newmark-agent 0.3.11 → 0.4.0

package/dist/core/electronUtilityRuntimePool.js

@@ -16,6 +16,7 @@ class ElectronUtilityRuntimePool {
     restarting = new Set();
     quarantined = new Map();
     disposing = new Set();
+    forceStopPromises = new Map();
     capacityTail = Promise.resolve();
     accessSequence = 0;
     constructor(root, hostScript, createClient = target => new electronUtilityAgentClient_1.ElectronUtilityAgentClient(root, hostScript, target), options = {}) {
@@ -202,6 +203,20 @@ class ElectronUtilityRuntimePool {
             this.release(entry, true);
         }
     }
+    async contextCompress(target, options = {}) {
+        const entry = await this.acquire((0, conversationTarget_1.normalizeConversationTarget)(target));
+        try {
+            if (entry.stopIntent)
+                return { ok: false, error: 'Context compression is unavailable while this conversation is stopping.' };
+            if (!entry.client.contextCompress)
+                return { ok: false, error: 'Context compression is unavailable in this runtime.' };
+            entry.lastSnapshot = null;
+            return await entry.client.contextCompress(options);
+        }
+        finally {
+            this.release(entry, true);
+        }
+    }
     async rateAutoRoute(target, score, routeId = '') {
         const normalized = (0, conversationTarget_1.normalizeConversationTarget)(target);
         const entry = await this.acquireExisting(normalized);
@@ -342,6 +357,67 @@ class ElectronUtilityRuntimePool {
         if (entry)
             await this.stopEntry(entry);
     }
+    /**
+     * Immediately terminate a target runtime for destructive lifecycle actions.
+     * Archive is deliberately stronger than the user-facing two-click Stop
+     * contract: the target may be running, already stopping, or holding an
+     * active prompt lease. Give the kernel only the short checkpoint window
+     * owned by forceTerminateEntry, then hard-stop and evict the client so no
+     * delayed runtime event can keep the archived target resident.
+     */
+    async forceStopTarget(target) {
+        const normalized = (0, conversationTarget_1.normalizeConversationTarget)(target);
+        const existing = this.forceStopPromises.get(normalized.runtimeKey);
+        if (existing)
+            return existing;
+        const operation = this.forceStopTargetInternal(normalized);
+        this.forceStopPromises.set(normalized.runtimeKey, operation);
+        try {
+            await operation;
+        }
+        finally {
+            if (this.forceStopPromises.get(normalized.runtimeKey) === operation) {
+                this.forceStopPromises.delete(normalized.runtimeKey);
+            }
+        }
+    }
+    async forceStopTargetInternal(target) {
+        let entry;
+        await this.serializeCapacity(async () => {
+            entry = this.entries.get(target.runtimeKey);
+            if (entry)
+                this.disposing.add(target.runtimeKey);
+        });
+        if (!entry)
+            return;
+        const intent = entry.stopIntent || {
+            runId: entry.lastRunId,
+            generation: entry.lastGeneration,
+            checkpointed: false,
+            forcePromise: null,
+        };
+        if (!entry.stopIntent)
+            entry.stopIntent = intent;
+        try {
+            await this.forceTerminateEntry(entry, intent);
+            // forceStop is expected to disconnect the utility child. If a client
+            // reports a stale connected flag, retry the hard boundary once before
+            // declaring archive unsafe.
+            if (entry.client.status().connected)
+                await entry.client.forceStop();
+            if (entry.client.status().connected) {
+                throw new Error(`Electron utility runtime ${target.runtimeKey} remained connected after force stop`);
+            }
+            if (this.entries.get(target.runtimeKey) === entry) {
+                this.entries.delete(target.runtimeKey);
+                entry.unsubscribe();
+                entry.client.setHostToolHandler(null);
+            }
+        }
+        finally {
+            this.disposing.delete(target.runtimeKey);
+        }
+    }
     async stopAll() {
         const targets = Array.from(this.entries.values(), entry => entry.target);
         const results = await Promise.allSettled(targets.map(target => this.stopTarget(target)));

