@xopcai/xopc 0.0.325 → 0.0.330

package/dist/src/agent/mcp/mcp-transport.js

@@ -2,13 +2,13 @@ import { init_paths_state, resolveStateDir } from "../../config/paths-state.js";
 import { createLogger } from "../../utils/logger/index.js";
 import { init_logger } from "../../utils/logger.js";
 import { init_string_coerce, normalizeOptionalString } from "../../utils/string-coerce.js";
-import { McpOAuthStore } from "./oauth/mcp-oauth-store.js";
-import { pluginOAuthScope } from "../../extensions/agent-plugins/auth.js";
 import { buildRuntimeEnvironment, resolveRuntimeCommand } from "../../runtime-tools/environment.js";
 import { XopcStdioClientTransport } from "./mcp-stdio-transport.js";
 import { resolveMcpTransportConfig } from "./mcp-transport-config.js";
+import { McpOAuthStore } from "./oauth/mcp-oauth-store.js";
 import { XopcMcpOAuthClientProvider } from "./oauth/mcp-oauth-provider.js";
 import { createPluginHttpFetch } from "./plugin-http-fetch.js";
+import { pluginOAuthScope } from "../../extensions/agent-plugins/plugin-oauth-scope.js";
 import { SSEClientTransport } from "@modelcontextprotocol/sdk/client/sse.js";
 import { StreamableHTTPClientTransport } from "@modelcontextprotocol/sdk/client/streamableHttp.js";
 import { getDefaultEnvironment } from "@modelcontextprotocol/sdk/client/stdio.js";

package/dist/src/agent/mcp/oauth/index.js

@@ -1,5 +1,5 @@
-import { McpOAuthStore, canonicalMcpServerUrl, mcpOAuthServerKey } from "./mcp-oauth-store.js";
 import { McpAuthorizationRequiredError, isMcpAuthorizationError } from "./mcp-oauth-errors.js";
+import { McpOAuthStore, canonicalMcpServerUrl, mcpOAuthServerKey } from "./mcp-oauth-store.js";
 import { XopcMcpOAuthClientProvider } from "./mcp-oauth-provider.js";
 import { McpOAuthSession } from "./mcp-oauth-session.js";
 import { McpOAuthManager, getMcpOAuthManager } from "./mcp-oauth-manager.js";

package/dist/src/agent/mcp/oauth/mcp-oauth-manager.js

@@ -4,11 +4,11 @@ import { init_global_singleton, resolveGlobalSingleton } from "../../../utils/gl
 import { resolveConnectorSecretReferences } from "../../../connectors/secret-store.js";
 import { recordPluginMcpHealth } from "../../../extensions/agent-plugins/health.js";
 import { redactSensitiveUrlLikeString } from "../../../utils/redact-sensitive-url.js";
-import { McpOAuthStore, canonicalMcpServerUrl } from "./mcp-oauth-store.js";
-import { pluginOAuthScope } from "../../../extensions/agent-plugins/auth.js";
 import { resolveMcpTransportConfig } from "../mcp-transport-config.js";
 import { isMcpAuthorizationError } from "./mcp-oauth-errors.js";
+import { McpOAuthStore, canonicalMcpServerUrl } from "./mcp-oauth-store.js";
 import { XopcMcpOAuthClientProvider } from "./mcp-oauth-provider.js";
+import { pluginOAuthScope } from "../../../extensions/agent-plugins/plugin-oauth-scope.js";
 import { resolveMcpTransport } from "../mcp-transport.js";
 import { disposeAllSessionMcpRuntimes } from "../bundle-mcp-runtime.js";
 import { McpOAuthSession } from "./mcp-oauth-session.js";

package/dist/src/agent/mcp/oauth/mcp-oauth-provider.js

@@ -1,5 +1,5 @@
-import { McpOAuthStore } from "./mcp-oauth-store.js";
 import { McpAuthorizationRequiredError } from "./mcp-oauth-errors.js";
+import { McpOAuthStore } from "./mcp-oauth-store.js";
 //#region src/agent/mcp/oauth/mcp-oauth-provider.ts
 var XopcMcpOAuthClientProvider = class {
 	store;

package/dist/src/agent/orchestration/agent-orchestrator.js

@@ -117,7 +117,7 @@ var AgentOrchestrator = class {
 					clearPendingTranscriptUserMessage(conversationId, userMessage);
 				}
 			})();
-			await this.agentManager.afterAgentTurn(conversationId, userPlainForMemory, turnId);
+			this.agentManager.scheduleUserUnderstandingMaintenance(conversationId, userPlainForMemory, turnId);
 			this.agentManager.scheduleBackgroundReviewAfterUserTurn(conversationId);
 			if (turnResult.ok) {
 				this.onEmbeddedTurnComplete?.(conversationId, turnResult.lastAssistantText);

