@xopcai/xopc 0.0.374 → 0.0.376

package/dist/src/agent/memory/compaction-promotion.js

@@ -1,8 +1,11 @@
+import { createContextEvidence, init_context_evidence_repository } from "../../storage/sqlite/context-evidence-repository.js";
+import { inferMemorySensitivity } from "./sensitivity.js";
 import { listKnowledgeItems, transitionKnowledgeStatus, writeKnowledgeItem } from "../../knowledge-memory/repository.js";
 import "../../knowledge-memory/index.js";
 import { resolveMemorySessionKind } from "./turn-provenance.js";
 import { createHash } from "node:crypto";
 //#region src/agent/memory/compaction-promotion.ts
+init_context_evidence_repository();
 const DURABLE_KINDS = new Set([
 	"objective",
 	"decision",
@@ -117,9 +120,29 @@ function promoteCompactionLedger(input) {
 	};
 	const sessionKind = resolveMemorySessionKind(input.conversationId);
 	for (const item of input.handover.items) {
+		const sensitivity = inferMemorySensitivity(item.text);
+		if (sensitivity === "secret" || sensitivity === "regulated") continue;
 		const classified = classifyItemProvenance(item, sourceById, entriesByTurn, entriesByRound);
 		const originClass = sessionKind === "automation" || sessionKind === "workflow" || sessionKind === "background" ? "system" : sessionKind === "group" ? "untrusted" : classified.originClass;
 		const active = item.status === "active";
+		const supportingSources = item.sources.flatMap((ref) => sourceById.get(ref.entryId) ?? []);
+		const independentlySupported = supportingSources.some((entry) => rowRole(entry) === "user") || supportingSources.some((entry) => entriesByRound.get(entry.entryId)?.some((peer) => rowRole(peer) === "user"));
+		const supported = originClass === "agent" && independentlySupported && !classified.derivedFromRecalledContext;
+		const evidence = supportingSources.map((entry) => {
+			const hash = createHash("sha256").update(JSON.stringify(entry.row)).digest("hex");
+			return {
+				id: createContextEvidence({
+					sourceType: "conversation",
+					sourceRef: `compaction:${input.transcriptId}:entry:${entry.entryId}`,
+					conversationId: input.conversationId,
+					messageId: entry.entryId,
+					contentHash: hash,
+					trustLevel: "trusted",
+					observedAt: entry.createdAt
+				}).id,
+				contentHash: hash
+			};
+		});
 		const episode = writeKnowledgeItem({
 			kind: KNOWLEDGE_KIND_BY_HANDOVER_KIND[item.kind],
 			scope: {
@@ -129,7 +152,11 @@ function promoteCompactionLedger(input) {
 			content: item.text,
 			canonicalKey: `compaction:${input.transcriptId}:${item.id}`,
 			confidence: input.audit.status === "passed" ? .82 : .65,
-			status: active ? originClass !== "untrusted" && !classified.derivedFromRecalledContext ? "active" : "candidate" : "archived",
+			evidence,
+			sensitivity,
+			claimMode: "observed",
+			verification: supported ? "supported" : "tentative",
+			status: active ? supported ? "active" : "candidate" : "archived",
 			importance: importanceFor(item),
 			originClass,
 			sourceAgentId: input.sourceAgentId,
@@ -145,7 +172,7 @@ function promoteCompactionLedger(input) {
 		});
 		if (!episode.item) continue;
 		result.episodicRecordIds.push(episode.item.id);
-		if (!(active && input.audit.status === "passed" && sessionKind === "interactive" && originClass === "agent" && !classified.derivedFromRecalledContext && DURABLE_KINDS.has(item.kind))) {
+		if (!(active && input.audit.status === "passed" && sessionKind === "interactive" && originClass === "agent" && supported && (!input.readPolicy || input.readPolicy.scopes.includes(input.projectId ? "project" : "workspace")) && !classified.derivedFromRecalledContext && DURABLE_KINDS.has(item.kind))) {
 			const existingDurable = !active ? listKnowledgeItems({ limit: 2e3 }).find((entry) => entry.canonicalKey === `durable:${item.kind}:${stableId("fact", item.text)}`) : void 0;
 			if (existingDurable?.sourceConversationId === input.conversationId) transitionKnowledgeStatus({
 				id: existingDurable.id,
@@ -169,6 +196,10 @@ function promoteCompactionLedger(input) {
 			content: item.text,
 			canonicalKey: `durable:${item.kind}:${stableId("fact", item.text)}`,
 			confidence: .82,
+			evidence,
+			sensitivity,
+			claimMode: "observed",
+			verification: "supported",
 			status: "active",
 			importance: importanceFor(item),
 			originClass: "agent",

package/dist/src/agent/service.js

@@ -3,22 +3,22 @@ import { init_logger } from "../utils/logger.js";
 import { init_attachment_ref, parseNoteAttachmentTarget } from "../notes/attachment-ref.js";
 import { init_agent_scope, resolveAgentHomeDir, resolveDefaultAgentId } from "./agent-scope.js";
 import { extractTextContent } from "./context/workspace.js";
-import { configureTracing, flushTracing } from "../observability/runtime.js";
-import { getAgentDefaultModelRef, init_schema } from "../config/schema.js";
-import { applyConfigOverrides } from "../config/runtime-overrides.js";
 import { init_agent_session_key, resolveAgentIdFromConversationId } from "../routing/agent-session-key.js";
 import { extractProfileAgentId, resolveEffectiveAgentConfigForSession } from "../config/agent-profile.js";
+import { getAgentDefaultModelRef, init_schema } from "../config/schema.js";
 import { init_providers, resolveModel } from "../providers/index.js";
+import { configureTracing, flushTracing } from "../observability/runtime.js";
+import { getUserTimezone } from "../user-model/repository.js";
+import { resolveAgentTurnTimeoutMs } from "./orchestration/run-agent-turn-with-timeout.js";
+import { applyConfigOverrides } from "../config/runtime-overrides.js";
 import { effectiveWorkspacePathForSession } from "../session/session-workspace.js";
 import { getProjectForSession } from "../projects/workspace.js";
-import { getUserTimezone } from "../user-model/repository.js";
 import "../user-model/index.js";
 import { runWithEmbeddedExecutionSession } from "./embedded/execution-context.js";
 import { removeSkillsLockEntry } from "./skills/hub-lock.js";
 import { installSkillFromZip } from "./skills/managed-store.js";
 import { resolveWorkspaceSkillsDir, resolveWorkspaceSkillsLockPath } from "./skills/workspace-skills-dir.js";
 import { pullSkillFromSource } from "./skills/hub-pull.js";
-import { resolveAgentTurnTimeoutMs } from "./orchestration/run-agent-turn-with-timeout.js";
 import { onSessionTranscriptUpdate } from "../session/transcript-events.js";
 import { persistInboundAttachments } from "../channels/attachments/inbound-persist.js";
 import { buildTranscriptUserMessage, hydrateUserTurnForLlm } from "./inbound/attachment-pipeline.js";

