sdlc-agent-4-enterprise-server 1.55.3 → 1.55.7

package/dist/config/ContentProxy.d.ts

@@ -30,5 +30,9 @@ export interface ContentProxyOverride {
     /** Disable the adapter entirely for this tool. */
     enabled?: boolean;
 }
-/** Empty by default — convention detection covers every current exporter. */
+/** Artifact output roots — dedicated sinks for orphaned artifact files. */
+export declare function artifactOutputRoots(): readonly string[];
+/** Check whether a real path falls inside one of the artifact roots. */
+export declare function isPathWithinRoot(root: string, candidate: string): boolean;
+/** Per-tool escape hatch for tools that defy the naming/description convention. */
 export declare const CONTENT_PROXY_OVERRIDES: Record<string, ContentProxyOverride>;

package/dist/config/ContentProxy.js

@@ -11,6 +11,7 @@
  *
  * Overrides exist only for tools that do not follow the convention.
  */
+import * as fs from 'fs';
 /** Tool-name prefixes whose result is a file written by the child server. */
 export const FILE_TOOL_NAME_PREFIXES = ['export_', 'render_', 'generate_'];
 /** Description fallback: "Convert ... to PDF/DOCX/…" (target must be a file format). */
@@ -31,6 +32,25 @@ export const CONTENT_PARAM_ALIASES = [
 export const NON_CONTENT_PARAM = /^(content_base64|.*_base64|file_path|.*_path|path|url|uri|dir|.*_id|id|name|.*_name|key|.*_key|token|secret|password|mime|.*_type|type|format|mode|encoding)$/i;
 /** Maximum artifact size inlined as base64 (mirrors the extension pre-read cap). */
 export const MAX_ARTIFACT_BYTES = 25 * 1024 * 1024;
-/** Empty by default — convention detection covers every current exporter. */
+/** Artifact output roots — dedicated sinks for orphaned artifact files. */
+export function artifactOutputRoots() {
+    // Convention: ARTIFACT_OUTPUT_ROOTS env var, or default per-workspace roots
+    const env = process.env.ARTIFACT_OUTPUT_ROOTS;
+    if (env)
+        return env.split(':').map((s) => s.trim()).filter(Boolean);
+    // Default: no roots configured → sweep will find nothing (safe no-op)
+    return [];
+}
+/** Check whether a real path falls inside one of the artifact roots. */
+export function isPathWithinRoot(root, candidate) {
+    try {
+        const real = fs.realpathSync(candidate);
+        return artifactOutputRoots().some((r) => real.startsWith(r));
+    }
+    catch {
+        return false;
+    }
+}
+/** Per-tool escape hatch for tools that defy the naming/description convention. */
 export const CONTENT_PROXY_OVERRIDES = {};
 //# sourceMappingURL=ContentProxy.js.map

package/dist/config/ContentProxy.js.map

@@ -1 +1 @@
-{"version":3,"file":"ContentProxy.js","sourceRoot":"","sources":["../../src/config/ContentProxy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,6EAA6E;AAC7E,MAAM,CAAC,MAAM,uBAAuB,GAAsB,CAAC,SAAS,EAAE,SAAS,EAAE,WAAW,CAAC,CAAC;AAE9F,wFAAwF;AACxF,MAAM,CAAC,MAAM,uBAAuB,GAAG,gEAAgE,CAAC;AAExG,qEAAqE;AACrE,MAAM,CAAC,MAAM,qBAAqB,GAAsB;IACtD,UAAU;IACV,kBAAkB;IAClB,SAAS;IACT,MAAM;IACN,KAAK;IACL,MAAM;IACN,MAAM;IACN,QAAQ;IACR,UAAU;CACX,CAAC;AAEF,6EAA6E;AAC7E,MAAM,CAAC,MAAM,iBAAiB,GAC5B,gKAAgK,CAAC;AAEnK,oFAAoF;AACpF,MAAM,CAAC,MAAM,kBAAkB,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;AAYnD,6EAA6E;AAC7E,MAAM,CAAC,MAAM,uBAAuB,GAAyC,EAAE,CAAC"}
+{"version":3,"file":"ContentProxy.js","sourceRoot":"","sources":["../../src/config/ContentProxy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AACzB,6EAA6E;AAC7E,MAAM,CAAC,MAAM,uBAAuB,GAAsB,CAAC,SAAS,EAAE,SAAS,EAAE,WAAW,CAAC,CAAC;AAE9F,wFAAwF;AACxF,MAAM,CAAC,MAAM,uBAAuB,GAAG,gEAAgE,CAAC;AAExG,qEAAqE;AACrE,MAAM,CAAC,MAAM,qBAAqB,GAAsB;IACtD,UAAU;IACV,kBAAkB;IAClB,SAAS;IACT,MAAM;IACN,KAAK;IACL,MAAM;IACN,MAAM;IACN,QAAQ;IACR,UAAU;CACX,CAAC;AAEF,6EAA6E;AAC7E,MAAM,CAAC,MAAM,iBAAiB,GAC5B,gKAAgK,CAAC;AAEnK,oFAAoF;AACpF,MAAM,CAAC,MAAM,kBAAkB,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;AAYnD,2EAA2E;AAC3E,MAAM,UAAU,mBAAmB;IACjC,4EAA4E;IAC5E,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC;IAC9C,IAAI,GAAG;QAAE,OAAO,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACpE,sEAAsE;IACtE,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,wEAAwE;AACxE,MAAM,UAAU,gBAAgB,CAAC,IAAY,EAAE,SAAiB;IAC9D,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,EAAE,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC;QACxC,OAAO,mBAAmB,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;IAC/D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,mFAAmF;AACnF,MAAM,CAAC,MAAM,uBAAuB,GAAyC,EAAE,CAAC"}

package/dist/modules/orchestration/artifact-cleanup/CleanupSweep.d.ts

@@ -0,0 +1,60 @@
+/**
+ * CleanupSweep — OI-15 periodic orphan reaper (TDD §9.2, BRD STORY 3 RD-8).
+ *
+ * Safety net for artifacts that escaped immediate cleanup (OI-14): crashes,
+ * power loss, permission errors. Per tick it scans ONLY the dedicated
+ * ARTIFACT_OUTPUT_ROOTS (SECURITY-REVIEW approval condition 2 — never the raw
+ * OS temp root, never the agent workspace). Roots are dedicated artifact
+ * sinks, so EVERY regular non-symlink file older than the TTL is swept —
+ * including job-dir nesting (`<root>/<job>/file`, how markdown-exporter
+ * writes) and arbitrary names (`STP-v1-SA4E-380.docx`); filename prefixes
+ * are NOT a criterion. Directories, symlinks, young files and anything
+ * outside the roots are always kept. Job directories emptied by the sweep
+ * are removed too. Each run is hard-bounded by maxRunMs and logs one
+ * summary line `{ removed, failed, skipped, durationMs }` with basenames only.
+ *
+ * Lifecycle: started/stopped next to the health monitor (OrchestrationModule);
+ * `enabled: false` never starts a timer.
+ */
+import type { Logger } from 'pino';
+import { type ArtifactCleanupConfig } from './cleanup-config.js';
+export interface SweepResult {
+    removed: number;
+    failed: number;
+    skipped: number;
+    durationMs: number;
+    /** True when the tick stopped early because maxRunMs elapsed (UT-48). */
+    bounded: boolean;
+}
+export interface CleanupSweepDeps {
+    /** Overrides loaded on top of the env-derived config (tests, ops). */
+    config?: Partial<ArtifactCleanupConfig>;
+    /** Scan roots override (tests); defaults to the configured artifact roots. */
+    roots?: readonly string[];
+    /** Deletion hook override (tests); defaults to fs.unlinkSync. */
+    removeFile?: (filePath: string) => void;
+}
+export declare class CleanupSweep {
+    private readonly logger;
+    private readonly config;
+    private readonly roots;
+    private readonly removeFile;
+    private timer?;
+    constructor(logger: Logger, deps?: CleanupSweepDeps);
+    /** Start the interval timer; no-op when disabled or already running. */
+    start(): void;
+    /** Stop the timer (idempotent). */
+    stop(): void;
+    /** Run one bounded sweep tick across all configured roots. */
+    runOnce(): SweepResult;
+    /** @returns false when the maxRunMs deadline was reached mid-scan. */
+    private scanRoot;
+    /** @returns false when the maxRunMs deadline was reached mid-scan. */
+    private scanJobDir;
+    private removeDirIfEmpty;
+    private sweepEntry;
+    /** Inside dedicated roots every regular non-symlink file qualifies — the
+     *  confinement boundary is the safety criterion, not the file name. */
+    private isCandidate;
+    private runTick;
+}

