npm - madarx - Versions diffs - 2.19.0 → 2.21.0 - Mend

madarx 2.19.0 → 2.21.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (1194) hide show

package/lib/higgsfield-media-card.js ADDED Viewed

@@ -0,0 +1,221 @@
+/**
+ * Deterministic, madarX-branded card for Higgsfield generation results.
+ * Rendered into the canvas when higgsfield_generate_image / _video succeeds, so
+ * the user sees the generated media in the space instead of a raw tool JSON blob.
+ *
+ * Brand: Onyx / Bone / Graphite with a single Mars-red accent. No emojis; the
+ * media itself is the focal element.
+ */
+function esc(value) {
+  return String(value ?? '')
+    .replace(/&/g, '&amp;')
+    .replace(/</g, '&lt;')
+    .replace(/>/g, '&gt;')
+    .replace(/"/g, '&quot;');
+}
+/**
+ * Gallery variant: embed one or more generated media items directly, with an
+ * optional caption and a collapsible spec/report block below. Used by the
+ * sub-agent path so a delegated generation shows the actual image on the canvas
+ * instead of a markdown document that merely links to it.
+ *
+ * @param {Array<{url:string, kind?:'image'|'video', thumbnail?:string}>} media
+ * @param {object} opts { title?, caption?, reportHtml? }
+ * @returns {string} full HTML document
+ */
+export function buildHiggsfieldGalleryHtml(media = [], opts = {}) {
+  const items = (Array.isArray(media) ? media : []).filter((m) => m && m.url);
+  const title = esc(opts.title || 'Higgsfield');
+  const caption = esc(opts.caption || '');
+  const tiles = items.map((m) => {
+    const url = esc(m.url);
+    return (m.kind === 'video')
+      ? `<video class="media" src="${url}" controls loop muted playsinline poster="${esc(m.thumbnail || '')}"></video>`
+      : `<a class="frame" href="${url}" target="_blank" rel="noopener"><img class="media" src="${url}" alt="${caption || 'Generated media'}" loading="lazy" /></a>`;
+  }).join('\n');
+  return `<!DOCTYPE html>
+<html lang="en">
+<head>
+<meta charset="utf-8" />
+<meta name="viewport" content="width=device-width, initial-scale=1" />
+<title>${title}</title>
+<style>
+  :root { --onyx:#0f0f10; --graphite:#1b1b1e; --bone:#f4f1ea; --muted:#9a968d; --mars:#d4452f; --line:#2a2a2e; }
+  * { box-sizing:border-box; margin:0; padding:0; }
+  body { background:radial-gradient(120% 100% at 50% 0%, #161618 0%, var(--onyx) 60%); color:var(--bone);
+    font-family:ui-sans-serif,-apple-system,"SF Pro Text","Segoe UI",system-ui,sans-serif; min-height:100vh;
+    padding:clamp(20px,4vw,48px); display:flex; flex-direction:column; align-items:center; gap:18px; }
+  .head { width:min(960px,100%); display:flex; align-items:baseline; justify-content:space-between; gap:16px; }
+  .brand { font-size:12px; letter-spacing:.18em; text-transform:uppercase; color:var(--muted); }
+  .brand b { color:var(--bone); font-weight:600; }
+  .grid { width:min(960px,100%); display:grid; gap:14px;
+    grid-template-columns:repeat(auto-fit,minmax(280px,1fr)); }
+  .frame { display:block; border:1px solid var(--line); border-radius:16px; overflow:hidden; background:#0b0b0c;
+    box-shadow:0 30px 80px -45px rgba(0,0,0,.9); }
+  .media { display:block; width:100%; height:auto; max-height:78vh; object-fit:contain; background:#0b0b0c; }
+  .cap { width:min(960px,100%); font-size:14px; line-height:1.5; color:#d9d5cc; }