package/dist/src/agent/orchestration/llm-turn-retry.js

@@ -1,21 +1,8 @@
+import { isTransientProviderErrorMessage } from "../../providers/model-response.js";
 import { isContextOverflowError } from "./context-overflow.js";
 //#region src/agent/orchestration/llm-turn-retry.ts
-const TRANSIENT_LLM_ERROR_SUBSTRINGS = [
-	"fetch failed",
-	"econnreset",
-	"econnrefused",
-	"enotfound",
-	"socket hang up",
-	"getaddrinfo",
-	"networkerror",
-	"etimedout",
-	"certificate",
-	"ssl",
-	"tls"
-];
 function isTransientLlmErrorMessage(message) {
-	const lower = message.toLowerCase();
-	return TRANSIENT_LLM_ERROR_SUBSTRINGS.some((s) => lower.includes(s));
+	return isTransientProviderErrorMessage(message);
 }
 function classifyLlmFailure(message) {
 	const normalized = message.trim().toLowerCase();

package/dist/src/agent/prompt/sections/tooling.js

@@ -128,6 +128,7 @@ function buildToolingSection(params) {
 	const hasExec = availableTools.has("exec_command");
 	const hasPlan = availableTools.has("update_plan");
 	const hasPublishArtifacts = availableTools.has("publish_artifacts");
+	const hasXopcUse = availableTools.has("xopc_use");
 	const orchestrationLines = [];
 	if (hasDelegate) orchestrationLines.push("- Sub-agent delegation → use `delegate_task(goal, context?, mode?, capabilities?, toolset?)`. Default research inherits available read capabilities; pass necessary context explicitly. Use implement for isolated worktree changes. Check rejectedTools and partial results before relying on the answer.");
 	if (hasWorkflow) orchestrationLines.push("- Multi-phase workflows → use `workflow` to start persisted runs with subagents when a script defines phases.");
@@ -141,6 +142,8 @@ function buildToolingSection(params) {
 		hasRead ? `Use \`${readToolName}\` for targeted file inspection before editing; do not rely on filenames alone.` : "",
 		hasPatch ? `Use \`${patchToolName}\` for source changes; keep patches focused and inspect failures carefully.` : "",
 		hasWrite ? `Use \`${writeToolName}\` only for new files or intentional complete rewrites.` : "",
+		hasXopcUse && hasRead && hasWrite ? `When the user explicitly asks to change or customize the current agent's name, identity, personality, instructions, working style, tools, workspace, or heartbeat, persist the change instead of only drafting advice. Inspect the current state first; use \`${readToolName}\` and \`${writeToolName}\` for the current agent's profile Markdown, and use \`xopc_use\` mode \`agent\` for structured settings. Target only the current runtime agent unless the user names another one, verify the saved result, and ask before consequential capability or scope expansion when intent is ambiguous.` : "",
+		hasXopcUse ? "When the user explicitly asks to create an Agent, use `xopc_use` mode `agent`: list first, create the Agent without a Project or custom workspace unless the user requests one, verify the result, and clearly identify the created Agent so the user can open its own conversation for further customization." : "",
 		hasGrep || hasFind ? `Use ${[hasGrep ? `\`${grepToolName}\`` : "", hasFind ? `\`${findToolName}\`` : ""].filter(Boolean).join(" and ")} for text/file discovery; use code graph or symbol tools when available for definitions and call relationships.` : "",
 		hasExec ? `Use \`${execToolName}\` for verification and safe inspection, not routine file editing.` : "",
 		hasWrite || hasExec ? "When delivering a user-facing workspace file, include a clickable Markdown link in the final response using `xopc://workspace/file?path=<workspace-relative-path>`; URL-encode spaces and special characters, and do not invent an HTTP or `file://` URL." : "",

package/dist/src/agent/service/direct-turn-helpers.js

@@ -127,7 +127,7 @@ async function runDirectAgentTurn(deps, input) {
 		beforeTurn: isResume ? void 0 : () => deps.agentManager.beginBackgroundReviewUserTurn(input.conversationId),
 		onEvent: input.onEvent
 	});
-	if (!isResume) await deps.agentManager.afterAgentTurn(input.conversationId, userPlain, turnId);
+	if (!isResume) deps.agentManager.scheduleUserUnderstandingMaintenance(input.conversationId, userPlain, turnId);
 	if (!isResume && result.stopReason !== "connection_required" && result.stopReason !== "clarification_required") deps.agentManager.scheduleBackgroundReviewAfterUserTurn(input.conversationId);
 	return result;
 }

package/dist/src/agent/service.d.ts

@@ -112,6 +112,7 @@ export declare class AgentService {
     setWorkspaceTrust(workspacePath: string, trusted: boolean): WorkspaceTrustState;
     getCapabilityCatalog(conversationId?: string): AgentCapabilityCatalogEntry[];
     getSkillMarkdownSource(skillName: string): SkillMarkdownPreviewPayload | null;
+    getWorkflowSkillInstructions(agentId: string, names: readonly string[]): string | undefined;
     refreshSkillsAfterDiskChange(): void;
     refreshSkillsAfterTrustChange(): void;
     installSkillFromSource(opts: SkillInstallToolOptions): Promise<SkillInstallToolResult>;

