newmark-agent 0.3.12 → 0.4.2

package/dist/core/mcpManager.d.ts

@@ -28,6 +28,7 @@ export interface McpServerInput {
 export declare class McpManager {
     private readonly filePath;
     private state;
+    private preserveCorruptSource;
     constructor(root: string);
     list(): Array<Omit<McpServerConfig, 'env' | 'headers'> & {
         envKeys: string[];

package/dist/core/mcpManager.js

@@ -45,10 +45,10 @@ function stringRecord(value, label) {
     const output = {};
     for (const [key, item] of Object.entries(value)) {
         const cleanKey = String(key || '').trim();
-        if (!cleanKey || cleanKey.includes('\r') || cleanKey.includes('\n') || cleanKey.includes(String.fromCharCode(0)))
+        if (!cleanKey || cleanKey.includes('\r') || cleanKey.includes('\n') || cleanKey.includes(String.fromCharCode(0)) || ['__proto__', 'prototype', 'constructor'].includes(cleanKey))
             throw new Error(`${label} contains an invalid key.`);
         const cleanValue = String(item ?? '');
-        if (cleanValue.includes(String.fromCharCode(0)))
+        if (cleanValue.includes(String.fromCharCode(0)) || (label === 'headers' && /[\r\n]/.test(cleanValue)))
             throw new Error(`${label} contains an invalid value.`);
         output[cleanKey] = cleanValue;
     }
@@ -59,11 +59,83 @@ function stringArray(value) {
         return undefined;
     if (!Array.isArray(value))
         throw new Error('args must be a JSON array of strings.');
-    return value.map(item => String(item)).filter(item => item.length <= 4000).slice(0, 100);
+    if (value.length > 100 || value.some(item => typeof item !== 'string' || item.length > 4000 || item.includes(String.fromCharCode(0)))) {
+        throw new Error('args must contain at most 100 strings, each no longer than 4000 characters.');
+    }
+    return [...value];
+}
+function publicHttpUrl(value) {
+    if (!value)
+        return undefined;
+    try {
+        const parsed = new URL(value);
+        if (parsed.username)
+            parsed.username = '<redacted>';
+        if (parsed.password)
+            parsed.password = '<redacted>';
+        for (const key of Array.from(parsed.searchParams.keys())) {
+            if (/(?:api.?key|authorization|access.?token|secret|password|credential)/i.test(key))
+                parsed.searchParams.set(key, '<redacted>');
+        }
+        return parsed.toString();
+    }
+    catch {
+        return value;
+    }
+}
+function parseHttpUrl(value) {
+    let parsed;
+    try {
+        parsed = new URL(value);
+    }
+    catch {
+        throw new Error('An HTTP MCP server requires an http(s) URL.');
+    }
+    if (!['http:', 'https:'].includes(parsed.protocol))
+        throw new Error('An HTTP MCP server requires an http(s) URL.');
+    if (parsed.username || parsed.password)
+        throw new Error('Put HTTP credentials in headers, not in the MCP URL.');
+    return value;
+}
+function safeLoadedServer(value) {
+    try {
+        if (!value || typeof value !== 'object' || Array.isArray(value))
+            return undefined;
+        const item = value;
+        const id = String(item.id || '').trim();
+        const name = String(item.name || '').trim();
+        const transport = item.transport === 'http' ? 'http' : item.transport === 'stdio' ? 'stdio' : undefined;
+        if (!id || !name || !transport)
+            return undefined;
+        const command = String(item.command || '').trim();
+        const url = String(item.url || '').trim();
+        if (transport === 'stdio' && !command)
+            return undefined;
+        if (transport === 'http')
+            parseHttpUrl(url);
+        return {
+            id: id.slice(0, 200),
+            name: name.slice(0, 120),
+            enabled: item.enabled === true,
+            transport,
+            command: transport === 'stdio' ? command.slice(0, 2000) : undefined,
+            args: transport === 'stdio' ? (stringArray(item.args) || []) : undefined,
+            cwd: transport === 'stdio' ? String(item.cwd || '').trim().slice(0, 4000) || undefined : undefined,
+            url: transport === 'http' ? url.slice(0, 4000) : undefined,
+            env: transport === 'stdio' ? (stringRecord(item.env, 'env') || {}) : undefined,
+            headers: transport === 'http' ? (stringRecord(item.headers, 'headers') || {}) : undefined,
