openmates 0.11.0-alpha.14 → 0.11.0-alpha.16

package/dist/{chunk-NQ3NCRIL.js → chunk-TUPR2SL3.js}

@@ -3,7 +3,7 @@ import {
 } from "./chunk-SFTCIVE2.js";
 
 // src/client.ts
-import { randomUUID } from "crypto";
+import { randomUUID as randomUUID2 } from "crypto";
 import { platform as platform2, release } from "os";
 import { createInterface } from "readline/promises";
 import { stdin, stdout } from "process";
@@ -726,6 +726,12 @@ function loadSyncCache() {
   const filePath = join(ensureStateDir(), SYNC_CACHE_FILE);
   return readJsonFile(filePath);
 }
+function clearSyncCache() {
+  const filePath = join(ensureStateDir(), SYNC_CACHE_FILE);
+  if (existsSync2(filePath)) {
+    rmSync(filePath);
+  }
+}
 function isSyncCacheFresh(maxAgeMs = 3e5) {
   const cache = loadSyncCache();
   if (!cache) return false;
@@ -733,7 +739,9 @@ function isSyncCacheFresh(maxAgeMs = 3e5) {
 }
 
 // src/ws.ts
-import WebSocket from "ws";
+import { createRequire } from "module";
+var require2 = createRequire(import.meta.url);
+var WebSocket = require2("ws");
 var OpenMatesWsClient = class {
   socket;
   constructor(options) {
@@ -793,6 +801,14 @@ var OpenMatesWsClient = class {
   send(type, payload) {
     this.socket.send(JSON.stringify({ type, payload }));
   }
+  sendAsync(type, payload) {
+    return new Promise((resolve4, reject) => {
+      this.socket.send(JSON.stringify({ type, payload }), (error) => {
+        if (error) reject(error);
+        else resolve4();
+      });
+    });
+  }
   waitForMessage(expectedType, predicate, timeoutMs = 2e4) {
     return new Promise((resolve4, reject) => {
       const onMessage = (rawData) => {
@@ -895,35 +911,83 @@ var OpenMatesWsClient = class {
   collectAiResponse(userMessageId, chatId, options) {
     const timeoutMs = options?.timeoutMs ?? 9e4;
     const onStream = options?.onStream;
+    const asyncEmbedWaitMs = options?.asyncEmbedWaitMs ?? 12e4;
     return new Promise((resolve4, reject) => {
       let latestContent = "";
+      let messageId = null;
+      let taskId = null;
       let category = null;
       let modelName = null;
       let followUpSuggestions = [];
+      const embeds = /* @__PURE__ */ new Map();
+      const processingEmbedIds = /* @__PURE__ */ new Set();
       let aiResponseDone = false;
+      let postProcessingDone = false;
       const POST_PROCESSING_WINDOW_MS = 12e3;
       let postProcessingTimer = null;
+      let asyncEmbedTimer = null;
       const timeout = setTimeout(() => {
         cleanup();
         reject(new Error("Timed out waiting for AI response"));
       }, timeoutMs);
       const capture = (p) => {
+        if (typeof p.message_id === "string" && p.message_id)
+          messageId = p.message_id;
+        if (typeof p.task_id === "string" && p.task_id) taskId = p.task_id;
         if (typeof p.category === "string" && p.category) category = p.category;
         if (typeof p.model_name === "string" && p.model_name)
           modelName = p.model_name;
       };
+      const extractMessageContent = (message) => {
+        if (typeof message.content === "string") return message.content;
+        const content = message.content;
+        if (!content || typeof content !== "object") return "";
+        try {
+          const root = content;
+          const text = root.content?.[0]?.content?.[0]?.text;
+          return typeof text === "string" ? text : "";
+        } catch {
+          return "";
+        }
+      };
+      const finishPostProcessingWait = () => {
+        postProcessingDone = true;
+        maybeResolve();
+      };
+      const maybeResolve = () => {
+        if (!aiResponseDone || !postProcessingDone) return;
+        if (processingEmbedIds.size > 0 && !asyncEmbedTimer) {
+          asyncEmbedTimer = setTimeout(() => {
+            cleanup();
+            resolve4({
+              messageId,
+              taskId,
+              content: latestContent,
+              category,
+              modelName,
+              followUpSuggestions,
+              embeds: [...embeds.values()]
+            });
+          }, asyncEmbedWaitMs);
+          return;
+        }
+        if (processingEmbedIds.size > 0) return;
+        cleanup();
+        resolve4({
+          messageId,
+          taskId,
+          content: latestContent,
+          category,
+          modelName,
+          followUpSuggestions,
+          embeds: [...embeds.values()]
+        });
+      };
       const scheduleResolve = (content) => {
         aiResponseDone = true;
         latestContent = content;
-        postProcessingTimer = setTimeout(() => {
-          cleanup();
-          resolve4({
