shortcutxl 0.3.85 → 0.3.87

package/BINARY-INVENTORY.json

@@ -1,14 +1,14 @@
 {
   "schemaVersion": 1,
-  "generatedAt": "2026-08-20T19:59:33.921Z",
+  "generatedAt": "2026-08-24T23:36:20.445Z",
   "package": "shortcutxl",
   "build": {
     "builder": "github-actions",
     "repository": "lyfegame/shortcut",
-    "sourceRef": "refs/heads/pwang724/fix-cli-app-approval-scrolling",
-    "sourceCommit": "9cc676833842002c8742057b44e12b6635f5888f",
-    "workflowRef": "lyfegame/shortcut/.github/workflows/release-shortcutxl.yml@refs/heads/pwang724/fix-cli-app-approval-scrolling",
-    "runId": "32411468790",
+    "sourceRef": "refs/heads/shortcutxl-0.3.87-release",
+    "sourceCommit": "932b5d424becf9729dc82c1da5c0d7d4ff8be22c",
+    "workflowRef": "lyfegame/shortcut/.github/workflows/release-shortcut-cli-npm-package.yml@refs/heads/shortcutxl-0.3.87-release",
+    "runId": "32789945621",
     "runnerOs": "Windows",
     "runnerImage": "win25-vs2026",
     "runnerImageVersion": "20260818.207.1"
@@ -550,7 +550,7 @@
     },
     {
       "path": "xll/python/Scripts/httpx.exe",
-      "sha256": "6f8a9f92f6a4069c9563897fac73999dd5b2ca8243f4777913ae4100fb51eae8",
+      "sha256": "0b542e5a9dc832d34f33d5c75e111e16f0d9d0100968e8405409018dbf329879",
       "source": "httpx console launcher installed into embedded Python",
       "version": "see packaged httpx distribution",
       "builtBy": "third-party",
@@ -558,7 +558,7 @@
     },
     {
       "path": "xll/python/Scripts/idna.exe",
-      "sha256": "f2222ae2caf7c715f65ed4d7769e0eb047bfd8cdaa0e8bb1298ffd4f9c9f4914",
+      "sha256": "d985abffe9723dd6672037af85ec4cbaae6b4d9f452028dc794b4d6d61514e05",
       "source": "Python package console launcher installed into embedded Python",
       "version": "see owning Python package metadata in site-packages",
       "builtBy": "third-party",
@@ -566,7 +566,7 @@
     },
     {
       "path": "xll/python/Scripts/pip.exe",
-      "sha256": "f60aaf7555f70c4076f52bf4bb58d6885273fe0dfd8dad13b5fbe6b46daa973b",
+      "sha256": "9c25f44908e9efe1afcad1e73d6de35927703f088e03fb35d764aff719bb6304",
       "source": "pip console launcher installed into embedded Python",
       "version": "see packaged pip distribution",
       "builtBy": "third-party",
@@ -574,7 +574,7 @@
     },
     {
       "path": "xll/python/Scripts/pip3.13.exe",
-      "sha256": "f60aaf7555f70c4076f52bf4bb58d6885273fe0dfd8dad13b5fbe6b46daa973b",
+      "sha256": "9c25f44908e9efe1afcad1e73d6de35927703f088e03fb35d764aff719bb6304",
       "source": "pip console launcher installed into embedded Python",
       "version": "see packaged pip distribution",
       "builtBy": "third-party",
@@ -582,7 +582,7 @@
     },
     {
       "path": "xll/python/Scripts/pip3.exe",
-      "sha256": "f60aaf7555f70c4076f52bf4bb58d6885273fe0dfd8dad13b5fbe6b46daa973b",
+      "sha256": "9c25f44908e9efe1afcad1e73d6de35927703f088e03fb35d764aff719bb6304",
       "source": "pip console launcher installed into embedded Python",
       "version": "see packaged pip distribution",
       "builtBy": "third-party",
@@ -590,7 +590,7 @@
     },
     {
       "path": "xll/python/Scripts/pywin32_postinstall.exe",
-      "sha256": "537ca79bfb736241887ca9017db7583dd6d566255d24f9005b598949ae1059d1",
+      "sha256": "00e246620113fd62b23749e74fa31cfb0dd486327abbff4ebda1fb40ba634b28",
       "source": "Python package console launcher installed into embedded Python",
       "version": "see owning Python package metadata in site-packages",
       "builtBy": "third-party",
@@ -598,7 +598,7 @@
     },
     {
       "path": "xll/python/Scripts/pywin32_testall.exe",
-      "sha256": "d0884c20bf24120ac7f100096f597452e5b01470bfdbc77c998fcc69ff58295a",
+      "sha256": "c6b2a8c33794368c0834b9dea8e97cc2c188a32c0d95c286c4cf258317af506a",
       "source": "Python package console launcher installed into embedded Python",
       "version": "see owning Python package metadata in site-packages",
       "builtBy": "third-party",