package/dist/modules/orchestration/artifact-cleanup/CleanupSweep.js

@@ -0,0 +1,159 @@
+/**
+ * CleanupSweep — OI-15 periodic orphan reaper (TDD §9.2, BRD STORY 3 RD-8).
+ *
+ * Safety net for artifacts that escaped immediate cleanup (OI-14): crashes,
+ * power loss, permission errors. Per tick it scans ONLY the dedicated
+ * ARTIFACT_OUTPUT_ROOTS (SECURITY-REVIEW approval condition 2 — never the raw
+ * OS temp root, never the agent workspace). Roots are dedicated artifact
+ * sinks, so EVERY regular non-symlink file older than the TTL is swept —
+ * including job-dir nesting (`<root>/<job>/file`, how markdown-exporter
+ * writes) and arbitrary names (`STP-v1-SA4E-380.docx`); filename prefixes
+ * are NOT a criterion. Directories, symlinks, young files and anything
+ * outside the roots are always kept. Job directories emptied by the sweep
+ * are removed too. Each run is hard-bounded by maxRunMs and logs one
+ * summary line `{ removed, failed, skipped, durationMs }` with basenames only.
+ *
+ * Lifecycle: started/stopped next to the health monitor (OrchestrationModule);
+ * `enabled: false` never starts a timer.
+ */
+import * as fs from 'fs';
+import * as path from 'path';
+import { artifactOutputRoots } from '../../../config/ContentProxy.js';
+import { loadArtifactCleanupConfig } from './cleanup-config.js';
+export class CleanupSweep {
+    logger;
+    config;
+    roots;
+    removeFile;
+    timer;
+    constructor(logger, deps = {}) {
+        this.logger = logger.child({ component: 'CleanupSweep' });
+        this.config = { ...loadArtifactCleanupConfig(), ...deps.config };
+        this.roots = deps.roots ?? artifactOutputRoots();
+        this.removeFile = deps.removeFile ?? ((filePath) => fs.unlinkSync(filePath));
+    }
+    /** Start the interval timer; no-op when disabled or already running. */
+    start() {
+        if (!this.config.enabled || this.timer)
+            return;
+        this.timer = setInterval(() => this.runTick(), this.config.intervalMs);
+        this.timer.unref?.();
+        this.logger.info({ intervalMs: this.config.intervalMs, ttlMs: this.config.ttlMs, roots: this.roots.length }, 'Artifact cleanup sweep started');
+    }
+    /** Stop the timer (idempotent). */
+    stop() {
+        if (!this.timer)
+            return;
+        clearInterval(this.timer);
+        this.timer = undefined;
+        this.logger.info('Artifact cleanup sweep stopped');
+    }
+    /** Run one bounded sweep tick across all configured roots. */
+    runOnce() {
+        const startedAt = Date.now();
+        const deadline = startedAt + this.config.maxRunMs;
+        const now = Date.now();
+        const result = { removed: 0, failed: 0, skipped: 0, durationMs: 0, bounded: false };
+        for (const root of this.roots) {
+            if (!this.scanRoot(root, now, deadline, result)) {
+                result.bounded = true;
+                break;
+            }
+        }
+        result.durationMs = Date.now() - startedAt;
+        this.logger.info({ removed: result.removed, failed: result.failed, skipped: result.skipped, durationMs: result.durationMs }, 'Artifact cleanup sweep tick completed');
+        if (result.bounded)
+            this.logger.warn({ maxRunMs: this.config.maxRunMs }, 'Artifact cleanup sweep stopped at maxRunMs bound');
+        return result;
+    }
+    /** @returns false when the maxRunMs deadline was reached mid-scan. */
+    scanRoot(root, now, deadline, result) {
+        let entries;
+        try {
+            entries = fs.readdirSync(root, { withFileTypes: true });
+        }
+        catch (err) {
+            this.logger.debug({ err }, 'Artifact cleanup sweep skipped unreadable root');
+            return true;
+        }
+        for (const entry of entries) {
+            if (Date.now() >= deadline)
+                return false;
+            if (entry.isDirectory() && !entry.isSymbolicLink()) {
+                // Child job dirs nest one level: <root>/<job>/<artifact>. Sweep their
+                // files, then remove the dir when the sweep emptied it.
+                const jobDir = path.join(root, entry.name);
+                if (!this.scanJobDir(jobDir, now, deadline, result))
+                    return false;
+                this.removeDirIfEmpty(jobDir, result);
+            }
+            else {
+                this.sweepEntry(root, entry, now, result);
+            }
+        }
+        return true;
+    }
+    /** @returns false when the maxRunMs deadline was reached mid-scan. */
+    scanJobDir(jobDir, now, deadline, result) {
+        let entries;
+        try {
+            entries = fs.readdirSync(jobDir, { withFileTypes: true });
+        }
+        catch (err) {
+            this.logger.debug({ err }, 'Artifact cleanup sweep skipped unreadable job dir');
+            return true;
+        }
+        for (const entry of entries) {
+            if (Date.now() >= deadline)
+                return false;
+            this.sweepEntry(jobDir, entry, now, result);
+        }
+        return true;
+    }
+    removeDirIfEmpty(jobDir, result) {
+        try {
+            const remaining = fs.readdirSync(jobDir);
+            if (remaining.length === 0) {
+                fs.rmdirSync(jobDir);
+                result.removed += 1;
+            }
+        }
+        catch {
+            // Non-empty or locked job dir stays — the next tick re-evaluates.
+        }
+    }
+    sweepEntry(dir, entry, now, result) {
+        const filePath = path.join(dir, entry.name);
+        if (!this.isCandidate(entry)) {
+            result.skipped += 1;
+            return;
+        }
+        try {
+            const stat = fs.lstatSync(filePath);
+            if (now - stat.mtimeMs <= this.config.ttlMs) {
+                result.skipped += 1;
+                return;
+            }
+            this.removeFile(filePath);
+            result.removed += 1;
+        }
+        catch (err) {
+            result.failed += 1;
+            this.logger.warn({ artifact: entry.name, err }, 'Artifact cleanup sweep failed to remove file');
+        }
+    }
+    /** Inside dedicated roots every regular non-symlink file qualifies — the
+     *  confinement boundary is the safety criterion, not the file name. */
+    isCandidate(entry) {
+        return entry.isFile() && !entry.isSymbolicLink();
+    }
+    runTick() {
+        try {
+            this.runOnce();
+        }
+        catch (err) {
+            this.logger.error({ err }, 'Artifact cleanup sweep tick failed');
+        }
+    }
+}
+//# sourceMappingURL=CleanupSweep.js.map