-            content: latestContent,
-            category,
-            modelName,
-            followUpSuggestions
-          });
-        }, POST_PROCESSING_WINDOW_MS);
+        clearTimeout(timeout);
+        postProcessingTimer = setTimeout(finishPostProcessingWait, POST_PROCESSING_WINDOW_MS);
       };
       const onMessage = (rawData) => {
         try {
@@ -939,9 +1003,27 @@ var OpenMatesWsClient = class {
             );
             return;
           }
+          if (type === "send_embed_data") {
+            const embedPayload = p.payload && typeof p.payload === "object" ? p.payload : p;
+            if (typeof embedPayload.chat_id === "string" && embedPayload.chat_id !== chatId) {
+              return;
+            }
+            const embedId = embedPayload.embed_id;
+            if (typeof embedId === "string" && embedId) {
+              const status = typeof embedPayload.status === "string" ? embedPayload.status : "finished";
+              embeds.set(embedId, embedPayload);
+              if (status === "processing") {
+                processingEmbedIds.add(embedId);
+              } else {
+                processingEmbedIds.delete(embedId);
+              }
+              maybeResolve();
+            }
+            return;
+          }
           if (type === "ai_message_update") {
             const msgId = p.user_message_id ?? p.userMessageId;
-            if (msgId !== userMessageId) return;
+            if (msgId !== userMessageId && p.chat_id !== chatId) return;
             capture(p);
             if (typeof p.full_content_so_far === "string") {
               latestContent = p.full_content_so_far;
@@ -966,7 +1048,7 @@ var OpenMatesWsClient = class {
           }
           if (type === "ai_background_response_completed") {
             const msgId = p.user_message_id ?? p.userMessageId;
-            if (msgId && msgId !== userMessageId) return;
+            if (msgId && msgId !== userMessageId && p.chat_id !== chatId) return;
             if (!msgId && p.chat_id !== chatId) return;
             capture(p);
             const content = typeof p.full_content === "string" ? p.full_content : latestContent;
@@ -974,6 +1056,25 @@ var OpenMatesWsClient = class {
             scheduleResolve(content);
             return;
           }
+          if (type === "chat_message_added") {
+            if (p.chat_id !== chatId) return;
+            const rawMessage = p.message;
+            if (!rawMessage || typeof rawMessage !== "object") return;
+            const message = rawMessage;
+            if (message.role !== "assistant") return;
+            const content = extractMessageContent(message);
+            if (!content) return;
+            capture(message);
+            if (typeof message.category === "string" && message.category) {
+              category = message.category;
+            }
+            if (typeof message.model_name === "string" && message.model_name) {
+              modelName = message.model_name;
+            }
+            onStream?.({ kind: "done", content, category, modelName });
+            scheduleResolve(content);
+            return;
+          }
           if (type === "ai_typing_started") {
             capture(p);
             onStream?.({
@@ -997,13 +1098,7 @@ var OpenMatesWsClient = class {
                 clearTimeout(postProcessingTimer);
                 postProcessingTimer = null;
               }
-              cleanup();
-              resolve4({
-                content: latestContent,
-                category,
-                modelName,
-                followUpSuggestions
-              });
+              finishPostProcessingWait();
             }
             return;
           }
@@ -1018,10 +1113,13 @@ var OpenMatesWsClient = class {
         if (aiResponseDone) {
           cleanup();
           resolve4({
+            messageId,
+            taskId,
             content: latestContent,
             category,
             modelName,
-            followUpSuggestions
+            followUpSuggestions,
+            embeds: [...embeds.values()]
           });
           return;
         }
@@ -1034,6 +1132,10 @@ var OpenMatesWsClient = class {
           clearTimeout(postProcessingTimer);
           postProcessingTimer = null;
         }
+        if (asyncEmbedTimer) {
+          clearTimeout(asyncEmbedTimer);
+          asyncEmbedTimer = null;
+        }
         this.socket.off("message", onMessage);
         this.socket.off("error", onError);
         this.socket.off("close", onClose);
@@ -1345,9 +1447,139 @@ function escapeRegExp(s) {
   return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 }
 
