assistme 0.2.4 → 0.2.6

package/dist/{chunk-GHMZQ2UA.js → chunk-XY3LGAOY.js}

@@ -340,6 +340,24 @@ async function emitEvent(messageId, eventType, eventData) {
   });
   if (error) log.warn(`Failed to emit event: ${error.message}`);
 }
+async function setActionRequest(messageId, actionData) {
+  const sb = getSupabase();
+  const { error } = await sb.rpc("mcp_set_action_request", {
+    p_token_hash: getTokenHash(),
+    p_message_id: messageId,
+    p_action_data: actionData
+  });
+  if (error) throw new Error(`Failed to set action request: ${error.message}`);
+}
+async function pollActionResponse(messageId) {
+  const sb = getSupabase();
+  const { data, error } = await sb.rpc("mcp_poll_action_response", {
+    p_token_hash: getTokenHash(),
+    p_message_id: messageId
+  });
+  if (error) throw new Error(`Failed to poll action response: ${error.message}`);
+  return data;
+}
 
 // src/agent/job-runner.ts
 var JobRunner = class {
@@ -556,5 +574,7 @@ export {
   getConversationHistory,
   resetEventSequence,
   emitEvent,
+  setActionRequest,
+  pollActionResponse,
   JobRunner
 };

package/dist/index.js

@@ -19,15 +19,17 @@ import {
   loginWithToken,
   logout,
   newCorrelationId,
+  pollActionResponse,
   pollAndClaimJobRun,
   pollAndClaimTask,
   resetEventSequence,
+  setActionRequest,
   setConfig,
   setCorrelationId,
   setLogLevel,
   setSessionBusy,
   updateHeartbeat
-} from "./chunk-GHMZQ2UA.js";
+} from "./chunk-XY3LGAOY.js";
 
 // src/index.ts
 import { Command } from "commander";
@@ -2974,7 +2976,7 @@ function createAgentToolsServer(deps) {
       ),
       tool(
         "skill_create",
-        "Create a new skill definition. The skill is saved as a draft \u2014 you must then ask the user if they want to add it to their collection, and use skill_add if they approve.",
+        "Create a new skill and add it to the user's collection. Returns the skill ID on success.",
         {
           name: z.string().describe("Skill name in kebab-case, e.g. 'flight-booking'"),
           description: z.string().describe("One-line description of what this skill does"),
@@ -3004,12 +3006,23 @@ function createAgentToolsServer(deps) {
               content: [{ type: "text", text: `Failed to create skill "${args.name}".` }]
             };
           }
-          log.success(`Skill "${args.name}" created (pending approval)`);
+          await skillManager.syncToAgentSkills(
+            args.name,
+            args.description,
+            args.instructions,
+            "1.0.0",
+            {
+              source: "manual",
+              emoji: args.emoji,
+              sourceSkillId: result.id
+            }
+          );
+          log.success(`Skill "${args.name}" created and added to collection`);
           return {
             content: [
               {
                 type: "text",
-                text: `Skill "${args.name}" created (ID: ${result.id}). Ask the user if they want to add it to their collection. If yes, call skill_add with this ID.`
+                text: `Skill "${args.name}" created and added to your collection (ID: ${result.id}).`
               }
             ]
           };
@@ -3142,7 +3155,7 @@ ${content}`;
       ),
       tool(
         "skill_generate",
-        "Prepare context for generating skills from a job description. Returns existing skills and job info so you can analyze the job and create skills using skill_create + skill_add. After creating all skills, call skill_link_job to link them to the job and mark it as analyzed.",
+        "Prepare context for generating skills from a job description. Returns existing skills and job info so you can analyze the job and create skills using skill_create (which auto-adds to user's collection). After creating all skills, call skill_link_job to link them to the job and mark it as analyzed.",
         {
           job_name: z.string().describe(
             "Short name for this job/role. Example: '\u7535\u5546\u8FD0\u8425', 'Frontend Dev', 'Data Analyst'"
@@ -3163,7 +3176,22 @@ ${content}`;
 
