@xopcai/xopc 0.0.392 → 0.0.393

package/dist/src/agent/skills/skill-manage-ops.js

@@ -1,5 +1,5 @@
-import { init_paths, resolveSkillsDir } from "../../config/paths.js";
 import { parseFrontmatter } from "../../markdown/frontmatter.js";
+import { init_paths, resolveSkillsDir } from "../../config/paths.js";
 import { resolveWorkspaceSkillsDir } from "./workspace-skills-dir.js";
 import { formatScanSummary, scanSkillDirectory } from "./scanner.js";
 import { fuzzyFindText, normalizeForFuzzyMatch, normalizeToLF, restoreLineEndings } from "../tools/edit-diff.js";

package/dist/src/agent/tool-manuals/xopc-use.d.ts

@@ -1 +1 @@
-export declare const xopcUseManual = "# XOPC Use Tool Manual\n\n## Purpose\n\n`xopc_use` operates first-class XOPC product objects without editing SQLite or product files directly.\nLoad this manual before a non-trivial mutation.\n\n```json\n{\n  \"mode\": \"agent | project | automation | note | task | task_run | chat_preview | local_app | settings\",\n  \"command\": \"...\",\n  \"args\": {},\n  \"dryRun\": false\n}\n```\n\nSend one object command per call. Inspect the returned JSON `ok` field; a tool call can\ncomplete successfully while the product command returns `ok: false`.\n\n## Object routing\n\n| Object | Tool |\n| --- | --- |\n| Agent definition and default Agent | `xopc_use` mode `agent` |\n| Project, milestone, project update | `xopc_use` mode `project` |\n| Automation | `xopc_use` mode `automation` |\n| Task intent and lifecycle | `xopc_use` mode `task` |\n| Task execution attempt, receipt, events and waits | `xopc_use` mode `task_run` |\n| Note | `xopc_use` mode `note` |\n| Lightweight UI preview | `xopc_use` mode `chat_preview` |\n| Local app | `xopc_use` mode `local_app` |\n| Settings jump target | `xopc_use` mode `settings` |\n| Workflow run | dedicated `workflow` tool; pass `taskId` to link it to a Task |\n| Session, memory, skill, connected app or workspace file | its dedicated tool |\n\nDo not emulate Workflow APIs through `xopc_use`. A Task is durable intent;\na TaskRun is one execution attempt; a WorkflowRun is a procedure execution and may belong\nto a TaskRun. Never treat these three objects as interchangeable.\n\n## Agents\n\nCommands: `list`, `get`, `create`, `update`, `set_default`, `disable`,\n`delete`, and `purge`.\n\nAn Agent profile stores `name` and optional `description`, `creature`, `style`, `language`,\n`emoji`, and `avatar` identity fields. Use `instructions` for short execution rules.\nPut personality in SOUL.md and ongoing work guidance in AGENTS.md.\n\n```json\n{\n  \"mode\": \"agent\",\n  \"command\": \"create\",\n  \"args\": {\n    \"id\": \"xiaomei\",\n    \"profile\": {\n      \"name\": \"\u5C0F\u7F8E\",\n      \"description\": \"\u5E2E\u52A9\u6574\u7406\u65E5\u5E38\u4E8B\u9879\",\n      \"language\": \"zh-CN\",\n      \"style\": \"\u6E29\u67D4\u3001\u4EB2\u5207\",\n      \"instructions\": \"\u7ED9\u51FA\u64CD\u4F5C\u5EFA\u8BAE\u524D\u5148\u6838\u5BF9\u5173\u952E\u4E8B\u5B9E\u3002\"\n    },\n    \"idempotencyKey\": \"create-agent-xiaomei\"\n  }\n}\n```\n\nUse `list` before creating an Agent so an existing id is updated rather than duplicated.\nMutations other than `create` require the current `expectedRevision`; `set_default` uses\nthe catalog revision returned by `list`. `delete` preserves on-disk data, while `purge`\nalso removes it. Use `dryRun: true` to validate the exact same input contract without writing.\n\n## Reliable protocol\n\n1. Use `list` then `get` when an id is unknown.\n2. Read the current `version` before a Task mutation.\n3. Use `dryRun: true` for broad Project changes or uncertain mutations.\n4. Mutate once with the exact id and current concurrency token.\n5. Verify the returned object and preserve any \u201COpen in xopc\u201D delivery link.\n6. On a conflict, read again and reconsider the operation; do not blindly retry.\n\nTimestamps are Unix epoch milliseconds. Array fields are arrays of strings. Omission\npreserves a patchable field; an empty array intentionally clears it. Prefer explicit\n`projectId`, `taskId`, `runId`, `noteId`, and `localAppId` fields over `id`.\n\n## Projects\n\nCommands: `list`, `get`, `create`, `update`, `resolve_workspace`,\n`list_milestones`, `create_milestone`, `update_milestone`, `list_updates`,\nand `create_update`.\n\nProject statuses: `planned`, `active`, `paused`, `completed`, `cancelled`,\n`archived`. Health values: `unknown`, `on_track`, `at_risk`, `off_track`.\n\nA Project defines bounded shared context for related work. Its durable planning fields are `outcome`,\n`successCriteria`, `scope`, `nonGoals`, `ownerId`, `targetAt`, and `health`.\nUse `brief` for a concise description and `instructions` for durable operating guidance.\n\n### Create\n\n```json\n{\n  \"mode\": \"project\",\n  \"command\": \"create\",\n  \"args\": {\n    \"name\": \"AI Product Research\",\n    \"outcome\": \"Choose a validated product direction\",\n    \"successCriteria\": [\"Ten customer interviews\", \"Decision recorded\"],\n    \"scope\": { \"market\": \"developer tools\" },\n    \"nonGoals\": [\"Build the production product\"],\n    \"health\": \"on_track\",\n    \"targetAt\": 1760000000000,\n    \"workspaceRoot\": \"/path/to/repo\"\n  }\n}\n```\n\n### Update\n\n```json\n{\n  \"mode\": \"project\",\n  \"command\": \"update\",\n  \"args\": {\n    \"projectId\": \"project_id\",\n    \"status\": \"active\",\n    \"health\": \"at_risk\",\n    \"successCriteria\": [\"Ten interviews\", \"Evidence-backed decision\"]\n  }\n}\n```\n\n### Resolve a workspace\n\nUse `autoCreate: false` for lookup. Set it to true only when creating a Project is authorized.\n\n```json\n{ \"mode\": \"project\", \"command\": \"resolve_workspace\", \"args\": { \"workspacePath\": \"/path/to/repo\", \"autoCreate\": false } }\n```\n\n### Milestones\n\nMilestone statuses: `planned`, `active`, `completed`, `cancelled`.\n\n```json\n{\n  \"mode\": \"project\",\n  \"command\": \"create_milestone\",\n  \"args\": {\n    \"projectId\": \"project_id\",\n    \"title\": \"Finish discovery\",\n    \"status\": \"active\",\n    \"targetAt\": 1760000000000,\n    \"sortOrder\": 10\n  }\n}\n```\n\nUse `list_milestones` with `projectId`. Use `update_milestone` with both\n`projectId` and `milestoneId`. Milestone deletion is intentionally not exposed.\n\n### Immutable project updates\n\nProject updates are append-only progress snapshots. They also update Project health.\n\n```json\n{\n  \"mode\": \"project\",\n  \"command\": \"create_update\",\n  \"args\": {\n    \"projectId\": \"project_id\",\n    \"health\": \"on_track\",\n    \"summary\": \"Discovery is complete\",\n    \"progress\": [\"Interviewed ten users\"],\n    \"risks\": [\"Pricing remains unvalidated\"],\n    \"nextSteps\": [\"Run pricing tests\"]\n  }\n}\n```\n\nUse `list_updates` with `projectId` and optional `limit`. Updates cannot be edited.\n\n## Automations\n\nCommands: `list`, `get`, `create`, `update`, `delete`, `run`, `pause`,\n`resume`, and `history`.\n\nAutomation `create` automatically uses the current session Project when `projectId` is\nomitted. An explicit `projectId` takes precedence and is validated before mutation. Use an\nexplicit id when creating for a Project other than the current session Project.\n\n### Create in the current Project\n\n`trigger` and `action` use the same shapes as the Automation product API.\n\n```json\n{\n  \"mode\": \"automation\",\n  \"command\": \"create\",\n  \"args\": {\n    \"name\": \"Daily project review\",\n    \"trigger\": { \"kind\": \"schedule\", \"schedule\": { \"kind\": \"cron\", \"expr\": \"0 9 * * 1-5\", \"tz\": \"Asia/Shanghai\" } },\n    \"action\": { \"kind\": \"agent\", \"instruction\": \"Review the current project and summarize risks.\" }\n  }\n}\n```\n\nTo override the inherited Project, add `\"projectId\": \"project_id\"` to `args`.\nThe create payload may also be nested under `args.automation`; top-level `args.projectId`\nhas precedence.\n\n### List and history\n\n`list` and unqualified `history` inherit the current session Project. Pass an explicit\n`projectId` to query another Project. Pass `automationId` to `history` for one Automation.\n\n### Update and operate\n\nUse `automationId` for `get`, `update`, `delete`, `run`, `pause`, and `resume`.\nFor `update`, patch fields may be direct args or nested under `args.patch`. Supplying a new\n`projectId` reassigns the Automation after validating the target Project.\n\n## Tasks\n\nCommands: `list`, `get`, `create`, `delegated_tasks`, `collaboration`,\n`collaboration_post`, `update_dependencies`, `add_context`, `remove_context`,\n`command`, and `delete`.\n\nTask phases are `backlog`, `ready`, `active`, `review`, and `closed`.\nOperational state is projected separately as `idle`, `queued`, `running`, `waiting`,\n`verifying`, `succeeded`, `failed`, or `cancelled`. Never send either value as a\nfree-form status update.