@xopcai/xopc 0.0.374 → 0.0.376

package/dist/src/user-context/config.d.ts

@@ -115,6 +115,11 @@ export declare const KnowledgeMemoryConfigSchema: z.ZodDefault<z.ZodObject<{
         allow: "allow";
         deny: "deny";
     }>>;
+    learning: z.ZodOptional<z.ZodObject<{
+        idleFlushMs: z.ZodDefault<z.ZodNumber>;
+        maxBatchChars: z.ZodDefault<z.ZodNumber>;
+        maxDailyBatches: z.ZodDefault<z.ZodNumber>;
+    }, z.core.$strict>>;
     readScopes: z.ZodDefault<z.ZodArray<z.ZodEnum<{
         project: "project";
         session: "session";
@@ -244,6 +249,11 @@ export declare const UserContextConfigSchema: z.ZodDefault<z.ZodObject<{
             allow: "allow";
             deny: "deny";
         }>>;
+        learning: z.ZodOptional<z.ZodObject<{
+            idleFlushMs: z.ZodDefault<z.ZodNumber>;
+            maxBatchChars: z.ZodDefault<z.ZodNumber>;
+            maxDailyBatches: z.ZodDefault<z.ZodNumber>;
+        }, z.core.$strict>>;
         readScopes: z.ZodDefault<z.ZodArray<z.ZodEnum<{
             project: "project";
             session: "session";

package/dist/src/user-context/config.js

@@ -150,6 +150,11 @@ var init_config = __esmMin((() => {
 	KnowledgeMemoryConfigSchema = z.object({
 		enabled: z.boolean().default(true),
 		writePolicy: z.enum(["deny", "allow"]).default("allow"),
+		learning: z.object({
+			idleFlushMs: z.number().int().min(1e3).max(6e5).default(6e4),
+			maxBatchChars: z.number().int().min(4e3).max(12e4).default(3e4),
+			maxDailyBatches: z.number().int().min(1).max(1e4).default(100)
+		}).strict().optional(),
 		readScopes: z.array(z.enum([
 			"global",
 			"agent",

package/dist/src/user-context/extraction/registry.d.ts

@@ -1,6 +1,6 @@
 import { type ContextExtractionRun } from '../../storage/sqlite/index.js';
 import type { UnderstandingKind } from '../domain.js';
-export type ExtractorId = 'turn-semantics' | 'transcript-synthesis' | 'connector-semantic';
+export type ExtractorId = 'turn-semantics' | 'transcript-synthesis' | 'source-work-synthesis' | 'connector-semantic';
 export type ExtractorDefinition = {
     id: ExtractorId;
     version: string;

package/dist/src/user-context/extraction/registry.js

@@ -15,6 +15,16 @@ const UNDERSTANDING_KINDS = [
 	"derived_insight"
 ];
 const DEFINITIONS = {
+	"source-work-synthesis": {
+		id: "source-work-synthesis",
+		version: "1",
+		inputKinds: ["file", "connector"],
+		requiredProcessingPolicy: "local_only",
+		authorityCeiling: "external_untrusted",
+		candidateKinds: ["project_context", "task_lesson"],
+		maxAutomaticStatus: "active",
+		timeoutMs: 3e4
+	},
 	"turn-semantics": {
 		id: "turn-semantics",
 		version: "1",

package/dist/src/user-context/identity-bindings.d.ts

@@ -0,0 +1,10 @@
+export declare function bindOwnerIdentity(input: {
+    channel: string;
+    accountId: string;
+    peerId: string;
+}): void;
+export declare function isOwnerIdentity(input: {
+    source: string;
+    accountId: string;
+    peerId: string;
+}): boolean;

package/dist/src/user-context/identity-bindings.js

@@ -0,0 +1,24 @@
+import { getSqliteDatabase, init_transaction } from "../storage/sqlite/transaction.js";
+//#region src/user-context/identity-bindings.ts
+init_transaction();
+function bindOwnerIdentity(input) {
+	if (![
+		input.channel,
+		input.accountId,
+		input.peerId
+	].every((value) => value.trim())) throw new Error("Identity fields are required.");
+	getSqliteDatabase().prepare(`INSERT INTO owner_identity_bindings(principal_id, channel, account_id, peer_id, verified_at)
+    VALUES ('local-owner', ?, ?, ?, ?) ON CONFLICT(channel, account_id, peer_id) DO UPDATE
+    SET verified_at = excluded.verified_at, revoked_at = NULL`).run(input.channel, input.accountId, input.peerId, Date.now());
+}
+function isOwnerIdentity(input) {
+	if ([
+		"webchat",
+		"cli",
+		"tui"
+	].includes(input.source)) return true;
+	return Boolean(getSqliteDatabase().prepare(`SELECT 1 FROM owner_identity_bindings
+    WHERE principal_id = 'local-owner' AND channel = ? AND account_id = ? AND peer_id = ? AND revoked_at IS NULL`).get(input.source, input.accountId, input.peerId));
+}
+//#endregion
+export { bindOwnerIdentity, isOwnerIdentity };