+  .report { width:min(960px,100%); border-top:1px solid var(--line); padding-top:16px; }
+  .report summary { cursor:pointer; color:var(--muted); font-size:12px; letter-spacing:.08em; text-transform:uppercase; }
+  .report-body { margin-top:12px; font-size:13.5px; line-height:1.55; color:#cfcabf; }
+  .report-body table { border-collapse:collapse; width:100%; margin:8px 0; }
+  .report-body td, .report-body th { border:1px solid var(--line); padding:6px 9px; text-align:left; }
+</style>
+</head>
+<body>
+  <header class="head"><span class="brand"><b>Higgsfield</b> &middot; ${title}</span></header>
+  <div class="grid">${tiles || '<p class="cap">No media returned.</p>'}</div>
+  ${caption ? `<p class="cap">${caption}</p>` : ''}
+  ${opts.reportHtml ? `<details class="report"><summary>Design spec &amp; notes</summary><div class="report-body">${opts.reportHtml}</div></details>` : ''}
+</body>
+</html>`;
+}
+/**
+ * @param {object} result   The adapter output: { ok, status, url, thumbnail, job_set_id }
+ * @param {object} meta      { kind: 'image'|'video', prompt?: string }
+ * @returns {string} full HTML document
+ */
+export function buildHiggsfieldMediaHtml(result = {}, meta = {}) {
+  const kind = meta.kind === 'video' ? 'video' : 'image';
+  const url = esc(result.url || '');
+  const prompt = esc(meta.prompt || '');
+  const status = esc(result.status || 'completed');
+  const label = kind === 'video' ? 'Video' : 'Image';
+  const media = kind === 'video'
+    ? `<video class="media" src="${url}" controls autoplay loop muted playsinline poster="${esc(result.thumbnail || '')}"></video>`
+    : `<img class="media" src="${url}" alt="${prompt || 'Generated image'}" />`;
+  const promptBlock = prompt
+    ? `<p class="prompt">${prompt}</p>`
+    : '';
+  return `<!DOCTYPE html>
+<html lang="en">
+<head>
+<meta charset="utf-8" />
+<meta name="viewport" content="width=device-width, initial-scale=1" />
+<title>Higgsfield ${label}</title>
+<style>
+  :root {
+    --onyx: #0f0f10;
+    --graphite: #1b1b1e;
+    --bone: #f4f1ea;
+    --muted: #9a968d;
+    --mars: #d4452f;
+    --line: #2a2a2e;
+  }
+  * { box-sizing: border-box; margin: 0; padding: 0; }
+  body {
+    background: radial-gradient(120% 100% at 50% 0%, #161618 0%, var(--onyx) 60%);
+    color: var(--bone);
+    font-family: ui-sans-serif, -apple-system, "SF Pro Text", "Segoe UI", system-ui, sans-serif;
+    min-height: 100vh;
+    display: flex;
+    align-items: center;
+    justify-content: center;
+    padding: clamp(20px, 5vw, 56px);
+  }
+  .card {
+    width: min(880px, 100%);
+    background: var(--graphite);
+    border: 1px solid var(--line);
+    border-radius: 18px;
+    overflow: hidden;
+    box-shadow: 0 30px 80px -40px rgba(0,0,0,0.9);
+  }
+  .head {
+    display: flex;
+    align-items: baseline;
+    justify-content: space-between;
+    gap: 16px;
+    padding: 18px 22px;
+    border-bottom: 1px solid var(--line);
+  }
+  .brand {
+    font-size: 12px;
+    letter-spacing: 0.18em;
+    text-transform: uppercase;
+    color: var(--muted);
+  }
+  .brand b { color: var(--bone); font-weight: 600; }
+  .status {
+    font-size: 11px;
+    letter-spacing: 0.12em;
+    text-transform: uppercase;
+    color: var(--mars);
+    display: inline-flex;
+    align-items: center;
+    gap: 7px;
+  }
+  .status::before {
+    content: "";