package/CHANGELOG.md

@@ -1,13 +1,20 @@
 # Changelog
 
-## [0.3.85]
+## [0.3.87]
 
+- **Shorty reviewers** - Inspector Shorty checks recent workbook changes for issues, while Doctor Shorty reviews your saved memory and personal skills.
+- **More reliable native app startup** - Fixed app bugs and resolved some app stability issues.
+
+## [0.3.86]
+
+- **Signed Windows installer and updates** - Shortcut now ships as a signed Windows app installer, with versioned installer and updater assets published on [GitHub Releases](https://github.com/lyfegame/shortcutxl-releases/releases).
+- **Clearer installation flow** - Windows setup guidance now describes Shortcut's bundled runtime, includes Office-wide recovery steps, and keeps Excel, Word, and PowerPoint integrations current during first run and upgrades.
 - **Scrollable approval dialogs** - Long approval requests in the native app now remain fully accessible.
 
 ## [0.3.84]
 
-- **UI improvements**
-- **Shared Office approvals** - Excel, Word, and PowerPoint now use one clearly labeled approval setting across the CLI and native app.
+- **Work across Excel, Word, and PowerPoint** - On Windows, Shortcut can now discover and work with open Word documents and PowerPoint presentations alongside Excel.
+- **Simpler skill setup and sync** - The native app now finds skills from Claude Code and Codex automatically, and adds a dedicated place to review and sync differences with Shortcut Cloud.
 
 ## [0.3.83]
 

package/SECURITY.md

@@ -11,7 +11,7 @@ The release workflow retains the exact npm tarball, its SHA-256 checksum, and it
 ```bash
 cosign verify-blob \
   --bundle shortcutxl-<version>.tgz.sigstore.json \
-  --certificate-identity "https://github.com/lyfegame/shortcut/.github/workflows/release-shortcutxl.yml@<source-ref>" \
+  --certificate-identity "https://github.com/lyfegame/shortcut/.github/workflows/release-shortcut-cli-npm-package.yml@<source-ref>" \
   --certificate-oidc-issuer "https://token.actions.githubusercontent.com" \
   shortcutxl-<version>.tgz
 ```

package/dist/app/agent-session-runtime-adapter.d.ts

@@ -16,6 +16,7 @@ import type { ToolRegistry } from '../contracts/host-tool-registry.js';
 import { type ThinkingLevel, type ToolDefinition } from '../core/index.js';
 import type { RuntimePermissionPolicy } from '../core/permission-policy.js';
 import { AgentSession, type FastModeDisabledReason } from './agent-session.js';
+import type { LocalShortyRuntime } from './background-agents/shorty/types.js';
 import type { ResourceLoader } from './resources/resource-loader.js';
 import type { AgentSessionSettingsStore } from './session/session-settings-store.js';
 import type { ProductSessionStore } from './session/session-store-types.js';
@@ -38,6 +39,10 @@ export interface CreateAgentSessionRuntimeAdapterOptions {
     approvalState?: AgentApprovalState;
     budgetLimits?: RuntimeBudgetLimits;
     enableToolSummaries?: boolean;
+    /** Enable local Doctor/Inspector background reviews for the interactive CLI. */
+    enableShortyReviews?: boolean;
+    /** Whether the current workbook backend supports unattended read-only inspection. */
+    isInspectorAvailable?: () => boolean;
     fastModeAllowed?: boolean;
     fastModeDisabledReason?: FastModeDisabledReason;
     modeName?: string;
@@ -58,6 +63,7 @@ export interface CreateAgentSessionRuntimeAdapterOptions {
 }
 export interface CreateAgentSessionRuntimeAdapterRuntimeResult {
     runtime: EmbeddedAgentRuntime;
+    shortyRuntime: LocalShortyRuntime;
 }
 export interface CreateAgentSessionRuntimeAdapterResult extends CreateAgentSessionRuntimeAdapterRuntimeResult {
     extensionsResult: ReturnType<ResourceLoader['getExtensions']>;

