@xopcai/xopc 0.0.374 → 0.0.375

package/dist/src/tui/extension-host/load-extensions.js

@@ -1,9 +1,9 @@
 import { createLogger } from "../../utils/logger/index.js";
 import { init_logger } from "../../utils/logger.js";
 import { init_paths, resolveExtensionsDir } from "../../config/paths.js";
+import { getWorkspacePath } from "../../config/workspace-path-helpers.js";
 import { ExtensionLoader } from "../../extensions/loader.js";
 import { loadConfig } from "../../config/loader.js";
-import { getWorkspacePath } from "../../config/workspace-path-helpers.js";
 import "../../config/index.js";
 //#region src/tui/extension-host/load-extensions.ts
 init_paths();

package/dist/src/tui/tui-commands.js

@@ -2,8 +2,8 @@ import { closeXopcDatabase, isXopcDatabaseOpen, openXopcDatabase } from "../stor
 import { TaskRepository } from "../tasks/task-repository.js";
 import { getSessionMetadata } from "../storage/sqlite/session-read-repository.js";
 import { init_sqlite } from "../storage/sqlite/index.js";
-import { resolveConfigPath } from "../config/paths.js";
 import { init_agent_session_key, isValidAgentId, normalizeAgentId } from "../routing/agent-session-key.js";
+import { resolveConfigPath } from "../config/paths.js";
 import { init_providers, providerSupportsOAuth } from "../providers/index.js";
 import { ProjectService } from "../projects/project-service.js";
 import { isValidProjectAgentId, normalizeProjectAgentId } from "../projects/project-agent.js";

package/dist/src/tui/tui-skills-autocomplete.js

@@ -1,8 +1,8 @@
 import { resolveStateDir } from "../config/paths-state.js";
 import { init_paths, resolveBundledSkillsDir } from "../config/paths.js";
+import { getWorkspacePath } from "../config/workspace-path-helpers.js";
 import { loadSkills } from "../agent/skills/index.js";
 import { loadConfig } from "../config/loader.js";
-import { getWorkspacePath } from "../config/workspace-path-helpers.js";
 import "../config/index.js";
 //#region src/tui/tui-skills-autocomplete.ts
 init_paths();

package/dist/src/tui/tui-startup-resources.js

@@ -1,12 +1,12 @@
 import { resolveStateDir } from "../config/paths-state.js";
-import { init_paths, resolveAgentProfileDir, resolveBundledSkillsDir } from "../config/paths.js";
 import { resolveEffectiveAgentProfile, resolveEffectiveAgentProfileForSession } from "../config/agent-profile.js";
+import { init_paths, resolveAgentProfileDir, resolveBundledSkillsDir } from "../config/paths.js";
+import { getWorkspacePath } from "../config/workspace-path-helpers.js";
 import { resolveBootstrapFilesSync } from "../agent/bootstrap/bootstrap-files.js";
 import { listConnectorInstances } from "../connectors/instances.js";
 import { createSkillConfigManager, isSkillEnabled } from "../agent/skills/config.js";
 import { loadSkills } from "../agent/skills/index.js";
 import { createWorkflowCatalog } from "../agent/workflow/catalog.js";
-import { getWorkspacePath } from "../config/workspace-path-helpers.js";
 import "../config/index.js";
 import { basename } from "node:path";
 //#region src/tui/tui-startup-resources.ts

package/dist/src/tui/tui.js

@@ -1,8 +1,8 @@
 import { version } from "../../package.js";
 import { resolveStateDir, resolveXopcDatabasePath } from "../config/paths-state.js";
-import { init_paths } from "../config/paths.js";
 import { init_agent_session_key, normalizeAgentId } from "../routing/agent-session-key.js";
 import { resolveEffectiveAgentProfile } from "../config/agent-profile.js";
+import { init_paths } from "../config/paths.js";
 import { getAllModels, getAllProviders, getApiKey, init_providers, isProviderConfiguredSync } from "../providers/index.js";
 import { isTerminalWorkflowRunStatus } from "../workflows/domain/run.js";
 import "../workflows/domain/index.js";