package/dist/src/user-context/sources/consent-fields.d.ts

@@ -0,0 +1,2 @@
+/** Restrict source fields before either model processing or searchable chunk persistence. */
+export declare function consentFilteredText(value: string | undefined, allowedFields: Set<string>): string | undefined;

package/dist/src/user-context/sources/consent-fields.js

@@ -0,0 +1,66 @@
+//#region src/user-context/sources/consent-fields.ts
+const FIELD_KEYS = {
+	title: [
+		"title",
+		"subject",
+		"name",
+		"fullName",
+		"repository"
+	],
+	content: [
+		"content",
+		"body",
+		"text",
+		"snippet",
+		"description",
+		"summary"
+	],
+	participants: [
+		"from",
+		"to",
+		"cc",
+		"bcc",
+		"sender",
+		"author",
+		"organizer",
+		"attendees",
+		"participants",
+		"assignee",
+		"owners"
+	],
+	status: [
+		"status",
+		"state",
+		"labels"
+	],
+	timestamps: [
+		"createdAt",
+		"updatedAt",
+		"modifiedAt",
+		"start",
+		"end",
+		"created_at",
+		"updated_at",
+		"modified_at"
+	],
+	owner_activity: [
+		"user",
+		"username",
+		"owner"
+	]
+};
+/** Restrict source fields before either model processing or searchable chunk persistence. */
+function consentFilteredText(value, allowedFields) {
+	if (!value) return;
+	try {
+		const parsed = JSON.parse(value);
+		if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) return;
+		const keys = new Set([...allowedFields].flatMap((field) => FIELD_KEYS[field] ?? []));
+		const selected = Object.entries(parsed).filter(([key]) => keys.has(key));
+		return selected.length ? JSON.stringify(Object.fromEntries(selected)) : void 0;
+	} catch {
+		return !/^\s*[\[{]/.test(value) && allowedFields.has("content") ? value : void 0;
+	}
+}
+//#endregion
+export { consentFilteredText };

package/dist/src/user-model/bootstrap.js

@@ -1,6 +1,6 @@
 import { createCollaborationRule, init_collaboration_rule_repository, listCollaborationRules } from "../storage/sqlite/collaboration-rule-repository.js";
-import { reconcileAssertion } from "./repository.js";
 import { createPriorityWindow, createUserGoal, listPriorityWindows, listUserGoals } from "./goals.js";
+import { reconcileAssertion } from "./repository.js";
 import { applyUserProfilePatch } from "./profile.js";
 //#region src/user-model/bootstrap.ts
 init_collaboration_rule_repository();

package/dist/src/user-model/capture/executor.js

@@ -1,7 +1,7 @@
 import { createCollaborationRule, init_collaboration_rule_repository, listCollaborationRules } from "../../storage/sqlite/collaboration-rule-repository.js";
 import { createContextEvidence, init_context_evidence_repository } from "../../storage/sqlite/context-evidence-repository.js";
-import { deleteUserAssertion, getAssertionSlot, getUserAssertion, linkAssertionEvidence, mergeAssertionObservation, reconcileAssertion, setAssertionStatus } from "../repository.js";
 import { createUserGoal, listUserGoals } from "../goals.js";
+import { deleteUserAssertion, getAssertionSlot, getUserAssertion, linkAssertionEvidence, mergeAssertionObservation, reconcileAssertion, setAssertionStatus } from "../repository.js";
 import { createHash } from "node:crypto";
 //#region src/user-model/capture/executor.ts
 init_context_evidence_repository();