\n\n`task.get` returns the Task, its projected `model`, dependencies, dependents, context,\nauthority grants, TaskRuns, receipts, and waits.\nThe projected model is the correct source for current operational state and attention items.\n\n`delete` permanently removes the Task and its contracts, waits, context links, TaskRuns,\nreceipts, and Task-owned execution records. It does not delete linked Sessions, workspace files,\nor external artifacts. Cancel an active TaskRun before deletion, and use `dryRun: true` when\nthe user's intent is ambiguous.\n\n```json\n{ \"mode\": \"task\", \"command\": \"delete\", \"args\": { \"taskId\": \"task_id\" }, \"dryRun\": true }\n```\n\n### Capture or start\n\n`createMode` defaults to `capture`, which creates a backlog Task without executing it.\nUse `start` only when immediate execution is intended.\n\nFor an immediate delegated task, use the minimal call below. The objective can include the\nworker instructions and constraints; optional lists are unnecessary for a simple delegation.\n\n```json\n{ \"mode\": \"task\", \"command\": \"create\", \"args\": { \"objective\": \"Calculate the requested result and report progress\", \"createMode\": \"start\" } }\n```\n\n```json\n{\n  \"mode\": \"task\",\n  \"command\": \"create\",\n  \"args\": {\n    \"objective\": \"Complete the customer research report\",\n    \"projectId\": \"project_id\",\n    \"createMode\": \"capture\",\n    \"priority\": \"high\",\n    \"expectedOutputs\": [\"Research report\"],\n    \"acceptanceCriteria\": [\"Sources are cited\"],\n    \"constraints\": [\"Do not contact customers without approval\"],\n    \"dependsOnTaskIds\": []\n  }\n}\n```\n\n### Main Agent and worker collaboration\n\nThe user-facing Agent can call `delegated_tasks` to list Tasks created from this conversation,\nthen `collaboration` with `{ \"taskId\": \"...\", \"afterSequence\": 0 }` to read the ordered board.\nUse the Task and TaskRun receipt as the final source of execution status.\n\nUse `collaboration_post` with `taskId`, `kind`, `body`, and a stable `idempotencyKey`.\nThe main Agent may write `instruction`, `question`, or `answer`; answers include\n`causationId` of the worker's question. The worker may write `progress`, `question`,\nor `ack`; acknowledgements include `causationId` of the instruction. A worker question\npauses the active TaskRun. After posting it, stop the execution turn and wait for an answer.\nAn instruction is first recorded, then delivered to the worker conversation, and is only\nconfirmed when the worker acknowledges it. Ordinary progress does not interrupt the user.\n\n```json\n{ \"mode\": \"task\", \"command\": \"collaboration_post\", \"args\": { \"taskId\": \"task_id\", \"kind\": \"progress\", \"body\": \"Completed source review\", \"idempotencyKey\": \"stable-key\" } }\n```\n\n### Dependencies\n\n```json\n{\n  \"mode\": \"task\",\n  \"command\": \"update_dependencies\",\n  \"args\": {\n    \"taskId\": \"task_id\",\n    \"expectedVersion\": 3,\n    \"dependsOnTaskIds\": [\"dependency_task_id\"]\n  }\n}\n```\n\n### Context links\n\nUse `add_context` to link a document, file, URL, session, memory, Task, artifact, or source\nas `input`, `reference`, `constraint`, `deliverable`, or `evidence` context.\n\n```json\n{\n  \"mode\": \"task\",\n  \"command\": \"add_context\",\n  \"args\": {\n    \"taskId\": \"task_id\",\n    \"targetKind\": \"file\",\n    \"targetId\": \"/path/to/spec.md\",\n    \"role\": \"input\",\n    \"title\": \"Product specification\",\n    \"pinned\": true,\n    \"retrievalPolicy\": {},\n    \"metadata\": {}\n  }\n}\n```\n\nUse `remove_context` with `taskId` and the exact `edgeId` returned by `task.get`.\nDo not add authority grants through this tool; an Agent must not authorize itself.\n\n### Typed lifecycle commands\n\nEvery command requires `taskId`, the Task's current `expectedVersion`, a `type`, and\ntype-specific fields inside `commandArgs`.\n\nSupported command types:\n\n- `mark_ready`\n- `start`: `{ \"executor\": { \"kind\": \"agent\", \"agentId\": \"main\" } }`\n- `request_review`\n- `close`: `{ \"resolution\": \"done | cancelled | duplicate | wont_do\" }`\n- `reopen`: `{ \"phase\": \"ready | active\" }`\n- `add_wait`: `{ \"wait\": { \"kind\": \"dependency | approval | input | schedule | external | paused\", \"reason\": \"...\", \"condition\": {} } }`\n- `resolve_wait`: `{ \"waitId\": \"wait_id\", \"resolution\": {} }`\n- `delegate`: `{ \"agentId\": \"agent_id\" }`\n- `revise_contract`: `{ \"contract\": { ...complete contract... } }`\n\n```json\n{\n  \"mode\": \"task\",\n  \"command\": \"command\",\n  \"args\": {\n    \"taskId\": \"task_id\",\n    \"expectedVersion\": 3,\n    \"type\": \"start\",\n    \"commandArgs\": {\n      \"executor\": { \"kind\": \"agent\", \"agentId\": \"main\" }\n    }\n  }\n}\n```\n\nContract revision is replacement, not a patch. Read the Task and preserve all contract fields\nthe user did not ask to change. Resolve a wait through `resolve_wait`; do not directly mutate\na TaskRun or manufacture a phase transition.\n\n## TaskRuns\n\nTaskRun inspection is read-only except for explicit cancellation. Other execution state is\ncontrolled by Task commands and the runtime coordinator.\n\n### List attempts for a Task\n\n```json\n{ \"mode\": \"task_run\", \"command\": \"list\", \"args\": { \"taskId\": \"task_id\", \"limit\": 20 } }\n```\n\nThe result contains run attempts, finalized receipts, and active waits.\n\n### Inspect one attempt\n\n```json\n{ \"mode\": \"task_run\", \"command\": \"get\", \"args\": { \"runId\": \"run_id\" } }\n```\n\nThe result contains the TaskRun, its receipt when terminal, ordered events, and active Task waits.\n\n### Cancel an attempt\n\nRead the run first, then pass its current version. Cancellation creates a terminal receipt.\n\n```json\n{\n  \"mode\": \"task_run\",\n  \"command\": \"cancel\",\n  \"args\": { \"runId\": \"run_id\", \"expectedVersion\": 2, \"reason\": \"User cancelled execution\" }\n}\n```\n\nDo not guess commands such as retry, force-complete, heartbeat, or transition; they are not Agent APIs.\n\n## Notes\n\nCommands: `list`, `get`, `create`, `append`, `preview_edit`, `update`, and `delete`.\nUse Notes for durable prose and reference material, not as a Task substitute. Prefer `append`\nwhen preserving user content. Use `preview_edit` before a canonical rewrite.\n\n```json\n{ \"mode\": \"note\", \"command\": \"create\", \"args\": { \"title\": \"Decision\", \"markdown\": \"...\", \"projectId\": \"project_id\" } }\n```\n\n```json\n{ \"mode\": \"note\", \"command\": \"append\", \"args\": { \"noteId\": \"note_id\", \"heading\": \"AI synthesis\", \"content\": \"...\" } }\n```\n\nUse `update` with `status: \"trashed\"` for a recoverable removal. `delete` permanently\nremoves the Note and its stored snapshots and media; use `dryRun: true` first when the\nuser's intent is ambiguous.\n\n```json\n{ \"mode\": \"note\", \"command\": \"delete\", \"args\": { \"noteId\": \"note_id\" }, \"dryRun\": true }\n```\n\n## Chat previews, local apps, and settings\n\nUse `chat_preview` by default when the user asks to design, mock up, or quickly show a UI in\nthe current conversation. It creates no Project and no Local App. Commands are `create`,\n`get`, and `revise`. Source consists of `markup`, `styles`, and optional `script`;\ndo not include a full HTML document or remote dependencies. Revision requires the exact\n`baseRevision` returned by the prior call.\n\nUse `local_app` only when the user explicitly asks for a durable, installable app or chooses\n\u201CSave as app\u201D on a chat preview. Do not create a Local App merely to render a UI draft.\n\nLocal app commands are `list`, `get`, `create`, and `validate`. Installation,\nactivation, rollback, and uninstall remain product runtime operations.\n\nSettings supports only `open` and returns an exact product jump target without changing config.\n\n## Error recovery\n\n| Result | Recovery |\n| --- | --- |\n| service unavailable | Stop retrying and report the unavailable capability. |\n| not found | Re-list in the intended scope; do not invent another id. |\n| conflict | Read the current object and reassess using its latest version. |\n| waiting | Inspect the Task projection and TaskRun waits; resolve only the real blocker. |\n| invalid command or state | Read the object and use only a documented transition. |\n| unsupported operation | Use the dedicated tool or product UI; never write storage directly. |\n\n## Deliberate boundaries\n\n- Project deletion and milestone deletion are not Agent APIs.\n- TaskRun mutation is internal to execution coordination except for optimistic cancellation.\n- Project updates are immutable.\n- Workflow and Automation operations remain in their dedicated tools.\n- Only the documented Task and TaskRun commands are valid; do not infer hidden aliases.\n";
