capacitor-native-agent 0.9.14 → 0.9.15

package/ios/Frameworks/NativeAgentFFI.xcframework/ios-arm64/Headers/native_agent_ffi/native_agent_ffi.swift

@@ -682,7 +682,12 @@ public protocol NativeAgentHandleProtocol: AnyObject, Sendable {
     func resetToolPermissions() throws 
     
     /**
-     * Respond to a tool approval request.
+     * Respond to a tool approval request (legacy boolean entry point).
+     *
+     * Retained as the UniFFI-facing API for mobile callers that pass a plain
+     * boolean. Internally delegates to `respond_to_approval_decision` (a
+     * Rust-only helper, not UniFFI-exported) with no `decision`/`answers`,
+     * preserving today's behavior.
      */
     func respondToApproval(toolCallId: String, approved: Bool, reason: String?) throws 
     
@@ -732,8 +737,13 @@ public protocol NativeAgentHandleProtocol: AnyObject, Sendable {
     
     /**
      * Set an auth key for a provider.
+     *
+     * `base_url`, when set, overrides the provider's hardcoded endpoint — used
+     * to point the driver at a backend proxy that injects the real API key
+     * server-side, so the device never holds the provider secret. `None` ⇒
+     * the provider's default endpoint (unchanged behavior).
      */
-    func setAuthKey(key: String, provider: String, authType: String, refresh: String?, expiresAt: Int64?) throws 
+    func setAuthKey(key: String, provider: String, authType: String, refresh: String?, expiresAt: Int64?, baseUrl: String?) throws 
     
     /**
      * Set the event callback for receiving agent events.
@@ -751,6 +761,14 @@ public protocol NativeAgentHandleProtocol: AnyObject, Sendable {
      */
     func setHeartbeatConfig(configJson: String) throws 
     
+    /**
+     * Replace the FFI's MCP tool manifest. Tools registered here become
+     * visible to the LLM and, when called, surface as `mcp_tool_call`
+     * events that the host must answer with `respond_to_mcp_tool`.
+     * Idempotent — every call replaces the prior manifest.
+     */
+    func setMcpTools(toolsJson: String) throws  -> UInt32
+    
     func setMemoryProvider(provider: MemoryProvider) throws 
     
     func setNotifier(notifier: NativeNotifier) throws 
@@ -1200,7 +1218,12 @@ open func resetToolPermissions()throws   {try rustCallWithError(FfiConverterType
 }
     
     /**
-     * Respond to a tool approval request.
+     * Respond to a tool approval request (legacy boolean entry point).
+     *
+     * Retained as the UniFFI-facing API for mobile callers that pass a plain
+     * boolean. Internally delegates to `respond_to_approval_decision` (a
+     * Rust-only helper, not UniFFI-exported) with no `decision`/`answers`,
+     * preserving today's behavior.
      */
 open func respondToApproval(toolCallId: String, approved: Bool, reason: String?)throws   {try rustCallWithError(FfiConverterTypeNativeAgentError_lift) {
     uniffi_native_agent_ffi_fn_method_nativeagenthandle_respond_to_approval(
@@ -1320,15 +1343,21 @@ open func serializeAgentEventJson(eventType: String, payloadJson: String, sessio
     
     /**
      * Set an auth key for a provider.
+     *
+     * `base_url`, when set, overrides the provider's hardcoded endpoint — used
+     * to point the driver at a backend proxy that injects the real API key
+     * server-side, so the device never holds the provider secret. `None` ⇒
+     * the provider's default endpoint (unchanged behavior).
      */
-open func setAuthKey(key: String, provider: String, authType: String, refresh: String?, expiresAt: Int64?)throws   {try rustCallWithError(FfiConverterTypeNativeAgentError_lift) {
+open func setAuthKey(key: String, provider: String, authType: String, refresh: String?, expiresAt: Int64?, baseUrl: String?)throws   {try rustCallWithError(FfiConverterTypeNativeAgentError_lift) {
     uniffi_native_agent_ffi_fn_method_nativeagenthandle_set_auth_key(
             self.uniffiCloneHandle(),
         FfiConverterString.lower(key),
         FfiConverterString.lower(provider),
         FfiConverterString.lower(authType),
         FfiConverterOptionString.lower(refresh),
-        FfiConverterOptionInt64.lower(expiresAt),$0
+        FfiConverterOptionInt64.lower(expiresAt),
+        FfiConverterOptionString.lower(baseUrl),$0
     )
 }
 }
@@ -1365,6 +1394,21 @@ open func setHeartbeatConfig(configJson: String)throws   {try rustCallWithError(
         FfiConverterString.lower(configJson),$0
     )
 }
+}
+    
+    /**
+     * Replace the FFI's MCP tool manifest. Tools registered here become
+     * visible to the LLM and, when called, surface as `mcp_tool_call`
+     * events that the host must answer with `respond_to_mcp_tool`.
+     * Idempotent — every call replaces the prior manifest.
+     */
+open func setMcpTools(toolsJson: String)throws  -> UInt32  {
+    return try  FfiConverterUInt32.lift(try rustCallWithError(FfiConverterTypeNativeAgentError_lift) {
+    uniffi_native_agent_ffi_fn_method_nativeagenthandle_set_mcp_tools(
+            self.uniffiCloneHandle(),
+        FfiConverterString.lower(toolsJson),$0
+    )
+})
 }
     
 open func setMemoryProvider(provider: MemoryProvider)throws   {try rustCallWithError(FfiConverterTypeNativeAgentError_lift) {
@@ -1913,6 +1957,11 @@ public struct SendMessageParams: Equatable, Hashable {
      * JSON-encoded prior conversation messages for multi-turn sessions.
      */
     public var priorMessagesJson: String?
+    /**
+     * Create-only plan-mode seed (Stage 4b). Honored when starting a NEW
+     * session; the persisted store value is authoritative on resume.
+     */
+    public var planModeInit: Bool?
 
     // Default memberwise initializers are never public by default, so we
     // declare one manually.
@@ -1924,7 +1973,11 @@ public struct SendMessageParams: Equatable, Hashable {
          */skillAllowedToolsJson: String?, 
         /**
          * JSON-encoded prior conversation messages for multi-turn sessions.
-         */priorMessagesJson: String?) {
+         */priorMessagesJson: String?, 
+        /**
+         * Create-only plan-mode seed (Stage 4b). Honored when starting a NEW
+         * session; the persisted store value is authoritative on resume.
+         */planModeInit: Bool?) {
         self.prompt = prompt
         self.sessionKey = sessionKey
         self.model = model
@@ -1933,6 +1986,7 @@ public struct SendMessageParams: Equatable, Hashable {
         self.maxTurns = maxTurns
         self.skillAllowedToolsJson = skillAllowedToolsJson
         self.priorMessagesJson = priorMessagesJson
+        self.planModeInit = planModeInit
     }
 
     
@@ -1958,7 +2012,8 @@ public struct FfiConverterTypeSendMessageParams: FfiConverterRustBuffer {
                 systemPrompt: FfiConverterString.read(from: &buf), 
                 maxTurns: FfiConverterOptionUInt32.read(from: &buf), 
                 skillAllowedToolsJson: FfiConverterOptionString.read(from: &buf), 
-                priorMessagesJson: FfiConverterOptionString.read(from: &buf)
+                priorMessagesJson: FfiConverterOptionString.read(from: &buf), 
+                planModeInit: FfiConverterOptionBool.read(from: &buf)
         )
     }
 
@@ -1971,6 +2026,7 @@ public struct FfiConverterTypeSendMessageParams: FfiConverterRustBuffer {
         FfiConverterOptionUInt32.write(value.maxTurns, into: &buf)
         FfiConverterOptionString.write(value.skillAllowedToolsJson, into: &buf)
         FfiConverterOptionString.write(value.priorMessagesJson, into: &buf)
+        FfiConverterOptionBool.write(value.planModeInit, into: &buf)
     }
 }
 
@@ -2392,6 +2448,19 @@ public protocol GovernanceProvider: AnyObject, Sendable {
      */
     func checkSink(sinkType: String, content: String)  -> String
     
