@xrkseek/harness 0.4.0-rc.4 → 0.4.1

package/node_modules/@xrkseek/server-host/dist/index.js

@@ -1,12 +1,16 @@
 import { createLocalAttachmentStore, resolveLocalAttachmentsRoot } from "@xrkseek/attachment-local";
-import { createMemorySessionStore, createPersistentSessionStore, createSessionDrainHub, newSession, SessionsDirInUseError, } from "@xrkseek/core-session";
+import { createMemorySessionStore, createPersistentSessionStore, createSessionDrainHub, newSession, readSessionEvents, SessionsDirInUseError, } from "@xrkseek/core-session";
 import { createProviderRegistry } from "@xrkseek/llm-registry";
 import { loadPolicyRulesetFile } from "@xrkseek/policy";
+import { flattenText, isHumanUserMessageSource } from "@xrkseek/protocol";
+import { consolidateCuratedMemoryPhase1, createCuratedMemoryStore, } from "@xrkseek/exec-memory";
+import { resolveSecretStore } from "@xrkseek/secrets";
 import { hostSettingsPath, defaultSpillDir, resolveXrkHome } from "@xrkseek/server-config";
 import { installOutboundHttpProxy } from "./http-proxy.js";
+import { mountInvariantsFailFast } from "./invariants-fail-fast.js";
 import { watchPolicyFile } from "./policy-file-watch.js";
 import { applyXrkProductBootPolicy, chainPublicHandlers, ensureDshCompatHostPlugin, createLiveHostPluginsPublicHandler, createHttpServer, createXrkPluginPublicHandler, createSidebarPublicHandler, prewarmDshCompatAdapters, shutdownDshCompatServices, applyHostPackageByName, stopHostPackageFiber, listHostAppliedPackages, invokeDshCompatRpc, attachDshCompatUpgrades, DSH_SETTINGS_NAMESPACES, DSH_SETTINGS_DEFAULTS, runPluginMutate, ensureXrkPlatformClientBootEntries, injectBootIntoHtml, injectMobileAccessShellIntoHtml, loadBootManifestFromWebDist, mergeWebBootManifests, resolveWebBootManifest, createXrkWalletPort, createMobileAccessGateChecker, createMobileAccessGateHandler, loadSidebarPrefs, } from "@xrkseek/server-http";
-import { attachFaceUpgrades, bindSubagentTools, createFaceRuntime, effectiveHostApiKey, isLoopbackAddress, publishRemoteEvent, createSessionRoutingLlm, liveRouteAllowsImageInput, resolveSessionCwd, canonicalAgentPresetId, resolveAgentPresetProfile, DEFAULT_MAX_DEPTH, DEFAULT_MAX_ACTIVE_CHILDREN, tryHandleFaceHttp, isPluginSoftDisabledAt, readDisabledPluginIdsAt, readManagedPackageIndexAt, reconcileManagedProcessPlugins, } from "@xrkseek/server-face";
+import { attachFaceUpgrades, bindSubagentTools, bindSessionQueryTools, createFaceRuntime, effectiveHostApiKey, isLoopbackAddress, peekSettingsYamlSection, publishRemoteEvent, createSessionRoutingLlm, liveRouteAllowsImageInput, resolveSessionCwd, canonicalAgentPresetId, resolveAgentPresetProfile, DEFAULT_MAX_DEPTH, DEFAULT_MAX_ACTIVE_CHILDREN, tryHandleFaceHttp, isPluginSoftDisabledAt, readDisabledPluginIdsAt, readManagedPackageIndexAt, reconcileManagedProcessPlugins, snapshotSessionWorkspace, } from "@xrkseek/server-face";
 import { createPluginLoader, composeHostPolicyEngine, wireCompositionChannels, wireCompositionLlm, collectChannelPluginRegistrations, } from "@xrkseek/server-loader";
 import { existsSync } from "node:fs";
 import { access } from "node:fs/promises";
@@ -31,8 +35,9 @@ import { createMcpDeferredDispose } from "./mcp-deferred-dispose.js";
 import { createStandingToolRegistry } from "./standing-tools.js";
 import { createDefaultPtyAccess } from "@xrkseek/exec-pty";
 import { createLocalShell } from "@xrkseek/exec-shell";
+import { createBrowserRuntimeRegistry } from "@xrkseek/exec-web";
 import { createLocalSubprocess } from "@xrkseek/exec-subprocess";
-import { createSshExecutionWorld, resolveSshConfigFromEnv, } from "@xrkseek/exec-ssh";
+import { createSshExecutionWorld, resolveSshConfig, } from "@xrkseek/exec-ssh";
 /** True while an unattended cron agent turn is running — skip cron tools to avoid recursion. */
 const cronAgentDepth = new AsyncLocalStorage();
 export { createHostAgentCache, HOST_PLUGINS_KEY } from "./agent-cache.js";
@@ -118,6 +123,13 @@ export function createHostManager() {
                 }
                 throw err;
             }
+            let invariantsRegistry;
+            if (config.runtime.invariantsFailFast) {
+                const mounted = mountInvariantsFailFast(store);
+                store = mounted.store;
+                invariantsRegistry = mounted.registry;
+                log?.info("runtime invariants fail-fast enabled (XRK_INVARIANTS_FAIL_FAST)");
+            }
             const loader = createPluginLoader();
             const registry = createProviderRegistry();