package/dist/modules/orchestration/artifact-cleanup/CleanupSweep.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"CleanupSweep.js","sourceRoot":"","sources":["../../../../src/modules/orchestration/artifact-cleanup/CleanupSweep.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAGH,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AACzB,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAC7B,OAAO,EAAE,mBAAmB,EAAE,MAAM,iCAAiC,CAAC;AACtE,OAAO,EAAE,yBAAyB,EAA8B,MAAM,qBAAqB,CAAC;AAoB5F,MAAM,OAAO,YAAY;IACN,MAAM,CAAS;IACf,MAAM,CAAwB;IAC9B,KAAK,CAAoB;IACzB,UAAU,CAA6B;IAChD,KAAK,CAAkB;IAE/B,YAAY,MAAc,EAAE,OAAyB,EAAE;QACrD,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,EAAE,SAAS,EAAE,cAAc,EAAE,CAAC,CAAC;QAC1D,IAAI,CAAC,MAAM,GAAG,EAAE,GAAG,yBAAyB,EAAE,EAAE,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;QACjE,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,mBAAmB,EAAE,CAAC;QACjD,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,UAAU,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC/E,CAAC;IAED,wEAAwE;IACxE,KAAK;QACH,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,IAAI,IAAI,CAAC,KAAK;YAAE,OAAO;QAC/C,IAAI,CAAC,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QACvE,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC;QACrB,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,EAAE,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,EAC1F,gCAAgC,CACjC,CAAC;IACJ,CAAC;IAED,mCAAmC;IACnC,IAAI;QACF,IAAI,CAAC,IAAI,CAAC,KAAK;YAAE,OAAO;QACxB,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC1B,IAAI,CAAC,KAAK,GAAG,SAAS,CAAC;QACvB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,gCAAgC,CAAC,CAAC;IACrD,CAAC;IAED,8DAA8D;IAC9D,OAAO;QACL,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC7B,MAAM,QAAQ,GAAG,SAAS,GAAG,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC;QAClD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,MAAM,GAAgB,EAAE,OAAO,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,UAAU,EAAE,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;QAEjG,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YAC9B,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,GAAG,EAAE,QAAQ,EAAE,MAAM,CAAC,EAAE,CAAC;gBAChD,MAAM,CAAC,OAAO,GAAG,IAAI,CAAC;gBACtB,MAAM;YACR,CAAC;QACH,CAAC;QAED,MAAM,CAAC,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;QAC3C,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,EAC1G,uCAAuC,CACxC,CAAC;QACF,IAAI,MAAM,CAAC,OAAO;YAAE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,EAAE,kDAAkD,CAAC,CAAC;QAC7H,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,sEAAsE;IAC9D,QAAQ,CAAC,IAAY,EAAE,GAAW,EAAE,QAAgB,EAAE,MAAmB;QAC/E,IAAI,OAAoB,CAAC;QACzB,IAAI,CAAC;YACH,OAAO,GAAG,EAAE,CAAC,WAAW,CAAC,IAAI,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1D,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,EAAE,gDAAgD,CAAC,CAAC;YAC7E,OAAO,IAAI,CAAC;QACd,CAAC;QACD,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;YAC5B,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,QAAQ;gBAAE,OAAO,KAAK,CAAC;YACzC,IAAI,KAAK,CAAC,WAAW,EAAE,IAAI,CAAC,KAAK,CAAC,cAAc,EAAE,EAAE,CAAC;gBACnD,sEAAsE;gBACtE,wDAAwD;gBACxD,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;gBAC3C,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,MAAM,CAAC;oBAAE,OAAO,KAAK,CAAC;gBAClE,IAAI,CAAC,gBAAgB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;YACxC,CAAC;iBAAM,CAAC;gBACN,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;YAC5C,CAAC;QACH,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,sEAAsE;IAC9D,UAAU,CAAC,MAAc,EAAE,GAAW,EAAE,QAAgB,EAAE,MAAmB;QACnF,IAAI,OAAoB,CAAC;QACzB,IAAI,CAAC;YACH,OAAO,GAAG,EAAE,CAAC,WAAW,CAAC,MAAM,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;QAC5D,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,EAAE,mDAAmD,CAAC,CAAC;YAChF,OAAO,IAAI,CAAC;QACd,CAAC;QACD,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;YAC5B,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,QAAQ;gBAAE,OAAO,KAAK,CAAC;YACzC,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;QAC9C,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAEO,gBAAgB,CAAC,MAAc,EAAE,MAAmB;QAC1D,IAAI,CAAC;YACH,MAAM,SAAS,GAAG,EAAE,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;YACzC,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC3B,EAAE,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;gBACrB,MAAM,CAAC,OAAO,IAAI,CAAC,CAAC;YACtB,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,kEAAkE;QACpE,CAAC;IACH,CAAC;IAEO,UAAU,CAAC,GAAW,EAAE,KAAgB,EAAE,GAAW,EAAE,MAAmB;QAChF,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QAC5C,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,EAAE,CAAC;YAC7B,MAAM,CAAC,OAAO,IAAI,CAAC,CAAC;YACpB,OAAO;QACT,CAAC;QACD,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,EAAE,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;YACpC,IAAI,GAAG,GAAG,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;gBAC5C,MAAM,CAAC,OAAO,IAAI,CAAC,CAAC;gBACpB,OAAO;YACT,CAAC;YACD,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;YAC1B,MAAM,CAAC,OAAO,IAAI,CAAC,CAAC;QACtB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,CAAC,MAAM,IAAI,CAAC,CAAC;YACnB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE,8CAA8C,CAAC,CAAC;QAClG,CAAC;IACH,CAAC;IAED;2EACuE;IAC/D,WAAW,CAAC,KAAgB;QAClC,OAAO,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,cAAc,EAAE,CAAC;IACnD,CAAC;IAEO,OAAO;QACb,IAAI,CAAC;YACH,IAAI,CAAC,OAAO,EAAE,CAAC;QACjB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,EAAE,oCAAoC,CAAC,CAAC;QACnE,CAAC;IACH,CAAC;CACF"}

package/dist/modules/orchestration/artifact-cleanup/artifact-roots.d.ts

@@ -0,0 +1,14 @@
+/**
+ * Artifact root helpers shared by OI-14 (immediate cleanup, content proxy) and
+ * OI-15 (periodic sweep). SECURITY-REVIEW F-01/F-05: local artifact access is
+ * confined to the dedicated ARTIFACT_OUTPUT_ROOTS — a path whose real location
+ * (symlinks resolved) falls outside them is never read and never deleted.
+ */
+/**
+ * F-01 — true only when the candidate's real path (fs.realpathSync, so symlink
+ * and `..` tricks are resolved away) sits inside one of the artifact roots.
+ * A missing path (ENOENT) or unreadable chain is not within the roots.
+ */
+export declare function isWithinArtifactRoots(candidate: string, roots?: readonly string[]): boolean;
+/** OI-15 — artifact file-name pattern: `export_*`, `render_*`, `generate_*`. */
+export declare function isArtifactFileName(name: string): boolean;

package/dist/modules/orchestration/artifact-cleanup/artifact-roots.js

@@ -0,0 +1,38 @@
+/**
+ * Artifact root helpers shared by OI-14 (immediate cleanup, content proxy) and
+ * OI-15 (periodic sweep). SECURITY-REVIEW F-01/F-05: local artifact access is
+ * confined to the dedicated ARTIFACT_OUTPUT_ROOTS — a path whose real location
+ * (symlinks resolved) falls outside them is never read and never deleted.
+ */
+import * as fs from 'fs';
+import * as path from 'path';
+import { FILE_TOOL_NAME_PREFIXES, artifactOutputRoots, isPathWithinRoot, } from '../../../config/ContentProxy.js';
+/**
+ * F-01 — true only when the candidate's real path (fs.realpathSync, so symlink
+ * and `..` tricks are resolved away) sits inside one of the artifact roots.
+ * A missing path (ENOENT) or unreadable chain is not within the roots.
+ */
+export function isWithinArtifactRoots(candidate, roots = artifactOutputRoots()) {
+    let real;
+    try {
+        real = fs.realpathSync(candidate);
+    }
+    catch {
+        return false;
+    }
+    return roots.some((root) => isPathWithinRoot(resolveRoot(root), real));
+}
+/** OI-15 — artifact file-name pattern: `export_*`, `render_*`, `generate_*`. */
+export function isArtifactFileName(name) {
+    const lower = name.toLowerCase();
+    return FILE_TOOL_NAME_PREFIXES.some((prefix) => lower.startsWith(prefix));
+}
+function resolveRoot(root) {
+    try {
+        return fs.realpathSync(root);
+    }
+    catch {
+        return path.resolve(root);
+    }
+}
+//# sourceMappingURL=artifact-roots.js.map

package/dist/modules/orchestration/artifact-cleanup/artifact-roots.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"artifact-roots.js","sourceRoot":"","sources":["../../../../src/modules/orchestration/artifact-cleanup/artifact-roots.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AACzB,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAC7B,OAAO,EACL,uBAAuB,EACvB,mBAAmB,EACnB,gBAAgB,GACjB,MAAM,iCAAiC,CAAC;AAEzC;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CACnC,SAAiB,EACjB,QAA2B,mBAAmB,EAAE;IAEhD,IAAI,IAAY,CAAC;IACjB,IAAI,CAAC;QACH,IAAI,GAAG,EAAE,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC;IACpC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,gBAAgB,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;AACzE,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,kBAAkB,CAAC,IAAY;IAC7C,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;IACjC,OAAO,uBAAuB,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC;AAC5E,CAAC;AAED,SAAS,WAAW,CAAC,IAAY;IAC/B,IAAI,CAAC;QACH,OAAO,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5B,CAAC;AACH,CAAC"}

package/dist/modules/orchestration/artifact-cleanup/cleanup-config.d.ts

@@ -0,0 +1,23 @@
+/**
+ * OI-15 — cleanup sweep configuration (TDD §9.2).
+ *
+ * BRD config keys → environment variables (backend reads config via env, the
+ * platform's existing pattern):
+ *   artifact.cleanup.enabled    → ARTIFACT_CLEANUP_ENABLED    (default true)
+ *   artifact.cleanup.intervalMs → ARTIFACT_CLEANUP_INTERVAL_MS (default 300_000)
+ *   artifact.cleanup.ttlMs      → ARTIFACT_CLEANUP_TTL_MS      (default 600_000)
+ *   artifact.cleanup.maxRunMs   → ARTIFACT_CLEANUP_MAX_RUN_MS  (default 30_000)
+ */
+export interface ArtifactCleanupConfig {
+    /** Master switch — false never starts the sweep timer. */
+    enabled: boolean;
+    /** Sweep cadence (timer-based). */
+    intervalMs: number;
+    /** Minimum file age before a matching artifact counts as orphaned. */
+    ttlMs: number;
+    /** Hard bound per sweep run; overrun → stop the tick and log. */
+    maxRunMs: number;
+}
+export declare const ARTIFACT_CLEANUP_DEFAULTS: Readonly<ArtifactCleanupConfig>;
+/** Load the cleanup config from the given environment (defaults when unset). */
+export declare function loadArtifactCleanupConfig(env?: NodeJS.ProcessEnv): ArtifactCleanupConfig;