+    /**
+     * Register a tainted value for data-flow tracking (agent-os taint uptake).
+     * `labels` is a comma-separated set drawn from
+     * `Pii|Secret|ExternalNetwork|UserInput|UntrustedAgent`; a later
+     * `check_sink` blocks if a registered value reaches a sink that forbids one
+     * of its labels (e.g. ExternalNetwork content flowing into ShellExec).
+     * (No default: `#[uniffi::export]` callback-interface methods can't be
+     * defaulted — every host impl must provide it. Mobile delegates to its
+     * `TaintTracker::register`; a host with no taint engine implements it as a
+     * no-op.)
+     */
+    func registerTaint(key: String, value: String, labels: String, source: String) 
+    
     /**
      * Reset loop guard state (e.g. on new session).
      */
@@ -2537,6 +2606,36 @@ fileprivate struct UniffiCallbackInterfaceGovernanceProvider {
                 writeReturn: writeReturn
             )
         },
+        registerTaint: { (
+            uniffiHandle: UInt64,
+            key: RustBuffer,
+            value: RustBuffer,
+            labels: RustBuffer,
+            source: RustBuffer,
+            uniffiOutReturn: UnsafeMutableRawPointer,
+            uniffiCallStatus: UnsafeMutablePointer<RustCallStatus>
+        ) in
+            let makeCall = {
+                () throws -> () in
+                guard let uniffiObj = try? FfiConverterCallbackInterfaceGovernanceProvider.handleMap.get(handle: uniffiHandle) else {
+                    throw UniffiInternalError.unexpectedStaleHandle
+                }
+                return uniffiObj.registerTaint(
+                     key: try FfiConverterString.lift(key),
+                     value: try FfiConverterString.lift(value),
+                     labels: try FfiConverterString.lift(labels),
+                     source: try FfiConverterString.lift(source)
+                )
+            }
+
+            
+            let writeReturn = { () }
+            uniffiTraitInterfaceCall(
+                callStatus: uniffiCallStatus,
+                makeCall: makeCall,
+                writeReturn: writeReturn
+            )
+        },
         reset: { (
             uniffiHandle: UInt64,
             uniffiOutReturn: UnsafeMutableRawPointer,
@@ -3238,6 +3337,30 @@ fileprivate struct FfiConverterOptionInt64: FfiConverterRustBuffer {
     }
 }
 
+#if swift(>=5.8)
+@_documentation(visibility: private)
+#endif
+fileprivate struct FfiConverterOptionBool: FfiConverterRustBuffer {
+    typealias SwiftType = Bool?
+
+    public static func write(_ value: SwiftType, into buf: inout [UInt8]) {
+        guard let value = value else {
+            writeInt(&buf, Int8(0))
+            return
+        }
+        writeInt(&buf, Int8(1))
+        FfiConverterBool.write(value, into: &buf)
+    }
+
+    public static func read(from buf: inout (data: Data, offset: Data.Index)) throws -> SwiftType {
+        switch try readInt(&buf) as Int8 {
+        case 0: return nil
+        case 1: return try FfiConverterBool.read(from: &buf)
+        default: throw UniffiInternalError.unexpectedOptionalTag
+        }
+    }
+}
+
 #if swift(>=5.8)
 @_documentation(visibility: private)
 #endif
@@ -3411,7 +3534,7 @@ private let initializationResult: InitializationResult = {
     if (uniffi_native_agent_ffi_checksum_method_nativeagenthandle_reset_tool_permissions() != 15060) {
         return InitializationResult.apiChecksumMismatch
     }
-    if (uniffi_native_agent_ffi_checksum_method_nativeagenthandle_respond_to_approval() != 3194) {
+    if (uniffi_native_agent_ffi_checksum_method_nativeagenthandle_respond_to_approval() != 56876) {
         return InitializationResult.apiChecksumMismatch
     }
     if (uniffi_native_agent_ffi_checksum_method_nativeagenthandle_respond_to_cron_approval() != 851) {
@@ -3438,7 +3561,7 @@ private let initializationResult: InitializationResult = {
     if (uniffi_native_agent_ffi_checksum_method_nativeagenthandle_serialize_agent_event_json() != 40873) {
         return InitializationResult.apiChecksumMismatch
     }
-    if (uniffi_native_agent_ffi_checksum_method_nativeagenthandle_set_auth_key() != 1639) {
+    if (uniffi_native_agent_ffi_checksum_method_nativeagenthandle_set_auth_key() != 12658) {
         return InitializationResult.apiChecksumMismatch
     }
     if (uniffi_native_agent_ffi_checksum_method_nativeagenthandle_set_event_callback() != 56165) {
@@ -3450,6 +3573,9 @@ private let initializationResult: InitializationResult = {
     if (uniffi_native_agent_ffi_checksum_method_nativeagenthandle_set_heartbeat_config() != 33968) {
         return InitializationResult.apiChecksumMismatch
     }
+    if (uniffi_native_agent_ffi_checksum_method_nativeagenthandle_set_mcp_tools() != 15664) {
+        return InitializationResult.apiChecksumMismatch
+    }
     if (uniffi_native_agent_ffi_checksum_method_nativeagenthandle_set_memory_provider() != 23171) {
         return InitializationResult.apiChecksumMismatch
     }
@@ -3492,10 +3618,13 @@ private let initializationResult: InitializationResult = {
     if (uniffi_native_agent_ffi_checksum_method_governanceprovider_check_sink() != 37338) {
         return InitializationResult.apiChecksumMismatch
     }
-    if (uniffi_native_agent_ffi_checksum_method_governanceprovider_reset() != 57214) {
+    if (uniffi_native_agent_ffi_checksum_method_governanceprovider_register_taint() != 17176) {
+        return InitializationResult.apiChecksumMismatch
+    }
+    if (uniffi_native_agent_ffi_checksum_method_governanceprovider_reset() != 47675) {
         return InitializationResult.apiChecksumMismatch
     }
-    if (uniffi_native_agent_ffi_checksum_method_governanceprovider_record_usage() != 907) {
+    if (uniffi_native_agent_ffi_checksum_method_governanceprovider_record_usage() != 32049) {
         return InitializationResult.apiChecksumMismatch
     }
     if (uniffi_native_agent_ffi_checksum_method_memoryprovider_store() != 49136) {

package/ios/Frameworks/NativeAgentFFI.xcframework/ios-arm64/Headers/native_agent_ffi/native_agent_ffiFFI.h

@@ -273,14 +273,21 @@ typedef void (*UniffiCallbackInterfaceGovernanceProviderMethod3)(uint64_t, RustB
 #endif
 #ifndef UNIFFI_FFIDEF_CALLBACK_INTERFACE_GOVERNANCE_PROVIDER_METHOD4
 #define UNIFFI_FFIDEF_CALLBACK_INTERFACE_GOVERNANCE_PROVIDER_METHOD4
-typedef void (*UniffiCallbackInterfaceGovernanceProviderMethod4)(uint64_t, void* _Nonnull, 
+typedef void (*UniffiCallbackInterfaceGovernanceProviderMethod4)(uint64_t, RustBuffer, RustBuffer, RustBuffer, RustBuffer, void* _Nonnull, 
         RustCallStatus *_Nonnull uniffiCallStatus
     );
 
 #endif
 #ifndef UNIFFI_FFIDEF_CALLBACK_INTERFACE_GOVERNANCE_PROVIDER_METHOD5
 #define UNIFFI_FFIDEF_CALLBACK_INTERFACE_GOVERNANCE_PROVIDER_METHOD5
-typedef void (*UniffiCallbackInterfaceGovernanceProviderMethod5)(uint64_t, RustBuffer, uint32_t, uint32_t, void* _Nonnull, 
+typedef void (*UniffiCallbackInterfaceGovernanceProviderMethod5)(uint64_t, void* _Nonnull, 
+        RustCallStatus *_Nonnull uniffiCallStatus
+    );
+
+#endif
+#ifndef UNIFFI_FFIDEF_CALLBACK_INTERFACE_GOVERNANCE_PROVIDER_METHOD6
+#define UNIFFI_FFIDEF_CALLBACK_INTERFACE_GOVERNANCE_PROVIDER_METHOD6
+typedef void (*UniffiCallbackInterfaceGovernanceProviderMethod6)(uint64_t, RustBuffer, uint32_t, uint32_t, void* _Nonnull, 
         RustCallStatus *_Nonnull uniffiCallStatus
     );
 
@@ -357,8 +364,9 @@ typedef struct UniffiVTableCallbackInterfaceGovernanceProvider {
     UniffiCallbackInterfaceGovernanceProviderMethod1 _Nonnull recordOutcome;
     UniffiCallbackInterfaceGovernanceProviderMethod2 _Nonnull recordAudit;
     UniffiCallbackInterfaceGovernanceProviderMethod3 _Nonnull checkSink;
-    UniffiCallbackInterfaceGovernanceProviderMethod4 _Nonnull reset;
-    UniffiCallbackInterfaceGovernanceProviderMethod5 _Nonnull recordUsage;
+    UniffiCallbackInterfaceGovernanceProviderMethod4 _Nonnull registerTaint;
+    UniffiCallbackInterfaceGovernanceProviderMethod5 _Nonnull reset;
+    UniffiCallbackInterfaceGovernanceProviderMethod6 _Nonnull recordUsage;
 } UniffiVTableCallbackInterfaceGovernanceProvider;
 