package/dist/app/agent-session-runtime-adapter.js

@@ -17,6 +17,7 @@ import { createPendingHostToolRequests } from '../core/pending-host-tool-request
 import { getHostToolTimeoutMs } from '../embedded-agent/host-tools/timeouts.js';
 import { AgentSession, LoginRequiredError } from './agent-session.js';
 import { SessionAutoApproveState } from './approvals/session-auto-approve.js';
+import { createLocalShortyRuntime } from './background-agents/shorty/runtime.js';
 import { convertToLlm } from './messages.js';
 import { findInitialModel } from './providers/model-resolver.js';
 export async function resolveInitialSessionModel(options) {
@@ -50,7 +51,7 @@ export async function resolveInitialSessionModel(options) {
     }
     return { model: resolved.model, modelFallbackMessage };
 }
-function createAgentSessionCore(session, pendingHostToolRequests) {
+function createAgentSessionCore(session, pendingHostToolRequests, shortyRuntime) {
     // AgentSession itself doesn't carry a "the last turn was cancelled" flag —
     // cancellation just leaves the message stream truncated. Track it locally
     // so the next snapshot reflects AgentStopReason.Cancelled. Cleared on
@@ -67,6 +68,12 @@ function createAgentSessionCore(session, pendingHostToolRequests) {
             session.replaceToolsByName(configuration.toolNames);
             session.agent.setSystemPrompt(configuration.systemPrompt);
         },
+        async configureReviewBuddy(enabled) {
+            shortyRuntime.configureInspector(enabled);
+        },
+        async runContextReview(input) {
+            await shortyRuntime.runDoctor(input.trigger);
+        },
         async controlTask(request) {
             return {
                 ok: false,
@@ -79,6 +86,7 @@ function createAgentSessionCore(session, pendingHostToolRequests) {
             session.clearGoal();
         },
         dispose() {
+            shortyRuntime.dispose();
             session.dispose();
         },
         async getGoal() {
@@ -112,6 +120,9 @@ function createAgentSessionCore(session, pendingHostToolRequests) {
         },
         subscribeSnapshotSource(listener) {
             return session.subscribe(listener);
+        },
+        subscribeExtraEvents(listener) {
+            return shortyRuntime.subscribe(listener);
         }
     }, pendingHostToolRequests);
 }
@@ -254,9 +265,16 @@ export async function createAgentSessionRuntimeAdapter(options) {
         observability: options.observability,
         compactionComplete: completeSimple
     });
+    const shortyRuntime = createLocalShortyRuntime({
+        enabled: options.enableShortyReviews,
+        isInspectorAvailable: options.isInspectorAvailable,
+        modelRegistry,
+        session
+    });
     return {
         session,
-        runtime: createAgentSessionCore(session, pendingHostToolRequests),
+        runtime: createAgentSessionCore(session, pendingHostToolRequests, shortyRuntime),
+        shortyRuntime,
         extensionsResult: resourceLoader.getExtensions(),
         modelFallbackMessage
     };