package/dist/modules/orchestration/artifact-cleanup/cleanup-config.js

@@ -0,0 +1,35 @@
+/**
+ * OI-15 — cleanup sweep configuration (TDD §9.2).
+ *
+ * BRD config keys → environment variables (backend reads config via env, the
+ * platform's existing pattern):
+ *   artifact.cleanup.enabled    → ARTIFACT_CLEANUP_ENABLED    (default true)
+ *   artifact.cleanup.intervalMs → ARTIFACT_CLEANUP_INTERVAL_MS (default 300_000)
+ *   artifact.cleanup.ttlMs      → ARTIFACT_CLEANUP_TTL_MS      (default 600_000)
+ *   artifact.cleanup.maxRunMs   → ARTIFACT_CLEANUP_MAX_RUN_MS  (default 30_000)
+ */
+export const ARTIFACT_CLEANUP_DEFAULTS = Object.freeze({
+    enabled: true,
+    intervalMs: 300_000,
+    ttlMs: 600_000,
+    maxRunMs: 30_000,
+});
+/** Load the cleanup config from the given environment (defaults when unset). */
+export function loadArtifactCleanupConfig(env = process.env) {
+    return {
+        enabled: boolEnv(env['ARTIFACT_CLEANUP_ENABLED'], ARTIFACT_CLEANUP_DEFAULTS.enabled),
+        intervalMs: intEnv(env['ARTIFACT_CLEANUP_INTERVAL_MS'], ARTIFACT_CLEANUP_DEFAULTS.intervalMs),
+        ttlMs: intEnv(env['ARTIFACT_CLEANUP_TTL_MS'], ARTIFACT_CLEANUP_DEFAULTS.ttlMs),
+        maxRunMs: intEnv(env['ARTIFACT_CLEANUP_MAX_RUN_MS'], ARTIFACT_CLEANUP_DEFAULTS.maxRunMs),
+    };
+}
+function boolEnv(value, fallback) {
+    if (value === undefined || value === '')
+        return fallback;
+    return value === '1' || value.toLowerCase() === 'true';
+}
+function intEnv(value, fallback) {
+    const parsed = Number.parseInt(value ?? '', 10);
+    return Number.isFinite(parsed) && parsed > 0 ? parsed : fallback;
+}
+//# sourceMappingURL=cleanup-config.js.map

package/dist/modules/orchestration/artifact-cleanup/cleanup-config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cleanup-config.js","sourceRoot":"","sources":["../../../../src/modules/orchestration/artifact-cleanup/cleanup-config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAaH,MAAM,CAAC,MAAM,yBAAyB,GAAoC,MAAM,CAAC,MAAM,CAAC;IACtF,OAAO,EAAE,IAAI;IACb,UAAU,EAAE,OAAO;IACnB,KAAK,EAAE,OAAO;IACd,QAAQ,EAAE,MAAM;CACjB,CAAC,CAAC;AAEH,gFAAgF;AAChF,MAAM,UAAU,yBAAyB,CAAC,MAAyB,OAAO,CAAC,GAAG;IAC5E,OAAO;QACL,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,0BAA0B,CAAC,EAAE,yBAAyB,CAAC,OAAO,CAAC;QACpF,UAAU,EAAE,MAAM,CAAC,GAAG,CAAC,8BAA8B,CAAC,EAAE,yBAAyB,CAAC,UAAU,CAAC;QAC7F,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,yBAAyB,CAAC,EAAE,yBAAyB,CAAC,KAAK,CAAC;QAC9E,QAAQ,EAAE,MAAM,CAAC,GAAG,CAAC,6BAA6B,CAAC,EAAE,yBAAyB,CAAC,QAAQ,CAAC;KACzF,CAAC;AACJ,CAAC;AAED,SAAS,OAAO,CAAC,KAAyB,EAAE,QAAiB;IAC3D,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,EAAE;QAAE,OAAO,QAAQ,CAAC;IACzD,OAAO,KAAK,KAAK,GAAG,IAAI,KAAK,CAAC,WAAW,EAAE,KAAK,MAAM,CAAC;AACzD,CAAC;AAED,SAAS,MAAM,CAAC,KAAyB,EAAE,QAAgB;IACzD,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;IAChD,OAAO,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC;AACnE,CAAC"}

package/dist/modules/orchestration/artifact-cleanup/delete-artifact.d.ts

@@ -0,0 +1,21 @@
+/**
+ * OI-14 — delete-after-inline for local artifacts (TDD §9.1).
+ *
+ * Contract: after the backend has fully materialised an artifact's bytes, the
+ * source file is deleted. Best-effort with identity verification (F-06):
+ *  - the file is re-stat'ed and only unlinked when inode/size/mtime still match
+ *    the pre-read snapshot, so a concurrently replaced file is never deleted;
+ *  - ENOENT counts as success (already gone);
+ *  - any other failure is logged as a warning and never fails the tool call —
+ *    the bytes are already delivered and the periodic sweep (OI-15) retries.
+ */
+import * as fs from 'fs';
+/** Minimal pino-shaped logger so this module stays decoupled from wiring. */
+export interface CleanupLog {
+    warn(obj: unknown, msg?: string): void;
+}
+/**
+ * Delete the artifact at `filePath` after a successful read. `before` is the
+ * stat snapshot taken immediately before the read (F-06 identity check).
+ */
+export declare function deleteArtifactAfterRead(filePath: string, before: fs.Stats, log?: CleanupLog): void;

package/dist/modules/orchestration/artifact-cleanup/delete-artifact.js

@@ -0,0 +1,42 @@
+/**
+ * OI-14 — delete-after-inline for local artifacts (TDD §9.1).
+ *
+ * Contract: after the backend has fully materialised an artifact's bytes, the
+ * source file is deleted. Best-effort with identity verification (F-06):
+ *  - the file is re-stat'ed and only unlinked when inode/size/mtime still match
+ *    the pre-read snapshot, so a concurrently replaced file is never deleted;
+ *  - ENOENT counts as success (already gone);
+ *  - any other failure is logged as a warning and never fails the tool call —
+ *    the bytes are already delivered and the periodic sweep (OI-15) retries.
+ */
+import * as fs from 'fs';
+import * as path from 'path';
+/**
+ * Delete the artifact at `filePath` after a successful read. `before` is the
+ * stat snapshot taken immediately before the read (F-06 identity check).
+ */
+export function deleteArtifactAfterRead(filePath, before, log) {
+    try {
+        const after = fs.lstatSync(filePath);
+        if (!identityMatches(before, after)) {
+            warn(log, { artifact: path.basename(filePath) }, 'Artifact changed during read; skipped cleanup');
+            return;
+        }
+        fs.unlinkSync(filePath);
+    }
+    catch (err) {
+        if (err?.code === 'ENOENT')
+            return; // already gone — success per TDD §9.1
+        warn(log, { artifact: path.basename(filePath), err }, 'Artifact cleanup failed after inline');
+    }
+}
+function identityMatches(before, after) {
+    return after.ino === before.ino && after.size === before.size && after.mtimeMs === before.mtimeMs;
+}
+function warn(log, obj, msg) {
+    if (log)
+        log.warn(obj, msg);
+    else
+        console.warn(`[artifact-cleanup] ${msg}`, obj);
+}
+//# sourceMappingURL=delete-artifact.js.map

package/dist/modules/orchestration/artifact-cleanup/delete-artifact.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"delete-artifact.js","sourceRoot":"","sources":["../../../../src/modules/orchestration/artifact-cleanup/delete-artifact.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AACzB,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAO7B;;;GAGG;AACH,MAAM,UAAU,uBAAuB,CAAC,QAAgB,EAAE,MAAgB,EAAE,GAAgB;IAC1F,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,EAAE,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;QACrC,IAAI,CAAC,eAAe,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,CAAC;YACpC,IAAI,CAAC,GAAG,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,EAAE,+CAA+C,CAAC,CAAC;YAClG,OAAO;QACT,CAAC;QACD,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;IAC1B,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,IAAI,GAAG,EAAE,IAAI,KAAK,QAAQ;YAAE,OAAO,CAAC,sCAAsC;QAC1E,IAAI,CAAC,GAAG,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,GAAG,EAAE,EAAE,sCAAsC,CAAC,CAAC;IAChG,CAAC;AACH,CAAC;AAED,SAAS,eAAe,CAAC,MAAgB,EAAE,KAAe;IACxD,OAAO,KAAK,CAAC,GAAG,KAAK,MAAM,CAAC,GAAG,IAAI,KAAK,CAAC,IAAI,KAAK,MAAM,CAAC,IAAI,IAAI,KAAK,CAAC,OAAO,KAAK,MAAM,CAAC,OAAO,CAAC;AACpG,CAAC;AAED,SAAS,IAAI,CAAC,GAA2B,EAAE,GAAY,EAAE,GAAW;IAClE,IAAI,GAAG;QAAE,GAAG,CAAC,IAAI,CAAC,GAAa,EAAE,GAAG,CAAC,CAAC;;QACjC,OAAO,CAAC,IAAI,CAAC,sBAAsB,GAAG,EAAE,EAAE,GAAG,CAAC,CAAC;AACtD,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sdlc-agent-4-enterprise-server",
-  "version": "1.55.3",
+  "version": "1.55.7",
   "description": "Code Intelligence MCP Server — multi-agent SDLC pipeline with semantic memory, code graph, and draw.io integration",
   "main": "dist/index.js",
   "bin": {

package/src/config/ContentProxy.ts

@@ -12,6 +12,7 @@
  * Overrides exist only for tools that do not follow the convention.
  */
 