package/dist/src/agent/service.js

@@ -1,13 +1,13 @@
 import { createLogger } from "../utils/logger/index.js";
 import { init_logger } from "../utils/logger.js";
 import { init_attachment_ref, parseNoteAttachmentTarget } from "../notes/attachment-ref.js";
-import { init_agent_scope, resolveAgentHomeDir, resolveDefaultAgentId } from "./agent-scope.js";
-import { extractTextContent } from "./context/workspace.js";
 import { getAgentDefaultModelRef, init_schema } from "../config/schema.js";
 import { applyConfigOverrides } from "../config/runtime-overrides.js";
+import { init_agent_scope, resolveAgentHomeDir, resolveDefaultAgentId } from "./agent-scope.js";
 import { init_agent_session_key, resolveAgentIdFromConversationId } from "../routing/agent-session-key.js";
 import { extractProfileAgentId } from "../config/agent-profile.js";
 import { init_providers, resolveModel } from "../providers/index.js";
+import { extractTextContent } from "./context/workspace.js";
 import { effectiveWorkspacePathForSession } from "../session/session-workspace.js";
 import { getProjectForSession } from "../projects/workspace.js";
 import { runWithEmbeddedExecutionSession } from "./embedded/execution-context.js";
@@ -524,6 +524,9 @@ var AgentService = class {
 	getSkillMarkdownSource(skillName) {
 		return this.agentManager.getSkillMarkdownSource(skillName);
 	}
+	getWorkflowSkillInstructions(agentId, names) {
+		return this.agentManager.getWorkflowSkillInstructions(agentId, names);
+	}
 	refreshSkillsAfterDiskChange() {
 		this.agentManager.refreshSkillsAfterDiskChange();
 	}

package/dist/src/agent/skills/marketplace/adapters/store/store-api-client.d.ts

@@ -51,6 +51,10 @@ export interface SkillsStorePackageListItem {
     stars?: number;
     /** Short provenance label for the row (e.g. ClawHub). */
     sourceLabel?: string;
+    branding?: {
+        iconUrl: string;
+        iconSha256: string;
+    };
     /** Published Connector V1 manifest, present for Store connector listings. */
     connectorManifest?: unknown;
 }
@@ -88,6 +92,10 @@ export interface MarketplacePackageDetail {
     name: string;
     type: string;
     description: string;
+    branding?: {
+        iconUrl: string;
+        iconSha256: string;
+    };
     readme: string | null;
     downloads: number;
     author: {
@@ -105,6 +113,10 @@ export interface StoreConnectorPackageDetail {
     name: string;
     type: 'connector';
     description: string;
+    branding?: {
+        iconUrl: string;
+        iconSha256: string;
+    };
     latestVersion: {
         version: string;
         manifest: unknown;

package/dist/src/agent/tasks/task-judge-service.js

@@ -8,8 +8,8 @@ import { getApiKey, init_providers, resolveModel } from "../../providers/index.j
 import { TaskConversationRepository } from "../../tasks/task-conversation-repository.js";
 import { readWorkspaceRevision } from "../coding/workspace-revision.js";
 import { completeWithResolvedCredentials } from "../../providers/model-call.js";
-import { TaskApplicationService } from "../../tasks/task-application-service.js";
 import { extractAssistantText, getAssistantMessageErrorReason, stripCodeFences } from "../../providers/model-response.js";
+import { TaskApplicationService } from "../../tasks/task-application-service.js";
 //#region src/agent/tasks/task-judge-service.ts
 init_schema();
 init_providers();

package/dist/src/agent/tools/factory.js

@@ -46,6 +46,8 @@ import "../../browser/index.js";
 import { getPendingTranscriptUserText } from "../inbound/attachment-pipeline.js";
 import { createDelegateTool } from "./delegate-tool.js";
 import { createWorkflowTool } from "./workflow-tool.js";
+import { createWorkflowCatalog } from "../workflow/catalog.js";
+import { createWorkflowManageTool } from "./workflow-manage-tool.js";
 import { createAutomationTool } from "./automation-tool.js";
 import { createBrowserAutomationTool } from "./browser-automation-tool.js";
 import { createXopcUseTool } from "./xopc-use-tool.js";
@@ -66,7 +68,6 @@ import { createComputerUseTool } from "./computer-use-tool.js";
 import { createReviewWorkspaceTool } from "./review-workspace.js";
 import { createLanguageDiagnosticsTool } from "./language-diagnostics.js";
 import { createDelegationParentPolicy } from "./delegation-parent-policy.js";
-import { createWorkflowCatalog } from "../workflow/catalog.js";
 import { mergeTtsConfigFromAppConfig } from "../../voice/tts/merge-config.js";
 import { createTextToSpeechTool } from "./tts-tool.js";
 import { getAgentCapabilityToolNames } from "../capabilities/registry.js";
@@ -464,7 +465,7 @@ var AgentToolsFactory = class AgentToolsFactory {
 				getTaskId: () => options?.conversationId ?? this.deps.getCurrentContext()?.conversationId ?? "default",
 				getReadiness: () => this.checkBrowserReadinessCached()
 			})] : [],
-			...primary ? [createWorkflowTool({
+			...primary ? [createWorkflowManageTool(), createWorkflowTool({
 				catalog: createWorkflowCatalog(),
 				getCurrentConversationId: () => this.deps.getCurrentContext()?.conversationId,
 				getConfig: () => this.deps.getConfig?.(),

