@axiom-lattice/gateway 2.1.108 → 2.1.110

package/dist/index.js

@@ -104,7 +104,7 @@ function getTenantId12(request) {
 async function getMcpServerConfigList(request, reply) {
   const tenantId = getTenantId12(request);
   try {
-    const storeLattice = (0, import_core26.getStoreLattice)("default", "mcp");
+    const storeLattice = (0, import_core28.getStoreLattice)("default", "mcp");
     const store2 = storeLattice.store;
     const configs = await store2.getAllConfigs(tenantId);
     return {
@@ -131,7 +131,7 @@ async function getMcpServerConfig(request, reply) {
   const tenantId = getTenantId12(request);
   const { key } = request.params;
   try {
-    const storeLattice = (0, import_core26.getStoreLattice)("default", "mcp");
+    const storeLattice = (0, import_core28.getStoreLattice)("default", "mcp");
     const store2 = storeLattice.store;
     const config = await store2.getConfigByKey(tenantId, key);
     if (!config) {
@@ -157,7 +157,7 @@ async function createMcpServerConfig(request, reply) {
   const tenantId = getTenantId12(request);
   const body = request.body;
   try {
-    const storeLattice = (0, import_core26.getStoreLattice)("default", "mcp");
+    const storeLattice = (0, import_core28.getStoreLattice)("default", "mcp");
     const store2 = storeLattice.store;
     const existing = await store2.getConfigByKey(tenantId, body.key);
     if (existing) {
@@ -197,7 +197,7 @@ async function updateMcpServerConfig(request, reply) {
   const { key } = request.params;
   const updates = request.body;
   try {
-    const storeLattice = (0, import_core26.getStoreLattice)("default", "mcp");
+    const storeLattice = (0, import_core28.getStoreLattice)("default", "mcp");
     const store2 = storeLattice.store;
     const existing = await store2.getConfigByKey(tenantId, key);
     if (!existing) {
@@ -217,8 +217,8 @@ async function updateMcpServerConfig(request, reply) {
     }
     if (shouldReconnect) {
       try {
-        await import_core26.mcpManager.reconnectServer(key);
-        await import_core26.mcpManager.registerToolsToToolLattice(key, updated.selectedTools);
+        await import_core28.mcpManager.reconnectServer(key);
+        await import_core28.mcpManager.registerToolsToToolLattice(key, updated.selectedTools);
         await store2.updateConfig(tenantId, existing.id, { status: "connected" });
         updated.status = "connected";
       } catch (error) {
@@ -244,7 +244,7 @@ async function deleteMcpServerConfig(request, reply) {
   const tenantId = getTenantId12(request);
   const { keyOrId } = request.params;
   try {
-    const storeLattice = (0, import_core26.getStoreLattice)("default", "mcp");
+    const storeLattice = (0, import_core28.getStoreLattice)("default", "mcp");
     const store2 = storeLattice.store;
     let config = await store2.getConfigByKey(tenantId, keyOrId);
     let configKey = keyOrId;
@@ -262,8 +262,8 @@ async function deleteMcpServerConfig(request, reply) {
       };
     }
     try {
-      if (import_core26.mcpManager.hasServer(configKey)) {
-        await import_core26.mcpManager.removeServer(configKey);
+      if (import_core28.mcpManager.hasServer(configKey)) {
+        await import_core28.mcpManager.removeServer(configKey);
       }
     } catch (error) {
       console.warn("Failed to remove from MCP manager:", error);
@@ -291,7 +291,7 @@ async function testMcpServerConnection(request, reply) {
   const tenantId = getTenantId12(request);
   const { key } = request.params;
   try {
-    const storeLattice = (0, import_core26.getStoreLattice)("default", "mcp");
+    const storeLattice = (0, import_core28.getStoreLattice)("default", "mcp");
     const store2 = storeLattice.store;
     const config = await store2.getConfigByKey(tenantId, key);
     if (!config) {
@@ -304,7 +304,7 @@ async function testMcpServerConnection(request, reply) {
     try {
       const testKey = `__test_${key}_${Date.now()}`;
       const connection = convertToConnection(config.config);
-      const { latency } = await import_core26.McpLatticeManager.testConnection(testKey, connection);
+      const { latency } = await import_core28.McpLatticeManager.testConnection(testKey, connection);
       return {
         success: true,
         message: "Connection test successful",
@@ -339,7 +339,7 @@ async function listMcpServerTools(request, reply) {
   const tenantId = getTenantId12(request);
   const { key } = request.params;
   try {
-    const storeLattice = (0, import_core26.getStoreLattice)("default", "mcp");
+    const storeLattice = (0, import_core28.getStoreLattice)("default", "mcp");
     const store2 = storeLattice.store;
     const config = await store2.getConfigByKey(tenantId, key);
     if (!config) {
@@ -349,10 +349,10 @@ async function listMcpServerTools(request, reply) {
         message: "MCP server configuration not found"
       };
     }
-    if (!import_core26.mcpManager.hasServer(key)) {
+    if (!import_core28.mcpManager.hasServer(key)) {
       await connectAndRegisterTools(config);
     }
-    const tools = await import_core26.mcpManager.getServerTools(key);
+    const tools = await import_core28.mcpManager.getServerTools(key);
     return {
       success: true,
       message: "Tools retrieved successfully",
@@ -372,7 +372,7 @@ async function connectMcpServer(request, reply) {
   const tenantId = getTenantId12(request);
   const { key } = request.params;
   try {
-    const storeLattice = (0, import_core26.getStoreLattice)("default", "mcp");
+    const storeLattice = (0, import_core28.getStoreLattice)("default", "mcp");
     const store2 = storeLattice.store;
     const config = await store2.getConfigByKey(tenantId, key);
     if (!config) {
@@ -393,7 +393,7 @@ async function connectMcpServer(request, reply) {
     };
   } catch (error) {
     console.error("Failed to connect MCP server:", error);
-    const storeLattice = (0, import_core26.getStoreLattice)("default", "mcp");
+    const storeLattice = (0, import_core28.getStoreLattice)("default", "mcp");
     const store2 = storeLattice.store;
     const config = await store2.getConfigByKey(tenantId, key);
     if (config) {
@@ -409,7 +409,7 @@ async function disconnectMcpServer(request, reply) {
   const tenantId = getTenantId12(request);
   const { key } = request.params;
   try {
-    const storeLattice = (0, import_core26.getStoreLattice)("default", "mcp");
+    const storeLattice = (0, import_core28.getStoreLattice)("default", "mcp");
     const store2 = storeLattice.store;
     const config = await store2.getConfigByKey(tenantId, key);
     if (!config) {
@@ -419,8 +419,8 @@ async function disconnectMcpServer(request, reply) {
         message: "MCP server configuration not found"
       };
     }
-    if (import_core26.mcpManager.hasServer(key)) {
-      await import_core26.mcpManager.removeServer(key);
+    if (import_core28.mcpManager.hasServer(key)) {
+      await import_core28.mcpManager.removeServer(key);
     }
     const updated = await store2.updateConfig(tenantId, config.id, {
       status: "disconnected"
@@ -450,7 +450,7 @@ async function testMcpServerTools(request, reply) {
     }
     const testKey = `__test_${Date.now()}`;
     const connection = convertToConnection(body.config);
-    const { tools } = await import_core26.McpLatticeManager.testConnection(testKey, connection);
+    const { tools } = await import_core28.McpLatticeManager.testConnection(testKey, connection);
     return {
       success: true,
       message: "Tools retrieved successfully",
@@ -487,9 +487,9 @@ function convertToConnection(config) {
 }
 async function connectAndRegisterTools(config) {
   const connection = convertToConnection(config.config);
-  import_core26.mcpManager.addServer(config.key, connection);
-  await import_core26.mcpManager.connect();
-  await import_core26.mcpManager.registerToolsToToolLattice(config.key, config.selectedTools);
+  import_core28.mcpManager.addServer(config.key, connection);
+  await import_core28.mcpManager.connect();
+  await import_core28.mcpManager.registerToolsToToolLattice(config.key, config.selectedTools);
 }
 function registerMcpServerConfigRoutes(app2) {
   app2.get("/api/mcp-servers", getMcpServerConfigList);
@@ -503,11 +503,11 @@ function registerMcpServerConfigRoutes(app2) {
   app2.post("/api/mcp-servers/:key/disconnect", disconnectMcpServer);
   app2.post("/api/mcp-servers/test-tools", testMcpServerTools);
 }
-var import_core26, import_crypto6;
+var import_core28, import_crypto6;
 var init_mcp_configs = __esm({
   "src/controllers/mcp-configs.ts"() {
     "use strict";
-    import_core26 = require("@axiom-lattice/core");
+    import_core28 = require("@axiom-lattice/core");
     import_crypto6 = require("crypto");
   }
 });
@@ -859,18 +859,18 @@ function extractText(msg) {
   }
   return null;
 }
-var import_zod2, logger4, wechatConfigSchema, MAX_RECONNECT_DELAY_MS, BASE_RECONNECT_DELAY_MS, HEARTBEAT_INTERVAL_MS, MSG_TYPE_USER, MSG_ITEM_TEXT, activeConnections2, seenClientIds, wechatChannelAdapter;
+var import_zod3, logger4, wechatConfigSchema, MAX_RECONNECT_DELAY_MS, BASE_RECONNECT_DELAY_MS, HEARTBEAT_INTERVAL_MS, MSG_TYPE_USER, MSG_ITEM_TEXT, activeConnections2, seenClientIds, wechatChannelAdapter;
 var init_WechatChannelAdapter = __esm({
   "src/channels/wechat/WechatChannelAdapter.ts"() {
     "use strict";
-    import_zod2 = require("zod");
+    import_zod3 = require("zod");
     init_wechat_client();
     init_context_store();
     init_Logger();
     logger4 = new Logger({ serviceName: "lattice/gateway/wechat" });
-    wechatConfigSchema = import_zod2.z.object({
-      botToken: import_zod2.z.string(),
-      uin: import_zod2.z.string().optional()
+    wechatConfigSchema = import_zod3.z.object({
+      botToken: import_zod3.z.string(),
+      uin: import_zod3.z.string().optional()
     });
     MAX_RECONNECT_DELAY_MS = 3e4;
     BASE_RECONNECT_DELAY_MS = 1e3;
@@ -1290,7 +1290,7 @@ async function handleTasksSend(request, reply) {
   taskStore.set(taskId, record);
   let agent;
   try {
-    agent = import_core36.agentInstanceManager.getAgent({
+    agent = import_core38.agentInstanceManager.getAgent({
       assistant_id: assistantId,
       thread_id: threadId,
       tenant_id: tenantId,
@@ -1382,7 +1382,7 @@ async function handleTasksCancel(request, reply) {
     return;
   }
   try {
-    const agent = import_core36.agentInstanceManager.getAgent({
+    const agent = import_core38.agentInstanceManager.getAgent({
       assistant_id: record.assistantId,
       thread_id: record.threadId,
       tenant_id: record.tenantId,
@@ -1419,7 +1419,7 @@ async function handleTasksStream(request, reply) {
   }
   let agent;
   try {
-    agent = import_core36.agentInstanceManager.getAgent({
+    agent = import_core38.agentInstanceManager.getAgent({
       assistant_id: record.assistantId,
       thread_id: record.threadId,
       tenant_id: record.tenantId,
@@ -1614,12 +1614,12 @@ function registerA2ARoutes(app2) {
     handleApiKeyRotate
   );
 }
-var import_uuid10, import_core36, import_protocols4, taskStore, _a2aKeyStore, _storeKeyMap;
+var import_uuid10, import_core38, import_protocols4, taskStore, _a2aKeyStore, _storeKeyMap;
 var init_a2a = __esm({
   "src/routes/a2a.ts"() {
     "use strict";
     import_uuid10 = require("uuid");
-    import_core36 = require("@axiom-lattice/core");
+    import_core38 = require("@axiom-lattice/core");
     import_protocols4 = require("@axiom-lattice/protocols");
     taskStore = /* @__PURE__ */ new Map();
     _a2aKeyStore = null;
@@ -1632,12 +1632,12 @@ var resources_exports = {};
 __export(resources_exports, {
   ResourceController: () => ResourceController
 });
-var import_bcryptjs, import_core37, ResourceController;
+var import_bcryptjs, import_core39, ResourceController;
 var init_resources = __esm({
   "src/controllers/resources.ts"() {
     "use strict";
     import_bcryptjs = __toESM(require("bcryptjs"));
-    import_core37 = require("@axiom-lattice/core");
+    import_core39 = require("@axiom-lattice/core");
     init_mime();
     ResourceController = class {
       constructor(deps) {
@@ -1652,14 +1652,14 @@ var init_resources = __esm({
         if (!workspaceId || !projectId) {
           return reply.status(400).send({ error: "x-workspace-id and x-project-id headers required" });
         }
-        const payload = (0, import_core37.createSharePayload)(
+        const payload = (0, import_core39.createSharePayload)(
           tenantId,
           workspaceId,
           projectId,
           userId,
           body
         );
-        const token = (0, import_core37.generateToken)();
+        const token = (0, import_core39.generateToken)();
         try {
           await this.deps.store.create({ ...payload, token });
           this.deps.logger.info(
@@ -1675,7 +1675,7 @@ var init_resources = __esm({
         const userId = request.user ? request.user.id ?? "unknown" : "unknown";
         const tenantId = request.headers["x-tenant-id"] || "default";
         const shares = await this.deps.store.listByUser(tenantId, userId);
-        return reply.send(shares);
+        return reply.send(shares.filter((r) => r.visibility !== "internal"));
       }
       async updateShare(request, reply) {
         const { token } = request.params;
@@ -1707,15 +1707,24 @@ var init_resources = __esm({
         const { token } = params;
         const subPath = params["*"] ?? "";
         this.deps.logger.info("[share] resolve start", { token, subPath });
-        if (subPath && (subPath.endsWith(".js") || subPath.endsWith(".py")) && subPath.startsWith("api/")) {
+        const isApi = subPath && /(^|\/)api\//.test(subPath) && (subPath.endsWith(".js") || subPath.endsWith(".py"));
+        if (request.method !== "GET" && !isApi) {
+          return reply.status(405).send({ error: "Method not allowed" });
+        }
+        if (isApi) {
           const record2 = await this.deps.store.findByToken(token);
           if (!record2 || record2.revoked) return reply.status(404).send("Not found");