package/dist/src/user-model/capture/semantic.d.ts

@@ -1,9 +1,10 @@
+import { type WorkCandidate } from '../../memory-learning/work-capture.js';
 import type { AssertionCandidate } from '../domain.js';
 export declare const USER_MODEL_CAPTURE_INTENTS: readonly ["remember", "query", "confirm", "correct", "forget", "user_assertion", "task", "none"];
 export type UserModelCaptureIntent = typeof USER_MODEL_CAPTURE_INTENTS[number];
 export interface CaptureEvidence {
     ref: string;
-    role: 'user' | 'assistant';
+    role: 'user' | 'assistant' | 'toolResult';
     text: string;
     createdAt: number;
 }
@@ -32,6 +33,7 @@ export interface ParsedCollaborationRuleCandidate {
     evidenceRefs: string[];
 }
 export interface UserModelInterpretation {
+    knowledge?: WorkCandidate[];
     intent: UserModelCaptureIntent;
     assertions: ParsedAssertionOperation[];
     goals?: ParsedGoalCandidate[];

package/dist/src/user-model/capture/semantic.js

@@ -1,3 +1,4 @@
+import { WorkCandidateSchema } from "../../memory-learning/work-capture.js";
 import { z } from "zod";
 //#region src/user-model/capture/semantic.ts
 const USER_MODEL_CAPTURE_INTENTS = [
@@ -30,6 +31,7 @@ const ScopeSchema = z.object({
 	});
 });
 const AssertionOperationSchema = z.object({
+	intent: z.enum(USER_MODEL_CAPTURE_INTENTS).optional(),
 	action: z.enum([
 		"create",
 		"merge",
@@ -122,6 +124,7 @@ const AssertionOperationSchema = z.object({
 	});
 });
 const GroundingSchema = z.object({
+	intent: z.enum(USER_MODEL_CAPTURE_INTENTS).optional(),
 	evidence: z.array(z.object({
 		ref: z.string().min(1),
 		quote: z.string().min(1)
@@ -150,6 +153,7 @@ const CollaborationRuleSchema = z.object({
 	statement: z.string().min(4).max(600)
 }).merge(GroundingSchema).strict();
 const InterpretationSchema = z.object({
+	knowledge: z.array(WorkCandidateSchema).max(8).default([]),
 	intent: z.enum(USER_MODEL_CAPTURE_INTENTS),
 	assertions: z.array(AssertionOperationSchema).max(8),
 	goals: z.array(GoalSchema).max(4).default([]),
@@ -198,7 +202,8 @@ function parseUserModelInterpretation(raw, evidence, allowedTargetIds = []) {
 	]);
 	const allowed = new Set(allowedTargetIds);
 	const assertions = [];
-	if (assertionIntents.has(parsed.intent)) for (const item of parsed.assertions) {
+	for (const item of parsed.assertions) {
+		if (!assertionIntents.has(item.intent ?? parsed.intent)) continue;
 		const evidenceRefs = groundedEvidenceRefs(item, evidenceByRef);
 		if (!evidenceRefs) continue;
 		if (item.action !== "create" && (!item.targetAssertionId || !allowed.has(item.targetAssertionId))) continue;
@@ -214,7 +219,7 @@ function parseUserModelInterpretation(raw, evidence, allowedTargetIds = []) {
 			value: item.value,
 			normalizedValue: item.normalizedValue,
 			statement: item.statement,
-			authority: effectiveAuthority(parsed.intent, item.authority),
+			authority: effectiveAuthority(item.intent ?? parsed.intent, item.authority),
 			confidence: item.confidence,
 			...item.declaredImportance === void 0 ? {} : { declaredImportance: item.declaredImportance },
 			inferredImportance: item.inferredImportance,
@@ -242,7 +247,8 @@ function parseUserModelInterpretation(raw, evidence, allowedTargetIds = []) {
 		"correct",
 		"user_assertion"
 	]);
-	const goals = structuredIntents.has(parsed.intent) ? parsed.goals.flatMap((item) => {
+	const goals = parsed.goals.flatMap((item) => {
+		if (!structuredIntents.has(item.intent ?? parsed.intent)) return [];
 		const evidenceRefs = groundedEvidenceRefs(item, evidenceByRef);
 		if (!evidenceRefs) return [];
 		return [{
@@ -253,8 +259,9 @@ function parseUserModelInterpretation(raw, evidence, allowedTargetIds = []) {
 			...item.targetAt === void 0 ? {} : { targetAt: parseTime(item.targetAt) },
 			evidenceRefs
 		}];
-	}) : [];
-	const collaborationRules = structuredIntents.has(parsed.intent) ? parsed.collaborationRules.flatMap((item) => {
+	});
+	const collaborationRules = parsed.collaborationRules.flatMap((item) => {
+		if (!structuredIntents.has(item.intent ?? parsed.intent)) return [];
 		const evidenceRefs = groundedEvidenceRefs(item, evidenceByRef);
 		if (!evidenceRefs || item.scope.type === "agent") return [];
 		return [{
@@ -265,8 +272,9 @@ function parseUserModelInterpretation(raw, evidence, allowedTargetIds = []) {
 			statement: item.statement,
 			evidenceRefs
 		}];
-	}) : [];
+	});
 	return {
+		knowledge: parsed.knowledge,
 		intent: parsed.intent,
 		assertions,
 		goals,