package/dist/core/flow-runner.js

@@ -126,7 +126,7 @@ async function runFlowBuild(agent, prompt, options) {
             if (!options.signal?.aborted && typeof agent.emitWorkEvent === 'function') {
                 agent.emitWorkEvent({ type: 'error', content: reportedError.message, runId });
             }
-            agent.finishConversationWorkRun(runId, options.signal?.aborted ? 'interrupted' : 'error');
+            agent.finishConversationWorkRun(runId, options.signal?.aborted ? 'interrupted' : 'error', undefined, options.signal?.aborted ? '' : reportedError.message);
             agent.flushWorkspaceConversationState();
         }
         throw reportedError;

package/dist/core/mcpManager.d.ts

@@ -28,6 +28,7 @@ export interface McpServerInput {
 export declare class McpManager {
     private readonly filePath;
     private state;
+    private preserveCorruptSource;
     constructor(root: string);
     list(): Array<Omit<McpServerConfig, 'env' | 'headers'> & {
         envKeys: string[];

package/dist/core/mcpManager.js

@@ -45,10 +45,10 @@ function stringRecord(value, label) {
     const output = {};
     for (const [key, item] of Object.entries(value)) {
         const cleanKey = String(key || '').trim();
-        if (!cleanKey || cleanKey.includes('\r') || cleanKey.includes('\n') || cleanKey.includes(String.fromCharCode(0)))
+        if (!cleanKey || cleanKey.includes('\r') || cleanKey.includes('\n') || cleanKey.includes(String.fromCharCode(0)) || ['__proto__', 'prototype', 'constructor'].includes(cleanKey))
             throw new Error(`${label} contains an invalid key.`);
         const cleanValue = String(item ?? '');
-        if (cleanValue.includes(String.fromCharCode(0)))
+        if (cleanValue.includes(String.fromCharCode(0)) || (label === 'headers' && /[\r\n]/.test(cleanValue)))
             throw new Error(`${label} contains an invalid value.`);
         output[cleanKey] = cleanValue;
     }
@@ -59,11 +59,83 @@ function stringArray(value) {
         return undefined;
     if (!Array.isArray(value))
         throw new Error('args must be a JSON array of strings.');
-    return value.map(item => String(item)).filter(item => item.length <= 4000).slice(0, 100);
+    if (value.length > 100 || value.some(item => typeof item !== 'string' || item.length > 4000 || item.includes(String.fromCharCode(0)))) {
+        throw new Error('args must contain at most 100 strings, each no longer than 4000 characters.');
+    }
+    return [...value];
+}
+function publicHttpUrl(value) {
+    if (!value)
+        return undefined;
+    try {
+        const parsed = new URL(value);
+        if (parsed.username)
+            parsed.username = '<redacted>';
+        if (parsed.password)
+            parsed.password = '<redacted>';
+        for (const key of Array.from(parsed.searchParams.keys())) {
+            if (/(?:api.?key|authorization|access.?token|secret|password|credential)/i.test(key))
+                parsed.searchParams.set(key, '<redacted>');
+        }
+        return parsed.toString();
+    }
+    catch {
+        return value;
+    }
+}
+function parseHttpUrl(value) {
+    let parsed;
+    try {
+        parsed = new URL(value);
+    }
+    catch {
+        throw new Error('An HTTP MCP server requires an http(s) URL.');
+    }
+    if (!['http:', 'https:'].includes(parsed.protocol))
+        throw new Error('An HTTP MCP server requires an http(s) URL.');
+    if (parsed.username || parsed.password)
+        throw new Error('Put HTTP credentials in headers, not in the MCP URL.');
+    return value;
+}
+function safeLoadedServer(value) {
+    try {
+        if (!value || typeof value !== 'object' || Array.isArray(value))
+            return undefined;
+        const item = value;
+        const id = String(item.id || '').trim();
+        const name = String(item.name || '').trim();
+        const transport = item.transport === 'http' ? 'http' : item.transport === 'stdio' ? 'stdio' : undefined;
+        if (!id || !name || !transport)
+            return undefined;
+        const command = String(item.command || '').trim();
+        const url = String(item.url || '').trim();
+        if (transport === 'stdio' && !command)
+            return undefined;
+        if (transport === 'http')
+            parseHttpUrl(url);
+        return {
+            id: id.slice(0, 200),
+            name: name.slice(0, 120),
+            enabled: item.enabled === true,
+            transport,
+            command: transport === 'stdio' ? command.slice(0, 2000) : undefined,
+            args: transport === 'stdio' ? (stringArray(item.args) || []) : undefined,
+            cwd: transport === 'stdio' ? String(item.cwd || '').trim().slice(0, 4000) || undefined : undefined,
