environment contains provider credentials.",
+		message: "At least one LLM provider credential is available.",
 		hints: []
 	};
 	return {

package/dist/src/cli/commands/models.js

@@ -1,6 +1,6 @@
 import { getAgentDefaultModelRef, init_schema } from "../../config/schema.js";
-import { loadConfig, saveConfig } from "../../config/loader.js";
 import { CredentialResolver, init_credentials } from "../../auth/credentials.js";
+import { loadConfig, saveConfig } from "../../config/loader.js";
 import { getAllModels, getAvailableModels, getConfiguredProviders, getProviderAuthState, getProviderDisplayName, init_providers, isProviderConfigured, providerSupportsApiKey, providerSupportsOAuth, resolveModel } from "../../providers/index.js";
 import { formatExamples, register } from "../registry.js";
 import { getContextWithOpts } from "../context.js";

package/dist/src/config/index.js

@@ -2,15 +2,15 @@ import { ENV_VARS, XOPC_DB_FILENAME, resolveHomeDir, resolveStateDir, resolveXop
 import { TelegramAccountConfigSchema, TelegramConfigSchema, TelegramGroupConfigSchema, TelegramTopicConfigSchema } from "../../extensions/telegram/src/config-schema.js";
 import { WeixinAccountConfigSchema, WeixinConfigSchema } from "../../extensions/weixin/src/config-schema.js";
 import { AgentImageGenerationModelSchema, AgentModelRefSchema, AgentModelsSchema, AgentsConfigSchema, BindingMatchSchema, BindingRuleSchema, BindingsConfigSchema, BrowserConfigSchema, ChannelsConfigSchema, CommandsConfigSchema, ConfigSchema, ConnectorsConfigSchema, ExperimentalConfigSchema, ExtensionSecurityConfigSchema, ExtensionSlotsConfigSchema, ExtensionsConfigSchema, GatewayAuthRateLimitSchema, GatewayAuthSchema, GatewayBindModeSchema, GatewayChannelConnectDeferModeSchema, GatewayConfigSchema, GatewayModeSchema, GatewayRemoteSchema, GatewaySecuritySchema, GatewayTailscaleConsentSchema, GatewayTailscaleSchema, GatewayTlsSchema, GatewayTrustedProxySchema, GatewayWebchatConfigSchema, HeartbeatConfigSchema, McpConfigSchema, McpOAuthConfigSchema, McpServerSchema, MediaUnderstandingCapabilitiesSchema, MediaUnderstandingModelSchema, MessagesConfigSchema, ModelCatalogConfigSchema, ModelsDevConfigSchema, ProviderAuthConfigSchema, ProviderAzureConfigSchema, ProviderRequestOverridesSchema, ProvidersConfigSchema, RuntimeToolsConfigSchema, STTConfigSchema, STTFallbackConfigSchema, STTProviderConfigSchema, SearchProviderEntrySchema, SessionConfigSchema, SessionDmScopeSchema, SessionResetByTypeSchema, SessionResetConfigSchema, SessionResetModeSchema, SessionScopeSchema, SessionStorageConfigSchema, TTSConfigSchema, TTSEdgeConfigSchema, TTSFallbackConfigSchema, TTSModelOverridesConfigSchema, TTSProviderConfigSchema, TTSSummarizationConfigSchema, ToolsConfigSchema, ToolsMediaAudioConfigSchema, ToolsMediaConfigSchema, TuiConfigSchema, TunnelConfigSchema, TunnelConsentSchema, UpdateAutoConfigSchema, UpdateConfigSchema, VoiceConfigSchema, VoiceRefinementConfigSchema, WebSearchConfigSchema, WebToolsConfigSchema, WebsiteBlocklistSchema, WorkspaceConfigSchema, WorkspaceImportConfigSchema, getAgentDefaultImageGenerationModelConfig, getAgentDefaultImageModelConfig, getAgentDefaultModelRef, init_schema, parseModelRef } from "./schema.js";
-import { applyConfigOverrides, getConfigOverrides, resetConfigOverrides, setConfigOverride, unsetConfigOverride } from "./runtime-overrides.js";
+import { clearConfigValueCache, getAllowedCommands, getCacheStats, init_resolve_config_value, resolveConfigValue, resolveHeaders, testApiKeyResolution } from "./resolve-config-value.js";
 import { expandWorkspacePathString, init_workspace_path, normalizeWorkspaceDir, resolveWorkspaceRoot } from "./workspace-path.js";
 import { resolveDefaultAgentWorkspaceDir } from "./workspace-defaults.js";