           if (record2.expiresAt && new Date(record2.expiresAt) < /* @__PURE__ */ new Date()) {
             return reply.status(410).send("Expired");
           }
-          if (!this._isInternalRequest(request) && record2.visibility === "password") {
-            if (!this._isUnlocked(request, token)) {
-              return reply.status(401).send({ error: "Password required" });
+          if (!this._isInternalRequest(request)) {
+            if (record2.visibility === "internal") {
+              return reply.status(401).send({ error: "Internal access only" });
+            }
+            if (record2.visibility === "password") {
+              if (!this._isUnlocked(request, token)) {
+                return reply.status(401).send({ error: "Password required" });
+              }
             }
           }
           const ext = subPath.endsWith(".py") ? "py" : "js";
@@ -1746,6 +1755,9 @@ var init_resources = __esm({
         });
         const isInternal = this._isInternalRequest(request);
         if (!isInternal) {
+          if (record.visibility === "internal") {
+            return reply.status(401).send({ error: "Internal access only" });
+          }
           if (record.visibility === "password") {
             const unlocked = this._isUnlocked(request, token);
             if (!unlocked) {
@@ -1775,6 +1787,39 @@ var init_resources = __esm({
         });
         return this._serveFile(record.address, token, subPath, sandboxConfig, reply);
       }
+      /**
+       * Thin redirect: /f/{uuidHex3}/{path} → /s/{internal-token}/{path}
+       * Decodes 3 UUIDs (no dashes, 96 hex chars), ensures internal share, 302 redirects.
+       */
+      async resolveDirectFile(request, reply) {
+        const params = request.params;
+        const tenantId = params.tid;
+        const workspaceId = params.wid;
+        const projectId = params.pid;
+        const subPath = params["*"] ?? "";
+        const isApi = subPath && /(^|\/)api\//.test(subPath) && (subPath.endsWith(".js") || subPath.endsWith(".py"));
+        if (request.method !== "GET" && !isApi) {
+          return reply.status(405).send({ error: "Method not allowed" });
+        }
+        if (isApi) {
+          const ext = subPath.endsWith(".py") ? "py" : "js";
+          return this._execApiCore({
+            tenantId,
+            workspaceId,
+            projectId,
+            assistantId: "",
+            resourcePath: subPath
+          }, subPath, ext, request, reply);
+        }
+        const volume = (0, import_core39.buildNamedVolumeName)("p", "project", tenantId, workspaceId, projectId);
+        return this._resolveAndServe(
+          volume,
+          subPath,
+          reply,
+          `/f/${tenantId}/${workspaceId}/${projectId}`,
+          { tenantId, workspaceId, projectId, assistantId: null }
+        );
+      }
       async unlockShare(request, reply) {
         const { token } = request.params;
         const { password } = request.body;
@@ -1801,7 +1846,16 @@ var init_resources = __esm({
       }
       _isInternalRequest(request) {
         const user = request.user;
-        return !!user && !!user.id;
+        if (user && user.id) return true;
+        const origin = request.headers.origin || request.headers.referer;
+        if (origin) {
+          try {
+            const { hostname } = new URL(origin);
+            if (hostname === request.hostname) return true;
+          } catch {
+          }
+        }
+        return false;
       }
       _isUnlocked(request, token) {
         const cookie = request.headers.cookie ?? "";
@@ -1811,30 +1865,19 @@ var init_resources = __esm({
       _isFilePath(path3) {
         return /\.[a-zA-Z0-9]+$/.test(path3);
       }
-      async _serveFile(address, token, subPath, sandboxConfig, reply) {
-        const provider = this.deps.sandboxManager.getDefaultProvider();
-        const resolver = provider.getResourceResolver();
-        const sandboxPath = subPath ? this._resolveSafeSubPath(address.resourcePath, subPath) : address.resourcePath;
-        const entryPath = !subPath && !this._isFilePath(sandboxPath) ? `${sandboxPath}/index.html` : sandboxPath;
-        this.deps.logger.info("[share] serving file", {
-          token,
-          volume: address.volume,
-          sandboxPath: entryPath,
-          subPath: subPath || "(none)",
-          tenantId: sandboxConfig.tenantId,
-          workspaceId: sandboxConfig.workspaceId,
-          projectId: sandboxConfig.projectId
-        });
+      /**
+       * Shared file resolution: directory → index.html, volume FS → sandbox, base tag, response.
+       */
+      async _resolveAndServe(volume, resourcePath, reply, baseTagPrefix, sandboxConfig) {
+        const cleanPath = resourcePath.replace(/\/+$/, "");
+        const entryPath = !cleanPath ? "index.html" : this._isFilePath(cleanPath) ? cleanPath : `${cleanPath}/index.html`;
+        const address = { volume, resourcePath: "" };
         let buf;
         try {
-          buf = await resolver.resolve({ ...address, resourcePath: entryPath });
-          this.deps.logger.info("[share] resolved via volume FS", { token, size: buf.length });
-        } catch (err) {
-          this.deps.logger.warn("[share] volume FS failed, trying sandbox fallback", {
-            token,
-            path: entryPath,
-            error: err.message
-          });
+          const provider = this.deps.sandboxManager.getDefaultProvider();
+          buf = await provider.getResourceResolver().resolve({ ...address, resourcePath: entryPath });
+        } catch {
+          if (!sandboxConfig) return reply.status(404).send("File not found");
           try {
             const sandbox = await this.deps.sandboxManager.getSandboxFromConfig({
               assistant_id: sandboxConfig.assistantId ?? "",
@@ -1844,37 +1887,60 @@ var init_resources = __esm({
               projectId: sandboxConfig.projectId
             });
             buf = await sandbox.file.downloadFile({ file: `/project/${entryPath}` });
-            this.deps.logger.info("[share] resolved via sandbox fallback", { token, size: buf.length });
-          } catch (err2) {
-            this.deps.logger.warn("[share] all resolution attempts failed", { token, resourcePath: entryPath, error: err2.message });
+          } catch {
             return reply.status(404).send("File not found");
           }
         }
-        const fullPath = entryPath;
-        const filename = getFilenameFromPath(fullPath);
-        const isHtml = !subPath && /\.(html|htm)$/i.test(filename);
-        if (isHtml) {
-          buf = this._injectBaseTag(buf, token);
-        }
+        const filename = entryPath.split("/").pop() || "download";
         const contentType = getContentTypeFromFilename(filename);
-        const contentDisposition = `inline; filename="${filename.replace(/"/g, '\\"')}"; filename*=UTF-8''${encodeURIComponent(filename)}`;
-        return reply.status(200).type(contentType).header("Content-Disposition", contentDisposition).header("Access-Control-Allow-Origin", "*").send(buf);
+        if (/\.(html|htm)$/i.test(filename)) {
+          const baseDir = cleanPath ? this._isFilePath(cleanPath) ? cleanPath.replace(/[^/]+$/, "") : cleanPath : "";
+          const html = buf.toString("utf-8");
+          if (!/<base\b/i.test(html)) {
+            const baseTag = `<base href="${baseTagPrefix}${baseDir ? "/" + baseDir : ""}/">`;
+            buf = Buffer.from(
+              html.includes("<head>") ? html.replace("<head>", `<head>${baseTag}`) : baseTag + html,
+              "utf-8"
+            );
+          }
+        }
+        return reply.status(200).type(contentType).header("Content-Disposition", `inline; filename*=UTF-8''${encodeURIComponent(filename)}`).header("Access-Control-Allow-Origin", "*").send(buf);
+      }
+      async _serveFile(address, token, subPath, sandboxConfig, reply) {
+        const resourcePath = subPath ? this._resolveSafeSubPath(address.resourcePath, subPath) : address.resourcePath;
+        return this._resolveAndServe(
+          address.volume,
+          resourcePath,
+          reply,
+          `/s/${token}`,
+          sandboxConfig
+        );
       }
       async _execApi(record, apiSubPath, ext, request, reply) {
+        const basePath = this._isFilePath(record.address.resourcePath) ? "" : `${record.address.resourcePath}/`;
+        return this._execApiCore({
+          tenantId: record.tenantId,
+          workspaceId: record.workspaceId,
+          projectId: record.projectId,
+          assistantId: record.assistantId,
+          resourcePath: basePath + apiSubPath
+        }, apiSubPath, ext, request, reply);
+      }
+      async _execApiCore(config, apiSubPath, ext, request, reply) {
         let sandbox;
         try {
           sandbox = await this.deps.sandboxManager.getSandboxFromConfig({
-            assistant_id: record.assistantId ?? "",
+            assistant_id: config.assistantId ?? "",
             thread_id: "",
-            tenantId: record.tenantId,
-            workspaceId: record.workspaceId,
-            projectId: record.projectId
+            tenantId: config.tenantId,
+            workspaceId: config.workspaceId,
+            projectId: config.projectId
           });
         } catch (err) {
           this.deps.logger.error("[share] sandbox start failed for API", { error: err.message });
           return reply.status(502).send({ error: "Sandbox unavailable" });
         }
-        const scriptPath = `/project/${apiSubPath}`;
+        const scriptPath = `/project/${config.resourcePath}`;
         const cmd = ext === "py" ? `python3 ${scriptPath}` : `node ${scriptPath}`;
         const queryStr = request.url.includes("?") ? request.url.split("?")[1] : "";
         const queryObj = {};
@@ -1889,24 +1955,23 @@ var init_resources = __esm({
           `export API_BODY='${bodyStr.replace(/'/g, "'\\''")}'`,
           `export API_METHOD='${request.method}'`,
           `export API_GATEWAY_URL='${request.protocol}://${request.hostname}'`,
-          `export API_TENANT_ID='${record.tenantId}'`,
-          `export API_ASSISTANT_ID='${record.assistantId || ""}'`
+          `export API_TENANT_ID='${config.tenantId}'`,
+          `export API_ASSISTANT_ID='${config.assistantId || ""}'`
         ].join(" && ");
         const fullCmd = `${envVars} && ${cmd}`;
-        this.deps.logger.info("[share] API exec", { token: record.token, cmd, scriptPath });
+        this.deps.logger.info("[api] exec", { scriptPath, cmd: cmd.substring(0, 80) });
         try {
-          const result = await sandbox.shell.exec(fullCmd);
+          const result = await sandbox.shell.execCommand({ command: fullCmd });
           let data;
           try {
-            data = JSON.parse(result.stdout.trim() || "{}");
+            data = JSON.parse(result.output?.trim() || "{}");
           } catch {
-            data = { output: result.stdout.trim() };
+            data = { output: result.output?.trim() || "" };
           }
           return reply.status(200).type("application/json").send(data);
         } catch (err) {
-          this.deps.logger.warn("[share] API exec failed", { token: record.token, cmd, error: err.message });
-          const msg = err?.stderr || err.message;
-          return reply.status(500).send({ error: msg });
+          this.deps.logger.warn("[api] exec failed", { scriptPath, error: err.message });
+          return reply.status(500).send({ error: err.message });
         }
       }
       _resolveSafeSubPath(entryFile, subPath) {
@@ -1915,21 +1980,6 @@ var init_resources = __esm({
         const entryDir = this._isFilePath(entryFile) ? entryFile.replace(/[^/]+$/, "") : entryFile + "/";
         return (entryDir + subPath).replace(/\/+/g, "/");
       }
-      _injectBaseTag(buf, token) {
-        const html = buf.toString("utf-8");
-        if (/<base\b/i.test(html)) return buf;
-        const baseTag = `<base href="/s/${token}/">`;
-        if (html.includes("</head>")) {
-          return Buffer.from(html.replace("</head>", `${baseTag}</head>`), "utf-8");
-        }
-        if (html.includes("<head>")) {
-          return Buffer.from(html.replace("<head>", `<head>${baseTag}`), "utf-8");
-        }
-        if (html.includes("<html>")) {
-          return Buffer.from(html.replace("<html>", `<html>${baseTag}`), "utf-8");
-        }
-        return Buffer.from(baseTag + html, "utf-8");
-      }
       _passwordPage(token) {
         return `<!DOCTYPE html><html><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>Password Protected</title><style>body{font-family:-apple-system,BlinkMacSystemFont,sans-serif;display:flex;align-items:center;justify-content:center;min-height:100vh;margin:0;background:#f5f5f5}.card{background:#fff;padding:32px;border-radius:12px;box-shadow:0 2px 8px rgba(0,0,0,.1);width:100%;max-width:360px;text-align:center}h2{margin:0 0 8px;font-size:20px}p{margin:0 0 20px;color:#666;font-size:14px}input{width:100%;padding:10px 12px;border:1px solid #d9d9d9;border-radius:8px;font-size:14px;box-sizing:border-box;margin-bottom:12px}button{width:100%;padding:10px;background:#6366f1;color:#fff;border:none;border-radius:8px;font-size:14px;cursor:pointer}.error{color:#ef4444;font-size:13px;margin-top:8px;display:none}</style></head><body><div class="card"><h2>Password Protected</h2><p>This share requires a password to access.</p><form id="f"><input type="password" id="p" placeholder="Enter password" required><button type="submit">Unlock</button><div class="error" id="e">Incorrect password</div></form></div><script>document.getElementById('f').onsubmit=async(e)=>{e.preventDefault();const r=await fetch('/s/${token}/unlock',{method:'POST',headers:{'Content-Type':'application/json'},body:JSON.stringify({password:document.getElementById('p').value})});if(r.ok)location.reload();else document.getElementById('e').style.display='block'}</script></body></html>`;
       }
@@ -4860,6 +4910,15 @@ async function completeTask(request, reply) {
   }
 }
 