package/dist/src/user-context/access-policy.js

@@ -1,4 +1,5 @@
 import { getSessionConfig, init_config_repository } from "../storage/sqlite/config-repository.js";
+import { isOwnerIdentity } from "./identity-bindings.js";
 import { init_config, resolveKnowledgeReadPolicy } from "./config.js";
 import { getConversationRouting } from "../storage/sqlite/conversation-repository.js";
 import { init_session_key } from "../routing/session-key.js";
@@ -20,7 +21,7 @@ function resolveUserContextSessionAccess(config, conversationId) {
 	};
 	const session = getConversationRouting(conversationId);
 	const mode = getSessionConfig(conversationId)?.userContextMode ?? "enabled";
-	const enabled = Boolean(config.userContext.enabled && session?.peerKind === "direct" && mode === "enabled");
+	const enabled = Boolean(config.userContext.enabled && session?.peerKind === "direct" && isOwnerIdentity(session) && mode === "enabled");
 	return {
 		enabled,
 		userModel: enabled && config.userContext.userModel.enabled,

package/dist/src/user-context/config.d.ts

@@ -115,6 +115,11 @@ export declare const KnowledgeMemoryConfigSchema: z.ZodDefault<z.ZodObject<{
         allow: "allow";
         deny: "deny";
     }>>;
+    learning: z.ZodOptional<z.ZodObject<{
+        idleFlushMs: z.ZodDefault<z.ZodNumber>;
+        maxBatchChars: z.ZodDefault<z.ZodNumber>;
+        maxDailyBatches: z.ZodDefault<z.ZodNumber>;
+    }, z.core.$strict>>;
     readScopes: z.ZodDefault<z.ZodArray<z.ZodEnum<{
         project: "project";
         session: "session";
@@ -244,6 +249,11 @@ export declare const UserContextConfigSchema: z.ZodDefault<z.ZodObject<{
             allow: "allow";
             deny: "deny";
         }>>;
+        learning: z.ZodOptional<z.ZodObject<{
+            idleFlushMs: z.ZodDefault<z.ZodNumber>;
+            maxBatchChars: z.ZodDefault<z.ZodNumber>;
+            maxDailyBatches: z.ZodDefault<z.ZodNumber>;
+        }, z.core.$strict>>;
         readScopes: z.ZodDefault<z.ZodArray<z.ZodEnum<{
             project: "project";
             session: "session";

package/dist/src/user-context/config.js

@@ -150,6 +150,11 @@ var init_config = __esmMin((() => {
 	KnowledgeMemoryConfigSchema = z.object({
 		enabled: z.boolean().default(true),
 		writePolicy: z.enum(["deny", "allow"]).default("allow"),
+		learning: z.object({
+			idleFlushMs: z.number().int().min(1e3).max(6e5).default(6e4),
+			maxBatchChars: z.number().int().min(4e3).max(12e4).default(3e4),
+			maxDailyBatches: z.number().int().min(1).max(1e4).default(100)
+		}).strict().optional(),
 		readScopes: z.array(z.enum([
 			"global",
 			"agent",

package/dist/src/user-context/extraction/registry.d.ts

@@ -1,6 +1,6 @@
 import { type ContextExtractionRun } from '../../storage/sqlite/index.js';
 import type { UnderstandingKind } from '../domain.js';
-export type ExtractorId = 'turn-semantics' | 'transcript-synthesis' | 'connector-semantic';
+export type ExtractorId = 'turn-semantics' | 'transcript-synthesis' | 'source-work-synthesis' | 'connector-semantic';
 export type ExtractorDefinition = {
     id: ExtractorId;
     version: string;

package/dist/src/user-context/extraction/registry.js

@@ -15,6 +15,16 @@ const UNDERSTANDING_KINDS = [
 	"derived_insight"
 ];
 const DEFINITIONS = {
+	"source-work-synthesis": {
+		id: "source-work-synthesis",
+		version: "1",
+		inputKinds: ["file", "connector"],
+		requiredProcessingPolicy: "local_only",
+		authorityCeiling: "external_untrusted",
+		candidateKinds: ["project_context", "task_lesson"],
+		maxAutomaticStatus: "active",
+		timeoutMs: 3e4
+	},
 	"turn-semantics": {
 		id: "turn-semantics",
 		version: "1",

package/dist/src/user-context/identity-bindings.d.ts

@@ -0,0 +1,10 @@
+export declare function bindOwnerIdentity(input: {
+    channel: string;
+    accountId: string;
+    peerId: string;
+}): void;
+export declare function isOwnerIdentity(input: {
+    source: string;
+    accountId: string;
+    peerId: string;
+}): boolean;