 import { resolveAgentDir as resolveAgentDir$1, resolveAgentHomeDir as resolveAgentHomeDir$1, resolveAgentWorkspaceDir } from "../agent/agent-scope.js";
-import { extractProfileAgentId, resolveEffectiveAgentConfigForAgent, resolveEffectiveAgentConfigForSession, resolveEffectiveAgentProfile, resolveEffectiveAgentProfileForSession } from "./agent-profile.js";
 import { FILENAMES, WORKSPACE_FILES, existsSync, hasBundledExtensionManifest, init_paths, resolveAgentAuthProfilesPath, resolveAgentDir, resolveAgentHomeDir, resolveAgentProfileDir, resolveAgentProfileMarkdownPath, resolveAuthProfilesPath, resolveBinDir, resolveBundledExtensionsDir, resolveBundledSkillsDir, resolveConfigPath, resolveCredentialsDir, resolveExtensionSdkPath, resolveExtensionsDir, resolveExtensionsLockPath, resolveInboxDir, resolveInboxMessagePath, resolveInboxPendingDir, resolveInboxProcessedDir, resolveLogPath, resolveLogsDir, resolveMcpOAuthPath, resolveModelsJsonPath, resolveNodeBinDir, resolveNodeBinPath, resolveNodeToolsDir, resolveNpmBinPath, resolveOAuthPath, resolvePidPath, resolveSkillPath, resolveSkillsCachePath, resolveSkillsDir, resolveSkillsLockPath, resolveSocketPath, resolveStatusPath, resolveToolsDir, resolveWorkspaceExtensionsDir, resolveWorkspaceFile, resolveWorkspaceStateDir, resolveWorkspaceStatePath, resolveXopcBinPath } from "./paths.js";
-import { init_loader, loadConfig, saveConfig } from "./loader.js";
-import { clearConfigValueCache, getAllowedCommands, getCacheStats, init_resolve_config_value, resolveConfigValue, resolveHeaders, testApiKeyResolution } from "./resolve-config-value.js";
 import { CustomModelSchema, ImageGenerationCapabilitiesSchema, ImageGenerationModelSchema, ImageGenerationProviderSchema, ModelOverrideSchema, ModelsJsonSchema, OpenAICompatSchema, OpenAICompletionsCompatSchema, OpenAIResponsesCompatSchema, OpenRouterRoutingSchema, ProviderConfigSchema, VercelGatewayRoutingSchema, getDefaultModelValues, init_models_json, loadModelsJson, modelsJsonExists, saveModelsJson, validateModelsConfig } from "./models-json.js";
+import { init_loader, loadConfig, saveConfig } from "./loader.js";
+import { applyConfigOverrides, getConfigOverrides, resetConfigOverrides, setConfigOverride, unsetConfigOverride } from "./runtime-overrides.js";
+import { extractProfileAgentId, resolveEffectiveAgentConfigForAgent, resolveEffectiveAgentConfigForSession, resolveEffectiveAgentProfile, resolveEffectiveAgentProfileForSession } from "./agent-profile.js";
 import { canonicalizeConfiguredMcpServer, isKnownCliMcpTypeAlias, normalizeConfiguredMcpServers, resolveXopcMcpTransportAlias } from "./mcp-config-normalize.js";
 import { formatThinkingLevels, listThinkingLevels, normalizeElevatedMode, normalizeReasoningLevel, normalizeThinkLevel, normalizeVerboseLevel, thinkLevelToNumber } from "../agent/transcript/thinking-types.js";
 import { getWorkspacePath } from "./workspace-path-helpers.js";

package/dist/src/config/loader.js

@@ -2,10 +2,10 @@ import { __esmMin } from "../../_virtual/_rolldown/runtime.js";
 import { createLogger } from "../utils/logger/index.js";
 import { init_logger } from "../utils/logger.js";
 import { ConfigSchema, init_schema } from "./schema.js";
-import { init_paths, resolveConfigPath } from "./paths.js";
 import { init_write_file_atomic, writeTextAtomic } from "../infra/write-file-atomic.js";
-import { assertChannelPluginConfigs, init_validate_channel_configs } from "./validate-channel-configs.js";
+import { init_paths, resolveConfigPath } from "./paths.js";
 import { init_resolution, setActivePlatformDiscovery } from "../platform/resolution.js";
+import { assertChannelPluginConfigs, init_validate_channel_configs } from "./validate-channel-configs.js";
 import { dirname } from "path";
 import { existsSync, mkdirSync, promises, readFileSync } from "fs";
 import { config } from "dotenv";

