@yeaft/webchat-agent 1.0.615 → 1.0.616

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@yeaft/webchat-agent",
-  "version": "1.0.615",
+  "version": "1.0.616",
   "description": "Remote worker agent for Yeaft Web Code Agent — connects the native Yeaft engine, CLI providers, and workbench tools",
   "main": "index.js",
   "type": "module",

package/yeaft/person/bridge.js

@@ -69,7 +69,11 @@ export function createPersonBridge({
         IMAGE_MODEL: 'No permitted selected model supports image input',
         MODEL_SELECTION: 'Choose models from this Agent configured catalog',
         NOT_OPEN: 'Open the digital person first',
-        NOT_FOUND: 'Digital person task or child not found',
+        NOT_FOUND: 'Digital person output, task or child not found',
+        OUTPUT_PLATFORM: 'File publication requires Linux with accessible procfs and no-follow directory descriptors; links and existing snapshots remain available',
+        OUTPUT_PATH: 'Output must be a regular file strictly within workDir; symlinks are not permitted',
+        OUTPUT_QUOTA: 'Maximum 10 MiB per file, 100 MiB or 200 outputs per person',
+        OUTPUT_NOT_FILE: 'Only published file snapshots can be read; links are not fetched',
         TASK_SCOPE_DENIED: 'Digital person task access denied',
         TASK_CONTROL_UNAVAILABLE: 'Task control could not be confirmed; refresh before retrying',
         STALE: 'Digital person state changed; refresh and try again',

package/yeaft/person/capabilities.js

@@ -3,11 +3,13 @@ import { bytes, digest, fail, identifier, object, page, text } from './contracts
 import { createdCapabilityRecord, validateCreatedDefinition } from './created-capability-contract.js';
 import { runPersonScript, scriptInput, testPersonScript } from './script-executor.js';
 import { chronologicalCursor, createdSkillView, inspectionCursor, inspectionPage, inspectionTime } from './inspection.js';
+import { publishOutput } from './outputs.js';
 
