@xopcai/xopc 0.0.340 → 0.0.342

package/dist/src/agent/embedded/run-turn.js

@@ -12,6 +12,7 @@ import { getAssistantTurnErrorMessage, isAssistantTurnAborted, isAssistantTurnFa
 import { isAgentTurnUnsettledError, resolveAgentTurnTimeoutMs, runAgentTurnWithTimeout } from "../orchestration/run-agent-turn-with-timeout.js";
 import { detectToolLoops } from "../orchestration/loop-guard.js";
 import { tryApplySessionTranscriptHygiene } from "../transcript/transcript-hygiene.js";
+import { restoreCurrentTurnImages } from "./current-turn-images.js";
 import { resolvePromptCachePolicy } from "../../providers/prompt-cache-plan.js";
 import { wrapStreamFnForXopcExtensions } from "./xopc-stream-bridge.js";
 import { acquireEmbeddedSessionRunner, evictEmbeddedSessionRunner } from "./session-runner.js";
@@ -326,9 +327,14 @@ async function runXopcEmbeddedTurn(params) {
 		const authoritativePrepareRequest = async (request, signal) => {
 			const prepared = await basePrepareRequest?.(request, signal);
 			const currentContext = prepared?.context ?? request.context;
+			const imagesForModel = resolvedModel.input?.includes("image") === false ? [] : params.images ?? [];
+			const restoreImages = (messages) => restoreCurrentTurnImages(messages, imagesForModel, runId);
 			if (!useAuthoritativeProjection) return {
 				...prepared,
-				context: currentContext
+				context: {
+					...currentContext,
+					messages: restoreImages(currentContext.messages)
+				}
 			};
 			try {
 				const messages = await transcriptRuntime.loadMessages();
@@ -336,7 +342,7 @@ async function runXopcEmbeddedTurn(params) {
 					...prepared,
 					context: {
 						...currentContext,
-						messages: withRecoveredMessages(currentContext.messages, messages)
+						messages: restoreImages(withRecoveredMessages(currentContext.messages, messages))
 					}
 				};
 			} catch (error) {
@@ -347,7 +353,13 @@ async function runXopcEmbeddedTurn(params) {
 					runId,
 					phase: "prepare_request"
 				}, "Failed to refresh the authoritative compacted projection");
-				return prepared;
+				return {
+					...prepared,
+					context: {
+						...currentContext,
+						messages: restoreImages(currentContext.messages)
+					}
+				};
 			}
 		};
 		session.agent.prepareRequest = authoritativePrepareRequest;

package/dist/src/agent/external-tools/endpoint-provider.js

@@ -1,7 +1,7 @@
-import { executeExternalOperation } from "../../capabilities/runtime/external-operations.js";
-import { canonicalCapabilityJson } from "../../capabilities/runtime/dispatcher.js";
 import { COMPUTER_CONTROL_TOOL, init_src } from "../../../packages/computer-control-contract/src/index.js";
 import { BROWSER_CONTROL_ENDPOINT_TOOL_NAME } from "../../../packages/browser-control-contract/src/index.js";
+import { executeExternalOperation } from "../../capabilities/runtime/external-operations.js";
+import { canonicalCapabilityJson } from "../../capabilities/runtime/dispatcher.js";
 import { externalToolRef, parseExternalToolRef } from "./refs.js";
 import { createHash } from "node:crypto";
 //#region src/agent/external-tools/endpoint-provider.ts

package/dist/src/agent/image/tool-model-config.js

@@ -1,5 +1,5 @@
-import { init_agent_scope, resolveDefaultAgentId } from "../agent-scope.js";
 import { getAgentDefaultImageModelConfig, getAgentDefaultModelRef, init_schema, parseModelRef } from "../../config/schema.js";
+import { init_agent_scope, resolveDefaultAgentId } from "../agent-scope.js";
 import { resolveEffectiveAgentConfigForAgent } from "../../config/agent-profile.js";
 import { getDefaultModelSync, getModelsByProvider, init_providers, isProviderConfiguredSync, resolveModel } from "../../providers/index.js";
 import { resolveAgentModelFallbackValues, resolveAgentModelPrimaryValue } from "../../config/model-input.js";

package/dist/src/agent/service.js

@@ -1,13 +1,13 @@
 import { createLogger } from "../utils/logger/index.js";
 import { init_logger } from "../utils/logger.js";
 import { init_attachment_ref, parseNoteAttachmentTarget } from "../notes/attachment-ref.js";
-import { init_agent_scope, resolveAgentHomeDir, resolveDefaultAgentId } from "./agent-scope.js";
-import { extractTextContent } from "./context/workspace.js";
 import { getAgentDefaultModelRef, init_schema } from "../config/schema.js";
 import { applyConfigOverrides } from "../config/runtime-overrides.js";
+import { init_agent_scope, resolveAgentHomeDir, resolveDefaultAgentId } from "./agent-scope.js";
 import { init_agent_session_key, resolveAgentIdFromConversationId } from "../routing/agent-session-key.js";
 import { extractProfileAgentId } from "../config/agent-profile.js";
 import { init_providers, resolveModel } from "../providers/index.js";
+import { extractTextContent } from "./context/workspace.js";
 import { effectiveWorkspacePathForSession } from "../session/session-workspace.js";
 import { getProjectForSession } from "../projects/workspace.js";
 import { runWithEmbeddedExecutionSession } from "./embedded/execution-context.js";