+export declare const xopcUseManual = "# XOPC Use Tool Manual\n\n## Purpose\n\n`xopc_use` operates first-class XOPC product objects without editing SQLite or product files directly.\nLoad this manual before a non-trivial mutation.\n\n```json\n{\n  \"mode\": \"agent | project | automation | note | task | task_run | chat_preview | local_app | settings\",\n  \"command\": \"...\",\n  \"args\": {},\n  \"dryRun\": false\n}\n```\n\nSend one object command per call. Inspect the returned JSON `ok` field; a tool call can\ncomplete successfully while the product command returns `ok: false`.\n\n## Object routing\n\n| Object | Tool |\n| --- | --- |\n| Agent definition and default Agent | `xopc_use` mode `agent` |\n| Project, milestone, project update | `xopc_use` mode `project` |\n| Automation | `xopc_use` mode `automation` |\n| Task intent and lifecycle | `xopc_use` mode `task` |\n| Task execution attempt, receipt, events and waits | `xopc_use` mode `task_run` |\n| Note | `xopc_use` mode `note` |\n| Lightweight UI preview | `xopc_use` mode `chat_preview` |\n| Local app | `xopc_use` mode `local_app` |\n| Settings jump target | `xopc_use` mode `settings` |\n| Workflow run | dedicated `workflow` tool; pass `taskId` to link it to a Task |\n| Session, memory, skill, connected app or workspace file | its dedicated tool |\n\nDo not emulate Workflow APIs through `xopc_use`. A Task is durable intent;\na TaskRun is one execution attempt; a WorkflowRun is a procedure execution and may belong\nto a TaskRun. Never treat these three objects as interchangeable.\n\n## Agents\n\nCommands: `list`, `get`, `create`, `update`, `set_default`, `disable`,\n`delete`, and `purge`.\n\nAn Agent profile stores `name` and optional `description`, `creature`, `style`, `language`,\n`emoji`, and `avatar` identity fields. Use `instructions` for short execution rules.\nPut personality in SOUL.md and ongoing work guidance in AGENTS.md.\n\n```json\n{\n  \"mode\": \"agent\",\n  \"command\": \"create\",\n  \"args\": {\n    \"id\": \"xiaomei\",\n    \"profile\": {\n      \"name\": \"\u5C0F\u7F8E\",\n      \"description\": \"\u5E2E\u52A9\u6574\u7406\u65E5\u5E38\u4E8B\u9879\",\n      \"language\": \"zh-CN\",\n      \"style\": \"\u6E29\u67D4\u3001\u4EB2\u5207\",\n      \"instructions\": \"\u7ED9\u51FA\u64CD\u4F5C\u5EFA\u8BAE\u524D\u5148\u6838\u5BF9\u5173\u952E\u4E8B\u5B9E\u3002\"\n    },\n    \"idempotencyKey\": \"create-agent-xiaomei\"\n  }\n}\n```\n\nUse `list` before creating an Agent so an existing id is updated rather than duplicated.\nMutations other than `create` require the current `expectedRevision`; `set_default` uses\nthe catalog revision returned by `list`. `delete` preserves on-disk data, while `purge`\nalso removes it. Use `dryRun: true` to validate the exact same input contract without writing.\n\n## Reliable protocol\n\n1. Use `list` then `get` when an id is unknown.\n2. Read the current `version` before a Task mutation.\n3. Use `dryRun: true` for broad Project changes or uncertain mutations.\n4. Mutate once with the exact id and current concurrency token.\n5. Verify the returned object and preserve any \u201COpen in xopc\u201D delivery link.\n6. On a conflict, read again and reconsider the operation; do not blindly retry.\n\nTimestamps are Unix epoch milliseconds. Array fields are arrays of strings. Omission\npreserves a patchable field; an empty array intentionally clears it. Prefer explicit\n`projectId`, `taskId`, `runId`, `noteId`, and `localAppId` fields over `id`.\n\n## Projects\n\nCommands: `list`, `get`, `create`, `update`, `resolve_workspace`,\n`list_milestones`, `create_milestone`, `update_milestone`, `list_updates`,\nand `create_update`.\n\nProject statuses: `planned`, `active`, `paused`, `completed`, `cancelled`,\n`archived`. Health values: `unknown`, `on_track`, `at_risk`, `off_track`.\n\nA Project defines bounded shared context for related work. Its durable planning fields are `outcome`,\n`successCriteria`, `scope`, `nonGoals`, `ownerId`, `targetAt`, and `health`.\nUse `brief` for a concise description and `instructions` for durable operating guidance.\n\n### Create\n\n```json\n{\n  \"mode\": \"project\",\n  \"command\": \"create\",\n  \"args\": {\n    \"name\": \"AI Product Research\",\n    \"outcome\": \"Choose a validated product direction\",\n    \"successCriteria\": [\"Ten customer interviews\", \"Decision recorded\"],\n    \"scope\": { \"market\": \"developer tools\" },\n    \"nonGoals\": [\"Build the production product\"],\n    \"health\": \"on_track\",\n    \"targetAt\": 1760000000000,\n    \"workspaceRoot\": \"/path/to/repo\"\n  }\n}\n```\n\n### Update\n\n```json\n{\n  \"mode\": \"project\",\n  \"command\": \"update\",\n  \"args\": {\n    \"projectId\": \"project_id\",\n    \"status\": \"active\",\n    \"health\": \"at_risk\",\n    \"successCriteria\": [\"Ten interviews\", \"Evidence-backed decision\"]\n  }\n}\n```\n\n### Resolve a workspace\n\nUse `autoCreate: false` for lookup. Set it to true only when creating a Project is authorized.\n\n```json\n{ \"mode\": \"project\", \"command\": \"resolve_workspace\", \"args\": { \"workspacePath\": \"/path/to/repo\", \"autoCreate\": false } }\n```\n\n### Milestones\n\nMilestone statuses: `planned`, `active`, `completed`, `cancelled`.\n\n```json\n{\n  \"mode\": \"project\",\n  \"command\": \"create_milestone\",\n  \"args\": {\n    \"projectId\": \"project_id\",\n    \"title\": \"Finish discovery\",\n    \"status\": \"active\",\n    \"targetAt\": 1760000000000,\n    \"sortOrder\": 10\n  }\n}\n```\n\nUse `list_milestones` with `projectId`. Use `update_milestone` with both\n`projectId` and `milestoneId`. Milestone deletion is intentionally not exposed.\n\n### Immutable project updates\n\nProject updates are append-only progress snapshots. They also update Project health.\n\n```json\n{\n  \"mode\": \"project\",\n  \"command\": \"create_update\",\n  \"args\": {\n    \"projectId\": \"project_id\",\n    \"health\": \"on_track\",\n    \"summary\": \"Discovery is complete\",\n    \"progress\": [\"Interviewed ten users\"],\n    \"risks\": [\"Pricing remains unvalidated\"],\n    \"nextSteps\": [\"Run pricing tests\"]\n  }\n}\n```\n\nUse `list_updates` with `projectId` and optional `limit`. Updates cannot be edited.\n\n## Automations\n\nCommands: `list`, `get`, `create`, `update`, `delete`, `run`, `pause`,\n`resume`, and `history`.\n\nAutomation `create` automatically uses the current session Project when `projectId` is\nomitted. An explicit `projectId` takes precedence and is validated before mutation. Use an\nexplicit id when creating for a Project other than the current session Project.\n\n### Create in the current Project\n\n`trigger` and `action` use the same shapes as the Automation product API.\n\n```json\n{\n  \"mode\": \"automation\",\n  \"command\": \"create\",\n  \"args\": {\n    \"name\": \"Daily project review\",\n    \"trigger\": { \"kind\": \"schedule\", \"schedule\": { \"kind\": \"cron\", \"expr\": \"0 9 * * 1-5\", \"tz\": \"Asia/Shanghai\" } },\n    \"action\": { \"kind\": \"agent\", \"instruction\": \"Review the current project and summarize risks.\" }\n  }\n}\n```\n\nTo override the inherited Project, add `\"projectId\": \"project_id\"` to `args`.\nThe create payload may also be nested under `args.automation`; top-level `args.projectId`\nhas precedence.\n\n### List and history\n\n`list` and unqualified `history` inherit the current session Project. Pass an explicit\n`projectId` to query another Project. Pass `automationId` to `history` for one Automation.\n\n### Update and operate\n\nUse `automationId` for `get`, `update`, `delete`, `run`, `pause`, and `resume`.\nFor `update`, patch fields may be direct args or nested under `args.patch`. Supplying a new\n`projectId` reassigns the Automation after validating the target Project.\n\n## Tasks\n\nTask locale follows the conversation response language, then the user request and profile.\nKeep every user-facing contract field (criteria, expected outputs, constraints, assumptions and risks)\nin that language, even when attached source material is English. Preserve paths, URLs and proper nouns.\nAn explicit locale must reflect the user\u2019s language choice.\n\nCommands: `list`, `get`, `create`, `delegated_tasks`, `collaboration`,\n`collaboration_post`, `update_dependencies`, `add_context`, `remove_context`,\n`command`, and `delete`.\n\nTask phases are `backlog`, `ready`, `active`, `review`, and `closed`.\nOperational state is projected separately as `idle`, `queued`, `running`, `waiting`,\n`verifying`, `succeeded`, `failed`, or `cancelled`. Never send either value as a\nfree-form status update.