 // Intrinsic cognition, bounded pure scripts and supported native host tools.
 // No shell/filesystem/network/VP authority is exposed to generated code.
 const entries = [
   { id: 'Think', version: 1, domain: 'cognition', description: 'Intrinsic deliberate reflection, reorganization, association and reconsideration.', keywords: '思考 整理 反思 think reflection', useWhen: 'Think with the evidence already present, or rest when nothing warrants further work.', avoidWhen: 'Do not invent evidence or call a tool merely to appear thoughtful.', instructions: 'Revisit supplied experiences and current judgments; separate report from hypothesis, propose new concepts or associations, test a counterexample, and record the explicit finding with uncertainty. It is fine to rest. This is a method, not another model call or external action.', args: {} },
+  { id: 'Output.publish', version: 1, domain: 'delivery', description: 'Deliver a meaningful artifact as an immutable file snapshot or external link to your owner.', keywords: '产物 交付 输出 文件 下载 链接 publish output artifact deliver file download link', useWhen: 'Deliver an actual completed or useful partial artifact, including artifacts produced by your children.', avoidWhen: 'Do not publish secrets, unauthorized files or guessed paths; do not claim publication rolled back on cancellation.', instructions: 'args: {file_path?:string,url?:string,title?:string}. Exactly one file_path or url. file_path is relative to canonical workDir or an absolute path strictly inside it; no symlinks/directories. Max 10 MiB per file, 100 MiB and 200 outputs total per Person. Files are durable byte snapshots with conservative MIME, including Markdown/images/PDF/HTML/text/code/JSON/binary downloads. URL must be HTTP(S), no credentials; it is metadata only and never fetched. title <=240 UTF-8 bytes; default filename or link host, truncated on UTF-8 boundaries if necessary. File publication is Linux-only with accessible procfs and no-follow directory descriptors; unavailable platforms fail closed with OUTPUT_PLATFORM. Links and existing snapshot reads remain available. Returns public {id,title,kind,mimeType,size,episodeId,createdAt,url?}, no raw path. Successful publications survive later cancellation/failure. Parent verifies and publishes child artifacts within its own workDir; do not grant children this capability.', args: { file_path: 'optional local artifact path within workDir', url: 'optional credential-free HTTP(S) URL', title: 'optional title <=240 UTF-8 bytes' }, access: 'publish-owner-output' },
   { id: 'Recall', version: 1, domain: 'memory', description: 'Recall a bounded page of your own long-term messages or concepts.', keywords: '回忆 记忆 召回 历史 查找 搜索 memory recall history search', useWhen: 'Missing prior words, experiences or concepts could change your present understanding.', avoidWhen: 'Current evidence is sufficient; a similar memory cannot grant permission or establish truth.', instructions: 'args: {kind:"messages"|"concepts",query?:string,cursor?:string|null,limit?:1..5}. SQLite uses local hybrid keyword/semantic recall when available; inspect retrieval mode, coverage and degradation. Legacy storage may use literal matching. Results are not exhaustive or authorization. Preserve nextCursor for the same query; local ranking cursors expire after 5 minutes or restart.', args: { kind: 'messages|concepts', query: 'optional memory search text', cursor: 'optional opaque cursor', limit: '1..5' } },
   { id: 'Capability.create', version: 1, domain: 'creation', description: 'Create or revise a reusable pure JavaScript capability; execute tests before publishing to your private catalog.', keywords: '创造 创建 固化 脚本 编程 学会 create script learn capability', useWhen: 'A reusable JSON data transformation or calculation is missing. Write a small script and concrete examples, including edge cases; successful tests publish it automatically.', avoidWhen: 'Do not save one-off constants, secrets, unnecessary duplicates, external actions or assumptions as verified facts. Tests you wrote are limited evidence, not proof of general correctness.', instructions: 'args: {id:"Script.<slug>",expectedVersion:0 for new or current version,description,useWhen,avoidWhen,inputDescription,outputDescription,code,tests:[{input:JSON,expected:JSON}]}. slug: lowercase letter followed by up to 47 lowercase letters/digits/hyphens. Metadata <=400 UTF-8 bytes each; code <=8192; total args <=24576; 1..8 tests with each input/expected <=4096 bytes. code is a synchronous function body receiving input and returning JSON. QuickJS only: no Node, imports, filesystem, network, shell, credentials or host tools. Each test runs in a fresh limited VM; failure returns diagnostics without publication. Passing tests atomically publish an immutable version independently of final cognitive commit. Later cancellation does not undo publication. Result prepares the ID for next call with {input:JSON}; no model generates that result. Tests are limited evidence, not proof of correctness/usefulness. Search before duplicating; catalog.view supplies the saved definition for revision. Preserve useful tests. Max 32 capabilities, 32 versions each.', args: { id: 'Script.<slug>', expectedVersion: 'integer >= 0', description: 'string', useWhen: 'string', avoidWhen: 'string', inputDescription: 'string', outputDescription: 'string', code: 'JavaScript function body', tests: 'array of {input,expected}' }, access: 'create-pure-capability' },
   { id: 'Skill.reconsider', version: 1, domain: 'method', description: 'Read-only method for revising a previous judgment.', keywords: '反思 复核 反例 修正 重新审视 reconsider revise counterexample', useWhen: 'A prior judgment meets conflicting evidence or may have overlooked an alternative.', avoidWhen: 'Do not force a revision or treat a hypothetical counterexample as observed evidence.', instructions: 'Identify one prior claim, list a concrete counterexample or missing evidence, and decide whether to retain, qualify or revise it. Mark what remains unresolved. Do not present the counterexample as an observed event without evidence.', args: {} },
@@ -25,6 +27,8 @@ export const CAPABILITY_MAP = Object.freeze({
   nativeToolNotice: 'Default native host tools are in this catalog, not QuickJS. View a known nativeTools ID to prepare its complete schema, or search. Bash supports background tasks and SpawnAgent supports independent parallel threads in the private Person task namespace. Collect results explicitly; completion does not start cognition. Session-specific tools are not registered.',
   discover: { id: 'catalog.search', args: '{query?:string,cursor?:string|null,limit?:1..5}', description: 'Browse/search summaries with budgeted complete contracts. Returned contracts are prepared for the next call; omitted contracts require catalog.view. All entries remain reachable by pagination.' },
   inspect: { id: 'catalog.view', args: '{id:string}', description: 'Load a known ID directly, or a contract omitted by search. No search is required first.' },
+  // Discoverable entry only; full delivery/safety instructions are demand-loaded.
+  delivery: { id: 'Output.publish' },
   intrinsic: 'Think is always available as a cognitive activity; no tool call is required.',
 });
 export const catalogRevision = digest(manifests);
@@ -99,8 +103,8 @@ export function inspectCapabilities(created, { cursor, limit }, nativeToolIds =
 }
 
 export class PersonCapabilities {
-  constructor(repository, ownerId, { experience = [], triggerKind = 'think', now = Date.now(), created = [], episode, toolHost } = {}) {
-    this.repository = repository; this.ownerId = ownerId; this.episode = episode; this.toolHost = toolHost;
+  constructor(repository, ownerId, { experience = [], triggerKind = 'think', now = Date.now(), created = [], episode, toolHost, workDir } = {}) {
+    this.repository = repository; this.ownerId = ownerId; this.episode = episode; this.toolHost = toolHost; this.workDir = workDir;
     this.scripts = new Map(created.map(record => [record.id, record]));
     this.nativeToolIds = toolHost?.allowedToolIds?.() ?? NATIVE_TOOL_IDS;
     const allowed = new Set(this.nativeToolIds);
@@ -181,6 +185,7 @@ export class PersonCapabilities {
       object(args, Object.keys(entry.args.properties ?? {}), entry.args.required ?? []);
       return this.toolHost.execute(id, args, { signal, callId, episodeId: this.episode?.id });
     }
+    if (id === 'Output.publish') return publishOutput(this.repository, this.episode, this.workDir, args, { signal, callId });
     if (id === 'Capability.create') {
       if (!this.episode || !callId) fail('UNSUPPORTED');
       const definition = validateCreatedDefinition(args);