 `;
           }
-          response += `**Your task:** Analyze this job description and decompose it into 4-10 automatable skills. `;
+          response += `**Your task:** Analyze this job description and decompose it into 4-10 automatable skills.
+
+`;
+          response += `**IMPORTANT \u2014 You MUST use request_user_confirmation before creating skills:**
+`;
+          response += `1. Analyze the job and draft a list of proposed skills (name, emoji, one-line description for each).
+`;
+          response += `2. Call \`request_user_confirmation\` with the formatted skill list as "message" and these options:
+`;
+          response += `   - options: [{label: "Approve All", action_key: "approve_all", description: "Create all proposed skills"}, {label: "Cancel", action_key: "cancel", description: "Do not create any skills"}]
+`;
+          response += `3. WAIT for the response. If action_key is "approve_all", create all skills using \`skill_create\`. If "cancel", stop.
+`;
+          response += `4. Do NOT ask for confirmation in text. Do NOT create skills without calling request_user_confirmation first.
+
+`;
           response += `For each skill, call \`skill_create\` with:
 `;
           response += `- name: kebab-case name (e.g. "slack-message-check")
@@ -3175,10 +3203,10 @@ ${content}`;
           response += `- emoji: a single emoji representing the skill
 
 `;
-          response += `After creating each skill, call \`skill_add\` with the returned skill ID to add it to the user's collection.
+          response += `skill_create automatically adds the skill to the user's collection \u2014 no need to call skill_add.
 
 `;
-          response += `After ALL skills are created and added, call \`skill_link_job\` with job_name="${args.job_name}" and the list of created skill names to link them and mark the job as analyzed.
+          response += `After ALL skills are created, call \`skill_link_job\` with job_name="${args.job_name}" and the list of created skill names to link them and mark the job as analyzed.
 
 `;
           response += `**Guidelines for skill instructions:**
@@ -3328,6 +3356,76 @@ ${content}`;
           };
         }
       ),
+      // ── User Confirmation Tool ─────────────────────────────────
+      tool(
+        "request_user_confirmation",
+        "Pause and ask the user for approval or input via the web UI. Returns the user's chosen action_key. Use this BEFORE creating skills, making irreversible changes, etc. The agent will block until the user responds or the timeout expires.",
+        {
+          message: z.string().describe("What to show the user (supports markdown)"),
+          options: z.array(z.object({
+            label: z.string().describe("Button label shown to user"),
+            action_key: z.string().describe("Machine-readable key returned when selected"),
+            description: z.string().optional().describe("Tooltip/description for this option")
+          })).describe("Buttons/options to show the user"),
+          timeout_seconds: z.number().optional().describe("How long to wait for response (default: 300)")
+        },
+        async (args) => {
+          const actionId = `action_${Date.now()}_${Math.random().toString(36).slice(2, 8)}`;
+          const timeout = (args.timeout_seconds || 300) * 1e3;
+          const actionData = {
+            id: actionId,
+            type: "confirmation",
+            message: args.message,
+            options: args.options,
+            created_at: (/* @__PURE__ */ new Date()).toISOString()
+          };
+          try {
+            await setActionRequest(taskId, actionData);
+            log.info(`Action request ${actionId} stored in metadata, waiting for user response...`);
+            emitEvent(taskId, "user_action_request", actionData).catch(() => {
+            });
+            const startTime = Date.now();
+            const pollInterval = 2e3;
+            while (Date.now() - startTime < timeout) {
+              const response = await pollActionResponse(taskId);
+              if (response) {
+                const actionKey = response.action_key || response.action || "";
+                const label = response.label || actionKey;
+                log.info(`User responded: ${label} (${actionKey})`);
+                return {
+                  content: [{
+                    type: "text",
+                    text: JSON.stringify({
+                      status: "responded",
+                      action_key: actionKey,
+                      label
+                    })
+                  }]
+                };
+              }
+              await new Promise((resolve2) => setTimeout(resolve2, pollInterval));
+            }
+            log.warn(`Action request ${actionId} timed out after ${args.timeout_seconds || 300}s`);
+            return {
+              content: [{
+                type: "text",
+                text: JSON.stringify({
+                  status: "timeout",
+                  message: "User did not respond within the timeout period."
+                })
+              }]
+            };
+          } catch (err) {
+            log.error(`request_user_confirmation failed: ${err}`);
+            return {
+              content: [{
+                type: "text",
+                text: `Failed to request user confirmation: ${err instanceof Error ? err.message : err}`
+              }]
+            };
+          }
+        }
+      ),
       // ── Job Automation Tools ──────────────────────────────────────
       tool(
         "job_run",
@@ -3521,30 +3619,17 @@ ${content}`;
 async function saveJobToDb(userId, jobName, jobDescription, createdSkillNames) {
   try {
     const sb = getSupabase();
-    const { data: job, error: jobError } = await sb.from("agent_jobs").upsert(
-      { user_id: userId, name: jobName, description: jobDescription },
-      { onConflict: "user_id,name" }
-    ).select("id").single();
-    if (jobError || !job) {
-      log.debug(`Failed to save job "${jobName}": ${jobError?.message}`);
+    const { data, error } = await sb.rpc("save_job_with_skills", {
+      p_user_id: userId,
+      p_job_name: jobName,
+      p_job_description: jobDescription,
+      p_skill_names: createdSkillNames
+    });
+    if (error) {
+      log.debug(`Failed to save job "${jobName}" via RPC: ${error.message}`);
       return;
     }
-    if (createdSkillNames.length > 0) {
-      const { data: skillRows } = await sb.from("agent_skills").select("id").eq("user_id", userId).in("name", createdSkillNames);
-      const skillIds = (skillRows || []).map((r) => r.id);
-      if (skillIds.length > 0) {
-        const links = skillIds.map((skillId) => ({
-          job_id: job.id,
-          skill_id: skillId
-        }));
-        const { error: linkError } = await sb.from("agent_job_skills").upsert(links, { onConflict: "job_id,skill_id" });
-        if (linkError) {
-          log.debug(`Failed to link skills to job: ${linkError.message}`);
-        }
-      }
-    }
-    await sb.from("agent_jobs").update({ skills_analyzed: true }).eq("id", job.id);
-    log.debug(`Job "${jobName}" saved to DB with ${createdSkillNames.length} skill link(s), marked as analyzed`);
+    log.debug(`Job "${jobName}" saved via RPC (id: ${data}), ${createdSkillNames.length} skill(s) linked`);
   } catch (err) {
     log.debug(`saveJobToDb error: ${err}`);
   }
@@ -3639,7 +3724,7 @@ Available capabilities:
 