+import * as fs from 'fs';
 /** Tool-name prefixes whose result is a file written by the child server. */
 export const FILE_TOOL_NAME_PREFIXES: readonly string[] = ['export_', 'render_', 'generate_'];
 
@@ -48,5 +49,24 @@ export interface ContentProxyOverride {
   enabled?: boolean;
 }
 
-/** Empty by default — convention detection covers every current exporter. */
+/** Artifact output roots — dedicated sinks for orphaned artifact files. */
+export function artifactOutputRoots(): readonly string[] {
+  // Convention: ARTIFACT_OUTPUT_ROOTS env var, or default per-workspace roots
+  const env = process.env.ARTIFACT_OUTPUT_ROOTS;
+  if (env) return env.split(':').map((s) => s.trim()).filter(Boolean);
+  // Default: no roots configured → sweep will find nothing (safe no-op)
+  return [];
+}
+
+/** Check whether a real path falls inside one of the artifact roots. */
+export function isPathWithinRoot(root: string, candidate: string): boolean {
+  try {
+    const real = fs.realpathSync(candidate);
+    return artifactOutputRoots().some((r) => real.startsWith(r));
+  } catch {
+    return false;
+  }
+}
+
+/** Per-tool escape hatch for tools that defy the naming/description convention. */
 export const CONTENT_PROXY_OVERRIDES: Record<string, ContentProxyOverride> = {};

package/src/modules/orchestration/artifact-cleanup/CleanupSweep.ts

@@ -0,0 +1,185 @@
+/**
+ * CleanupSweep — OI-15 periodic orphan reaper (TDD §9.2, BRD STORY 3 RD-8).
+ *
+ * Safety net for artifacts that escaped immediate cleanup (OI-14): crashes,
+ * power loss, permission errors. Per tick it scans ONLY the dedicated
+ * ARTIFACT_OUTPUT_ROOTS (SECURITY-REVIEW approval condition 2 — never the raw
+ * OS temp root, never the agent workspace). Roots are dedicated artifact
+ * sinks, so EVERY regular non-symlink file older than the TTL is swept —
+ * including job-dir nesting (`<root>/<job>/file`, how markdown-exporter
+ * writes) and arbitrary names (`STP-v1-SA4E-380.docx`); filename prefixes
+ * are NOT a criterion. Directories, symlinks, young files and anything
+ * outside the roots are always kept. Job directories emptied by the sweep
+ * are removed too. Each run is hard-bounded by maxRunMs and logs one
+ * summary line `{ removed, failed, skipped, durationMs }` with basenames only.
+ *
+ * Lifecycle: started/stopped next to the health monitor (OrchestrationModule);
+ * `enabled: false` never starts a timer.
+ */
+
+import type { Logger } from 'pino';
+import * as fs from 'fs';
+import * as path from 'path';
+import { artifactOutputRoots } from '../../../config/ContentProxy.js';
+import { loadArtifactCleanupConfig, type ArtifactCleanupConfig } from './cleanup-config.js';
+
+export interface SweepResult {
+  removed: number;
+  failed: number;
+  skipped: number;
+  durationMs: number;
+  /** True when the tick stopped early because maxRunMs elapsed (UT-48). */
+  bounded: boolean;
+}
+
+export interface CleanupSweepDeps {
+  /** Overrides loaded on top of the env-derived config (tests, ops). */
+  config?: Partial<ArtifactCleanupConfig>;
+  /** Scan roots override (tests); defaults to the configured artifact roots. */
+  roots?: readonly string[];
+  /** Deletion hook override (tests); defaults to fs.unlinkSync. */
+  removeFile?: (filePath: string) => void;
+}
+
+export class CleanupSweep {
+  private readonly logger: Logger;
+  private readonly config: ArtifactCleanupConfig;
+  private readonly roots: readonly string[];
+  private readonly removeFile: (filePath: string) => void;
+  private timer?: NodeJS.Timeout;
+
+  constructor(logger: Logger, deps: CleanupSweepDeps = {}) {
+    this.logger = logger.child({ component: 'CleanupSweep' });
+    this.config = { ...loadArtifactCleanupConfig(), ...deps.config };
+    this.roots = deps.roots ?? artifactOutputRoots();
+    this.removeFile = deps.removeFile ?? ((filePath) => fs.unlinkSync(filePath));
+  }
+
+  /** Start the interval timer; no-op when disabled or already running. */
+  start(): void {
+    if (!this.config.enabled || this.timer) return;
+    this.timer = setInterval(() => this.runTick(), this.config.intervalMs);
+    this.timer.unref?.();
+    this.logger.info(
+      { intervalMs: this.config.intervalMs, ttlMs: this.config.ttlMs, roots: this.roots.length },
+      'Artifact cleanup sweep started',
+    );
+  }
+
+  /** Stop the timer (idempotent). */
+  stop(): void {
+    if (!this.timer) return;
+    clearInterval(this.timer);
+    this.timer = undefined;
+    this.logger.info('Artifact cleanup sweep stopped');
+  }
+
+  /** Run one bounded sweep tick across all configured roots. */
+  runOnce(): SweepResult {
+    const startedAt = Date.now();
+    const deadline = startedAt + this.config.maxRunMs;
+    const now = Date.now();
+    const result: SweepResult = { removed: 0, failed: 0, skipped: 0, durationMs: 0, bounded: false };
+
+    for (const root of this.roots) {
+      if (!this.scanRoot(root, now, deadline, result)) {
+        result.bounded = true;
+        break;
+      }
+    }
+
+    result.durationMs = Date.now() - startedAt;
+    this.logger.info(
+      { removed: result.removed, failed: result.failed, skipped: result.skipped, durationMs: result.durationMs },
+      'Artifact cleanup sweep tick completed',
+    );
+    if (result.bounded) this.logger.warn({ maxRunMs: this.config.maxRunMs }, 'Artifact cleanup sweep stopped at maxRunMs bound');
+    return result;
+  }
+
+  /** @returns false when the maxRunMs deadline was reached mid-scan. */
+  private scanRoot(root: string, now: number, deadline: number, result: SweepResult): boolean {
+    let entries: fs.Dirent[];
+    try {
+      entries = fs.readdirSync(root, { withFileTypes: true });
+    } catch (err) {
+      this.logger.debug({ err }, 'Artifact cleanup sweep skipped unreadable root');
+      return true;
+    }
+    for (const entry of entries) {
+      if (Date.now() >= deadline) return false;
+      if (entry.isDirectory() && !entry.isSymbolicLink()) {
+        // Child job dirs nest one level: <root>/<job>/<artifact>. Sweep their
+        // files, then remove the dir when the sweep emptied it.
+        const jobDir = path.join(root, entry.name);
+        if (!this.scanJobDir(jobDir, now, deadline, result)) return false;
+        this.removeDirIfEmpty(jobDir, result);
+      } else {
+        this.sweepEntry(root, entry, now, result);
+      }
+    }
+    return true;
+  }
+
+  /** @returns false when the maxRunMs deadline was reached mid-scan. */
+  private scanJobDir(jobDir: string, now: number, deadline: number, result: SweepResult): boolean {
+    let entries: fs.Dirent[];
+    try {
+      entries = fs.readdirSync(jobDir, { withFileTypes: true });
+    } catch (err) {
+      this.logger.debug({ err }, 'Artifact cleanup sweep skipped unreadable job dir');
+      return true;
+    }
+    for (const entry of entries) {
+      if (Date.now() >= deadline) return false;
+      this.sweepEntry(jobDir, entry, now, result);
+    }
+    return true;
+  }
+
+  private removeDirIfEmpty(jobDir: string, result: SweepResult): void {
+    try {
+      const remaining = fs.readdirSync(jobDir);
+      if (remaining.length === 0) {
+        fs.rmdirSync(jobDir);
+        result.removed += 1;
+      }
+    } catch {
+      // Non-empty or locked job dir stays — the next tick re-evaluates.
+    }
+  }
+
+  private sweepEntry(dir: string, entry: fs.Dirent, now: number, result: SweepResult): void {
+    const filePath = path.join(dir, entry.name);
+    if (!this.isCandidate(entry)) {
+      result.skipped += 1;
+      return;
+    }
+    try {
+      const stat = fs.lstatSync(filePath);
+      if (now - stat.mtimeMs <= this.config.ttlMs) {
+        result.skipped += 1;
+        return;
+      }
+      this.removeFile(filePath);
+      result.removed += 1;
+    } catch (err) {
+      result.failed += 1;
+      this.logger.warn({ artifact: entry.name, err }, 'Artifact cleanup sweep failed to remove file');
+    }
+  }
+
+  /** Inside dedicated roots every regular non-symlink file qualifies — the
+   *  confinement boundary is the safety criterion, not the file name. */
+  private isCandidate(entry: fs.Dirent): boolean {
+    return entry.isFile() && !entry.isSymbolicLink();
+  }
+
+  private runTick(): void {
+    try {
+      this.runOnce();
+    } catch (err) {
+      this.logger.error({ err }, 'Artifact cleanup sweep tick failed');
+    }
+  }
+}

package/src/modules/orchestration/artifact-cleanup/__tests__/CleanupSweep.test.ts