package/dist/src/agent/tasks/task-judge-service.js

@@ -2,13 +2,13 @@ import { createLogger } from "../../utils/logger/index.js";
 import { init_logger } from "../../utils/logger.js";
 import { TaskRepository, init_task_repository } from "../../tasks/task-repository.js";
 import { TaskRunRepository, init_task_run_repository } from "../../tasks/task-run-repository.js";
-import { getAgentDefaultModelRef, init_schema } from "../../config/schema.js";
 import { resolveEffectiveAgentProfileForSession } from "../../config/agent-profile.js";
+import { getAgentDefaultModelRef, init_schema } from "../../config/schema.js";
 import { getApiKey, init_providers, resolveModel } from "../../providers/index.js";
-import { TaskConversationRepository } from "../../tasks/task-conversation-repository.js";
-import { readWorkspaceRevision } from "../coding/workspace-revision.js";
 import { completeWithResolvedCredentials } from "../../providers/model-call.js";
 import { extractAssistantText, getAssistantMessageErrorReason, stripCodeFences } from "../../providers/model-response.js";
+import { TaskConversationRepository } from "../../tasks/task-conversation-repository.js";
+import { readWorkspaceRevision } from "../coding/workspace-revision.js";
 import { TaskApplicationService } from "../../tasks/task-application-service.js";
 //#region src/agent/tasks/task-judge-service.ts
 init_schema();

package/dist/src/agent/tools/factory.js

@@ -9,8 +9,8 @@ import { patchSessionMetadata } from "../../storage/sqlite/session-repository.js
 import { getSessionTaskPlan, setSessionTaskPlan } from "../../storage/sqlite/session-task-plan-repository.js";
 import { init_sqlite } from "../../storage/sqlite/index.js";
 import { init_agent_scope, resolveDefaultAgentId } from "../agent-scope.js";
-import { resolveEffectiveAgentConfigForAgent, resolveEffectiveAgentConfigForSession } from "../../config/agent-profile.js";
 import { resolveUserContextSessionAccess } from "../../user-context/access-policy.js";
+import { resolveEffectiveAgentConfigForAgent, resolveEffectiveAgentConfigForSession } from "../../config/agent-profile.js";
 import { createPersonalAttentionTool } from "./personal-attention-tool.js";
 import { markCodemodeCoreRead } from "./codemode-permissions.js";
 import "../../../packages/browser-control-contract/src/index.js";

package/dist/src/agent/tools/knowledge-memory-tool.js

@@ -1,4 +1,6 @@
-import { getKnowledgeItem, isKnowledgeCurrent, knowledgeItemAllowed, searchKnowledgeItems, writeKnowledgeItem } from "../../knowledge-memory/repository.js";
+import { inferMemorySensitivity } from "../memory/sensitivity.js";
+import { canUseKnowledge } from "../../knowledge-memory/usage-policy.js";
+import { getKnowledgeItem, searchKnowledgeItems, writeKnowledgeItem } from "../../knowledge-memory/repository.js";
 import "../../knowledge-memory/index.js";
 import { Type } from "@sinclair/typebox";
 //#region src/agent/tools/knowledge-memory-tool.ts
@@ -75,9 +77,6 @@ function createKnowledgeSearchTool(options) {
 		}
 	};
 }
-function visibleItem(options, item) {
-	return item.scope.type === "global" || item.scope.type === "agent" && item.scope.id === options.agentId || item.scope.type === "workspace" && item.scope.id === options.workspaceId || item.scope.type === "project" && item.scope.id === options.getProjectId?.() || item.scope.type === "session" && item.scope.id === options.getSessionId();
-}
 function createKnowledgeGetTool(options) {
 	return {
 		name: "knowledge_get",
@@ -95,7 +94,7 @@ function createKnowledgeGetTool(options) {
 			};
 			const id = raw.id;
 			const item = getKnowledgeItem(id);
-			return item && isKnowledgeCurrent(item) && visibleItem(options, item) && knowledgeItemAllowed(item, options.getReadPolicy()) ? {
+			return item && canUseKnowledge(item, visibility(options), options.getReadPolicy()) ? {
 				content: [{
 					type: "text",
 					text: JSON.stringify(item, null, 2)
@@ -140,6 +139,13 @@ function createKnowledgeWriteTool(options) {
 				details: { error: "knowledge_write_denied" }
 			};
 			const input = raw;
+			if (["secret", "regulated"].includes(inferMemorySensitivity(input.content))) return {
+				content: [{
+					type: "text",
+					text: "Sensitive credentials or regulated information cannot be stored as work knowledge."
+				}],
+				details: { error: "sensitive_knowledge_denied" }
+			};
 			if (!options.getReadPolicy().scopes.includes(input.scope) || !options.getReadPolicy().contentSources.includes("memory")) return {
 				content: [{
 					type: "text",
@@ -169,7 +175,9 @@ function createKnowledgeWriteTool(options) {
 					},
 					content: input.content,
 					canonicalKey: input.canonicalKey,
-					status: "active",
+					status: "candidate",
+					verification: "tentative",
+					claimMode: "inferred",
 					confidence: .7,
 					importance: input.importance ?? .5,
 					originClass: "agent",