             // Face / mutate / soft-disable always share this absolute path. Config may
@@ -285,11 +297,14 @@ export function createHostManager() {
             let mcpSyncTail = Promise.resolve();
             const lastDrainResult = new Map();
             // Local Host + remote cwd: swap fs/shell (Hermes/DSH provider pattern).
+            // Env `XRK_SSH_HOST` CI-bypasses Face; else peek settings.yaml before Face
+            // (SSH world must own workspaceRoot before createFaceRuntime).
             let sshWorld;
             /** Local Host cwd before SSH workspace swap (browse/settings anchor). */
             let localHostRoot;
             try {
-                const sshConfig = resolveSshConfigFromEnv(process.env);
+                const sshProduct = peekSettingsYamlSection(resolveXrkHome(), "ssh-remote");
+                const sshConfig = resolveSshConfig(process.env, sshProduct);
                 if (sshConfig) {
                     localHostRoot = config.runtime.workspaceRoot;
                     sshWorld = createSshExecutionWorld({ config: sshConfig });
@@ -317,8 +332,45 @@ export function createHostManager() {
                     defaultCwd: config.runtime.workspaceRoot,
                 })
                 : undefined;
+            /** Session-keyed browser pages — survives agent invalidate (Hermes task_id map). */
+            const sharedBrowser = config.runtime.preset === "harness" || config.runtime.preset === "server"
+                ? createBrowserRuntimeRegistry()
+                : undefined;
             const ensureSession = (sid) => newSession(store, sid).id;
             const faceBox = {};
+            /** Session-end Phase1: fold leftover human notes into MEMORY.md (disk only). */
+            const consolidateCuratedMemoryForSession = (sessionId) => {
+                try {
+                    const rt = faceBox.runtime;
+                    const memEnvRaw = String(process.env.XRK_CURATED_MEMORY ?? "").trim();
+                    let enabled = memEnvRaw !== "" ? memEnvRaw !== "0" : true;
+                    if (memEnvRaw === "" && rt) {
+                        const memNs = rt.settingsNamespaces.view("curated-memory")
+                            .value;
+                        enabled = memNs.enabled !== false;
+                    }
+                    if (!enabled)
+                        return;
+                    const userTexts = [];
+                    for (const event of readSessionEvents(store, sessionId)) {
+                        if (event.type !== "user/message")
+                            continue;
+                        if (!isHumanUserMessageSource(event.source))
+                            continue;
+                        const text = flattenText(event.content).trim();
+                        if (text)
+                            userTexts.push(text);
+                    }
+                    if (userTexts.length === 0)
+                        return;
+                    void consolidateCuratedMemoryPhase1(createCuratedMemoryStore(), {
+                        userTexts,
+                    });
+                }
+                catch {
+                    /* best-effort — Host stop / archive must continue */
+                }
+            };
             const llmResolverBox = {};
             const pluginSettingsBox = {};
             const sessionCwdBox = {};
@@ -367,6 +419,7 @@ export function createHostManager() {
                         resolveFilePath: (ref) => attachments.fileHostPath?.(ref),
                         ...(sharedPty ? { ptyService: sharedPty.service } : {}),
                         ...(sharedShell ? { shellJobs: sharedShell } : {}),
+                        ...(sharedBrowser ? { browserRuntime: sharedBrowser } : {}),
                         ...(cronBox.scheduler && !cronAgentDepth.getStore()
                             ? { cronScheduler: cronBox.scheduler }
                             : {}),
@@ -406,12 +459,51 @@ export function createHostManager() {
                                 toolResultMaxInlineBytes: pluginSettings.toolResultMaxInlineBytes,
                             }
                             : {}),
+                        ...(pluginSettings.locale
+                            ? { locale: pluginSettings.locale }
+                            : {}),
                         ...(pluginSettings.webSearch
                             ? { webSearch: pluginSettings.webSearch }
                             : {}),
                         ...(pluginSettings.workspaceInject
                             ? { workspaceInject: pluginSettings.workspaceInject }