+// src/controllers/middleware-types.ts
+var import_core18 = require("@axiom-lattice/core");
+function middlewareTypesRoutes(fastify2) {
+  fastify2.get("/api/middleware-types", async (_request, reply) => {
+    const metas = import_core18.PluginRegistry.listMeta();
+    return reply.send(metas);
+  });
+}
+
 // src/schemas/data-query.ts
 var dataQuerySchema = {
   description: "Execute data query (semantic or SQL)",
@@ -5201,7 +5260,7 @@ var getHealthSchema = {
 };
 
 // src/controllers/thread_status.ts
-var import_core18 = require("@axiom-lattice/core");
+var import_core19 = require("@axiom-lattice/core");
 async function removePendingMessageHandler(request, reply) {
   try {
     const { assistant_id, thread_id, message_id } = request.params;
@@ -5214,7 +5273,7 @@ async function removePendingMessageHandler(request, reply) {
     if (!assistant_id) {
       return reply.code(400).send({ error: "Missing assistant_id parameter" });
     }
-    const agent = import_core18.agentInstanceManager.getAgent({
+    const agent = import_core19.agentInstanceManager.getAgent({
       assistant_id,
       thread_id,
       tenant_id,
@@ -5248,7 +5307,7 @@ async function removePendingMessageHandler(request, reply) {
 }
 
 // src/services/sandbox_service.ts
-var import_core19 = require("@axiom-lattice/core");
+var import_core20 = require("@axiom-lattice/core");
 var ERROR_HTML = `<!DOCTYPE html>
 <html lang="zh-CN">
 <head>
@@ -5360,7 +5419,7 @@ var ERROR_HTML = `<!DOCTYPE html>
 </html>`;
 var SandboxService = class {
   getFilesystemVmIsolation(tenantId, assistantId) {
-    const agentLattice = import_core19.agentLatticeManager.getAgentLatticeWithTenant(tenantId, assistantId);
+    const agentLattice = import_core20.agentLatticeManager.getAgentLatticeWithTenant(tenantId, assistantId);
     if (!agentLattice) {
       return null;
     }
@@ -5374,9 +5433,9 @@ var SandboxService = class {
   computeSandboxName(assistantId, threadId, vmIsolation, tenantId, workspaceId, projectId) {
     switch (vmIsolation) {
       case "agent":
-        return (0, import_core19.normalizeSandboxName)(`${tenantId ?? "default"}-${assistantId}`);
+        return (0, import_core20.normalizeSandboxName)(`${tenantId ?? "default"}-${assistantId}`);
       case "project":
-        return (0, import_core19.normalizeSandboxName)(
+        return (0, import_core20.normalizeSandboxName)(
           `${tenantId ?? "default"}-${workspaceId ?? "default"}-${projectId ?? "default"}`
         );
       case "global":
@@ -5432,7 +5491,7 @@ var SandboxService = class {
 var sandboxService = new SandboxService();
 