package/dist/src/auth/credentials.js

@@ -2,11 +2,11 @@ import { __esmMin } from "../../_virtual/_rolldown/runtime.js";
 import { createLogger } from "../utils/logger/index.js";
 import { init_logger } from "../utils/logger.js";
 import { init_write_file_atomic, writeTextAtomic } from "../infra/write-file-atomic.js";
-import { getApiKeyFromEnv, init_env_keys } from "../providers/env-keys.js";
 import { init_paths, resolveAgentAuthProfilesPath, resolveAuthProfilesPath, resolveCredentialsDir, resolveOAuthPath } from "../config/paths.js";
+import { assertCurrentModelProvider, init_provider_policy } from "../providers/provider-policy.js";
+import { getApiKeyFromEnv, init_env_keys } from "../providers/env-keys.js";
 import { init_oauth_provider_lock, withOAuthProviderLock } from "./oauth-provider-lock.js";
 import { getOAuthProviderDefinition, init_registry } from "./oauth/registry.js";
-import { assertCurrentModelProvider, init_provider_policy } from "../providers/provider-policy.js";
 import { dirname, join } from "path";
 import { mkdir, readFile, readdir, rm } from "fs/promises";
 //#region src/auth/credentials.ts

package/dist/src/auth/model-credential-store.js

@@ -1,6 +1,6 @@
 import { __esmMin } from "../../_virtual/_rolldown/runtime.js";
-import { init_oauth_provider_lock, withOAuthProviderLock } from "./oauth-provider-lock.js";
 import { assertCurrentModelProvider, init_provider_policy, isRetiredModelProvider } from "../providers/provider-policy.js";
+import { init_oauth_provider_lock, withOAuthProviderLock } from "./oauth-provider-lock.js";
 import { CredentialResolver, init_credentials } from "./credentials.js";
 //#region src/auth/model-credential-store.ts
 function normalizeProviderId(providerId) {

package/dist/src/auth/sync-provider-auth.js

@@ -1,8 +1,8 @@
 import { __esmMin } from "../../_virtual/_rolldown/runtime.js";
+import { getDefaultAgentId, init_resolve_route } from "../routing/resolve-route.js";
 import { init_paths, resolveAgentAuthProfilesPath, resolveAuthProfilesPath, resolveOAuthPath } from "../config/paths.js";
-import { init_registry, isOAuthOnlyProvider } from "./oauth/registry.js";
 import { assertCurrentModelProvider, init_provider_policy } from "../providers/provider-policy.js";
-import { getDefaultAgentId, init_resolve_route } from "../routing/resolve-route.js";
+import { init_registry, isOAuthOnlyProvider } from "./oauth/registry.js";
 import { existsSync, readFileSync } from "node:fs";
 //#region src/auth/sync-provider-auth.ts
 /**

package/dist/src/automations/draft/automation-draft-service.js

@@ -1,9 +1,9 @@
 import { createLogger } from "../../utils/logger/index.js";
 import { init_logger } from "../../utils/logger.js";
 import { getAgentDefaultModelRef, init_schema } from "../../config/schema.js";
+import { resolveModelSelector } from "../../config/agent-model-intents.js";
 import { getDefaultModelSync, init_providers, resolveModel } from "../../providers/index.js";
 import { completeWithResolvedCredentials } from "../../providers/model-call.js";
-import { resolveModelSelector } from "../../config/agent-model-intents.js";
 import { buildAutomationDraftPrompt, buildAutomationDraftRepairPrompt, buildAutomationRunRepairPrompt, buildAutomationRunRepairRetryPrompt } from "./automation-draft-prompt.js";
 import { buildAutomationDraftResponse, parseGeneratedAutomationDraft, parseGeneratedAutomationRepairDraft } from "./automation-draft-validator.js";
 //#region src/automations/draft/automation-draft-service.ts

package/dist/src/chat-commands/agent-edit.js

@@ -1,7 +1,7 @@
 import { normalizeAgentId } from "../agent-catalog/id.js";
 import { init_agent_scope, resolveAgentProfileDir } from "../agent/agent-scope.js";
-import { WORKSPACE_FILES, init_paths } from "../config/paths.js";
 import { init_agent_session_key, resolveAgentIdFromConversationId } from "../routing/agent-session-key.js";
+import { WORKSPACE_FILES, init_paths } from "../config/paths.js";
 import { commandRegistry } from "./registry.js";
 import { join } from "node:path";
 import { readFile } from "node:fs/promises";

package/dist/src/chat-commands/builtins/config.js

@@ -1,7 +1,7 @@
 import { createLogger } from "../../utils/logger/index.js";
 import { init_logger } from "../../utils/logger.js";
-import { init_paths, resolveConfigPath } from "../../config/paths.js";
 import { ConfigSchema, init_schema } from "../../config/schema.js";
+import { init_paths, resolveConfigPath } from "../../config/paths.js";
 import { commandRegistry } from "../registry.js";
 import { parseConfigValue } from "../config-value.js";
 import { getConfigValueAtPath, parseConfigPath, setConfigValueAtPath, unsetConfigValueAtPath } from "../config-paths.js";

package/dist/src/chat-commands/context.js

@@ -1,7 +1,7 @@
 import { createLogger } from "../utils/logger/index.js";
 import { init_logger } from "../utils/logger.js";
-import { getAgentDefaultModelRef, init_schema } from "../config/schema.js";
 import { resolveEffectiveAgentConfigForSession } from "../config/agent-profile.js";
+import { getAgentDefaultModelRef, init_schema } from "../config/schema.js";
 import { effectiveWorkspacePathForSession } from "../session/session-workspace.js";
 import { getProjectForSession } from "../projects/workspace.js";
 import { getSessionDisplayName } from "./session-key.js";