                             : {}),
+                        ...(pluginSettings.sessionTelemetry
+                            ? { sessionTelemetry: pluginSettings.sessionTelemetry }
+                            : {}),
+                        ...(pluginSettings.sandbox
+                            ? { sandbox: pluginSettings.sandbox }
+                            : {}),
+                        ...(pluginSettings.computerUseProduct
+                            ? { computerUseProduct: pluginSettings.computerUseProduct }
+                            : {}),
+                        ...(pluginSettings.computerUseEnv
+                            ? { computerUseEnv: pluginSettings.computerUseEnv }
+                            : {}),
+                        ...(pluginSettings.browserProduct
+                            ? { browserProduct: pluginSettings.browserProduct }
+                            : {}),
+                        ...(pluginSettings.voiceProduct
+                            ? { voiceProduct: pluginSettings.voiceProduct }
+                            : {}),
+                        ...(pluginSettings.voiceEnv
+                            ? { voiceEnv: pluginSettings.voiceEnv }
+                            : {}),
+                        ...(pluginSettings.imageGenProduct
+                            ? { imageGenProduct: pluginSettings.imageGenProduct }
+                            : {}),
+                        ...(pluginSettings.imageGenEnv
+                            ? { imageGenEnv: pluginSettings.imageGenEnv }
+                            : {}),
+                        ...(pluginSettings.videoGenProduct
+                            ? { videoGenProduct: pluginSettings.videoGenProduct }
+                            : {}),
+                        ...(pluginSettings.videoGenEnv
+                            ? { videoGenEnv: pluginSettings.videoGenEnv }
+                            : {}),
+                        ...(pluginSettings.curatedMemory === false
+                            ? { curatedMemory: false }
+                            : {}),
                     });
                     if (faceBox.approvals) {
                         agent.setApprovalHandler(faceBox.approvals.handlerFor(sessionId));
@@ -438,6 +530,10 @@ export function createHostManager() {
                                 maxActiveChildren,
                             });
                         }
+                        bindSessionQueryTools(agent.tools, {
+                            runtime: faceBox.runtime,
+                            parentSessionId: sessionId,
+                        });
                         const prefs = loadSidebarPrefs(resolveXrkHome()).value;
                         if (prefs.agentOpenTools === true ||
                             prefs.agentTerminalTools === true) {
@@ -482,6 +578,12 @@ export function createHostManager() {
                             if (signal.aborted) {
                                 throw new DOMException("aborted", "AbortError");
                             }
+                            // Worktree snapshot before tools mutate files (Hermes-style
+                            // checkpoint). Best-effort — never blocks the turn.
+                            const face = faceBox.runtime;
+                            if (face) {
+                                await snapshotSessionWorkspace(face, sessionId);
+                            }
                             const result = await agent.continueTurn({ signal });
                             lastDrainResult.set(sessionId, result);
                         }
@@ -510,7 +612,7 @@ export function createHostManager() {
             }, lastDrainResult);
             drainActiveBox.isActive = (sessionId) => drain.isActive(sessionId);
             drainActiveBox.activeIds = () => hub.activeIds();
-            cronBox.scheduler = createHostCron({
+            const cronHostOptions = {
                 productHome: resolveXrkHome(),
                 workspaceRoot: config.runtime.workspaceRoot,
                 runAgent: async (job, signal) => {
@@ -539,11 +641,33 @@ export function createHostManager() {
                 onError: (err) => {
                     log?.warn(`cron: ${err instanceof Error ? err.message : String(err)}`);
                 },
-            });
-            cronBox.scheduler?.start();
-            if (cronBox.scheduler) {
+            };
+            /**
+             * Face `cron.enabled` SoT when `XRK_CRON` unset; env non-empty is CI bypass.