@@ -0,0 +1,199 @@
+/**
+ * CleanupSweep — OI-15 unit tests (STC §2.9 addendum, TDD §9.2).
+ * Real temp scan roots; injected removeFile for bound/failure cases.
+ */
+
+import { describe, it, expect, afterEach, vi } from 'vitest';
+import type { Logger } from 'pino';
+import * as fs from 'fs';
+import * as os from 'os';
+import * as path from 'path';
+import { CleanupSweep, type SweepResult } from '../CleanupSweep.js';
+import { ARTIFACT_CLEANUP_DEFAULTS, loadArtifactCleanupConfig } from '../cleanup-config.js';
+import { artifactOutputRoots } from '../../../../config/ContentProxy.js';
+
+const TMP = fs.mkdtempSync(path.join(os.tmpdir(), 'cleanup-sweep-'));
+afterEach(() => { vi.restoreAllMocks(); vi.useRealTimers(); });
+afterAll(() => fs.rmSync(TMP, { recursive: true, force: true }));
+
+function fakeLogger() {
+  const calls = { info: vi.fn(), warn: vi.fn(), error: vi.fn(), debug: vi.fn() };
+  const logger: any = { ...calls, child: () => logger };
+  return { logger: logger as unknown as Logger, calls };
+}
+
+function freshRoot(name: string): string {
+  const root = path.join(TMP, name);
+  fs.mkdirSync(root, { recursive: true });
+  return root;
+}
+
+function seedOld(root: string, name: string, ageMs: number): string {
+  const file = path.join(root, name);
+  fs.writeFileSync(file, Buffer.from(`orphan:${name}`));
+  const past = new Date(Date.now() - ageMs);
+  fs.utimesSync(file, past, past);
+  return file;
+}
+
+const TINY = { ttlMs: 60_000, intervalMs: 300_000, maxRunMs: 30_000, enabled: true };
+
+// STC: UT-47 — sweep removes orphans older than TTL (any name, incl. nested
+// job dirs); keeps young files, symlinks and everything outside the roots
+describe('CleanupSweep — TTL and pattern (UT-47)', () => {
+  it('removes old artifact files (any name, incl. nested job dirs) and keeps young and symlinked files', () => {
+    const root = freshRoot('ttl');
+    const removed = seedOld(root, 'export_r1.docx', 120_000);
+    const young = seedOld(root, 'export_r2.docx', 1_000);
+    // Real-world garbage: arbitrary names inside the dedicated root ARE orphans
+    const legacyDoc = seedOld(root, 'STP-v1-SA4E-380.docx', 120_000);
+    // Child job-dir nesting: <root>/<job>/<artifact>. Job dir holding a young
+    // file stays; a job dir emptied by the sweep is removed too.
+    const jobDir = path.join(root, 'a1b2c3d4e5f6');
+    fs.mkdirSync(jobDir, { recursive: true });
+    const nested = seedOld(jobDir, 'SECURITY-REVIEW-v1-SA4E-380.docx', 120_000);
+    const nestedYoung = seedOld(jobDir, 'fresh.docx', 1_000);
+    const jobDir2 = path.join(root, 'b2c3d4e5f6a1');
+    fs.mkdirSync(jobDir2, { recursive: true });
+    const nestedOnlyOld = seedOld(jobDir2, 'export_json-output.json', 120_000);
+    const symlink = path.join(root, 'export_l.docx');
+    let hasSymlink = true;
+    try {
+      fs.symlinkSync(young, symlink, 'file'); // target stays — dangling links would fake ENOENT
+    } catch {
+      hasSymlink = false; // Windows without symlink privilege — guard covered by isFile() filter
+    }
+
+    const { logger, calls } = fakeLogger();
+    const result = new CleanupSweep(logger, { roots: [root], config: TINY }).runOnce();
+
+    expect(fs.existsSync(removed)).toBe(false);
+    expect(fs.existsSync(legacyDoc)).toBe(false);
+    expect(fs.existsSync(nested)).toBe(false);
+    expect(fs.existsSync(nestedOnlyOld)).toBe(false);
+    expect(fs.existsSync(jobDir2)).toBe(false); // emptied by the sweep → dir removed
+    expect(fs.existsSync(jobDir)).toBe(true); // still holds the young file
+    expect(fs.existsSync(young)).toBe(true);
+    expect(fs.existsSync(nestedYoung)).toBe(true);
+    if (hasSymlink) expect(fs.existsSync(symlink)).toBe(true);
+    // removed: export_r1 + STP + nested SECURITY-REVIEW + nested json + emptied job dir = 5
+    expect(result.removed).toBe(5);
+    expect(result.failed).toBe(0);
+
+    const summary = calls.info.mock.calls.find(([, msg]) => msg === 'Artifact cleanup sweep tick completed');
+    expect(summary).toBeDefined();
+    expect(summary![0]).toMatchObject({ removed: 5, failed: 0, skipped: result.skipped });
+    expect(JSON.stringify(summary![0])).not.toContain(root); // I-3: no host paths in logs
+  });
+
+  it('never scans outside the configured roots (agent workspace untouched)', () => {
+    const root = freshRoot('confined');
+    const workspace = freshRoot('workspace');
+    const workspaceArtifact = seedOld(workspace, 'export_w.docx', 120_000);
+    seedOld(root, 'export_root.docx', 120_000);
+
+    const result = new CleanupSweep(fakeLogger().logger, { roots: [root], config: TINY }).runOnce();
+
+    expect(fs.existsSync(workspaceArtifact)).toBe(true);
+    expect(result.removed).toBe(1);
+  });
+});
+
+// STC: UT-48 — sweep bounds and configuration
+describe('CleanupSweep — bounds and configuration (UT-48)', () => {
+  it('stops the tick at maxRunMs and reports partial deletions honestly', () => {
+    const root = freshRoot('bound');
+    const total = 12;
+    for (let i = 0; i < total; i += 1) seedOld(root, `export_b${i}.docx`, 120_000);
+    const slowRemove = (filePath: string) => {
+      const until = Date.now() + 8; // simulate slow unlink without async
+      while (Date.now() < until) { /* busy */ }
+      fs.unlinkSync(filePath);
+    };
+
+    const { logger, calls } = fakeLogger();
+    const result = new CleanupSweep(logger, { roots: [root], config: { ...TINY, maxRunMs: 20 }, removeFile: slowRemove }).runOnce();
+
+    expect(result.bounded).toBe(true);
+    expect(result.removed).toBeGreaterThan(0);
+    expect(result.removed).toBeLessThan(total);
+    expect(calls.warn).toHaveBeenCalledWith({ maxRunMs: 20 }, 'Artifact cleanup sweep stopped at maxRunMs bound');
+    expect(result.durationMs).toBeLessThan(10_000);
+  });
+
+  it('continues after a failure and lists it with the basename only', () => {
+    const root = freshRoot('failure');
+    const locked = seedOld(root, 'export_locked.docx', 120_000);
+    seedOld(root, 'export_ok.docx', 120_000);
+    const removeFile = (filePath: string) => {
+      if (filePath === locked) throw Object.assign(new Error('EPERM'), { code: 'EPERM' });
+      fs.unlinkSync(filePath);
+    };
+
+    const { logger, calls } = fakeLogger();
+    const result = new CleanupSweep(logger, { roots: [root], config: TINY, removeFile }).runOnce();
+
+    expect(result).toMatchObject({ removed: 1, failed: 1, bounded: false });
+    expect(calls.warn).toHaveBeenCalledWith(
+      expect.objectContaining({ artifact: 'export_locked.docx' }),
+      'Artifact cleanup sweep failed to remove file',
+    );
+    expect(JSON.stringify(calls.warn.mock.calls.at(-1)?.[0])).not.toContain(root);
+  });
+
+  it('does not start a timer when enabled=false', () => {
+    const sweep = new CleanupSweep(fakeLogger().logger, { config: { enabled: false } });
+    sweep.start();
+    expect((sweep as any).timer).toBeUndefined();
+    sweep.stop();
+  });
+
+  it('runs on the configured interval once started and stops cleanly', () => {
+    vi.useFakeTimers();
+    const sweep = new CleanupSweep(fakeLogger().logger, { config: { ...TINY, intervalMs: 10 } });
+    const runOnce = vi.spyOn(sweep, 'runOnce').mockReturnValue({ removed: 0, failed: 0, skipped: 0, durationMs: 0, bounded: false } as SweepResult);
+
+    sweep.start();
+    vi.advanceTimersByTime(35);
+    expect(runOnce.mock.calls.length).toBeGreaterThanOrEqual(3);
+
+    sweep.stop();
+    vi.advanceTimersByTime(50);
+    expect(runOnce.mock.calls.length).toBe(3);
+  });
+});
+
+describe('cleanup configuration — env mapping (UT-48 step 3)', () => {
+  it('ships the documented defaults', () => {
+    expect(ARTIFACT_CLEANUP_DEFAULTS).toEqual({ enabled: true, intervalMs: 300_000, ttlMs: 600_000, maxRunMs: 30_000 });
+    expect(loadArtifactCleanupConfig({})).toEqual(ARTIFACT_CLEANUP_DEFAULTS);
+  });
+
+  it('applies env overrides for enabled/interval/ttl/maxRun', () => {
+    expect(loadArtifactCleanupConfig({
+      ARTIFACT_CLEANUP_ENABLED: 'false',
+      ARTIFACT_CLEANUP_INTERVAL_MS: '1000',
+      ARTIFACT_CLEANUP_TTL_MS: '50',
+      ARTIFACT_CLEANUP_MAX_RUN_MS: '10',
+    })).toEqual({ enabled: false, intervalMs: 1000, ttlMs: 50, maxRunMs: 10 });
+  });
+
+  it('defaults the roots to the dedicated artifact directories plus the child artifact home', () => {
+    const workspace = path.resolve(process.cwd());
+    const roots = artifactOutputRoots({});
+    expect(roots).toContain(path.join(os.tmpdir(), 'sa4e-artifacts'));
+    expect(roots).toContain(path.join(workspace, 'tmp', 'artifacts'));
+    // SA4E-380 F-01: the markdown-exporter child's own artifact home must be
+    // in the defaults, otherwise every local-path read fails confinement.
+    const childHome = process.platform === 'win32'
+      ? path.join(process.env.LOCALAPPDATA ?? '', 'markdown-exporter-mcp', 'artifacts')
+      : path.join(process.env.HOME ?? os.homedir(), '.cache', 'markdown-exporter-mcp', 'artifacts');
+    expect(roots).toContain(path.resolve(childHome));
+  });
+
+  it('honours the ARTIFACT_OUTPUT_ROOTS env override (path.delimiter separated)', () => {
+    const a = path.join(TMP, 'override-a');
+    const b = path.join(TMP, 'override-b');
+    expect(artifactOutputRoots({ ARTIFACT_OUTPUT_ROOTS: [a, b].join(path.delimiter) })).toEqual([a, b]);
+  });
+});