package/dist/src/cli/commands/agent.js

@@ -1,8 +1,9 @@
 import { createLogger } from "../../utils/logger/index.js";
 import { init_logger } from "../../utils/logger.js";
 import { init_agent_scope, resolveDefaultAgentId } from "../../agent/agent-scope.js";
-import { getAgentDefaultModelRef, init_schema } from "../../config/schema.js";
 import { init_agent_session_key, resolveAgentMainConversationId } from "../../routing/agent-session-key.js";
+import { getAgentDefaultModelRef, init_schema } from "../../config/schema.js";
+import { getWorkspacePath } from "../../config/workspace-path-helpers.js";
 import { ExtensionLoader } from "../../extensions/loader.js";
 import "../../extensions/index.js";
 import { loadConfig } from "../../config/loader.js";
@@ -12,7 +13,6 @@ import { AgentService } from "../../agent/service.js";
 import "../../agent/index.js";
 import { formatExamples, register } from "../registry.js";
 import { getContextWithOpts } from "../context.js";
-import { getWorkspacePath } from "../../config/workspace-path-helpers.js";
 import "../../config/index.js";
 import { getXopcCloudCatalogCoordinator } from "../../providers/xopc-cloud-catalog-coordinator.js";
 import { listSessions } from "./agent/sessions.js";

package/dist/src/cli/commands/doctor/checks/database-schema.js

@@ -53,7 +53,7 @@ async function checkDatabaseSchema(ctx) {
 		id: "database-schema",
 		label: "Database schema",
 		status: "pass",
-		message: `SQLite schema v${status.dbVersion} (current release v244).`,
+		message: `SQLite schema v${status.dbVersion} (current release v245).`,
 		hints: []
 	};
 }

package/dist/src/cli/commands/doctor/checks/image-providers.js

@@ -1,6 +1,6 @@
 import { resolveModelsJsonPath } from "../../../../config/paths.js";
-import { CredentialResolver, init_credentials } from "../../../../auth/credentials.js";
 import { init_models_json, loadModelsJson } from "../../../../config/models-json.js";
+import { CredentialResolver, init_credentials } from "../../../../auth/credentials.js";
 import { classifyHost } from "../../../../media-shared/http/private-network.js";
 import "../../../../media-shared/http/index.js";
 import { existsSync } from "node:fs";

package/dist/src/cli/commands/doctor/checks/provider-auth.js

@@ -1,9 +1,9 @@
 import { AgentCatalogRepository, init_repository } from "../../../../agent-catalog/repository.js";
+import { getDefaultAgentId, init_resolve_route } from "../../../../routing/resolve-route.js";
+import { getAgentDefaultModelRef, init_schema, parseModelRef } from "../../../../config/schema.js";
 import { PROVIDER_ENV_MAP, init_env_keys } from "../../../../providers/env-keys.js";
 import { getModelOAuthProviderIds, init_registry } from "../../../../auth/oauth/registry.js";
 import { CredentialResolver, init_credentials } from "../../../../auth/credentials.js";
-import { getAgentDefaultModelRef, init_schema, parseModelRef } from "../../../../config/schema.js";
-import { getDefaultAgentId, init_resolve_route } from "../../../../routing/resolve-route.js";
 import { loadConfig } from "../../../../config/loader.js";
 import { existsSync } from "node:fs";
 //#region src/cli/commands/doctor/checks/provider-auth.ts

package/dist/src/cli/commands/models.js

@@ -2,8 +2,8 @@ import { creditDecimal } from "../../../packages/gateway-contract/src/cloud-cred
 import { init_src } from "../../../packages/gateway-contract/src/index.js";
 import { AgentCatalogRepository, init_repository } from "../../agent-catalog/repository.js";
 import { AgentCatalogService } from "../../agent-catalog/service.js";
-import { CredentialResolver, init_credentials } from "../../auth/credentials.js";
 import { getAgentDefaultModelRef, init_schema } from "../../config/schema.js";
+import { CredentialResolver, init_credentials } from "../../auth/credentials.js";
 import { getAllModels, getAvailableModels, getConfiguredProviders, getProviderAuthState, getProviderDisplayName, init_providers, isProviderConfigured, providerSupportsApiKey, providerSupportsOAuth, resolveModel } from "../../providers/index.js";
 import { XopcCloudAccountService } from "../../providers/xopc-cloud-account-service.js";
 import { listImageProviderSpecs } from "../../../packages/image-providers/src/catalog.js";

package/dist/src/cli/commands/onboard/model.js

@@ -1,11 +1,11 @@
 import { AgentCatalogRepository, init_repository } from "../../../agent-catalog/repository.js";
 import { AgentCatalogService } from "../../../agent-catalog/service.js";
-import { getApiKeyFromEnv } from "../../../providers/env-keys.js";
-import { resolveModelsJsonPath } from "../../../config/paths.js";
-import { CredentialResolver, init_credentials } from "../../../auth/credentials.js";
 import { getAgentDefaultModelRef, init_schema } from "../../../config/schema.js";
+import { resolveModelsJsonPath } from "../../../config/paths.js";
 import { init_models_json, loadModelsJson, saveModelsJson } from "../../../config/models-json.js";
+import { getApiKeyFromEnv } from "../../../providers/env-keys.js";
 import { getModelRegistry } from "../../../providers/model-registry.js";
+import { CredentialResolver, init_credentials } from "../../../auth/credentials.js";
 import { getAllProviders, getModelsByProvider, getProviderDisplayName, init_providers, providerSupportsApiKey, providerSupportsOAuth } from "../../../providers/index.js";
 import { prepareUpdateGlobalDefaults } from "../../../gateway/global-defaults-admin.js";
 import { discoverProviderModels, isProviderApiDiscoverable } from "../../../providers/model-discovery.js";