package/yeaft/person/contracts.js

@@ -23,7 +23,11 @@ const ERRORS = {
   ATTACHMENT_LIMIT: 'Attachments exceed the limit: 4 files, 5 MiB each, 10 MiB total; text plus extracted content must fit 24 KiB.',
   IMAGE_MODEL: 'The selected model does not permit image input.',
   CLOSED: 'The digital person service is closed.',
-  NOT_FOUND: 'Digital person task or child not found.',
+  NOT_FOUND: 'Digital person output, task or child not found.',
+  OUTPUT_PLATFORM: 'File publication requires Linux with accessible procfs and no-follow directory descriptors; links and existing snapshots remain available.',
+  OUTPUT_PATH: 'Output must be a regular, unchanged file strictly within workDir; symlinks are not permitted.',
+  OUTPUT_QUOTA: 'Outputs exceed the limit: 10 MiB per file, 100 MiB or 200 outputs per person.',
+  OUTPUT_NOT_FILE: 'Only published file snapshots can be read; links are not fetched.',
   TASK_SCOPE_DENIED: 'Digital person task access denied.',
   TASK_CONTROL_UNAVAILABLE: 'Task control could not be confirmed; refresh before retrying.',
 };

package/yeaft/person/outputs.js

@@ -0,0 +1,153 @@
+import { constants, openSync, closeSync, fstatSync, readSync, realpathSync } from 'node:fs';
+import { basename, extname, relative, resolve, sep } from 'node:path';
+import { fail, object, page, PersonError, text } from './contracts.js';
+
+export const OUTPUT_LIMITS = Object.freeze({ fileBytes: 10 * 1024 * 1024, personBytes: 100 * 1024 * 1024, personCount: 200, readBytes: 65536 });
+const BINARY = 'application/octet-stream';
+const ID = /^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/;
+
+export function outputArgs(args) {
+  object(args, ['file_path', 'url', 'title'], []);
+  if (Object.hasOwn(args, 'file_path') === Object.hasOwn(args, 'url')) fail('INVALID_REQUEST');
+  if (Object.hasOwn(args, 'title')) text(args.title, 240);
+  if (Object.hasOwn(args, 'file_path')) text(args.file_path, 4096);
+  else outputUrl(args.url);
+  return args;
+}
+export function outputUrl(value) {
+  text(value, 4096);
+  // WHATWG parsing silently trims controls and tolerates ambiguous backslashes.
+  if (!/^https?:\/\//i.test(value) || /[\s\u0000-\u001f\u007f\\]/u.test(value)) fail('INVALID_REQUEST');
+  let url; try { url = new URL(value); } catch { fail('INVALID_REQUEST'); }
+  if (!['http:', 'https:'].includes(url.protocol) || !url.hostname || url.username || url.password || /^https?:\/\/[^/?#]*@/i.test(value)) fail('INVALID_REQUEST');
+  return url.href; // Metadata only. Never fetched by the Agent or Server.
+}
+export function outputsPage(payload = {}) {
+  if (Object.hasOwn(payload ?? {}, 'limit') && payload.limit == null) fail('INVALID_REQUEST');
+  return page(payload);
+}
+export function outputReadRequest(payload = {}) {
+  object(payload, ['outputId', 'offset', 'maxBytes'], ['outputId']);
+  if (typeof payload.outputId !== 'string' || !ID.test(payload.outputId)) fail('INVALID_REQUEST');
+  const offset = payload.offset === undefined ? 0 : payload.offset;
+  const maxBytes = payload.maxBytes === undefined ? OUTPUT_LIMITS.readBytes : payload.maxBytes;
+  if (!Number.isSafeInteger(offset) || offset < 0 || !Number.isInteger(maxBytes) || maxBytes < 1 || maxBytes > OUTPUT_LIMITS.readBytes) fail('INVALID_REQUEST');
+  return { outputId: payload.outputId, offset, maxBytes };
+}
+export function outputView(record) {
+  return { id: record.id, title: record.title, kind: record.kind, mimeType: record.mimeType, size: record.size,
+    episodeId: record.episodeId, createdAt: record.createdAt, ...(record.kind === 'link' ? { url: record.url } : {}) };
+}
+
+/** Renderer selection is byte-checked and conservative. SVG and unknown/binary
+ * formats are downloads only. Signatures are not a full decoder or malware scan. */
+export function outputMime(name, data) {
+  const ext = extname(name).toLowerCase();
+  const magic = hex => data.subarray(0, hex.length / 2).equals(Buffer.from(hex, 'hex'));
+  if (ext === '.png') return magic('89504e470d0a1a0a') ? 'image/png' : BINARY;
+  if (['.jpg', '.jpeg', '.jfif'].includes(ext)) return magic('ffd8ff') ? 'image/jpeg' : BINARY;
+  if (ext === '.gif') return ['GIF87a', 'GIF89a'].includes(data.subarray(0, 6).toString('ascii')) ? 'image/gif' : BINARY;
+  if (ext === '.webp') return data.subarray(0, 4).toString('ascii') === 'RIFF' && data.subarray(8, 12).toString('ascii') === 'WEBP' ? 'image/webp' : BINARY;
+  if (ext === '.pdf') return data.subarray(0, 5).toString('ascii') === '%PDF-' ? 'application/pdf' : BINARY;
+  if (ext === '.svg') return BINARY;
+  let content;
+  try { content = new TextDecoder('utf-8', { fatal: true }).decode(data); } catch { return BINARY; }
+  if (/[\u0000-\u0008\u000b\u000c\u000e-\u001f\u007f]/u.test(content)) return BINARY;
+  if (['.html', '.htm'].includes(ext)) return 'text/html'; // UI must use script/network-blocked sandbox.
+  if (['.md', '.markdown'].includes(ext)) return 'text/markdown';
+  if (ext === '.json') { try { JSON.parse(content); return 'application/json'; } catch { return 'text/plain'; } }
+  return 'text/plain'; // Code/plain UTF-8 is never executed, regardless of extension.
+}
+
+/** Deliberately Linux-only until another platform has a verified race-safe
+ * descriptor-relative implementation. Link publication / durable reads are portable. */
+export function outputFilePublicationSupport() {