+            url: transport === 'http' ? url.slice(0, 4000) : undefined,
+            env: transport === 'stdio' ? (stringRecord(item.env, 'env') || {}) : undefined,
+            headers: transport === 'http' ? (stringRecord(item.headers, 'headers') || {}) : undefined,
+            createdAt: String(item.createdAt || new Date(0).toISOString()),
+            updatedAt: String(item.updatedAt || item.createdAt || new Date(0).toISOString()),
+        };
+    }
+    catch {
+        return undefined;
+    }
 }
 class McpManager {
     filePath;
     state;
+    preserveCorruptSource = false;
     constructor(root) {
         this.filePath = path.join(root, 'MCP.json');
         this.state = this.load();
@@ -74,6 +146,7 @@ class McpManager {
             return {
                 ...publicServer,
                 args: [...(server.args || [])],
+                url: publicHttpUrl(server.url),
                 envKeys: Object.keys(env || {}).sort(),
                 headerKeys: Object.keys(headers || {}).sort(),
             };
@@ -81,22 +154,33 @@ class McpManager {
     }
     upsert(input) {
         const id = String(input.id || '').trim();
-        const existing = this.state.servers.find(server => server.id === id);
+        if (input.transport !== undefined && input.transport !== 'stdio' && input.transport !== 'http')
+            throw new Error('transport must be stdio or http.');
+        let existing = this.state.servers.find(server => server.id === id);
         const name = String(input.name ?? existing?.name ?? '').trim().slice(0, 120);
         if (!name)
             throw new Error('MCP server name is required.');
+        if (/[\r\n\0]/.test(name))
+            throw new Error('MCP server name contains invalid characters.');
         const transport = input.transport === 'http' ? 'http' : (input.transport === 'stdio' ? 'stdio' : existing?.transport || 'stdio');
         const command = String(input.command ?? existing?.command ?? '').trim();
-        const url = String(input.url ?? existing?.url ?? '').trim();
+        let url = String(input.url ?? existing?.url ?? '').trim();
         if (transport === 'stdio' && !command)
             throw new Error('A stdio MCP server requires a command.');
-        if (transport === 'http' && !/^https?:\/\//i.test(url))
-            throw new Error('An HTTP MCP server requires an http(s) URL.');
+        if (transport === 'stdio' && /[\r\n\0]/.test(command))
+            throw new Error('command contains an invalid value.');
+        if (transport === 'http')
+            url = parseHttpUrl(url);
+        if (!existing && !id) {
+            existing = this.state.servers.find(server => server.name.toLocaleLowerCase() === name.toLocaleLowerCase()
+                && server.transport === transport
+                && (transport === 'stdio' ? server.command === command : server.url === url));
+        }
         const now = new Date().toISOString();
         const server = {
             id: existing?.id || `mcp-${(0, crypto_1.randomUUID)()}`,
             name,
-            enabled: typeof input.enabled === 'boolean' ? input.enabled : existing?.enabled !== false,
+            enabled: typeof input.enabled === 'boolean' ? input.enabled : existing?.enabled === true,
             transport,
             command: transport === 'stdio' ? command.slice(0, 2000) : undefined,
             args: transport === 'stdio' ? (stringArray(input.args) ?? existing?.args ?? []) : undefined,
@@ -134,15 +218,21 @@ class McpManager {
     load() {
         try {
             const parsed = JSON.parse(fs.readFileSync(this.filePath, 'utf8'));
-            return { version: 1, servers: Array.isArray(parsed.servers) ? parsed.servers.filter(Boolean) : [] };
+            return { version: 1, servers: Array.isArray(parsed.servers) ? parsed.servers.map(safeLoadedServer).filter((server) => !!server) : [] };
         }
         catch {
+            this.preserveCorruptSource = fs.existsSync(this.filePath);
             return { version: 1, servers: [] };
         }
     }
     save() {
         fs.mkdirSync(path.dirname(this.filePath), { recursive: true });
-        const tempPath = `${this.filePath}.${process.pid}.tmp`;
+        if (this.preserveCorruptSource) {
+            const backupPath = `${this.filePath}.corrupt-${new Date().toISOString().replace(/[:.]/g, '-')}`;
+            fs.copyFileSync(this.filePath, backupPath);
+            this.preserveCorruptSource = false;
+        }
+        const tempPath = `${this.filePath}.${process.pid}-${(0, crypto_1.randomUUID)()}.tmp`;
         fs.writeFileSync(tempPath, JSON.stringify(this.state, null, 2), 'utf8');
         fs.renameSync(tempPath, this.filePath);
     }