 // src/controllers/sandbox.ts
-var import_core20 = require("@axiom-lattice/core");
+var import_core21 = require("@axiom-lattice/core");
 init_mime();
 function registerSandboxProxyRoutes(app2) {
   app2.post(
@@ -5447,7 +5506,7 @@ function registerSandboxProxyRoutes(app2) {
       }
       const workspaceId = request.headers["x-workspace-id"];
       const projectId = request.headers["x-project-id"];
-      const sandboxManager = (0, import_core20.getSandBoxManager)();
+      const sandboxManager = (0, import_core21.getSandBoxManager)();
       const sandbox = await sandboxManager.getSandboxFromConfig({
         assistant_id: assistantId,
         thread_id: threadId,
@@ -5495,7 +5554,7 @@ function registerSandboxProxyRoutes(app2) {
       }
       const workspaceId = request.headers["x-workspace-id"];
       const projectId = request.headers["x-project-id"];
-      const sandboxManager = (0, import_core20.getSandBoxManager)();
+      const sandboxManager = (0, import_core21.getSandBoxManager)();
       const sandbox = await sandboxManager.getSandboxFromConfig({
         assistant_id: assistantId,
         thread_id: threadId,
@@ -5528,15 +5587,15 @@ function registerSandboxProxyRoutes(app2) {
 // src/controllers/workspace.ts
 var fs = __toESM(require("fs/promises"));
 var path = __toESM(require("path"));
-var import_core21 = require("@axiom-lattice/core");
 var import_core22 = require("@axiom-lattice/core");
 var import_core23 = require("@axiom-lattice/core");
+var import_core24 = require("@axiom-lattice/core");
 var import_uuid3 = require("uuid");
 init_mime();
 var WorkspaceController = class {
   constructor() {
-    this.workspaceStore = (0, import_core21.getStoreLattice)("default", "workspace").store;
-    this.projectStore = (0, import_core21.getStoreLattice)("default", "project").store;
+    this.workspaceStore = (0, import_core22.getStoreLattice)("default", "workspace").store;
+    this.projectStore = (0, import_core22.getStoreLattice)("default", "project").store;
   }
   getTenantId(request) {
     const userTenantId = request.user?.tenantId;
@@ -5670,7 +5729,7 @@ var WorkspaceController = class {
     }
     console.log(`[getBackend] storageType=${workspace.storageType} filePath=${filePath}`);
     if (workspace.storageType === "sandbox") {
-      const sandboxManager = (0, import_core23.getSandBoxManager)();
+      const sandboxManager = (0, import_core24.getSandBoxManager)();
       const volumeConfig = {
         assistant_id: assistantId || "",
         thread_id: "",
@@ -5688,7 +5747,7 @@ var WorkspaceController = class {
       const sandbox = await sandboxManager.getSandboxFromConfig(volumeConfig);
       console.log(`[getBackend] sandbox acquired, name=${sandbox.name || "unknown"}`);
       return {
-        backend: new import_core22.SandboxFilesystem({
+        backend: new import_core23.SandboxFilesystem({
           sandboxInstance: sandbox
         }),
         workspace
@@ -5696,7 +5755,7 @@ var WorkspaceController = class {
     } else {
       console.log(`[getBackend] using FilesystemBackend rootDir=/lattice_store/tenants/${tenantId}/workspaces/${workspaceId}/${projectId}`);
       return {
-        backend: new import_core22.FilesystemBackend({
+        backend: new import_core23.FilesystemBackend({
           rootDir: `/lattice_store/tenants/${tenantId}/workspaces/${workspaceId}/${projectId}`,
           virtualMode: true
         }),
@@ -5748,7 +5807,7 @@ var WorkspaceController = class {
       const { workspace } = await this.getBackend(tenantId, workspaceId, projectId, assistantId);
       const resolvedPath = filePath;
       if (workspace.storageType === "sandbox") {
-        const sandboxManager = (0, import_core23.getSandBoxManager)();
+        const sandboxManager = (0, import_core24.getSandBoxManager)();
         const volumeConfig = {
           assistant_id: assistantId || "",
           thread_id: "",
@@ -5802,7 +5861,7 @@ var WorkspaceController = class {
       const { workspace } = await this.getBackend(tenantId, workspaceId, projectId, assistantId);
       const resolvedPath = filePath;
       if (workspace.storageType === "sandbox") {
-        const sandboxManager = (0, import_core23.getSandBoxManager)();
+        const sandboxManager = (0, import_core24.getSandBoxManager)();
         const volumeConfig = {
           assistant_id: assistantId || "",
           thread_id: "",
@@ -5943,7 +6002,7 @@ var WorkspaceController = class {
         return reply.status(400).send({ success: false, error: "Invalid path parameter" });
       }
       if (workspace.storageType === "sandbox") {
-        const sandboxManager = (0, import_core23.getSandBoxManager)();
+        const sandboxManager = (0, import_core24.getSandBoxManager)();
         const volumeConfig = {
           assistant_id: assistantId || "",
           thread_id: "",
@@ -6051,7 +6110,7 @@ function registerWorkspaceRoutes(app2) {
 }
 
 // src/controllers/database-configs.ts
-var import_core24 = require("@axiom-lattice/core");
+var import_core25 = require("@axiom-lattice/core");
 var import_crypto4 = require("crypto");
 function getTenantId10(request) {
   const userTenantId = request.user?.tenantId;
@@ -6063,7 +6122,7 @@ function getTenantId10(request) {
 async function getDatabaseConfigList(request, reply) {
   const tenantId = getTenantId10(request);
   try {
-    const storeLattice = (0, import_core24.getStoreLattice)("default", "database");
+    const storeLattice = (0, import_core25.getStoreLattice)("default", "database");
     const store2 = storeLattice.store;
     const configs = await store2.getAllConfigs(tenantId);
     console.log("Backend: getAllConfigs returned:", configs);
@@ -6094,7 +6153,7 @@ async function getDatabaseConfig(request, reply) {
   const tenantId = getTenantId10(request);
   const { key } = request.params;
   try {
-    const storeLattice = (0, import_core24.getStoreLattice)("default", "database");
+    const storeLattice = (0, import_core25.getStoreLattice)("default", "database");
     const store2 = storeLattice.store;
     const config = await store2.getConfigByKey(tenantId, key);
     if (!config) {
@@ -6120,7 +6179,7 @@ async function createDatabaseConfig(request, reply) {
   const tenantId = getTenantId10(request);
   const body = request.body;
   try {
-    const storeLattice = (0, import_core24.getStoreLattice)("default", "database");
+    const storeLattice = (0, import_core25.getStoreLattice)("default", "database");
     const store2 = storeLattice.store;
     const existing = await store2.getConfigByKey(tenantId, body.key);
     if (existing) {
@@ -6133,7 +6192,7 @@ async function createDatabaseConfig(request, reply) {
     const id = body.id || (0, import_crypto4.randomUUID)();
     const config = await store2.createConfig(tenantId, id, body);
     try {
-      import_core24.sqlDatabaseManager.registerDatabase(tenantId, config.key, config.config);
+      import_core25.sqlDatabaseManager.registerDatabase(tenantId, config.key, config.config);
     } catch (error) {
       console.warn("Failed to auto-register database:", error);
     }
@@ -6156,7 +6215,7 @@ async function updateDatabaseConfig(request, reply) {
   const { key } = request.params;
   const updates = request.body;
   try {
-    const storeLattice = (0, import_core24.getStoreLattice)("default", "database");
+    const storeLattice = (0, import_core25.getStoreLattice)("default", "database");
     const store2 = storeLattice.store;
     const existing = await store2.getConfigByKey(tenantId, key);
     if (!existing) {
@@ -6175,7 +6234,7 @@ async function updateDatabaseConfig(request, reply) {
     }
     if (updates.config) {
       try {
-        import_core24.sqlDatabaseManager.registerDatabase(tenantId, updated.key, updated.config);
+        import_core25.sqlDatabaseManager.registerDatabase(tenantId, updated.key, updated.config);
       } catch (error) {
         console.warn("Failed to re-register database:", error);
       }
@@ -6197,7 +6256,7 @@ async function deleteDatabaseConfig(request, reply) {
   const tenantId = getTenantId10(request);
   const { keyOrId } = request.params;
   try {
-    const storeLattice = (0, import_core24.getStoreLattice)("default", "database");
+    const storeLattice = (0, import_core25.getStoreLattice)("default", "database");
     const store2 = storeLattice.store;
     console.log("Delete request - keyOrId:", keyOrId);
     let config = await store2.getConfigByKey(tenantId, keyOrId);
@@ -6224,8 +6283,8 @@ async function deleteDatabaseConfig(request, reply) {
       };
     }
     try {
-      if (import_core24.sqlDatabaseManager.hasDatabase(tenantId, configKey)) {
-        await import_core24.sqlDatabaseManager.removeDatabase(tenantId, configKey);
+      if (import_core25.sqlDatabaseManager.hasDatabase(tenantId, configKey)) {
+        await import_core25.sqlDatabaseManager.removeDatabase(tenantId, configKey);
       }
     } catch (error) {
       console.warn("Failed to remove from SqlDatabaseManager:", error);
@@ -6246,7 +6305,7 @@ async function testDatabaseConnection(request, reply) {
   const tenantId = getTenantId10(request);
   const { key } = request.params;
   try {
-    const storeLattice = (0, import_core24.getStoreLattice)("default", "database");
+    const storeLattice = (0, import_core25.getStoreLattice)("default", "database");
     const store2 = storeLattice.store;
     const config = await store2.getConfigByKey(tenantId, key);
     if (!config) {
@@ -6257,16 +6316,16 @@ async function testDatabaseConnection(request, reply) {
       };
     }
     const testKey = `__test_${key}_${Date.now()}`;
-    import_core24.sqlDatabaseManager.registerDatabase(tenantId, testKey, config.config);
+    import_core25.sqlDatabaseManager.registerDatabase(tenantId, testKey, config.config);
     const startTime = Date.now();
-    const db = await import_core24.sqlDatabaseManager.getDatabase(tenantId, testKey);
+    const db = await import_core25.sqlDatabaseManager.getDatabase(tenantId, testKey);
     try {
       await db.connect();
       await db.listTables();
       const latency = Date.now() - startTime;
       await new Promise((resolve) => setTimeout(resolve, 100));
       await db.disconnect();
-      await import_core24.sqlDatabaseManager.removeDatabase(tenantId, testKey);
+      await import_core25.sqlDatabaseManager.removeDatabase(tenantId, testKey);
       return {
         success: true,
         message: "Connection test successful",
@@ -6278,7 +6337,7 @@ async function testDatabaseConnection(request, reply) {
     } catch (error) {
       try {
         await db.disconnect();
-        await import_core24.sqlDatabaseManager.removeDatabase(tenantId, testKey);
+        await import_core25.sqlDatabaseManager.removeDatabase(tenantId, testKey);
       } catch {
       }
       return {
@@ -6330,7 +6389,7 @@ function registerDatabaseConfigRoutes(app2) {
 }
 