+            createdAt: String(item.createdAt || new Date(0).toISOString()),
+            updatedAt: String(item.updatedAt || item.createdAt || new Date(0).toISOString()),
+        };
+    }
+    catch {
+        return undefined;
+    }
 }
 class McpManager {
     filePath;
     state;
+    preserveCorruptSource = false;
     constructor(root) {
         this.filePath = path.join(root, 'MCP.json');
         this.state = this.load();
@@ -74,6 +146,7 @@ class McpManager {
             return {
                 ...publicServer,
                 args: [...(server.args || [])],
+                url: publicHttpUrl(server.url),
                 envKeys: Object.keys(env || {}).sort(),
                 headerKeys: Object.keys(headers || {}).sort(),
             };
@@ -81,22 +154,33 @@ class McpManager {
     }
     upsert(input) {
         const id = String(input.id || '').trim();
-        const existing = this.state.servers.find(server => server.id === id);
+        if (input.transport !== undefined && input.transport !== 'stdio' && input.transport !== 'http')
+            throw new Error('transport must be stdio or http.');
+        let existing = this.state.servers.find(server => server.id === id);
         const name = String(input.name ?? existing?.name ?? '').trim().slice(0, 120);
         if (!name)
             throw new Error('MCP server name is required.');
+        if (/[\r\n\0]/.test(name))
+            throw new Error('MCP server name contains invalid characters.');
         const transport = input.transport === 'http' ? 'http' : (input.transport === 'stdio' ? 'stdio' : existing?.transport || 'stdio');
         const command = String(input.command ?? existing?.command ?? '').trim();
-        const url = String(input.url ?? existing?.url ?? '').trim();
+        let url = String(input.url ?? existing?.url ?? '').trim();
         if (transport === 'stdio' && !command)
             throw new Error('A stdio MCP server requires a command.');
-        if (transport === 'http' && !/^https?:\/\//i.test(url))
-            throw new Error('An HTTP MCP server requires an http(s) URL.');
+        if (transport === 'stdio' && /[\r\n\0]/.test(command))
+            throw new Error('command contains an invalid value.');
+        if (transport === 'http')
+            url = parseHttpUrl(url);
+        if (!existing && !id) {
+            existing = this.state.servers.find(server => server.name.toLocaleLowerCase() === name.toLocaleLowerCase()
+                && server.transport === transport
+                && (transport === 'stdio' ? server.command === command : server.url === url));
+        }
         const now = new Date().toISOString();
         const server = {
             id: existing?.id || `mcp-${(0, crypto_1.randomUUID)()}`,
             name,
-            enabled: typeof input.enabled === 'boolean' ? input.enabled : existing?.enabled !== false,
+            enabled: typeof input.enabled === 'boolean' ? input.enabled : existing?.enabled === true,
             transport,
             command: transport === 'stdio' ? command.slice(0, 2000) : undefined,
             args: transport === 'stdio' ? (stringArray(input.args) ?? existing?.args ?? []) : undefined,
@@ -134,15 +218,21 @@ class McpManager {
     load() {
         try {
             const parsed = JSON.parse(fs.readFileSync(this.filePath, 'utf8'));
-            return { version: 1, servers: Array.isArray(parsed.servers) ? parsed.servers.filter(Boolean) : [] };
+            return { version: 1, servers: Array.isArray(parsed.servers) ? parsed.servers.map(safeLoadedServer).filter((server) => !!server) : [] };
         }
         catch {
+            this.preserveCorruptSource = fs.existsSync(this.filePath);
             return { version: 1, servers: [] };
         }
     }
     save() {
         fs.mkdirSync(path.dirname(this.filePath), { recursive: true });
-        const tempPath = `${this.filePath}.${process.pid}.tmp`;
+        if (this.preserveCorruptSource) {
+            const backupPath = `${this.filePath}.corrupt-${new Date().toISOString().replace(/[:.]/g, '-')}`;
+            fs.copyFileSync(this.filePath, backupPath);
+            this.preserveCorruptSource = false;
+        }
+        const tempPath = `${this.filePath}.${process.pid}-${(0, crypto_1.randomUUID)()}.tmp`;
         fs.writeFileSync(tempPath, JSON.stringify(this.state, null, 2), 'utf8');
         fs.renameSync(tempPath, this.filePath);
     }