package/dist/src/user-model/index.js

@@ -1,9 +1,9 @@
 import { PERSONAL_DOMAINS, USER_MODEL_PRINCIPAL_ID, defaultAssertionDomain, defaultAssertionLayer, init_domain, validateCandidate, validateScope } from "./domain.js";
+import { createPriorityWindow, createUserGoal, listPriorityWindows, listUserGoals, setUserGoalStatus, updatePriorityWindow, updateUserGoal } from "./goals.js";
 import { defaultReviewAt, isAssertionValidAt, requiresBoundedValidity, resolveCurrentAssertion } from "./temporal.js";
 import { deleteUserAssertion, getActiveAssertionByPredicate, getActiveAssertionForSlot, getAssertionSlot, getUserAssertion, getUserTimezone, linkAssertionEvidence, listSlotAssertions, listUserAssertionSources, listUserAssertions, mergeAssertionObservation, reconcileAssertion, setAssertionStatus, setUserAssertionScope } from "./repository.js";
 import { listActionRuleSuggestions } from "./action-rule-suggestions.js";
 import { calculateExecutionValue } from "./importance.js";
-import { createPriorityWindow, createUserGoal, listPriorityWindows, listUserGoals, setUserGoalStatus, updatePriorityWindow, updateUserGoal } from "./goals.js";
 import { deleteUserModelObservationsForGrant, linkUserAssertions, listUserAssertionEdges, listUserModelObservations, recordUserModelObservation } from "./observation-repository.js";
 import { applyUserProfilePatch, getUserProfileSnapshot } from "./profile.js";
 import { bootstrapUserModel } from "./bootstrap.js";

package/dist/src/user-model/usage-policy.js

@@ -1,9 +1,43 @@
+import { isXopcDatabaseOpen } from "../storage/sqlite/connection.js";
+import { getSqliteDatabase, init_transaction } from "../storage/sqlite/transaction.js";
+import { getSessionMetadata } from "../storage/sqlite/session-read-repository.js";
+import { init_session_repository } from "../storage/sqlite/session-repository.js";
+import { init_sqlite } from "../storage/sqlite/index.js";
+import { getUnderstandingConsent } from "../user-context/sources/consent-repository.js";
+import { isOwnerIdentity } from "../user-context/identity-bindings.js";
 //#region src/user-model/usage-policy.ts
+init_sqlite();
+init_transaction();
+init_session_repository();
 /** Automatic personalization never grants execution authority. */
 function isWorkingAssumption(assertion) {
 	return (assertion.status === "candidate" || assertion.status === "active") && (assertion.authority === "user_observed" || assertion.authority === "system_inferred") && assertion.confidence >= .7 && (assertion.consequence === "low" || assertion.consequence === "medium") && assertion.sensitivity === "normal" && assertion.disclosurePolicy !== "ask_before_reference";
 }
 function canUseAssertion(assertion, asOf = Date.now(), context = {}) {
+	if (assertion.consentReceiptId) {
+		if (!isXopcDatabaseOpen()) return false;
+		const consent = getUnderstandingConsent(assertion.consentReceiptId);
+		if (!consent || consent.revokedAt !== void 0 || !consent.allowedDomains.includes(assertion.domain)) return false;
+		if (!getSqliteDatabase().prepare("SELECT 1 FROM understanding_source_grants WHERE grant_id = ? AND status = 'active'").get(consent.grantId)) return false;
+	}
+	if (isXopcDatabaseOpen() && assertion.id) {
+		const db = getSqliteDatabase();
+		const evidence = db.prepare(`SELECT e.source_type, e.source_item_id, e.conversation_id, e.content_hash,
+      link.content_hash AS linked_hash FROM user_assertion_evidence link JOIN context_evidence e ON e.evidence_id = link.evidence_id
+      WHERE link.assertion_id = ? AND link.relation = 'supports'`).all(assertion.id);
+		if (assertion.createdBy === "connector" && (!assertion.consentReceiptId || !evidence.length)) return false;
+		for (const link of evidence) {
+			if (link.conversation_id) {
+				const session = getSessionMetadata(link.conversation_id);
+				if (!session?.routing || session.routing.peerKind !== "direct" || !isOwnerIdentity(session.routing)) return false;
+			}
+			if (link.source_type === "connector") {
+				if (!link.source_item_id || !link.linked_hash || link.linked_hash !== link.content_hash) return false;
+				const source = db.prepare("SELECT content_hash, deleted_at FROM knowledge_source_items WHERE item_id = ?").get(link.source_item_id);
+				if (!source || source.deleted_at || source.content_hash !== link.linked_hash) return false;
+			}
+		}
+	}
 	return (assertion.validFrom === void 0 || assertion.validFrom <= asOf) && (assertion.validTo === void 0 || assertion.validTo >= asOf) && (assertion.deleteAfter === void 0 || assertion.deleteAfter > asOf) && (assertion.reviewAt === void 0 || assertion.reviewAt > asOf) && (!context.use || !assertion.allowedUses || assertion.allowedUses.includes(context.use)) && (!assertion.allowedAgentIds || Boolean(context.agentId && assertion.allowedAgentIds.includes(context.agentId))) && assertion.sensitivity !== "secret" && assertion.sensitivity !== "regulated" && assertion.disclosurePolicy !== "ask_before_reference" && (assertion.status === "active" && assertion.authority === "user_explicit" || isWorkingAssumption(assertion));
 }
 //#endregion