+  const unavailable = { supported: false, reason: 'File publication requires Linux with accessible procfs and no-follow directory descriptors; links and existing snapshots remain available.' };
+  if (process.platform !== 'linux' || !constants.O_NOFOLLOW || !constants.O_DIRECTORY) return unavailable;
+  let root, probe;
+  try {
+    root = openSync('/', constants.O_RDONLY | constants.O_DIRECTORY | constants.O_NOFOLLOW);
+    probe = openSync(`/proc/self/fd/${root}/.`, constants.O_RDONLY | constants.O_DIRECTORY | constants.O_NOFOLLOW);
+    if (!fstatSync(probe).isDirectory() || realpathSync(`/proc/self/fd/${probe}`) !== '/') return unavailable;
+    return { supported: true, reason: null };
+  } catch { return unavailable; }
+  finally { for (const fd of [probe, root]) if (fd !== undefined) { try { closeSync(fd); } catch { /* best effort close */ } } }
+}
+
+// A filesystem basename can legally exceed our public title limit. Keep a valid
+// UTF-8 prefix (and short extension) rather than rejecting an otherwise valid file.
+function defaultTitle(value) {
+  value = value.trim() || 'Output';
+  if (Buffer.byteLength(value) <= 240) return value;
+  const ext = extname(value), suffix = `…${Buffer.byteLength(ext) <= 32 ? ext : ''}`;
+  let prefix = '';
+  for (const char of value) {
+    if (Buffer.byteLength(prefix + char + suffix) > 240) break;
+    prefix += char;
+  }
+  return prefix + suffix;
+}
+
+/** Read through pinned directory descriptors: each component is O_NOFOLLOW.
+ * Resolving then opening the full path would leave an ancestor-symlink race.
+ * Linux procfs provides openat-like anchoring without native dependencies.
+ * Missing platform support, fd filesystem or O_NOFOLLOW fails closed. */
+export function snapshotOutput(workDir, filePath) {
+  const descriptors = [];
+  try {
+    if (!outputFilePublicationSupport().supported) fail('OUTPUT_PLATFORM');
+    const root = realpathSync(resolve(workDir ?? process.cwd()));
+    const requested = resolve(root, filePath), rel = relative(root, requested);
+    if (!rel || rel === '..' || rel.startsWith(`..${sep}`) || resolve(root, rel) !== requested) fail('OUTPUT_PATH');
+    const fdRoot = '/proc/self/fd';
+    let parent = openSync(root, constants.O_RDONLY | constants.O_DIRECTORY | constants.O_NOFOLLOW);
+    descriptors.push(parent);
+    // Revalidate the root descriptor, so a swapped canonical root is not trusted.
+    if (realpathSync(`${fdRoot}/${parent}`) !== root) fail('OUTPUT_PATH');
+    const parts = rel.split(sep);
+    for (const component of parts.slice(0, -1)) {
+      parent = openSync(`${fdRoot}/${parent}/${component}`, constants.O_RDONLY | constants.O_DIRECTORY | constants.O_NOFOLLOW);
+      descriptors.push(parent);
+    }
+    // NONBLOCK prevents a malicious FIFO/device path from hanging before fstat.
+    const fd = openSync(`${fdRoot}/${parent}/${parts.at(-1)}`, constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK);
+    descriptors.push(fd);
+    const stat = fstatSync(fd);
+    if (!stat.isFile()) fail('OUTPUT_PATH');
+    const opened = realpathSync(`${fdRoot}/${fd}`), openedRel = relative(root, opened);
+    if (!openedRel || openedRel === '..' || openedRel.startsWith(`..${sep}`) || opened !== requested) fail('OUTPUT_PATH');
+    if (stat.size > OUTPUT_LIMITS.fileBytes) fail('OUTPUT_QUOTA');
+    // Read at most the limit + 1, even if another process grows the original.
+    const data = Buffer.alloc(stat.size + 1); let size = 0;
+    while (size < data.length) { const n = readSync(fd, data, size, data.length - size, size); if (!n) break; size += n; }
+    const after = fstatSync(fd);
+    if (after.size > OUTPUT_LIMITS.fileBytes || size > OUTPUT_LIMITS.fileBytes) fail('OUTPUT_QUOTA');
+    if (size !== stat.size || after.size !== stat.size || after.mtimeMs !== stat.mtimeMs || after.ctimeMs !== stat.ctimeMs) fail('OUTPUT_PATH');
+    return { data: data.subarray(0, size), name: basename(requested) };
+  } catch (error) {
+    if (error instanceof PersonError) throw error;
+    fail('OUTPUT_PATH'); // Never leak a filesystem error or raw path.
+  } finally { for (const fd of descriptors.reverse()) { try { closeSync(fd); } catch { /* best effort close */ } } }
+}
+
+export async function publishOutput(repository, episode, workDir, args, { signal, callId } = {}) {
+  outputArgs(args);
+  if (!episode || !callId) fail('UNSUPPORTED');
+  // Read permission is derived from the started current Person invocation, not
+  // from browser arguments or a child/Session tool registry.
+  await repository.checkOutputPublication(episode, { callId, args });
+  signal?.throwIfAborted();
+  let record, data = null;
+  if (Object.hasOwn(args, 'file_path')) {
+    const snapshot = snapshotOutput(workDir, args.file_path); data = snapshot.data;
+    record = { kind: 'file', title: args.title?.trim() ?? defaultTitle(snapshot.name), mimeType: outputMime(snapshot.name, data), size: data.length };
+  } else {
+    const url = outputUrl(args.url);
+    record = { kind: 'link', title: args.title?.trim() ?? defaultTitle(new URL(url).hostname), mimeType: null, size: 0, url };
+  }
+  text(record.title, 240);
+  signal?.throwIfAborted();
+  // SQLite checks the invocation/fence again in the same transaction as insert.
+  // Once committed this is an honest durable side effect, even after cancellation.
+  return repository.saveOutput(episode, { callId, args, record, data });
+}