package/src/modules/orchestration/artifact-cleanup/artifact-roots.ts

@@ -0,0 +1,46 @@
+/**
+ * Artifact root helpers shared by OI-14 (immediate cleanup, content proxy) and
+ * OI-15 (periodic sweep). SECURITY-REVIEW F-01/F-05: local artifact access is
+ * confined to the dedicated ARTIFACT_OUTPUT_ROOTS — a path whose real location
+ * (symlinks resolved) falls outside them is never read and never deleted.
+ */
+
+import * as fs from 'fs';
+import * as path from 'path';
+import {
+  FILE_TOOL_NAME_PREFIXES,
+  artifactOutputRoots,
+  isPathWithinRoot,
+} from '../../../config/ContentProxy.js';
+
+/**
+ * F-01 — true only when the candidate's real path (fs.realpathSync, so symlink
+ * and `..` tricks are resolved away) sits inside one of the artifact roots.
+ * A missing path (ENOENT) or unreadable chain is not within the roots.
+ */
+export function isWithinArtifactRoots(
+  candidate: string,
+  roots: readonly string[] = artifactOutputRoots(),
+): boolean {
+  let real: string;
+  try {
+    real = fs.realpathSync(candidate);
+  } catch {
+    return false;
+  }
+  return roots.some((root) => isPathWithinRoot(resolveRoot(root), real));
+}
+
+/** OI-15 — artifact file-name pattern: `export_*`, `render_*`, `generate_*`. */
+export function isArtifactFileName(name: string): boolean {
+  const lower = name.toLowerCase();
+  return FILE_TOOL_NAME_PREFIXES.some((prefix) => lower.startsWith(prefix));
+}
+
+function resolveRoot(root: string): string {
+  try {
+    return fs.realpathSync(root);
+  } catch {
+    return path.resolve(root);
+  }
+}

package/src/modules/orchestration/artifact-cleanup/cleanup-config.ts

@@ -0,0 +1,48 @@
+/**
+ * OI-15 — cleanup sweep configuration (TDD §9.2).
+ *
+ * BRD config keys → environment variables (backend reads config via env, the
+ * platform's existing pattern):
+ *   artifact.cleanup.enabled    → ARTIFACT_CLEANUP_ENABLED    (default true)
+ *   artifact.cleanup.intervalMs → ARTIFACT_CLEANUP_INTERVAL_MS (default 300_000)
+ *   artifact.cleanup.ttlMs      → ARTIFACT_CLEANUP_TTL_MS      (default 600_000)
+ *   artifact.cleanup.maxRunMs   → ARTIFACT_CLEANUP_MAX_RUN_MS  (default 30_000)
+ */
+
+export interface ArtifactCleanupConfig {
+  /** Master switch — false never starts the sweep timer. */
+  enabled: boolean;
+  /** Sweep cadence (timer-based). */
+  intervalMs: number;
+  /** Minimum file age before a matching artifact counts as orphaned. */
+  ttlMs: number;
+  /** Hard bound per sweep run; overrun → stop the tick and log. */
+  maxRunMs: number;
+}
+
+export const ARTIFACT_CLEANUP_DEFAULTS: Readonly<ArtifactCleanupConfig> = Object.freeze({
+  enabled: true,
+  intervalMs: 300_000,
+  ttlMs: 600_000,
+  maxRunMs: 30_000,
+});
+
+/** Load the cleanup config from the given environment (defaults when unset). */
+export function loadArtifactCleanupConfig(env: NodeJS.ProcessEnv = process.env): ArtifactCleanupConfig {
+  return {
+    enabled: boolEnv(env['ARTIFACT_CLEANUP_ENABLED'], ARTIFACT_CLEANUP_DEFAULTS.enabled),
+    intervalMs: intEnv(env['ARTIFACT_CLEANUP_INTERVAL_MS'], ARTIFACT_CLEANUP_DEFAULTS.intervalMs),
+    ttlMs: intEnv(env['ARTIFACT_CLEANUP_TTL_MS'], ARTIFACT_CLEANUP_DEFAULTS.ttlMs),
+    maxRunMs: intEnv(env['ARTIFACT_CLEANUP_MAX_RUN_MS'], ARTIFACT_CLEANUP_DEFAULTS.maxRunMs),
+  };
+}
+
+function boolEnv(value: string | undefined, fallback: boolean): boolean {
+  if (value === undefined || value === '') return fallback;
+  return value === '1' || value.toLowerCase() === 'true';
+}
+
+function intEnv(value: string | undefined, fallback: number): number {
+  const parsed = Number.parseInt(value ?? '', 10);
+  return Number.isFinite(parsed) && parsed > 0 ? parsed : fallback;
+}

package/src/modules/orchestration/artifact-cleanup/delete-artifact.ts

@@ -0,0 +1,46 @@
+/**
+ * OI-14 — delete-after-inline for local artifacts (TDD §9.1).
+ *
+ * Contract: after the backend has fully materialised an artifact's bytes, the
+ * source file is deleted. Best-effort with identity verification (F-06):
+ *  - the file is re-stat'ed and only unlinked when inode/size/mtime still match
+ *    the pre-read snapshot, so a concurrently replaced file is never deleted;
+ *  - ENOENT counts as success (already gone);
+ *  - any other failure is logged as a warning and never fails the tool call —
+ *    the bytes are already delivered and the periodic sweep (OI-15) retries.
+ */
+
+import * as fs from 'fs';
+import * as path from 'path';
+
+/** Minimal pino-shaped logger so this module stays decoupled from wiring. */
+export interface CleanupLog {
+  warn(obj: unknown, msg?: string): void;
+}
+
+/**
+ * Delete the artifact at `filePath` after a successful read. `before` is the
+ * stat snapshot taken immediately before the read (F-06 identity check).
+ */
+export function deleteArtifactAfterRead(filePath: string, before: fs.Stats, log?: CleanupLog): void {
+  try {
+    const after = fs.lstatSync(filePath);
+    if (!identityMatches(before, after)) {
+      warn(log, { artifact: path.basename(filePath) }, 'Artifact changed during read; skipped cleanup');
+      return;
+    }
+    fs.unlinkSync(filePath);
+  } catch (err: any) {
+    if (err?.code === 'ENOENT') return; // already gone — success per TDD §9.1
+    warn(log, { artifact: path.basename(filePath), err }, 'Artifact cleanup failed after inline');
+  }
+}
+
+function identityMatches(before: fs.Stats, after: fs.Stats): boolean {
+  return after.ino === before.ino && after.size === before.size && after.mtimeMs === before.mtimeMs;
+}
+
+function warn(log: CleanupLog | undefined, obj: unknown, msg: string): void {
+  if (log) log.warn(obj as object, msg);
+  else console.warn(`[artifact-cleanup] ${msg}`, obj);
+}

package/src/modules/orchestration/content-proxy/__tests__/content-proxy.cleanup.test.ts