+// src/embedCreator.ts
+import { randomUUID, createHash as createHash3, randomBytes, webcrypto as webcrypto3 } from "crypto";
+import { encode as toonEncode } from "@toon-format/toon";
+var cryptoApi3 = webcrypto3;
+var AES_GCM_IV_LENGTH3 = 12;
+function bytesToBase642(input) {
+  return Buffer.from(input).toString("base64");
+}
+function toArrayBuffer2(input) {
+  return input.buffer.slice(input.byteOffset, input.byteOffset + input.byteLength);
+}
+async function encryptAesGcm(plaintext, rawKeyBytes) {
+  const iv = cryptoApi3.getRandomValues(new Uint8Array(AES_GCM_IV_LENGTH3));
+  const key = await cryptoApi3.subtle.importKey(
+    "raw",
+    toArrayBuffer2(rawKeyBytes),
+    { name: "AES-GCM" },
+    false,
+    ["encrypt"]
+  );
+  const encrypted = await cryptoApi3.subtle.encrypt(
+    { name: "AES-GCM", iv: toArrayBuffer2(iv) },
+    key,
+    new TextEncoder().encode(plaintext)
+  );
+  const cipherBytes = new Uint8Array(encrypted);
+  const combined = new Uint8Array(iv.length + cipherBytes.length);
+  combined.set(iv);
+  combined.set(cipherBytes, iv.length);
+  return bytesToBase642(combined);
+}
+async function wrapKey(embedKey, wrappingKey) {
+  const cryptoKey = await cryptoApi3.subtle.importKey(
+    "raw",
+    toArrayBuffer2(wrappingKey),
+    { name: "AES-GCM" },
+    false,
+    ["encrypt"]
+  );
+  const iv = cryptoApi3.getRandomValues(new Uint8Array(AES_GCM_IV_LENGTH3));
+  const encrypted = await cryptoApi3.subtle.encrypt(
+    { name: "AES-GCM", iv: toArrayBuffer2(iv) },
+    cryptoKey,
+    toArrayBuffer2(embedKey)
+  );
+  const cipherBytes = new Uint8Array(encrypted);
+  const combined = new Uint8Array(iv.length + cipherBytes.length);
+  combined.set(iv);
+  combined.set(cipherBytes, iv.length);
+  return bytesToBase642(combined);
+}
+function generateEmbedKey() {
+  return new Uint8Array(randomBytes(32));
+}
+function computeSHA256(content) {
+  return createHash3("sha256").update(content).digest("hex");
+}
+function toonEncodeContent(data) {
+  try {
+    return toonEncode(data);
+  } catch {
+    return JSON.stringify(data);
+  }
+}
+function generateEmbedId() {
+  return randomUUID();
+}
+function createEmbedReferenceBlock(type, embedId, url) {
+  const data = { type, embed_id: embedId };
+  if (url) data.url = url;
+  const ref = JSON.stringify(data, null, 2);
+  return "```json\n" + ref + "\n```";
+}
+async function encryptEmbed(embed, masterKey, chatKey, chatId, messageId, userId) {
+  try {
+    const embedKey = generateEmbedKey();
+    const encryptedContent = await encryptAesGcm(embed.content, embedKey);
+    const encryptedType = await encryptAesGcm(embed.type, embedKey);
+    const encryptedTextPreview = await encryptAesGcm(embed.textPreview, embedKey);
+    const hashedEmbedId = computeSHA256(embed.embedId);
+    const hashedChatId = computeSHA256(chatId);
+    const hashedMessageId = computeSHA256(messageId);
+    const hashedUserId = computeSHA256(userId);
+    const wrappedWithMaster = await wrapKey(embedKey, masterKey);
+    const nowSeconds = Math.floor(Date.now() / 1e3);
+    const embedKeys = [
+      {
+        hashed_embed_id: hashedEmbedId,
+        key_type: "master",
+        hashed_chat_id: null,
+        encrypted_embed_key: wrappedWithMaster,
+        hashed_user_id: hashedUserId,
+        created_at: nowSeconds
+      }
+    ];
+    if (chatKey) {
+      const wrappedWithChat = await wrapKey(embedKey, chatKey);
+      embedKeys.push({
+        hashed_embed_id: hashedEmbedId,
+        key_type: "chat",
+        hashed_chat_id: hashedChatId,
+        encrypted_embed_key: wrappedWithChat,
+        hashed_user_id: hashedUserId,
+        created_at: nowSeconds
+      });
+    }
+    return {
+      embed_id: embed.embedId,
+      encrypted_type: encryptedType,
+      encrypted_content: encryptedContent,
+      encrypted_text_preview: encryptedTextPreview,
+      status: embed.status,
+      hashed_chat_id: hashedChatId,
+      hashed_message_id: hashedMessageId,
+      hashed_user_id: hashedUserId,
+      file_path: embed.filePath,
+      content_hash: embed.contentHash,
+      text_length_chars: embed.textLengthChars,
+      created_at: nowSeconds,
+      updated_at: nowSeconds,
+      embed_keys: embedKeys
+    };
+  } catch (error) {
+    const msg = error instanceof Error ? error.message : String(error);
+    process.stderr.write(`\x1B[31mError:\x1B[0m Failed to encrypt embed: ${msg}
+`);
+    return null;
+  }
+}
+
 // src/shareEncryption.ts
-import { webcrypto as webcrypto3 } from "crypto";
-var crypto = webcrypto3;
+import { webcrypto as webcrypto4 } from "crypto";
+var crypto = webcrypto4;
 function base64UrlEncode(data) {
   return Buffer.from(data).toString("base64").replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
 }
@@ -1459,6 +1691,12 @@ function buildEmbedShareUrl(origin, embedId, blob) {
 }
 