package/dist/src/user-context/identity-bindings.js

@@ -0,0 +1,24 @@
+import { getSqliteDatabase, init_transaction } from "../storage/sqlite/transaction.js";
+//#region src/user-context/identity-bindings.ts
+init_transaction();
+function bindOwnerIdentity(input) {
+	if (![
+		input.channel,
+		input.accountId,
+		input.peerId
+	].every((value) => value.trim())) throw new Error("Identity fields are required.");
+	getSqliteDatabase().prepare(`INSERT INTO owner_identity_bindings(principal_id, channel, account_id, peer_id, verified_at)
+    VALUES ('local-owner', ?, ?, ?, ?) ON CONFLICT(channel, account_id, peer_id) DO UPDATE
+    SET verified_at = excluded.verified_at, revoked_at = NULL`).run(input.channel, input.accountId, input.peerId, Date.now());
+}
+function isOwnerIdentity(input) {
+	if ([
+		"webchat",
+		"cli",
+		"tui"
+	].includes(input.source)) return true;
+	return Boolean(getSqliteDatabase().prepare(`SELECT 1 FROM owner_identity_bindings
+    WHERE principal_id = 'local-owner' AND channel = ? AND account_id = ? AND peer_id = ? AND revoked_at IS NULL`).get(input.source, input.accountId, input.peerId));
+}
+//#endregion
+export { bindOwnerIdentity, isOwnerIdentity };

package/dist/src/user-context/sources/consent-fields.d.ts

@@ -0,0 +1,2 @@
+/** Restrict source fields before either model processing or searchable chunk persistence. */
+export declare function consentFilteredText(value: string | undefined, allowedFields: Set<string>): string | undefined;

package/dist/src/user-context/sources/consent-fields.js

@@ -0,0 +1,66 @@
+//#region src/user-context/sources/consent-fields.ts
+const FIELD_KEYS = {
+	title: [
+		"title",
+		"subject",
+		"name",
+		"fullName",
+		"repository"
+	],
+	content: [
+		"content",
+		"body",
+		"text",
+		"snippet",
+		"description",
+		"summary"
+	],
+	participants: [
+		"from",
+		"to",
+		"cc",
+		"bcc",
+		"sender",
+		"author",
+		"organizer",
+		"attendees",
+		"participants",
+		"assignee",
+		"owners"
+	],
+	status: [
+		"status",
+		"state",
+		"labels"
+	],
+	timestamps: [
+		"createdAt",
+		"updatedAt",
+		"modifiedAt",
+		"start",
+		"end",
+		"created_at",
+		"updated_at",
+		"modified_at"
+	],
+	owner_activity: [
+		"user",
+		"username",
+		"owner"
+	]
+};
+/** Restrict source fields before either model processing or searchable chunk persistence. */
+function consentFilteredText(value, allowedFields) {
+	if (!value) return;
+	try {
+		const parsed = JSON.parse(value);
+		if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) return;
+		const keys = new Set([...allowedFields].flatMap((field) => FIELD_KEYS[field] ?? []));
+		const selected = Object.entries(parsed).filter(([key]) => keys.has(key));
+		return selected.length ? JSON.stringify(Object.fromEntries(selected)) : void 0;
+	} catch {
+		return !/^\s*[\[{]/.test(value) && allowedFields.has("content") ? value : void 0;
+	}
+}
+//#endregion
+export { consentFilteredText };

package/dist/src/user-model/bootstrap.js

@@ -1,6 +1,6 @@
 import { createCollaborationRule, init_collaboration_rule_repository, listCollaborationRules } from "../storage/sqlite/collaboration-rule-repository.js";
-import { reconcileAssertion } from "./repository.js";
 import { createPriorityWindow, createUserGoal, listPriorityWindows, listUserGoals } from "./goals.js";
+import { reconcileAssertion } from "./repository.js";
 import { applyUserProfilePatch } from "./profile.js";
 //#region src/user-model/bootstrap.ts
 init_collaboration_rule_repository();