package/dist/core/modelValidationStore.d.ts

@@ -2,8 +2,11 @@ import { ModelValidationCache, ModelValidationRecord } from './modelValidation';
 /** Durable validation evidence. The file contains probe metadata only, never prompts, tool arguments or credentials. */
 export declare class FileModelValidationCache implements ModelValidationCache {
     private readonly filePath;
+    private readonly readOnly;
     private readonly records;
-    constructor(rootPath: string);
+    constructor(rootPath: string, options?: {
+        readOnly?: boolean;
+    });
     get(modelKey: string): ModelValidationRecord | undefined;
     set(record: ModelValidationRecord): void;
     delete(modelKey: string): void;

package/dist/core/modelValidationStore.js

@@ -42,9 +42,11 @@ function key(model) {
 /** Durable validation evidence. The file contains probe metadata only, never prompts, tool arguments or credentials. */
 class FileModelValidationCache {
     filePath;
+    readOnly;
     records = new Map();
-    constructor(rootPath) {
+    constructor(rootPath, options = {}) {
         this.filePath = path.join(rootPath, 'model-validation', 'records.json');
+        this.readOnly = options.readOnly === true;
         this.load();
     }
     get(modelKey) {
@@ -53,11 +55,15 @@ class FileModelValidationCache {
     }
     set(record) {
         this.records.set(record.modelKey || key(record.model), JSON.parse(JSON.stringify(record)));
+        if (this.readOnly)
+            return;
         this.save();
     }
     delete(modelKey) {
         if (!this.records.delete(modelKey))
             return;
+        if (this.readOnly)
+            return;
         this.save();
     }
     load() {

package/dist/core/subagent.d.ts

@@ -223,6 +223,12 @@ export declare class SubagentManager {
     toRecord(idOrName: string): NewmarkSubagentRecord | undefined;
     toToolResult(idOrName: string, output: string, ok?: boolean): NewmarkSubagentToolResult;
     getResult(name: string): string;
+    /**
+     * 有界结果 transcript：subagent_result 注入主 Agent 上下文时，不再放大完整
+     * 消息历史（含所有中间 tool call/result 洪水）。只保留最近若干条非 tool 消息，
+     * 按字符上限截断，杜绝上下文回归。完整历史按需走 subagent_read(max_chars)。
+     */
+    boundedResultTranscript(idOrName: string): string;
     listActive(): SubagentInstance[];
     listAll(): SubagentInstance[];
     pauseScheduling(): void;