package/dist/src/cli/commands/onboard.js

@@ -5,8 +5,8 @@ import { resolveGatewayLocalClientHost } from "../../config/gateway-bind.js";
 import { saveConfig } from "../../config/loader.js";
 import { formatExamples, register } from "../registry.js";
 import "../../config/index.js";
-import { provisionEagerRuntimes } from "../../runtime-tools/bootstrap.js";
 import { colors } from "../utils/colors.js";
+import { provisionEagerRuntimes } from "../../runtime-tools/bootstrap.js";
 import { initWorkspace } from "../utils/init-workspace.js";
 import { setupModel } from "./onboard/model.js";
 import { getChannelConfigurators } from "./onboard/channels/registry.js";

package/dist/src/cli/extension-cli-register.js

@@ -1,3 +1,4 @@
+import { getWorkspacePath } from "../config/workspace-path-helpers.js";
 import { collectConfiguredChannelIds } from "../extensions/activation-context.js";
 import { ExtensionLoader } from "../extensions/loader.js";
 import "../extensions/index.js";
@@ -6,7 +7,6 @@ import { MessageBus } from "../infra/bus/queue.js";
 import "../infra/bus/index.js";
 import { bootstrapApplicationStateSync } from "../bootstrap/application-state.js";
 import { createDefaultContext } from "./registry.js";
-import { getWorkspacePath } from "../config/workspace-path-helpers.js";
 import "../config/index.js";
 import { registerExtensionCliProgram } from "../extensions/sdk/channel-helpers.js";
 import { join } from "path";

package/dist/src/config/agent-model-intents.js

@@ -1,7 +1,7 @@
 import { ModelIntentSchema } from "../agent-config/schema.js";
 import { init_agent_config } from "../agent-config/index.js";
-import { init_schema, parseModelRef } from "./schema.js";
 import { resolveEffectiveAgentConfigForAgent } from "./agent-profile.js";
+import { init_schema, parseModelRef } from "./schema.js";
 //#region src/config/agent-model-intents.ts
 init_agent_config();
 init_schema();