+             * Returns whether the scheduler presence changed (tools need invalidate).
+             */
+            const applyCronScheduler = (product) => {
+                const next = createHostCron({
+                    ...cronHostOptions,
+                    ...(product ? { product } : {}),
+                });
+                if (!next) {
+                    if (!cronBox.scheduler)
+                        return false;
+                    cronBox.scheduler.stop();
+                    cronBox.scheduler = undefined;
+                    log?.info("cron ticker stopped");
+                    return true;
+                }
+                if (cronBox.scheduler)
+                    return false;
+                cronBox.scheduler = next;
+                next.start();
                 log?.info("cron ticker started (~/.xrk/cron/jobs.json)");
-            }
+                return true;
+            };
+            // Env-only until Face is ready; re-applied below with Settings product.
+            applyCronScheduler();
             const webOverlay = await resolveWebPluginOverlay(resolvedPluginsDir);
             const overlayBoot = webOverlay
                 ? loadBootManifestFromWebDist(webOverlay)
@@ -592,6 +716,7 @@ export function createHostManager() {
                     rpcChannels: [...row.rpcChannels],
                 }));
             };
+            const secretStore = await resolveSecretStore(process.env);
             const faceRuntime = createFaceRuntime({
                 store,
                 resolveAgent,
@@ -605,6 +730,7 @@ export function createHostManager() {
                     : {}),
                 // Face settings / credentials / workspaces.json / host-settings → harness home.
                 productDir: resolveXrkHome(),
+                ...(secretStore ? { secretStore } : {}),
                 tools: createStandingToolRegistry({
                     workspaceRoot: config.runtime.workspaceRoot,
                     preset: config.runtime.preset,
@@ -731,6 +857,10 @@ export function createHostManager() {
                     ? { settingsDocumentPath: path.resolve(config.runtime.policyFile) }
                     : {}),
                 invalidateAgent: (sessionId) => agentCache.invalidate(sessionId),
+                onSessionFinalize: (sessionId) => {
+                    consolidateCuratedMemoryForSession(sessionId);
+                    sharedBrowser?.drop(sessionId);
+                },
                 ...createAutoReviewBridgeFromHost(resolveXrkHome()),
                 ...(sharedPty
                     ? {
@@ -809,6 +939,8 @@ export function createHostManager() {
                     .value;
                 const injectNs = faceRuntime.settingsNamespaces.view("workspace-inject")
                     .value;
+                const telemetryNs = faceRuntime.settingsNamespaces.view("session-telemetry")
+                    .value;
                 const maxParallelToolCalls = typeof loop.maxParallelToolCalls === "number" &&
                     Number.isFinite(loop.maxParallelToolCalls) &&
                     loop.maxParallelToolCalls > 0
@@ -909,6 +1041,159 @@ export function createHostManager() {
                     injectMaxCharsRaw >= 4_000
                     ? Math.min(128_000, Math.floor(injectMaxCharsRaw))
                     : undefined;
+                const telModeRaw = typeof telemetryNs.mode === "string"
+                    ? telemetryNs.mode.trim().toLowerCase()
+                    : "off";
+                const telMode = telModeRaw === "memory" || telModeRaw === "otlp" || telModeRaw === "off"
+                    ? telModeRaw
+                    : "off";
+                const telEndpoint = typeof telemetryNs.endpoint === "string" && telemetryNs.endpoint.trim()
+                    ? telemetryNs.endpoint.trim()
+                    : undefined;
+                const sessionTelemetry = {
+                    mode: telMode,
+                    ...(telEndpoint ? { endpoint: telEndpoint } : {}),
+                };
+                const sandboxNs = faceRuntime.settingsNamespaces.view("sandbox")
+                    .value;
+                const sbBackendRaw = typeof sandboxNs.backend === "string"
+                    ? sandboxNs.backend.trim().toLowerCase()
+                    : "workspace";
+                const sbBackend = sbBackendRaw === "docker" ||
+                    sbBackendRaw === "bwrap" ||
+                    sbBackendRaw === "windows" ||
+                    sbBackendRaw === "workspace"
+                    ? sbBackendRaw
+                    : "workspace";
+                const sbImage = typeof sandboxNs.dockerImage === "string" && sandboxNs.dockerImage.trim()
+                    ? sandboxNs.dockerImage.trim()