\n\n`task.get` returns the Task, its projected `model`, dependencies, dependents, context,\nauthority grants, TaskRuns, receipts, and waits.\nThe projected model is the correct source for current operational state and attention items.\n\n`delete` permanently removes the Task and its contracts, waits, context links, TaskRuns,\nreceipts, and Task-owned execution records. It does not delete linked Sessions, workspace files,\nor external artifacts. Cancel an active TaskRun before deletion, and use `dryRun: true` when\nthe user's intent is ambiguous.\n\n```json\n{ \"mode\": \"task\", \"command\": \"delete\", \"args\": { \"taskId\": \"task_id\" }, \"dryRun\": true }\n```\n\n### Capture or start\n\n`createMode` defaults to `capture`, which creates a backlog Task without executing it.\nUse `start` only when immediate execution is intended.\n\nFor an immediate delegated task, use the minimal call below. The objective can include the\nworker instructions and constraints; optional lists are unnecessary for a simple delegation.\n\n```json\n{ \"mode\": \"task\", \"command\": \"create\", \"args\": { \"objective\": \"Calculate the requested result and report progress\", \"createMode\": \"start\" } }\n```\n\n```json\n{\n  \"mode\": \"task\",\n  \"command\": \"create\",\n  \"args\": {\n    \"objective\": \"Complete the customer research report\",\n    \"projectId\": \"project_id\",\n    \"createMode\": \"capture\",\n    \"priority\": \"high\",\n    \"expectedOutputs\": [\"Research report\"],\n    \"acceptanceCriteria\": [\"Sources are cited\"],\n    \"constraints\": [\"Do not contact customers without approval\"],\n    \"dependsOnTaskIds\": []\n  }\n}\n```\n\n### Main Agent and worker collaboration\n\nThe user-facing Agent can call `delegated_tasks` to list Tasks created from this conversation,\nthen `collaboration` with `{ \"taskId\": \"...\", \"afterSequence\": 0 }` to read the ordered board.\nUse the Task and TaskRun receipt as the final source of execution status.\n\nUse `collaboration_post` with `taskId`, `kind`, `body`, and a stable `idempotencyKey`.\nThe main Agent may write `instruction`, `question`, or `answer`; answers include\n`causationId` of the worker's question. The worker may write `progress`, `question`,\nor `ack`; acknowledgements include `causationId` of the instruction. A worker question\npauses the active TaskRun. After posting it, stop the execution turn and wait for an answer.\nAn instruction is first recorded, then delivered to the worker conversation, and is only\nconfirmed when the worker acknowledges it. Ordinary progress does not interrupt the user.\n\n```json\n{ \"mode\": \"task\", \"command\": \"collaboration_post\", \"args\": { \"taskId\": \"task_id\", \"kind\": \"progress\", \"body\": \"Completed source review\", \"idempotencyKey\": \"stable-key\" } }\n```\n\n### Dependencies\n\n```json\n{\n  \"mode\": \"task\",\n  \"command\": \"update_dependencies\",\n  \"args\": {\n    \"taskId\": \"task_id\",\n    \"expectedVersion\": 3,\n    \"dependsOnTaskIds\": [\"dependency_task_id\"]\n  }\n}\n```\n\n### Context links\n\nUse `add_context` to link a document, file, URL, session, memory, Task, artifact, or source\nas `input`, `reference`, `constraint`, `deliverable`, or `evidence` context.\n\n```json\n{\n  \"mode\": \"task\",\n  \"command\": \"add_context\",\n  \"args\": {\n    \"taskId\": \"task_id\",\n    \"targetKind\": \"file\",\n    \"targetId\": \"/path/to/spec.md\",\n    \"role\": \"input\",\n    \"title\": \"Product specification\",\n    \"pinned\": true,\n    \"retrievalPolicy\": {},\n    \"metadata\": {}\n  }\n}\n```\n\nUse `remove_context` with `taskId` and the exact `edgeId` returned by `task.get`.\nDo not add authority grants through this tool; an Agent must not authorize itself.\n\n### Typed lifecycle commands\n\nEvery command requires `taskId`, the Task's current `expectedVersion`, a `type`, and\ntype-specific fields inside `commandArgs`.\n\nSupported command types:\n\n- `mark_ready`\n- `start`: `{ \"executor\": { \"kind\": \"agent\", \"agentId\": \"main\" } }`\n- `request_review`\n- `close`: `{ \"resolution\": \"done | cancelled | duplicate | wont_do\" }`\n- `reopen`: `{ \"phase\": \"ready | active\" }`\n- `add_wait`: `{ \"wait\": { \"kind\": \"dependency | approval | input | schedule | external | paused\", \"reason\": \"...\", \"condition\": {} } }`\n- `resolve_wait`: `{ \"waitId\": \"wait_id\", \"resolution\": {} }`\n- `delegate`: `{ \"agentId\": \"agent_id\" }`\n- `revise_contract`: `{ \"contract\": { ...complete contract... } }`\n\n```json\n{\n  \"mode\": \"task\",\n  \"command\": \"command\",\n  \"args\": {\n    \"taskId\": \"task_id\",\n    \"expectedVersion\": 3,\n    \"type\": \"start\",\n    \"commandArgs\": {\n      \"executor\": { \"kind\": \"agent\", \"agentId\": \"main\" }\n    }\n  }\n}\n```\n\nContract revision is replacement, not a patch. Read the Task and preserve all contract fields\nthe user did not ask to change. Resolve a wait through `resolve_wait`; do not directly mutate\na TaskRun or manufacture a phase transition.\n\n## TaskRuns\n\nTaskRun inspection is read-only except for explicit cancellation. Other execution state is\ncontrolled by Task commands and the runtime coordinator.\n\n### List attempts for a Task\n\n```json\n{ \"mode\": \"task_run\", \"command\": \"list\", \"args\": { \"taskId\": \"task_id\", \"limit\": 20 } }\n```\n\nThe result contains run attempts, finalized receipts, and active waits.\n\n### Inspect one attempt\n\n```json\n{ \"mode\": \"task_run\", \"command\": \"get\", \"args\": { \"runId\": \"run_id\" } }\n```\n\nThe result contains the TaskRun, its receipt when terminal, ordered events, and active Task waits.\n\n### Cancel an attempt\n\nRead the run first, then pass its current version. Cancellation creates a terminal receipt.\n\n```json\n{\n  \"mode\": \"task_run\",\n  \"command\": \"cancel\",\n  \"args\": { \"runId\": \"run_id\", \"expectedVersion\": 2, \"reason\": \"User cancelled execution\" }\n}\n```\n\nDo not guess commands such as retry, force-complete, heartbeat, or transition; they are not Agent APIs.\n\n## Notes\n\nCommands: `list`, `get`, `create`, `append`, `preview_edit`, `update`, and `delete`.\nUse Notes for durable prose and reference material, not as a Task substitute. Prefer `append`\nwhen preserving user content. Use `preview_edit` before a canonical rewrite.\n\n```json\n{ \"mode\": \"note\", \"command\": \"create\", \"args\": { \"title\": \"Decision\", \"markdown\": \"...\", \"projectId\": \"project_id\" } }\n```\n\n```json\n{ \"mode\": \"note\", \"command\": \"append\", \"args\": { \"noteId\": \"note_id\", \"heading\": \"AI synthesis\", \"content\": \"...\" } }\n```\n\nUse `update` with `status: \"trashed\"` for a recoverable removal. `delete` permanently\nremoves the Note and its stored snapshots and media; use `dryRun: true` first when the\nuser's intent is ambiguous.\n\n```json\n{ \"mode\": \"note\", \"command\": \"delete\", \"args\": { \"noteId\": \"note_id\" }, \"dryRun\": true }\n```\n\n## Chat previews, local apps, and settings\n\nUse `chat_preview` by default when the user asks to design, mock up, or quickly show a UI in\nthe current conversation. It creates no Project and no Local App. Commands are `create`,\n`get`, and `revise`. Source consists of `markup`, `styles`, and optional `script`;\ndo not include a full HTML document or remote dependencies. Revision requires the exact\n`baseRevision` returned by the prior call.\n\nUse `local_app` only when the user explicitly asks for a durable, installable app or chooses\n\u201CSave as app\u201D on a chat preview. Do not create a Local App merely to render a UI draft.\n\nLocal app commands are `list`, `get`, `create`, and `validate`. Installation,\nactivation, rollback, and uninstall remain product runtime operations.\n\nSettings supports only `open` and returns an exact product jump target without changing config.\n\n## Error recovery\n\n| Result | Recovery |\n| --- | --- |\n| service unavailable | Stop retrying and report the unavailable capability. |\n| not found | Re-list in the intended scope; do not invent another id. |\n| conflict | Read the current object and reassess using its latest version. |\n| waiting | Inspect the Task projection and TaskRun waits; resolve only the real blocker. |\n| invalid command or state | Read the object and use only a documented transition. |\n| unsupported operation | Use the dedicated tool or product UI; never write storage directly. |\n\n## Deliberate boundaries\n\n- Project deletion and milestone deletion are not Agent APIs.\n- TaskRun mutation is internal to execution coordination except for optimistic cancellation.\n- Project updates are immutable.\n- Workflow and Automation operations remain in their dedicated tools.\n- Only the documented Task and TaskRun commands are valid; do not infer hidden aliases.\n";