 #endif
@@ -610,7 +618,7 @@ RustBuffer uniffi_native_agent_ffi_fn_method_nativeagenthandle_serialize_agent_e
 #endif
 #ifndef UNIFFI_FFIDEF_UNIFFI_NATIVE_AGENT_FFI_FN_METHOD_NATIVEAGENTHANDLE_SET_AUTH_KEY
 #define UNIFFI_FFIDEF_UNIFFI_NATIVE_AGENT_FFI_FN_METHOD_NATIVEAGENTHANDLE_SET_AUTH_KEY
-void uniffi_native_agent_ffi_fn_method_nativeagenthandle_set_auth_key(uint64_t ptr, RustBuffer key, RustBuffer provider, RustBuffer auth_type, RustBuffer refresh, RustBuffer expires_at, RustCallStatus *_Nonnull out_status
+void uniffi_native_agent_ffi_fn_method_nativeagenthandle_set_auth_key(uint64_t ptr, RustBuffer key, RustBuffer provider, RustBuffer auth_type, RustBuffer refresh, RustBuffer expires_at, RustBuffer base_url, RustCallStatus *_Nonnull out_status
 );
 #endif
 #ifndef UNIFFI_FFIDEF_UNIFFI_NATIVE_AGENT_FFI_FN_METHOD_NATIVEAGENTHANDLE_SET_EVENT_CALLBACK
@@ -628,6 +636,11 @@ void uniffi_native_agent_ffi_fn_method_nativeagenthandle_set_governance_provider
 void uniffi_native_agent_ffi_fn_method_nativeagenthandle_set_heartbeat_config(uint64_t ptr, RustBuffer config_json, RustCallStatus *_Nonnull out_status
 );
 #endif
+#ifndef UNIFFI_FFIDEF_UNIFFI_NATIVE_AGENT_FFI_FN_METHOD_NATIVEAGENTHANDLE_SET_MCP_TOOLS
+#define UNIFFI_FFIDEF_UNIFFI_NATIVE_AGENT_FFI_FN_METHOD_NATIVEAGENTHANDLE_SET_MCP_TOOLS
+uint32_t uniffi_native_agent_ffi_fn_method_nativeagenthandle_set_mcp_tools(uint64_t ptr, RustBuffer tools_json, RustCallStatus *_Nonnull out_status
+);
+#endif
 #ifndef UNIFFI_FFIDEF_UNIFFI_NATIVE_AGENT_FFI_FN_METHOD_NATIVEAGENTHANDLE_SET_MEMORY_PROVIDER
 #define UNIFFI_FFIDEF_UNIFFI_NATIVE_AGENT_FFI_FN_METHOD_NATIVEAGENTHANDLE_SET_MEMORY_PROVIDER
 void uniffi_native_agent_ffi_fn_method_nativeagenthandle_set_memory_provider(uint64_t ptr, uint64_t provider, RustCallStatus *_Nonnull out_status
@@ -1230,6 +1243,12 @@ uint16_t uniffi_native_agent_ffi_checksum_method_nativeagenthandle_set_governanc
 #define UNIFFI_FFIDEF_UNIFFI_NATIVE_AGENT_FFI_CHECKSUM_METHOD_NATIVEAGENTHANDLE_SET_HEARTBEAT_CONFIG
 uint16_t uniffi_native_agent_ffi_checksum_method_nativeagenthandle_set_heartbeat_config(void
     
+);
+#endif
+#ifndef UNIFFI_FFIDEF_UNIFFI_NATIVE_AGENT_FFI_CHECKSUM_METHOD_NATIVEAGENTHANDLE_SET_MCP_TOOLS
+#define UNIFFI_FFIDEF_UNIFFI_NATIVE_AGENT_FFI_CHECKSUM_METHOD_NATIVEAGENTHANDLE_SET_MCP_TOOLS
+uint16_t uniffi_native_agent_ffi_checksum_method_nativeagenthandle_set_mcp_tools(void
+    
 );
 #endif
 #ifndef UNIFFI_FFIDEF_UNIFFI_NATIVE_AGENT_FFI_CHECKSUM_METHOD_NATIVEAGENTHANDLE_SET_MEMORY_PROVIDER
@@ -1314,6 +1333,12 @@ uint16_t uniffi_native_agent_ffi_checksum_method_governanceprovider_record_audit
 #define UNIFFI_FFIDEF_UNIFFI_NATIVE_AGENT_FFI_CHECKSUM_METHOD_GOVERNANCEPROVIDER_CHECK_SINK
 uint16_t uniffi_native_agent_ffi_checksum_method_governanceprovider_check_sink(void
     
+);
+#endif
+#ifndef UNIFFI_FFIDEF_UNIFFI_NATIVE_AGENT_FFI_CHECKSUM_METHOD_GOVERNANCEPROVIDER_REGISTER_TAINT
+#define UNIFFI_FFIDEF_UNIFFI_NATIVE_AGENT_FFI_CHECKSUM_METHOD_GOVERNANCEPROVIDER_REGISTER_TAINT
+uint16_t uniffi_native_agent_ffi_checksum_method_governanceprovider_register_taint(void
+    
 );
 #endif
 #ifndef UNIFFI_FFIDEF_UNIFFI_NATIVE_AGENT_FFI_CHECKSUM_METHOD_GOVERNANCEPROVIDER_RESET

package/ios/Frameworks/NativeAgentFFI.xcframework/ios-arm64-simulator/Headers/native_agent_ffi/native_agent_ffi.swift

@@ -682,7 +682,12 @@ public protocol NativeAgentHandleProtocol: AnyObject, Sendable {
     func resetToolPermissions() throws 
     
     /**
-     * Respond to a tool approval request.
+     * Respond to a tool approval request (legacy boolean entry point).
+     *
+     * Retained as the UniFFI-facing API for mobile callers that pass a plain
+     * boolean. Internally delegates to `respond_to_approval_decision` (a
+     * Rust-only helper, not UniFFI-exported) with no `decision`/`answers`,
+     * preserving today's behavior.
      */
     func respondToApproval(toolCallId: String, approved: Bool, reason: String?) throws 
     
@@ -732,8 +737,13 @@ public protocol NativeAgentHandleProtocol: AnyObject, Sendable {
     
     /**
      * Set an auth key for a provider.
+     *
+     * `base_url`, when set, overrides the provider's hardcoded endpoint — used
+     * to point the driver at a backend proxy that injects the real API key
+     * server-side, so the device never holds the provider secret. `None` ⇒
+     * the provider's default endpoint (unchanged behavior).
      */
-    func setAuthKey(key: String, provider: String, authType: String, refresh: String?, expiresAt: Int64?) throws 
+    func setAuthKey(key: String, provider: String, authType: String, refresh: String?, expiresAt: Int64?, baseUrl: String?) throws 
     
     /**
      * Set the event callback for receiving agent events.
@@ -751,6 +761,14 @@ public protocol NativeAgentHandleProtocol: AnyObject, Sendable {
      */
     func setHeartbeatConfig(configJson: String) throws 
     
+    /**
+     * Replace the FFI's MCP tool manifest. Tools registered here become
+     * visible to the LLM and, when called, surface as `mcp_tool_call`
+     * events that the host must answer with `respond_to_mcp_tool`.
+     * Idempotent — every call replaces the prior manifest.
+     */
+    func setMcpTools(toolsJson: String) throws  -> UInt32
+    
     func setMemoryProvider(provider: MemoryProvider) throws 
     
     func setNotifier(notifier: NativeNotifier) throws 
@@ -1200,7 +1218,12 @@ open func resetToolPermissions()throws   {try rustCallWithError(FfiConverterType
 }
     
     /**
-     * Respond to a tool approval request.
+     * Respond to a tool approval request (legacy boolean entry point).
+     *
+     * Retained as the UniFFI-facing API for mobile callers that pass a plain
+     * boolean. Internally delegates to `respond_to_approval_decision` (a
+     * Rust-only helper, not UniFFI-exported) with no `decision`/`answers`,
+     * preserving today's behavior.
      */
 open func respondToApproval(toolCallId: String, approved: Bool, reason: String?)throws   {try rustCallWithError(FfiConverterTypeNativeAgentError_lift) {
     uniffi_native_agent_ffi_fn_method_nativeagenthandle_respond_to_approval(
@@ -1320,15 +1343,21 @@ open func serializeAgentEventJson(eventType: String, payloadJson: String, sessio
     