package/dist/src/agent/skills/marketplace/adapters/store/store-api-client.d.ts

@@ -102,10 +102,26 @@ export interface MarketplacePackageDetail {
         username: string;
         avatarUrl: string | null;
     };
+    publisher?: {
+        verification: 'community' | 'verified';
+        sourceRepository: string | null;
+    };
     latestVersion: {
         version: string;
         changelog: string | null;
         publishedAt: string;
+        downloadUrl?: string;
+        sha256?: string | null;
+        sourceCommit?: string | null;
+        artifactFormat?: string;
+        riskTier?: 'content' | 'network' | 'local-exec';
+        componentIndex?: {
+            skills: string[];
+            mcpServers: Array<{
+                name: string;
+                transport: string;
+            }>;
+        };
     };
 }
 export interface StoreConnectorPackageDetail {
@@ -144,14 +160,21 @@ export interface StorePublishedPackageHead {
         checksum?: string;
         integrity?: string;
         sha256?: string;
+        sourceCommit?: string | null;
+        artifactFormat?: string;
+        riskTier?: 'content' | 'network' | 'local-exec';
     };
 }
-export declare function resolveExtensionZipDownloadUrl(storeBaseUrl: string, packageName: string, version?: string): Promise<{
+export type ResolvedExtensionStoreArtifact = {
     downloadUrl: string;
     version: string;
     integrity?: string;
     sha256?: string;
-}>;
+    sourceCommit?: string;
+    artifactFormat?: string;
+    riskTier?: 'content' | 'network' | 'local-exec';
+};
+export declare function resolveExtensionZipDownloadUrl(storeBaseUrl: string, packageName: string, version?: string): Promise<ResolvedExtensionStoreArtifact>;
 export declare function downloadExtensionStoreZipBuffer(storeBaseUrl: string, downloadUrl: string): Promise<Buffer>;
 export declare function downloadConnectorStoreZipBuffer(storeBaseUrl: string, downloadUrl: string): Promise<Buffer>;
 export declare function skillIdForMarketplaceInstall(packageName: string): string | undefined;

package/dist/src/agent/skills/marketplace/adapters/store/store-api-client.js

@@ -181,7 +181,7 @@ async function resolveExtensionZipDownloadUrl(storeBaseUrl, packageName, version
 	const base = normalizeBaseUrl(storeBaseUrl);
 	const enc = encodeURIComponent(packageName.trim());
 	const meta = await fetchJson(`${base}/api/v1/packages/${enc}`);
-	if (meta.type !== "extension") throw new Error(`Package "${packageName}" has type "${meta.type}" (expected extension). Use \`xopc skills install\` for skills.`);
+	if (meta.type !== "extension" && meta.type !== "plugin") throw new Error(`Package "${packageName}" has type "${meta.type}" (expected plugin or extension). Use \`xopc skills install\` for skills.`);
 	if (version?.trim()) {
 		const detail = await fetchJson(`${base}/api/v1/packages/${enc}/versions/${encodeURIComponent(version.trim())}`);
 		if (!detail.downloadUrl) throw new Error("Store version has no download URL");
@@ -190,7 +190,10 @@ async function resolveExtensionZipDownloadUrl(storeBaseUrl, packageName, version
 			downloadUrl: detail.downloadUrl,
 			version: detail.version,
 			integrity: detail.integrity ?? detail.checksum ?? detail.sha256,
-			...detail.sha256 ? { sha256: detail.sha256 } : {}
+			...detail.sha256 ? { sha256: detail.sha256 } : {},
+			...detail.sourceCommit ? { sourceCommit: detail.sourceCommit } : {},
+			...detail.artifactFormat ? { artifactFormat: detail.artifactFormat } : {},
+			...detail.riskTier ? { riskTier: detail.riskTier } : {}
 		};
 	}
 	const lv = meta.latestVersion;
@@ -200,7 +203,10 @@ async function resolveExtensionZipDownloadUrl(storeBaseUrl, packageName, version
 		downloadUrl: lv.downloadUrl,
 		version: lv.version,
 		integrity: lv.integrity ?? lv.checksum ?? lv.sha256,
-		...lv.sha256 ? { sha256: lv.sha256 } : {}
+		...lv.sha256 ? { sha256: lv.sha256 } : {},
+		...lv.sourceCommit ? { sourceCommit: lv.sourceCommit } : {},
+		...lv.artifactFormat ? { artifactFormat: lv.artifactFormat } : {},
+		...lv.riskTier ? { riskTier: lv.riskTier } : {}
 	};
 }
 async function downloadExtensionStoreZipBuffer(storeBaseUrl, downloadUrl) {

package/dist/src/agent/tools/xopc-use-tool.js

@@ -9,9 +9,9 @@ import { TaskRunRepository } from "../../tasks/task-run-repository.js";
 import { getSessionMetadata } from "../../storage/sqlite/session-read-repository.js";
 import { init_sqlite } from "../../storage/sqlite/index.js";
 import "../../activity/index.js";
+import { getDefaultAgentId, init_resolve_route } from "../../routing/resolve-route.js";
 import { CapabilityError } from "../../capabilities/runtime/errors.js";
 import "../../capabilities/runtime/dispatcher.js";
-import { getDefaultAgentId, init_resolve_route } from "../../routing/resolve-route.js";
 import { resolveProjectAgentId } from "../../projects/project-agent.js";
 import "../../projects/index.js";
 import { TaskDeletionService } from "../../tasks/task-deletion-service.js";