+    width: 7px; height: 7px; border-radius: 50%;
+    background: var(--mars);
+  }
+  .stage {
+    background: #0b0b0c;
+    display: flex;
+    align-items: center;
+    justify-content: center;
+    padding: 0;
+  }
+  .media {
+    display: block;
+    width: 100%;
+    max-height: 70vh;
+    object-fit: contain;
+    background: #0b0b0c;
+  }
+  .foot { padding: 18px 22px 22px; }
+  .prompt {
+    font-size: 15px;
+    line-height: 1.55;
+    color: #d9d5cc;
+  }
+  .meta {
+    margin-top: 14px;
+    display: flex;
+    flex-wrap: wrap;
+    gap: 10px;
+  }
+  .pill {
+    font-size: 12px;
+    color: var(--muted);
+    border: 1px solid var(--line);
+    border-radius: 999px;
+    padding: 5px 11px;
+  }
+  .open {
+    margin-top: 16px;
+    display: inline-block;
+    font-size: 13px;
+    color: var(--bone);
+    text-decoration: none;
+    border-bottom: 1px solid var(--mars);
+    padding-bottom: 2px;
+  }
+</style>
+</head>
+<body>
+  <main class="card">
+    <header class="head">
+      <span class="brand"><b>Higgsfield</b> &middot; ${label}</span>
+      <span class="status">${status}</span>
+    </header>
+    <div class="stage">${media}</div>
+    <div class="foot">
+      ${promptBlock}
+      <div class="meta">
+        <span class="pill">Source: Higgsfield AI</span>
+        <span class="pill">Type: ${label}</span>
+      </div>
+      ${url ? `<a class="open" href="${url}" target="_blank" rel="noopener">Open original</a>` : ''}
+    </div>
+  </main>
+</body>
+</html>`;
+}

package/lib/marketplace-seeds.js CHANGED Viewed

@@ -310,6 +310,87 @@ function buildBusinessSkillSeed(s) {
   };
 }
+// ── Higgsfield AI skills (github bundle) ─────────────────────────────────────
+// MIT-licensed image/video generation skill pack from higgsfield-ai/skills.
+// Each skill drives the Higgsfield AI generation API, so they are external-write
+// capable and require a Higgsfield API key — NOT default-on.
+const HIGGSFIELD_SKILLS = [
+  {
+    slug: 'higgsfield-generate', title: 'Higgsfield — Generate',
+    invocation: '/higgsfield:generate', upstream: 'higgsfield-generate',
+    description: 'Generate images and videos across 30+ models (Flux, Kling, Veo, etc.), with Marketing Studio for branded ads and a Virality Predictor for scoring.',
+    trigger_examples: ['generate an image', 'make a video with kling', 'predict virality'],
+    uses_tools: ['higgsfield_generate_image', 'higgsfield_generate_video'],
+  },
+  {
+    slug: 'higgsfield-soul-id', title: 'Higgsfield — Soul ID',
+    invocation: '/higgsfield:soul-id', upstream: 'higgsfield-soul-id',
+    description: 'Train reusable, face-faithful identity models and return reference IDs for use in later generation tasks.',
+    trigger_examples: ['train a soul id', 'create a face identity model', 'reusable avatar identity'],
+    uses_tools: ['higgsfield_generate_image'],
+  },
+  {
+    slug: 'higgsfield-product-photoshoot', title: 'Higgsfield — Product Photoshoot',
+    invocation: '/higgsfield:product-photoshoot', upstream: 'higgsfield-product-photoshoot',
+    description: 'Create brand-quality product imagery in 10 modes — studio, lifestyle, Pinterest, hero banner, ad packs, virtual try-on, and more.',
+    trigger_examples: ['product photoshoot', 'studio shots of this product', 'lifestyle product images'],