 5. JOB AUTOMATION:
    - When the user describes their job/role/daily work, use skill_generate to decompose it into automatable skills
-   - First call without auto_create to show the plan, then with auto_create:true after user confirms
+   - ALWAYS use request_user_confirmation to get user approval before creating skills \u2014 never create skills without approval
    - Use job_run to start a job \u2014 it gives you the job's goal and available skills as capabilities
    - When running a job, be AGENTIC: decide dynamically what to do based on what you discover
    - Do NOT follow a fixed sequence \u2014 if checking Slack reveals a task that needs GitHub, go do GitHub immediately
@@ -3774,6 +3859,8 @@ var TaskProcessor = class {
         "mcp__assistme-agent__skill_browse",
         "mcp__assistme-agent__skill_add",
         "mcp__assistme-agent__skill_publish",
+        // User confirmation
+        "mcp__assistme-agent__request_user_confirmation",
         // Job automation tools
         "mcp__assistme-agent__job_run",
         "mcp__assistme-agent__job_schedule",
@@ -4446,7 +4533,7 @@ function registerJobCommands(program2) {
   jobCmd.command("list").description("List your defined jobs").action(async () => {
     try {
       const userId = await getCurrentUserId();
-      const { JobRunner: JobRunner2 } = await import("./job-runner-BH5MDQX3.js");
+      const { JobRunner: JobRunner2 } = await import("./job-runner-XTGLMPZ3.js");
       const runner = new JobRunner2(userId);
       const jobs = await runner.listJobs();
       if (jobs.length === 0) {
@@ -4474,7 +4561,7 @@ function registerJobCommands(program2) {
   jobCmd.command("status [name]").description("Show run history for a job (or all jobs)").option("-l, --limit <number>", "Max runs to show (default: 5)").action(async (name, opts) => {
     try {
       const userId = await getCurrentUserId();
-      const { JobRunner: JobRunner2 } = await import("./job-runner-BH5MDQX3.js");
+      const { JobRunner: JobRunner2 } = await import("./job-runner-XTGLMPZ3.js");
       const runner = new JobRunner2(userId);
       const runs = await runner.getRunHistory(
         name,
@@ -4528,7 +4615,7 @@ Job Run History${name ? ` \u2014 ${name}` : ""}:`
         process.exit(1);
       }
       const userId = await getCurrentUserId();
-      const { JobRunner: JobRunner2 } = await import("./job-runner-BH5MDQX3.js");
+      const { JobRunner: JobRunner2 } = await import("./job-runner-XTGLMPZ3.js");
       const runner = new JobRunner2(userId);
       const job = await runner.loadJob(name);
       if (!job) {