package/dist/src/user-model/capture/executor.js

@@ -1,7 +1,7 @@
 import { createCollaborationRule, init_collaboration_rule_repository, listCollaborationRules } from "../../storage/sqlite/collaboration-rule-repository.js";
 import { createContextEvidence, init_context_evidence_repository } from "../../storage/sqlite/context-evidence-repository.js";
-import { deleteUserAssertion, getAssertionSlot, getUserAssertion, linkAssertionEvidence, mergeAssertionObservation, reconcileAssertion, setAssertionStatus } from "../repository.js";
 import { createUserGoal, listUserGoals } from "../goals.js";
+import { deleteUserAssertion, getAssertionSlot, getUserAssertion, linkAssertionEvidence, mergeAssertionObservation, reconcileAssertion, setAssertionStatus } from "../repository.js";
 import { createHash } from "node:crypto";
 //#region src/user-model/capture/executor.ts
 init_context_evidence_repository();

package/dist/src/user-model/capture/semantic.d.ts

@@ -1,9 +1,10 @@
+import { type WorkCandidate } from '../../memory-learning/work-capture.js';
 import type { AssertionCandidate } from '../domain.js';
 export declare const USER_MODEL_CAPTURE_INTENTS: readonly ["remember", "query", "confirm", "correct", "forget", "user_assertion", "task", "none"];
 export type UserModelCaptureIntent = typeof USER_MODEL_CAPTURE_INTENTS[number];
 export interface CaptureEvidence {
     ref: string;
-    role: 'user' | 'assistant';
+    role: 'user' | 'assistant' | 'toolResult';
     text: string;
     createdAt: number;
 }
@@ -32,6 +33,7 @@ export interface ParsedCollaborationRuleCandidate {
     evidenceRefs: string[];
 }
 export interface UserModelInterpretation {
+    knowledge?: WorkCandidate[];
     intent: UserModelCaptureIntent;
     assertions: ParsedAssertionOperation[];
     goals?: ParsedGoalCandidate[];

package/dist/src/user-model/capture/semantic.js

@@ -1,3 +1,4 @@
+import { WorkCandidateSchema } from "../../memory-learning/work-capture.js";
 import { z } from "zod";
 //#region src/user-model/capture/semantic.ts
 const USER_MODEL_CAPTURE_INTENTS = [
@@ -30,6 +31,7 @@ const ScopeSchema = z.object({
 	});
 });
 const AssertionOperationSchema = z.object({
+	intent: z.enum(USER_MODEL_CAPTURE_INTENTS).optional(),
 	action: z.enum([
 		"create",
 		"merge",
@@ -122,6 +124,7 @@ const AssertionOperationSchema = z.object({
 	});
 });
 const GroundingSchema = z.object({
+	intent: z.enum(USER_MODEL_CAPTURE_INTENTS).optional(),
 	evidence: z.array(z.object({
 		ref: z.string().min(1),
 		quote: z.string().min(1)
@@ -150,6 +153,7 @@ const CollaborationRuleSchema = z.object({
 	statement: z.string().min(4).max(600)
 }).merge(GroundingSchema).strict();
 const InterpretationSchema = z.object({
+	knowledge: z.array(WorkCandidateSchema).max(8).default([]),
 	intent: z.enum(USER_MODEL_CAPTURE_INTENTS),
 	assertions: z.array(AssertionOperationSchema).max(8),
 	goals: z.array(GoalSchema).max(4).default([]),
@@ -198,7 +202,8 @@ function parseUserModelInterpretation(raw, evidence, allowedTargetIds = []) {
 	]);
 	const allowed = new Set(allowedTargetIds);
 	const assertions = [];
-	if (assertionIntents.has(parsed.intent)) for (const item of parsed.assertions) {
+	for (const item of parsed.assertions) {
+		if (!assertionIntents.has(item.intent ?? parsed.intent)) continue;
 		const evidenceRefs = groundedEvidenceRefs(item, evidenceByRef);
 		if (!evidenceRefs) continue;
 		if (item.action !== "create" && (!item.targetAssertionId || !allowed.has(item.targetAssertionId))) continue;
@@ -214,7 +219,7 @@ function parseUserModelInterpretation(raw, evidence, allowedTargetIds = []) {
 			value: item.value,
 			normalizedValue: item.normalizedValue,
 			statement: item.statement,
-			authority: effectiveAuthority(parsed.intent, item.authority),
+			authority: effectiveAuthority(item.intent ?? parsed.intent, item.authority),
 			confidence: item.confidence,
 			...item.declaredImportance === void 0 ? {} : { declaredImportance: item.declaredImportance },
 			inferredImportance: item.inferredImportance,
@@ -242,7 +247,8 @@ function parseUserModelInterpretation(raw, evidence, allowedTargetIds = []) {
 		"correct",
 		"user_assertion"
 	]);
-	const goals = structuredIntents.has(parsed.intent) ? parsed.goals.flatMap((item) => {
+	const goals = parsed.goals.flatMap((item) => {
+		if (!structuredIntents.has(item.intent ?? parsed.intent)) return [];
 		const evidenceRefs = groundedEvidenceRefs(item, evidenceByRef);
 		if (!evidenceRefs) return [];
 		return [{
@@ -253,8 +259,9 @@ function parseUserModelInterpretation(raw, evidence, allowedTargetIds = []) {
 			...item.targetAt === void 0 ? {} : { targetAt: parseTime(item.targetAt) },
 			evidenceRefs
 		}];
-	}) : [];
-	const collaborationRules = structuredIntents.has(parsed.intent) ? parsed.collaborationRules.flatMap((item) => {
+	});
+	const collaborationRules = parsed.collaborationRules.flatMap((item) => {
+		if (!structuredIntents.has(item.intent ?? parsed.intent)) return [];
 		const evidenceRefs = groundedEvidenceRefs(item, evidenceByRef);
 		if (!evidenceRefs || item.scope.type === "agent") return [];
 		return [{
@@ -265,8 +272,9 @@ function parseUserModelInterpretation(raw, evidence, allowedTargetIds = []) {
 			statement: item.statement,
 			evidenceRefs
 		}];
-	}) : [];
+	});
 	return {
+		knowledge: parsed.knowledge,
 		intent: parsed.intent,
 		assertions,
 		goals,