+    uses_tools: ['higgsfield_product_photoshoot', 'higgsfield_generate_image'],
+  },
+  {
+    slug: 'higgsfield-marketplace-cards', title: 'Higgsfield — Marketplace Cards',
+    invocation: '/higgsfield:marketplace-cards', upstream: 'higgsfield-marketplace-cards',
+    description: 'Generate marketplace product cards with compliant images and A+ style modules.',
+    trigger_examples: ['marketplace product card', 'a+ content module', 'listing card images'],
+    uses_tools: ['higgsfield_generate_image'],
+  },
+];
+function buildHiggsfieldSkillSeed(s) {
+  return {
+    slug: s.slug,
+    title: s.title,
+    description: s.description,
+    category: 'media',
+    author: 'higgsfield-ai',
+    source_kind: 'github',
+    source_url: `https://github.com/higgsfield-ai/skills/tree/main/${s.upstream}`,
+    version: null,
+    risk_summary: 'Calls the external Higgsfield AI generation API and requires a Higgsfield API key. Generation is an external write — keep approval-gated.',
+    tags: ['design', 'media', 'image-generation', 'video-generation', 'higgsfield', 'mit'],
+    manifest: {
+      invocation: s.invocation,
+      upstream_slug: s.upstream,
+      trigger_examples: s.trigger_examples,
+      uses_tools: s.uses_tools,
+      requires_connection: 'higgsfield',
+    },
+  };
+}
+const HIGGSFIELD_BUNDLE = {
+  slug: 'higgsfield',
+  title: 'Higgsfield AI Skills',
+  description:
+    'MIT-licensed image and video generation pack from higgsfield-ai/skills: generate across 30+ models, train Soul ID identities, run product photoshoots, and build marketplace cards.',
+  category: 'media',
+  author: 'higgsfield-ai',
+  source_kind: 'github',
+  source_url: 'https://github.com/higgsfield-ai/skills',
+  version: null,
+  risk_summary:
+    'External generation bundle — every skill calls the Higgsfield AI API and needs a Higgsfield API key. No code executes locally, but generation is an external write; keep approval-gated.',
+  tags: ['design', 'media', 'image-generation', 'video-generation', 'higgsfield', 'mit'],
+  manifest: {
+    item_refs: HIGGSFIELD_SKILLS.map(s => `skill:${s.slug}`),
+    published_count: HIGGSFIELD_SKILLS.length,
+    license: 'MIT',
+    requires_connection: 'higgsfield',
+    unlocks_tool_slugs: ['higgsfield_generate_image', 'higgsfield_product_photoshoot', 'higgsfield_generate_video'],
+    install_hint: 'npx skills add higgsfield-ai/skills',
+    note: 'Requires a Higgsfield API key. Connect Higgsfield (Connections) to add your key, then the generate image/video tools are usable.',
+  },
+};
 const BUNDLE_SEEDS = [
   {
     slug: 'gstack',
@@ -487,6 +568,8 @@ export function seedMarketplaceItems(db) {
     for (const s of BUSINESS_SKILL_SEEDS) upsertItem(db, 'skill', buildBusinessSkillSeed(s));
     for (const s of BUSINESS_SUITE_SKILL_SEEDS) upsertItem(db, 'skill', buildSuiteSkillSeed(s));
     for (const seed of SKILL_SEEDS) upsertItem(db, 'skill', seed);
+    for (const s of HIGGSFIELD_SKILLS) upsertItem(db, 'skill', buildHiggsfieldSkillSeed(s));
+    upsertItem(db, 'bundle', HIGGSFIELD_BUNDLE);
     for (const seed of BUNDLE_SEEDS) upsertItem(db, 'bundle', seed);
     for (const curated of OPEN_DESIGN_CURATED_SKILLS) {
       upsertItem(db, 'skill', buildOpenDesignSkillSeed(curated));
@@ -547,5 +630,7 @@ export const BUSINESS_SUITE_SKILL_SLUGS = BUSINESS_SUITE_SKILL_SEEDS.map(s => s.