package/dist/app/background-agents/durable-memory/coordinator.js

@@ -1,4 +1,3 @@
-import { SHORTCUT_LLM_PROXY_URL } from '../../../constants.js';
 import { getActiveUserMessageId } from '../../../core/user-message-id.js';
 import { DURABLE_MEMORY_AGENT_EFFORT, DURABLE_MEMORY_AGENT_MODEL, DURABLE_MEMORY_AGENT_TOOLS, DURABLE_MEMORY_TURN_END_CADENCE } from '../../extensions/durable-memory/constants.js';
 import { buildDurableMemoryPromptFragment } from '../../extensions/durable-memory/retrieval.js';
@@ -6,7 +5,6 @@ import { emitDurableMemoryStatus } from '../../extensions/durable-memory/status.
 import { validateWorkspaceState } from '../../extensions/durable-memory/validator.js';
 import { DurableMemoryWorkspace } from '../../extensions/durable-memory/workspace.js';
 import { deriveModePermissionPolicy } from '../../permissions/policy.js';
-import { createShortcutAuthRecovery } from '../../providers/shortcut-auth-recovery.js';
 import { resolveForkTraceDir } from '../../session/fork-trace-paths.js';
 import { runForkedAgent } from '../../session/forked-agent.js';
 import { durableMemoryAgent } from './memory-agent.js';
@@ -244,11 +242,6 @@ export class DurableMemoryCoordinator {
         const currentModel = ctx.model;
         if (!currentModel)
             return null;
-        // `ExtensionContext.modelRegistry` is typed as the neutral
-        // `AgentModelRegistry` interface, but every production path hands
-        // in the concrete `ModelRegistry` (which exposes `authStorage`).
-        // Cast here without a null check — tests mock a minimal registry
-        // and `createShortcutAuthRecovery(undefined)` is well-defined.
         const messages = ctx.getMessages();
         const userMessageId = ctx.userMessageId ?? getActiveUserMessageId(messages);
         if (!userMessageId)
@@ -300,7 +293,6 @@ export class DurableMemoryCoordinator {
         if (signal.aborted)
             return;
         const memoryModel = run.modelRegistry.find?.(run.model.provider, DURABLE_MEMORY_AGENT_MODEL) ?? run.model;
-        const baseUrl = memoryModel.baseUrl ?? run.model.baseUrl ?? SHORTCUT_LLM_PROXY_URL;
         const apiKey = await run.modelRegistry.getApiKey(memoryModel);
         if (!apiKey)
             return;
@@ -329,12 +321,9 @@ export class DurableMemoryCoordinator {
                 messages: run.messages,
                 tools,
                 model: memoryModel,
-                baseUrl,
-                apiKey,
+                modelRegistry: run.modelRegistry,
                 continuationRunId: run.continuationRunId,
-                getExtraHeaders: () => ({ 'X-Session-Id': run.sessionId }),
                 userMessageId: run.userMessageId,
-                recoverAuth: createShortcutAuthRecovery(run.modelRegistry.authStorage),
                 getToolContext: () => ({ permissionPolicy })
             }, {
                 kind: DURABLE_MEMORY_FORK_KIND,

package/dist/app/background-agents/durable-memory/memory-tools.js

@@ -1,54 +1,19 @@
-import { isAbsolute, relative, resolve, sep } from 'node:path';
 import { createEditTool } from '../../tools/edit.js';
-import { createGrepTool } from '../../tools/grep.js';
-import { createReadTool } from '../../tools/read.js';
+import { assertPathWithinAnyRoot, createScopedReadTools, wrapScopedTool } from '../../tools/scoped-file-tools.js';
 import { createWriteTool } from '../../tools/write.js';
-/** True if `targetPath` resolves to `rootDir` or one of its descendants. */
-function isWithinRoot(rootDir, targetPath) {
-    const relativePath = relative(resolve(rootDir), resolve(targetPath));
-    return (relativePath === '' ||
-        (relativePath !== '..' && !relativePath.startsWith(`..${sep}`) && !isAbsolute(relativePath)));
-}
 /** Throw if `inputPath` is outside the durable-memory write root. */
-function assertPathWithinRoot(rootDir, inputPath) {
-    const absolutePath = resolve(rootDir, inputPath);
-    if (!isWithinRoot(rootDir, absolutePath)) {
-        throw new Error(`Path is outside durable-memory root: ${inputPath}`);
-    }
-}
-/** Throw if `inputPath` is outside every allowed durable-memory read root. */
-function assertPathWithinAnyRoot(roots, inputPath) {
-    const absolutePath = resolve(roots[0], inputPath);
-    if (!roots.some((root) => isWithinRoot(root, absolutePath))) {
-        throw new Error(`Path is outside durable-memory read roots: ${inputPath}`);
-    }
-}
-/** Attach durable-memory path-policy validation to an underlying file tool. */
-function wrapScopedTool(tool, validate) {
-    return {
-        ...tool,
-        execute: async (toolCallId, rawParams, signal, onUpdate, ctx) => {
-            validate(rawParams);
-            return tool.execute(toolCallId, rawParams, signal, onUpdate, ctx);
-        }
-    };
+async function assertPathWithinRoot(rootDir, inputPath) {
+    await assertPathWithinAnyRoot(rootDir, [rootDir], inputPath, 'durable-memory root', 'write');
 }
 /** Build the path-scoped read/edit/write/grep tool set for the durable-memory agent. */
 export function createDurableMemoryTools(rootDir, options = {}) {
     const readRoots = [rootDir, ...(options.readRoots ?? [])];
-    const readTool = wrapScopedTool(createReadTool(rootDir), (params) => {
-        assertPathWithinAnyRoot(readRoots, params.path);
-    });
-    const editTool = wrapScopedTool(createEditTool(rootDir), (params) => {
-        assertPathWithinRoot(rootDir, params.path);
-    });
-    const writeTool = wrapScopedTool(createWriteTool(rootDir), (params) => {
-        assertPathWithinRoot(rootDir, params.path);
+    const [readTool, grepTool] = createScopedReadTools(rootDir, readRoots, 'durable-memory read roots');
+    const editTool = wrapScopedTool(createEditTool(rootDir), async (params) => {
+        await assertPathWithinRoot(rootDir, params.path);
     });
-    const grepTool = wrapScopedTool(createGrepTool(rootDir), (params) => {
-        if (params.path) {
-            assertPathWithinAnyRoot(readRoots, params.path);
-        }
+    const writeTool = wrapScopedTool(createWriteTool(rootDir), async (params) => {
+        await assertPathWithinRoot(rootDir, params.path);
     });
     return [readTool, editTool, writeTool, grepTool];
 }