package/dist/src/agent/tool-manuals/xopc-use.js

@@ -222,6 +222,11 @@ For \`update\`, patch fields may be direct args or nested under \`args.patch\`.
 
 ## Tasks
 
+Task locale follows the conversation response language, then the user request and profile.
+Keep every user-facing contract field (criteria, expected outputs, constraints, assumptions and risks)
+in that language, even when attached source material is English. Preserve paths, URLs and proper nouns.
+An explicit locale must reflect the user’s language choice.
+
 Commands: \`list\`, \`get\`, \`create\`, \`delegated_tasks\`, \`collaboration\`,
 \`collaboration_post\`, \`update_dependencies\`, \`add_context\`, \`remove_context\`,
 \`command\`, and \`delete\`.

package/dist/src/agent/tools/dataBatch.d.ts

@@ -1,4 +1,5 @@
 import type { AgentTool } from '@earendil-works/pi-agent-core';
 import { type DataSourceOptions } from '../data-acquisition/service.js';
+export declare function withoutDataToolPermissions<T>(run: () => T): T;
 export declare function withDataToolPermissions<T>(names: ReadonlySet<string>, run: () => T): T;
 export declare function createDataBatchTool(workspace: string, getAllowedTools: () => ReadonlySet<string>, options?: DataSourceOptions): AgentTool;

package/dist/src/agent/tools/dataBatch.js

@@ -8,6 +8,9 @@ import { AsyncLocalStorage } from "node:async_hooks";
 init_logger();
 const executionTools = new AsyncLocalStorage();
 const log = createLogger("DataAcquisition");
+function withoutDataToolPermissions(run) {
+	return executionTools.exit(run);
+}
 function withDataToolPermissions(names, run) {
 	const parent = executionTools.getStore();
 	const allowed = parent ? new Set([...names].filter((name) => parent.has(name))) : names;
@@ -49,4 +52,4 @@ function createDataBatchTool(workspace, getAllowedTools, options = {}) {
 	};
 }
 //#endregion
-export { createDataBatchTool, withDataToolPermissions };
+export { createDataBatchTool, withDataToolPermissions, withoutDataToolPermissions };

package/dist/src/agent/tools/delegate-tool.d.ts

@@ -6,6 +6,7 @@ export declare const DEFAULT_DELEGATE_TOOLS: string[];
 /** Tools never passed to a delegated sub-agent (even if requested). */
 export declare const DELEGATE_BLOCKED_TOOLS: Set<string>;
 export interface DelegateToolDeps {
+    isWorkspaceTrusted?: (workspaceDir: string) => boolean | null | undefined;
     getParentTools: () => AgentTool<any, any>[];
     createParentPolicy?: () => AgentTurnPolicy;
     workspace: string;

package/dist/src/agent/tools/delegate-tool.js

@@ -155,6 +155,7 @@ function createDelegateTool(deps) {
 				const abort = () => child?.abort(resolveAgentAbortReason(signal?.reason));
 				try {
 					child = createDelegateChildHandle({
+						isWorkspaceTrusted: deps.isWorkspaceTrusted,
 						workspace,
 						goal: mode === "review" ? `Independently review the actual changes. Inspect review_workspace and relevant source/tests. Report actionable defects with file and line evidence, severity and a concrete failure example. If there are no findings, state the checks and remaining uncertainty. Do not treat the parent's completion claim as evidence.\n\n${input.goal}` : input.goal,
 						context: [input.context, research ? researchResumeContext(research.checkpoint) : void 0].filter(Boolean).join("\n\n") || void 0,

package/dist/src/agent/tools/error-tracker.js

@@ -36,11 +36,13 @@ var ToolErrorTracker = class {
 			lastErrorTime: now
 		});
 		this.totalFailures++;
+		const errorMessage = error?.replace(/\s+/g, " ").trim().slice(0, 500) || void 0;
 		log.warn({
 			toolName,
 			failures: this.getFailureCount(toolName),
-			total: this.totalFailures
-		}, "Tool failure recorded");
+			total: this.totalFailures,
+			errorMessage
+		}, errorMessage ? `Tool failure recorded (${toolName}): ${errorMessage}` : "Tool failure recorded");
 	}
 	/**
 	* Get failure count for a specific tool