 export { BUSINESS_SUITE_MODULE_SEED };
 export const PHASE1_SKILL_SLUGS = SKILL_SEEDS.map(s => s.slug);
 export const PHASE1_BUNDLE_SLUGS = BUNDLE_SEEDS.map(s => s.slug);
+export const HIGGSFIELD_SKILL_SLUGS = HIGGSFIELD_SKILLS.map(s => s.slug);
+export const HIGGSFIELD_BUNDLE_SLUG = HIGGSFIELD_BUNDLE.slug;
 export const OPEN_DESIGN_SKILL_SLUGS = OPEN_DESIGN_CURATED_SKILLS.map(s => `open-design-${s.slug}`);
 export const OPEN_DESIGN_BUNDLE_SLUG = OPEN_DESIGN_BUNDLE.slug;

package/lib/marketplace.js CHANGED Viewed

@@ -148,6 +148,9 @@ function shapeNonToolItem(row, installRow) {
         : (Array.isArray(manifest.item_refs) ? manifest.item_refs.length : 0),
       license: manifest.license || null,
       note: manifest.note || null,
+      requires_connection: manifest.requires_connection || null,
+      unlocks_tool_slugs: Array.isArray(manifest.unlocks_tool_slugs) ? manifest.unlocks_tool_slugs : [],
+      install_hint: manifest.install_hint || null,
     };
   } else if (row.kind === 'workflow') {
     // Workflow templates ship a `source_spec_json` payload — the same shape
@@ -350,11 +353,7 @@ export function setItemInstalled(id, installed) {
   }
   if (item.kind === 'bundle') {
-    return {
-      status: 'deferred',
-      reason: 'Bundle install lands in Phase 2 (GitHub importer).',
-      item,
-    };
+    return setBundleInstalled(item, installed);
   }
   if (item.kind === 'connection') {
@@ -403,6 +402,59 @@ export function setItemInstalled(id, installed) {
   return getItem(id);
 }
+/**
+ * Install or uninstall a bundle.
+ *
+ * A bundle is a curated set of skills/tools referenced by `manifest.item_refs`
+ * (e.g. "skill:higgsfield-generate", "skill:design-shotgun"). Installing a
+ * bundle installs each referenced item through the same single write path
+ * (setItemInstalled), then flags the bundle row itself. Uninstall reverses it.
+ *
+ * If the bundle declares `manifest.requires_connection`, the result carries a
+ * `requires_connection` hint so the UI can prompt the user to add the API key —
+ * the bundle still installs (skills become available); generation just needs the
+ * connection before it can run.
+ */
+function setBundleInstalled(item, installed) {
+  const refs = Array.isArray(item.bundle?.item_refs) ? item.bundle.item_refs : [];
+  const results = [];
+  for (const ref of refs) {
+    // Refs are full item ids ("skill:slug" / "tool:slug"). Skip bundle refs to
+    // avoid recursion; only leaf items install here.
+    if (typeof ref !== 'string' || ref.startsWith('bundle:')) continue;
+    const child = getItem(ref);
+    if (!child) continue;
+    try {
+      setItemInstalled(child.id, installed);
+      results.push({ id: child.id, ok: true });
+    } catch (err) {
+      results.push({ id: child.id, ok: false, error: String(err?.message || err) });
+    }
+  }
+  // Flag the bundle row in marketplace_installations.
+  const db = getDb();
+  const now = nowIso();
+  const existing = db
+    .prepare('SELECT item_id FROM marketplace_installations WHERE item_id=?')
+    .get(item.id);
+  if (existing) {
+    db.prepare('UPDATE marketplace_installations SET installed=?, installed_at=? WHERE item_id=?')
+      .run(installed ? 1 : 0, installed ? now : null, item.id);
+  } else {
+    db.prepare('INSERT INTO marketplace_installations (item_id, installed, installed_at) VALUES (?, ?, ?)')
+      .run(item.id, installed ? 1 : 0, installed ? now : null);
+  }
+  const requiresConnection = item.bundle?.requires_connection || item.manifest?.requires_connection || null;
+  return {
+    status: installed ? 'installed' : 'uninstalled',
+    item: getItem(item.id),
+    installed_items: results,
+    requires_connection: installed ? requiresConnection : null,
+  };
+}
 /**
  * Install or uninstall a marketplace workflow template.