package/dist/core/subagent.js

@@ -193,7 +193,7 @@ class SubagentManager {
             fromAgentId,
             toAgentId: target.id,
             kind,
-            body,
+            body: truncateText(body, 32000),
             correlationId: details.correlationId,
             replyTo: details.replyTo,
             createdAt: now(),
@@ -481,6 +481,27 @@ class SubagentManager {
             return '';
         return record.result || record.messages.filter(message => message.role === 'assistant').map(message => message.content).join('\n');
     }
+    /**
+     * 有界结果 transcript：subagent_result 注入主 Agent 上下文时，不再放大完整
+     * 消息历史（含所有中间 tool call/result 洪水）。只保留最近若干条非 tool 消息，
+     * 按字符上限截断，杜绝上下文回归。完整历史按需走 subagent_read(max_chars)。
+     */
+    boundedResultTranscript(idOrName) {
+        const record = this.get(idOrName);
+        if (!record)
+            return '';
+        const MAX_MSG = 8; // 最近保留的消息条数
+        const MAX_CHARS = 8000; // 总字符上限
+        const messages = record.messages
+            .filter(message => message.role === 'assistant' || message.role === 'user' || message.role === 'system')
+            .slice(-MAX_MSG)
+            .map(message => `[${message.role}] ${truncateText(String(message.content || ''), 1200)}`);
+        let text = messages.join('\n');
+        if (text.length > MAX_CHARS) {
+            text = text.slice(0, MAX_CHARS) + `\n[...transcript truncated: ${record.messages.length} total messages, ${record.messages.length - MAX_MSG} older omitted; use subagent_read for full history...]`;
+        }
+        return text || '(no transcript)';
+    }
     listActive() { return this.listAll().filter(item => item.status !== 'closed'); }
     listAll() { return [...this.subs.values()].map(cloneRecord); }
     pauseScheduling() {

package/dist/core/toolPolicy.d.ts

@@ -14,6 +14,12 @@ export interface ToolPolicyDecision {
 }
 export declare const PLAN_COMPUTER_USE_ACTIONS: readonly ["observe", "app_list", "app_observe"];
 export declare const PLAN_BROWSER_USE_ACTIONS: readonly ["observe", "navigate", "wait", "extract"];
+/** 判断一个工具是否可参与并行调度。缺省 false（独占）。
+ *  优先看 toolchain registry 推断的 riskLevel（'read' 工具天然并发安全，
+ *  seedToolchainFromDefinitions 的 inferRiskLevel 自动推断），显式白名单作兜底。
+ *  这样后续新增工具只需在 ToolExecutor.definitions() 加 schema，seed 时其
+ *  riskLevel 被自动推断，'read' 工具自动并发安全——无需再改本文件。 */
+export declare function isConcurrencySafeTool(name: string, riskLevel?: string): boolean;
 export declare function isReadOnlyScopedToolAction(name: string, action: string): boolean;
 export declare function toolAvailability(name: string): ToolAvailability;
 export declare function evaluateToolPolicy(request: ToolPolicyRequest): ToolPolicyDecision;