 // src/client.ts
+function normalizeUnixSeconds(value, fallback) {
+  if (typeof value !== "number" || !Number.isFinite(value) || value <= 0) {
+    return fallback;
+  }
+  return value > 1e10 ? Math.floor(value / 1e3) : Math.floor(value);
+}
 var MEMORY_TYPE_REGISTRY = {
   "ai/communication_style": {
     appId: "ai",
@@ -1892,7 +2130,7 @@ var OpenMatesClient = class _OpenMatesClient {
       pin: pin.trim().toUpperCase(),
       token
     });
-    const sessionId = randomUUID();
+    const sessionId = randomUUID2();
     const login = await this.http.post(
       "/v1/auth/login",
       {
@@ -2387,7 +2625,7 @@ var OpenMatesClient = class _OpenMatesClient {
   async sendMessage(params) {
     let chatId;
     if (!params.chatId) {
-      chatId = randomUUID();
+      chatId = randomUUID2();
     } else if (params.chatId.length < 36) {
       const resolved = await this.resolveFullChatId(params.chatId);
       if (!resolved) {
@@ -2400,7 +2638,7 @@ var OpenMatesClient = class _OpenMatesClient {
       chatId = params.chatId;
     }
     const { ws, session } = await this.openWsClient();
-    const messageId = randomUUID();
+    const messageId = randomUUID2();
     const createdAt = Math.floor(Date.now() / 1e3);
     const isNewChat = !params.chatId;
     ws.send("set_active_chat", { chat_id: chatId });
@@ -2420,6 +2658,7 @@ var OpenMatesClient = class _OpenMatesClient {
     };
     let chatKeyBytes = null;
     let encryptedChatKey = null;
+    let baselineMessagesV = 0;
     if (!params.incognito) {
       const masterKey = this.getMasterKeyBytes();
       if (isNewChat) {
@@ -2439,6 +2678,7 @@ var OpenMatesClient = class _OpenMatesClient {
           (c) => String(c.details.id ?? "") === chatId || String(c.details.id ?? "").startsWith(chatId)
         );
         if (chat) {
+          baselineMessagesV = typeof chat.details.messages_v === "number" ? chat.details.messages_v : 0;
           const encKey = typeof chat.details.encrypted_chat_key === "string" ? chat.details.encrypted_chat_key : null;
           if (encKey) {
             chatKeyBytes = await decryptBytesWithAesGcm(encKey, masterKey);
@@ -2447,8 +2687,23 @@ var OpenMatesClient = class _OpenMatesClient {
         }
       }
     }
-    if (params.encryptedEmbeds && params.encryptedEmbeds.length > 0) {
-      messagePayload.encrypted_embeds = params.encryptedEmbeds;
+    const encryptedEmbeds = [...params.encryptedEmbeds ?? []];
+    if (!params.incognito && params.preparedEmbeds && params.preparedEmbeds.length > 0) {
+      const masterKey = this.getMasterKeyBytes();
+      for (const embed of params.preparedEmbeds) {
+        const encrypted = await encryptEmbed(
+          embed,
+          masterKey,
+          chatKeyBytes,
+          chatId,
+          messageId,
+          session.hashedEmail
+        );
+        if (encrypted) encryptedEmbeds.push(encrypted);
+      }
+    }
+    if (encryptedEmbeds.length > 0) {
+      messagePayload.encrypted_embeds = encryptedEmbeds;
     }
     ws.send("chat_message_added", messagePayload);
     if (!params.incognito && chatKeyBytes) {
@@ -2476,6 +2731,7 @@ var OpenMatesClient = class _OpenMatesClient {
       ws.send("encrypted_chat_metadata", metadataPayload);
     }
     let assistant = "";
+    let assistantMessageId = null;
     let category = null;
     let modelName = null;
     let followUpSuggestions = [];
@@ -2483,6 +2739,7 @@ var OpenMatesClient = class _OpenMatesClient {
     if (params.incognito) {
       try {
         const resp = await ws.collectAiResponse(messageId, chatId, streamOpts);
+        assistantMessageId = resp.messageId;
         assistant = resp.content;
         category = resp.category;
         modelName = resp.modelName;
@@ -2492,10 +2749,55 @@ var OpenMatesClient = class _OpenMatesClient {
     } else {
       try {
         const resp = await ws.collectAiResponse(messageId, chatId, streamOpts);
+        assistantMessageId = resp.messageId;
         assistant = resp.content;
         category = resp.category;
         modelName = resp.modelName;
         followUpSuggestions = resp.followUpSuggestions;
+        if (chatKeyBytes && assistant) {
+          const completedAt = Math.floor(Date.now() / 1e3);
+          const encryptedAssistantContent = await encryptWithAesGcmCombined(
+            assistant,
+            chatKeyBytes
+          );
+          const encryptedCategory = category ? await encryptWithAesGcmCombined(category, chatKeyBytes) : void 0;
+          const encryptedModelName = modelName ? await encryptWithAesGcmCombined(modelName, chatKeyBytes) : void 0;
+          const persistedAssistantMessageId = assistantMessageId ?? randomUUID2();
+          ws.send("ai_response_completed", {
+            chat_id: chatId,
+            message: {
+              message_id: persistedAssistantMessageId,
+              chat_id: chatId,
+              role: "assistant",
+              created_at: completedAt,
+              status: "synced",
+              user_message_id: messageId,
+              encrypted_content: encryptedAssistantContent,
+              encrypted_category: encryptedCategory,
+              encrypted_model_name: encryptedModelName
+            },
+            versions: {
+              messages_v: baselineMessagesV + 2,
+              last_edited_overall_timestamp: completedAt
+            }
+          });
+          await ws.waitForMessage(
+            "ai_response_storage_confirmed",
+            (payload) => {
+              const p = payload;
+              return p.message_id === persistedAssistantMessageId;
+            },