package/dist/src/agent/tools/index.d.ts

@@ -27,6 +27,7 @@ export { createClarifyTool, type ClarifyRequestPayload, type GatewayClarifyReque
 export { BrowserRuntime, assertBrowserUrlAllowed } from '../../browser/index.js';
 export { createDelegateTool, DEFAULT_DELEGATE_TOOLS, DELEGATE_BLOCKED_TOOLS, } from './delegate-tool.js';
 export { createWorkflowTool, type WorkflowToolDeps, type WorkflowToolInput } from './workflow-tool.js';
+export { createWorkflowManageTool } from './workflow-manage-tool.js';
 export { createAutomationTool, type AutomationToolDeps } from './automation-tool.js';
 export { createBrowserAutomationTool } from './browser-automation-tool.js';
 export { createXopcUseTool, type XopcUseToolDeps, type XopcUseToolInput } from './xopc-use-tool.js';

package/dist/src/agent/tools/index.js

@@ -32,6 +32,7 @@ import "../../browser/index.js";
 import { resolveImageModelConfigForTool } from "../image/tool-model-config.js";
 import { DEFAULT_DELEGATE_TOOLS, DELEGATE_BLOCKED_TOOLS, createDelegateTool } from "./delegate-tool.js";
 import { createWorkflowTool } from "./workflow-tool.js";
+import { createWorkflowManageTool } from "./workflow-manage-tool.js";
 import { createAutomationTool } from "./automation-tool.js";
 import { createBrowserAutomationTool } from "./browser-automation-tool.js";
 import { createXopcUseTool } from "./xopc-use-tool.js";
@@ -44,4 +45,4 @@ import { createDesktopPetTool } from "./desktop-pet-tool.js";
 import { createManagedJobTool } from "./managed-job-tool.js";
 import { createImageTool } from "./image-tool.js";
 import { createImageGenerateTool, resolveImageGenerationModelConfigForTool } from "./image-generate-tool.js";
-export { BrowserRuntime, DEFAULT_DELEGATE_TOOLS, DEFAULT_MAX_BYTES, DEFAULT_MAX_LINES, DEFAULT_TOOL_METADATA, DEFAULT_WEB_EXTRACT_MAX_LENGTH, DELEGATE_BLOCKED_TOOLS, GREP_MAX_LINE_LENGTH, MAX_RAW_HTML_CHARS_FOR_WEB_EXTRACT, TodoStore, ToolConcurrencyController, assertBrowserUrlAllowed, createApplyPatchTool, createAutomationTool, createBrowserAutomationTool, createClarifyTool, createCreateShareTool, createDataBatchTool, createDelegateTool, createDesktopPetTool, createExecCommandTool, createFindTool, createGrepTool, createImageGenerateTool, createImageTool, createKnowledgeGetTool, createKnowledgeSearchTool, createKnowledgeWriteTool, createListDirTool, createManagedJobTool, createMemoryMaintenanceTool, createMessageTool, createPublishArtifactsTool, createReadFileTool, createReadMediaTool, createSendMediaTool, createSessionRecallTool, createSessionSearchTool, createSessionStatusTool, createSkillInstallTool, createSkillManageTool, createSkillViewTool, createSkillsListTool, createSkillsMarketplaceSearchTool, createTodoTool, createToolManualTool, createUpdatePlanTool, createUserContextGetTool, createUserContextSearchTool, createUserContextUpdateTool, createWebExtractTool, createWebFetchTool, createWebSearchTool, createWorkflowTool, createWriteFileTool, createXopcUseTool, findTool, formatSize, fuzzyFindText, generateDiffString, getToolMetadata, grepTool, isShareToolAvailable, listDirTool, normalizeForFuzzyMatch, normalizeToLF, resolveImageGenerationModelConfigForTool, resolveImageModelConfigForTool, resolveToolLockMode, restoreLineEndings, stripBom, stripHtmlBoilerplate, truncateHead, truncateLine, truncateTail, writeFileTool };
+export { BrowserRuntime, DEFAULT_DELEGATE_TOOLS, DEFAULT_MAX_BYTES, DEFAULT_MAX_LINES, DEFAULT_TOOL_METADATA, DEFAULT_WEB_EXTRACT_MAX_LENGTH, DELEGATE_BLOCKED_TOOLS, GREP_MAX_LINE_LENGTH, MAX_RAW_HTML_CHARS_FOR_WEB_EXTRACT, TodoStore, ToolConcurrencyController, assertBrowserUrlAllowed, createApplyPatchTool, createAutomationTool, createBrowserAutomationTool, createClarifyTool, createCreateShareTool, createDataBatchTool, createDelegateTool, createDesktopPetTool, createExecCommandTool, createFindTool, createGrepTool, createImageGenerateTool, createImageTool, createKnowledgeGetTool, createKnowledgeSearchTool, createKnowledgeWriteTool, createListDirTool, createManagedJobTool, createMemoryMaintenanceTool, createMessageTool, createPublishArtifactsTool, createReadFileTool, createReadMediaTool, createSendMediaTool, createSessionRecallTool, createSessionSearchTool, createSessionStatusTool, createSkillInstallTool, createSkillManageTool, createSkillViewTool, createSkillsListTool, createSkillsMarketplaceSearchTool, createTodoTool, createToolManualTool, createUpdatePlanTool, createUserContextGetTool, createUserContextSearchTool, createUserContextUpdateTool, createWebExtractTool, createWebFetchTool, createWebSearchTool, createWorkflowManageTool, createWorkflowTool, createWriteFileTool, createXopcUseTool, findTool, formatSize, fuzzyFindText, generateDiffString, getToolMetadata, grepTool, isShareToolAvailable, listDirTool, normalizeForFuzzyMatch, normalizeToLF, resolveImageGenerationModelConfigForTool, resolveImageModelConfigForTool, resolveToolLockMode, restoreLineEndings, stripBom, stripHtmlBoilerplate, truncateHead, truncateLine, truncateTail, writeFileTool };