package/dist/src/config/index.js

@@ -2,18 +2,18 @@ import { ENV_VARS, XOPC_DB_FILENAME, resolveHomeDir, resolveStateDir, resolveXop
 import { expandWorkspacePathString, init_workspace_path, normalizeWorkspaceDir, resolveWorkspaceRoot } from "./workspace-path.js";
 import { resolveDefaultAgentWorkspaceDir } from "./workspace-defaults.js";
 import { resolveAgentWorkspaceDir } from "../agent/agent-scope.js";
-import { FILENAMES, WORKSPACE_FILES, existsSync, hasBundledExtensionManifest, init_paths, resolveAgentAuthProfilesPath, resolveAgentDir, resolveAgentHomeDir, resolveAgentProfileDir, resolveAgentProfileMarkdownPath, resolveAuthProfilesPath, resolveBinDir, resolveBundledExtensionsDir, resolveBundledSkillsDir, resolveConfigPath, resolveCredentialsDir, resolveExtensionSdkPath, resolveExtensionsDir, resolveExtensionsLockPath, resolveInboxDir, resolveInboxMessagePath, resolveInboxPendingDir, resolveInboxProcessedDir, resolveLogPath, resolveLogsDir, resolveModelsJsonPath, resolveNodeBinDir, resolveNodeBinPath, resolveNodeToolsDir, resolveNpmBinPath, resolveOAuthPath, resolvePidPath, resolveSkillPath, resolveSkillsCachePath, resolveSkillsDir, resolveSkillsLockPath, resolveSocketPath, resolveStatusPath, resolveToolsDir, resolveWorkspaceExtensionsDir, resolveWorkspaceFile, resolveWorkspaceStateDir, resolveWorkspaceStatePath, resolveXopcBinPath } from "./paths.js";
+import { extractProfileAgentId, resolveEffectiveAgentConfigForAgent, resolveEffectiveAgentConfigForSession, resolveEffectiveAgentProfile, resolveEffectiveAgentProfileForSession } from "./agent-profile.js";
 import { TelegramAccountConfigSchema, TelegramConfigSchema, TelegramGroupConfigSchema, TelegramTopicConfigSchema } from "../../extensions/telegram/src/config-schema.js";
 import { WeixinAccountConfigSchema, WeixinConfigSchema } from "../../extensions/weixin/src/config-schema.js";
 import { AgentImageGenerationModelSchema, AgentModelRefSchema, AgentModelsSchema, BrowserConfigSchema, ChannelsConfigSchema, CommandsConfigSchema, ConfigSchema, ConnectorsConfigSchema, ExperimentalConfigSchema, ExtensionSecurityConfigSchema, ExtensionSlotsConfigSchema, ExtensionsConfigSchema, GatewayAuthRateLimitSchema, GatewayAuthSchema, GatewayBindModeSchema, GatewayChannelConnectDeferModeSchema, GatewayConfigSchema, GatewayModeSchema, GatewayRemoteSchema, GatewayScenesConfigSchema, GatewaySecuritySchema, GatewayTailscaleConsentSchema, GatewayTailscaleSchema, GatewayTlsSchema, GatewayTrustedProxySchema, GatewayWebchatConfigSchema, McpConfigSchema, McpOAuthConfigSchema, McpServerSchema, MediaUnderstandingCapabilitiesSchema, MediaUnderstandingModelSchema, MessagesConfigSchema, ModelCatalogConfigSchema, ModelsDevConfigSchema, ProviderAuthConfigSchema, ProviderAzureConfigSchema, ProviderRequestOverridesSchema, ProvidersConfigSchema, RuntimeToolsConfigSchema, STTConfigSchema, STTFallbackConfigSchema, STTProviderConfigSchema, SearchProviderEntrySchema, SessionConfigSchema, SessionDmScopeSchema, SessionResetByTypeSchema, SessionResetConfigSchema, SessionResetModeSchema, SessionScopeSchema, SessionStorageConfigSchema, TTSConfigSchema, TTSEdgeConfigSchema, TTSFallbackConfigSchema, TTSModelOverridesConfigSchema, TTSProviderConfigSchema, TTSSummarizationConfigSchema, ToolsConfigSchema, ToolsMediaAudioConfigSchema, ToolsMediaConfigSchema, TunnelBrokerUrlSchema, TunnelConfigSchema, TunnelConsentSchema, UpdateAutoConfigSchema, UpdateConfigSchema, VoiceConfigSchema, VoiceRefinementConfigSchema, WebSearchConfigSchema, WebToolsConfigSchema, WebsiteBlocklistSchema, WorkspaceConfigSchema, WorkspaceImportConfigSchema, getAgentDefaultImageGenerationModelConfig, getAgentDefaultImageModelConfig, getAgentDefaultModelRef, init_schema, parseModelRef } from "./schema.js";
-import { applyConfigOverrides, getConfigOverrides, resetConfigOverrides, setConfigOverride, unsetConfigOverride } from "./runtime-overrides.js";
-import { extractProfileAgentId, resolveEffectiveAgentConfigForAgent, resolveEffectiveAgentConfigForSession, resolveEffectiveAgentProfile, resolveEffectiveAgentProfileForSession } from "./agent-profile.js";
 import { clearConfigValueCache, getAllowedCommands, getCacheStats, init_resolve_config_value, resolveConfigValue, resolveHeaders, testApiKeyResolution } from "./resolve-config-value.js";
+import { FILENAMES, WORKSPACE_FILES, existsSync, hasBundledExtensionManifest, init_paths, resolveAgentAuthProfilesPath, resolveAgentDir, resolveAgentHomeDir, resolveAgentProfileDir, resolveAgentProfileMarkdownPath, resolveAuthProfilesPath, resolveBinDir, resolveBundledExtensionsDir, resolveBundledSkillsDir, resolveConfigPath, resolveCredentialsDir, resolveExtensionSdkPath, resolveExtensionsDir, resolveExtensionsLockPath, resolveInboxDir, resolveInboxMessagePath, resolveInboxPendingDir, resolveInboxProcessedDir, resolveLogPath, resolveLogsDir, resolveModelsJsonPath, resolveNodeBinDir, resolveNodeBinPath, resolveNodeToolsDir, resolveNpmBinPath, resolveOAuthPath, resolvePidPath, resolveSkillPath, resolveSkillsCachePath, resolveSkillsDir, resolveSkillsLockPath, resolveSocketPath, resolveStatusPath, resolveToolsDir, resolveWorkspaceExtensionsDir, resolveWorkspaceFile, resolveWorkspaceStateDir, resolveWorkspaceStatePath, resolveXopcBinPath } from "./paths.js";
 import { CustomModelSchema, ImageGenerationCapabilitiesSchema, ImageGenerationModelSchema, ImageGenerationProviderSchema, ModelOverrideSchema, ModelsJsonSchema, OpenAICompatSchema, OpenAICompletionsCompatSchema, OpenAIResponsesCompatSchema, OpenRouterRoutingSchema, ProviderConfigSchema, VercelGatewayRoutingSchema, getDefaultModelValues, init_models_json, loadModelsJson, modelsJsonExists, saveModelsJson, validateModelsConfig } from "./models-json.js";
+import { getWorkspacePath } from "./workspace-path-helpers.js";
+import { applyConfigOverrides, getConfigOverrides, resetConfigOverrides, setConfigOverride, unsetConfigOverride } from "./runtime-overrides.js";
 import { canonicalizeConfiguredMcpServer, normalizeConfiguredMcpServers } from "./mcp-config-normalize.js";
 import { formatThinkingLevels, listThinkingLevels, normalizeElevatedMode, normalizeReasoningLevel, normalizeThinkLevel, normalizeVerboseLevel, thinkLevelToNumber } from "../agent/transcript/thinking-types.js";
 import { assertConfigRewriteSafeForRunningGateway, loadConfig, saveConfig } from "./loader.js";
-import { getWorkspacePath } from "./workspace-path-helpers.js";
 import { listAgentProfileMarkdownDirs, listAgentWorkspaceDirs } from "./workspace-dirs.js";
 import { ProfileManager, createProfile, deleteProfile, getCurrentProfile, getProfileManager, getProfileNameFromDir, getSwitchCommand, listProfiles, resolveProfileStateDir } from "./profile.js";
 import { diffConfigPaths } from "./diff.js";

package/dist/src/config/loader.js

@@ -1,9 +1,9 @@
 import { createLogger } from "../utils/logger/index.js";
 import { init_logger } from "../utils/logger.js";
 import { init_write_file_atomic, writeTextAtomic } from "../infra/write-file-atomic.js";
+import { ConfigSchema, init_schema } from "./schema.js";
 import { init_paths, resolveConfigPath } from "./paths.js";
 import { init_resolution, setActivePlatformDiscovery } from "../platform/resolution.js";
-import { ConfigSchema, init_schema } from "./schema.js";
 import { assertChannelPluginConfigs } from "./validate-channel-configs.js";
 import { isGatewayConfigLockedByAnotherProcessSync } from "../gateway/lock.js";
 import { dirname } from "path";

package/dist/src/config/models-json.js

@@ -1,9 +1,9 @@
 import { __esmMin } from "../../_virtual/_rolldown/runtime.js";
 import { init_write_file_atomic, writeTextAtomicSync } from "../infra/write-file-atomic.js";
-import { init_paths, resolveModelsJsonPath } from "./paths.js";
-import { assertCurrentModelProvider, init_provider_policy } from "../providers/provider-policy.js";
 import { ComputerProfileSchema, init_src } from "../../packages/computer-control-contract/src/index.js";
+import { init_paths, resolveModelsJsonPath } from "./paths.js";
 import { init_model_policy, isComputerModel } from "../computer/model-policy.js";
+import { assertCurrentModelProvider, init_provider_policy } from "../providers/provider-policy.js";
 import { existsSync, readFileSync } from "fs";
 import { z } from "zod";
 //#region src/config/models-json.ts