package/dist/app/background-agents/shorty/doctor/read-tools.d.ts

@@ -0,0 +1,5 @@
+import type { ToolDefinition } from '../../../../core/core-types.js';
+import type { LocalDoctorPaths } from './records.js';
+/** Build Doctor's read-only tools with access limited to memories and personal skills. */
+export declare function createDoctorReadTools(paths: LocalDoctorPaths): ToolDefinition[];
+//# sourceMappingURL=read-tools.d.ts.map

package/dist/app/background-agents/shorty/doctor/read-tools.js

@@ -0,0 +1,6 @@
+import { createScopedReadTools } from '../../../tools/scoped-file-tools.js';
+/** Build Doctor's read-only tools with access limited to memories and personal skills. */
+export function createDoctorReadTools(paths) {
+    return createScopedReadTools(paths.agentDir, [paths.memoriesDir, paths.personalSkills], 'Doctor read roots');
+}
+//# sourceMappingURL=read-tools.js.map

package/dist/app/background-agents/shorty/doctor/records.d.ts

@@ -0,0 +1,17 @@
+import { type AgentContextReviewRecommendation, type AgentContextReviewUpdatedEvent } from '../../../../contracts/agent-api.js';
+import type { LocalContextReviewDecision } from '../types.js';
+export interface LocalDoctorPaths {
+    readonly agentDir: string;
+    readonly memoriesDir: string;
+    readonly memoryIndex: string;
+    readonly personalSkills: string;
+    readonly archivedSkills: string;
+    readonly reviewRecords: string;
+}
+export declare function resolveLocalDoctorPaths(agentDir?: string): LocalDoctorPaths;
+export declare function createDoctorRecordStore(paths: LocalDoctorPaths, now: () => number): {
+    isAutomaticReviewDue(date: Date): boolean;
+    markAutomaticAttempt(date: Date): void;
+    recordDecision(event: AgentContextReviewUpdatedEvent, action: LocalContextReviewDecision, recommendations?: readonly AgentContextReviewRecommendation[]): void;
+};
+//# sourceMappingURL=records.d.ts.map