package/dist/src/agent/tools/exec-command.js

@@ -8,7 +8,7 @@ import { Type } from "@sinclair/typebox";
 //#region src/agent/tools/exec-command.ts
 const DEFAULT_MAX_OUTPUT_CHARS = 5e4;
 const ExecCommandSchema = Type.Object({
-	cmd: Type.String({ description: "Command for the default platform shell: /bin/sh on Unix and in Docker; cmd.exe on Windows hosts. Use portable syntax, or invoke an installed shell explicitly for shell-specific features." }),
+	cmd: Type.String({ description: "Command for the default platform shell: /bin/sh on Unix and in Docker; cmd.exe on Windows hosts. Commands start in the workspace; use cwd instead of cd. For verification, invoke the existing test runner directly without shell chains, pipes, or output filters so its exit status and evidence remain unambiguous. Use maxOutputChars to limit output." }),
 	cwd: Type.Optional(Type.String({ description: "Working directory. Relative paths are resolved under the agent workspace." })),
 	timeoutMs: Type.Optional(Type.Number({ description: "Command timeout in milliseconds. Defaults to 1800000 (30m) and is capped at 14400000 (4h)." })),
 	maxOutputChars: Type.Optional(Type.Number({ description: "Maximum characters returned to the model. UI streaming still receives output deltas." })),
@@ -19,7 +19,7 @@ const ExecCommandSchema = Type.Object({
 	})),
 	outputs: Type.Optional(Type.Array(Type.String({ minLength: 1 }), {
 		maxItems: 50,
-		description: "Final user-facing files created by this command. Relative paths resolve under the effective cwd and are persisted as chat deliverables after a successful command."
+		description: "Final user-facing files to persist after this command succeeds, including files written earlier in the task. Put all final paths on the final verification command to verify and publish in one call. Relative paths resolve under the effective cwd."
 	}))
 });
 function clampMaxOutputChars(raw) {
@@ -60,7 +60,7 @@ function createExecCommandTool(workspaceCwd, options) {
 			"Use apply_patch for file edits; do not edit files by shell redirection unless explicitly necessary.",
 			"Relative cwd values resolve under the current agent workspace.",
 			"Use a fresh output directory with mkdir -p. Avoid destructive cleanup such as rm -rf on variable paths; blocked cleanup should be removed, never disguised or moved to bypass policy. A syntax preflight on Unix host commands prevents partial writes from malformed shell syntax.",
-			"When the command creates final user-facing files, declare all final paths in outputs so they are persisted with this command."
+			"Use outputs on the final verification command to persist all completed user-facing files together, including files written earlier. A successful artifact receipt needs no additional publish_artifacts call unless the file changes or capture failed."
 		].join(" "),
 		parameters: ExecCommandSchema,
 		label: "Run Command",
@@ -232,6 +232,7 @@ function createExecCommandTool(workspaceCwd, options) {
 				const published = details.artifacts.filter((item) => item.availability === "available").length;
 				const failed = details.artifacts.length - published;
 				resultText += `\n\nArtifacts: ${published} published${failed > 0 ? `, ${failed} failed` : ""}.`;
+				resultText += `\n${details.artifacts.map((item) => `${JSON.stringify(item.title)}: ${item.availability}`).join("\n")}`;
 			}
 			return {
 				content: [{

package/dist/src/agent/tools/factory.d.ts

@@ -27,6 +27,7 @@ import type { WorkflowRunServiceLike } from '../../workflows/service/workflow-ru
 import type { SkillManager } from '../skills/skill-manager.js';
 import { type ToolExecutorConfig } from './executor.js';
 export interface ToolFactoryDeps {
+    isWorkspaceTrusted?: (workspaceDir: string) => boolean | null | undefined;
     workspace: string;
     extensionRegistry?: ExtensionRegistry;
     getCurrentContext: () => {

package/dist/src/agent/tools/factory.js

@@ -8,19 +8,19 @@ import { getSessionMetadata } from "../../storage/sqlite/session-read-repository
 import { patchSessionMetadata } from "../../storage/sqlite/session-repository.js";
 import { getSessionTaskPlan, setSessionTaskPlan } from "../../storage/sqlite/session-task-plan-repository.js";
 import { init_sqlite } from "../../storage/sqlite/index.js";
-import { resolveUserContextSessionAccess } from "../../user-context/access-policy.js";
 import { init_agent_scope, resolveDefaultAgentId } from "../agent-scope.js";
-import { resolveEffectiveAgentConfigForAgent, resolveEffectiveAgentConfigForSession } from "../../config/agent-profile.js";
+import { resolveUserContextSessionAccess } from "../../user-context/access-policy.js";
+import { resolveEffectiveAgentConfigForAgent } from "../../config/agent-profile.js";
 import { PERSONAL_TOOL_DESCRIPTIONS } from "../../personal-agent/policy.js";
 import { TaskConversationRepository } from "../../tasks/task-conversation-repository.js";
 import { PERSONAL_REQUEST_TOOL_IDS, TASK_EXECUTION_TOOL_IDS, filterExecutionTools, resolveExecutionToolPolicy } from "../embedded/execution-tool-policy.js";
 import { LOCAL_READ_MAX_CHARS } from "./local-read-budget.js";
 import { createPersonalAttentionTool } from "./personal-attention-tool.js";
+import { withCoreToolExposure } from "./toolExposure.js";
 import { markCodemodeCoreRead } from "./codemode-permissions.js";
 import "../../../packages/browser-control-contract/src/index.js";
 import { getEmbeddedExecutionRunId, getEmbeddedExecutionSession } from "../embedded/execution-context.js";
 import { wrapToolsWithProtection } from "./executor.js";
-import { EXTERNAL_TOOL_NAMES } from "../external-tools/gateway-tools.js";
 import { createDefaultExternalToolGatewayTools } from "../external-tools/index.js";
 import { createReadFileTool } from "./read.js";
 import { createDataBatchTool } from "./dataBatch.js";
@@ -85,7 +85,7 @@ import { ComputerRuntime } from "../../computer/runtime.js";
 import { createComputerUseTool } from "./computer-use-tool.js";
 import { createReviewWorkspaceTool } from "./review-workspace.js";
 import { createLanguageDiagnosticsTool } from "./language-diagnostics.js";
-import { createDelegationParentPolicy } from "./delegation-parent-policy.js";
+import { createNoninteractiveToolPolicy } from "./noninteractive-tool-policy.js";
 import { mergeTtsConfigFromAppConfig } from "../../voice/tts/merge-config.js";
 import { createTextToSpeechTool } from "./tts-tool.js";
 import { getAgentCapabilityToolNames } from "../capabilities/registry.js";
@@ -268,7 +268,7 @@ var AgentToolsFactory = class AgentToolsFactory {
 			agentId: options?.agentId ?? (cfg ? resolveDefaultAgentId() : "main")
 		});
 		const agentId = options?.agentId;
-		const resolvedAgentId = agentId ?? (cfg ? resolveDefaultAgentId() : "main");
+		const resolvedAgentId = agentId ?? (executionConversationId ? getSessionMetadata(executionConversationId)?.agentId : void 0) ?? (cfg ? resolveDefaultAgentId() : "main");
 		const personalExecution = executionConversationId ? personalRequestForExecution(executionConversationId) : void 0;
 		const personalExecutionMarker = executionConversationId && isXopcDatabaseOpen() ? getSessionMetadata(executionConversationId)?.customData?.personalReadRequestId : void 0;
 		if (personalExecution && executionConversationId && personalExecutionMarker !== personalExecution.requestId) patchSessionMetadata(executionConversationId, { customData: {
@@ -292,7 +292,7 @@ var AgentToolsFactory = class AgentToolsFactory {
 			return key ? getSessionMetadata(key)?.projectId : void 0;
 		};
 		const getCommandIsolation = () => {
-			return this.deps.getConfig?.() ? (currentConversationId() ? resolveEffectiveAgentConfigForSession(currentConversationId()) : resolveEffectiveAgentConfigForAgent(resolvedAgentId)).config.runtime.commandIsolation : void 0;
+			return this.deps.getConfig?.() ? resolveEffectiveAgentConfigForAgent(resolvedAgentId).config.runtime.commandIsolation : void 0;
 		};
 		const externalTools = createDefaultExternalToolGatewayTools({
 			workspace,
@@ -578,9 +578,10 @@ var AgentToolsFactory = class AgentToolsFactory {
 				startWorkflowRun: this.deps.getWorkflowRunService ? (params) => this.deps.getWorkflowRunService().startWorkflowRun(params) : void 0
 			})] : [],
 			...primary ? [createDelegateTool({
+				isWorkspaceTrusted: this.deps.isWorkspaceTrusted,
 				workspace,
 				getParentTools: () => options?.getParentTools?.() ?? filterToolsByDisabledSet(core, disabled),
-				createParentPolicy: options?.createDelegationPolicy ?? (() => createDelegationParentPolicy({
+				createParentPolicy: options?.createDelegationPolicy ?? (() => createNoninteractiveToolPolicy({
 					getConfig: () => this.deps.getConfig?.(),
 					conversationId: currentConversationId(),
 					agentId: resolvedAgentId
@@ -602,6 +603,8 @@ var AgentToolsFactory = class AgentToolsFactory {
 				},
 				toolExecutorConfig: this.deps.toolExecutorConfig,
 				buildChildTools: (childOpts) => {
+					const childAgentId = childOpts.agentId ?? resolvedAgentId;
+					const childConfig = childOpts.getConfig() ? resolveEffectiveAgentConfigForAgent(childAgentId).config : void 0;
 					return new AgentToolsFactory({
 						workspace: childOpts.workspace,
 						bus: childOpts.bus,
@@ -609,21 +612,17 @@ var AgentToolsFactory = class AgentToolsFactory {
 						getConfig: childOpts.getConfig,
 						getPrimaryModel: () => childOpts.model,
 						endpointTools: childOpts.endpointTools ?? this.deps.endpointTools,
-						toolExecutorConfig: childOpts.toolExecutorConfig
+						toolExecutorConfig: {
+							...childOpts.toolExecutorConfig,
+							resolveTimeoutMs: (name) => childOpts.getConfig() ? resolveEffectiveAgentConfigForAgent(childAgentId).config.tools[name]?.timeoutMs : void 0
+						}
 					}).createAllTools({
 						workspace: childOpts.workspace,
 						getPrimaryModel: () => childOpts.model,
-						agentId: options?.agentId ?? childOpts.agentId,
-						conversationId: childOpts.browserConversationId,
-						toolAllowlist: options?.toolAllowlist,
-						disabledTools: new Set([
-							...disabled ?? [],
-							EXTERNAL_TOOL_NAMES.search,
-							EXTERNAL_TOOL_NAMES.describe,
-							EXTERNAL_TOOL_NAMES.execute,
-							EXTERNAL_TOOL_NAMES.requireConnection,
-							EXTERNAL_TOOL_NAMES.updateConnectionObjective
-						])
+						agentId: childAgentId,
+						conversationId: childOpts.conversationId,
+						toolAllowlist: childConfig?.toolAllowlist,
+						disabledTools: new Set(Object.entries(childConfig?.tools ?? {}).filter(([, policy]) => policy.mode === "deny").map(([name]) => name))
 					});
 				}
 			})] : [],
@@ -641,7 +640,7 @@ var AgentToolsFactory = class AgentToolsFactory {
 			"xopc_tool_execute"
 		].some((name) => !disabled?.has(name))) {
 			const dataTools = () => {
-				const policies = this.deps.getConfig?.() ? (currentConversationId() ? resolveEffectiveAgentConfigForSession(currentConversationId()) : resolveEffectiveAgentConfigForAgent(resolvedAgentId)).config.tools : void 0;
+				const policies = this.deps.getConfig?.() ? resolveEffectiveAgentConfigForAgent(resolvedAgentId).config.tools : void 0;
 				if (policies?.data_batch?.mode === "deny") return [];
 				return filterToolsByDisabledSet(core, disabled).filter((tool) => (!allowed || allowed.has(tool.name)) && policies?.[tool.name]?.mode !== "deny");
 			};
@@ -654,7 +653,7 @@ var AgentToolsFactory = class AgentToolsFactory {
 		return filterExecutionTools(executionToolPolicy, filterToolsByDisabledSet(core.map(markCodemodeCoreRead), disabled).filter((tool) => (!allowed || allowed.has(tool.name)) && !(personalToolsConfigured && tool.name === "clarify")).map((tool) => personalToolsConfigured && !tool.name.startsWith("personal_") && PERSONAL_TOOL_DESCRIPTIONS[tool.name] ? {
 			...tool,
 			description: PERSONAL_TOOL_DESCRIPTIONS[tool.name]
-		} : tool));
+		} : tool)).map((tool) => executionToolPolicy.discovery ? withCoreToolExposure(tool) : tool);
 	}
 	createCapabilityTools(capabilityNames, options) {
 		const disabled = options?.disabledTools;