package/dist/core/subagent.d.ts

@@ -223,6 +223,12 @@ export declare class SubagentManager {
     toRecord(idOrName: string): NewmarkSubagentRecord | undefined;
     toToolResult(idOrName: string, output: string, ok?: boolean): NewmarkSubagentToolResult;
     getResult(name: string): string;
+    /**
+     * 有界结果 transcript：subagent_result 注入主 Agent 上下文时，不再放大完整
+     * 消息历史（含所有中间 tool call/result 洪水）。只保留最近若干条非 tool 消息，
+     * 按字符上限截断，杜绝上下文回归。完整历史按需走 subagent_read(max_chars)。
+     */
+    boundedResultTranscript(idOrName: string): string;
     listActive(): SubagentInstance[];
     listAll(): SubagentInstance[];
     pauseScheduling(): void;

package/dist/core/subagent.js

@@ -193,7 +193,7 @@ class SubagentManager {
             fromAgentId,
             toAgentId: target.id,
             kind,
-            body,
+            body: truncateText(body, 32000),
             correlationId: details.correlationId,
             replyTo: details.replyTo,
             createdAt: now(),
@@ -481,6 +481,27 @@ class SubagentManager {
             return '';
         return record.result || record.messages.filter(message => message.role === 'assistant').map(message => message.content).join('\n');
     }
+    /**
+     * 有界结果 transcript：subagent_result 注入主 Agent 上下文时，不再放大完整
+     * 消息历史（含所有中间 tool call/result 洪水）。只保留最近若干条非 tool 消息，
+     * 按字符上限截断，杜绝上下文回归。完整历史按需走 subagent_read(max_chars)。
+     */
+    boundedResultTranscript(idOrName) {
+        const record = this.get(idOrName);
+        if (!record)
+            return '';
+        const MAX_MSG = 8; // 最近保留的消息条数
+        const MAX_CHARS = 8000; // 总字符上限
+        const messages = record.messages
+            .filter(message => message.role === 'assistant' || message.role === 'user' || message.role === 'system')
+            .slice(-MAX_MSG)
+            .map(message => `[${message.role}] ${truncateText(String(message.content || ''), 1200)}`);
+        let text = messages.join('\n');
+        if (text.length > MAX_CHARS) {
+            text = text.slice(0, MAX_CHARS) + `\n[...transcript truncated: ${record.messages.length} total messages, ${record.messages.length - MAX_MSG} older omitted; use subagent_read for full history...]`;
+        }
+        return text || '(no transcript)';
+    }
     listActive() { return this.listAll().filter(item => item.status !== 'closed'); }
     listAll() { return [...this.subs.values()].map(cloneRecord); }
     pauseScheduling() {

package/dist/core/toolPolicy.d.ts

@@ -14,9 +14,24 @@ export interface ToolPolicyDecision {
 }
 export declare const PLAN_COMPUTER_USE_ACTIONS: readonly ["observe", "app_list", "app_observe"];
 export declare const PLAN_BROWSER_USE_ACTIONS: readonly ["observe", "navigate", "wait", "extract"];
+/** 判断一个工具是否可参与并行调度。缺省 false（独占）。
+ *  优先看 toolchain registry 推断的 riskLevel（'read' 工具天然并发安全，
+ *  seedToolchainFromDefinitions 的 inferRiskLevel 自动推断），显式白名单作兜底。
+ *  这样后续新增工具只需在 ToolExecutor.definitions() 加 schema，seed 时其
+ *  riskLevel 被自动推断，'read' 工具自动并发安全——无需再改本文件。 */
+export declare function isConcurrencySafeTool(name: string, riskLevel?: string): boolean;
 export declare function isReadOnlyScopedToolAction(name: string, action: string): boolean;
 export declare function toolAvailability(name: string): ToolAvailability;
 export declare function evaluateToolPolicy(request: ToolPolicyRequest): ToolPolicyDecision;
 export declare function filterToolDefinitions<T>(definitions: T[], request: Omit<ToolPolicyRequest, 'name' | 'args'>): T[];
 export declare function planModePolicyPrompt(): string;
+export interface DeletionGuardDecision {
+    blocked: boolean;
+    reason?: string;
+}
+/**
+ * 硬性删除命令审查。blocked=true 表示该命令构成脚本/命令批量删除，必须拒绝并
+ * 引导 Agent 使用受监管的 delete_file 工具逐个删除。
+ */
+export declare function evaluateDeletionGuard(command: string): DeletionGuardDecision;
 //# sourceMappingURL=toolPolicy.d.ts.map