     /**
      * Set an auth key for a provider.
+     *
+     * `base_url`, when set, overrides the provider's hardcoded endpoint — used
+     * to point the driver at a backend proxy that injects the real API key
+     * server-side, so the device never holds the provider secret. `None` ⇒
+     * the provider's default endpoint (unchanged behavior).
      */
-open func setAuthKey(key: String, provider: String, authType: String, refresh: String?, expiresAt: Int64?)throws   {try rustCallWithError(FfiConverterTypeNativeAgentError_lift) {
+open func setAuthKey(key: String, provider: String, authType: String, refresh: String?, expiresAt: Int64?, baseUrl: String?)throws   {try rustCallWithError(FfiConverterTypeNativeAgentError_lift) {
     uniffi_native_agent_ffi_fn_method_nativeagenthandle_set_auth_key(
             self.uniffiCloneHandle(),
         FfiConverterString.lower(key),
         FfiConverterString.lower(provider),
         FfiConverterString.lower(authType),
         FfiConverterOptionString.lower(refresh),
-        FfiConverterOptionInt64.lower(expiresAt),$0
+        FfiConverterOptionInt64.lower(expiresAt),
+        FfiConverterOptionString.lower(baseUrl),$0
     )
 }
 }
@@ -1365,6 +1394,21 @@ open func setHeartbeatConfig(configJson: String)throws   {try rustCallWithError(
         FfiConverterString.lower(configJson),$0
     )
 }
+}
+    
+    /**
+     * Replace the FFI's MCP tool manifest. Tools registered here become
+     * visible to the LLM and, when called, surface as `mcp_tool_call`
+     * events that the host must answer with `respond_to_mcp_tool`.
+     * Idempotent — every call replaces the prior manifest.
+     */
+open func setMcpTools(toolsJson: String)throws  -> UInt32  {
+    return try  FfiConverterUInt32.lift(try rustCallWithError(FfiConverterTypeNativeAgentError_lift) {
+    uniffi_native_agent_ffi_fn_method_nativeagenthandle_set_mcp_tools(
+            self.uniffiCloneHandle(),
+        FfiConverterString.lower(toolsJson),$0
+    )
+})
 }
     
 open func setMemoryProvider(provider: MemoryProvider)throws   {try rustCallWithError(FfiConverterTypeNativeAgentError_lift) {
@@ -1913,6 +1957,11 @@ public struct SendMessageParams: Equatable, Hashable {
      * JSON-encoded prior conversation messages for multi-turn sessions.
      */
     public var priorMessagesJson: String?
+    /**
+     * Create-only plan-mode seed (Stage 4b). Honored when starting a NEW
+     * session; the persisted store value is authoritative on resume.
+     */
+    public var planModeInit: Bool?
 
     // Default memberwise initializers are never public by default, so we
     // declare one manually.
@@ -1924,7 +1973,11 @@ public struct SendMessageParams: Equatable, Hashable {
          */skillAllowedToolsJson: String?, 
         /**
          * JSON-encoded prior conversation messages for multi-turn sessions.
-         */priorMessagesJson: String?) {
+         */priorMessagesJson: String?, 
+        /**
+         * Create-only plan-mode seed (Stage 4b). Honored when starting a NEW
+         * session; the persisted store value is authoritative on resume.
+         */planModeInit: Bool?) {
         self.prompt = prompt
         self.sessionKey = sessionKey
         self.model = model
@@ -1933,6 +1986,7 @@ public struct SendMessageParams: Equatable, Hashable {
         self.maxTurns = maxTurns
         self.skillAllowedToolsJson = skillAllowedToolsJson
         self.priorMessagesJson = priorMessagesJson
+        self.planModeInit = planModeInit
     }
 
     
@@ -1958,7 +2012,8 @@ public struct FfiConverterTypeSendMessageParams: FfiConverterRustBuffer {
                 systemPrompt: FfiConverterString.read(from: &buf), 
                 maxTurns: FfiConverterOptionUInt32.read(from: &buf), 
                 skillAllowedToolsJson: FfiConverterOptionString.read(from: &buf), 
-                priorMessagesJson: FfiConverterOptionString.read(from: &buf)
+                priorMessagesJson: FfiConverterOptionString.read(from: &buf), 
+                planModeInit: FfiConverterOptionBool.read(from: &buf)
         )
     }
 
@@ -1971,6 +2026,7 @@ public struct FfiConverterTypeSendMessageParams: FfiConverterRustBuffer {
         FfiConverterOptionUInt32.write(value.maxTurns, into: &buf)
         FfiConverterOptionString.write(value.skillAllowedToolsJson, into: &buf)
         FfiConverterOptionString.write(value.priorMessagesJson, into: &buf)
+        FfiConverterOptionBool.write(value.planModeInit, into: &buf)
     }
 }
 
@@ -2392,6 +2448,19 @@ public protocol GovernanceProvider: AnyObject, Sendable {
      */
     func checkSink(sinkType: String, content: String)  -> String
     
+    /**
+     * Register a tainted value for data-flow tracking (agent-os taint uptake).
+     * `labels` is a comma-separated set drawn from
+     * `Pii|Secret|ExternalNetwork|UserInput|UntrustedAgent`; a later
+     * `check_sink` blocks if a registered value reaches a sink that forbids one
+     * of its labels (e.g. ExternalNetwork content flowing into ShellExec).
+     * (No default: `#[uniffi::export]` callback-interface methods can't be
+     * defaulted — every host impl must provide it. Mobile delegates to its
+     * `TaintTracker::register`; a host with no taint engine implements it as a
+     * no-op.)
+     */
+    func registerTaint(key: String, value: String, labels: String, source: String) 
+    
     /**
      * Reset loop guard state (e.g. on new session).
      */
@@ -2537,6 +2606,36 @@ fileprivate struct UniffiCallbackInterfaceGovernanceProvider {
                 writeReturn: writeReturn
             )
         },
+        registerTaint: { (
+            uniffiHandle: UInt64,
+            key: RustBuffer,
+            value: RustBuffer,
+            labels: RustBuffer,
+            source: RustBuffer,
+            uniffiOutReturn: UnsafeMutableRawPointer,
+            uniffiCallStatus: UnsafeMutablePointer<RustCallStatus>
+        ) in
+            let makeCall = {
+                () throws -> () in
+                guard let uniffiObj = try? FfiConverterCallbackInterfaceGovernanceProvider.handleMap.get(handle: uniffiHandle) else {
+                    throw UniffiInternalError.unexpectedStaleHandle
+                }
+                return uniffiObj.registerTaint(
+                     key: try FfiConverterString.lift(key),
+                     value: try FfiConverterString.lift(value),
+                     labels: try FfiConverterString.lift(labels),
+                     source: try FfiConverterString.lift(source)
+                )
+            }
+
+            
+            let writeReturn = { () }
+            uniffiTraitInterfaceCall(
+                callStatus: uniffiCallStatus,
+                makeCall: makeCall,
+                writeReturn: writeReturn
+            )
+        },
         reset: { (
             uniffiHandle: UInt64,
             uniffiOutReturn: UnsafeMutableRawPointer,
@@ -3238,6 +3337,30 @@ fileprivate struct FfiConverterOptionInt64: FfiConverterRustBuffer {
     }
 }
 