package/dist/core/toolPolicy.js

@@ -1,6 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.PLAN_BROWSER_USE_ACTIONS = exports.PLAN_COMPUTER_USE_ACTIONS = void 0;
+exports.isConcurrencySafeTool = isConcurrencySafeTool;
 exports.isReadOnlyScopedToolAction = isReadOnlyScopedToolAction;
 exports.toolAvailability = toolAvailability;
 exports.evaluateToolPolicy = evaluateToolPolicy;
@@ -16,6 +17,11 @@ const MODE_SCOPED_TOOLS = new Set([
     'build_history_query',
     'context_compress',
     'context_history_manage',
+    'compress_tool_result',
+    'background_tool',
+    'read_tool_result',
+    'goal_manage',
+    'conversation_rename',
     'question',
     'task',
     'subagent_list',
@@ -23,6 +29,10 @@ const MODE_SCOPED_TOOLS = new Set([
     'subagent_send',
     'subagent_result',
     'subagent_close',
+    'branch_list',
+    'branch_send',
+    'branch_read',
+    'branch_create',
 ]);
 const PLAN_READ_ONLY_TOOLS = new Set([
     'pwd',
@@ -51,12 +61,50 @@ const PLAN_READ_ONLY_TOOLS = new Set([
     'subagent_send',
     'subagent_result',
     'subagent_close',
+    'branch_list',
+    'branch_read',
     'question',
 ]);
 exports.PLAN_COMPUTER_USE_ACTIONS = ['observe', 'app_list', 'app_observe'];
 exports.PLAN_BROWSER_USE_ACTIONS = ['observe', 'navigate', 'wait', 'extract'];
 const PLAN_COMPUTER_USE_ACTION_SET = new Set(exports.PLAN_COMPUTER_USE_ACTIONS);
 const PLAN_BROWSER_USE_ACTION_SET = new Set(exports.PLAN_BROWSER_USE_ACTIONS);
+/**
+ * 并发安全工具集合（DSH isConcurrencySafe 语义的 Newmark 落地）。
+ *
+ * 只有确定性无副作用的只读工具才允许与兄弟 tool call 并发执行；任何写入、
+ * shell 命令、浏览器交互、子代理编排、以及会改变对话/文件/外部状态的工具
+ * 都保持独占串行，避免盲目 Promise.all 引发竞态。缺省保守：不在集合中的
+ * 工具一律视为独占。
+ *
+ * 注意：read/grep/glob/pwd 是同一进程内的内存/文件系统只读，可安全重叠；
+ * web_search/web_fetch 只读网络，可重叠；git_status/file_audit/repo_security_audit
+ * 只读审计，可重叠。其余（含 memory_lab_read 等读接口）因可能触发内部缓存/
+ * 重建副作用，默认保守串行。
+ */
+const CONCURRENCY_SAFE_TOOLS = new Set([
+    'pwd',
+    'read',
+    'glob',
+    'grep',
+    'web_search',
+    'web_fetch',
+    'git_status',
+    'file_audit',
+    'repo_security_audit',
+]);
+/** 判断一个工具是否可参与并行调度。缺省 false（独占）。
+ *  优先看 toolchain registry 推断的 riskLevel（'read' 工具天然并发安全，
+ *  seedToolchainFromDefinitions 的 inferRiskLevel 自动推断），显式白名单作兜底。
+ *  这样后续新增工具只需在 ToolExecutor.definitions() 加 schema，seed 时其
+ *  riskLevel 被自动推断，'read' 工具自动并发安全——无需再改本文件。 */
+function isConcurrencySafeTool(name, riskLevel) {
+    const toolName = String(name || '').trim();
+    if (CONCURRENCY_SAFE_TOOLS.has(toolName))
+        return true;
+    // 从 toolchain registry 派生的 riskLevel：read 工具默认并发安全。
+    return riskLevel === 'read';
+}
 function isReadOnlyScopedToolAction(name, action) {
     if (name === 'computer_use')
         return PLAN_COMPUTER_USE_ACTION_SET.has(action);
@@ -97,7 +145,7 @@ function evaluateToolPolicy(request) {
         }
     }
     if (request.isSubagent) {
-        if (name === 'skill_download' || name === 'question' || name.startsWith('automation_')) {
+        if (name === 'skill_download' || name === 'question' || name.startsWith('automation_') || name === 'goal_manage' || name === 'conversation_rename') {
             return { ...base, allowed: false, reason: `[Subagent sandbox] Tool '${name}' is disabled for peer agents.` };
         }
     }

package/dist/core/types.d.ts

@@ -100,7 +100,7 @@ export interface ChatMessage {
 export interface AgentWorkEvent {
     id: string;
     conversationId: string;
-    type: 'start' | 'text' | 'response' | 'final_response' | 'tool_call' | 'tool_result' | 'status' | 'done' | 'error' | 'queue_update' | 'guide';
+    type: 'start' | 'text' | 'response' | 'final_response' | 'tool_call' | 'tool_result' | 'thought' | 'thought_result' | 'status' | 'done' | 'error' | 'queue_update' | 'guide';
     content: string;
     mode: string;
     model: string;