package/dist/src/user-model/index.js

@@ -1,9 +1,9 @@
 import { PERSONAL_DOMAINS, USER_MODEL_PRINCIPAL_ID, defaultAssertionDomain, defaultAssertionLayer, init_domain, validateCandidate, validateScope } from "./domain.js";
+import { createPriorityWindow, createUserGoal, listPriorityWindows, listUserGoals, setUserGoalStatus, updatePriorityWindow, updateUserGoal } from "./goals.js";
 import { defaultReviewAt, isAssertionValidAt, requiresBoundedValidity, resolveCurrentAssertion } from "./temporal.js";
 import { deleteUserAssertion, getActiveAssertionByPredicate, getActiveAssertionForSlot, getAssertionSlot, getUserAssertion, getUserTimezone, linkAssertionEvidence, listSlotAssertions, listUserAssertionSources, listUserAssertions, mergeAssertionObservation, reconcileAssertion, setAssertionStatus, setUserAssertionScope } from "./repository.js";
 import { listActionRuleSuggestions } from "./action-rule-suggestions.js";
 import { calculateExecutionValue } from "./importance.js";
-import { createPriorityWindow, createUserGoal, listPriorityWindows, listUserGoals, setUserGoalStatus, updatePriorityWindow, updateUserGoal } from "./goals.js";
 import { deleteUserModelObservationsForGrant, linkUserAssertions, listUserAssertionEdges, listUserModelObservations, recordUserModelObservation } from "./observation-repository.js";
 import { applyUserProfilePatch, getUserProfileSnapshot } from "./profile.js";
 import { bootstrapUserModel } from "./bootstrap.js";