package/dist/src/agent-catalog/capabilities.js

@@ -1,10 +1,10 @@
 import { AgentEntrySchema, EffectiveAgentConfigSchema } from "../agent-config/schema.js";
 import { resolveEffectiveAgentConfig } from "../agent-config/resolver.js";
 import { init_agent_config } from "../agent-config/index.js";
-import { CapabilityError } from "../capabilities/runtime/errors.js";
-import { defineAtomicCapability, defineReadCapability } from "../capabilities/runtime/dispatcher.js";
 import { AgentCatalogRepository, init_repository } from "./repository.js";
 import { init_agent_scope, resolveAgentWorkspaceDir } from "../agent/agent-scope.js";
+import { CapabilityError } from "../capabilities/runtime/errors.js";
+import { defineAtomicCapability, defineReadCapability } from "../capabilities/runtime/dispatcher.js";
 import { AgentCatalogService } from "./service.js";
 import { z } from "zod";
 //#region src/agent-catalog/capabilities.ts

package/dist/src/auth/credentials.js

@@ -2,8 +2,8 @@ import { __esmMin } from "../../_virtual/_rolldown/runtime.js";
 import { createLogger } from "../utils/logger/index.js";
 import { init_logger } from "../utils/logger.js";
 import { init_paths, resolveAgentAuthProfilesPath, resolveAuthProfilesPath, resolveCredentialsDir, resolveOAuthPath } from "../config/paths.js";
-import { init_write_file_atomic, writeTextAtomic } from "../infra/write-file-atomic.js";
 import { getOAuthProviderDefinition, init_registry } from "./oauth/registry.js";
+import { init_write_file_atomic, writeTextAtomic } from "../infra/write-file-atomic.js";
 import { getApiKeyFromEnv, init_env_keys } from "../providers/env-keys.js";
 import { init_oauth_provider_lock, withOAuthProviderLock } from "./oauth-provider-lock.js";
 import { dirname, join } from "path";

package/dist/src/auth/oauth-provider-lock.js

@@ -3,8 +3,8 @@ import { init_paths, resolveOAuthPath } from "../config/paths.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { dirname } from "node:path";
 import { randomUUID } from "node:crypto";
-import { mkdir, open, readFile, rm, stat } from "node:fs/promises";
 import { setTimeout } from "node:timers/promises";
+import { mkdir, open, readFile, rm, stat } from "node:fs/promises";
 //#region src/auth/oauth-provider-lock.ts
 function lockPath(providerId) {
 	return `${resolveOAuthPath(providerId.toLowerCase())}.lock`;

package/dist/src/auth/sync-provider-auth.js

@@ -1,6 +1,6 @@
 import { __esmMin } from "../../_virtual/_rolldown/runtime.js";
-import { init_paths, resolveAgentAuthProfilesPath, resolveAuthProfilesPath, resolveOAuthPath } from "../config/paths.js";
 import { getDefaultAgentId, init_resolve_route } from "../routing/resolve-route.js";
+import { init_paths, resolveAgentAuthProfilesPath, resolveAuthProfilesPath, resolveOAuthPath } from "../config/paths.js";
 import { init_registry, isOAuthOnlyProvider } from "./oauth/registry.js";
 import { existsSync, readFileSync } from "node:fs";
 //#region src/auth/sync-provider-auth.ts

package/dist/src/automations/capabilities/drafts.js

@@ -3,10 +3,10 @@ import { init_src } from "../../../packages/gateway-contract/src/index.js";
 import { init_trust_policy, resolveAutomationSafetyForTrust } from "../../user-context/trust-policy.js";
 import { getUserTrustPolicy } from "../../storage/sqlite/user-trust-repository.js";
 import { init_sqlite } from "../../storage/sqlite/index.js";
+import { init_agent_scope, resolveDefaultAgentId } from "../../agent/agent-scope.js";
 import { CapabilityError } from "../../capabilities/runtime/errors.js";
 import { ExternalEffectNotAppliedError } from "../../capabilities/runtime/external-operations.js";
 import { defineExternalCapability, defineReadCapability } from "../../capabilities/runtime/dispatcher.js";
-import { init_agent_scope, resolveDefaultAgentId } from "../../agent/agent-scope.js";
 import { AutomationCreateCapabilityInputSchema } from "./write.js";
 import { simulateAutomation } from "../draft/automation-draft-validator.js";
 import { AutomationDraftService } from "../draft/automation-draft-service.js";

package/dist/src/bootstrap/application-state.js

@@ -1,9 +1,9 @@
 import { requireXopcDatabase } from "../storage/sqlite/connection.js";
 import { init_sqlite } from "../storage/sqlite/index.js";
 import { AgentCatalogService } from "../agent-catalog/service.js";
+import { ensureStarterAgentsInitialized } from "../agent/starter-agents.js";
 import { cutoverLegacyAgentConfig } from "../agent-catalog/migrations/legacy-config-cutover.js";
 import "../agent-catalog/index.js";
-import { ensureStarterAgentsInitialized } from "../agent/starter-agents.js";
 import { runBootstrapMigrationsSync } from "../migrations/runner.js";
 //#region src/bootstrap/application-state.ts
 init_sqlite();