package/dist/core/utilityAgentProtocol.d.ts

@@ -1,6 +1,6 @@
 import { BrowserControlRequest, BrowserControlResult } from './browserControl';
 import { BrowserUseRequest } from './browserUse';
-import { AgentPromptMessage, ConversationKernelRunOptions, ConversationKernelRunResult, ConversationQueueMode, ConversationRuntimeState, ConversationStopResult } from './conversationKernel';
+import { AgentPromptMessage, ConversationContextCompressOptions, ConversationKernelRunOptions, ConversationKernelRunResult, ConversationQueueMode, ConversationRuntimeState, ConversationStopResult } from './conversationKernel';
 import { ConversationRuntimeTarget, NormalizedConversationTarget } from './conversationTarget';
 import { AgentMode, AgentWorkEvent, ConversationInputEnvelope, GuideReceipt } from './types';
 import type { AutoRouteRatingResult, ConversationSnapshot } from './agent';
@@ -102,6 +102,13 @@ export type UtilityAgentRequest = {
     params: {
         target: ConversationRuntimeTarget;
     };
+} | {
+    id: string;
+    method: 'context_compress';
+    params: {
+        target: ConversationRuntimeTarget;
+        options?: ConversationContextCompressOptions;
+    };
 } | {
     id: string;
     method: 'rate_auto_route';

package/dist/core/workspace.d.ts

@@ -23,6 +23,15 @@ export interface WorkspaceManagerOptions {
 }
 /** Normalize persisted Windows/WSL aliases and recover paths damaged by cross-host path.resolve calls. */
 export declare function normalizeHostWorkspacePath(input: string, platform?: NodeJS.Platform): string;
+/**
+ * An installed package is never a writable user workspace. Older builds could
+ * persist the install directory as an external workspace when the GUI was
+ * started from its shortcut working directory; restoring that entry then
+ * tried to create `<install>\\conversations` under Program Files. Keep this
+ * policy in the workspace layer so GUI, TUI, CLI, and detached runtimes all
+ * recover the same way.
+ */
+export declare function isProtectedInstallWorkspacePath(candidate: string): boolean;
 export declare class WorkspaceManager {
     rootPath: string;
     private config;
@@ -52,6 +61,12 @@ export declare class WorkspaceManager {
     private saveState;
     private findWorkspace;
     private restoreCurrent;
+    /**
+     * Re-read the registry and persisted current-workspace pointer after another
+     * Newmark entrypoint updates Work/*.json. This intentionally does not create
+     * a workspace: a refresh must reflect the shared on-disk state exactly.
+     */
+    reloadFromStorage(): WorkspaceInfo | null;
     private saveInternal;
     private saveExternal;
     private sleepSync;