@@ -0,0 +1,166 @@
+/**
+ * Content proxy — local cleanup suite (SA4E-380 STC §2.9 addendum, TDD §9.1).
+ * UT-44/45/46 + the F-01 confinement contract for `readLocalFile`.
+ * Split from content-proxy.test.ts to honour the 200-line file gate.
+ */
+
+import { describe, it, expect, afterAll, vi } from 'vitest';
+import * as fs from 'fs';
+import * as os from 'os';
+import * as path from 'path';
+import { pathToFileURL } from 'url';
+import { detectCapability } from '../detect.js';
+import { adaptInvocation } from '../invocation-adapter.js';
+import { adaptResult } from '../result-adapter.js';
+import { resolveArtifact, resolveContentBlock } from '../artifact-source.js';
+import type { ToolDefinition } from '../../../../types/tool.js';
+
+// ESM namespaces are not spy-able — route unlinkSync through a mutable ref so
+// the UT-45 failure case can simulate an undeletable (locked) artifact.
+const unlinkRef = vi.hoisted(() => ({ impl: null as null | (() => never) }));
+vi.mock('fs', async (importOriginal) => {
+  const actual = await importOriginal<typeof import('fs')>();
+  const real = actual.unlinkSync.bind(actual);
+  const unlinkSync = ((filePath: Parameters<typeof real>[0]) => {
+    if (unlinkRef.impl) return unlinkRef.impl(filePath);
+    return real(filePath);
+  }) as typeof actual.unlinkSync;
+  return { ...actual, unlinkSync };
+});
+
+const TMP = fs.mkdtempSync(path.join(os.tmpdir(), 'content-proxy-cleanup-'));
+const PREVIOUS_ROOTS = process.env['ARTIFACT_OUTPUT_ROOTS'];
+process.env['ARTIFACT_OUTPUT_ROOTS'] = TMP;
+afterAll(() => {
+  unlinkRef.impl = null;
+  if (PREVIOUS_ROOTS === undefined) delete process.env['ARTIFACT_OUTPUT_ROOTS'];
+  else process.env['ARTIFACT_OUTPUT_ROOTS'] = PREVIOUS_ROOTS;
+  fs.rmSync(TMP, { recursive: true, force: true });
+});
+
+const EXPORT_DOCX: ToolDefinition = {
+  name: 'export_docx',
+  description: 'Export a Markdown file to DOCX.',
+  category: 'orchestration',
+  inputSchema: { type: 'object', properties: { markdown: { type: 'string' } }, required: ['markdown'] },
+};
+
+const wrapperInvocation = () => adaptInvocation(detectCapability(EXPORT_DOCX)!, {
+  content_base64: Buffer.from('# x').toString('base64'),
+});
+
+describe('content proxy — local cleanup (OI-14)', () => {
+  // STC: UT-44 — immediate cleanup: local artifact deleted after successful inline
+  it('deletes the local artifact after its bytes are inlined (stat → ENOENT)', async () => {
+    const file = path.join(TMP, 'out.docx');
+    fs.writeFileSync(file, Buffer.from('DOCX-BYTES'));
+
+    const fetched = await resolveArtifact({ path: file, name: 'out.docx' }, {});
+
+    expect(fetched?.buffer.toString()).toBe('DOCX-BYTES');
+    expect(fs.existsSync(file)).toBe(false);
+  });
+
+  // STC: UT-44 step 3 — a file: URI read inherits deletion via readLocalFile
+  it('deletes artifacts read through a file: URI as well', async () => {
+    const file = path.join(TMP, 'cleanup-uri.docx');
+    fs.writeFileSync(file, Buffer.from('URI-BYTES'));
+
+    const fetched = await resolveArtifact({ uri: pathToFileURL(file).href, name: 'cleanup-uri.docx' }, {});
+
+    expect(fetched?.buffer.toString()).toBe('URI-BYTES');
+    expect(fs.existsSync(file)).toBe(false);
+  });
+
+  // STC: UT-45 — cleanup failure never fails the tool call; basename-only warning
+  it('keeps the bytes and warns (basename only) when unlink fails', async () => {
+    const file = path.join(TMP, 'locked.docx');
+    fs.writeFileSync(file, Buffer.from('LOCKED-BYTES'));
+    const warn = vi.spyOn(console, 'warn').mockImplementation(() => {});
+    unlinkRef.impl = () => {
+      throw Object.assign(new Error('EBUSY: resource busy'), { code: 'EBUSY' });
+    };
+    try {
+      const fetched = await resolveArtifact({ path: file, name: 'locked.docx' }, {});
+
+      expect(fetched?.buffer.toString()).toBe('LOCKED-BYTES');
+      expect(fs.existsSync(file)).toBe(true);
+      const logged = (warn.mock.calls.at(-1) ?? []).map((arg) => JSON.stringify(arg)).join(' ');
+      expect(logged).toContain('locked.docx');
+      expect(logged).not.toContain(TMP); // I-3: no host path in logs
+    } finally {
+      unlinkRef.impl = null;
+      warn.mockRestore();
+      fs.rmSync(file, { force: true });
+    }
+  });
+
+  // STC: UT-45 step 2 — a failed read never deletes anything
+  it('never deletes when the read fails (out-of-root or oversized)', async () => {
+    const outside = path.join(os.tmpdir(), `content-proxy-refused-${Date.now()}.docx`);
+    fs.writeFileSync(outside, Buffer.from('SECRET'));
+    const oversized = path.join(TMP, 'huge.docx');
+    fs.writeFileSync(oversized, Buffer.alloc(26 * 1024 * 1024, 'x'));
+    try {
+      await resolveArtifact({ path: outside, name: 'secret.docx' }, {});
+      await resolveArtifact({ path: oversized, name: 'huge.docx' }, {});
+      expect(fs.existsSync(outside)).toBe(true);
+      expect(fs.existsSync(oversized)).toBe(true);
+    } finally {
+      fs.rmSync(outside, { force: true });
+      fs.rmSync(oversized, { force: true });
+    }
+  });
+
+  // STC: UT-46 — resource/URL/blob-resolved artifacts are never deleted (OI-14 scope)
+  it('never deletes artifacts resolved via resources/read, URLs or content blocks', async () => {
+    const cleanup = vi.fn();
+    const readResource = async (uri: string) => (uri === 'artifact://job-7/UG.docx' ? Buffer.from('REMOTE-DOCX') : null);
+    const fetchUrl = async () => Buffer.from('HTTP-DOCX');
+
+    await resolveArtifact({ uri: 'artifact://job-7/UG.docx', name: 'UG.docx' }, { cleanup, readResource });
+    await resolveArtifact({ url: 'https://files.example/UG.docx', name: 'UG.docx' }, { cleanup, fetchUrl });
+    await resolveContentBlock(
+      { type: 'resource', resource: { uri: 'file:///srv/UG.docx', blob: Buffer.from('BLOB-DOCX').toString('base64') } },
+      { cleanup },
+    );
+
+    expect(cleanup).not.toHaveBeenCalled();
+  });
+
+  // Dep contract behind the McpClientManager wiring: local reads call cleanup with the pre-read stat.
+  it('invokes the injected cleanup hook only for local reads', async () => {
+    const cleanup = vi.fn();
+    const file = path.join(TMP, 'hooked.docx');
+    fs.writeFileSync(file, Buffer.from('HOOKED-BYTES'));
+
+    await resolveArtifact({ path: file, name: 'hooked.docx' }, { cleanup });
+
+    expect(cleanup).toHaveBeenCalledTimes(1);
+    expect(cleanup).toHaveBeenCalledWith(file, expect.objectContaining({ size: 12 }));
+  });
+
+  // SECURITY-REVIEW F-01 (High, binding): outside ARTIFACT_OUTPUT_ROOTS → no read, no delete, loud failure.
+  it('refuses out-of-root local paths and fails loudly as ARTIFACT_FETCH_FAILED', async () => {
+    const outside = fs.mkdtempSync(path.join(os.tmpdir(), 'content-proxy-outside-'));
+    try {
+      const file = path.join(outside, 'secret.docx');
+      fs.writeFileSync(file, Buffer.from('SECRET'));
+      const result = {
+        content: [{ type: 'text', text: JSON.stringify({ success: true, artifacts: [{ path: file, name: 'secret.docx', size: 6 }] }) }],
+        isError: false,
+      };
+
+      const fetched = await resolveArtifact({ path: file, name: 'secret.docx' }, {});
+      const adapted = await adaptResult(wrapperInvocation(), result, { serverName: 'local-exporter' });
+
+      expect(fetched).toBeNull(); // never read
+      expect(fs.existsSync(file)).toBe(true); // never deleted
+      expect(adapted.isError).toBe(true);
+      expect(adapted.content[0].text).toMatch(/ARTIFACT_FETCH_FAILED/);
+      expect(adapted.content[0].text).not.toContain(outside); // no host path leak
+    } finally {
+      fs.rmSync(outside, { recursive: true, force: true });
+    }
+  });
+});