package/dist/src/user-model/usage-policy.js

@@ -1,9 +1,43 @@
+import { isXopcDatabaseOpen } from "../storage/sqlite/connection.js";
+import { getSqliteDatabase, init_transaction } from "../storage/sqlite/transaction.js";
+import { getSessionMetadata } from "../storage/sqlite/session-read-repository.js";
+import { init_session_repository } from "../storage/sqlite/session-repository.js";
+import { init_sqlite } from "../storage/sqlite/index.js";
+import { getUnderstandingConsent } from "../user-context/sources/consent-repository.js";
+import { isOwnerIdentity } from "../user-context/identity-bindings.js";
 //#region src/user-model/usage-policy.ts
+init_sqlite();
+init_transaction();
+init_session_repository();
 /** Automatic personalization never grants execution authority. */
 function isWorkingAssumption(assertion) {
 	return (assertion.status === "candidate" || assertion.status === "active") && (assertion.authority === "user_observed" || assertion.authority === "system_inferred") && assertion.confidence >= .7 && (assertion.consequence === "low" || assertion.consequence === "medium") && assertion.sensitivity === "normal" && assertion.disclosurePolicy !== "ask_before_reference";
 }
 function canUseAssertion(assertion, asOf = Date.now(), context = {}) {
+	if (assertion.consentReceiptId) {
+		if (!isXopcDatabaseOpen()) return false;
+		const consent = getUnderstandingConsent(assertion.consentReceiptId);
+		if (!consent || consent.revokedAt !== void 0 || !consent.allowedDomains.includes(assertion.domain)) return false;
+		if (!getSqliteDatabase().prepare("SELECT 1 FROM understanding_source_grants WHERE grant_id = ? AND status = 'active'").get(consent.grantId)) return false;
+	}
+	if (isXopcDatabaseOpen() && assertion.id) {
+		const db = getSqliteDatabase();
+		const evidence = db.prepare(`SELECT e.source_type, e.source_item_id, e.conversation_id, e.content_hash,
+      link.content_hash AS linked_hash FROM user_assertion_evidence link JOIN context_evidence e ON e.evidence_id = link.evidence_id
+      WHERE link.assertion_id = ? AND link.relation = 'supports'`).all(assertion.id);
+		if (assertion.createdBy === "connector" && (!assertion.consentReceiptId || !evidence.length)) return false;
+		for (const link of evidence) {
+			if (link.conversation_id) {
+				const session = getSessionMetadata(link.conversation_id);
+				if (!session?.routing || session.routing.peerKind !== "direct" || !isOwnerIdentity(session.routing)) return false;
+			}
+			if (link.source_type === "connector") {
+				if (!link.source_item_id || !link.linked_hash || link.linked_hash !== link.content_hash) return false;
+				const source = db.prepare("SELECT content_hash, deleted_at FROM knowledge_source_items WHERE item_id = ?").get(link.source_item_id);
+				if (!source || source.deleted_at || source.content_hash !== link.linked_hash) return false;
+			}
+		}
+	}
 	return (assertion.validFrom === void 0 || assertion.validFrom <= asOf) && (assertion.validTo === void 0 || assertion.validTo >= asOf) && (assertion.deleteAfter === void 0 || assertion.deleteAfter > asOf) && (assertion.reviewAt === void 0 || assertion.reviewAt > asOf) && (!context.use || !assertion.allowedUses || assertion.allowedUses.includes(context.use)) && (!assertion.allowedAgentIds || Boolean(context.agentId && assertion.allowedAgentIds.includes(context.agentId))) && assertion.sensitivity !== "secret" && assertion.sensitivity !== "regulated" && assertion.disclosurePolicy !== "ask_before_reference" && (assertion.status === "active" && assertion.authority === "user_explicit" || isWorkingAssumption(assertion));
 }
 //#endregion

package/dist/src/voice/platform-streams.js

@@ -10,6 +10,7 @@ var PlatformVoiceError = class extends Error {
 		this.name = "PlatformVoiceError";
 	}
 	get clientMessage() {
+		if (this.code === "realtime_quota_session_limit") return "The funded transcription duration has been reached. Start a new voice session to continue.";
 		if (this.code === "realtime_quota_workspace_budget") return "XOPC Cloud voice workspace budget is exhausted. Increase the workspace budget or choose another voice provider.";
 		if (this.status === 402 || this.code === "realtime_quota_user_credits") return "XOPC Cloud voice has insufficient Credit or quota. Check your Cloud balance and workspace budget, or choose another voice provider.";
 		if (this.status === 401 || this.status === 403) return "XOPC Cloud voice authorization failed. Sign in again and check your access to this voice model.";