package/dist/src/agent/tools/{delegation-parent-policy.d.ts → noninteractive-tool-policy.d.ts}

@@ -1,6 +1,6 @@
 import type { Config } from '../../config/schema.js';
 /** Noninteractive callers cannot silently turn an ask policy into an allow. */
-export declare function createDelegationParentPolicy(options: {
+export declare function createNoninteractiveToolPolicy(options: {
     getConfig: () => Config | undefined;
     conversationId?: string;
     agentId?: string;

package/dist/src/agent/tools/{delegation-parent-policy.js → noninteractive-tool-policy.js}

@@ -1,8 +1,8 @@
 import { resolveEffectiveAgentConfigForAgent, resolveEffectiveAgentConfigForSession } from "../../config/agent-profile.js";
 import { createAgentTurnPolicy } from "../orchestration/agent-turn-policy.js";
-//#region src/agent/tools/delegation-parent-policy.ts
+//#region src/agent/tools/noninteractive-tool-policy.ts
 /** Noninteractive callers cannot silently turn an ask policy into an allow. */
-function createDelegationParentPolicy(options) {
+function createNoninteractiveToolPolicy(options) {
 	const policies = (name, args) => {
 		if (!options.getConfig()) return [];
 		const resolved = options.conversationId ? resolveEffectiveAgentConfigForSession(options.conversationId) : options.agentId ? resolveEffectiveAgentConfigForAgent(options.agentId) : resolveEffectiveAgentConfigForSession(void 0);
@@ -23,7 +23,7 @@ function createDelegationParentPolicy(options) {
 			const blocked = policies(context.toolCall.name, context.args).find((policy) => policy.mode !== "allow");
 			return blocked ? {
 				block: true,
-				reason: `${blocked.id} requires parent authorization (${blocked.mode}).`
+				reason: `${blocked.id} requires authorization (${blocked.mode}).`
 			} : void 0;
 		},
 		resolveToolLimit: (name, args) => {
@@ -36,4 +36,4 @@ function createDelegationParentPolicy(options) {
 	});
 }
 //#endregion
-export { createDelegationParentPolicy };
+export { createNoninteractiveToolPolicy };

package/dist/src/agent/tools/personal-read-tool.js

@@ -1,7 +1,7 @@
+import { CapabilityDispatcher } from "../../capabilities/runtime/dispatcher.js";
 import { isPersonalConversation } from "../../personal-agent/repository.js";
 import { LOCAL_READ_MAX_CHARS } from "./local-read-budget.js";
 import { getEmbeddedExecutionSession } from "../embedded/execution-context.js";
-import { CapabilityDispatcher } from "../../capabilities/runtime/dispatcher.js";
 import { registerNoteReadCapabilities } from "../../notes/capabilities/read.js";
 import { registerProjectReadCapabilities } from "../../projects/capabilities/read.js";
 import { registerAutomationReadCapabilities } from "../../automations/capabilities/read.js";

package/dist/src/agent/tools/personal-task-tool.js

@@ -12,9 +12,9 @@ import { TaskReadModelProjector } from "../../tasks/task-read-model-projector.js
 import { TaskOriginRepository } from "../../tasks/task-origin-repository.js";
 import { boundedPersonalResult } from "./personal-result-budget.js";
 import { TaskCollaborationRepository } from "../../tasks/task-collaboration-repository.js";
+import { PERSONAL_WORKER_RESULT_GUIDANCE } from "../../personal-agent/communication.js";
 import { parseTaskHandoffReferences } from "../../tasks/task-handoff.js";
 import { TaskApplicationService } from "../../tasks/task-application-service.js";
-import { PERSONAL_WORKER_RESULT_GUIDANCE } from "../../personal-agent/communication.js";
 import { getAvailablePersonalAgentTools, personalAgentModelAvailability } from "../../personal-agent/specialist-capabilities.js";
 import { assessSpecialist, matchSpecialists } from "../../agent-matching/service.js";
 import { createXopcUseTool } from "./xopc-use-tool.js";

package/dist/src/agent/tools/publish-artifacts.js

@@ -75,7 +75,7 @@ function createPublishArtifactsTool(workspace) {
 	return {
 		name: "publish_artifacts",
 		label: "Publish Artifacts",
-		description: "Publish completed user-facing files into durable chat artifacts. Call this after exec_command or another runtime creates spreadsheets, presentations, PDFs, documents, archives, or other files. Pass every final deliverable together; do not publish temporary or source files.",
+		description: "Publish only completed requested user-facing files missing a current successful artifact receipt. This tool cannot read, edit, create files, or execute commands. If a required edit is blocked, report that limitation without publishing the original or probing this tool. Pass missing final paths together; exclude unchanged captured files, temporary files, and source edits.",
 		parameters: PublishArtifactsSchema,
 		mutationScope: "none",
 		supportsParallel: false,

package/dist/src/agent/tools/search/cache.d.ts

@@ -1,4 +1,4 @@
-import type { SearchResult } from './types.js';
+import type { SearchMetadata, SearchResult } from './types.js';
 export declare const SEARCH_CACHE_TTL_MS: number;
 export interface SearchCacheEntry {
     key: string;
@@ -7,11 +7,13 @@ export interface SearchCacheEntry {
     results: SearchResult[];
     provider: string;
     capturedAt: number;
+    metadata?: SearchMetadata;
 }
 export interface SearchCache {
     get(key: string): SearchCacheEntry | undefined;
     set(entry: SearchCacheEntry): void;
 }
+export declare function withoutSearchCache<T>(run: () => T): T;
 /** Research owns this scope. No account-wide or cross-conversation cache exists. */
 export declare function withSearchCache<T>(cache: SearchCache, run: () => T): T;
 export declare function currentSearchCache(): SearchCache | undefined;