package/yeaft/person/runtime.js

@@ -235,7 +235,7 @@ export class PersonRuntime {
         getContext: async ctx => this.tasks()?.context({ ...ctx, episode, provider,
           selection: toolSelection, effortDecision: toolEffortDecision, parentToolRegistry: this.parentToolRegistry }),
         onResult: result => finalizeNativeResult(result) });
-      const capabilities = new PersonCapabilities(this.repository, episode.ownerId, { experience: snapshot.capabilityExperience, triggerKind: episode.kind, created, episode, toolHost });
+      const capabilities = new PersonCapabilities(this.repository, episode.ownerId, { experience: snapshot.capabilityExperience, triggerKind: episode.kind, created, episode, toolHost, workDir: this.toolOptions.workDir });
       let previous = null, capabilityResult = null, dependencyRefs = [];
       // Validation retains actual reads across calls, independently of the bounded rendered request.
       // Candidate proposals never enter this read-set or establish new provenance.
@@ -344,7 +344,7 @@ export class PersonRuntime {
             signal.throwIfAborted();
             // Native host and script execution join their actual work before close.
             const executionPromise = capabilities.execute(invocation, { signal, callId });
-            capabilityResult = isNativeTool(invocation.id) || invocation.id === 'Capability.create' || invocation.id.startsWith('Script.')
+            capabilityResult = isNativeTool(invocation.id) || invocation.id === 'Output.publish' || invocation.id === 'Capability.create' || invocation.id.startsWith('Script.')
               ? await executionPromise : await abortable(executionPromise, signal);
             if (!finalized && !await finalize(capabilityResult)) fail('STALE');
             signal.throwIfAborted();

package/yeaft/person/service.js

@@ -7,6 +7,7 @@ import { loadConfig } from '../config.js';
 import { validateFiles } from './attachments.js';
 import { createPersonProvider, resolveAgentDefaultModel, selectPersonModels, validateDefaultModel, validateModelCandidates } from './provider.js';
 import { fail, identifier, LIMITS, object, page, personTaskRequest, safeError, text } from './contracts.js';
+import { outputFilePublicationSupport, outputReadRequest } from './outputs.js';
 import { turnsPage } from './turn-diagnostics.js';
 import { inspectRequest, personName, searchRequest } from './inspection.js';
 