+                    : undefined;
+                const sbNetRaw = typeof sandboxNs.dockerNetwork === "string"
+                    ? sandboxNs.dockerNetwork.trim().toLowerCase()
+                    : "";
+                const sbNetwork = sbNetRaw === "bridge" || sbNetRaw === "none" ? sbNetRaw : undefined;
+                const sbModeRaw = typeof sandboxNs.windowsMode === "string"
+                    ? sandboxNs.windowsMode.trim()
+                    : "";
+                const sbMode = sbModeRaw === "workspace-write" ||
+                    sbModeRaw === "read-only" ||
+                    sbModeRaw === "danger-full-access"
+                    ? sbModeRaw
+                    : undefined;
+                const sandbox = {
+                    backend: sbBackend,
+                    ...(sbImage ? { dockerImage: sbImage } : {}),
+                    ...(sbNetwork ? { dockerNetwork: sbNetwork } : {}),
+                    ...(sbMode ? { windowsMode: sbMode } : {}),
+                };
+                const computerUseNs = faceRuntime.settingsNamespaces.view("computer-use")
+                    .value;
+                const cuModeRaw = typeof computerUseNs.mode === "string"
+                    ? computerUseNs.mode.trim().toLowerCase()
+                    : "off";
+                const computerUseProduct = {
+                    mode: cuModeRaw === "uia" || cuModeRaw === "background"
+                        ? cuModeRaw
+                        : "off",
+                };
+                const backgroundHelper = faceRuntime.credentials.peek("computer.background")?.trim() ||
+                    process.env.XRK_COMPUTER_USE_BACKGROUND?.trim() ||
+                    "";
+                const computerUseEnv = backgroundHelper
+                    ? {
+                        ...process.env,
+                        XRK_COMPUTER_USE_BACKGROUND: backgroundHelper,
+                    }
+                    : undefined;
+                const browserNs = faceRuntime.settingsNamespaces.view("browser")
+                    .value;
+                const brModeRaw = typeof browserNs.mode === "string"
+                    ? browserNs.mode.trim().toLowerCase()
+                    : "http";
+                const brCdpUrl = typeof browserNs.cdpUrl === "string" && browserNs.cdpUrl.trim()
+                    ? browserNs.cdpUrl.trim()
+                    : undefined;
+                const browserProduct = {
+                    mode: brModeRaw === "cdp" ? "cdp" : "http",
+                    ...(brCdpUrl ? { cdpUrl: brCdpUrl } : {}),
+                };
+                const voiceNs = faceRuntime.settingsNamespaces.view("voice")
+                    .value;
+                const voiceModeRaw = typeof voiceNs.mode === "string"
+                    ? voiceNs.mode.trim().toLowerCase()
+                    : "off";
+                const voiceBase = typeof voiceNs.baseUrl === "string" && voiceNs.baseUrl.trim()
+                    ? voiceNs.baseUrl.trim()
+                    : undefined;
+                const voiceProduct = {
+                    mode: voiceModeRaw === "openai" ? "openai" : "off",
+                    ...(voiceBase ? { baseUrl: voiceBase } : {}),
+                };
+                const voiceKey = faceRuntime.credentials.peek("voice.openai")?.trim() ||
+                    process.env.XRK_VOICE_OPENAI_KEY?.trim() ||
+                    "";
+                const voiceEnv = voiceKey
+                    ? { ...process.env, XRK_VOICE_OPENAI_KEY: voiceKey }
+                    : undefined;
+                const imageNs = faceRuntime.settingsNamespaces.view("image-gen")
+                    .value;
+                const imageModeRaw = typeof imageNs.mode === "string"
+                    ? imageNs.mode.trim().toLowerCase()
+                    : "off";
+                const imageBase = typeof imageNs.baseUrl === "string" && imageNs.baseUrl.trim()
+                    ? imageNs.baseUrl.trim()
+                    : undefined;
+                const imageModel = typeof imageNs.model === "string" && imageNs.model.trim()
+                    ? imageNs.model.trim()
+                    : undefined;
+                const imageGenProduct = {
+                    mode: imageModeRaw === "openai" ? "openai" : "off",
+                    ...(imageBase ? { baseUrl: imageBase } : {}),
+                    ...(imageModel ? { model: imageModel } : {}),
+                };
+                const imageKey = faceRuntime.credentials.peek("image.openai")?.trim() ||
+                    process.env.XRK_IMAGE_GEN_OPENAI_KEY?.trim() ||
+                    "";
+                const imageGenEnv = imageKey
+                    ? { ...process.env, XRK_IMAGE_GEN_OPENAI_KEY: imageKey }
+                    : undefined;