package/dist/src/agent/tools/user-context-tool.js

@@ -1,5 +1,5 @@
 import { retrievalLexicalSimilarity } from "../../retrieval/textFeatures.js";
-import { deleteUserAssertion, getAssertionSlot, getUserAssertion, listUserAssertions, reconcileAssertion, setAssertionStatus } from "../../user-model/repository.js";
+import { deleteUserAssertion, getAssertionSlot, getUserAssertion, listUserAssertionSources, listUserAssertions, reconcileAssertion, setAssertionStatus } from "../../user-model/repository.js";
 import { canUseAssertion } from "../../user-model/usage-policy.js";
 import "../../user-model/index.js";
 import { Type } from "@sinclair/typebox";
@@ -49,7 +49,10 @@ function createUserContextSearchTool(options) {
 			const results = listUserAssertions({
 				statuses: ["active", "candidate"],
 				limit: 1e3
-			}).filter((assertion) => visible(options, assertion.slotId)).filter((item) => canUseAssertion(item)).map((assertion) => ({
+			}).filter((assertion) => visible(options, assertion.slotId)).filter((item) => canUseAssertion(item, Date.now(), {
+				use: "answer",
+				agentId: options.agentId
+			})).map((assertion) => ({
 				assertion,
 				score: retrievalLexicalSimilarity(input.query, `${assertion.statement} ${assertion.normalizedValue}`)
 			})).filter((item) => item.score > 0).sort((left, right) => right.score - left.score).slice(0, input.maxResults ?? 12).map(({ assertion, score }) => ({
@@ -58,6 +61,14 @@ function createUserContextSearchTool(options) {
 				statement: assertion.statement,
 				status: assertion.status,
 				authority: assertion.authority,
+				domain: assertion.domain,
+				layer: assertion.layer,
+				confidence: assertion.confidence,
+				evidence: {
+					supportCount: assertion.supportCount,
+					independentSourceCount: assertion.independentSourceCount,
+					lastSupportedAt: assertion.lastSupportedAt
+				},
 				score
 			}));
 			return {
@@ -86,7 +97,10 @@ function createUserContextGetTool(options) {
 			};
 			const id = raw.id;
 			const assertion = getUserAssertion(id);
-			if (!assertion || !visible(options, assertion.slotId) || !canUseAssertion(assertion)) return {
+			if (!assertion || !visible(options, assertion.slotId) || !canUseAssertion(assertion, Date.now(), {
+				use: "answer",
+				agentId: options.agentId
+			})) return {
 				content: [{
 					type: "text",
 					text: `User assertion not found: ${id}`
@@ -95,7 +109,8 @@ function createUserContextGetTool(options) {
 			};
 			const result = {
 				assertion,
-				slot: getAssertionSlot(assertion.slotId)
+				slot: getAssertionSlot(assertion.slotId),
+				sources: listUserAssertionSources([assertion.id]).get(assertion.id) ?? []
 			};
 			return {
 				content: [{
@@ -180,7 +195,17 @@ function createUserContextUpdateTool(options) {
 							volatility: current.volatility,
 							sensitivity: current.sensitivity,
 							disclosurePolicy: current.disclosurePolicy,
+							domain: current.domain,
+							layer: current.layer,
+							sensitivityCategories: current.sensitivityCategories,
+							purposeIds: current.purposeIds,
+							allowedUses: current.allowedUses,
+							allowedAgentIds: current.allowedAgentIds,
+							deleteAfter: current.deleteAfter,
 							applicability: current.applicability,
+							...current.validFrom === void 0 ? {} : { validFrom: current.validFrom },
+							...current.validTo === void 0 ? {} : { validTo: current.validTo },
+							...current.reviewAt === void 0 ? {} : { reviewAt: current.reviewAt },
 							observedAt: Date.now(),
 							createdBy: "user",
 							correctionOfAssertionId: current.id