package/dist/core/toolPolicy.js

@@ -1,11 +1,13 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.PLAN_BROWSER_USE_ACTIONS = exports.PLAN_COMPUTER_USE_ACTIONS = void 0;
+exports.isConcurrencySafeTool = isConcurrencySafeTool;
 exports.isReadOnlyScopedToolAction = isReadOnlyScopedToolAction;
 exports.toolAvailability = toolAvailability;
 exports.evaluateToolPolicy = evaluateToolPolicy;
 exports.filterToolDefinitions = filterToolDefinitions;
 exports.planModePolicyPrompt = planModePolicyPrompt;
+exports.evaluateDeletionGuard = evaluateDeletionGuard;
 const REQUIRED_TOOLS = new Set(['pwd', 'read', 'glob', 'grep']);
 const MODE_SCOPED_TOOLS = new Set([
     'image_inspect',
@@ -16,6 +18,11 @@ const MODE_SCOPED_TOOLS = new Set([
     'build_history_query',
     'context_compress',
     'context_history_manage',
+    'compress_tool_result',
+    'background_tool',
+    'read_tool_result',
+    'goal_manage',
+    'conversation_rename',
     'question',
     'task',
     'subagent_list',
@@ -23,6 +30,10 @@ const MODE_SCOPED_TOOLS = new Set([
     'subagent_send',
     'subagent_result',
     'subagent_close',
+    'branch_list',
+    'branch_send',
+    'branch_read',
+    'branch_create',
 ]);
 const PLAN_READ_ONLY_TOOLS = new Set([
     'pwd',
@@ -51,12 +62,50 @@ const PLAN_READ_ONLY_TOOLS = new Set([
     'subagent_send',
     'subagent_result',
     'subagent_close',
+    'branch_list',
+    'branch_read',
     'question',
 ]);
 exports.PLAN_COMPUTER_USE_ACTIONS = ['observe', 'app_list', 'app_observe'];
 exports.PLAN_BROWSER_USE_ACTIONS = ['observe', 'navigate', 'wait', 'extract'];
 const PLAN_COMPUTER_USE_ACTION_SET = new Set(exports.PLAN_COMPUTER_USE_ACTIONS);
 const PLAN_BROWSER_USE_ACTION_SET = new Set(exports.PLAN_BROWSER_USE_ACTIONS);
+/**
+ * 并发安全工具集合（DSH isConcurrencySafe 语义的 Newmark 落地）。
+ *
+ * 只有确定性无副作用的只读工具才允许与兄弟 tool call 并发执行；任何写入、
+ * shell 命令、浏览器交互、子代理编排、以及会改变对话/文件/外部状态的工具
+ * 都保持独占串行，避免盲目 Promise.all 引发竞态。缺省保守：不在集合中的
+ * 工具一律视为独占。
+ *
+ * 注意：read/grep/glob/pwd 是同一进程内的内存/文件系统只读，可安全重叠；
+ * web_search/web_fetch 只读网络，可重叠；git_status/file_audit/repo_security_audit
+ * 只读审计，可重叠。其余（含 memory_lab_read 等读接口）因可能触发内部缓存/
+ * 重建副作用，默认保守串行。
+ */
+const CONCURRENCY_SAFE_TOOLS = new Set([
+    'pwd',
+    'read',
+    'glob',
+    'grep',
+    'web_search',
+    'web_fetch',
+    'git_status',
+    'file_audit',
+    'repo_security_audit',
+]);
+/** 判断一个工具是否可参与并行调度。缺省 false（独占）。
+ *  优先看 toolchain registry 推断的 riskLevel（'read' 工具天然并发安全，
+ *  seedToolchainFromDefinitions 的 inferRiskLevel 自动推断），显式白名单作兜底。
+ *  这样后续新增工具只需在 ToolExecutor.definitions() 加 schema，seed 时其
+ *  riskLevel 被自动推断，'read' 工具自动并发安全——无需再改本文件。 */
+function isConcurrencySafeTool(name, riskLevel) {
+    const toolName = String(name || '').trim();
+    if (CONCURRENCY_SAFE_TOOLS.has(toolName))
+        return true;
+    // 从 toolchain registry 派生的 riskLevel：read 工具默认并发安全。