+#if swift(>=5.8)
+@_documentation(visibility: private)
+#endif
+fileprivate struct FfiConverterOptionBool: FfiConverterRustBuffer {
+    typealias SwiftType = Bool?
+
+    public static func write(_ value: SwiftType, into buf: inout [UInt8]) {
+        guard let value = value else {
+            writeInt(&buf, Int8(0))
+            return
+        }
+        writeInt(&buf, Int8(1))
+        FfiConverterBool.write(value, into: &buf)
+    }
+
+    public static func read(from buf: inout (data: Data, offset: Data.Index)) throws -> SwiftType {
+        switch try readInt(&buf) as Int8 {
+        case 0: return nil
+        case 1: return try FfiConverterBool.read(from: &buf)
+        default: throw UniffiInternalError.unexpectedOptionalTag
+        }
+    }
+}
+
 #if swift(>=5.8)
 @_documentation(visibility: private)
 #endif
@@ -3411,7 +3534,7 @@ private let initializationResult: InitializationResult = {
     if (uniffi_native_agent_ffi_checksum_method_nativeagenthandle_reset_tool_permissions() != 15060) {
         return InitializationResult.apiChecksumMismatch
     }
-    if (uniffi_native_agent_ffi_checksum_method_nativeagenthandle_respond_to_approval() != 3194) {
+    if (uniffi_native_agent_ffi_checksum_method_nativeagenthandle_respond_to_approval() != 56876) {
         return InitializationResult.apiChecksumMismatch
     }
     if (uniffi_native_agent_ffi_checksum_method_nativeagenthandle_respond_to_cron_approval() != 851) {
@@ -3438,7 +3561,7 @@ private let initializationResult: InitializationResult = {
     if (uniffi_native_agent_ffi_checksum_method_nativeagenthandle_serialize_agent_event_json() != 40873) {
         return InitializationResult.apiChecksumMismatch
     }
-    if (uniffi_native_agent_ffi_checksum_method_nativeagenthandle_set_auth_key() != 1639) {
+    if (uniffi_native_agent_ffi_checksum_method_nativeagenthandle_set_auth_key() != 12658) {
         return InitializationResult.apiChecksumMismatch
     }
     if (uniffi_native_agent_ffi_checksum_method_nativeagenthandle_set_event_callback() != 56165) {
@@ -3450,6 +3573,9 @@ private let initializationResult: InitializationResult = {
     if (uniffi_native_agent_ffi_checksum_method_nativeagenthandle_set_heartbeat_config() != 33968) {
         return InitializationResult.apiChecksumMismatch
     }
+    if (uniffi_native_agent_ffi_checksum_method_nativeagenthandle_set_mcp_tools() != 15664) {
+        return InitializationResult.apiChecksumMismatch
+    }
     if (uniffi_native_agent_ffi_checksum_method_nativeagenthandle_set_memory_provider() != 23171) {
         return InitializationResult.apiChecksumMismatch
     }
@@ -3492,10 +3618,13 @@ private let initializationResult: InitializationResult = {
     if (uniffi_native_agent_ffi_checksum_method_governanceprovider_check_sink() != 37338) {
         return InitializationResult.apiChecksumMismatch
     }
-    if (uniffi_native_agent_ffi_checksum_method_governanceprovider_reset() != 57214) {
+    if (uniffi_native_agent_ffi_checksum_method_governanceprovider_register_taint() != 17176) {
+        return InitializationResult.apiChecksumMismatch
+    }
+    if (uniffi_native_agent_ffi_checksum_method_governanceprovider_reset() != 47675) {
         return InitializationResult.apiChecksumMismatch
     }
-    if (uniffi_native_agent_ffi_checksum_method_governanceprovider_record_usage() != 907) {
+    if (uniffi_native_agent_ffi_checksum_method_governanceprovider_record_usage() != 32049) {
         return InitializationResult.apiChecksumMismatch
     }
     if (uniffi_native_agent_ffi_checksum_method_memoryprovider_store() != 49136) {

package/ios/Frameworks/NativeAgentFFI.xcframework/ios-arm64-simulator/Headers/native_agent_ffi/native_agent_ffiFFI.h

@@ -273,14 +273,21 @@ typedef void (*UniffiCallbackInterfaceGovernanceProviderMethod3)(uint64_t, RustB
 #endif
 #ifndef UNIFFI_FFIDEF_CALLBACK_INTERFACE_GOVERNANCE_PROVIDER_METHOD4
 #define UNIFFI_FFIDEF_CALLBACK_INTERFACE_GOVERNANCE_PROVIDER_METHOD4
-typedef void (*UniffiCallbackInterfaceGovernanceProviderMethod4)(uint64_t, void* _Nonnull, 
+typedef void (*UniffiCallbackInterfaceGovernanceProviderMethod4)(uint64_t, RustBuffer, RustBuffer, RustBuffer, RustBuffer, void* _Nonnull, 
         RustCallStatus *_Nonnull uniffiCallStatus
     );
 
 #endif
 #ifndef UNIFFI_FFIDEF_CALLBACK_INTERFACE_GOVERNANCE_PROVIDER_METHOD5
 #define UNIFFI_FFIDEF_CALLBACK_INTERFACE_GOVERNANCE_PROVIDER_METHOD5
-typedef void (*UniffiCallbackInterfaceGovernanceProviderMethod5)(uint64_t, RustBuffer, uint32_t, uint32_t, void* _Nonnull, 
+typedef void (*UniffiCallbackInterfaceGovernanceProviderMethod5)(uint64_t, void* _Nonnull, 
+        RustCallStatus *_Nonnull uniffiCallStatus
+    );
+
+#endif
+#ifndef UNIFFI_FFIDEF_CALLBACK_INTERFACE_GOVERNANCE_PROVIDER_METHOD6
+#define UNIFFI_FFIDEF_CALLBACK_INTERFACE_GOVERNANCE_PROVIDER_METHOD6
+typedef void (*UniffiCallbackInterfaceGovernanceProviderMethod6)(uint64_t, RustBuffer, uint32_t, uint32_t, void* _Nonnull, 
         RustCallStatus *_Nonnull uniffiCallStatus
     );
 
@@ -357,8 +364,9 @@ typedef struct UniffiVTableCallbackInterfaceGovernanceProvider {
     UniffiCallbackInterfaceGovernanceProviderMethod1 _Nonnull recordOutcome;
     UniffiCallbackInterfaceGovernanceProviderMethod2 _Nonnull recordAudit;
     UniffiCallbackInterfaceGovernanceProviderMethod3 _Nonnull checkSink;
-    UniffiCallbackInterfaceGovernanceProviderMethod4 _Nonnull reset;
-    UniffiCallbackInterfaceGovernanceProviderMethod5 _Nonnull recordUsage;
+    UniffiCallbackInterfaceGovernanceProviderMethod4 _Nonnull registerTaint;
+    UniffiCallbackInterfaceGovernanceProviderMethod5 _Nonnull reset;
+    UniffiCallbackInterfaceGovernanceProviderMethod6 _Nonnull recordUsage;
 } UniffiVTableCallbackInterfaceGovernanceProvider;
 
 #endif
@@ -610,7 +618,7 @@ RustBuffer uniffi_native_agent_ffi_fn_method_nativeagenthandle_serialize_agent_e
 #endif
 #ifndef UNIFFI_FFIDEF_UNIFFI_NATIVE_AGENT_FFI_FN_METHOD_NATIVEAGENTHANDLE_SET_AUTH_KEY
 #define UNIFFI_FFIDEF_UNIFFI_NATIVE_AGENT_FFI_FN_METHOD_NATIVEAGENTHANDLE_SET_AUTH_KEY
-void uniffi_native_agent_ffi_fn_method_nativeagenthandle_set_auth_key(uint64_t ptr, RustBuffer key, RustBuffer provider, RustBuffer auth_type, RustBuffer refresh, RustBuffer expires_at, RustCallStatus *_Nonnull out_status
+void uniffi_native_agent_ffi_fn_method_nativeagenthandle_set_auth_key(uint64_t ptr, RustBuffer key, RustBuffer provider, RustBuffer auth_type, RustBuffer refresh, RustBuffer expires_at, RustBuffer base_url, RustCallStatus *_Nonnull out_status
 );
 #endif
 #ifndef UNIFFI_FFIDEF_UNIFFI_NATIVE_AGENT_FFI_FN_METHOD_NATIVEAGENTHANDLE_SET_EVENT_CALLBACK
@@ -628,6 +636,11 @@ void uniffi_native_agent_ffi_fn_method_nativeagenthandle_set_governance_provider
 void uniffi_native_agent_ffi_fn_method_nativeagenthandle_set_heartbeat_config(uint64_t ptr, RustBuffer config_json, RustCallStatus *_Nonnull out_status
 );
 #endif
+#ifndef UNIFFI_FFIDEF_UNIFFI_NATIVE_AGENT_FFI_FN_METHOD_NATIVEAGENTHANDLE_SET_MCP_TOOLS
+#define UNIFFI_FFIDEF_UNIFFI_NATIVE_AGENT_FFI_FN_METHOD_NATIVEAGENTHANDLE_SET_MCP_TOOLS
+uint32_t uniffi_native_agent_ffi_fn_method_nativeagenthandle_set_mcp_tools(uint64_t ptr, RustBuffer tools_json, RustCallStatus *_Nonnull out_status
+);
+#endif
 #ifndef UNIFFI_FFIDEF_UNIFFI_NATIVE_AGENT_FFI_FN_METHOD_NATIVEAGENTHANDLE_SET_MEMORY_PROVIDER
 #define UNIFFI_FFIDEF_UNIFFI_NATIVE_AGENT_FFI_FN_METHOD_NATIVEAGENTHANDLE_SET_MEMORY_PROVIDER
 void uniffi_native_agent_ffi_fn_method_nativeagenthandle_set_memory_provider(uint64_t ptr, uint64_t provider, RustCallStatus *_Nonnull out_status
@@ -1230,6 +1243,12 @@ uint16_t uniffi_native_agent_ffi_checksum_method_nativeagenthandle_set_governanc
 #define UNIFFI_FFIDEF_UNIFFI_NATIVE_AGENT_FFI_CHECKSUM_METHOD_NATIVEAGENTHANDLE_SET_HEARTBEAT_CONFIG
 uint16_t uniffi_native_agent_ffi_checksum_method_nativeagenthandle_set_heartbeat_config(void
     