  *

package/lib/orchestrator-tools.js CHANGED Viewed

@@ -40,6 +40,8 @@ import {
 import { resolveSafePath } from './tools/safety.js';
 import { executeRegistryTool, getEnabledToolSchemas, listMarketplaceTools, setToolEnabled } from './tools/registry.js';
 import { listMarketplaceItems } from './marketplace.js';
+import { buildRoutingContext } from './agent-routing.js';
+import { isSpecialistTool } from './role-capability-map.js';
 import { createTask, listTasks } from './delegation.js';
 import { runSingleReport } from './mines/diligence.js';
 import { getBridgeHealth, sendWhatsAppDocument, sendWhatsAppMessage } from './whatsapp.js';
@@ -1066,6 +1068,21 @@ export const CORE_TOOLS = [
       required: ['tool_name'],
     },
   },
+  {
+    name: 'route_goal',
+    description:
+      'CALL THIS FIRST for any non-trivial request, BEFORE attempting a specialist task yourself. It grounds your delegation decision: given the user goal, it returns the live capability registry — every active agent with its role, mission, skills, and granted tools; the enabled-tool catalog; whether Tool Smith is available to build missing capabilities — plus the fallback ladder. Reason over it and pick the path: delegate to a fit specialist (run_agent), create_then_delegate when none fits (create_agent), build_capability when a specialist exists but lacks a required tool (request_capability), or direct_fallback for a trivial one-line factual answer. Read-only, no side effects.',
+    input_schema: {
+      type: 'object',
+      properties: {
+        goal: {
+          type: 'string',
+          description: 'The user goal in one sentence, e.g. "find a return flight DXB to London for May 18-25" or "draft a reply to this email".',
+        },
+      },
+      required: ['goal'],
+    },
+  },
   {
     name: 'request_capability',
     description:
@@ -1093,10 +1110,28 @@ export const CORE_TOOLS = [
 const HERMES_TOOL_NAMES = new Set(['send_to_hermes', 'start_hermes_job']);
+/**
+ * Names of enabled marketplace tools in a SPECIALIST-owned category. These are
+ * stripped from the MAIN agent's directly-callable catalog so specialist work
+ * must be delegated to an agent that owns the tool (the load-bearing
+ * delegation-first gate). Sub-agents still receive their granted specialist
+ * tools via getEnabledToolSchemasForAgent — the narrowing applies to the
+ * orchestrator catalog only. Kill-switch: MADARX_DELEGATION_ENFORCEMENT=off.
+ */
+function mainAgentDirectDenylist() {
+  if (process.env.MADARX_DELEGATION_ENFORCEMENT === 'off') return new Set();
+  try {
+    return new Set(listMarketplaceTools().filter(isSpecialistTool).map(t => t.name));
+  } catch {
+    return new Set();
+  }
+}
 export function getTools() {
   const hermesOk = isHermesAvailable();
   const coreTools = hermesOk ? CORE_TOOLS : CORE_TOOLS.filter(t => !HERMES_TOOL_NAMES.has(t.name));
-  return getEnabledToolSchemas(coreTools);
+  const denylist = mainAgentDirectDenylist();
+  return getEnabledToolSchemas(coreTools).filter(t => !denylist.has(t.name));
 }
 export const TOOLS = CORE_TOOLS;
@@ -1280,6 +1315,19 @@ export function clampToolResult(value) {
  * @returns {unknown}
  */
 export async function executeTool(toolName, input = {}, context = {}) {
+  // Load-bearing delegation-first gate (main-agent path, both Anthropic + CLI
+  // engines): specialist domain tools are not the orchestrator's to call. Block
+  // here so even a CLI engine emitting a raw madarx-action cannot bypass the
+  // catalog narrowing that hides them from the Anthropic schema. Sub-agents go
+  // through executeRegistryTool and are unaffected. Kill-switch via
+  // MADARX_DELEGATION_ENFORCEMENT=off (honored inside mainAgentDirectDenylist).