@@ -54,7 +55,9 @@ export function createPersonService(options = {}) {
       object(payload, []);
       let agentDefaultModel = null;
       try { agentDefaultModel = resolveAgentDefaultModel(config ?? loadConfig({ dir: yeaftDir })); } catch { /* Invalid/missing native config. */ }
-      const status = { renameSupported: true, defaultModelSupported: true, configured, storage: 'sqlite', modelReady: false,
+      const filePublication = outputFilePublicationSupport();
+      const status = { outputsSupported: true, outputsFileSupported: filePublication.supported, outputsFileReason: filePublication.reason,
+        renameSupported: true, defaultModelSupported: true, configured, storage: 'sqlite', modelReady: false,
         defaultModel: null, agentDefaultModel, modelCandidates: [], effectiveModelCandidates: [], effectiveDefaultModel: null };
       if (!configured) return { ...status, reason: 'Digital person storage configuration is missing.', storageReady: false };
       try { await repository.init(); }
@@ -96,6 +99,8 @@ export function createPersonService(options = {}) {
         if (!host) fail('UNSUPPORTED');
         return host.request({ ownerId, personId: person.personId, namespace, op, payload: args });
       }
+      case 'outputs': return repository.outputs(ownerId, payload);
+      case 'output_read': return repository.outputRead(ownerId, outputReadRequest(payload));
       case 'snapshot': object(payload, []); return repository.snapshot(ownerId);
       case 'receipt': {
         object(payload, ['clientMessageId', 'requestHash'], ['clientMessageId']);

package/yeaft/person/sqlite-repository.js

@@ -107,6 +107,10 @@ export class SqlitePersonRepository {
   async settings(ownerId, settings, expectedControlVersion) { return this.request('settings', [ownerId, settings, expectedControlVersion]); }
   async list(ownerId, collection, options, filter) { return this.request('list', [ownerId, collection, options, filter]); }
   async turns(ownerId, options) { return this.request('turns', [ownerId, options]); }
+  async checkOutputPublication(episode, input) { return this.request('checkOutputPublication', [episode, input]); }
+  async saveOutput(episode, input) { return this.request('saveOutput', [episode, input]); }
+  async outputs(ownerId, options = {}) { return this.request('outputs', [ownerId, options]); }
+  async outputRead(ownerId, options) { return this.request('outputRead', [ownerId, options]); }
   async snapshot(ownerId) { return this.request('snapshot', [ownerId]); }
   async inspect(ownerId, options, nativeToolIds) { return this.request('inspect', [ownerId, options, nativeToolIds]); }
   async search(ownerId, options) { return this.request('search', [ownerId, options]); }

package/yeaft/person/sqlite-schema.js

@@ -14,6 +14,22 @@ export const TABLES = Object.freeze({
 });
 
 export const SCHEMA = `
+-- Additive migration: old schemaVersion/user_version=1 readers remain compatible.
+-- Output bytes have exactly one authority, this instance SQLite database.
+CREATE TABLE IF NOT EXISTS outputs (
+  seq INTEGER PRIMARY KEY AUTOINCREMENT,
+  namespace TEXT NOT NULL, ownerId TEXT NOT NULL, personId TEXT NOT NULL,
+  id TEXT NOT NULL, episodeId TEXT NOT NULL, callId TEXT NOT NULL,
+  size INTEGER NOT NULL CHECK(size BETWEEN 0 AND 10485760),
+  record TEXT NOT NULL CHECK(json_valid(record)), data BLOB,
+  UNIQUE(namespace, ownerId, personId, id),
+  UNIQUE(namespace, ownerId, personId, episodeId, callId),
+  FOREIGN KEY(namespace, ownerId, personId, episodeId) REFERENCES episodes(namespace, ownerId, personId, id),
+  CHECK((json_extract(record, '$.kind') = 'file' AND data IS NOT NULL AND length(data) = size)
+    OR (json_extract(record, '$.kind') = 'link' AND data IS NULL AND size = 0))
+) STRICT;
+CREATE INDEX IF NOT EXISTS outputs_recent ON outputs(namespace, ownerId, personId, seq DESC);
+
 CREATE TABLE IF NOT EXISTS persons (
   namespace TEXT NOT NULL, ownerId TEXT NOT NULL, personId TEXT NOT NULL,
   record TEXT NOT NULL CHECK(json_valid(record)), PRIMARY KEY(namespace, ownerId, personId)