package/dist/core/workspace.js

@@ -35,6 +35,7 @@ var __importStar = (this && this.__importStar) || (function () {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.WorkspaceManager = void 0;
 exports.normalizeHostWorkspacePath = normalizeHostWorkspacePath;
+exports.isProtectedInstallWorkspacePath = isProtectedInstallWorkspacePath;
 const fs = __importStar(require("fs"));
 const path = __importStar(require("path"));
 const crypto = __importStar(require("crypto"));
@@ -64,6 +65,34 @@ function normalizeHostWorkspacePath(input, platform = process.platform) {
     }
     return path.posix.resolve(raw || '.');
 }
+function isPathInside(parent, child) {
+    try {
+        const relative = path.relative(path.resolve(parent), path.resolve(child));
+        return relative === '' || (!!relative && !relative.startsWith('..') && !path.isAbsolute(relative));
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * An installed package is never a writable user workspace. Older builds could
+ * persist the install directory as an external workspace when the GUI was
+ * started from its shortcut working directory; restoring that entry then
+ * tried to create `<install>\\conversations` under Program Files. Keep this
+ * policy in the workspace layer so GUI, TUI, CLI, and detached runtimes all
+ * recover the same way.
+ */
+function isProtectedInstallWorkspacePath(candidate) {
+    const value = String(candidate || '').trim();
+    if (!value)
+        return false;
+    const roots = [path.dirname(process.execPath)];
+    if (process.platform === 'win32') {
+        roots.push(process.env.ProgramFiles || '', process.env['ProgramFiles(x86)'] || '', process.env.ProgramW6432 || '');
+    }
+    const resolved = path.resolve(value);
+    return roots.filter(Boolean).some(root => isPathInside(root, resolved));
+}
 class WorkspaceManager {
     rootPath;
     config;
@@ -135,9 +164,18 @@ class WorkspaceManager {
         catch { /* empty */ }
         try {
             const ext = JSON.parse(fs.readFileSync(path.join(w, 'External.json'), 'utf-8'));
-            this.external = Array.isArray(ext)
+            const normalized = Array.isArray(ext)
                 ? ext.map(item => this.normalizeExternalWorkspace(item, changed => { externalChanged = externalChanged || changed; }))
                 : [];
+            this.external = normalized.filter(workspace => {
+                if (!isProtectedInstallWorkspacePath(workspace.path))
+                    return true;
+                // Never restore or persist the installation directory as a user
+                // workspace. It is a migration boundary for registries written by
+                // older versions and by package-level pressure tests.
+                externalChanged = true;
+                return false;
+            });
         }
         catch { /* empty */ }
         // Scan for directories not in Local.json
@@ -344,6 +382,15 @@ class WorkspaceManager {
     }
     restoreCurrent() {
         const stateCurrent = this.readState().current || null;
+        if (stateCurrent?.path && isProtectedInstallWorkspacePath(stateCurrent.path)) {
+            // The previous current workspace may have been filtered from
+            // External.json above. Clear the pointer instead of falling back to an
+            // arbitrary external directory; Agent can create/reuse a user-root
+            // internal workspace according to its normal configuration.
+            this.current = null;
+            this.saveState();
+            return;
+        }
         const stored = this.findWorkspace(stateCurrent);
         if (stored) {
             this.current = stored;
@@ -358,6 +405,20 @@ class WorkspaceManager {
             this.saveState();
         }
     }
+    /**
+     * Re-read the registry and persisted current-workspace pointer after another
+     * Newmark entrypoint updates Work/*.json. This intentionally does not create
+     * a workspace: a refresh must reflect the shared on-disk state exactly.
+     */
+    reloadFromStorage() {
+        if (this.detached)
+            return this.current;
+        this.scan();
+        this.validate();
+        this.current = null;
+        this.restoreCurrent();
+        return this.current;
+    }
     saveInternal() {
         if (this.detached)
             return;

package/dist/core/wslAgentClient.d.ts

@@ -72,6 +72,10 @@ export declare class WslAgentClient {
     rewind(target: ConversationRuntimeTarget, messageIndex: number): Promise<WslConversationRewindResult>;
     enqueueGuide(target: ConversationRuntimeTarget, envelope: ConversationInputEnvelope): Promise<GuideReceipt>;
     checkpoint(target: ConversationRuntimeTarget): Promise<Record<string, unknown>>;
+    contextCompress(target: ConversationRuntimeTarget, options?: {
+        keepRecent?: number;
+        force?: boolean;
+    }): Promise<Record<string, unknown>>;
     rateAutoRoute(target: ConversationRuntimeTarget, score: number, routeId?: string): Promise<WslAutoRouteRatingResult>;
     setWorkRunExpanded(target: ConversationRuntimeTarget, runId: string, expanded: boolean): Promise<boolean>;
     setMode(target: ConversationRuntimeTarget, mode: AgentMode): Promise<AgentMode>;