+    return riskLevel === 'read';
+}
 function isReadOnlyScopedToolAction(name, action) {
     if (name === 'computer_use')
         return PLAN_COMPUTER_USE_ACTION_SET.has(action);
@@ -97,7 +146,7 @@ function evaluateToolPolicy(request) {
         }
     }
     if (request.isSubagent) {
-        if (name === 'skill_download' || name === 'question' || name.startsWith('automation_')) {
+        if (name === 'skill_download' || name === 'question' || name.startsWith('automation_') || name === 'goal_manage' || name === 'conversation_rename') {
             return { ...base, allowed: false, reason: `[Subagent sandbox] Tool '${name}' is disabled for peer agents.` };
         }
     }
@@ -119,4 +168,128 @@ function planModePolicyPrompt() {
         'Runtime policy rejects stale or hidden mutating tool calls even if a prompt asks for them.',
     ].join(' ');
 }
+/** 删除命令动词（跨 POSIX / PowerShell / cmd）。注意：不含单独 "remove"（避免匹配普通英文）。 */
+const DELETE_VERB_SOURCE = '(?:remove-item|rmdir|unlink|erase|del|rm|rd|ri)';
+const DELETE_VERB_BOUNDARY = new RegExp(`(?:^|[\\s;&|()\\n])${DELETE_VERB_SOURCE}(?:\\s|$)`, 'i');
+function hasDeletionVerb(text) {
+    return DELETE_VERB_BOUNDARY.test(text);
+}
+function deletionVerbCount(text) {
+    const matches = text.match(new RegExp(DELETE_VERB_BOUNDARY.source, 'gi'));
+    return matches ? matches.length : 0;
+}
+/** 循环结构批量删除：foreach / for…in / for( / while( / bash do…done。 */
+function hasLoopDeletion(text) {
+    const lower = text.toLowerCase();
+    if (/\bforeach\b/.test(lower))
+        return true; // PowerShell foreach
+    if (/\bfor\b\s*[$({]/.test(lower))
+        return true; // PowerShell/C for(...)
+    if (/\bfor\b\s+\S+\s+in\b/.test(lower))
+        return true; // bash for f in ...
+    if (/\bwhile\b\s*[({]/.test(lower))
+        return true; // while(...)
+    if (/\bwhile\b\s+\S/.test(lower) && /\bdo\b/.test(lower))
+        return true; // bash while ... do
+    if (/\bdone\b/.test(lower))
+        return true; // bash 循环结束标记
+    return false;
+}
+/** find -delete / find -exec rm / xargs rm 批量删除。 */
+function hasFindXargsDeletion(text) {
+    if (/\bfind\b[^\n;&|]*-(?:delete\b|exec(?:dir)?\s+(?:rm|del|erase)\b)/i.test(text))
+        return true;
+    if (/\bxargs\b[^\n;&|]*\b(?:rm|del|erase|remove-item)\b/i.test(text))
+        return true;
+    return false;
+}
+/** 按 shell 语义切分参数：引号内的空格不拆分，返回去引号后的 token。 */
+function splitCommandArgs(args) {
+    const tokens = [];
+    const re = /"([^"]*)"|'([^']*)'|(\S+)/g;
+    let m;
+    while ((m = re.exec(args)) !== null) {
+        const token = m[1] ?? m[2] ?? m[3] ?? '';
+        if (token)
+            tokens.push(token);
+    }
+    return tokens;
+}
+/** 管道接收端删除：上游产出多项，删除动词作为接收端即批量删除。 */
+function hasPipeDeletion(text) {
+    return new RegExp(`\\|\\s*${DELETE_VERB_SOURCE}\\b`, 'i').test(text);