package/yeaft/person/sqlite-store.js

@@ -11,6 +11,7 @@ import { capabilityExperienceView, recordCapabilityExperience } from './capabili
 import { chronologicalCursor, conceptView, inspectionCursor, inspectionPage, inspectRequest, messageView, personName, searchRequest, settingsView, stateView } from './inspection.js';
 import { TOKEN_FIELDS, turnsPage, turnView } from './turn-diagnostics.js';
 import { inspectCapabilities } from './capabilities.js';
+import { OUTPUT_LIMITS, outputArgs, outputMime, outputReadRequest, outputsPage, outputUrl, outputView } from './outputs.js';
 
 const SCOPE = 'namespace = ? AND ownerId = ? AND personId = ?';
 const scopeValues = s => [s.namespace, s.ownerId, s.personId];
@@ -52,8 +53,19 @@ const publicOutput = (output, failed) => {
   return failed ? { text: output.text, retainedBytes, observedBytes, complete: false, accepted: false, availability: 'captured', usage, stopReason }
     : { text: output.text, bytes: retainedBytes, complete: true, usage, stopReason };
 };
-const READS = new Set(['receipt', 'turns', 'inspect', 'search', 'getPerson', 'context', 'recall', 'list', 'searchChanges', 'resolveMemories', 'createdCapabilities', 'episodeAttachments']);
-const WRITES = new Set(['open', 'recover', 'admit', 'heartbeat', 'append', 'startCall', 'finalizeCall', 'startCapability', 'finalizeCapability', 'commit', 'publishProgress', 'finish', 'cancel', 'settings', 'snapshot', 'saveCreatedCapability']);
+const objectOutput = (record, data) => {
+  if (!record || !['file', 'link'].includes(record.kind)) fail('INVALID_REQUEST');
+  text(record.title, 240);
+  if (!Number.isSafeInteger(record.size) || record.size < 0 || record.size > OUTPUT_LIMITS.fileBytes) fail('OUTPUT_QUOTA');
+  if (record.kind === 'link') {
+    if (record.mimeType !== null || record.size !== 0 || data !== null || outputUrl(record.url) !== record.url) fail('INVALID_REQUEST');
+  } else {
+    const mimes = ['text/plain', 'text/markdown', 'text/html', 'application/json', 'application/pdf', 'application/octet-stream', 'image/png', 'image/jpeg', 'image/gif', 'image/webp'];
+    if (!mimes.includes(record.mimeType) || !(data instanceof Uint8Array) || data.length !== record.size) fail('INVALID_REQUEST');
+  }
+};
+const READS = new Set(['outputs', 'outputRead', 'checkOutputPublication', 'receipt', 'turns', 'inspect', 'search', 'getPerson', 'context', 'recall', 'list', 'searchChanges', 'resolveMemories', 'createdCapabilities', 'episodeAttachments']);
+const WRITES = new Set(['saveOutput', 'open', 'recover', 'admit', 'heartbeat', 'append', 'startCall', 'finalizeCall', 'startCapability', 'finalizeCapability', 'commit', 'publishProgress', 'finish', 'cancel', 'settings', 'snapshot', 'saveCreatedCapability']);
 const memoryKind = kind => { if (!['messages', 'concepts'].includes(kind)) fail('INVALID_REQUEST'); return kind; };
 const boundedLimit = (limit, max = 100) => { if (!Number.isSafeInteger(limit) || limit < 1 || limit > max) fail('INVALID_REQUEST'); return limit; };
 const sequence = value => {
@@ -271,7 +283,7 @@ export class SqlitePersonStore {
   }
   append(episode, kind, data) {
     // Call proof/publication events are emitted only by their transactional methods.
-    if (['call_started', 'call_output', 'call_failed', 'capability_created', 'capability_finalized'].includes(kind)) fail('INVALID_REQUEST');
+    if (['call_started', 'call_output', 'call_failed', 'capability_created', 'capability_finalized', 'output_published'].includes(kind)) fail('INVALID_REQUEST');
     const p = this.own(episode);
     const record = this.one('episodes', this.episodeScope(episode), ' AND id = ?', [episode.id]);
     if (!record || record.status !== 'running') fail('STALE');
@@ -543,6 +555,52 @@ export class SqlitePersonStore {
     const docs = this.rows('concepts', this.scope(ownerId), ' AND (? IS NULL OR id > ?) AND instr(statement, ?) > 0 ORDER BY id ASC LIMIT ?', [cursor, cursor, query.toLowerCase(), limit + 1]);
     return { items: docs.slice(0, limit).map(conceptView), nextCursor: docs.length > limit ? docs[limit - 1].id : null };
   }
+  checkOutputPublication(episode, { callId, args }) {
+    outputArgs(args); this.own(episode);
+    const scope = this.episodeScope(episode), active = this.one('episodes', scope, ' AND id = ?', [episode.id]);