+                const videoNs = faceRuntime.settingsNamespaces.view("video-gen")
+                    .value;
+                const videoModeRaw = typeof videoNs.mode === "string"
+                    ? videoNs.mode.trim().toLowerCase()
+                    : "off";
+                const videoBase = typeof videoNs.baseUrl === "string" && videoNs.baseUrl.trim()
+                    ? videoNs.baseUrl.trim()
+                    : undefined;
+                const videoModel = typeof videoNs.model === "string" && videoNs.model.trim()
+                    ? videoNs.model.trim()
+                    : undefined;
+                const videoGenProduct = {
+                    mode: videoModeRaw === "openai" ? "openai" : "off",
+                    ...(videoBase ? { baseUrl: videoBase } : {}),
+                    ...(videoModel ? { model: videoModel } : {}),
+                };
+                const videoKey = faceRuntime.credentials.peek("video.openai")?.trim() ||
+                    process.env.XRK_VIDEO_GEN_OPENAI_KEY?.trim() ||
+                    "";
+                const videoGenEnv = videoKey
+                    ? { ...process.env, XRK_VIDEO_GEN_OPENAI_KEY: videoKey }
+                    : undefined;
+                const localeNs = faceRuntime.settingsNamespaces.view("locale")
+                    .value;
+                const asLocale = (raw) => raw === "zh" || raw === "en" ? raw : undefined;
+                // Explicit Settings choice wins; older desktop builds stored the shell
+                // language in the `ui` namespace (`ui.locale`) and never wrote
+                // `locale.preference`, so honour it instead of dropping to the
+                // language-agnostic prompt fallback (reasoning drifted to English).
+                const localePref = asLocale(localeNs.preference) ??
+                    asLocale(faceRuntime.settingsNamespaces.view("ui")
+                        .value.locale);
+                const memNs = faceRuntime.settingsNamespaces.view("curated-memory")
+                    .value;
+                const memFaceOn = memNs.enabled !== false;
+                const memEnvRaw = String(process.env.XRK_CURATED_MEMORY ?? "").trim();
+                const curatedMemoryEnabled = memEnvRaw !== "" ? memEnvRaw !== "0" : memFaceOn;
                 return {
                     ...(maxParallelToolCalls !== undefined ? { maxParallelToolCalls } : {}),
                     ...(maxSteps !== undefined ? { maxSteps } : {}),
@@ -944,8 +1229,26 @@ export function createHostManager() {
                     ...(injectMaxChars !== undefined
                         ? { workspaceInject: { maxChars: injectMaxChars } }
                         : {}),
+                    sessionTelemetry,
+                    sandbox,
+                    computerUseProduct,
+                    ...(computerUseEnv ? { computerUseEnv } : {}),
+                    browserProduct,
+                    voiceProduct,
+                    ...(voiceEnv ? { voiceEnv } : {}),
+                    imageGenProduct,
+                    ...(imageGenEnv ? { imageGenEnv } : {}),
+                    videoGenProduct,
+                    ...(videoGenEnv ? { videoGenEnv } : {}),
+                    ...(!curatedMemoryEnabled ? { curatedMemory: false } : {}),
+                    ...(localePref ? { locale: localePref } : {}),
                 };
             };
+            {
+                const cronNs = faceRuntime.settingsNamespaces.view("cron")
+                    .value;
+                applyCronScheduler({ enabled: cronNs.enabled !== false });
+            }
             faceRuntime.bus.subscribeHost((_rpcId, frame) => {
                 if (frame.type !== "host/remote-event")
                     return;
@@ -957,12 +1260,30 @@ export function createHostManager() {
                 }
                 if (event === "settings/document-updated") {
                     const ns = frame.args[0];
+                    if (ns === "cron") {
+                        const cronNs = faceRuntime.settingsNamespaces.view("cron")
+                            .value;
+                        const changed = applyCronScheduler({
+                            enabled: cronNs.enabled !== false,
+                        });
+                        if (changed)
+                            void invalidateAgents();
+                        return;
+                    }
                     if (ns === "agent-default-model" ||
                         ns === "llm-deepseek" ||
                         ns === "llm-pi-ai" ||
                         ns === "agent-loop" ||
                         ns === "bash" ||
-                        ns === "web-search") {
+                        ns === "web-search" ||
+                        ns === "sandbox" ||