+  if (mainAgentDirectDenylist().has(toolName)) {
+    return clampToolResult({
+      ok: false,
+      error: 'delegate_required',
+      message: `"${toolName}" is a specialist tool you do not own directly. Call route_goal(goal), then delegate to the agent that owns it with run_agent — or request_capability if no agent has it.`,
+    });
+  }
   const result = await dispatchTool(toolName, input, context);
   return clampToolResult(result);
 }
@@ -1375,7 +1423,7 @@ async function dispatchTool(toolName, input = {}, context = {}) {
       return sendWhatsAppMessage(input.chat_id, input.text);
     case 'run_agent':
-      return runAgentOnDemand(input);
+      return runAgentOnDemand(input, context);
     case 'mines_run_report':
       // One-action mines report trigger from chat. The actual report tool call
@@ -1411,6 +1459,9 @@ async function dispatchTool(toolName, input = {}, context = {}) {
     case 'uninstall_tool':
       return uninstallToolHandler(input);
+    case 'route_goal':
+      return buildRoutingContext({ goal: input.goal, project_id: context.project_id || null });
     case 'request_capability':
       return requestCapabilityHandler(input, context);
@@ -1572,13 +1623,16 @@ function resolveAgentId({ agent_id, agent_name }) {
   return { ok: false, error: 'Pass either agent_id or agent_name.' };
 }
-async function runAgentOnDemand(input) {
+async function runAgentOnDemand(input, context = {}) {
   const resolved = resolveAgentId(input);
   if (!resolved.ok) return { ok: false, error: resolved.error };
   const agent = resolved.agent;
   const wake_reason = input.wake_reason || 'on-demand from main agent';
   const instruction = typeof input.instruction === 'string' && input.instruction.trim() ? input.instruction.trim() : null;
   const expected_output = typeof input.expected_output === 'string' && input.expected_output.trim() ? input.expected_output.trim() : null;
+  // Owner-granted inline approvals to inject into this sub-agent's matching tool
+  // calls (so an approved gate resumes instead of re-prompting).
+  const pending_approvals = Array.isArray(context.pending_approvals) ? context.pending_approvals : [];
   try {
     // Per-call overrides are auditable but NOT persisted onto the agent row —
     // they shape this single run's prompt only (see runAgentTick precedence).
@@ -1590,20 +1644,23 @@ async function runAgentOnDemand(input) {
         meta: { agent_id: agent.id, wake_reason, has_instruction: Boolean(instruction), has_expected_output: Boolean(expected_output) },
       });
     }
-    const run = await runAgentTick(agent.id, { triggered_by: 'main_agent', wake_reason, instruction, expected_output });
+    const run = await runAgentTick(agent.id, { triggered_by: 'main_agent', wake_reason, instruction, expected_output, pending_approvals });
     if (!run) return { ok: false, error: `runAgentTick returned null for ${agent.id}` };
     return {
       ok: true,
       agent_id: agent.id,
       agent_name: agent.name,
       run_id: run.id,
-      status: run.status || 'complete',
+      status: run.pending_approval ? 'awaiting_approval' : (run.status || 'complete'),
       title: run.artifact_title || run.title,
       preview: (run.preview || '').slice(0, 600),
       // Addressable artifact row (for pinning to the canvas). `artifact` stays
       // the file-path string for backward compatibility.
       artifact_id: run.artifact_id || null,
       artifact: run.artifact || null,
+      // Inline-approval surface: when the sub-agent paused on an owner-approval
+      // gate, this carries the approval the chat should render as Approve/Deny.
+      pending_approval: run.pending_approval || null,
     };
   } catch (err) {
     return { ok: false, error: err.message, agent_id: agent.id };

package/lib/role-capability-map.js ADDED Viewed

@@ -0,0 +1,89 @@
+/**
+ * Role ↔ capability hints for delegation-first routing.
+ *
+ * IMPORTANT: this file is a FAST-PATH HINT + SEED LIST, not the routing
+ * authority. The authoritative routing decision is the main agent reasoning
+ * over the live registry returned by lib/agent-routing.js::buildRoutingContext.