package/dist/app/background-agents/shorty/doctor/records.js

@@ -0,0 +1,69 @@
+import { mkdirSync, readFileSync, renameSync, writeFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { getAgentDir, getMemoriesDir } from '../../../../config.js';
+import { AgentContextReviewPhase } from '../../../../contracts/agent-api.js';
+const DOCTOR_ATTEMPT_FILE = 'context-review-attempt.json';
+function todayKey(now) {
+    const year = now.getFullYear();
+    const month = String(now.getMonth() + 1).padStart(2, '0');
+    const day = String(now.getDate()).padStart(2, '0');
+    return `${year}-${month}-${day}`;
+}
+export function resolveLocalDoctorPaths(agentDir) {
+    const resolvedAgentDir = agentDir ?? getAgentDir();
+    const memoriesDir = agentDir ? join(agentDir, 'memories') : getMemoriesDir();
+    const personalSkills = join(resolvedAgentDir, 'skills');
+    return {
+        agentDir: resolvedAgentDir,
+        memoriesDir,
+        memoryIndex: join(memoriesDir, 'MEMORY.md'),
+        personalSkills,
+        archivedSkills: join(personalSkills, '_archive'),
+        reviewRecords: join(memoriesDir, 'context-reviews')
+    };
+}
+export function createDoctorRecordStore(paths, now) {
+    const attemptPath = join(paths.agentDir, DOCTOR_ATTEMPT_FILE);
+    return {
+        isAutomaticReviewDue(date) {
+            try {
+                const stored = JSON.parse(readFileSync(attemptPath, 'utf8'));
+                return stored.date !== todayKey(date);
+            }
+            catch {
+                return true;
+            }
+        },
+        markAutomaticAttempt(date) {
+            mkdirSync(paths.agentDir, { recursive: true });
+            const tempPath = `${attemptPath}.tmp`;
+            writeFileSync(tempPath, `${JSON.stringify({ date: todayKey(date) })}\n`, 'utf8');
+            renameSync(tempPath, attemptPath);
+        },
+        recordDecision(event, action, recommendations = event.recommendations ?? []) {
+            if (event.phase !== AgentContextReviewPhase.Completed ||
+                !event.createdAt ||
+                !event.recordPath ||
+                !event.outcome) {
+                throw new Error('Only completed Doctor Shorty reviews can be recorded.');
+            }
+            const fileName = event.recordPath.split('/').at(-1);
+            if (!fileName || !fileName.endsWith('.json'))
+                throw new Error('Invalid review record path.');
+            mkdirSync(paths.reviewRecords, { recursive: true });
+            const record = {
+                id: event.reviewId,
+                created_at: event.createdAt,
+                trigger: event.trigger,
+                outcome: event.outcome,
+                recommendations,
+                decision: { action, recorded_at: new Date(now()).toISOString() }
+            };
+            const target = join(paths.reviewRecords, fileName);
+            const tempPath = `${target}.tmp`;
+            writeFileSync(tempPath, `${JSON.stringify(record, null, 2)}\n`, 'utf8');
+            renameSync(tempPath, target);
+        }
+    };
+}
+//# sourceMappingURL=records.js.map

package/dist/app/background-agents/shorty/doctor/runtime.d.ts

@@ -0,0 +1,12 @@
+import { type AgentContextReviewTrigger } from '../../../../contracts/agent-api.js';
+import type { CreateLocalShortyRuntimeOptions, LocalShortyEvent } from '../types.js';
+import { createDoctorRecordStore } from './records.js';
+export interface LocalDoctorRuntime {
+    configure(enabled: boolean): void;
+    run(trigger: AgentContextReviewTrigger): Promise<void>;
+    runAutomaticIfDue(now?: Date): Promise<boolean>;
+    recordDecision: ReturnType<typeof createDoctorRecordStore>['recordDecision'];
+    dispose(): void;
+}
+export declare function createLocalDoctorRuntime(options: CreateLocalShortyRuntimeOptions, emit: (event: LocalShortyEvent) => void): LocalDoctorRuntime;
+//# sourceMappingURL=runtime.d.ts.map