package/dist/src/voice/platform-streams.js

@@ -10,6 +10,7 @@ var PlatformVoiceError = class extends Error {
 		this.name = "PlatformVoiceError";
 	}
 	get clientMessage() {
+		if (this.code === "realtime_quota_session_limit") return "The funded transcription duration has been reached. Start a new voice session to continue.";
 		if (this.code === "realtime_quota_workspace_budget") return "XOPC Cloud voice workspace budget is exhausted. Increase the workspace budget or choose another voice provider.";
 		if (this.status === 402 || this.code === "realtime_quota_user_credits") return "XOPC Cloud voice has insufficient Credit or quota. Check your Cloud balance and workspace budget, or choose another voice provider.";
 		if (this.status === 401 || this.status === 403) return "XOPC Cloud voice authorization failed. Sign in again and check your access to this voice model.";
@@ -80,7 +81,7 @@ function connect(url, token, signal, onEvent, onFailure) {
 		response.once("aborted", reject);
 	});
 	socket.on("error", fail);
-	socket.on("close", () => fail(/* @__PURE__ */ new Error("Platform voice disconnected before completion")));
+	socket.on("close", (code, reason) => fail(new PlatformVoiceError(`Platform voice disconnected before completion (close ${code}${reason.length ? `: ${reason.toString("utf8").slice(0, 256)}` : ""})`, void 0, "provider_disconnected")));
 	return {
 		socket,
 		close,