package/dist/{job-runner-BH5MDQX3.js → job-runner-XTGLMPZ3.js}

@@ -1,6 +1,6 @@
 import {
   JobRunner
-} from "./chunk-GHMZQ2UA.js";
+} from "./chunk-XY3LGAOY.js";
 export {
   JobRunner
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "assistme",
-  "version": "0.2.4",
+  "version": "0.2.6",
   "description": "AssistMe CLI Agent - AI-powered assistant that controls your real browser",
   "type": "module",
   "main": "dist/index.js",

package/src/agent/mcp-servers.ts

@@ -10,7 +10,7 @@ import { log } from "../utils/logger.js";
 import type { MemoryManager, MemoryCategory } from "./memory.js";
 import type { SkillManager } from "./skills.js";
 import { substituteArguments, preprocessDynamicContext } from "./skills.js";
-import { getSupabase } from "../db/supabase.js";
+import { getSupabase, emitEvent, setActionRequest, pollActionResponse } from "../db/supabase.js";
 import { JobRunner } from "./job-runner.js";
 import {
   createScheduledTask,
@@ -214,7 +214,7 @@ export function createAgentToolsServer(deps: AgentToolsDeps): McpSdkServerConfig
       ),
       tool(
         "skill_create",
-        "Create a new skill definition. The skill is saved as a draft — you must then ask the user if they want to add it to their collection, and use skill_add if they approve.",
+        "Create a new skill and add it to the user's collection. Returns the skill ID on success.",
         {
           name: z.string().describe("Skill name in kebab-case, e.g. 'flight-booking'"),
           description: z.string().describe("One-line description of what this skill does"),
@@ -235,6 +235,7 @@ export function createAgentToolsServer(deps: AgentToolsDeps): McpSdkServerConfig
             };
           }
 
+          // Create in skills table (repository)
           const result = await skillManager.create(
             args.name,
             args.description,
@@ -248,12 +249,25 @@ export function createAgentToolsServer(deps: AgentToolsDeps): McpSdkServerConfig
             };
           }
 
-          log.success(`Skill "${args.name}" created (pending approval)`);
+          // Auto-add to user's collection via upsert_agent_skill RPC
+          await skillManager.syncToAgentSkills(
+            args.name,
+            args.description,
+            args.instructions,
+            "1.0.0",
+            {
+              source: "manual",
+              emoji: args.emoji,
+              sourceSkillId: result.id,
+            }
+          );
+
+          log.success(`Skill "${args.name}" created and added to collection`);
           return {
             content: [
               {
                 type: "text",
-                text: `Skill "${args.name}" created (ID: ${result.id}). Ask the user if they want to add it to their collection. If yes, call skill_add with this ID.`,
+                text: `Skill "${args.name}" created and added to your collection (ID: ${result.id}).`,
               },
             ],
           };
@@ -405,7 +419,7 @@ export function createAgentToolsServer(deps: AgentToolsDeps): McpSdkServerConfig
       tool(
         "skill_generate",
         "Prepare context for generating skills from a job description. Returns existing skills and job info " +
-          "so you can analyze the job and create skills using skill_create + skill_add. " +
+          "so you can analyze the job and create skills using skill_create (which auto-adds to user's collection). " +
           "After creating all skills, call skill_link_job to link them to the job and mark it as analyzed.",
         {
           job_name: z.string().describe(
@@ -426,14 +440,20 @@ export function createAgentToolsServer(deps: AgentToolsDeps): McpSdkServerConfig
             response += `**Existing skills (do NOT duplicate):** ${existingNames.join(", ")}\n\n`;
           }
 