package/dist/src/config/schema.d.ts

@@ -1362,6 +1362,11 @@ export declare const ConfigSchema: z.ZodDefault<z.ZodObject<{
                 allow: "allow";
                 deny: "deny";
             }>>;
+            learning: z.ZodOptional<z.ZodObject<{
+                idleFlushMs: z.ZodDefault<z.ZodNumber>;
+                maxBatchChars: z.ZodDefault<z.ZodNumber>;
+                maxDailyBatches: z.ZodDefault<z.ZodNumber>;
+            }, z.core.$strict>>;
             readScopes: z.ZodDefault<z.ZodArray<z.ZodEnum<{
                 project: "project";
                 session: "session";

package/dist/src/config/schema.js

@@ -3,9 +3,9 @@ import { AgentModelsOverrideSchema, ImageGenerationRouteSchema, ModelRouteSchema
 import { resolveEffectiveAgentConfig } from "../agent-config/resolver.js";
 import { init_agent_config } from "../agent-config/index.js";
 import { AgentCatalogRepository, init_repository } from "../agent-catalog/repository.js";
-import { TracingConfigSchema, init_config } from "../observability/config.js";
-import { ComputerConfigSchema, init_config as init_config$1 } from "../computer/config.js";
-import { DEFAULT_CONTEXT_COMPACTION_POLICY, UserContextConfigSchema, init_config as init_config$2 } from "../user-context/config.js";
+import { DEFAULT_CONTEXT_COMPACTION_POLICY, UserContextConfigSchema, init_config } from "../user-context/config.js";
+import { TracingConfigSchema, init_config as init_config$1 } from "../observability/config.js";
+import { ComputerConfigSchema, init_config as init_config$2 } from "../computer/config.js";
 import { init_public_url, validatePublicUrl } from "./public-url.js";
 import { PlatformConfigSchema, init_contracts } from "../platform/contracts.js";
 import { TelegramAccountConfigSchema, TelegramConfigSchema, TelegramGroupConfigSchema, TelegramTopicConfigSchema, init_config_schema } from "../../extensions/telegram/src/config-schema.js";
@@ -44,11 +44,11 @@ function parseModelRef(ref) {
 }
 var AgentModelRefSchema, AgentImageGenerationModelSchema, AgentModelsSchema, BrowserDriverSchema, BrowserHostnameSchema, BrowserConfigSchema, SessionDmScopeSchema, SessionStorageConfigSchema, SessionResetModeSchema, SessionResetConfigSchema, SessionResetByTypeSchema, SessionScopeSchema, SessionConfigSchema, ChannelsConfigSchema, SearchProviderEntrySchema, WebSearchConfigSchema, WebsiteBlocklistSchema, WebToolsConfigSchema, ToolsConfigSchema, RuntimePreferenceSchema, RuntimeProvisionSchema, RuntimeVersionRequestSchema, LanguageRuntimeSchema, DEFAULT_RUNTIME_TOOLS_CONFIG, RuntimeToolsConfigSchema, GatewayAuthRateLimitSchema, GatewaySecuritySchema, GatewayTrustedProxySchema, GatewayAuthSchema, GatewayTailscaleConsentSchema, GatewayTailscaleSchema, GatewayRemoteSchema, GatewayTlsSchema, GatewayModeSchema, GatewayChannelConnectDeferModeSchema, TunnelConsentSchema, TunnelBrokerUrlSchema, TunnelConfigSchema, WorkspaceImportConfigSchema, WorkspaceConfigSchema, GatewayBindModeSchema, GatewayWebchatConfigSchema, GatewayScenesConfigSchema, GatewayConfigSchema, ModelsDevConfigSchema, ModelCatalogConfigSchema, SttProviderConfigCatchallSchema, STTProviderConfigSchema, STTFallbackConfigSchema, MediaUnderstandingCapabilitiesSchema, MediaUnderstandingModelSchema, STTConfigSchema, TtsProviderConfigCatchallSchema, TTSProviderConfigSchema, TTSFallbackConfigSchema, TTSModelOverridesConfigSchema, TTSEdgeConfigSchema, TTSSummarizationConfigSchema, TTSConfigSchema, VoiceRefinementConfigSchema, VoiceConfigSchema, MessagesConfigSchema, ToolsMediaAudioConfigSchema, ToolsMediaConfigSchema, ProviderAzureConfigSchema, ProviderRequestOverridesSchema, ProviderAuthConfigSchema, ProvidersConfigSchema, ExtensionSecurityConfigSchema, ExtensionSlotsConfigSchema, ExtensionsConfigSchema, UpdateAutoConfigSchema, UpdateConfigSchema, CommandsConfigSchema, McpHttpUrlSchema, ConnectorSecretReferenceSchema, McpConfigScalarSchema, McpExposureSchema, McpOAuthConfigSchema, McpServerSchema, McpConfigSchema, ConnectorsConfigSchema, ExperimentalConfigSchema, ConfigSchema;
 var init_schema = __esmMin((() => {
-	init_config();
 	init_config$1();
+	init_config$2();
 	init_agent_config();
 	init_repository();
-	init_config$2();
+	init_config();
 	init_public_url();
 	init_contracts();
 	init_config_schema();