package/dist/src/agent/tools/workflow-manage-tool.d.ts

@@ -0,0 +1,2 @@
+import type { AgentTool } from '@earendil-works/pi-agent-core';
+export declare function createWorkflowManageTool(): AgentTool;

package/dist/src/agent/tools/workflow-manage-tool.js

@@ -0,0 +1,225 @@
+import { appendProductDeliveryText } from "../../../packages/gateway-contract/src/product-delivery.js";
+import { init_src } from "../../../packages/gateway-contract/src/index.js";
+import { validateWorkflowDefinitionInput } from "../../workflows/domain/validation.js";
+import { WorkflowNameConflictError, WorkflowRevisionConflictError, createWorkflowCatalog } from "../workflow/catalog.js";
+import "../../workflows/domain/index.js";
+import { WorkflowDraftConflictError, WorkflowDraftStore } from "../../workflows/authoring/workflow-draft-store.js";
+import { createStarterWorkflowGraph, createStarterWorkflowManifest } from "../../workflows/authoring/workflow-draft-defaults.js";
+import "../../workflows/authoring/index.js";
+import { Type } from "@sinclair/typebox";
+//#region src/agent/tools/workflow-manage-tool.ts
+init_src();
+const WorkflowManageSchema = Type.Object({
+	action: Type.Union([
+		Type.Literal("list"),
+		Type.Literal("open_draft"),
+		Type.Literal("get_draft"),
+		Type.Literal("replace_draft"),
+		Type.Literal("validate_draft"),
+		Type.Literal("publish_draft")
+	]),
+	workflowName: Type.Optional(Type.String({ description: "Saved or new lowercase snake_case workflow name." })),
+	draftId: Type.Optional(Type.String({ description: "Draft id returned by open_draft." })),
+	graph: Type.Optional(Type.Any({ description: "Complete workflow graph for replace_draft." })),
+	manifest: Type.Optional(Type.Any({ description: "Complete workflow manifest for replace_draft." })),
+	expectedUpdatedAtMs: Type.Optional(Type.Number({ description: "Latest draft updatedAtMs; required for replace_draft and publish_draft." })),
+	confirmed: Type.Optional(Type.Boolean({ description: "Must be true for publish_draft after the user explicitly confirms this draft." }))
+});
+function createWorkflowManageTool() {
+	const store = new WorkflowDraftStore();
+	return {
+		name: "workflow_manage",
+		label: "◆ Workflow builder",
+		description: "Create and edit saved workflows through durable validated drafts. Use list/open/get/replace/validate, then publish only after user confirmation.",
+		parameters: WorkflowManageSchema,
+		async execute(_toolCallId, input) {
+			try {
+				if (input.action === "list") return listWorkflows();
+				if (input.action === "open_draft") return openDraft(store, input.workflowName);
+				const draft = requireDraft(store, input.draftId);
+				if (input.action === "get_draft") return success(JSON.stringify(draft, null, 2), { draft });
+				if (input.action === "validate_draft") return validateDraft(draft);
+				if (input.action === "replace_draft") return replaceDraft(store, draft, input);
+				return publishDraft(store, draft, input.expectedUpdatedAtMs, input.confirmed);
+			} catch (error) {
+				return failure(error instanceof Error ? error.message : String(error));
+			}
+		}
+	};
+}
+function listWorkflows() {
+	const workflows = createWorkflowCatalog().list().slice(0, 100).map((entry) => ({
+		name: entry.name,
+		title: entry.title,
+		description: entry.description,
+		revision: entry.revision
+	}));
+	return success(workflows.length ? JSON.stringify(workflows, null, 2) : "No saved workflows.", { workflows });
+}
+function openDraft(store, rawName) {
+	const workflowName = rawName?.trim();
+	if (!workflowName) return failure("workflowName is required for open_draft.");
+	const catalog = createWorkflowCatalog();
+	let graph = createStarterWorkflowGraph();
+	let manifest = createStarterWorkflowManifest(workflowName);
+	let baseRevision = 0;
+	if (catalog.list().some((entry) => entry.name === workflowName)) {
+		const definition = catalog.load(workflowName);
+		graph = definition.graph;
+		manifest = {
+			title: definition.title,
+			description: definition.description,
+			version: definition.version,
+			inputSchema: definition.inputSchema,
+			outputSchema: definition.outputSchema,
+			defaults: definition.defaults,
+			tags: definition.metadata.tags,
+			whenToUse: definition.metadata.whenToUse,
+			estimatedAgents: definition.metadata.estimatedAgents,
+			examplePrompts: definition.metadata.examplePrompts,
+			i18n: definition.metadata.i18n,
+			permissions: definition.permissions,
+			resources: definition.resources,
+			connectors: definition.connectors
+		};
+		baseRevision = definition.revision;
+	}
+	const draft = store.save({
+		workflowName,
+		graph,
+		manifest,