package/dist/src/voice/realtime/agentEngine.js

@@ -43,6 +43,7 @@ function createAgentVoiceEngine(options) {
 	let pendingTurn;
 	let turnReceivedAtMs;
 	let taskUpdateQueued = false;
+	const deliveredReplies = /* @__PURE__ */ new Set();
 	let lastUserSpeechAt = 0;
 	let openingInputSeen = false;
 	const turn = new TurnCoordinator(claim.silenceDurationMs, (text, decision, turnId) => {
@@ -314,7 +315,7 @@ function createAgentVoiceEngine(options) {
 		if (response.speechWorker) prefetchNextSpeech(response);
 		else startSpeechWorker(response);
 	}
-	async function runAssistantTurn(text, turnId, updateClientMessageId, receivedAtMs = Date.now(), committedAtMs = receivedAtMs, opening) {
+	async function runAssistantTurn(text, turnId, updateClientMessageId, receivedAtMs = Date.now(), committedAtMs = receivedAtMs, opening, directReply = false) {
 		if (!claim.tts || !claim.request.conversationId || !text.trim() || closed) return false;
 		cancelActiveResponse("barge_in");
 		const response = {
@@ -337,7 +338,7 @@ function createAgentVoiceEngine(options) {
 			taskDone: false,
 			pcm: new PcmFrameBuffer()
 		};
-		const taskUpdateExposed = () => Boolean(updateClientMessageId && response.text.trim());
+		const taskUpdateExposed = () => directReply ? response.firstFrameSent : Boolean(updateClientMessageId && response.text.trim());
 		activeResponse = response;
 		send("response.created", { responseId: response.id });
 		if (opening) response.openingTimer = setTimeout(() => {
@@ -364,14 +365,14 @@ function createAgentVoiceEngine(options) {
 			}, (error) => ({ error }));
 			await interruptionWrites;
 			if (response.abortController.signal.aborted || closed) return taskUpdateExposed();
-			if (opening) {
+			if (opening || directReply) {
 				response.text = text;
 				response.firstTextAtMs = Date.now();
 				send("response.text.delta", {
 					responseId: response.id,
 					delta: text
 				});
-				queuePhrases(response, [text]);
+				queuePhrases(response, directReply ? response.segmenter.push(text) : [text]);
 			} else {
 				if (!claim.conversationSessionId) throw new Error("Conversation identity is unavailable");
 				const task = await options.runtime.agentBroker.delegate({
@@ -487,7 +488,7 @@ function createAgentVoiceEngine(options) {
 			});
 			if (opening) opening.result = response.audioStarted ? "completed" : "failed";
 			activeResponse = void 0;
-			return !updateClientMessageId || taskUpdateExposed();
+			return directReply ? response.firstFrameSent : !updateClientMessageId || taskUpdateExposed();
 		} catch (error) {
 			if (response.abortController.signal.aborted || closed) return taskUpdateExposed();
 			log.warn({
@@ -694,6 +695,21 @@ function createAgentVoiceEngine(options) {
 	}
 	return {
 		isConversationIdle,
+		offerReply(input) {
+			if (deliveredReplies.has(input.deliveryId)) return Promise.resolve(true);
+			if (taskUpdateQueued || !canOfferTaskUpdateInput() || !input.text.trim() || input.text.length > 32e3 || deliveredReplies.size >= 256) return Promise.resolve(false);
+			taskUpdateQueued = true;
+			const attempt = conversationTail.then(async () => {
+				if (!canOfferTaskUpdateInput() || options.runtime.sessionBusy(claim.request.conversationId)) return false;
+				const delivered = await runAssistantTurn(input.text, input.deliveryId, void 0, Date.now(), Date.now(), void 0, true);
+				if (delivered) deliveredReplies.add(input.deliveryId);
+				return delivered;
+			});
+			conversationTail = attempt.then(() => {}, () => {});
+			return attempt.finally(() => {
+				taskUpdateQueued = false;
+			});
+		},
 		async offerOpeningGreeting(input) {
 			if (openingInputSeen || !canOfferTaskUpdateInput() || options.runtime.sessionBusy(claim.request.conversationId)) return "skipped";
 			const opening = {

package/dist/src/voice/realtime/engine.d.ts

@@ -22,5 +22,9 @@ export interface VoiceEngine {
         clientMessageId: string;
         content: string;
     }): Promise<boolean>;
+    offerReply?(input: {
+        deliveryId: string;
+        text: string;
+    }): Promise<boolean>;
     close(): void | Promise<void>;
 }