 // src/controllers/metrics-configs.ts
-var import_core25 = require("@axiom-lattice/core");
+var import_core26 = require("@axiom-lattice/core");
 var import_crypto5 = require("crypto");
 function getTenantId11(request) {
   const userTenantId = request.user?.tenantId;
@@ -6342,7 +6401,7 @@ function getTenantId11(request) {
 async function getMetricsServerConfigList(request, reply) {
   const tenantId = getTenantId11(request);
   try {
-    const storeLattice = (0, import_core25.getStoreLattice)("default", "metrics");
+    const storeLattice = (0, import_core26.getStoreLattice)("default", "metrics");
     const store2 = storeLattice.store;
     const configs = await store2.getAllConfigs(tenantId);
     return {
@@ -6369,7 +6428,7 @@ async function getMetricsServerConfig(request, reply) {
   const tenantId = getTenantId11(request);
   const { key } = request.params;
   try {
-    const storeLattice = (0, import_core25.getStoreLattice)("default", "metrics");
+    const storeLattice = (0, import_core26.getStoreLattice)("default", "metrics");
     const store2 = storeLattice.store;
     const config = await store2.getConfigByKey(tenantId, key);
     if (!config) {
@@ -6395,7 +6454,7 @@ async function createMetricsServerConfig(request, reply) {
   const tenantId = getTenantId11(request);
   const body = request.body;
   try {
-    const storeLattice = (0, import_core25.getStoreLattice)("default", "metrics");
+    const storeLattice = (0, import_core26.getStoreLattice)("default", "metrics");
     const store2 = storeLattice.store;
     const existing = await store2.getConfigByKey(tenantId, body.key);
     if (existing) {
@@ -6424,7 +6483,7 @@ async function createMetricsServerConfig(request, reply) {
     };
     const config = await store2.createConfig(tenantId, id, configData);
     try {
-      import_core25.metricsServerManager.registerServer(tenantId, config.key, config.config);
+      import_core26.metricsServerManager.registerServer(tenantId, config.key, config.config);
     } catch (error) {
       console.warn("Failed to auto-register metrics server:", error);
     }
@@ -6447,7 +6506,7 @@ async function updateMetricsServerConfig(request, reply) {
   const { key } = request.params;
   const updates = request.body;
   try {
-    const storeLattice = (0, import_core25.getStoreLattice)("default", "metrics");
+    const storeLattice = (0, import_core26.getStoreLattice)("default", "metrics");
     const store2 = storeLattice.store;
     const existing = await store2.getConfigByKey(tenantId, key);
     if (!existing) {
@@ -6475,7 +6534,7 @@ async function updateMetricsServerConfig(request, reply) {
     }
     if (updates.config) {
       try {
-        import_core25.metricsServerManager.registerServer(tenantId, updated.key, updated.config);
+        import_core26.metricsServerManager.registerServer(tenantId, updated.key, updated.config);
       } catch (error) {
         console.warn("Failed to re-register metrics server:", error);
       }
@@ -6497,7 +6556,7 @@ async function deleteMetricsServerConfig(request, reply) {
   const tenantId = getTenantId11(request);
   const { keyOrId } = request.params;
   try {
-    const storeLattice = (0, import_core25.getStoreLattice)("default", "metrics");
+    const storeLattice = (0, import_core26.getStoreLattice)("default", "metrics");
     const store2 = storeLattice.store;
     let config = await store2.getConfigByKey(tenantId, keyOrId);
     let configKey = keyOrId;
@@ -6522,8 +6581,8 @@ async function deleteMetricsServerConfig(request, reply) {
       };
     }
     try {
-      if (import_core25.metricsServerManager.hasServer(tenantId, configKey)) {
-        import_core25.metricsServerManager.removeServer(tenantId, configKey);
+      if (import_core26.metricsServerManager.hasServer(tenantId, configKey)) {
+        import_core26.metricsServerManager.removeServer(tenantId, configKey);
       }
     } catch (error) {
       console.warn("Failed to remove from MetricsServerManager:", error);
@@ -6544,7 +6603,7 @@ async function testMetricsServerConnection(request, reply) {
   const tenantId = getTenantId11(request);
   const { key } = request.params;
   try {
-    const storeLattice = (0, import_core25.getStoreLattice)("default", "metrics");
+    const storeLattice = (0, import_core26.getStoreLattice)("default", "metrics");
     const store2 = storeLattice.store;
     const config = await store2.getConfigByKey(tenantId, key);
     if (!config) {
@@ -6555,11 +6614,11 @@ async function testMetricsServerConnection(request, reply) {
       };
     }
     const testKey = `__test_${key}_${Date.now()}`;
-    import_core25.metricsServerManager.registerServer(tenantId, testKey, config.config);
+    import_core26.metricsServerManager.registerServer(tenantId, testKey, config.config);
     try {
-      const client = await import_core25.metricsServerManager.getClient(tenantId, testKey);
+      const client = await import_core26.metricsServerManager.getClient(tenantId, testKey);
       const result = await client.testConnection();
-      import_core25.metricsServerManager.removeServer(tenantId, testKey);
+      import_core26.metricsServerManager.removeServer(tenantId, testKey);
       return {
         success: true,
         message: result.connected ? "Connection test successful" : "Connection test failed",
@@ -6567,7 +6626,7 @@ async function testMetricsServerConnection(request, reply) {
       };
     } catch (error) {
       try {
-        import_core25.metricsServerManager.removeServer(tenantId, testKey);
+        import_core26.metricsServerManager.removeServer(tenantId, testKey);
       } catch {
       }
       return {
@@ -6595,7 +6654,7 @@ async function listAvailableMetrics(request, reply) {
   const tenantId = getTenantId11(request);
   const { key } = request.params;
   try {
-    const storeLattice = (0, import_core25.getStoreLattice)("default", "metrics");
+    const storeLattice = (0, import_core26.getStoreLattice)("default", "metrics");
     const store2 = storeLattice.store;
     const config = await store2.getConfigByKey(tenantId, key);
     if (!config) {
@@ -6605,10 +6664,10 @@ async function listAvailableMetrics(request, reply) {
         message: "Metrics server configuration not found"
       };
     }
-    if (!import_core25.metricsServerManager.hasServer(tenantId, key)) {
-      import_core25.metricsServerManager.registerServer(tenantId, key, config.config);
+    if (!import_core26.metricsServerManager.hasServer(tenantId, key)) {
+      import_core26.metricsServerManager.registerServer(tenantId, key, config.config);
     }
-    const client = await import_core25.metricsServerManager.getClient(tenantId, key);
+    const client = await import_core26.metricsServerManager.getClient(tenantId, key);
     const metrics = await client.listMetrics();
     return {
       success: true,
@@ -6634,7 +6693,7 @@ async function queryMetricsData(request, reply) {
   const { key } = request.params;
   const { metricName, startTime, endTime, step, labels } = request.body;
   try {
-    const storeLattice = (0, import_core25.getStoreLattice)("default", "metrics");
+    const storeLattice = (0, import_core26.getStoreLattice)("default", "metrics");
     const store2 = storeLattice.store;
     const config = await store2.getConfigByKey(tenantId, key);
     if (!config) {
@@ -6651,10 +6710,10 @@ async function queryMetricsData(request, reply) {
         message: "metricName is required"
       };
     }
-    if (!import_core25.metricsServerManager.hasServer(tenantId, key)) {
-      import_core25.metricsServerManager.registerServer(tenantId, key, config.config);
+    if (!import_core26.metricsServerManager.hasServer(tenantId, key)) {
+      import_core26.metricsServerManager.registerServer(tenantId, key, config.config);
     }
-    const client = await import_core25.metricsServerManager.getClient(tenantId, key);
+    const client = await import_core26.metricsServerManager.getClient(tenantId, key);
     const result = await client.queryMetricData(metricName, {
       startTime,
       endTime,
@@ -6681,7 +6740,7 @@ async function getDataSources(request, reply) {
   const tenantId = getTenantId11(request);
   const { key } = request.params;
   try {
-    const storeLattice = (0, import_core25.getStoreLattice)("default", "metrics");
+    const storeLattice = (0, import_core26.getStoreLattice)("default", "metrics");
     const store2 = storeLattice.store;
     const config = await store2.getConfigByKey(tenantId, key);
     if (!config) {
@@ -6699,7 +6758,7 @@ async function getDataSources(request, reply) {
       };
     }
     const semanticConfig = config.config;
-    const client = new import_core25.SemanticMetricsClient(semanticConfig);
+    const client = new import_core26.SemanticMetricsClient(semanticConfig);
     const allDatasources = await client.getDataSources();
     const selectedIds = semanticConfig.selectedDataSources || [];
     const filteredDatasources = selectedIds.length > 0 ? allDatasources.filter((ds) => selectedIds.includes(String(ds.id))) : allDatasources;
@@ -6722,7 +6781,7 @@ async function getDatasourceMetrics(request, reply) {
   const tenantId = getTenantId11(request);
   const { key, datasourceId } = request.params;
   try {
-    const storeLattice = (0, import_core25.getStoreLattice)("default", "metrics");
+    const storeLattice = (0, import_core26.getStoreLattice)("default", "metrics");
     const store2 = storeLattice.store;
     const config = await store2.getConfigByKey(tenantId, key);
     if (!config) {
@@ -6740,7 +6799,7 @@ async function getDatasourceMetrics(request, reply) {
       };
     }
     const semanticConfig = config.config;
-    const client = new import_core25.SemanticMetricsClient(semanticConfig);
+    const client = new import_core26.SemanticMetricsClient(semanticConfig);
     const metrics = await client.getDatasourceMetrics(datasourceId);
     return {
       success: true,
@@ -6760,7 +6819,7 @@ async function querySemanticMetrics(request, reply) {
   const { key } = request.params;
   const body = request.body;
   try {
-    const storeLattice = (0, import_core25.getStoreLattice)("default", "metrics");
+    const storeLattice = (0, import_core26.getStoreLattice)("default", "metrics");
     const store2 = storeLattice.store;
     const config = await store2.getConfigByKey(tenantId, key);
     if (!config) {
@@ -6785,7 +6844,7 @@ async function querySemanticMetrics(request, reply) {
       };
     }
     const semanticConfig = config.config;
-    const client = new import_core25.SemanticMetricsClient(semanticConfig);
+    const client = new import_core26.SemanticMetricsClient(semanticConfig);
     const result = await client.semanticQuery(body);
     const columnNames = result.columns.map((col) => col.name);
     const allDataPoints = [];
@@ -6845,7 +6904,7 @@ async function testSemanticDataSources(request, reply) {
       password: body.password,
       headers: body.headers
     };
-    const client = new import_core25.SemanticMetricsClient(testConfig);
+    const client = new import_core26.SemanticMetricsClient(testConfig);
     const datasources = await client.getDataSources();
     return {
       success: true,
@@ -6881,7 +6940,7 @@ async function testDatasourceMetrics(request, reply) {
       password: body.password,
       headers: body.headers
     };
-    const client = new import_core25.SemanticMetricsClient(testConfig);
+    const client = new import_core26.SemanticMetricsClient(testConfig);
     const metrics = await client.getDatasourceMetrics(datasourceId);
     return {
       success: true,
@@ -6912,16 +6971,170 @@ function registerMetricsServerConfigRoutes(app2) {
   app2.post("/api/metrics-configs/test-datasources/:datasourceId/meta", testDatasourceMetrics);
 }
 