-          response += `**Your task:** Analyze this job description and decompose it into 4-10 automatable skills. `;
+          response += `**Your task:** Analyze this job description and decompose it into 4-10 automatable skills.\n\n`;
+          response += `**IMPORTANT — You MUST use request_user_confirmation before creating skills:**\n`;
+          response += `1. Analyze the job and draft a list of proposed skills (name, emoji, one-line description for each).\n`;
+          response += `2. Call \`request_user_confirmation\` with the formatted skill list as "message" and these options:\n`;
+          response += `   - options: [{label: "Approve All", action_key: "approve_all", description: "Create all proposed skills"}, {label: "Cancel", action_key: "cancel", description: "Do not create any skills"}]\n`;
+          response += `3. WAIT for the response. If action_key is "approve_all", create all skills using \`skill_create\`. If "cancel", stop.\n`;
+          response += `4. Do NOT ask for confirmation in text. Do NOT create skills without calling request_user_confirmation first.\n\n`;
           response += `For each skill, call \`skill_create\` with:\n`;
           response += `- name: kebab-case name (e.g. "slack-message-check")\n`;
           response += `- description: one-line description\n`;
           response += `- instructions: detailed step-by-step markdown instructions the agent can follow\n`;
           response += `- emoji: a single emoji representing the skill\n\n`;
-          response += `After creating each skill, call \`skill_add\` with the returned skill ID to add it to the user's collection.\n\n`;
-          response += `After ALL skills are created and added, call \`skill_link_job\` with job_name="${args.job_name}" and the list of created skill names to link them and mark the job as analyzed.\n\n`;
+          response += `skill_create automatically adds the skill to the user's collection — no need to call skill_add.\n\n`;
+          response += `After ALL skills are created, call \`skill_link_job\` with job_name="${args.job_name}" and the list of created skill names to link them and mark the job as analyzed.\n\n`;
           response += `**Guidelines for skill instructions:**\n`;
           response += `- Write clear, actionable markdown steps\n`;
           response += `- Reference browser tools (browser_navigate, browser_click, browser_read_page, etc.) for web tasks\n`;
@@ -584,6 +604,89 @@ export function createAgentToolsServer(deps: AgentToolsDeps): McpSdkServerConfig
         }
       ),
 
+      // ── User Confirmation Tool ─────────────────────────────────
+
+      tool(
+        "request_user_confirmation",
+        "Pause and ask the user for approval or input via the web UI. " +
+          "Returns the user's chosen action_key. Use this BEFORE creating skills, making irreversible changes, etc. " +
+          "The agent will block until the user responds or the timeout expires.",
+        {
+          message: z.string().describe("What to show the user (supports markdown)"),
+          options: z.array(z.object({
+            label: z.string().describe("Button label shown to user"),
+            action_key: z.string().describe("Machine-readable key returned when selected"),
+            description: z.string().optional().describe("Tooltip/description for this option"),
+          })).describe("Buttons/options to show the user"),
+          timeout_seconds: z.number().optional().describe("How long to wait for response (default: 300)"),
+        },
+        async (args) => {
+          const actionId = `action_${Date.now()}_${Math.random().toString(36).slice(2, 8)}`;
+          const timeout = (args.timeout_seconds || 300) * 1000;
+
+          const actionData = {
+            id: actionId,
+            type: "confirmation",
+            message: args.message,
+            options: args.options,
+            created_at: new Date().toISOString(),
+          };
+
+          try {
+            // Store action request in message metadata via RPC — UI reads this
+            await setActionRequest(taskId, actionData);
+            log.info(`Action request ${actionId} stored in metadata, waiting for user response...`);
+
+            // Also emit event for real-time notification (best-effort)
+            emitEvent(taskId, "user_action_request", actionData).catch(() => {});
+
+            // Poll for response
+            const startTime = Date.now();
+            const pollInterval = 2000;
+
+            while (Date.now() - startTime < timeout) {
+              const response = await pollActionResponse(taskId);
+              if (response) {
+                const actionKey = (response.action_key || response.action || "") as string;
+                const label = (response.label || actionKey) as string;
+                log.info(`User responded: ${label} (${actionKey})`);
+                return {
+                  content: [{
+                    type: "text",
+                    text: JSON.stringify({
+                      status: "responded",
+                      action_key: actionKey,
+                      label,
+                    }),
+                  }],
+                };
+              }
+
+              await new Promise((resolve) => setTimeout(resolve, pollInterval));
+            }
+
+            log.warn(`Action request ${actionId} timed out after ${args.timeout_seconds || 300}s`);
+            return {
+              content: [{
+                type: "text",
+                text: JSON.stringify({
+                  status: "timeout",
+                  message: "User did not respond within the timeout period.",
+                }),
+              }],
+            };
+          } catch (err) {
+            log.error(`request_user_confirmation failed: ${err}`);
+            return {
+              content: [{
+                type: "text",
+                text: `Failed to request user confirmation: ${err instanceof Error ? err.message : err}`,
+              }],
+            };
+          }
+        }
+      ),
+
       // ── Job Automation Tools ──────────────────────────────────────
 
       tool(
@@ -824,54 +927,19 @@ async function saveJobToDb(
   try {
     const sb = getSupabase();
 