package/dist/src/voice/realtime/memory-context.js

@@ -3,16 +3,20 @@ import { init_logger } from "../../utils/logger.js";
 import { getSessionMetadata } from "../../storage/sqlite/session-read-repository.js";
 import { init_session_repository } from "../../storage/sqlite/session-repository.js";
 import { getSessionConfig, init_config_repository } from "../../storage/sqlite/config-repository.js";
+import { canUseKnowledge } from "../../knowledge-memory/usage-policy.js";
+import { getKnowledgeItem } from "../../knowledge-memory/repository.js";
+import { init_config, resolveKnowledgeReadPolicy } from "../../user-context/config.js";
 import { getConversationRouting } from "../../storage/sqlite/conversation-repository.js";
 import { getConversation } from "../../routing/agent-session-key.js";
 import { init_session_key } from "../../routing/session-key.js";
-import { getKnowledgeItem } from "../../knowledge-memory/repository.js";
+import { resolveUserContextSessionAccess } from "../../user-context/access-policy.js";
 import "../../knowledge-memory/index.js";
+import { stripRuntimeContextFromUserMessage } from "../../session/user-message-display.js";
 import { getUserAssertion } from "../../user-model/repository.js";
 import "../../user-model/index.js";
-import { stripRuntimeContextFromUserMessage } from "../../session/user-message-display.js";
 import { buildExecutionContext } from "../../agent/context/execution-context.js";
 //#region src/voice/realtime/memory-context.ts
+init_config();
 init_session_key();
 init_config_repository();
 init_session_repository();
@@ -35,7 +39,7 @@ function buildVoiceMemoryContext(input) {
 	const started = performance.now();
 	try {
 		const config = input.getConfig();
-		if (!voiceMemoryEnabled(config, input.conversationId) || input.maxChars < 128) return;
+		if (!resolveUserContextSessionAccess(config, input.conversationId).userModel || !voiceMemoryEnabled(config, input.conversationId) || input.maxChars < 128) return;
 		const session = getSessionMetadata(input.conversationId);
 		const context = buildExecutionContext({
 			query: voiceMemoryQuery(input.history),
@@ -44,7 +48,9 @@ function buildVoiceMemoryContext(input) {
 			projectId: input.projectId,
 			conversationId: input.conversationId,
 			maxAssertions: 6,
-			maxKnowledge: 3
+			maxKnowledge: 3,
+			includeKnowledge: resolveUserContextSessionAccess(config, input.conversationId).knowledge,
+			knowledgePolicy: resolveKnowledgeReadPolicy(config.userContext.knowledgeMemory)
 		});
 		const block = JSON.stringify({ backgroundMemory: {
 			userFacts: context.assertions.map((item) => item.assertion.statement),
@@ -64,7 +70,15 @@ function buildVoiceMemoryContext(input) {
 		const configVersion = JSON.stringify(config.userContext);
 		const isCurrent = () => {
 			if (!voiceMemoryEnabled(input.getConfig(), input.conversationId) || JSON.stringify(input.getConfig().userContext) !== configVersion) return false;
-			return references.every((reference) => reference.kind === "assertion" ? getUserAssertion(reference.id)?.recordedAt === reference.updatedAt : getKnowledgeItem(reference.id)?.updatedAt === reference.updatedAt);
+			return references.every((reference) => reference.kind === "assertion" ? getUserAssertion(reference.id)?.recordedAt === reference.updatedAt : (() => {
+				const item = getKnowledgeItem(reference.id);
+				return Boolean(item && item.updatedAt === reference.updatedAt && canUseKnowledge(item, {
+					agentId: session?.routing?.agentId ?? "main",
+					workspaceId: input.workspaceId,
+					projectId: input.projectId,
+					conversationId: input.conversationId
+				}, resolveKnowledgeReadPolicy(input.getConfig().userContext.knowledgeMemory)));
+			})());
 		};
 		log.debug({
 			conversationId: input.conversationId,

package/dist/src/voice/realtime/persona-context.js

@@ -1,6 +1,6 @@
 import { init_agent_scope, resolveAgentProfileDir } from "../../agent/agent-scope.js";
-import { DEFAULT_SOUL_FILENAME } from "../../agent/context/workspace.js";
 import { resolveEffectiveAgentProfileForSession } from "../../config/agent-profile.js";
+import { DEFAULT_SOUL_FILENAME } from "../../agent/context/workspace.js";
 import { loadProfileBootstrapFiles } from "../../agent/bootstrap/load-bootstrap-files.js";
 import { join } from "node:path";
 import { statSync } from "node:fs";

package/dist/src/work-discovery/incremental-repository.js

@@ -1,5 +1,5 @@
-import { getWorkDiscoveryRun } from "./repository.js";
 import { createUnderstandingSourceRun, listUnderstandingSourceGrants, listUnderstandingSourceRuns, updateUnderstandingSourceRun } from "../user-context/sources/repository.js";
+import { getWorkDiscoveryRun } from "./repository.js";
 import { workDiscoveryFingerprintsEqual } from "./incremental.js";
 //#region src/work-discovery/incremental-repository.ts
 function refreshFromRun(run) {