+		baseRevision
+	});
+	return success(`Opened durable draft ${draft.id} for ${workflowName}.`, { draft });
+}
+function requireDraft(store, draftId) {
+	const id = draftId?.trim();
+	if (!id) throw new Error("draftId is required for this action.");
+	const draft = store.get(id);
+	if (!draft) throw new Error("Workflow draft not found.");
+	return draft;
+}
+function validateDraft(draft) {
+	const validation = validateWorkflowDefinitionInput({
+		name: draft.workflowName,
+		graph: draft.graph,
+		manifest: draft.manifest
+	});
+	const text = validation.valid ? `Workflow draft is valid${validation.warnings.length ? ` with ${validation.warnings.length} warning(s)` : ""}.` : `Workflow draft is invalid: ${validation.errors.map((issue) => issue.message).join(" ")}`;
+	return validation.valid ? success(text, {
+		validation,
+		updatedAtMs: draft.updatedAtMs
+	}) : failure(text, {
+		validation,
+		updatedAtMs: draft.updatedAtMs
+	});
+}
+function replaceDraft(store, draft, input) {
+	if (!input.graph) return failure("graph is required for replace_draft.");
+	if (input.expectedUpdatedAtMs === void 0) return failure("expectedUpdatedAtMs is required for replace_draft.");
+	const workflowName = input.workflowName?.trim() || draft.workflowName;
+	const manifest = input.manifest ?? draft.manifest;
+	const validation = validateWorkflowDefinitionInput({
+		name: workflowName,
+		graph: input.graph,
+		manifest
+	});
+	if (!validation.valid) return failure(`Draft was not changed. ${validation.errors.map((issue) => issue.message).join(" ")}`, { validation });
+	try {
+		const saved = store.save({
+			id: draft.id,
+			workflowName,
+			graph: input.graph,
+			manifest,
+			expectedUpdatedAtMs: input.expectedUpdatedAtMs
+		});
+		return success(`Workflow draft saved at version ${saved.updatedAtMs}.`, {
+			draft: saved,
+			validation
+		});
+	} catch (error) {
+		if (error instanceof WorkflowDraftConflictError) return failure("Draft changed since it was read. Read it again before applying changes.", {
+			code: "WORKFLOW_DRAFT_CONFLICT",
+			currentUpdatedAtMs: error.currentUpdatedAtMs
+		});
+		throw error;
+	}
+}
+function publishDraft(store, draft, expectedUpdatedAtMs, confirmed) {
+	if (confirmed !== true) return failure("Publishing requires explicit user confirmation. Ask the user to confirm this validated draft first.");
+	if (expectedUpdatedAtMs === void 0) return failure("expectedUpdatedAtMs is required for publish_draft.");
+	if (draft.updatedAtMs !== expectedUpdatedAtMs) return failure("Draft changed since it was read. Read and validate it again before publishing.", {
+		code: "WORKFLOW_DRAFT_CONFLICT",
+		currentUpdatedAtMs: draft.updatedAtMs
+	});
+	const validation = validateWorkflowDefinitionInput({
+		name: draft.workflowName,
+		graph: draft.graph,
+		manifest: draft.manifest
+	});
+	if (!validation.valid) return failure(`Workflow was not published. ${validation.errors.map((issue) => issue.message).join(" ")}`, { validation });
+	try {
+		const { definition } = createWorkflowCatalog().save({
+			name: draft.workflowName,
+			graph: draft.graph,
+			manifest: draft.manifest,
+			expectedRevision: draft.baseRevision,
+			intent: draft.baseRevision === 0 ? "create" : "update"
+		});
+		store.save({
+			...draft,
+			baseRevision: definition.revision,
+			expectedUpdatedAtMs: draft.updatedAtMs
+		});
+		const delivery = {
+			version: 2,
+			operation: draft.baseRevision === 0 ? "created" : "updated",
+			primary: {
+				kind: "workflow_definition",
+				id: definition.id,
+				title: definition.title,
+				summary: definition.description,
+				status: "ready",
+				capabilities: [
+					"open",
+					"edit",
+					"run"
+				]
+			}
+		};
+		return success(appendProductDeliveryText(`Published workflow \`${definition.name}\` revision ${definition.revision}.`, delivery), {
+			definition,
+			delivery
+		});
+	} catch (error) {
+		if (error instanceof WorkflowNameConflictError) return failure(`Workflow name "${error.workflowName}" is already in use.`, { code: "WORKFLOW_NAME_EXISTS" });
+		if (error instanceof WorkflowRevisionConflictError) return failure("The saved workflow changed. Open a fresh draft before publishing.", {
+			code: "WORKFLOW_REVISION_CONFLICT",
+			currentRevision: error.currentRevision
+		});
+		throw error;
+	}
+}
+function success(text, details) {
+	return {
+		content: [{
+			type: "text",
+			text
+		}],
+		details
+	};
+}
+function failure(message, details = {}) {
+	return {
+		content: [{
+			type: "text",
+			text: message
+		}],
+		details: {
+			error: message,
+			...details
+		}
+	};
+}
+//#endregion
+export { createWorkflowManageTool };