+    if (!active || active.status !== 'running' || active.openCapability?.callId !== callId ||
+        active.openCapability.invocationHash !== digest({ id: 'Output.publish', args })) fail('STALE');
+    return true;
+  }
+  saveOutput(episode, { callId, args, record, data }) {
+    this.checkOutputPublication(episode, { callId, args });
+    const scope = this.episodeScope(episode);
+    objectOutput(record, data);
+    // Recheck MIME against the invocation filename/bytes at the authority boundary.
+    if ((record.kind === 'file' && (!Object.hasOwn(args, 'file_path') || outputMime(args.file_path, Buffer.from(data)) !== record.mimeType)) ||
+        (record.kind === 'link' && (!Object.hasOwn(args, 'url') || outputUrl(args.url) !== record.url))) fail('INVALID_REQUEST');
+    const totals = this.sql(`SELECT count(*) AS count, coalesce(sum(size), 0) AS size FROM outputs WHERE ${SCOPE}`).get(...scopeValues(scope));
+    if (totals.count >= OUTPUT_LIMITS.personCount || totals.size + record.size > OUTPUT_LIMITS.personBytes) fail('OUTPUT_QUOTA');
+    // Exactly one durable publication per started invocation, even before finalize.
+    if (this.sql(`SELECT 1 FROM outputs WHERE ${SCOPE} AND episodeId = ? AND callId = ?`).get(...scopeValues(scope), episode.id, callId)) fail('STALE');
+    const item = outputView({ ...record, id: randomUUID(), episodeId: episode.id, createdAt: this.now.toISOString() });
+    this.sql('INSERT INTO outputs(namespace, ownerId, personId, id, episodeId, callId, size, record, data) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)')
+      .run(...scopeValues(scope), item.id, item.episodeId, callId, item.size, JSON.stringify(item), data == null ? null : Buffer.from(data));
+    this.trace(episode.ownerId, episode.id, 'output_published', { callId, output: item });
+    return item;
+  }
+  outputs(ownerId, options = {}) {
+    const { cursor, limit } = outputsPage(options);
+    this.getPerson(ownerId);
+    const rows = this.sql(`SELECT seq, record FROM outputs WHERE ${SCOPE} AND (? IS NULL OR seq < ?) ORDER BY seq DESC LIMIT ?`)
+      .all(...scopeValues(this.scope(ownerId)), cursor, cursor, limit + 1);
+    return { items: rows.slice(0, limit).map(row => outputView(JSON.parse(row.record))), nextCursor: rows.length > limit ? String(rows[limit - 1].seq) : null };
+  }
+  outputRead(ownerId, options) {
+    const { outputId, offset, maxBytes } = outputReadRequest(options);
+    this.getPerson(ownerId);
+    const scope = this.scope(ownerId);
+    const row = this.sql(`SELECT size, record FROM outputs WHERE ${SCOPE} AND id = ?`).get(...scopeValues(scope), outputId);
+    if (!row) fail('NOT_FOUND');
+    const item = outputView(JSON.parse(row.record));
+    if (item.kind !== 'file') fail('OUTPUT_NOT_FILE');
+    if (offset > row.size) fail('INVALID_REQUEST');
+    // SQLite substr uses 1-based byte indices for BLOBs; never load the whole file.
+    const chunk = this.sql(`SELECT substr(data, ?, ?) AS data FROM outputs WHERE ${SCOPE} AND id = ?`)
+      .get(offset + 1, maxBytes, ...scopeValues(scope), outputId).data;
+    const data = Buffer.from(chunk), nextOffset = offset + data.length;
+    return { outputId, data: data.toString('base64'), offset, nextOffset, eof: nextOffset === row.size, totalBytes: row.size, mimeType: item.mimeType };
+  }
   snapshot(ownerId) {
     this.recover(ownerId);
     const scope = this.scope(ownerId), p = this.getPerson(ownerId), state = this.one('states', scope);
@@ -553,7 +611,7 @@ export class SqlitePersonStore {
       ...(episode.terminalCode ? { terminalCode: episode.terminalCode } : {}), ...(episode.endedAt ? { endedAt: episode.endedAt } : {}) } : null;
     return { latestEpisode, person: this.personView(p), state: stateView(state), concepts: this.focused(scope, state.focusConceptIds).slice(0, 12).map(conceptView),
       messages: messages.slice(0, 20).reverse().map(messageView), nextMessagesCursor: messages.length > 20 ? String(messages[19].seq) : null,
-      busy: Boolean(p.activeEpisodeId), episodeId: p.activeEpisodeId };
+      outputs: this.outputs(ownerId), busy: Boolean(p.activeEpisodeId), episodeId: p.activeEpisodeId };
   }
   searchChanges(ownerId, { after = 0, limit = 100 } = {}) {
     this.getPerson(ownerId); after = sequence(after); boundedLimit(limit, 1000);