+// src/controllers/connections.ts
+var import_core27 = require("@axiom-lattice/core");
+var import_zod = require("zod");
+var createBody = import_zod.z.object({
+  type: import_zod.z.string().min(1),
+  key: import_zod.z.string().min(1),
+  name: import_zod.z.string().min(1),
+  description: import_zod.z.string().optional(),
+  config: import_zod.z.record(import_zod.z.unknown())
+});
+var testOrDiscoverBody = import_zod.z.object({
+  key: import_zod.z.string().optional(),
+  config: import_zod.z.record(import_zod.z.unknown()).optional()
+});
+function getTenant(request) {
+  return request.headers["x-tenant-id"] || "default";
+}
+function maskSecrets(config) {
+  const sensitive = /* @__PURE__ */ new Set([
+    "password",
+    "secret",
+    "token",
+    "apikey",
+    "api_key",
+    "session",
+    "privatekey",
+    "private_key",
+    "accesskey",
+    "access_key"
+  ]);
+  const out = {};
+  for (const [k, v] of Object.entries(config)) {
+    out[k] = sensitive.has(k.toLowerCase()) ? "********" : v;
+  }
+  return out;
+}
+async function resolveConfig(type, body, tenantId) {
+  if (body.key) {
+    const entry = await import_core27.ConnectionRegistry.get(type, body.key, tenantId);
+    if (!entry) throw { status: 404, error: `Connection "${body.key}" not found` };
+    return entry.config;
+  }
+  if (body.config) return body.config;
+  throw { status: 400, error: "Either 'key' or 'config' is required" };
+}
+function connectionRoutes(fastify2) {
+  fastify2.get("/api/connections", async (request, reply) => {
+    const { type } = request.query;
+    if (!type) return reply.status(400).send({ error: "query 'type' required" });
+    const entries = await import_core27.ConnectionRegistry.list(type, getTenant(request));
+    return reply.send({
+      success: true,
+      data: { records: entries.map((e) => ({ ...e, config: maskSecrets(e.config) })), total: entries.length }
+    });
+  });
+  fastify2.post("/api/connections", async (request, reply) => {
+    const parsed = createBody.parse(request.body);
+    const entry = await import_core27.ConnectionRegistry.create({
+      tenantId: getTenant(request),
+      type: parsed.type,
+      key: parsed.key,
+      name: parsed.name,
+      description: parsed.description,
+      config: parsed.config
+    });
+    return reply.status(201).send({
+      success: true,
+      data: { ...entry, config: maskSecrets(entry.config) }
+    });
+  });
+  fastify2.put("/api/connections/:key", async (request, reply) => {
+    const { type } = request.query;
+    if (!type) return reply.status(400).send({ error: "query 'type' required" });
+    const { key } = request.params;
+    const body = request.body;
+    const tenantId = getTenant(request);
+    const existing = await import_core27.ConnectionRegistry.get(type, key, tenantId);
+    if (!existing) return reply.status(404).send({ error: "not found" });
+    const updates = {};
+    if (body.name !== void 0) updates.name = body.name;
+    if (body.description !== void 0) updates.description = body.description;
+    if (body.config) {
+      updates.config = { ...existing.config, ...body.config };
+    }
+    const entry = await import_core27.ConnectionRegistry.update(tenantId, type, key, updates);
+    return reply.send({
+      success: true,
+      data: { ...entry, config: maskSecrets(entry?.config ?? {}) }
+    });
+  });
+  fastify2.delete("/api/connections/:key", async (request, reply) => {
+    const { type } = request.query;
+    if (!type) return reply.status(400).send({ error: "query 'type' required" });
+    const { key } = request.params;
+    const ok = await import_core27.ConnectionRegistry.delete(getTenant(request), type, key);
+    return reply.send({ success: ok });
+  });
+  fastify2.post("/api/connections/test", async (request, reply) => {
+    const { type } = request.query;
+    if (!type) return reply.status(400).send({ error: "query 'type' required" });
+    const plugin = import_core27.PluginRegistry.get(type);
+    if (!plugin?.connection?.test) {
+      return reply.status(400).send({ error: "plugin does not support connection testing" });
+    }
+    try {
+      const body = testOrDiscoverBody.parse(request.body);
+      const targetConfig = await resolveConfig(type, body, getTenant(request));
+      const result = await plugin.connection.test(targetConfig);
+      return reply.send(result);
+    } catch (err) {
+      if (err?.status === 404) {
+        return reply.status(404).send(err);
+      }
+      if (err?.status === 400) {
+        return reply.status(400).send(err);
+      }
+      if (err instanceof import_zod.z.ZodError) {
+        return reply.status(400).send({ error: err.errors });
+      }
+      return reply.status(500).send({
+        ok: false,
+        message: err instanceof Error ? err.message : String(err)
+      });
+    }
+  });
+  fastify2.post("/api/connections/discover", async (request, reply) => {
+    const { type } = request.query;
+    if (!type) return reply.status(400).send({ error: "query 'type' required" });
+    const plugin = import_core27.PluginRegistry.get(type);
+    if (!plugin?.connection?.discover) {
+      return reply.status(400).send({ error: "plugin does not support resource discovery" });
+    }
+    try {
+      const body = testOrDiscoverBody.parse(request.body);
+      const targetConfig = await resolveConfig(type, body, getTenant(request));
+      const resources = await plugin.connection.discover(targetConfig);
+      return reply.send({ resources });
+    } catch (err) {
+      if (err?.status === 404) {
+        return reply.status(404).send(err);
+      }
+      if (err?.status === 400) {
+        return reply.status(400).send(err);
+      }
+      if (err instanceof import_zod.z.ZodError) {
+        return reply.status(400).send({ error: err.errors });
+      }
+      return reply.status(500).send({
+        error: err instanceof Error ? err.message : String(err)
+      });
+    }
+  });
+}
+
 // src/routes/index.ts
 init_mcp_configs();
 
 // src/controllers/eval.ts
-var import_core28 = require("@axiom-lattice/core");
+var import_core30 = require("@axiom-lattice/core");
 var import_uuid5 = require("uuid");
 
 // src/services/eval-runner.ts
 var import_events = require("events");
-var import_core27 = require("@axiom-lattice/core");
+var import_core29 = require("@axiom-lattice/core");
 var import_agent_eval = require("@axiom-lattice/agent-eval");
 var import_uuid4 = require("uuid");
 function mapLogs(logs) {
@@ -6983,7 +7196,7 @@ var EvalRunner = class {
     if (hasModelKey) {
       judgeModelConfig = { modelKey: judgeCfg.modelKey };
     } else if (!hasCredentials) {
-      const firstModel = import_core27.modelLatticeManager.getAllLattices()[0];
+      const firstModel = import_core29.modelLatticeManager.getAllLattices()[0];
       if (firstModel) {
         judgeModelConfig = { modelKey: firstModel.key };
       } else {
@@ -7094,7 +7307,7 @@ var EvalRunner = class {
     return this.runs.has(runId);
   }
   getEvalStore() {
-    return (0, import_core27.getStoreLattice)("default", "eval").store;
+    return (0, import_core29.getStoreLattice)("default", "eval").store;
   }
 };
 var evalRunner = new EvalRunner();
@@ -7108,7 +7321,7 @@ function getTenantId13(request) {
   return request.headers["x-tenant-id"] || "default";
 }
 function getEvalStore() {
-  return (0, import_core28.getStoreLattice)("default", "eval").store;
+  return (0, import_core30.getStoreLattice)("default", "eval").store;
 }
 async function createProject(request, reply) {
   try {
@@ -7494,11 +7707,11 @@ data: ${JSON.stringify(event.data)}
 }
 