+                        ns === "computer-use" ||
+                        ns === "browser" ||
+                        ns === "voice" ||
+                        ns === "image-gen" ||
+                        ns === "video-gen" ||
+                        ns === "curated-memory" ||
+                        ns === "locale") {
                         void invalidateAgents();
                     }
                 }
@@ -1004,6 +1325,32 @@ export function createHostManager() {
                 workspaceRoot: faceRuntime.workspaceRoot,
                 defaultCwd: faceRuntime.workspaceRoot,
                 resolveSessionCwd: (sessionId) => resolveSessionCwd(faceRuntime, sessionId),
+                resolveAutoReviewClassifierProduct: () => {
+                    const ns = faceRuntime.settingsNamespaces.view("auto-review")
+                        .value;
+                    const classifierUrl = typeof ns.classifierUrl === "string" ? ns.classifierUrl.trim() : "";
+                    const classifierToken = faceRuntime.credentials.peek("auto-review.classifier")?.trim() ||
+                        process.env.XRK_AUTO_REVIEW_CLASSIFIER_TOKEN?.trim() ||
+                        "";
+                    return {
+                        ...(classifierUrl ? { classifierUrl } : {}),
+                        ...(classifierToken ? { classifierToken } : {}),
+                    };
+                },
+                resolveMemoryEmbedProduct: () => {
+                    const ns = faceRuntime.settingsNamespaces.view("memory-embed")
+                        .value;
+                    const url = typeof ns.url === "string" ? ns.url.trim() : "";
+                    const collection = typeof ns.collection === "string" ? ns.collection.trim() : "";
+                    const token = faceRuntime.credentials.peek("memory-embed.token")?.trim() ||
+                        process.env.XRK_MEMORY_EMBED_TOKEN?.trim() ||
+                        "";
+                    return {
+                        ...(url ? { url } : {}),
+                        ...(token ? { token } : {}),
+                        ...(collection ? { collection } : {}),
+                    };
+                },
                 tokenLedger: {
                     ...createCostMeterUsageBridge(faceRuntime),
                     ...createUsageStatsBridgeFromFace(faceRuntime),
@@ -1051,6 +1398,12 @@ export function createHostManager() {
                     },
                     policy,
                     resolvePolicyAsk: hostWireCtx.resolvePolicyAsk,
+                    onPrefsChanged: (_value, patch) => {
+                        if (Object.prototype.hasOwnProperty.call(patch, "agentOpenTools") ||
+                            Object.prototype.hasOwnProperty.call(patch, "agentTerminalTools")) {
+                            void invalidateAgents();
+                        }
+                    },
                 }), createXrkPluginPublicHandler({
                     pluginsDir: resolvedPluginsDir,
                     xrkHome: resolveXrkHome(),
@@ -1148,6 +1501,10 @@ export function createHostManager() {
                     stopPromise = (async () => {
                         cronBox.scheduler?.stop();
                         policyFileWatch?.dispose();
+                        // Phase1 consolidate before agents/store go away (Hermes finalize).
+                        for (const sessionId of store.list()) {
+                            consolidateCuratedMemoryForSession(sessionId);
+                        }
                         await http.close();
                         await agentCache.dispose();
                         if (sharedShell) {
@@ -1158,6 +1515,14 @@ export function createHostManager() {
                                 // Host stop must continue even if jobs teardown partially fails.
                             }
                         }
+                        if (sharedBrowser) {
+                            try {
+                                sharedBrowser.dispose();
+                            }
+                            catch {
+                                // Host stop must continue even if browser CDP teardown fails.
+                            }
+                        }
                         if (sshWorld) {
                             try {
                                 sshWorld.dispose();
@@ -1177,6 +1542,7 @@ export function createHostManager() {
                         if ("close" in store && typeof store.close === "function") {
                             store.close();
                         }
+                        invariantsRegistry?.dispose();
                         for (const p of loader.list()) {
                             await loader.unregister(p.id);
                         }