package/dist/app/background-agents/shorty/doctor/runtime.js

@@ -0,0 +1,162 @@
+import { AgentContextReviewPhase, AgentEventKind } from '../../../../contracts/agent-api.js';
+import { buildContextReviewQuery, buildContextReviewRecordPath, buildContextReviewSystemPrompt, contextReviewAgent } from '../../../../embedded-agent/context-review/agent.js';
+import { parseContextReviewResult } from '../../../../embedded-agent/context-review/result.js';
+import { readAgentReviewActivityDescription, upsertAgentReviewActivity } from '../../../../embedded-agent/review/activity.js';
+import { GREP, READ } from '../../../../tool-names.js';
+import { resolveAutomaticLocalShortyModel, runLocalShortyAgent } from '../execution.js';
+import { buildShortyPermissionPolicy } from '../permission-policy.js';
+import { createDoctorReadTools } from './read-tools.js';
+import { createDoctorRecordStore, resolveLocalDoctorPaths } from './records.js';
+const REVIEW_TIMEOUT_MS = contextReviewAgent.timeoutSeconds * 1_000;
+export function createLocalDoctorRuntime(options, emit) {
+    const now = options.now ?? Date.now;
+    const paths = resolveLocalDoctorPaths(options.agentDir);
+    const records = createDoctorRecordStore(paths, now);
+    let enabled = options.enabled ?? false;
+    let disposed = false;
+    let active = null;
+    const run = async (trigger, model) => {
+        if (disposed || active || (!enabled && trigger === 'automatic'))
+            return;
+        const reviewId = `context-review-${globalThis.crypto.randomUUID()}`;
+        const createdAt = new Date(now()).toISOString();
+        const controller = new AbortController();
+        active = { reviewId, controller };
+        const startedAt = now();
+        let activities = [];
+        const emitRunningState = () => {
+            emit({
+                kind: AgentEventKind.ContextReviewUpdated,
+                reviewId,
+                trigger,
+                phase: AgentContextReviewPhase.Started,
+                activities
+            });
+        };
+        emitRunningState();
+        let timedOut = false;
+        const timeout = setTimeout(() => {
+            timedOut = true;
+            controller.abort();
+        }, REVIEW_TIMEOUT_MS);
+        try {
+            const tools = createDoctorReadTools(paths);
+            const permissionPolicy = buildShortyPermissionPolicy([READ, GREP], [paths.memoriesDir, paths.personalSkills]);
+            const result = await runLocalShortyAgent({
+                model,
+                modelRegistry: options.modelRegistry,
+                parent: {
+                    systemPrompt: buildContextReviewSystemPrompt({
+                        memoryIndex: paths.memoryIndex,
+                        personalSkills: paths.personalSkills,
+                        archivedSkills: paths.archivedSkills,
+                        reviewRecords: paths.reviewRecords
+                    }, 'read-grep'),
+                    messages: [],
+                    tools,
+                    continuationRunId: reviewId,
+                    getToolContext: () => ({
+                        continuationRunId: reviewId,
+                        permissionPolicy
+                    })
+                },
+                controller: {
+                    kind: 'doctor-shorty',
+                    instruction: buildContextReviewQuery({ trigger }),
+                    effortLevel: 'low',
+                    signal: controller.signal,
+                    onToolCall: (toolCall) => {
+                        const description = readAgentReviewActivityDescription(toolCall.arguments ?? {}) ??
+                            (toolCall.name === GREP
+                                ? 'Searching memory and skills'
+                                : toolCall.name === READ
+                                    ? 'Reading memory and skills'
+                                    : null);
+                        if (!description || active?.reviewId !== reviewId)
+                            return;
+                        activities = upsertAgentReviewActivity(activities, {
+                            id: toolCall.id,
+                            description,
+                            status: 'running'
+                        });
+                        emitRunningState();
+                    }
+                }
+            });
+            if (active?.reviewId !== reviewId)
+                return;
+            const parsed = parseContextReviewResult(result.response);
+            const recordPath = buildContextReviewRecordPath(new Date(createdAt));
+            emit({
+                kind: AgentEventKind.ContextReviewUpdated,
+                reviewId,
+                trigger,
+                phase: AgentContextReviewPhase.Completed,
+                createdAt,
+                recordPath,
+                outcome: parsed.outcome,
+                recommendations: parsed.recommendations.map((recommendation) => ({
+                    ...recommendation,
+                    id: `${reviewId}:${recommendation.id}`
+                })),
+                durationMs: Math.max(0, now() - startedAt)
+            });
+        }
+        catch (error) {
+            if (active?.reviewId !== reviewId)
+                return;
+            emit({
+                kind: AgentEventKind.ContextReviewUpdated,
+                reviewId,
+                trigger,
+                phase: timedOut
+                    ? AgentContextReviewPhase.Failed
+                    : controller.signal.aborted
+                        ? AgentContextReviewPhase.Cancelled
+                        : AgentContextReviewPhase.Failed,
+                message: timedOut
+                    ? 'Context check timed out.'
+                    : error instanceof Error
+                        ? error.message
+                        : String(error),
+                durationMs: Math.max(0, now() - startedAt)
+            });
+        }
+        finally {
+            clearTimeout(timeout);
+            if (active?.reviewId === reviewId)
+                active = null;
+        }
+    };
+    return {
+        configure(nextEnabled) {
+            enabled = nextEnabled;
+            if (!enabled && active) {
+                active.controller.abort();
+                active = null;
+            }
+        },
+        run,
+        async runAutomaticIfDue(date = new Date()) {
+            if (disposed || !enabled || active)
+                return false;
+            if (!records.isAutomaticReviewDue(date))
+                return false;
+            const model = resolveAutomaticLocalShortyModel(options.modelRegistry);
+            if (!model)
+                return false;
+            records.markAutomaticAttempt(date);
+            await run('automatic', model);
+            return true;
+        },
+        recordDecision: records.recordDecision,
+        dispose() {
+            if (disposed)
+                return;
+            disposed = true;
+            active?.controller.abort();
+            active = null;
+        }
+    };
+}
+//# sourceMappingURL=runtime.js.map