package/dist/src/capabilities/runtime/dispatcher.js

@@ -1,7 +1,7 @@
 import { SqliteCommitEffectError, init_transaction } from "../../storage/sqlite/transaction.js";
-import { OperationConflictError, executeAtomicOperation } from "./atomic-operations.js";
 import { CapabilityError } from "./errors.js";
 import { executeExternalOperation } from "./external-operations.js";
+import { OperationConflictError, executeAtomicOperation } from "./atomic-operations.js";
 import { createHash } from "node:crypto";
 import { z } from "zod";
 //#region src/capabilities/runtime/dispatcher.ts

package/dist/src/capabilities/runtime/product.js

@@ -1,6 +1,5 @@
 import { CapabilityError } from "./errors.js";
 import { CapabilityDispatcher } from "./dispatcher.js";
-import { registerAgentCapabilities } from "../../agent-catalog/capabilities.js";
 import { registerLocalAppReadCapabilities } from "../../local-apps/capabilities/read.js";
 import { registerNoteReadCapabilities } from "../../notes/capabilities/read.js";
 import { registerNoteWriteCapabilities } from "../../notes/capabilities/write.js";
@@ -19,6 +18,7 @@ import { registerSceneReadCapabilities } from "../../scenes/capabilities/read.js
 import { registerSceneWriteCapabilities } from "../../scenes/capabilities/write.js";
 import { registerSettingsCapability } from "./settings.js";
 import { registerAppContextCapability } from "./app-context.js";
+import { registerAgentCapabilities } from "../../agent-catalog/capabilities.js";
 //#region src/capabilities/runtime/product.ts
 function createProductDispatcher(getNotes, taskWrites) {
 	const dispatcher = new CapabilityDispatcher();

package/dist/src/chat-commands/agent-edit.js

@@ -1,7 +1,7 @@
 import { normalizeAgentId } from "../agent-catalog/id.js";
 import { init_agent_scope, resolveAgentProfileDir } from "../agent/agent-scope.js";
-import { WORKSPACE_FILES, init_paths } from "../config/paths.js";
 import { init_agent_session_key, resolveAgentIdFromConversationId } from "../routing/agent-session-key.js";
+import { WORKSPACE_FILES, init_paths } from "../config/paths.js";
 import { commandRegistry } from "./registry.js";
 import { join } from "node:path";
 import { readFile } from "node:fs/promises";

package/dist/src/chat-commands/builtins/config.js

@@ -1,7 +1,7 @@
 import { createLogger } from "../../utils/logger/index.js";
 import { init_logger } from "../../utils/logger.js";
-import { init_paths, resolveConfigPath } from "../../config/paths.js";
 import { ConfigSchema, init_schema } from "../../config/schema.js";
+import { init_paths, resolveConfigPath } from "../../config/paths.js";
 import { commandRegistry } from "../registry.js";
 import { parseConfigValue } from "../config-value.js";
 import { getConfigValueAtPath, parseConfigPath, setConfigValueAtPath, unsetConfigValueAtPath } from "../config-paths.js";

package/dist/src/cli/commands/agent.js

@@ -1,7 +1,7 @@
 import { createLogger } from "../../utils/logger/index.js";
 import { init_logger } from "../../utils/logger.js";
-import { init_agent_scope, resolveDefaultAgentId } from "../../agent/agent-scope.js";
 import { getAgentDefaultModelRef, init_schema } from "../../config/schema.js";
+import { init_agent_scope, resolveDefaultAgentId } from "../../agent/agent-scope.js";
 import { init_agent_session_key, resolveAgentMainConversationId } from "../../routing/agent-session-key.js";
 import { ExtensionLoader } from "../../extensions/loader.js";
 import "../../extensions/index.js";

package/dist/src/cli/commands/agents.js

@@ -1,8 +1,8 @@
 import { normalizeAgentId, validateAgentIdForNewAgent } from "../../agent-catalog/id.js";
 import { AgentCatalogRepository, init_repository } from "../../agent-catalog/repository.js";
 import { init_agent_scope, resolveAgentDir, resolveAgentWorkspaceDir, resolveDefaultAgentId } from "../../agent/agent-scope.js";
-import { AgentCatalogService } from "../../agent-catalog/service.js";
 import { resolveEffectiveAgentConfigForAgent } from "../../config/agent-profile.js";
+import { AgentCatalogService } from "../../agent-catalog/service.js";
 import { colors } from "../utils/colors.js";
 //#region src/cli/commands/agents.ts
 init_repository();

package/dist/src/cli/commands/extension-agent-plugin.js

@@ -38,11 +38,12 @@ async function installAgentPluginFromCli(source, options) {
 			default: false
 		})) return;
 	}
-	const plugin = await withAgentPluginSource(source, cfg, (local) => store.install(local, {
+	const plugin = await withAgentPluginSource(source, cfg, (local, provenance) => store.install(local, {
 		reviewHash: plan.reviewHash,
 		replace: options.force,
 		expectedId: options.expectedId,
-		sourceLabel: source.startsWith("https://") || source.startsWith("store:") ? source : resolve(source)
+		sourceLabel: source.startsWith("https://") || source.startsWith("store:") ? source : resolve(source),
+		provenance
 	}));
 	console.log(`Installed plugin:${plugin.id} (${plugin.receipt.enabled ? "enabled" : "disabled"}).`);
 	return plugin;