package/dist/src/config/models-json.js

@@ -1,6 +1,6 @@
 import { __esmMin } from "../../_virtual/_rolldown/runtime.js";
-import { init_paths, resolveModelsJsonPath } from "./paths.js";
 import { init_write_file_atomic, writeTextAtomicSync } from "../infra/write-file-atomic.js";
+import { init_paths, resolveModelsJsonPath } from "./paths.js";
 import { existsSync, readFileSync } from "fs";
 import { z } from "zod";
 //#region src/config/models-json.ts

package/dist/src/config/schema.d.ts

@@ -106,6 +106,10 @@ export declare const AgentsConfigSchema: z.ZodDefault<z.ZodObject<{
                 mode: z.ZodLiteral<"docker">;
                 image: z.ZodString;
                 network: z.ZodDefault<z.ZodBoolean>;
+                workspaceAccess: z.ZodDefault<z.ZodEnum<{
+                    "read-only": "read-only";
+                    "read-write": "read-write";
+                }>>;
             }, z.core.$strict>], "mode">>;
             maxTurns: z.ZodOptional<z.ZodNumber>;
             timeoutMs: z.ZodOptional<z.ZodNumber>;
@@ -185,6 +189,10 @@ export declare const AgentsConfigSchema: z.ZodDefault<z.ZodObject<{
                 mode: z.ZodLiteral<"docker">;
                 image: z.ZodString;
                 network: z.ZodDefault<z.ZodBoolean>;
+                workspaceAccess: z.ZodDefault<z.ZodEnum<{
+                    "read-only": "read-only";
+                    "read-write": "read-write";
+                }>>;
             }, z.core.$strict>], "mode">>;
             maxTurns: z.ZodOptional<z.ZodNumber>;
             timeoutMs: z.ZodOptional<z.ZodNumber>;
@@ -1582,6 +1590,10 @@ export declare const ConfigSchema: z.ZodDefault<z.ZodObject<{
                     mode: z.ZodLiteral<"docker">;
                     image: z.ZodString;
                     network: z.ZodDefault<z.ZodBoolean>;
+                    workspaceAccess: z.ZodDefault<z.ZodEnum<{
+                        "read-only": "read-only";
+                        "read-write": "read-write";
+                    }>>;
                 }, z.core.$strict>], "mode">>;
                 maxTurns: z.ZodOptional<z.ZodNumber>;
                 timeoutMs: z.ZodOptional<z.ZodNumber>;
@@ -1661,6 +1673,10 @@ export declare const ConfigSchema: z.ZodDefault<z.ZodObject<{
                     mode: z.ZodLiteral<"docker">;
                     image: z.ZodString;
                     network: z.ZodDefault<z.ZodBoolean>;
+                    workspaceAccess: z.ZodDefault<z.ZodEnum<{
+                        "read-only": "read-only";
+                        "read-write": "read-write";
+                    }>>;
                 }, z.core.$strict>], "mode">>;
                 maxTurns: z.ZodOptional<z.ZodNumber>;
                 timeoutMs: z.ZodOptional<z.ZodNumber>;

package/dist/src/discussions/action-tasks.d.ts

@@ -0,0 +1,21 @@
+export declare function meetingActionTasks(id: string): {
+    actionId: string;
+    taskId: string;
+    phase: "backlog" | "ready" | "active" | "review" | "closed";
+    resolution: "cancelled" | "done" | "duplicate" | "wont_do";
+    deleted: boolean;
+}[];
+/** Task, contract, source context, outbox and conversion link commit together. */
+export declare function convertMeetingAction(id: string, actionId: string, organizationRevision: number): {
+    existing: boolean;
+    actionId: string;
+    taskId: string;
+    phase: "backlog" | "ready" | "active" | "review" | "closed";
+    resolution: "cancelled" | "done" | "duplicate" | "wont_do";
+    deleted: boolean;
+} | {
+    actionId: string;
+    taskId: string;
+    existing: boolean;
+    deleted: boolean;
+};