+);
+#endif
+#ifndef UNIFFI_FFIDEF_UNIFFI_NATIVE_AGENT_FFI_CHECKSUM_METHOD_NATIVEAGENTHANDLE_SET_MCP_TOOLS
+#define UNIFFI_FFIDEF_UNIFFI_NATIVE_AGENT_FFI_CHECKSUM_METHOD_NATIVEAGENTHANDLE_SET_MCP_TOOLS
+uint16_t uniffi_native_agent_ffi_checksum_method_nativeagenthandle_set_mcp_tools(void
+    
 );
 #endif
 #ifndef UNIFFI_FFIDEF_UNIFFI_NATIVE_AGENT_FFI_CHECKSUM_METHOD_NATIVEAGENTHANDLE_SET_MEMORY_PROVIDER
@@ -1314,6 +1333,12 @@ uint16_t uniffi_native_agent_ffi_checksum_method_governanceprovider_record_audit
 #define UNIFFI_FFIDEF_UNIFFI_NATIVE_AGENT_FFI_CHECKSUM_METHOD_GOVERNANCEPROVIDER_CHECK_SINK
 uint16_t uniffi_native_agent_ffi_checksum_method_governanceprovider_check_sink(void
     
+);
+#endif
+#ifndef UNIFFI_FFIDEF_UNIFFI_NATIVE_AGENT_FFI_CHECKSUM_METHOD_GOVERNANCEPROVIDER_REGISTER_TAINT
+#define UNIFFI_FFIDEF_UNIFFI_NATIVE_AGENT_FFI_CHECKSUM_METHOD_GOVERNANCEPROVIDER_REGISTER_TAINT
+uint16_t uniffi_native_agent_ffi_checksum_method_governanceprovider_register_taint(void
+    
 );
 #endif
 #ifndef UNIFFI_FFIDEF_UNIFFI_NATIVE_AGENT_FFI_CHECKSUM_METHOD_GOVERNANCEPROVIDER_RESET

package/ios/Sources/NativeAgentPlugin/Generated/native_agent_ffi.swift

@@ -682,7 +682,12 @@ public protocol NativeAgentHandleProtocol: AnyObject, Sendable {
     func resetToolPermissions() throws 
     
     /**
-     * Respond to a tool approval request.
+     * Respond to a tool approval request (legacy boolean entry point).
+     *
+     * Retained as the UniFFI-facing API for mobile callers that pass a plain
+     * boolean. Internally delegates to `respond_to_approval_decision` (a
+     * Rust-only helper, not UniFFI-exported) with no `decision`/`answers`,
+     * preserving today's behavior.
      */
     func respondToApproval(toolCallId: String, approved: Bool, reason: String?) throws 
     
@@ -732,8 +737,13 @@ public protocol NativeAgentHandleProtocol: AnyObject, Sendable {
     
     /**
      * Set an auth key for a provider.
+     *
+     * `base_url`, when set, overrides the provider's hardcoded endpoint — used
+     * to point the driver at a backend proxy that injects the real API key
+     * server-side, so the device never holds the provider secret. `None` ⇒
+     * the provider's default endpoint (unchanged behavior).
      */
-    func setAuthKey(key: String, provider: String, authType: String, refresh: String?, expiresAt: Int64?) throws 
+    func setAuthKey(key: String, provider: String, authType: String, refresh: String?, expiresAt: Int64?, baseUrl: String?) throws 
     
     /**
      * Set the event callback for receiving agent events.
@@ -751,6 +761,14 @@ public protocol NativeAgentHandleProtocol: AnyObject, Sendable {
      */
     func setHeartbeatConfig(configJson: String) throws 
     
+    /**
+     * Replace the FFI's MCP tool manifest. Tools registered here become
+     * visible to the LLM and, when called, surface as `mcp_tool_call`
+     * events that the host must answer with `respond_to_mcp_tool`.
+     * Idempotent — every call replaces the prior manifest.
+     */
+    func setMcpTools(toolsJson: String) throws  -> UInt32
+    
     func setMemoryProvider(provider: MemoryProvider) throws 
     
     func setNotifier(notifier: NativeNotifier) throws 
@@ -1200,7 +1218,12 @@ open func resetToolPermissions()throws   {try rustCallWithError(FfiConverterType
 }
     
     /**
-     * Respond to a tool approval request.
+     * Respond to a tool approval request (legacy boolean entry point).
+     *
+     * Retained as the UniFFI-facing API for mobile callers that pass a plain
+     * boolean. Internally delegates to `respond_to_approval_decision` (a
+     * Rust-only helper, not UniFFI-exported) with no `decision`/`answers`,
+     * preserving today's behavior.
      */
 open func respondToApproval(toolCallId: String, approved: Bool, reason: String?)throws   {try rustCallWithError(FfiConverterTypeNativeAgentError_lift) {
     uniffi_native_agent_ffi_fn_method_nativeagenthandle_respond_to_approval(
@@ -1320,15 +1343,21 @@ open func serializeAgentEventJson(eventType: String, payloadJson: String, sessio
     
     /**
      * Set an auth key for a provider.
+     *
+     * `base_url`, when set, overrides the provider's hardcoded endpoint — used
+     * to point the driver at a backend proxy that injects the real API key
+     * server-side, so the device never holds the provider secret. `None` ⇒
+     * the provider's default endpoint (unchanged behavior).
      */
-open func setAuthKey(key: String, provider: String, authType: String, refresh: String?, expiresAt: Int64?)throws   {try rustCallWithError(FfiConverterTypeNativeAgentError_lift) {
+open func setAuthKey(key: String, provider: String, authType: String, refresh: String?, expiresAt: Int64?, baseUrl: String?)throws   {try rustCallWithError(FfiConverterTypeNativeAgentError_lift) {
     uniffi_native_agent_ffi_fn_method_nativeagenthandle_set_auth_key(
             self.uniffiCloneHandle(),
         FfiConverterString.lower(key),
         FfiConverterString.lower(provider),
         FfiConverterString.lower(authType),
         FfiConverterOptionString.lower(refresh),
-        FfiConverterOptionInt64.lower(expiresAt),$0
+        FfiConverterOptionInt64.lower(expiresAt),
+        FfiConverterOptionString.lower(baseUrl),$0
     )
 }
 }
@@ -1365,6 +1394,21 @@ open func setHeartbeatConfig(configJson: String)throws   {try rustCallWithError(
         FfiConverterString.lower(configJson),$0
     )
 }
+}
+    
+    /**
+     * Replace the FFI's MCP tool manifest. Tools registered here become
+     * visible to the LLM and, when called, surface as `mcp_tool_call`
+     * events that the host must answer with `respond_to_mcp_tool`.
+     * Idempotent — every call replaces the prior manifest.
+     */
+open func setMcpTools(toolsJson: String)throws  -> UInt32  {
+    return try  FfiConverterUInt32.lift(try rustCallWithError(FfiConverterTypeNativeAgentError_lift) {
+    uniffi_native_agent_ffi_fn_method_nativeagenthandle_set_mcp_tools(
+            self.uniffiCloneHandle(),
+        FfiConverterString.lower(toolsJson),$0
+    )
+})
 }
     
 open func setMemoryProvider(provider: MemoryProvider)throws   {try rustCallWithError(FfiConverterTypeNativeAgentError_lift) {
@@ -1913,6 +1957,11 @@ public struct SendMessageParams: Equatable, Hashable {
      * JSON-encoded prior conversation messages for multi-turn sessions.
      */
     public var priorMessagesJson: String?
+    /**
+     * Create-only plan-mode seed (Stage 4b). Honored when starting a NEW
+     * session; the persisted store value is authoritative on resume.
+     */
+    public var planModeInit: Bool?
 