package/dist/src/cli/commands/models.js

@@ -1,8 +1,8 @@
 import { AgentCatalogRepository, init_repository } from "../../agent-catalog/repository.js";
-import { AgentCatalogService } from "../../agent-catalog/service.js";
 import { getAgentDefaultModelRef, init_schema } from "../../config/schema.js";
 import { CredentialResolver, init_credentials } from "../../auth/credentials.js";
 import { getAllModels, getAvailableModels, getConfiguredProviders, getProviderAuthState, getProviderDisplayName, init_providers, isProviderConfigured, providerSupportsApiKey, providerSupportsOAuth, resolveModel } from "../../providers/index.js";
+import { AgentCatalogService } from "../../agent-catalog/service.js";
 import { loadConfig } from "../../config/loader.js";
 import { formatExamples, register } from "../registry.js";
 import { getContextWithOpts } from "../context.js";

package/dist/src/cli/commands/onboard/model.js

@@ -1,12 +1,12 @@
 import { AgentCatalogRepository, init_repository } from "../../../agent-catalog/repository.js";
-import { resolveModelsJsonPath } from "../../../config/paths.js";
-import { AgentCatalogService } from "../../../agent-catalog/service.js";
 import { getAgentDefaultModelRef, init_schema } from "../../../config/schema.js";
+import { resolveModelsJsonPath } from "../../../config/paths.js";
 import { init_models_json, loadModelsJson, saveModelsJson } from "../../../config/models-json.js";
 import { getApiKeyFromEnv } from "../../../providers/env-keys.js";
 import { getModelRegistry } from "../../../providers/model-registry.js";
 import { CredentialResolver, init_credentials } from "../../../auth/credentials.js";
 import { getAllProviders, getModelsByProvider, getProviderDisplayName, init_providers, providerSupportsApiKey, providerSupportsOAuth } from "../../../providers/index.js";
+import { AgentCatalogService } from "../../../agent-catalog/service.js";
 import { prepareUpdateGlobalDefaults } from "../../../gateway/global-defaults-admin.js";
 import { discoverProviderModels, isProviderApiDiscoverable } from "../../../providers/model-discovery.js";
 import { getXopcCloudCatalogCoordinator } from "../../../providers/xopc-cloud-catalog-coordinator.js";

package/dist/src/cli/extension-cli-register.js

@@ -4,6 +4,7 @@ import "../extensions/index.js";
 import { loadConfig } from "../config/loader.js";
 import { MessageBus } from "../infra/bus/queue.js";
 import "../infra/bus/index.js";
+import { bootstrapApplicationStateSync } from "../bootstrap/application-state.js";
 import { createDefaultContext } from "./registry.js";
 import { getWorkspacePath } from "../config/workspace-path-helpers.js";
 import "../config/index.js";
@@ -19,6 +20,7 @@ function argvRequestsVersionOnly(argv) {
 async function registerExtensionCliCommands(program) {
 	if (argvRequestsVersionOnly(process.argv)) return;
 	const ctx = createDefaultContext(process.argv, {});
+	bootstrapApplicationStateSync(ctx.configPath);
 	const config = loadConfig(ctx.configPath);
 	const workspace = getWorkspacePath(config) || ctx.workspacePath;
 	const rawExt = config.extensions;

package/dist/src/cli/utils/init-workspace-core.js

@@ -1,6 +1,6 @@
 import { AgentCatalogRepository, init_repository } from "../../agent-catalog/repository.js";
-import { AgentCatalogService } from "../../agent-catalog/service.js";
 import { ConfigSchema, init_schema } from "../../config/schema.js";
+import { AgentCatalogService } from "../../agent-catalog/service.js";
 import { assertConfigRewriteSafeForRunningGateway, saveConfig } from "../../config/loader.js";
 import { ensureStarterAgentsInitialized } from "../../agent/starter-agents.js";
 import { bootstrapApplicationStateSync } from "../../bootstrap/application-state.js";