+            2e4
+          );
+          await this.persistStreamedEmbeds({
+            ws,
+            embeds: resp.embeds,
+            chatId,
+            chatKeyBytes,
+            fallbackMessageId: persistedAssistantMessageId
+          });
+          clearSyncCache();
+        }
       } finally {
         ws.close();
       }
@@ -2510,6 +2812,110 @@ var OpenMatesClient = class _OpenMatesClient {
       followUpSuggestions
     };
   }
+  async persistStreamedEmbeds(params) {
+    const finalized = new Map(
+      params.embeds.filter((embed) => {
+        const status = embed.status ?? "finished";
+        return embed.embed_id && embed.content && status !== "processing" && status !== "error" && status !== "cancelled";
+      }).map((embed) => [embed.embed_id, embed])
+    );
+    if (finalized.size === 0) return;
+    const session = this.requireSession();
+    const masterKey = this.getMasterKeyBytes();
+    const parentKeys = /* @__PURE__ */ new Map();
+    const processed = /* @__PURE__ */ new Set();
+    const makeKey = () => {
+      const key = new Uint8Array(32);
+      globalThis.crypto.getRandomValues(key);
+      return key;
+    };
+    const persistOne = async (embed, embedKey, isChild) => {
+      const now = Math.floor(Date.now() / 1e3);
+      const createdAt = normalizeUnixSeconds(embed.createdAt, now);
+      const updatedAt = normalizeUnixSeconds(embed.updatedAt, now);
+      const messageId = embed.message_id || params.fallbackMessageId;
+      const userId = embed.user_id || session.hashedEmail;
+      const hashedChatId = computeSHA256(params.chatId);
+      const hashedMessageId = computeSHA256(messageId);
+      const hashedUserId = computeSHA256(userId);
+      const hashedEmbedId = computeSHA256(embed.embed_id);
+      const encryptedContent = await encryptWithAesGcmCombined(
+        embed.content ?? "",
+        embedKey
+      );
+      const encryptedType = await encryptWithAesGcmCombined(
+        embed.type || "app_skill_use",
+        embedKey
+      );
+      const encryptedTextPreview = embed.text_preview ? await encryptWithAesGcmCombined(embed.text_preview, embedKey) : void 0;
+      await params.ws.sendAsync("store_embed", {
+        embed_id: embed.embed_id,
+        encrypted_type: encryptedType,
+        encrypted_content: encryptedContent,
+        encrypted_text_preview: encryptedTextPreview,
+        status: embed.status || "finished",
+        hashed_chat_id: hashedChatId,
+        hashed_message_id: hashedMessageId,
+        hashed_task_id: embed.task_id ? computeSHA256(embed.task_id) : void 0,
+        hashed_user_id: hashedUserId,
+        embed_ids: embed.embed_ids,
+        parent_embed_id: embed.parent_embed_id || void 0,
+        version_number: embed.version_number,
+        file_path: embed.file_path,
+        content_hash: embed.content_hash,
+        text_length_chars: embed.text_length_chars,
+        is_private: embed.is_private ?? false,
+        is_shared: embed.is_shared ?? false,
+        created_at: createdAt,
+        updated_at: updatedAt
+      });
+      if (!isChild) {
+        const keys = [
+          {
+            hashed_embed_id: hashedEmbedId,
+            key_type: "master",
+            hashed_chat_id: null,
+            encrypted_embed_key: await encryptBytesWithAesGcm(embedKey, masterKey),
+            hashed_user_id: hashedUserId,
+            created_at: now
+          },
+          {
+            hashed_embed_id: hashedEmbedId,
+            key_type: "chat",
+            hashed_chat_id: hashedChatId,
+            encrypted_embed_key: await encryptBytesWithAesGcm(
+              embedKey,
+              params.chatKeyBytes
+            ),
+            hashed_user_id: hashedUserId,
+            created_at: now
+          }
+        ];
+        await params.ws.sendAsync("store_embed_keys", { keys });
+        parentKeys.set(embed.embed_id, embedKey);
+      }
+    };
+    let madeProgress = true;
+    while (processed.size < finalized.size && madeProgress) {
+      madeProgress = false;
+      for (const embed of finalized.values()) {
+        if (processed.has(embed.embed_id)) continue;
+        const parentId = embed.parent_embed_id || null;
+        if (parentId && finalized.has(parentId) && !parentKeys.has(parentId)) {
+          continue;
+        }
+        const parentKey = parentId ? parentKeys.get(parentId) : void 0;
+        await persistOne(embed, parentKey ?? makeKey(), Boolean(parentKey));
+        processed.add(embed.embed_id);
+        madeProgress = true;
+      }
+    }
+    for (const embed of finalized.values()) {
+      if (processed.has(embed.embed_id)) continue;
+      await persistOne(embed, makeKey(), false);
+      processed.add(embed.embed_id);
+    }
+  }
   /**
    * Delete a chat by ID.
    *
@@ -3284,7 +3690,7 @@ Required: ${schema.required.join(", ")}`
         );
       }
     }
-    const entryId = params.entryId ?? randomUUID();
+    const entryId = params.entryId ?? randomUUID2();
     const now = Math.floor(Date.now() / 1e3);
     const hashedKey = hashItemKey(params.appId, params.itemType);
     const plaintextPayload = {
@@ -3556,7 +3962,7 @@ Required: ${schema.required.join(", ")}`
   makeWsClient(session) {
     return new OpenMatesWsClient({
       apiUrl: session.apiUrl,
-      sessionId: randomUUID(),
+      sessionId: randomUUID2(),
       wsToken: session.wsToken,
       refreshToken: session.cookies.auth_refresh_token ?? null,
       // Same User-Agent as login so OS-based device fingerprint hash matches.
@@ -3928,7 +4334,7 @@ function printLogo() {
 }
 