+}
+/** 递归删除标志：rm -r/-R/--recursive、Remove-Item -Recurse、rmdir/rd /s、del /s。 */
+function hasRecursiveDeletionFlag(text) {
+    const lower = text.toLowerCase();
+    if (/\brm\b\s+(-[a-z]*r[a-z]*|--recursive)\b/.test(lower))
+        return true;
+    if (/\bremove-item\b[^\n;&|]*\s+-(?:recurse|r)\b/.test(lower))
+        return true;
+    if (/\b(?:rmdir|rd)\b\s+(-r\b|\/[s]\b)/.test(lower))
+        return true;
+    if (/\bdel\b\s+\/[s]\b/.test(lower))
+        return true;
+    return false;
+}
+/** 删除命令后跟含通配符的目标 token。 */
+function hasWildcardDeletionTarget(text) {
+    const segmentRe = new RegExp(`(?:^|[\\s;&|()\\n])${DELETE_VERB_SOURCE}([\\s][^;&|\\n]*)?`, 'gi');
+    let m;
+    while ((m = segmentRe.exec(text)) !== null) {
+        const args = m[1] || '';
+        for (const token of splitCommandArgs(args)) {
+            if (!token || token.startsWith('-') || /^\/[A-Za-z]/.test(token))
+                continue;
+            if (/[*?]/.test(token))
+                return true;
+        }
+    }
+    return false;
+}
+/** 单条删除命令后跟 >= 2 个明确目标（非 flag、非 shell 开关）。 */
+function hasMultipleDeleteTargets(text) {
+    const segmentRe = new RegExp(`(?:^|[\\s;&|()\\n])${DELETE_VERB_SOURCE}([\\s][^;&|\\n]*)?`, 'gi');
+    let m;
+    while ((m = segmentRe.exec(text)) !== null) {
+        const args = m[1] || '';
+        const targets = splitCommandArgs(args)
+            .filter(t => t && !t.startsWith('-') && !/^\/[A-Za-z]/.test(t) && !/^(&&|\|\||;|\||&|>|>>|<|2>&1)$/.test(t));
+        if (targets.length >= 2)
+            return true;
+    }
+    return false;
+}
+/**
+ * 硬性删除命令审查。blocked=true 表示该命令构成脚本/命令批量删除，必须拒绝并
+ * 引导 Agent 使用受监管的 delete_file 工具逐个删除。
+ */
+function evaluateDeletionGuard(command) {
+    const text = String(command || '');
+    if (!text.trim())
+        return { blocked: false };
+    // find -delete / find -exec rm 中，-delete 不含标准删除动词，需在入口单独识别为批量删除意图。
+    const findXargs = hasFindXargsDeletion(text);
+    if (!hasDeletionVerb(text) && !findXargs)
+        return { blocked: false };
+    const refuse = (kind) => ({
+        blocked: true,
+        reason: `[deletion guard] ${kind} batch deletion is not allowed. Delete files one by one with the delete_file tool under Agent supervision.`,
+    });
+    if (hasLoopDeletion(text))
+        return refuse('Loop-based');
+    if (findXargs)
+        return refuse('find/xargs');
+    if (hasPipeDeletion(text))
+        return refuse('Pipe-fed');
+    if (hasRecursiveDeletionFlag(text))
+        return refuse('Recursive');
+    if (hasWildcardDeletionTarget(text))
+        return refuse('Wildcard');
+    if (hasMultipleDeleteTargets(text))
+        return refuse('Multiple-target');
+    if (deletionVerbCount(text) >= 2)
+        return refuse('Multiple-statement');
+    return { blocked: false };
+}
 //# sourceMappingURL=toolPolicy.js.map