+ * A goal whose domain is absent from these maps still routes correctly via the
+ * grounded context + the fallback ladder — these maps only let obvious cases
+ * skip the reasoning round-trip and tell the seeder which specialists to plant.
+ *
+ * Keyed off the `category` field every MARKETPLACE_TOOLS entry already carries
+ * (lib/tools/registry.js), so adding a tool category here is the only manual
+ * step — no per-tool wiring.
+ */
+/**
+ * Tool categories that are SPECIALIST-OWNED: their tools are removed from the
+ * main agent's directly-callable catalog (see getTools() narrowing) and are
+ * reachable only by delegating to an agent that owns them.
+ *
+ * Scope note: the hard gate covers clear specialist WORK domains with low
+ * main-agent overlap. Deliberately NOT specialist (kept on the main agent):
+ *  - web        → web_search / web_fetch are the orchestrator's quick-fact allowance.
+ *  - voice      → voice_speak is how the main/voice agent talks — a mechanism, not a domain.
+ *  - browser    → browser_* is a main-agent mechanism (BROWSER_CONTROL contract).
+ *  - github     → heavy main-agent overlap (read context); routing + prompt steer
+ *                 engineering work to engineering_lead without a structural block (follow-up).
+ *  - authoring  → skill/composite/connector authoring belongs to the Tool Smith flow.
+ *  - workflow   → process-definition tools are orchestration.
+ *  - core/system/cli_generator → orchestration + presentation primitives.
+ *  - local_machine → file_read etc. used by the orchestrator for grounding.
+ */
+export const SPECIALIST_TOOL_CATEGORIES = new Set([
+  'travel',
+  'email',
+  'calendar',
+  'supabase',
+  'vercel',
+  'mines',
+]);
+/**
+ * Obvious-domain shortcut: tool category → the specialist role that owns it.
+ * Only a hint for fastPathHint(); never the sole basis of a routing decision.
+ */
+export const CATEGORY_TO_ROLE = {
+  travel: 'travel_concierge',
+  email: 'personal_assistant',
+  github: 'engineering_lead',
+  calendar: 'ops_manager',
+  supabase: 'web_ecommerce',
+  vercel: 'web_ecommerce',
+  browser: 'web_ecommerce',
+  voice: 'content_social',
+};
+/**
+ * Lightweight keyword → category guesses for fastPathHint(). Intentionally
+ * small: clear wins only. Anything not matched here falls through to the LLM
+ * reasoning over buildRoutingContext — which is the point.
+ */
+export const KEYWORD_CATEGORY_HINTS = [
+  [/\b(flight|flights|fly|airfare|airline|hotel|hotels|itinerary|trip|travel|book a (room|stay))\b/i, 'travel'],
+  [/\b(email|inbox|reply to .*(mail|message)|draft a (reply|mail|email)|gmail)\b/i, 'email'],
+  [/\b(pull request|\bpr\b|open an? issue|github|merge|commit|repo|repository)\b/i, 'github'],
+  [/\b(calendar|schedule a (meeting|call)|book (a )?(meeting|slot|30 ?min)|invite .* to)\b/i, 'calendar'],
+  [/\b(deploy|vercel|production build|ship the site)\b/i, 'vercel'],
+  [/\b(supabase|database row|insert into|update the table|sql)\b/i, 'supabase'],
+];
+/**
+ * Specialists to AUTO-SEED on first launch so the most common delegation
+ * targets exist out of the box. Kept minimal: every other domain is covered by
+ * the `create_then_delegate` ladder step at runtime. Each entry is an
+ * agent-templates.js slug; the seeder installs it idempotently.
+ */
+export const SEED_SPECIALISTS = [
+  'travel-concierge',
+];
+/** True when a marketplace tool belongs to a specialist-owned category. */
+export function isSpecialistTool(tool) {
+  return Boolean(tool && SPECIALIST_TOOL_CATEGORIES.has(tool.category));
+}
+/** Obvious role for a tool category, or null when there is no clear owner. */
+export function roleForCategory(category) {
+  return CATEGORY_TO_ROLE[category] || null;
+}