package/dist/app/background-agents/shorty/execution.d.ts

@@ -0,0 +1,16 @@
+import type { Model } from '../../../ai/types.js';
+import type { AgentModelRegistry } from '../../../contracts/agent-model.js';
+import { type ForkedAgentControllerOptions, type ForkedAgentParentContext, type ForkedAgentResult } from '../../session/forked-agent.js';
+export interface RunLocalShortyAgentOptions {
+    readonly controller: ForkedAgentControllerOptions;
+    readonly model?: Model<any>;
+    readonly modelRegistry: AgentModelRegistry;
+    readonly parent: Omit<ForkedAgentParentContext, 'model' | 'modelRegistry'>;
+}
+/** Resolve the model used by every local Doctor and Inspector run. */
+export declare function resolveLocalShortyModel(modelRegistry: AgentModelRegistry): Model<any> | undefined;
+/** Return Sol only when an automatic review can authenticate without prompting. */
+export declare function resolveAutomaticLocalShortyModel(modelRegistry: AgentModelRegistry): Model<any> | undefined;
+/** Run a local reviewer without leaking credential plumbing into the reviewer. */
+export declare function runLocalShortyAgent(options: RunLocalShortyAgentOptions): Promise<ForkedAgentResult>;
+//# sourceMappingURL=execution.d.ts.map

package/dist/app/background-agents/shorty/execution.js

@@ -0,0 +1,28 @@
+import { SHORTCUT_MODEL_ID } from '../../../model-ids.js';
+import { runForkedAgent } from '../../session/forked-agent.js';
+/** Resolve the model used by every local Doctor and Inspector run. */
+export function resolveLocalShortyModel(modelRegistry) {
+    return modelRegistry.find('shortcut', SHORTCUT_MODEL_ID.Gpt56Sol);
+}
+/** Return Sol only when an automatic review can authenticate without prompting. */
+export function resolveAutomaticLocalShortyModel(modelRegistry) {
+    const model = resolveLocalShortyModel(modelRegistry);
+    if (!model)
+        return undefined;
+    const hasCredentials = modelRegistry
+        .getAvailable()
+        .some((available) => available.provider === model.provider && available.id === model.id);
+    return hasCredentials ? model : undefined;
+}
+/** Run a local reviewer without leaking credential plumbing into the reviewer. */
+export async function runLocalShortyAgent(options) {
+    const model = options.model ?? resolveLocalShortyModel(options.modelRegistry);
+    if (!model)
+        throw new Error('The Shortcut Sol review model is not registered.');
+    return runForkedAgent({
+        ...options.parent,
+        model,
+        modelRegistry: options.modelRegistry
+    }, options.controller);
+}
+//# sourceMappingURL=execution.js.map

package/dist/app/background-agents/shorty/fix-prompts.d.ts

@@ -0,0 +1,4 @@
+import type { AgentContextReviewRecommendation, AgentReviewBuddyFinding } from '../../../contracts/agent-api.js';
+export declare function formatInspectorFixRequest(findings: readonly AgentReviewBuddyFinding[]): string;
+export declare function formatDoctorFixRequest(recommendations: readonly AgentContextReviewRecommendation[]): string;
+//# sourceMappingURL=fix-prompts.d.ts.map