 // ../secret-scanner/src/registry.ts
-import { createRequire } from "module";
+import { createRequire as createRequire2 } from "module";
 
 // ../secret-scanner/src/types.ts
 var SECRET_ENV_PATTERNS = [
@@ -4062,8 +4468,8 @@ var SECRET_PATTERNS = [
 ];
 
 // ../secret-scanner/src/registry.ts
-var require2 = createRequire(import.meta.url);
-var AhoCorasick = require2("ahocorasick");
+var require3 = createRequire2(import.meta.url);
+var AhoCorasick = require3("ahocorasick");
 var MIN_SECRET_LENGTH = 8;
 var SecretRegistry = class {
   /** Map from plaintext value → registry entry */
@@ -4605,136 +5011,6 @@ import { readFileSync as readFileSync3, statSync, existsSync as existsSync3 } fr
 import { basename, extname, resolve } from "path";
 import { homedir as homedir3 } from "os";
 import { createHash as createHash4 } from "crypto";
-
-// src/embedCreator.ts
-import { randomUUID as randomUUID2, createHash as createHash3, randomBytes, webcrypto as webcrypto4 } from "crypto";
-import { encode as toonEncode } from "@toon-format/toon";
-var cryptoApi3 = webcrypto4;
-var AES_GCM_IV_LENGTH3 = 12;
-function bytesToBase643(input) {
-  return Buffer.from(input).toString("base64");
-}
-function toArrayBuffer2(input) {
-  return input.buffer.slice(input.byteOffset, input.byteOffset + input.byteLength);
-}
-async function encryptAesGcm(plaintext, rawKeyBytes) {
-  const iv = cryptoApi3.getRandomValues(new Uint8Array(AES_GCM_IV_LENGTH3));
-  const key = await cryptoApi3.subtle.importKey(
-    "raw",
-    toArrayBuffer2(rawKeyBytes),
-    { name: "AES-GCM" },
-    false,
-    ["encrypt"]
-  );
-  const encrypted = await cryptoApi3.subtle.encrypt(
-    { name: "AES-GCM", iv: toArrayBuffer2(iv) },
-    key,
-    new TextEncoder().encode(plaintext)
-  );
-  const cipherBytes = new Uint8Array(encrypted);
-  const combined = new Uint8Array(iv.length + cipherBytes.length);
-  combined.set(iv);
-  combined.set(cipherBytes, iv.length);
-  return bytesToBase643(combined);
-}
-async function wrapKey(embedKey, wrappingKey) {
-  const cryptoKey = await cryptoApi3.subtle.importKey(
-    "raw",
-    toArrayBuffer2(wrappingKey),
-    { name: "AES-GCM" },
-    false,
-    ["encrypt"]
-  );
-  const iv = cryptoApi3.getRandomValues(new Uint8Array(AES_GCM_IV_LENGTH3));
-  const encrypted = await cryptoApi3.subtle.encrypt(
-    { name: "AES-GCM", iv: toArrayBuffer2(iv) },
-    cryptoKey,
-    toArrayBuffer2(embedKey)
-  );
-  const cipherBytes = new Uint8Array(encrypted);
-  const combined = new Uint8Array(iv.length + cipherBytes.length);
-  combined.set(iv);
-  combined.set(cipherBytes, iv.length);
-  return bytesToBase643(combined);
-}
-function generateEmbedKey() {
-  return new Uint8Array(randomBytes(32));
-}
-function computeSHA256(content) {
-  return createHash3("sha256").update(content).digest("hex");
-}
-function toonEncodeContent(data) {
-  try {
-    return toonEncode(data);
-  } catch {
-    return JSON.stringify(data);
-  }
-}
-function generateEmbedId() {
-  return randomUUID2();
-}
-function createEmbedReferenceBlock(type, embedId) {
-  const ref = JSON.stringify({ type, embed_id: embedId }, null, 2);
-  return "```json\n" + ref + "\n```";
-}
-async function encryptEmbed(embed, masterKey, chatKey, chatId, messageId, userId) {
-  try {
-    const embedKey = generateEmbedKey();
-    const encryptedContent = await encryptAesGcm(embed.content, embedKey);
-    const encryptedType = await encryptAesGcm(embed.type, embedKey);
-    const encryptedTextPreview = await encryptAesGcm(embed.textPreview, embedKey);
-    const hashedEmbedId = computeSHA256(embed.embedId);
-    const hashedChatId = computeSHA256(chatId);
-    const hashedMessageId = computeSHA256(messageId);
-    const hashedUserId = computeSHA256(userId);
-    const wrappedWithMaster = await wrapKey(embedKey, masterKey);
-    const nowSeconds = Math.floor(Date.now() / 1e3);
-    const embedKeys = [
-      {
-        hashed_embed_id: hashedEmbedId,
-        key_type: "master",
-        hashed_chat_id: null,
-        encrypted_embed_key: wrappedWithMaster,
-        hashed_user_id: hashedUserId,
-        created_at: nowSeconds
-      }
-    ];
-    if (chatKey) {
-      const wrappedWithChat = await wrapKey(embedKey, chatKey);
-      embedKeys.push({
-        hashed_embed_id: hashedEmbedId,
-        key_type: "chat",
-        hashed_chat_id: hashedChatId,
-        encrypted_embed_key: wrappedWithChat,
-        hashed_user_id: hashedUserId,
-        created_at: nowSeconds
-      });
-    }
-    return {
-      embed_id: embed.embedId,
-      encrypted_type: encryptedType,
-      encrypted_content: encryptedContent,
-      encrypted_text_preview: encryptedTextPreview,
-      status: embed.status,
-      hashed_chat_id: hashedChatId,
-      hashed_message_id: hashedMessageId,
-      hashed_user_id: hashedUserId,
-      file_path: embed.filePath,
-      content_hash: embed.contentHash,
-      text_length_chars: embed.textLengthChars,
-      created_at: nowSeconds,
-      updated_at: nowSeconds,
-      embed_keys: embedKeys
-    };
-  } catch (error) {
-    const msg = error instanceof Error ? error.message : String(error);
-    process.stderr.write(`\x1B[31mError:\x1B[0m Failed to encrypt embed: ${msg}
-`);
-    return null;
-  }
-}
-
-// src/fileEmbed.ts
 var MAX_PER_FILE_SIZE = 100 * 1024 * 1024;
 var BLOCKED_EXTENSIONS = /* @__PURE__ */ new Set([
   ".pem",
@@ -5125,6 +5401,70 @@ function formatEmbedsForMessage(embeds) {
   return "\n" + embeds.map((e) => e.referenceBlock).join("\n");
 }
 