package/dist/src/config/index.js

@@ -1,13 +1,13 @@
 import { ENV_VARS, XOPC_DB_FILENAME, resolveHomeDir, resolveStateDir, resolveXopcCloudCatalogCachePath, resolveXopcDatabasePath } from "./paths-state.js";
-import { expandWorkspacePathString, init_workspace_path, normalizeWorkspaceDir, resolveWorkspaceRoot } from "./workspace-path.js";
-import { resolveDefaultAgentWorkspaceDir } from "./workspace-defaults.js";
-import { resolveAgentWorkspaceDir } from "../agent/agent-scope.js";
-import { FILENAMES, WORKSPACE_FILES, existsSync, hasBundledExtensionManifest, init_paths, resolveAgentAuthProfilesPath, resolveAgentDir, resolveAgentHomeDir, resolveAgentProfileDir, resolveAgentProfileMarkdownPath, resolveAuthProfilesPath, resolveBinDir, resolveBundledExtensionsDir, resolveBundledSkillsDir, resolveConfigPath, resolveCredentialsDir, resolveExtensionSdkPath, resolveExtensionsDir, resolveExtensionsLockPath, resolveInboxDir, resolveInboxMessagePath, resolveInboxPendingDir, resolveInboxProcessedDir, resolveLogPath, resolveLogsDir, resolveMcpOAuthPath, resolveModelsJsonPath, resolveNodeBinDir, resolveNodeBinPath, resolveNodeToolsDir, resolveNpmBinPath, resolveOAuthPath, resolvePidPath, resolveSkillPath, resolveSkillsCachePath, resolveSkillsDir, resolveSkillsLockPath, resolveSocketPath, resolveStatusPath, resolveToolsDir, resolveWorkspaceExtensionsDir, resolveWorkspaceFile, resolveWorkspaceStateDir, resolveWorkspaceStatePath, resolveXopcBinPath } from "./paths.js";
 import { TelegramAccountConfigSchema, TelegramConfigSchema, TelegramGroupConfigSchema, TelegramTopicConfigSchema } from "../../extensions/telegram/src/config-schema.js";
 import { WeixinAccountConfigSchema, WeixinConfigSchema } from "../../extensions/weixin/src/config-schema.js";
 import { AgentImageGenerationModelSchema, AgentModelRefSchema, AgentModelsSchema, BrowserConfigSchema, ChannelsConfigSchema, CommandsConfigSchema, ConfigSchema, ConnectorsConfigSchema, ExperimentalConfigSchema, ExtensionSecurityConfigSchema, ExtensionSlotsConfigSchema, ExtensionsConfigSchema, GatewayAuthRateLimitSchema, GatewayAuthSchema, GatewayBindModeSchema, GatewayChannelConnectDeferModeSchema, GatewayConfigSchema, GatewayModeSchema, GatewayRemoteSchema, GatewayScenesConfigSchema, GatewaySecuritySchema, GatewayTailscaleConsentSchema, GatewayTailscaleSchema, GatewayTlsSchema, GatewayTrustedProxySchema, GatewayWebchatConfigSchema, HeartbeatConfigSchema, McpConfigSchema, McpOAuthConfigSchema, McpServerSchema, MediaUnderstandingCapabilitiesSchema, MediaUnderstandingModelSchema, MessagesConfigSchema, ModelCatalogConfigSchema, ModelsDevConfigSchema, ProviderAuthConfigSchema, ProviderAzureConfigSchema, ProviderRequestOverridesSchema, ProvidersConfigSchema, RuntimeToolsConfigSchema, STTConfigSchema, STTFallbackConfigSchema, STTProviderConfigSchema, SearchProviderEntrySchema, SessionConfigSchema, SessionDmScopeSchema, SessionResetByTypeSchema, SessionResetConfigSchema, SessionResetModeSchema, SessionScopeSchema, SessionStorageConfigSchema, TTSConfigSchema, TTSEdgeConfigSchema, TTSFallbackConfigSchema, TTSModelOverridesConfigSchema, TTSProviderConfigSchema, TTSSummarizationConfigSchema, ToolsConfigSchema, ToolsMediaAudioConfigSchema, ToolsMediaConfigSchema, TunnelConfigSchema, TunnelConsentSchema, UpdateAutoConfigSchema, UpdateConfigSchema, VoiceConfigSchema, VoiceRefinementConfigSchema, WebSearchConfigSchema, WebToolsConfigSchema, WebsiteBlocklistSchema, WorkspaceConfigSchema, WorkspaceImportConfigSchema, getAgentDefaultImageGenerationModelConfig, getAgentDefaultImageModelConfig, getAgentDefaultModelRef, init_schema, parseModelRef } from "./schema.js";
 import { applyConfigOverrides, getConfigOverrides, resetConfigOverrides, setConfigOverride, unsetConfigOverride } from "./runtime-overrides.js";
+import { expandWorkspacePathString, init_workspace_path, normalizeWorkspaceDir, resolveWorkspaceRoot } from "./workspace-path.js";
+import { resolveDefaultAgentWorkspaceDir } from "./workspace-defaults.js";
+import { resolveAgentWorkspaceDir } from "../agent/agent-scope.js";
 import { extractProfileAgentId, resolveEffectiveAgentConfigForAgent, resolveEffectiveAgentConfigForSession, resolveEffectiveAgentProfile, resolveEffectiveAgentProfileForSession } from "./agent-profile.js";
+import { FILENAMES, WORKSPACE_FILES, existsSync, hasBundledExtensionManifest, init_paths, resolveAgentAuthProfilesPath, resolveAgentDir, resolveAgentHomeDir, resolveAgentProfileDir, resolveAgentProfileMarkdownPath, resolveAuthProfilesPath, resolveBinDir, resolveBundledExtensionsDir, resolveBundledSkillsDir, resolveConfigPath, resolveCredentialsDir, resolveExtensionSdkPath, resolveExtensionsDir, resolveExtensionsLockPath, resolveInboxDir, resolveInboxMessagePath, resolveInboxPendingDir, resolveInboxProcessedDir, resolveLogPath, resolveLogsDir, resolveMcpOAuthPath, resolveModelsJsonPath, resolveNodeBinDir, resolveNodeBinPath, resolveNodeToolsDir, resolveNpmBinPath, resolveOAuthPath, resolvePidPath, resolveSkillPath, resolveSkillsCachePath, resolveSkillsDir, resolveSkillsLockPath, resolveSocketPath, resolveStatusPath, resolveToolsDir, resolveWorkspaceExtensionsDir, resolveWorkspaceFile, resolveWorkspaceStateDir, resolveWorkspaceStatePath, resolveXopcBinPath } from "./paths.js";
 import { clearConfigValueCache, getAllowedCommands, getCacheStats, init_resolve_config_value, resolveConfigValue, resolveHeaders, testApiKeyResolution } from "./resolve-config-value.js";
 import { CustomModelSchema, ImageGenerationCapabilitiesSchema, ImageGenerationModelSchema, ImageGenerationProviderSchema, ModelOverrideSchema, ModelsJsonSchema, OpenAICompatSchema, OpenAICompletionsCompatSchema, OpenAIResponsesCompatSchema, OpenRouterRoutingSchema, ProviderConfigSchema, VercelGatewayRoutingSchema, getDefaultModelValues, init_models_json, loadModelsJson, modelsJsonExists, saveModelsJson, validateModelsConfig } from "./models-json.js";
 import { canonicalizeConfiguredMcpServer, isKnownCliMcpTypeAlias, normalizeConfiguredMcpServers, resolveXopcMcpTransportAlias } from "./mcp-config-normalize.js";