     // Default memberwise initializers are never public by default, so we
     // declare one manually.
@@ -1924,7 +1973,11 @@ public struct SendMessageParams: Equatable, Hashable {
          */skillAllowedToolsJson: String?, 
         /**
          * JSON-encoded prior conversation messages for multi-turn sessions.
-         */priorMessagesJson: String?) {
+         */priorMessagesJson: String?, 
+        /**
+         * Create-only plan-mode seed (Stage 4b). Honored when starting a NEW
+         * session; the persisted store value is authoritative on resume.
+         */planModeInit: Bool?) {
         self.prompt = prompt
         self.sessionKey = sessionKey
         self.model = model
@@ -1933,6 +1986,7 @@ public struct SendMessageParams: Equatable, Hashable {
         self.maxTurns = maxTurns
         self.skillAllowedToolsJson = skillAllowedToolsJson
         self.priorMessagesJson = priorMessagesJson
+        self.planModeInit = planModeInit
     }
 
     
@@ -1958,7 +2012,8 @@ public struct FfiConverterTypeSendMessageParams: FfiConverterRustBuffer {
                 systemPrompt: FfiConverterString.read(from: &buf), 
                 maxTurns: FfiConverterOptionUInt32.read(from: &buf), 
                 skillAllowedToolsJson: FfiConverterOptionString.read(from: &buf), 
-                priorMessagesJson: FfiConverterOptionString.read(from: &buf)
+                priorMessagesJson: FfiConverterOptionString.read(from: &buf), 
+                planModeInit: FfiConverterOptionBool.read(from: &buf)
         )
     }
 
@@ -1971,6 +2026,7 @@ public struct FfiConverterTypeSendMessageParams: FfiConverterRustBuffer {
         FfiConverterOptionUInt32.write(value.maxTurns, into: &buf)
         FfiConverterOptionString.write(value.skillAllowedToolsJson, into: &buf)
         FfiConverterOptionString.write(value.priorMessagesJson, into: &buf)
+        FfiConverterOptionBool.write(value.planModeInit, into: &buf)
     }
 }
 
@@ -2392,6 +2448,19 @@ public protocol GovernanceProvider: AnyObject, Sendable {
      */
     func checkSink(sinkType: String, content: String)  -> String
     
+    /**
+     * Register a tainted value for data-flow tracking (agent-os taint uptake).
+     * `labels` is a comma-separated set drawn from
+     * `Pii|Secret|ExternalNetwork|UserInput|UntrustedAgent`; a later
+     * `check_sink` blocks if a registered value reaches a sink that forbids one
+     * of its labels (e.g. ExternalNetwork content flowing into ShellExec).
+     * (No default: `#[uniffi::export]` callback-interface methods can't be
+     * defaulted — every host impl must provide it. Mobile delegates to its
+     * `TaintTracker::register`; a host with no taint engine implements it as a
+     * no-op.)
+     */
+    func registerTaint(key: String, value: String, labels: String, source: String) 
+    
     /**
      * Reset loop guard state (e.g. on new session).
      */
@@ -2537,6 +2606,36 @@ fileprivate struct UniffiCallbackInterfaceGovernanceProvider {
                 writeReturn: writeReturn
             )
         },
+        registerTaint: { (
+            uniffiHandle: UInt64,
+            key: RustBuffer,
+            value: RustBuffer,
+            labels: RustBuffer,
+            source: RustBuffer,
+            uniffiOutReturn: UnsafeMutableRawPointer,
+            uniffiCallStatus: UnsafeMutablePointer<RustCallStatus>
+        ) in
+            let makeCall = {
+                () throws -> () in
+                guard let uniffiObj = try? FfiConverterCallbackInterfaceGovernanceProvider.handleMap.get(handle: uniffiHandle) else {
+                    throw UniffiInternalError.unexpectedStaleHandle
+                }
+                return uniffiObj.registerTaint(
+                     key: try FfiConverterString.lift(key),
+                     value: try FfiConverterString.lift(value),
+                     labels: try FfiConverterString.lift(labels),
+                     source: try FfiConverterString.lift(source)
+                )
+            }
+
+            
+            let writeReturn = { () }
+            uniffiTraitInterfaceCall(
+                callStatus: uniffiCallStatus,
+                makeCall: makeCall,
+                writeReturn: writeReturn
+            )
+        },
         reset: { (
             uniffiHandle: UInt64,
             uniffiOutReturn: UnsafeMutableRawPointer,
@@ -3238,6 +3337,30 @@ fileprivate struct FfiConverterOptionInt64: FfiConverterRustBuffer {
     }
 }
 
+#if swift(>=5.8)
+@_documentation(visibility: private)
+#endif
+fileprivate struct FfiConverterOptionBool: FfiConverterRustBuffer {
+    typealias SwiftType = Bool?
+
+    public static func write(_ value: SwiftType, into buf: inout [UInt8]) {
+        guard let value = value else {
+            writeInt(&buf, Int8(0))
+            return
+        }
+        writeInt(&buf, Int8(1))
+        FfiConverterBool.write(value, into: &buf)
+    }
+
+    public static func read(from buf: inout (data: Data, offset: Data.Index)) throws -> SwiftType {
+        switch try readInt(&buf) as Int8 {
+        case 0: return nil
+        case 1: return try FfiConverterBool.read(from: &buf)
+        default: throw UniffiInternalError.unexpectedOptionalTag
+        }
+    }
+}
+
 #if swift(>=5.8)
 @_documentation(visibility: private)
 #endif
@@ -3411,7 +3534,7 @@ private let initializationResult: InitializationResult = {
     if (uniffi_native_agent_ffi_checksum_method_nativeagenthandle_reset_tool_permissions() != 15060) {
         return InitializationResult.apiChecksumMismatch
     }
-    if (uniffi_native_agent_ffi_checksum_method_nativeagenthandle_respond_to_approval() != 3194) {
+    if (uniffi_native_agent_ffi_checksum_method_nativeagenthandle_respond_to_approval() != 56876) {
         return InitializationResult.apiChecksumMismatch
     }
     if (uniffi_native_agent_ffi_checksum_method_nativeagenthandle_respond_to_cron_approval() != 851) {
@@ -3438,7 +3561,7 @@ private let initializationResult: InitializationResult = {
     if (uniffi_native_agent_ffi_checksum_method_nativeagenthandle_serialize_agent_event_json() != 40873) {
         return InitializationResult.apiChecksumMismatch
     }
-    if (uniffi_native_agent_ffi_checksum_method_nativeagenthandle_set_auth_key() != 1639) {
+    if (uniffi_native_agent_ffi_checksum_method_nativeagenthandle_set_auth_key() != 12658) {
         return InitializationResult.apiChecksumMismatch
     }
     if (uniffi_native_agent_ffi_checksum_method_nativeagenthandle_set_event_callback() != 56165) {
@@ -3450,6 +3573,9 @@ private let initializationResult: InitializationResult = {
     if (uniffi_native_agent_ffi_checksum_method_nativeagenthandle_set_heartbeat_config() != 33968) {
         return InitializationResult.apiChecksumMismatch
     }
+    if (uniffi_native_agent_ffi_checksum_method_nativeagenthandle_set_mcp_tools() != 15664) {
+        return InitializationResult.apiChecksumMismatch
+    }
     if (uniffi_native_agent_ffi_checksum_method_nativeagenthandle_set_memory_provider() != 23171) {
         return InitializationResult.apiChecksumMismatch
     }
@@ -3492,10 +3618,13 @@ private let initializationResult: InitializationResult = {
     if (uniffi_native_agent_ffi_checksum_method_governanceprovider_check_sink() != 37338) {
         return InitializationResult.apiChecksumMismatch
     }
-    if (uniffi_native_agent_ffi_checksum_method_governanceprovider_reset() != 57214) {
+    if (uniffi_native_agent_ffi_checksum_method_governanceprovider_register_taint() != 17176) {
+        return InitializationResult.apiChecksumMismatch
+    }
+    if (uniffi_native_agent_ffi_checksum_method_governanceprovider_reset() != 47675) {
         return InitializationResult.apiChecksumMismatch
     }
-    if (uniffi_native_agent_ffi_checksum_method_governanceprovider_record_usage() != 907) {
+    if (uniffi_native_agent_ffi_checksum_method_governanceprovider_record_usage() != 32049) {
         return InitializationResult.apiChecksumMismatch
     }
     if (uniffi_native_agent_ffi_checksum_method_memoryprovider_store() != 49136) {

package/ios/Sources/NativeAgentPlugin/Generated/native_agent_ffiFFI.h

@@ -273,14 +273,21 @@ typedef void (*UniffiCallbackInterfaceGovernanceProviderMethod3)(uint64_t, RustB
 #endif
 #ifndef UNIFFI_FFIDEF_CALLBACK_INTERFACE_GOVERNANCE_PROVIDER_METHOD4
 #define UNIFFI_FFIDEF_CALLBACK_INTERFACE_GOVERNANCE_PROVIDER_METHOD4
-typedef void (*UniffiCallbackInterfaceGovernanceProviderMethod4)(uint64_t, void* _Nonnull, 
+typedef void (*UniffiCallbackInterfaceGovernanceProviderMethod4)(uint64_t, RustBuffer, RustBuffer, RustBuffer, RustBuffer, void* _Nonnull, 
         RustCallStatus *_Nonnull uniffiCallStatus
     );
 