package/dist/core/types.d.ts

@@ -100,7 +100,7 @@ export interface ChatMessage {
 export interface AgentWorkEvent {
     id: string;
     conversationId: string;
-    type: 'start' | 'text' | 'response' | 'final_response' | 'tool_call' | 'tool_result' | 'status' | 'done' | 'error' | 'queue_update' | 'guide';
+    type: 'start' | 'text' | 'response' | 'final_response' | 'tool_call' | 'tool_result' | 'thought' | 'thought_result' | 'status' | 'done' | 'error' | 'queue_update' | 'guide';
     content: string;
     mode: string;
     model: string;

package/dist/core/utilityAgentProtocol.d.ts

@@ -1,6 +1,6 @@
 import { BrowserControlRequest, BrowserControlResult } from './browserControl';
 import { BrowserUseRequest } from './browserUse';
-import { AgentPromptMessage, ConversationKernelRunOptions, ConversationKernelRunResult, ConversationQueueMode, ConversationRuntimeState, ConversationStopResult } from './conversationKernel';
+import { AgentPromptMessage, ConversationContextCompressOptions, ConversationKernelRunOptions, ConversationKernelRunResult, ConversationQueueMode, ConversationRuntimeState, ConversationStopResult } from './conversationKernel';
 import { ConversationRuntimeTarget, NormalizedConversationTarget } from './conversationTarget';
 import { AgentMode, AgentWorkEvent, ConversationInputEnvelope, GuideReceipt } from './types';
 import type { AutoRouteRatingResult, ConversationSnapshot } from './agent';
@@ -102,6 +102,13 @@ export type UtilityAgentRequest = {
     params: {
         target: ConversationRuntimeTarget;
     };
+} | {
+    id: string;
+    method: 'context_compress';
+    params: {
+        target: ConversationRuntimeTarget;
+        options?: ConversationContextCompressOptions;
+    };
 } | {
     id: string;
     method: 'rate_auto_route';

package/dist/core/workspace.d.ts

@@ -23,6 +23,15 @@ export interface WorkspaceManagerOptions {
 }
 /** Normalize persisted Windows/WSL aliases and recover paths damaged by cross-host path.resolve calls. */
 export declare function normalizeHostWorkspacePath(input: string, platform?: NodeJS.Platform): string;
+/**
+ * An installed package is never a writable user workspace. Older builds could
+ * persist the install directory as an external workspace when the GUI was
+ * started from its shortcut working directory; restoring that entry then
+ * tried to create `<install>\\conversations` under Program Files. Keep this
+ * policy in the workspace layer so GUI, TUI, CLI, and detached runtimes all
+ * recover the same way.
+ */
+export declare function isProtectedInstallWorkspacePath(candidate: string): boolean;
 export declare class WorkspaceManager {
     rootPath: string;
     private config;

package/dist/core/workspace.js

@@ -35,6 +35,7 @@ var __importStar = (this && this.__importStar) || (function () {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.WorkspaceManager = void 0;
 exports.normalizeHostWorkspacePath = normalizeHostWorkspacePath;
+exports.isProtectedInstallWorkspacePath = isProtectedInstallWorkspacePath;
 const fs = __importStar(require("fs"));
 const path = __importStar(require("path"));
 const crypto = __importStar(require("crypto"));
@@ -64,6 +65,34 @@ function normalizeHostWorkspacePath(input, platform = process.platform) {
     }
     return path.posix.resolve(raw || '.');
 }
+function isPathInside(parent, child) {
+    try {
+        const relative = path.relative(path.resolve(parent), path.resolve(child));
+        return relative === '' || (!!relative && !relative.startsWith('..') && !path.isAbsolute(relative));
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * An installed package is never a writable user workspace. Older builds could
+ * persist the install directory as an external workspace when the GUI was
+ * started from its shortcut working directory; restoring that entry then
+ * tried to create `<install>\\conversations` under Program Files. Keep this
+ * policy in the workspace layer so GUI, TUI, CLI, and detached runtimes all
+ * recover the same way.
+ */
+function isProtectedInstallWorkspacePath(candidate) {
+    const value = String(candidate || '').trim();
+    if (!value)
+        return false;
+    const roots = [path.dirname(process.execPath)];
+    if (process.platform === 'win32') {
+        roots.push(process.env.ProgramFiles || '', process.env['ProgramFiles(x86)'] || '', process.env.ProgramW6432 || '');
+    }
+    const resolved = path.resolve(value);
+    return roots.filter(Boolean).some(root => isPathInside(root, resolved));
+}
 class WorkspaceManager {
     rootPath;
     config;
@@ -135,9 +164,18 @@ class WorkspaceManager {
         catch { /* empty */ }
         try {
             const ext = JSON.parse(fs.readFileSync(path.join(w, 'External.json'), 'utf-8'));
-            this.external = Array.isArray(ext)
+            const normalized = Array.isArray(ext)
                 ? ext.map(item => this.normalizeExternalWorkspace(item, changed => { externalChanged = externalChanged || changed; }))
                 : [];
+            this.external = normalized.filter(workspace => {
+                if (!isProtectedInstallWorkspacePath(workspace.path))
+                    return true;
+                // Never restore or persist the installation directory as a user
+                // workspace. It is a migration boundary for registries written by
+                // older versions and by package-level pressure tests.
+                externalChanged = true;
+                return false;
+            });
         }
         catch { /* empty */ }
         // Scan for directories not in Local.json
@@ -344,6 +382,15 @@ class WorkspaceManager {
     }
     restoreCurrent() {
         const stateCurrent = this.readState().current || null;
+        if (stateCurrent?.path && isProtectedInstallWorkspacePath(stateCurrent.path)) {
+            // The previous current workspace may have been filtered from
+            // External.json above. Clear the pointer instead of falling back to an
+            // arbitrary external directory; Agent can create/reuse a user-root
+            // internal workspace according to its normal configuration.
+            this.current = null;
+            this.saveState();
+            return;
+        }
         const stored = this.findWorkspace(stateCurrent);
         if (stored) {
             this.current = stored;