package/dist/src/work-discovery/service.js

@@ -5,19 +5,19 @@ import { createContextEvidence, init_context_evidence_repository } from "../stor
 import { ensureSessionRecord, patchSessionMetadata } from "../storage/sqlite/session-repository.js";
 import { init_sqlite } from "../storage/sqlite/index.js";
 import { ActivityService } from "../activity/service.js";
-import { getAgentDefaultModelRef, init_schema } from "../config/schema.js";
+import { createUnderstandingSourceRun, getUnderstandingSourceGrant, getUnderstandingSourceRun, updateUnderstandingSourceGrantCheckpoint, updateUnderstandingSourceGrantPolicies, updateUnderstandingSourceRun, upsertUnderstandingSourceGrant } from "../user-context/sources/repository.js";
+import { writeKnowledgeItem } from "../knowledge-memory/repository.js";
 import { init_session_key, resolveConversationId } from "../routing/session-key.js";
+import "../knowledge-memory/index.js";
 import { getDefaultAgentId, init_resolve_route } from "../routing/resolve-route.js";
 import { resolveEffectiveAgentProfile } from "../config/agent-profile.js";
+import { getAgentDefaultModelRef, init_schema } from "../config/schema.js";
 import { init_providers, resolveModel } from "../providers/index.js";
-import { writeKnowledgeItem } from "../knowledge-memory/repository.js";
-import "../knowledge-memory/index.js";
-import { linkAssertionEvidence, reconcileAssertion } from "../user-model/repository.js";
+import { isLocalModelBaseUrl } from "../providers/model-call.js";
 import { createPriorityWindow, createUserGoal } from "../user-model/goals.js";
+import { linkAssertionEvidence, reconcileAssertion } from "../user-model/repository.js";
 import "../user-model/index.js";
 import { createWorkDiscoveryRun, getProjectUnderstandingRun, getWorkDiscoveryOnboardingState, getWorkDiscoveryRun, getWorkDiscoveryRunByIdempotencyKey, listPendingProjectUnderstandingRuns, setWorkDiscoveryFeedback, setWorkDiscoveryOnboardingState, updateWorkDiscoveryRun } from "./repository.js";
-import { isLocalModelBaseUrl } from "../providers/model-call.js";
-import { createUnderstandingSourceRun, getUnderstandingSourceGrant, getUnderstandingSourceRun, updateUnderstandingSourceGrantCheckpoint, updateUnderstandingSourceGrantPolicies, updateUnderstandingSourceRun, upsertUnderstandingSourceGrant } from "../user-context/sources/repository.js";
 import { allowsRemoteSourceProcessing } from "../user-context/sources/processing-policy.js";
 import { analyzeUnderstandingSources, analyzeWorkContext, workDiscoveryResultMarkdown } from "./analyzer.js";
 import { clusterActivityTopics } from "../user-context/sources/activity-clustering.js";

package/dist/src/workflows/service/workflow-run-service.js

@@ -3,6 +3,7 @@ import { TaskRunRepository, init_task_run_repository } from "../../tasks/task-ru
 import { init_conversation_repository, resolveRoutedConversation } from "../../storage/sqlite/conversation-repository.js";
 import { getDefaultAgentId, init_resolve_route } from "../../routing/resolve-route.js";
 import { extractProfileAgentId, resolveEffectiveAgentProfile, resolveEffectiveAgentProfileForSession } from "../../config/agent-profile.js";
+import { resolveModelSelector } from "../../config/agent-model-intents.js";
 import { init_providers, resolveModel } from "../../providers/index.js";
 import { getProjectWorkspacePathForSession } from "../../projects/workspace.js";
 import { TaskConversationRepository } from "../../tasks/task-conversation-repository.js";
@@ -12,7 +13,6 @@ import { validateWorkflowJsonSchema } from "../domain/schema-validation.js";
 import "../domain/index.js";
 import { TaskContextRepository } from "../../tasks/task-context-repository.js";
 import { TaskApplicationService } from "../../tasks/task-application-service.js";
-import { resolveModelSelector } from "../../config/agent-model-intents.js";
 import { DelegateSubagentRunner } from "../../agent/workflow/subagent-runner.js";
 import { preflightWorkflowConnectors } from "../../connectors/workflow-preflight.js";
 import { CatalogWorkflowDefinitionRegistry } from "../registry/catalog-workflow-definition-registry.js";