package/dist/src/agent/tools/search/cache.js

@@ -2,6 +2,9 @@ import { AsyncLocalStorage } from "node:async_hooks";
 //#region src/agent/tools/search/cache.ts
 const SEARCH_CACHE_TTL_MS = 10 * 6e4;
 const searchCache = new AsyncLocalStorage();
+function withoutSearchCache(run) {
+	return searchCache.exit(run);
+}
 /** Research owns this scope. No account-wide or cross-conversation cache exists. */
 function withSearchCache(cache, run) {
 	return searchCache.run(cache, run);
@@ -16,4 +19,4 @@ var SearchCacheWriteError = class extends Error {
 	}
 };
 //#endregion
-export { SEARCH_CACHE_TTL_MS, SearchCacheWriteError, currentSearchCache, withSearchCache };
+export { SEARCH_CACHE_TTL_MS, SearchCacheWriteError, currentSearchCache, withSearchCache, withoutSearchCache };

package/dist/src/agent/tools/search/providers/deepseek-protocol.d.ts

@@ -0,0 +1,9 @@
+export declare function deepseekSearchEndpoint(baseUrl?: string): string;
+export declare function deepseekSearchBody(query: string, count: number): string;
+export declare function deepseekSearchResults(body: unknown): Array<{
+    title: string;
+    url: string;
+    description: string;
+    publishedAt?: string;
+}>;
+export declare function readDeepseekResponse(response: Response): Promise<unknown>;

package/dist/src/agent/tools/search/providers/deepseek-protocol.js

@@ -0,0 +1,84 @@
+import { __esmMin } from "../../../../../_virtual/_rolldown/runtime.js";
+//#region src/agent/tools/search/providers/deepseek-protocol.ts
+function deepseekSearchEndpoint(baseUrl = "https://api.deepseek.com") {
+	const url = new URL(baseUrl);
+	if (url.protocol !== "https:" || url.username || url.password || url.search || url.hash || ![
+		"",
+		"/",
+		"/v1",
+		"/v1/"
+	].includes(url.pathname)) throw new Error("DeepSeek API base URL must be an HTTPS origin with optional /v1");
+	return `${url.origin}/v1/tools/search`;
+}
+function deepseekSearchBody(query, count) {
+	if (!query.trim() || Array.from(query).length > 128) throw new Error("DeepSeek search query must contain 1–128 Unicode characters");
+	return JSON.stringify({
+		query,
+		count: Math.max(1, Math.min(50, Math.floor(count))),
+		need_content: false
+	});
+}
+function deepseekSearchResults(body) {
+	if (!body || typeof body !== "object" || !("results" in body) || !Array.isArray(body.results)) throw new Error("DeepSeek search returned an invalid response");
+	const seen = /* @__PURE__ */ new Set();
+	return body.results.flatMap((item) => {
+		if (!item || typeof item !== "object") return [];
+		const row = item;
+		if (typeof row.title !== "string" || !row.title.trim() || typeof row.url !== "string") return [];
+		let url;
+		try {
+			url = new URL(row.url);
+		} catch {
+			return [];
+		}
+		if (!["http:", "https:"].includes(url.protocol) || url.username || url.password || seen.has(url.href)) return [];
+		seen.add(url.href);
+		const description = typeof row.summary === "string" && row.summary.trim() ? row.summary : typeof row.snippet === "string" ? row.snippet : "";
+		return [{
+			title: row.title.trim().slice(0, 300),
+			url: url.href,
+			description: description.trim().slice(0, 800),
+			...typeof row.date === "string" && row.date.length <= 100 ? { publishedAt: row.date } : {}
+		}];
+	});
+}
+async function readDeepseekResponse(response) {
+	const limit = 2 * 1024 * 1024;
+	if (Number(response.headers.get("content-length")) > limit) {
+		await response.body?.cancel();
+		throw new Error("DeepSeek search response is too large");
+	}
+	const reader = response.body?.getReader();
+	if (!reader) throw new Error("DeepSeek search returned an empty response");
+	const chunks = [];
+	let length = 0;
+	try {
+		while (true) {
+			const { value, done } = await reader.read();
+			if (done) break;
+			length += value.byteLength;
+			if (length > limit) {
+				await reader.cancel();
+				throw new Error("DeepSeek search response is too large");
+			}
+			chunks.push(value);
+		}
+	} finally {
+		reader.releaseLock();
+	}
+	const bytes = new Uint8Array(length);
+	let offset = 0;
+	for (const chunk of chunks) {
+		bytes.set(chunk, offset);
+		offset += chunk.byteLength;
+	}
+	try {
+		return JSON.parse(new TextDecoder().decode(bytes));
+	} catch {
+		throw new Error("DeepSeek search returned invalid JSON");
+	}
+}
+var init_deepseek_protocol = __esmMin((() => {}));
+//#endregion
+init_deepseek_protocol();
+export { deepseekSearchBody, deepseekSearchEndpoint, deepseekSearchResults, init_deepseek_protocol, readDeepseekResponse };

package/dist/src/agent/tools/search/providers/deepseek.d.ts

@@ -0,0 +1,9 @@
+import type { SearchProvider, SearchResult } from '../types.js';
+export declare class DeepSeekProvider implements SearchProvider {
+    private readonly apiKey;
+    private readonly baseUrl?;
+    readonly name = "deepseek";
+    constructor(apiKey: string, baseUrl?: string);
+    isAvailable(): boolean;
+    search(query: string, count: number, signal?: AbortSignal): Promise<SearchResult[]>;
+}

package/dist/src/agent/tools/search/providers/deepseek.js

@@ -0,0 +1,55 @@
+import { deepseekSearchBody, deepseekSearchEndpoint, deepseekSearchResults, init_deepseek_protocol, readDeepseekResponse } from "./deepseek-protocol.js";
+import { searchHttpError } from "../errors.js";
+import { SearchRateLimitError, SearchRequestGate } from "../request-gate.js";
+//#region src/agent/tools/search/providers/deepseek.ts
+init_deepseek_protocol();
+const gate = new SearchRequestGate();
+var DeepSeekProvider = class {
+	name = "deepseek";
+	constructor(apiKey, baseUrl) {
+		this.apiKey = apiKey;
+		this.baseUrl = baseUrl;
+	}
+	isAvailable() {
+		return Boolean(this.apiKey.trim());
+	}
+	async search(query, count, signal) {
+		const endpoint = deepseekSearchEndpoint(this.baseUrl);
+		const body = deepseekSearchBody(query, count);
+		try {
+			await gate.wait(signal);
+		} catch (error) {
+			if (error instanceof SearchRateLimitError) throw searchHttpError(new Response(null, {
+				status: 429,
+				headers: { "retry-after": String(error.retryAfterMs / 1e3) }
+			}));
+			throw error;
+		}
+		const response = await fetch(endpoint, {
+			method: "POST",
+			redirect: "error",
+			signal,
+			headers: {
+				authorization: `Bearer ${this.apiKey}`,
+				"content-type": "application/json",
+				accept: "application/json"
+			},
+			body
+		});
+		if (!response.ok) {
+			if (response.status === 429) {
+				const retryAfter = response.headers.get("retry-after");
+				const ms = retryAfter === null ? 1e3 : Number.isFinite(Number(retryAfter)) ? Number(retryAfter) * 1e3 : Date.parse(retryAfter) - Date.now();
+				gate.cooldown(Number.isFinite(ms) ? Math.max(1e3, ms) : 1e3);
+			}
+			await response.body?.cancel();
+			throw searchHttpError(response, response.status === 402 ? "DeepSeek search account balance is insufficient" : `DeepSeek search failed (${response.status})`);
+		}
+		return deepseekSearchResults(await readDeepseekResponse(response)).slice(0, count).map(({ publishedAt: _date, ...result }) => ({
+			...result,
+			source: this.name
+		}));
+	}
+};
+//#endregion
+export { DeepSeekProvider };

package/dist/src/agent/tools/search/providers/xopc-cloud.d.ts

@@ -1,6 +1,6 @@
 import { type ModelCatalogStore } from '../../../../providers/model-catalog-store.js';
 import { type ProviderAuthService } from '../../../../providers/provider-auth-service.js';
-import type { SearchProvider, SearchResult } from '../types.js';
+import type { SearchExecution, SearchProvider, SearchResult } from '../types.js';
 interface XopcCloudSearchProviderOptions {
     region: 'cn' | 'global';
     fetchImpl?: typeof fetch;
@@ -17,5 +17,6 @@ export declare class XopcCloudSearchProvider implements SearchProvider {
     cacheIdentity(): string;
     isAvailable(): boolean;
     search(query: string, count: number, signal?: AbortSignal): Promise<SearchResult[]>;
+    searchWithMetadata(query: string, count: number, signal?: AbortSignal): Promise<SearchExecution>;
 }
 export {};