-    // Upsert the job
-    const { data: job, error: jobError } = await sb
-      .from("agent_jobs")
-      .upsert(
-        { user_id: userId, name: jobName, description: jobDescription },
-        { onConflict: "user_id,name" }
-      )
-      .select("id")
-      .single();
-
-    if (jobError || !job) {
-      log.debug(`Failed to save job "${jobName}": ${jobError?.message}`);
-      return;
-    }
-
-    // Query DB for skill IDs by name (can't rely on in-memory dbId due to async sync)
-    if (createdSkillNames.length > 0) {
-      const { data: skillRows } = await sb
-        .from("agent_skills")
-        .select("id")
-        .eq("user_id", userId)
-        .in("name", createdSkillNames);
-
-      const skillIds = (skillRows || []).map((r: Record<string, unknown>) => r.id as string);
+    const { data, error } = await sb.rpc("save_job_with_skills", {
+      p_user_id: userId,
+      p_job_name: jobName,
+      p_job_description: jobDescription,
+      p_skill_names: createdSkillNames,
+    });
 
-      if (skillIds.length > 0) {
-        const links = skillIds.map((skillId) => ({
-          job_id: job.id,
-          skill_id: skillId,
-        }));
-
-        const { error: linkError } = await sb
-          .from("agent_job_skills")
-          .upsert(links, { onConflict: "job_id,skill_id" });
-
-        if (linkError) {
-          log.debug(`Failed to link skills to job: ${linkError.message}`);
-        }
-      }
+    if (error) {
+      log.debug(`Failed to save job "${jobName}" via RPC: ${error.message}`);
+      return;
     }
 
-    // Mark job as analyzed
-    await sb
-      .from("agent_jobs")
-      .update({ skills_analyzed: true })
-      .eq("id", job.id);
-
-    log.debug(`Job "${jobName}" saved to DB with ${createdSkillNames.length} skill link(s), marked as analyzed`);
+    log.debug(`Job "${jobName}" saved via RPC (id: ${data}), ${createdSkillNames.length} skill(s) linked`);
   } catch (err) {
     log.debug(`saveJobToDb error: ${err}`);
   }

package/src/agent/processor.ts

@@ -68,7 +68,7 @@ Available capabilities:
 
 5. JOB AUTOMATION:
    - When the user describes their job/role/daily work, use skill_generate to decompose it into automatable skills
-   - First call without auto_create to show the plan, then with auto_create:true after user confirms
+   - ALWAYS use request_user_confirmation to get user approval before creating skills — never create skills without approval
    - Use job_run to start a job — it gives you the job's goal and available skills as capabilities
    - When running a job, be AGENTIC: decide dynamically what to do based on what you discover
    - Do NOT follow a fixed sequence — if checking Slack reveals a task that needs GitHub, go do GitHub immediately
@@ -237,6 +237,8 @@ export class TaskProcessor {
         "mcp__assistme-agent__skill_browse",
         "mcp__assistme-agent__skill_add",
         "mcp__assistme-agent__skill_publish",
+        // User confirmation
+        "mcp__assistme-agent__request_user_confirmation",
         // Job automation tools
         "mcp__assistme-agent__job_run",
         "mcp__assistme-agent__job_schedule",

package/src/db/supabase.ts

@@ -418,7 +418,8 @@ export type EventType =
   | "tool_result"
   | "thinking"
   | "error"
-  | "status_change";
+  | "status_change"
+  | "user_action_request";
 
 let eventSequence = 0;
 
@@ -459,3 +460,30 @@ export async function emitEvents(
   });
   if (error) log.warn(`Failed to emit events batch: ${error.message}`);
 }
+
+// ── Action Request Helpers ──────────────────────────────────────────
+
+export async function setActionRequest(
+  messageId: string,
+  actionData: Record<string, unknown>
+): Promise<void> {
+  const sb = getSupabase();
+  const { error } = await sb.rpc("mcp_set_action_request", {
+    p_token_hash: getTokenHash(),
+    p_message_id: messageId,
+    p_action_data: actionData,
+  });
+  if (error) throw new Error(`Failed to set action request: ${error.message}`);
+}
+
+export async function pollActionResponse(
+  messageId: string
+): Promise<Record<string, unknown> | null> {
+  const sb = getSupabase();
+  const { data, error } = await sb.rpc("mcp_poll_action_response", {
+    p_token_hash: getTokenHash(),
+    p_message_id: messageId,
+  });
+  if (error) throw new Error(`Failed to poll action response: ${error.message}`);
+  return data as Record<string, unknown> | null;
+}