package/dist/src/voice/realtime/memory-context.js

@@ -3,16 +3,20 @@ import { init_logger } from "../../utils/logger.js";
 import { getSessionMetadata } from "../../storage/sqlite/session-read-repository.js";
 import { init_session_repository } from "../../storage/sqlite/session-repository.js";
 import { getSessionConfig, init_config_repository } from "../../storage/sqlite/config-repository.js";
+import { canUseKnowledge } from "../../knowledge-memory/usage-policy.js";
+import { getKnowledgeItem } from "../../knowledge-memory/repository.js";
+import { init_config, resolveKnowledgeReadPolicy } from "../../user-context/config.js";
 import { getConversationRouting } from "../../storage/sqlite/conversation-repository.js";
 import { getConversation } from "../../routing/agent-session-key.js";
 import { init_session_key } from "../../routing/session-key.js";
-import { getKnowledgeItem } from "../../knowledge-memory/repository.js";
+import { resolveUserContextSessionAccess } from "../../user-context/access-policy.js";
 import "../../knowledge-memory/index.js";
+import { stripRuntimeContextFromUserMessage } from "../../session/user-message-display.js";
 import { getUserAssertion } from "../../user-model/repository.js";
 import "../../user-model/index.js";
-import { stripRuntimeContextFromUserMessage } from "../../session/user-message-display.js";
 import { buildExecutionContext } from "../../agent/context/execution-context.js";
 //#region src/voice/realtime/memory-context.ts
+init_config();
 init_session_key();
 init_config_repository();
 init_session_repository();
@@ -35,7 +39,7 @@ function buildVoiceMemoryContext(input) {
 	const started = performance.now();
 	try {
 		const config = input.getConfig();
-		if (!voiceMemoryEnabled(config, input.conversationId) || input.maxChars < 128) return;
+		if (!resolveUserContextSessionAccess(config, input.conversationId).userModel || !voiceMemoryEnabled(config, input.conversationId) || input.maxChars < 128) return;
 		const session = getSessionMetadata(input.conversationId);
 		const context = buildExecutionContext({
 			query: voiceMemoryQuery(input.history),
@@ -44,7 +48,9 @@ function buildVoiceMemoryContext(input) {
 			projectId: input.projectId,
 			conversationId: input.conversationId,
 			maxAssertions: 6,
-			maxKnowledge: 3
+			maxKnowledge: 3,
+			includeKnowledge: resolveUserContextSessionAccess(config, input.conversationId).knowledge,
+			knowledgePolicy: resolveKnowledgeReadPolicy(config.userContext.knowledgeMemory)
 		});
 		const block = JSON.stringify({ backgroundMemory: {
 			userFacts: context.assertions.map((item) => item.assertion.statement),
@@ -64,7 +70,15 @@ function buildVoiceMemoryContext(input) {
 		const configVersion = JSON.stringify(config.userContext);
 		const isCurrent = () => {
 			if (!voiceMemoryEnabled(input.getConfig(), input.conversationId) || JSON.stringify(input.getConfig().userContext) !== configVersion) return false;
-			return references.every((reference) => reference.kind === "assertion" ? getUserAssertion(reference.id)?.recordedAt === reference.updatedAt : getKnowledgeItem(reference.id)?.updatedAt === reference.updatedAt);
+			return references.every((reference) => reference.kind === "assertion" ? getUserAssertion(reference.id)?.recordedAt === reference.updatedAt : (() => {
+				const item = getKnowledgeItem(reference.id);
+				return Boolean(item && item.updatedAt === reference.updatedAt && canUseKnowledge(item, {
+					agentId: session?.routing?.agentId ?? "main",
+					workspaceId: input.workspaceId,
+					projectId: input.projectId,
+					conversationId: input.conversationId
+				}, resolveKnowledgeReadPolicy(input.getConfig().userContext.knowledgeMemory)));
+			})());
 		};
 		log.debug({
 			conversationId: input.conversationId,

package/dist/src/voice/realtime/runtime.d.ts

@@ -29,6 +29,11 @@ export declare class VoiceRealtimeRuntime {
     hasConversation(conversationId: string): boolean;
     canPublishReply(conversationId: string): boolean;
     canOfferTaskUpdate(conversationId: string): boolean;
+    offerReply(input: {
+        conversationId: string;
+        deliveryId: string;
+        text: string;
+    }): Promise<boolean>;
     offerTaskUpdate(input: {
         conversationId: string;
         clientMessageId: string;

package/dist/src/voice/realtime/runtime.js

@@ -333,6 +333,10 @@ var VoiceRealtimeRuntime = class {
 		const sessionId = this.conversationReservations.get(conversationId);
 		return (sessionId ? this.activeSessions.get(sessionId) : void 0)?.engine?.canOfferTaskUpdate?.() === true;
 	}
+	async offerReply(input) {
+		const sessionId = this.conversationReservations.get(input.conversationId);
+		return (sessionId ? this.activeSessions.get(sessionId) : void 0)?.engine?.offerReply?.(input) ?? false;
+	}
 	async offerTaskUpdate(input) {
 		const sessionId = this.conversationReservations.get(input.conversationId);
 		const session = sessionId ? this.activeSessions.get(sessionId) : void 0;

package/dist/src/work-discovery/incremental-repository.js

@@ -1,5 +1,5 @@
-import { getWorkDiscoveryRun } from "./repository.js";
 import { createUnderstandingSourceRun, listUnderstandingSourceGrants, listUnderstandingSourceRuns, updateUnderstandingSourceRun } from "../user-context/sources/repository.js";
+import { getWorkDiscoveryRun } from "./repository.js";
 import { workDiscoveryFingerprintsEqual } from "./incremental.js";
 //#region src/work-discovery/incremental-repository.ts
 function refreshFromRun(run) {