+// src/urlEmbed.ts
+var URL_PATTERN = /\bhttps?:\/\/[^\s<>()`"']+/gi;
+var FENCED_BLOCK_PATTERN = /(```[\s\S]*?```)/g;
+var TRAILING_URL_PUNCTUATION = /[.,!?;:]+$/;
+function trimTrailingUrlPunctuation(rawUrl) {
+  let url = rawUrl;
+  let suffix = "";
+  const punctuation = url.match(TRAILING_URL_PUNCTUATION)?.[0] ?? "";
+  if (punctuation) {
+    url = url.slice(0, -punctuation.length);
+    suffix = punctuation + suffix;
+  }
+  while (url.endsWith(")")) {
+    const openCount = (url.match(/\(/g) ?? []).length;
+    const closeCount = (url.match(/\)/g) ?? []).length;
+    if (closeCount <= openCount) break;
+    url = url.slice(0, -1);
+    suffix = `)${suffix}`;
+  }
+  return { url, suffix };
+}
+function createWebsiteEmbed(url) {
+  const embedId = generateEmbedId();
+  const content = toonEncodeContent({
+    url,
+    title: null,
+    description: null,
+    favicon: null,
+    image: null,
+    site_name: null,
+    fetched_at: (/* @__PURE__ */ new Date()).toISOString()
+  });
+  return {
+    embedId,
+    type: "web-website",
+    content,
+    textPreview: url,
+    status: "finished"
+  };
+}
+function replaceUrlsInText(text, embeds) {
+  return text.replace(URL_PATTERN, (rawUrl) => {
+    const { url, suffix } = trimTrailingUrlPunctuation(rawUrl);
+    if (!url) return rawUrl;
+    try {
+      new URL(url);
+    } catch {
+      return rawUrl;
+    }
+    const embed = createWebsiteEmbed(url);
+    embeds.push(embed);
+    return `${createEmbedReferenceBlock("website", embed.embedId, url)}${suffix}`;
+  });
+}
+function prepareUrlEmbeds(message) {
+  const embeds = [];
+  const parts = message.split(FENCED_BLOCK_PATTERN);
+  const processed = parts.map((part, index) => {
+    const isFence = index % 2 === 1 && part.startsWith("```");
+    return isFence ? part : replaceUrlsInText(part, embeds);
+  }).join("");
+  return { message: processed, embeds };
+}
+
 // src/embedRenderers.ts
 var str = (v) => typeof v === "string" && v.length > 0 ? v : null;
 var DIRECT_TYPES = /* @__PURE__ */ new Set([
@@ -8938,7 +9278,7 @@ async function sendMessageStreaming(client, params, redactor) {
       processedRawLength = raw.length;
     }
   };
-  const encryptedEmbeds = [];
+  const preparedEmbeds = [];
   let finalMessage = params.message;
   if (params.message.includes("@")) {
     try {
@@ -9045,31 +9385,7 @@ async function sendMessageStreaming(client, params, redactor) {
         if (embedRefs) {
           finalMessage += embedRefs;
         }
-        try {
-          const { masterKey, userId } = client.getEmbedEncryptionKeys();
-          for (const fe of fileResult.embeds) {
-            const encrypted = await encryptEmbed(
-              fe.embed,
-              masterKey,
-              null,
-              // chatKey — not available in CLI yet for new chats
-              params.chatId || "new",
-              // will be replaced by server
-              "pending",
-              // messageId set during send
-              userId
-            );
-            if (encrypted) {
-              encryptedEmbeds.push(encrypted);
-            }
-          }
-        } catch (err) {
-          const msg = err instanceof Error ? err.message : String(err);
-          process.stderr.write(
-            `\x1B[33mWarning:\x1B[0m Embed encryption failed: ${msg}. Files sent without encryption.
-`
-          );
-        }
+        preparedEmbeds.push(...fileResult.embeds.map((fileEmbed) => fileEmbed.embed));
       }
       if (parsed.resolved.length > 0 && !params.json) {
         clearTyping();
@@ -9084,12 +9400,15 @@ async function sendMessageStreaming(client, params, redactor) {
     } catch {
     }
   }
+  const urlResult = prepareUrlEmbeds(finalMessage);
+  finalMessage = urlResult.message;
+  preparedEmbeds.push(...urlResult.embeds);
   const result = await client.sendMessage({
     message: finalMessage,
     chatId: params.chatId,
     incognito: params.incognito,
     onStream,
-    encryptedEmbeds: encryptedEmbeds.length > 0 ? encryptedEmbeds : void 0
+    preparedEmbeds: preparedEmbeds.length > 0 ? preparedEmbeds : void 0
   });
   clearTyping();
   if (!params.json) {