package/dist/src/agent/tools/xopc-use-tool.js

@@ -9,9 +9,9 @@ import { TaskRunRepository } from "../../tasks/task-run-repository.js";
 import { getSessionMetadata } from "../../storage/sqlite/session-read-repository.js";
 import { init_sqlite } from "../../storage/sqlite/index.js";
 import "../../activity/index.js";
+import { getDefaultAgentId, init_resolve_route } from "../../routing/resolve-route.js";
 import { CapabilityError } from "../../capabilities/runtime/errors.js";
 import "../../capabilities/runtime/dispatcher.js";
-import { getDefaultAgentId, init_resolve_route } from "../../routing/resolve-route.js";
 import { resolveProjectAgentId } from "../../projects/project-agent.js";
 import "../../projects/index.js";
 import { TaskDeletionService } from "../../tasks/task-deletion-service.js";

package/dist/src/agent-catalog/capabilities.js

@@ -1,10 +1,10 @@
 import { AgentEntrySchema, EffectiveAgentConfigSchema } from "../agent-config/schema.js";
 import { resolveEffectiveAgentConfig } from "../agent-config/resolver.js";
 import { init_agent_config } from "../agent-config/index.js";
-import { CapabilityError } from "../capabilities/runtime/errors.js";
-import { defineAtomicCapability, defineReadCapability } from "../capabilities/runtime/dispatcher.js";
 import { AgentCatalogRepository, init_repository } from "./repository.js";
 import { init_agent_scope, resolveAgentWorkspaceDir } from "../agent/agent-scope.js";
+import { CapabilityError } from "../capabilities/runtime/errors.js";
+import { defineAtomicCapability, defineReadCapability } from "../capabilities/runtime/dispatcher.js";
 import { AgentCatalogService } from "./service.js";
 import { z } from "zod";
 //#region src/agent-catalog/capabilities.ts

package/dist/src/auth/credentials.js

@@ -2,8 +2,8 @@ import { __esmMin } from "../../_virtual/_rolldown/runtime.js";
 import { createLogger } from "../utils/logger/index.js";
 import { init_logger } from "../utils/logger.js";
 import { init_paths, resolveAgentAuthProfilesPath, resolveAuthProfilesPath, resolveCredentialsDir, resolveOAuthPath } from "../config/paths.js";
-import { init_write_file_atomic, writeTextAtomic } from "../infra/write-file-atomic.js";
 import { getOAuthProviderDefinition, init_registry } from "./oauth/registry.js";
+import { init_write_file_atomic, writeTextAtomic } from "../infra/write-file-atomic.js";
 import { getApiKeyFromEnv, init_env_keys } from "../providers/env-keys.js";
 import { init_oauth_provider_lock, withOAuthProviderLock } from "./oauth-provider-lock.js";
 import { dirname, join } from "path";

package/dist/src/auth/oauth-provider-lock.js

@@ -3,8 +3,8 @@ import { init_paths, resolveOAuthPath } from "../config/paths.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { dirname } from "node:path";
 import { randomUUID } from "node:crypto";
-import { mkdir, open, readFile, rm, stat } from "node:fs/promises";
 import { setTimeout } from "node:timers/promises";
+import { mkdir, open, readFile, rm, stat } from "node:fs/promises";
 //#region src/auth/oauth-provider-lock.ts
 function lockPath(providerId) {
 	return `${resolveOAuthPath(providerId.toLowerCase())}.lock`;

package/dist/src/auth/sync-provider-auth.js

@@ -1,6 +1,6 @@
 import { __esmMin } from "../../_virtual/_rolldown/runtime.js";
-import { init_paths, resolveAgentAuthProfilesPath, resolveAuthProfilesPath, resolveOAuthPath } from "../config/paths.js";
 import { getDefaultAgentId, init_resolve_route } from "../routing/resolve-route.js";
+import { init_paths, resolveAgentAuthProfilesPath, resolveAuthProfilesPath, resolveOAuthPath } from "../config/paths.js";
 import { init_registry, isOAuthOnlyProvider } from "./oauth/registry.js";
 import { existsSync, readFileSync } from "node:fs";
 //#region src/auth/sync-provider-auth.ts

package/dist/src/automations/capabilities/drafts.js

@@ -3,10 +3,10 @@ import { init_src } from "../../../packages/gateway-contract/src/index.js";
 import { init_trust_policy, resolveAutomationSafetyForTrust } from "../../user-context/trust-policy.js";
 import { getUserTrustPolicy } from "../../storage/sqlite/user-trust-repository.js";
 import { init_sqlite } from "../../storage/sqlite/index.js";
+import { init_agent_scope, resolveDefaultAgentId } from "../../agent/agent-scope.js";
 import { CapabilityError } from "../../capabilities/runtime/errors.js";
 import { ExternalEffectNotAppliedError } from "../../capabilities/runtime/external-operations.js";
 import { defineExternalCapability, defineReadCapability } from "../../capabilities/runtime/dispatcher.js";
-import { init_agent_scope, resolveDefaultAgentId } from "../../agent/agent-scope.js";
 import { AutomationCreateCapabilityInputSchema } from "./write.js";
 import { simulateAutomation } from "../draft/automation-draft-validator.js";
 import { AutomationDraftService } from "../draft/automation-draft-service.js";