package/dist/core/wslAgentClient.d.ts

@@ -72,6 +72,10 @@ export declare class WslAgentClient {
     rewind(target: ConversationRuntimeTarget, messageIndex: number): Promise<WslConversationRewindResult>;
     enqueueGuide(target: ConversationRuntimeTarget, envelope: ConversationInputEnvelope): Promise<GuideReceipt>;
     checkpoint(target: ConversationRuntimeTarget): Promise<Record<string, unknown>>;
+    contextCompress(target: ConversationRuntimeTarget, options?: {
+        keepRecent?: number;
+        force?: boolean;
+    }): Promise<Record<string, unknown>>;
     rateAutoRoute(target: ConversationRuntimeTarget, score: number, routeId?: string): Promise<WslAutoRouteRatingResult>;
     setWorkRunExpanded(target: ConversationRuntimeTarget, runId: string, expanded: boolean): Promise<boolean>;
     setMode(target: ConversationRuntimeTarget, mode: AgentMode): Promise<AgentMode>;

package/dist/core/wslAgentClient.js

@@ -317,6 +317,10 @@ class WslAgentClient {
         await this.start();
         return await this.request('checkpoint', { target: await this.mapTarget(target) }, 5_000);
     }
+    async contextCompress(target, options = {}) {
+        await this.start();
+        return await this.request('context_compress', { target: await this.mapTarget(target), options }, 120_000);
+    }
     async rateAutoRoute(target, score, routeId = '') {
         await this.start();
         return await this.request('rate_auto_route', {

package/dist/core/wslAgentProtocol.d.ts

@@ -1,5 +1,5 @@
 import { AgentMode, AgentWorkEvent, ConversationInputEnvelope, GuideReceipt } from './types';
-import { AgentPromptMessage, ConversationKernelRunOptions, ConversationKernelRunResult, ConversationQueueMode, ConversationStopResult } from './conversationKernel';
+import { AgentPromptMessage, ConversationContextCompressOptions, ConversationKernelRunOptions, ConversationKernelRunResult, ConversationQueueMode, ConversationStopResult } from './conversationKernel';
 import { ConversationRuntimeTarget } from './conversationTarget';
 import { TerminalTakeoverEvent, TerminalTakeoverOwnerFilter, TerminalTakeoverState } from '../tools/terminalTakeover';
 import { BrowserUseRequest } from './browserUse';
@@ -114,6 +114,13 @@ export type WslAgentRequest = {
     params: {
         target: ConversationRuntimeTarget;
     };
+} | {
+    id: string;
+    method: 'context_compress';
+    params: {
+        target: ConversationRuntimeTarget;
+        options?: ConversationContextCompressOptions;
+    };
 } | {
     id: string;
     method: 'rate_auto_route';