 // src/controllers/users.ts
-var import_core29 = require("@axiom-lattice/core");
+var import_core31 = require("@axiom-lattice/core");
 var import_uuid6 = require("uuid");
 var UsersController = class {
   constructor() {
-    this.userStore = (0, import_core29.getStoreLattice)("default", "user").store;
+    this.userStore = (0, import_core31.getStoreLattice)("default", "user").store;
   }
   async listUsers(request, reply) {
     const { email } = request.query;
@@ -7576,11 +7789,11 @@ function registerUserRoutes(app2) {
 }
 
 // src/controllers/tenants.ts
-var import_core30 = require("@axiom-lattice/core");
+var import_core32 = require("@axiom-lattice/core");
 var import_uuid7 = require("uuid");
 var TenantsController = class {
   constructor() {
-    this.tenantStore = (0, import_core30.getStoreLattice)("default", "tenant").store;
+    this.tenantStore = (0, import_core32.getStoreLattice)("default", "tenant").store;
   }
   // ==================== Tenant CRUD ====================
   async listTenants(request, reply) {
@@ -7644,7 +7857,7 @@ function registerTenantRoutes(app2) {
 }
 
 // src/controllers/auth.ts
-var import_core31 = require("@axiom-lattice/core");
+var import_core33 = require("@axiom-lattice/core");
 var import_uuid8 = require("uuid");
 var defaultAuthConfig = {
   autoApproveUsers: true,
@@ -7653,9 +7866,9 @@ var defaultAuthConfig = {
 };
 var AuthController = class {
   constructor(config = {}) {
-    this.userStore = (0, import_core31.getStoreLattice)("default", "user").store;
-    this.tenantStore = (0, import_core31.getStoreLattice)("default", "tenant").store;
-    this.userTenantLinkStore = (0, import_core31.getStoreLattice)("default", "userTenantLink").store;
+    this.userStore = (0, import_core33.getStoreLattice)("default", "user").store;
+    this.tenantStore = (0, import_core33.getStoreLattice)("default", "tenant").store;
+    this.userTenantLinkStore = (0, import_core33.getStoreLattice)("default", "userTenantLink").store;
     this.config = { ...defaultAuthConfig, ...config };
   }
   async register(request, reply) {
@@ -7813,7 +8026,7 @@ var AuthController = class {
       const linkMeta = link?.metadata || {};
       let personalAssistant = null;
       if (linkMeta.personalAssistantId) {
-        const assistantStore = (0, import_core31.getStoreLattice)("default", "assistant").store;
+        const assistantStore = (0, import_core33.getStoreLattice)("default", "assistant").store;
         const exists = await assistantStore.hasAssistant(tenantId, linkMeta.personalAssistantId);
         if (exists) {
           personalAssistant = {
@@ -8038,7 +8251,7 @@ function registerAuthRoutes(app2, config) {
 }
 
 // src/channels/lark/LarkChannelAdapter.ts
-var import_zod = require("zod");
+var import_zod2 = require("zod");
 
 // src/channels/lark/parser.ts
 function parseLarkMessageEvent(payload) {
@@ -8118,11 +8331,11 @@ function wsEventToInbound(event, installationId, tenantId) {
     }
   };
 }
-var larkConfigSchema = import_zod.z.object({
-  appId: import_zod.z.string(),
-  appSecret: import_zod.z.string(),
-  verificationToken: import_zod.z.string().optional(),
-  encryptKey: import_zod.z.string().optional()
+var larkConfigSchema = import_zod2.z.object({
+  appId: import_zod2.z.string(),
+  appSecret: import_zod2.z.string(),
+  verificationToken: import_zod2.z.string().optional(),
+  encryptKey: import_zod2.z.string().optional()
 });
 var larkChannelAdapter = {
   channel: "lark",
@@ -8637,7 +8850,7 @@ function registerChannelInstallationRoutes(app2) {
 }
 
 // src/controllers/channel-bindings.ts
-var import_core32 = require("@axiom-lattice/core");
+var import_core34 = require("@axiom-lattice/core");
 function getTenantId15(request) {
   const userTenantId = request.user?.tenantId;
   if (userTenantId) return userTenantId;
@@ -8647,7 +8860,7 @@ async function getBindingList(request, _reply) {
   const tenantId = getTenantId15(request);
   const { channel, agentId, channelInstallationId, limit, offset } = request.query;
   try {
-    const registry = (0, import_core32.getBindingRegistry)();
+    const registry = (0, import_core34.getBindingRegistry)();
     const bindings = await registry.list({ channel, agentId, tenantId, channelInstallationId, limit, offset });
     return { success: true, message: "Bindings retrieved", data: { records: bindings, total: bindings.length } };
   } catch (error) {
@@ -8658,7 +8871,7 @@ async function getBindingList(request, _reply) {
 async function getBinding(request, reply) {
   const tenantId = getTenantId15(request);
   try {
-    const registry = (0, import_core32.getBindingRegistry)();
+    const registry = (0, import_core34.getBindingRegistry)();
     const bindings = await registry.list({ tenantId });
     const binding = bindings.find((b) => b.id === request.params.id);
     if (!binding || binding.tenantId !== tenantId) {
@@ -8674,7 +8887,7 @@ async function getBinding(request, reply) {
 async function createBinding(request, reply) {
   const tenantId = getTenantId15(request);
   try {
-    const registry = (0, import_core32.getBindingRegistry)();
+    const registry = (0, import_core34.getBindingRegistry)();
     const binding = await registry.create({ ...request.body, tenantId });
     reply.status(201);
     return { success: true, message: "Binding created", data: binding };
@@ -8687,7 +8900,7 @@ async function createBinding(request, reply) {
 async function updateBinding(request, reply) {
   try {
     const tenantId = getTenantId15(request);
-    const registry = (0, import_core32.getBindingRegistry)();
+    const registry = (0, import_core34.getBindingRegistry)();
     const bindings = await registry.list({ tenantId });
     const existing = bindings.find((b) => b.id === request.params.id);
     if (!existing || existing.tenantId !== tenantId) {
@@ -8705,7 +8918,7 @@ async function updateBinding(request, reply) {
 async function deleteBinding(request, reply) {
   try {
     const tenantId = getTenantId15(request);
-    const registry = (0, import_core32.getBindingRegistry)();
+    const registry = (0, import_core34.getBindingRegistry)();
     const bindings = await registry.list({ tenantId });
     const existing = bindings.find((b) => b.id === request.params.id);
     if (!existing || existing.tenantId !== tenantId) {
@@ -8724,7 +8937,7 @@ async function resolveBinding(request, _reply) {
   const tenantId = getTenantId15(request);
   const { channel, senderId, channelInstallationId } = request.query;
   try {
-    const registry = (0, import_core32.getBindingRegistry)();
+    const registry = (0, import_core34.getBindingRegistry)();
     const binding = await registry.resolve({ channel, senderId, channelInstallationId, tenantId });
     if (!binding) {
       return { success: false, message: "No binding found", data: null };
@@ -8747,7 +8960,7 @@ function registerChannelBindingRoutes(app2) {
 }
 
 // src/controllers/menu-items.ts
-var import_core33 = require("@axiom-lattice/core");
+var import_core35 = require("@axiom-lattice/core");
 function getTenantId16(request) {
   const userTenantId = request.user?.tenantId;
   if (userTenantId) return userTenantId;
@@ -8759,7 +8972,7 @@ function errorMessage(err) {
 async function getMenuItemList(request, _reply) {
   const tenantId = getTenantId16(request);
   try {
-    const registry = (0, import_core33.getMenuRegistry)();
+    const registry = (0, import_core35.getMenuRegistry)();
     const items = await registry.list({ tenantId, menuTarget: request.query.menuTarget });
     return { success: true, message: "Menu items retrieved", data: { records: items, total: items.length } };
   } catch (error) {
@@ -8771,7 +8984,7 @@ async function getMenuItemList(request, _reply) {
 async function getMenuItem(request, reply) {
   const tenantId = getTenantId16(request);
   try {
-    const registry = (0, import_core33.getMenuRegistry)();
+    const registry = (0, import_core35.getMenuRegistry)();
     const item = await registry.getById(request.params.id);
     if (!item || item.tenantId !== tenantId) {
       reply.status(404);
@@ -8788,7 +9001,7 @@ async function getMenuItem(request, reply) {
 async function createMenuItem(request, reply) {
   const tenantId = getTenantId16(request);
   try {
-    const registry = (0, import_core33.getMenuRegistry)();
+    const registry = (0, import_core35.getMenuRegistry)();
     const item = await registry.create({ ...request.body, tenantId });
     reply.status(201);
     return { success: true, message: "Menu item created", data: item };
@@ -8802,7 +9015,7 @@ async function createMenuItem(request, reply) {
 async function updateMenuItem(request, reply) {
   try {
     const tenantId = getTenantId16(request);
-    const registry = (0, import_core33.getMenuRegistry)();
+    const registry = (0, import_core35.getMenuRegistry)();
     const existing = await registry.getById(request.params.id);
     if (!existing || existing.tenantId !== tenantId) {
       reply.status(404);
@@ -8820,7 +9033,7 @@ async function updateMenuItem(request, reply) {
 async function deleteMenuItem(request, reply) {
   try {
     const tenantId = getTenantId16(request);
-    const registry = (0, import_core33.getMenuRegistry)();
+    const registry = (0, import_core35.getMenuRegistry)();
     const existing = await registry.getById(request.params.id);
     if (!existing || existing.tenantId !== tenantId) {
       reply.status(404);
@@ -9166,6 +9379,8 @@ var registerLatticeRoutes = (app2, channelDeps) => {
   registerWorkspaceRoutes(app2);
   registerDatabaseConfigRoutes(app2);
   registerMetricsServerConfigRoutes(app2);
+  connectionRoutes(app2);
+  middlewareTypesRoutes(app2);
   app2.post(
     "/api/data/query",
     { schema: dataQuerySchema },
@@ -9261,6 +9476,9 @@ var registerLatticeRoutes = (app2, channelDeps) => {
 function registerResourceRoutes(app2, controller) {
   app2.get("/s/:token", controller.resolveResource.bind(controller));
   app2.get("/s/:token/*", controller.resolveResource.bind(controller));
+  app2.post("/s/:token/*", controller.resolveResource.bind(controller));
+  app2.put("/s/:token/*", controller.resolveResource.bind(controller));
+  app2.delete("/s/:token/*", controller.resolveResource.bind(controller));
   app2.post("/s/:token/unlock", controller.unlockShare.bind(controller));
   app2.options("/s/:token", async (_req, reply) => {
     reply.header("Access-Control-Allow-Origin", "*");
@@ -9268,6 +9486,12 @@ function registerResourceRoutes(app2, controller) {
     reply.header("Access-Control-Allow-Headers", "Content-Type");
     return reply.status(204).send();
   });
+  const dirFile = controller.resolveDirectFile.bind(controller);
+  app2.get("/f/:tid/:wid/:pid", dirFile);
+  app2.get("/f/:tid/:wid/:pid/*", dirFile);
+  app2.post("/f/:tid/:wid/:pid/*", dirFile);
+  app2.put("/f/:tid/:wid/:pid/*", dirFile);
+  app2.delete("/f/:tid/:wid/:pid/*", dirFile);
   app2.post("/api/resources/share", controller.createShare.bind(controller));
   app2.get("/api/resources/shares", controller.listShares.bind(controller));
   app2.patch("/api/resources/share/:token", controller.updateShare.bind(controller));
@@ -9275,7 +9499,7 @@ function registerResourceRoutes(app2, controller) {
 }
 