package/dist/src/work-discovery/service.js

@@ -5,19 +5,19 @@ import { createContextEvidence, init_context_evidence_repository } from "../stor
 import { ensureSessionRecord, patchSessionMetadata } from "../storage/sqlite/session-repository.js";
 import { init_sqlite } from "../storage/sqlite/index.js";
 import { ActivityService } from "../activity/service.js";
-import { getAgentDefaultModelRef, init_schema } from "../config/schema.js";
+import { createUnderstandingSourceRun, getUnderstandingSourceGrant, getUnderstandingSourceRun, updateUnderstandingSourceGrantCheckpoint, updateUnderstandingSourceGrantPolicies, updateUnderstandingSourceRun, upsertUnderstandingSourceGrant } from "../user-context/sources/repository.js";
+import { writeKnowledgeItem } from "../knowledge-memory/repository.js";
 import { init_session_key, resolveConversationId } from "../routing/session-key.js";
+import "../knowledge-memory/index.js";
 import { getDefaultAgentId, init_resolve_route } from "../routing/resolve-route.js";
 import { resolveEffectiveAgentProfile } from "../config/agent-profile.js";
+import { getAgentDefaultModelRef, init_schema } from "../config/schema.js";
 import { init_providers, resolveModel } from "../providers/index.js";
-import { writeKnowledgeItem } from "../knowledge-memory/repository.js";
-import "../knowledge-memory/index.js";
-import { linkAssertionEvidence, reconcileAssertion } from "../user-model/repository.js";
+import { isLocalModelBaseUrl } from "../providers/model-call.js";
 import { createPriorityWindow, createUserGoal } from "../user-model/goals.js";
+import { linkAssertionEvidence, reconcileAssertion } from "../user-model/repository.js";
 import "../user-model/index.js";
 import { createWorkDiscoveryRun, getProjectUnderstandingRun, getWorkDiscoveryOnboardingState, getWorkDiscoveryRun, getWorkDiscoveryRunByIdempotencyKey, listPendingProjectUnderstandingRuns, setWorkDiscoveryFeedback, setWorkDiscoveryOnboardingState, updateWorkDiscoveryRun } from "./repository.js";
-import { isLocalModelBaseUrl } from "../providers/model-call.js";
-import { createUnderstandingSourceRun, getUnderstandingSourceGrant, getUnderstandingSourceRun, updateUnderstandingSourceGrantCheckpoint, updateUnderstandingSourceGrantPolicies, updateUnderstandingSourceRun, upsertUnderstandingSourceGrant } from "../user-context/sources/repository.js";
 import { allowsRemoteSourceProcessing } from "../user-context/sources/processing-policy.js";
 import { analyzeUnderstandingSources, analyzeWorkContext, workDiscoveryResultMarkdown } from "./analyzer.js";
 import { clusterActivityTopics } from "../user-context/sources/activity-clustering.js";

package/dist/src/workflows/service/workflow-run-service.js

@@ -3,6 +3,7 @@ import { TaskRunRepository, init_task_run_repository } from "../../tasks/task-ru
 import { init_conversation_repository, resolveRoutedConversation } from "../../storage/sqlite/conversation-repository.js";
 import { getDefaultAgentId, init_resolve_route } from "../../routing/resolve-route.js";
 import { extractProfileAgentId, resolveEffectiveAgentProfile, resolveEffectiveAgentProfileForSession } from "../../config/agent-profile.js";
+import { resolveModelSelector } from "../../config/agent-model-intents.js";
 import { init_providers, resolveModel } from "../../providers/index.js";
 import { getProjectWorkspacePathForSession } from "../../projects/workspace.js";
 import { TaskConversationRepository } from "../../tasks/task-conversation-repository.js";
@@ -12,7 +13,6 @@ import { validateWorkflowJsonSchema } from "../domain/schema-validation.js";
 import "../domain/index.js";
 import { TaskContextRepository } from "../../tasks/task-context-repository.js";
 import { TaskApplicationService } from "../../tasks/task-application-service.js";
-import { resolveModelSelector } from "../../config/agent-model-intents.js";
 import { DelegateSubagentRunner } from "../../agent/workflow/subagent-runner.js";
 import { preflightWorkflowConnectors } from "../../connectors/workflow-preflight.js";
 import { CatalogWorkflowDefinitionRegistry } from "../registry/catalog-workflow-definition-registry.js";