package/dist/src/connectors/connected-source-ingestion.js

@@ -2,20 +2,24 @@ import { createLogger } from "../utils/logger/index.js";
 import { init_logger } from "../utils/logger.js";
 import { getConnectorInstallation, listConnectorConnections } from "../storage/sqlite/connector-repository.js";
 import { init_sqlite } from "../storage/sqlite/index.js";
+import { getActiveUnderstandingConsent, grantUnderstandingConsent } from "../user-context/sources/consent-repository.js";
+import { listUnderstandingSourceGrants, upsertUnderstandingSourceGrant } from "../user-context/sources/repository.js";
+import { ConnectedKnowledgePipeline } from "../knowledge/connected-knowledge-pipeline.js";
+import { getWorkspacePath } from "../config/workspace-path-helpers.js";
 import { canAccessConnectorAccount, currentAccountConnections } from "./account-access.js";
 import { ComposioSessionsAdapter } from "./composio-sessions.js";
 import { decodeConnectedSourceCursor, encodeConnectedSourceCursor } from "./connected-source-cursor.js";
 import { scopeForComposioAction } from "./composio.js";
 import { getConnectorDefinition } from "./catalog.js";
 import { getConnectorInstance } from "./instances.js";
-import { getWorkspacePath } from "../config/workspace-path-helpers.js";
 import { KnowledgeIngestionService } from "../knowledge/ingestion-service.js";
-import { ConnectedKnowledgePipeline } from "../knowledge/connected-knowledge-pipeline.js";
 import { LocalFolderKnowledgeSourceAdapter } from "../knowledge/local-folder-adapter.js";
 import "../knowledge/index.js";
 import { normalizeConnectedSourceResult } from "./connected-source-normalizers.js";
 import { sanitizeConnectedSourceValue } from "./connected-source-sanitization.js";
+import { resolve } from "node:path";
 import { createHash } from "node:crypto";
+import { realpath } from "node:fs/promises";
 //#region src/connectors/connected-source-ingestion.ts
 init_logger();
 init_sqlite();
@@ -145,9 +149,8 @@ function resultToSourceItems(input) {
 		const ownerIdentities = connectionIdentities(input.connectionIdentity);
 		const actorAttributed = entity.metadata.actorAttributed === true || hasOwnerAttribution(input.toolkit, people, ownerIdentities);
 		const serialized = JSON.stringify(sanitizeConnectedSourceValue(entity.value), null, 2);
-		const contentChars = typeof entity.value.content === "string" ? 24e3 : 8e3;
-		const normalizedText = serialized.length > contentChars ? `${serialized.slice(0, contentChars)}\n…` : serialized;
-		const contentHash = createHash("sha256").update(serialized).digest("hex");
+		const normalizedText = serialized;
+		const contentHash = createHash("sha256").update(`connected-source-v2:${serialized}`).digest("hex");
 		return {
 			sourceInstanceId: input.sourceInstanceId,
 			collectionScope: input.collectionScope,
@@ -350,9 +353,44 @@ async function ingestLocalFolderSource(input) {
 	if (definition?.runtime.type !== "memorySource" || definition.runtime.sourceKind !== "local-folder") throw new Error("Local folder sync requires a local-folder memory source connector.");
 	const instance = getConnectorInstance(input.config, definition.id);
 	if (!instance?.enabled) throw new Error("Local folder connector is not installed and enabled.");
-	const rootPath = typeof instance.config?.rootPath === "string" ? instance.config.rootPath.trim() : "";
-	if (!rootPath) throw new Error("Local folder connector requires a rootPath.");
+	const configuredRoot = typeof instance.config?.rootPath === "string" ? instance.config.rootPath.trim() : "";
+	if (!configuredRoot) throw new Error("Local folder connector requires a rootPath.");
+	const rootPath = await realpath(resolve(configuredRoot));
 	const sourceInstanceId = `local-folder:${definition.id}`;
+	const priorGrant = listUnderstandingSourceGrants({ includeRevoked: true }).find((grant) => grant.sourceKey === sourceInstanceId);
+	if (priorGrant && (priorGrant.status === "revoked" || !getActiveUnderstandingConsent(priorGrant.id))) throw new Error("Local folder source authorization was revoked. Restore it before syncing.");
+	if (priorGrant && (priorGrant.config.rootPath !== rootPath || getActiveUnderstandingConsent(priorGrant.id)?.allowedAgentIds && !getActiveUnderstandingConsent(priorGrant.id).allowedAgentIds.includes(input.agentId))) throw new Error("Local folder root or Agent differs from the existing authorization. Update source authorization before syncing.");
+	const grant = upsertUnderstandingSourceGrant({
+		sourceKey: sourceInstanceId,
+		adapterId: `connector:${definition.id}`,
+		category: "files",
+		platform: "all",
+		displayName: definition.displayName,
+		accessMode: "continuous",
+		retentionPolicy: "bounded_raw",
+		processingPolicy: "local_only",
+		config: {
+			sourceInstanceId,
+			rootPath
+		}
+	});
+	if (!getActiveUnderstandingConsent(grant.id)) grantUnderstandingConsent({
+		grantId: grant.id,
+		purposes: ["work_assistance"],
+		allowedDomains: ["goals"],
+		deniedDomains: [],
+		allowedFields: [
+			"title",
+			"content",
+			"timestamps"
+		],
+		accessMode: "continuous",
+		lookbackDays: 0,
+		rawRetentionDays: 365,
+		processingPolicy: "local_only",
+		allowedAgentIds: [input.agentId],
+		disclosureVersion: "local-folder-1"
+	});
 	const adapter = new LocalFolderKnowledgeSourceAdapter(rootPath);
 	const syncRun = await new KnowledgeIngestionService(new Map([[adapter.kind, adapter]])).sync({
 		adapterKind: adapter.kind,

package/dist/src/connectors/connected-source-understanding.d.ts

@@ -11,6 +11,7 @@ export declare function deriveConnectedSourceUnderstanding(input: {
     sourceRunId: string;
     processingPolicy: 'local_only' | 'remote_allowed';
     analyze?: typeof analyzeUnderstandingSources;
+    batchOrdinal?: number;
     assertAuthorized?: () => void;
 }): Promise<{
     created: number;