package/dist/cli.js

@@ -2,7 +2,7 @@
 import {
   getExtForLang,
   serializeToYaml
-} from "./chunk-NQ3NCRIL.js";
+} from "./chunk-TUPR2SL3.js";
 import "./chunk-SFTCIVE2.js";
 export {
   getExtForLang,

package/dist/index.d.ts

@@ -105,6 +105,35 @@ interface MentionContext {
     memoryEntries: MemoryEntryInfo[];
 }
 
+/**
+ * @file Embed creation pipeline for the CLI — generates encrypted embeds
+ * with proper key wrapping, matching the web app's zero-knowledge architecture.
+ *
+ * For each embed:
+ * 1. Content is TOON-encoded (or JSON-fallback)
+ * 2. A random AES-256 embed key is generated
+ * 3. Content, type, and text_preview are encrypted with the embed key
+ * 4. The embed key is wrapped with both master key and chat key
+ * 5. SHA-256 hashes are computed for all IDs
+ * 6. The encrypted embed + wrapped keys are attached to chat_message_added
+ *
+ * Mirrors: cryptoService.ts (encryptWithEmbedKey, wrapEmbedKeyWithMasterKey,
+ *          wrapEmbedKeyWithChatKey, generateEmbedKey)
+ *          chatSyncServiceSenders.ts (encrypted_embeds construction)
+ *
+ * Architecture: docs/architecture/embeds.md
+ */
+/** A prepared embed ready for encryption and sending */
+interface PreparedEmbed {
+    embedId: string;
+    type: string;
+    content: string;
+    textPreview: string;
+    status: string;
+    filePath?: string;
+    contentHash?: string;
+    textLengthChars?: number;
+}
 /** A fully encrypted embed ready for the WebSocket payload */
 interface EncryptedEmbed {
     embed_id: string;
@@ -424,6 +453,8 @@ declare class OpenMatesClient {
         onStream?: (event: StreamEvent) => void;
         /** Encrypted file embeds to attach to the message (code, images, PDFs). */
         encryptedEmbeds?: EncryptedEmbed[];
+        /** Prepared embeds to encrypt after the real chat/message IDs are known. */
+        preparedEmbeds?: PreparedEmbed[];
     }): Promise<{
         chatId: string;
         assistant: string;
@@ -433,6 +464,7 @@ declare class OpenMatesClient {
         /** Follow-up suggestions from post-processing (may be empty for incognito chats). */
         followUpSuggestions: string[];
     }>;
+    private persistStreamedEmbeds;
     /**
      * Delete a chat by ID.
      *

package/dist/index.js

@@ -7,7 +7,7 @@ import {
   getExtForLang,
   parseNewChatSuggestionText,
   serializeToYaml
-} from "./chunk-NQ3NCRIL.js";
+} from "./chunk-TUPR2SL3.js";
 import "./chunk-SFTCIVE2.js";
 export {
   MATE_NAMES,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "openmates",
-  "version": "0.11.0-alpha.14",
+  "version": "0.11.0-alpha.16",
   "description": "OpenMates CLI and SDK",
   "type": "module",
   "main": "dist/index.js",
@@ -18,9 +18,11 @@
     "test:unit:crypto": "node --test --experimental-strip-types tests/crypto.test.ts",
     "test:unit:storage": "node --test --experimental-strip-types --loader ./tests/loader.mjs tests/storage.test.ts",
     "test:unit:keychain": "node --test --experimental-strip-types tests/keychain.test.ts",
+    "test:unit:ws": "node --test --experimental-strip-types tests/ws.test.ts",
+    "test:unit:url-embed": "node --test --experimental-strip-types --loader ./tests/loader.mjs tests/urlEmbed.test.ts",
     "test:unit:server": "node --test --experimental-strip-types tests/server.test.ts",
     "test:unit:cli": "node --test tests/cli.test.ts",
-    "test": "node --test --experimental-strip-types --loader ./tests/loader.mjs tests/crypto.test.ts tests/storage.test.ts tests/keychain.test.ts tests/mentions.test.ts tests/outputRedactor.test.ts tests/fileEmbed.test.ts tests/embedCreator.test.ts tests/shareEncryption.test.ts tests/server.test.ts && node --test tests/cli.test.ts"
+    "test": "node --test --experimental-strip-types --loader ./tests/loader.mjs tests/crypto.test.ts tests/storage.test.ts tests/keychain.test.ts tests/mentions.test.ts tests/outputRedactor.test.ts tests/fileEmbed.test.ts tests/embedCreator.test.ts tests/shareEncryption.test.ts tests/server.test.ts tests/ws.test.ts tests/urlEmbed.test.ts && node --test tests/cli.test.ts"
   },
   "keywords": [
     "openmates",