package/dist/src/config/loader.js

@@ -1,9 +1,9 @@
 import { createLogger } from "../utils/logger/index.js";
 import { init_logger } from "../utils/logger.js";
-import { init_paths, resolveConfigPath } from "./paths.js";
-import { init_write_file_atomic, writeTextAtomic } from "../infra/write-file-atomic.js";
 import { ConfigSchema, init_schema } from "./schema.js";
+import { init_paths, resolveConfigPath } from "./paths.js";
 import { init_resolution, setActivePlatformDiscovery } from "../platform/resolution.js";
+import { init_write_file_atomic, writeTextAtomic } from "../infra/write-file-atomic.js";
 import { assertChannelPluginConfigs } from "./validate-channel-configs.js";
 import { isGatewayConfigLockedByAnotherProcessSync } from "../gateway/lock.js";
 import { dirname } from "path";

package/dist/src/config/models-json.js

@@ -1,7 +1,7 @@
 import { __esmMin } from "../../_virtual/_rolldown/runtime.js";
 import { init_paths, resolveModelsJsonPath } from "./paths.js";
-import { init_write_file_atomic, writeTextAtomicSync } from "../infra/write-file-atomic.js";
 import { ComputerProfileSchema, init_src } from "../../packages/computer-control-contract/src/index.js";
+import { init_write_file_atomic, writeTextAtomicSync } from "../infra/write-file-atomic.js";
 import { init_model_policy, isComputerModel } from "../computer/model-policy.js";
 import { existsSync, readFileSync } from "fs";
 import { z } from "zod";

package/dist/src/config/schema.d.ts

@@ -1266,6 +1266,7 @@ export declare const ConfigSchema: z.ZodDefault<z.ZodObject<{
                 confirm: "confirm";
                 deny: "deny";
             }>>;
+            showMemoryReferences: z.ZodDefault<z.ZodBoolean>;
             processingPolicy: z.ZodDefault<z.ZodEnum<{
                 local_only: "local_only";
                 remote_allowed: "remote_allowed";

package/dist/src/config/schema.js

@@ -1,9 +1,9 @@
 import { __esmMin } from "../../_virtual/_rolldown/runtime.js";
+import { ComputerConfigSchema, init_config } from "../computer/config.js";
 import { AgentModelsOverrideSchema, ImageGenerationRouteSchema, ModelRouteSchema } from "../agent-config/schema.js";
 import { resolveEffectiveAgentConfig } from "../agent-config/resolver.js";
 import { init_agent_config } from "../agent-config/index.js";
 import { AgentCatalogRepository, init_repository } from "../agent-catalog/repository.js";
-import { ComputerConfigSchema, init_config } from "../computer/config.js";
 import { DEFAULT_CONTEXT_COMPACTION_POLICY, UserContextConfigSchema, init_config as init_config$1 } from "../user-context/config.js";
 import { init_public_url, validatePublicUrl } from "./public-url.js";
 import { PlatformConfigSchema, init_contracts } from "../platform/contracts.js";
@@ -1013,6 +1013,7 @@ workDiscoveryOnboarding: z.boolean().default(true) }).strict().default({ workDis
 				enabled: true,
 				writePolicy: "allow",
 				sensitiveWritePolicy: "confirm",
+				showMemoryReferences: true,
 				processingPolicy: "remote_allowed",
 				extraction: {
 					reviewIntervalTurns: 10,

package/dist/src/extensions/agent-plugins/inventory.d.ts

@@ -1,5 +1,28 @@
 import { type InstalledAgentPlugin } from './store.js';
 export declare function agentPluginInventoryRow(plugin: InstalledAgentPlugin): {
+    components: {
+        skills: {
+            name: string;
+        }[];
+        mcp: {
+            name: string;
+            id: string;
+            type: "sse" | "streamable-http" | "stdio";
+        }[];
+    };
+    diagnostics: import("./validation.js").PluginDiagnostic[];
+    provenance?: {
+        kind: "store";
+        packageName: string;
+        packageType: "extension" | "plugin";
+        version: string;
+        sha256: string;
+        publisherVerification?: "verified" | "community";
+        sourceRepository?: string;
+        sourceCommit?: string;
+        artifactFormat?: string;
+        riskTier?: "content" | "network" | "local-exec";
+    };
     id: string;
     pluginId: string;
     format: "agent-plugin";
@@ -13,6 +36,8 @@ export declare function agentPluginInventoryRow(plugin: InstalledAgentPlugin): {
     hasUi: boolean;
     hasConfigSchema: boolean;
     canRollback: boolean;
+};
+export declare function listAgentPluginInventory(): {
     components: {
         skills: {
             name: string;
@@ -24,8 +49,18 @@ export declare function agentPluginInventoryRow(plugin: InstalledAgentPlugin): {
         }[];
     };
     diagnostics: import("./validation.js").PluginDiagnostic[];
-};
-export declare function listAgentPluginInventory(): {
+    provenance?: {
+        kind: "store";
+        packageName: string;
+        packageType: "extension" | "plugin";
+        version: string;
+        sha256: string;
+        publisherVerification?: "verified" | "community";
+        sourceRepository?: string;
+        sourceCommit?: string;
+        artifactFormat?: string;
+        riskTier?: "content" | "network" | "local-exec";
+    };
     id: string;
     pluginId: string;
     format: "agent-plugin";
@@ -39,15 +74,4 @@ export declare function listAgentPluginInventory(): {
     hasUi: boolean;
     hasConfigSchema: boolean;
     canRollback: boolean;
-    components: {
-        skills: {
-            name: string;
-        }[];
-        mcp: {
-            name: string;
-            id: string;
-            type: "sse" | "streamable-http" | "stdio";
-        }[];
-    };
-    diagnostics: import("./validation.js").PluginDiagnostic[];
 }[];