 #endif
 #ifndef UNIFFI_FFIDEF_CALLBACK_INTERFACE_GOVERNANCE_PROVIDER_METHOD5
 #define UNIFFI_FFIDEF_CALLBACK_INTERFACE_GOVERNANCE_PROVIDER_METHOD5
-typedef void (*UniffiCallbackInterfaceGovernanceProviderMethod5)(uint64_t, RustBuffer, uint32_t, uint32_t, void* _Nonnull, 
+typedef void (*UniffiCallbackInterfaceGovernanceProviderMethod5)(uint64_t, void* _Nonnull, 
+        RustCallStatus *_Nonnull uniffiCallStatus
+    );
+
+#endif
+#ifndef UNIFFI_FFIDEF_CALLBACK_INTERFACE_GOVERNANCE_PROVIDER_METHOD6
+#define UNIFFI_FFIDEF_CALLBACK_INTERFACE_GOVERNANCE_PROVIDER_METHOD6
+typedef void (*UniffiCallbackInterfaceGovernanceProviderMethod6)(uint64_t, RustBuffer, uint32_t, uint32_t, void* _Nonnull, 
         RustCallStatus *_Nonnull uniffiCallStatus
     );
 
@@ -357,8 +364,9 @@ typedef struct UniffiVTableCallbackInterfaceGovernanceProvider {
     UniffiCallbackInterfaceGovernanceProviderMethod1 _Nonnull recordOutcome;
     UniffiCallbackInterfaceGovernanceProviderMethod2 _Nonnull recordAudit;
     UniffiCallbackInterfaceGovernanceProviderMethod3 _Nonnull checkSink;
-    UniffiCallbackInterfaceGovernanceProviderMethod4 _Nonnull reset;
-    UniffiCallbackInterfaceGovernanceProviderMethod5 _Nonnull recordUsage;
+    UniffiCallbackInterfaceGovernanceProviderMethod4 _Nonnull registerTaint;
+    UniffiCallbackInterfaceGovernanceProviderMethod5 _Nonnull reset;
+    UniffiCallbackInterfaceGovernanceProviderMethod6 _Nonnull recordUsage;
 } UniffiVTableCallbackInterfaceGovernanceProvider;
 
 #endif
@@ -610,7 +618,7 @@ RustBuffer uniffi_native_agent_ffi_fn_method_nativeagenthandle_serialize_agent_e
 #endif
 #ifndef UNIFFI_FFIDEF_UNIFFI_NATIVE_AGENT_FFI_FN_METHOD_NATIVEAGENTHANDLE_SET_AUTH_KEY
 #define UNIFFI_FFIDEF_UNIFFI_NATIVE_AGENT_FFI_FN_METHOD_NATIVEAGENTHANDLE_SET_AUTH_KEY
-void uniffi_native_agent_ffi_fn_method_nativeagenthandle_set_auth_key(uint64_t ptr, RustBuffer key, RustBuffer provider, RustBuffer auth_type, RustBuffer refresh, RustBuffer expires_at, RustCallStatus *_Nonnull out_status
+void uniffi_native_agent_ffi_fn_method_nativeagenthandle_set_auth_key(uint64_t ptr, RustBuffer key, RustBuffer provider, RustBuffer auth_type, RustBuffer refresh, RustBuffer expires_at, RustBuffer base_url, RustCallStatus *_Nonnull out_status
 );
 #endif
 #ifndef UNIFFI_FFIDEF_UNIFFI_NATIVE_AGENT_FFI_FN_METHOD_NATIVEAGENTHANDLE_SET_EVENT_CALLBACK
@@ -628,6 +636,11 @@ void uniffi_native_agent_ffi_fn_method_nativeagenthandle_set_governance_provider
 void uniffi_native_agent_ffi_fn_method_nativeagenthandle_set_heartbeat_config(uint64_t ptr, RustBuffer config_json, RustCallStatus *_Nonnull out_status
 );
 #endif
+#ifndef UNIFFI_FFIDEF_UNIFFI_NATIVE_AGENT_FFI_FN_METHOD_NATIVEAGENTHANDLE_SET_MCP_TOOLS
+#define UNIFFI_FFIDEF_UNIFFI_NATIVE_AGENT_FFI_FN_METHOD_NATIVEAGENTHANDLE_SET_MCP_TOOLS
+uint32_t uniffi_native_agent_ffi_fn_method_nativeagenthandle_set_mcp_tools(uint64_t ptr, RustBuffer tools_json, RustCallStatus *_Nonnull out_status
+);
+#endif
 #ifndef UNIFFI_FFIDEF_UNIFFI_NATIVE_AGENT_FFI_FN_METHOD_NATIVEAGENTHANDLE_SET_MEMORY_PROVIDER
 #define UNIFFI_FFIDEF_UNIFFI_NATIVE_AGENT_FFI_FN_METHOD_NATIVEAGENTHANDLE_SET_MEMORY_PROVIDER
 void uniffi_native_agent_ffi_fn_method_nativeagenthandle_set_memory_provider(uint64_t ptr, uint64_t provider, RustCallStatus *_Nonnull out_status
@@ -1230,6 +1243,12 @@ uint16_t uniffi_native_agent_ffi_checksum_method_nativeagenthandle_set_governanc
 #define UNIFFI_FFIDEF_UNIFFI_NATIVE_AGENT_FFI_CHECKSUM_METHOD_NATIVEAGENTHANDLE_SET_HEARTBEAT_CONFIG
 uint16_t uniffi_native_agent_ffi_checksum_method_nativeagenthandle_set_heartbeat_config(void
     
+);
+#endif
+#ifndef UNIFFI_FFIDEF_UNIFFI_NATIVE_AGENT_FFI_CHECKSUM_METHOD_NATIVEAGENTHANDLE_SET_MCP_TOOLS
+#define UNIFFI_FFIDEF_UNIFFI_NATIVE_AGENT_FFI_CHECKSUM_METHOD_NATIVEAGENTHANDLE_SET_MCP_TOOLS
+uint16_t uniffi_native_agent_ffi_checksum_method_nativeagenthandle_set_mcp_tools(void
+    
 );
 #endif
 #ifndef UNIFFI_FFIDEF_UNIFFI_NATIVE_AGENT_FFI_CHECKSUM_METHOD_NATIVEAGENTHANDLE_SET_MEMORY_PROVIDER
@@ -1314,6 +1333,12 @@ uint16_t uniffi_native_agent_ffi_checksum_method_governanceprovider_record_audit
 #define UNIFFI_FFIDEF_UNIFFI_NATIVE_AGENT_FFI_CHECKSUM_METHOD_GOVERNANCEPROVIDER_CHECK_SINK
 uint16_t uniffi_native_agent_ffi_checksum_method_governanceprovider_check_sink(void
     
+);
+#endif
+#ifndef UNIFFI_FFIDEF_UNIFFI_NATIVE_AGENT_FFI_CHECKSUM_METHOD_GOVERNANCEPROVIDER_REGISTER_TAINT
+#define UNIFFI_FFIDEF_UNIFFI_NATIVE_AGENT_FFI_CHECKSUM_METHOD_GOVERNANCEPROVIDER_REGISTER_TAINT
+uint16_t uniffi_native_agent_ffi_checksum_method_governanceprovider_register_taint(void
+    
 );
 #endif
 #ifndef UNIFFI_FFIDEF_UNIFFI_NATIVE_AGENT_FFI_CHECKSUM_METHOD_GOVERNANCEPROVIDER_RESET

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "capacitor-native-agent",
-  "version": "0.9.14",
+  "version": "0.9.15",
   "description": "Native AI agent loop for Capacitor — runs LLM completions, tool execution, and cron jobs in native Rust, enabling background execution.",
   "main": "dist/esm/index.js",
   "types": "dist/esm/index.d.ts",