package/dist/src/extensions/agent-plugins/inventory.js

@@ -16,6 +16,7 @@ function agentPluginInventoryRow(plugin) {
 		hasUi: false,
 		hasConfigSchema: false,
 		canRollback: !!plugin.receipt.previous,
+		...plugin.receipt.provenance ? { provenance: plugin.receipt.provenance } : {},
 		components: {
 			skills: plugin.skills.map((skill) => ({ name: skill.name })),
 			mcp: Object.entries(plugin.servers).map(([name, server]) => ({

package/dist/src/extensions/agent-plugins/sources.d.ts

@@ -1,5 +1,17 @@
 import type { Config } from '../../config/schema.js';
+export interface AgentPluginSourceProvenance {
+    kind: 'store';
+    packageName: string;
+    packageType: 'plugin' | 'extension';
+    version: string;
+    sha256: string;
+    publisherVerification?: 'community' | 'verified';
+    sourceRepository?: string;
+    sourceCommit?: string;
+    artifactFormat?: string;
+    riskTier?: 'content' | 'network' | 'local-exec';
+}
 export declare function isAgentPluginArchive(buffer: Buffer): boolean;
 export declare function withAgentPluginArchive<T>(buffer: Buffer, fn: (local: string) => T): T;
 /** Resolve remote artifacts only for explicit inspect/install requests, never during discovery. */
-export declare function withAgentPluginSource<T>(source: string, config: Config | undefined, fn: (local: string) => T): Promise<T>;
+export declare function withAgentPluginSource<T>(source: string, config: Config | undefined, fn: (local: string, provenance?: AgentPluginSourceProvenance) => T): Promise<T>;

package/dist/src/extensions/agent-plugins/sources.js

@@ -37,15 +37,30 @@ function withAgentPluginArchive(buffer, fn) {
 async function withAgentPluginSource(source, config, fn) {
 	if (!source.startsWith("https://") && !source.startsWith("store:")) return fn(source);
 	let buffer;
+	let provenance;
 	if (source.startsWith("store:")) {
-		const { resolveExtensionZipDownloadUrl, resolveExtensionsStoreBaseUrl, downloadExtensionStoreZipBuffer, verifyStoreArtifactSha256 } = await import("../../agent/skills/marketplace/adapters/store/store-api-client.js");
+		const { fetchMarketplacePackageDetail, resolveExtensionZipDownloadUrl, resolveExtensionsStoreBaseUrl, downloadExtensionStoreZipBuffer, verifyStoreArtifactSha256 } = await import("../../agent/skills/marketplace/adapters/store/store-api-client.js");
 		const spec = source.slice(6);
 		const match = /^([a-z0-9.-]+)(?:@([^/]+))?$/.exec(spec);
 		if (!match) throw new Error("Expected store:<package>[@version]");
 		const base = resolveExtensionsStoreBaseUrl(config);
+		const detail = await fetchMarketplacePackageDetail(base, match[1]);
+		if (detail.type !== "plugin" && detail.type !== "extension") throw new Error(`Store package has unsupported type: ${detail.type}`);
 		const artifact = await resolveExtensionZipDownloadUrl(base, match[1], match[2]);
 		buffer = await downloadExtensionStoreZipBuffer(base, artifact.downloadUrl);
 		verifyStoreArtifactSha256(buffer, artifact.sha256);
+		provenance = {
+			kind: "store",
+			packageName: match[1],
+			packageType: detail.type,
+			version: artifact.version,
+			sha256: artifact.sha256,
+			...detail.publisher?.verification ? { publisherVerification: detail.publisher.verification } : {},
+			...detail.publisher?.sourceRepository ? { sourceRepository: detail.publisher.sourceRepository } : {},
+			...artifact.sourceCommit ? { sourceCommit: artifact.sourceCommit } : {},
+			...artifact.artifactFormat ? { artifactFormat: artifact.artifactFormat } : {},
+			...artifact.riskTier ? { riskTier: artifact.riskTier } : {}
+		};
 	} else {
 		const url = new URL(source);
 		const response = await createPluginHttpFetch(url, {})(url, { signal: AbortSignal.timeout(3e4) });
@@ -66,7 +81,7 @@ async function withAgentPluginSource(source, config, fn) {
 		}
 		buffer = Buffer.concat(chunks);
 	}
-	return withAgentPluginArchive(buffer, fn);
+	return withAgentPluginArchive(buffer, (local) => fn(local, provenance));
 }
 //#endregion
 export { isAgentPluginArchive, withAgentPluginArchive, withAgentPluginSource };