 // src/router/MessageRouter.ts
-var import_core34 = require("@axiom-lattice/core");
+var import_core36 = require("@axiom-lattice/core");
 var import_crypto9 = require("crypto");
 var BindingNotFoundError = class extends Error {
   constructor(message) {
@@ -9436,7 +9660,7 @@ var MessageRouter = class {
             channel: message.channel,
             adapterChannel: adapter.channel
           }, "Thread resolved by adapter strategy");
-          const threadStore = (0, import_core34.getStoreLattice)("default", "thread").store;
+          const threadStore = (0, import_core36.getStoreLattice)("default", "thread").store;
           try {
             await threadStore.createThread(
               tenantId,
@@ -9473,7 +9697,7 @@ var MessageRouter = class {
           }
         }
         if (!threadId) {
-          const threadStore = (0, import_core34.getStoreLattice)("default", "thread").store;
+          const threadStore = (0, import_core36.getStoreLattice)("default", "thread").store;
           const newThreadId = (0, import_crypto9.randomUUID)();
           console.log({
             event: "dispatch:thread:create",
@@ -9513,7 +9737,7 @@ var MessageRouter = class {
           senderId: message.sender.id,
           contentLength: message.content.text.length
         }, "Dispatching to agent");
-        const agent = import_core34.agentInstanceManager.getAgent({
+        const agent = import_core36.agentInstanceManager.getAgent({
           tenant_id: tenantId,
           assistant_id: agentId,
           thread_id: threadId,
@@ -9758,7 +9982,7 @@ function createAuditLoggerMiddleware() {
 }
 
 // src/index.ts
-var import_core38 = require("@axiom-lattice/core");
+var import_core40 = require("@axiom-lattice/core");
 
 // src/swagger.ts
 var import_swagger = __toESM(require("@fastify/swagger"));
@@ -9823,7 +10047,7 @@ var configureSwagger = async (app2, customSwaggerConfig, customSwaggerUiConfig)
 };
 
 // src/services/agent_task_consumer.ts
-var import_core35 = require("@axiom-lattice/core");
+var import_core37 = require("@axiom-lattice/core");
 var handleAgentTask = async (taskRequest, retryCount = 0) => {
   const {
     assistant_id,
@@ -9841,17 +10065,17 @@ var handleAgentTask = async (taskRequest, retryCount = 0) => {
     console.log(
       `\u5F00\u59CB\u5904\u7406\u4EFB\u52A1 [assistant_id: ${assistant_id}, thread_id: ${thread_id}]`
     );
-    const agent = import_core35.agentInstanceManager.getAgent({ assistant_id, thread_id, tenant_id, workspace_id: runConfig?.workspaceId, project_id: runConfig?.projectId, custom_run_config: runConfig });
-    await agent.addMessage({ input, command, custom_run_config: runConfig }, import_core35.QueueMode.STEER);
+    const agent = import_core37.agentInstanceManager.getAgent({ assistant_id, thread_id, tenant_id, workspace_id: runConfig?.workspaceId, project_id: runConfig?.projectId, custom_run_config: runConfig });
+    await agent.addMessage({ input, command, custom_run_config: runConfig }, import_core37.QueueMode.STEER);
     if (callback_event) {
       agent.subscribeOnce("message:completed", (evt) => {
-        import_core35.eventBus.publish(callback_event, {
+        import_core37.eventBus.publish(callback_event, {
           success: true,
           state: evt.state
         });
         if (main_thread_id && main_tenant_id) {
           try {
-            const mainAgent = import_core35.agentInstanceManager.getAgent({
+            const mainAgent = import_core37.agentInstanceManager.getAgent({
               assistant_id: main_assistant_id ?? assistant_id,
               thread_id: main_thread_id,
               tenant_id: main_tenant_id,
@@ -9881,7 +10105,7 @@ ${summary}`
         }
       });
       agent.subscribeOnce("message:interrupted", (evt) => {
-        import_core35.eventBus.publish(callback_event, {
+        import_core37.eventBus.publish(callback_event, {
           success: true,
           state: evt.state
         });
@@ -9904,7 +10128,7 @@ ${summary}`
       return handleAgentTask(taskRequest, nextRetryCount);
     }
     if (callback_event) {
-      import_core35.eventBus.publish(callback_event, {
+      import_core37.eventBus.publish(callback_event, {
         success: false,
         error: error instanceof Error ? error.message : String(error)
       });
@@ -9941,7 +10165,7 @@ var _AgentTaskConsumer = class _AgentTaskConsumer {
    * 初始化事件监听和队列轮询
    */
   initialize() {
-    import_core35.eventBus.subscribe(import_core35.AGENT_TASK_EVENT, this.trigger_agent_task.bind(this));
+    import_core37.eventBus.subscribe(import_core37.AGENT_TASK_EVENT, this.trigger_agent_task.bind(this));
     this.startPollingQueue();
     console.log("Agent\u4EFB\u52A1\u6D88\u8D39\u8005\u5DF2\u542F\u52A8\u5E76\u76D1\u542C\u4EFB\u52A1\u4E8B\u4EF6\u548C\u961F\u5217");
   }
@@ -10060,7 +10284,7 @@ var _AgentTaskConsumer = class _AgentTaskConsumer {
     handleAgentTask(taskRequest).catch((error) => {
       console.error("\u5904\u7406Agent\u4EFB\u52A1\u65F6\u53D1\u751F\u672A\u6355\u83B7\u7684\u9519\u8BEF:", error);
       if (taskRequest.callback_event) {
-        import_core35.eventBus.publish(taskRequest.callback_event, {
+        import_core37.eventBus.publish(taskRequest.callback_event, {
           success: false,
           error: error instanceof Error ? error.message : String(error)
         });
@@ -10075,7 +10299,7 @@ _AgentTaskConsumer.agent_run_endpoint = "http://localhost:4001/api/runs";
 var AgentTaskConsumer = _AgentTaskConsumer;
 
 // src/index.ts
-var import_core39 = require("@axiom-lattice/core");
+var import_core41 = require("@axiom-lattice/core");
 var import_protocols5 = require("@axiom-lattice/protocols");
 var import_meta = {};
 process.on("unhandledRejection", (reason, promise) => {
@@ -10091,17 +10315,15 @@ var DEFAULT_LOGGER_CONFIG = {
 var loggerLattice = initializeLogger(DEFAULT_LOGGER_CONFIG);
 var logger5 = loggerLattice.client;
 function initializeLogger(config) {
-  if (import_core39.loggerLatticeManager.hasLattice("default")) {
-    import_core39.loggerLatticeManager.removeLattice("default");
+  if (import_core41.loggerLatticeManager.hasLattice("default")) {
+    import_core41.loggerLatticeManager.removeLattice("default");
   }
-  (0, import_core39.registerLoggerLattice)("default", config);
-  return (0, import_core39.getLoggerLattice)("default");
+  (0, import_core41.registerLoggerLattice)("default", config);
+  return (0, import_core41.getLoggerLattice)("default");
 }
 var app = (0, import_fastify.default)({
   logger: false,
-  // 禁用内置日志记录器
   bodyLimit: Number(process.env.BODY_LIMIT) || 50 * 1024 * 1024
-  // Default 50MB, configurable via BODY_LIMIT env var
 });
 app.addContentTypeParser("application/json", { parseAs: "string" }, function(request, body, done) {
   if (request.method === "DELETE" || !body || body.length === 0) {
@@ -10135,6 +10357,7 @@ app.addHook("preHandler", async (request, reply) => {
   if (request.url.startsWith("/s/")) return;
   const urlPath = request.url.split("?")[0];
   if (urlPath.includes("/viewfile") || urlPath.includes("/downloadfile") || urlPath.includes("/uploadfile")) return;
+  if (urlPath.startsWith("/f/") || urlPath === "/f") return;
   return reply.status(401).send({
     success: false,
     error: "Unauthorized - Missing or invalid token"
@@ -10207,7 +10430,7 @@ app.setErrorHandler((error, request, reply) => {
 });
 function getConfiguredSandboxProvider() {
   const sandboxProviderType = process.env.SANDBOX_PROVIDER_TYPE || "microsandbox-remote";
-  return (0, import_core39.createSandboxProvider)({
+  return (0, import_core41.createSandboxProvider)({
     type: sandboxProviderType,
     remoteBaseURL: process.env.SANDBOX_BASE_URL,
     microsandboxServiceBaseURL: process.env.MICROSANDBOX_SERVICE_BASE_URL,
@@ -10223,7 +10446,7 @@ function getConfiguredSandboxProvider() {
 }
 async function restoreMcpConnections() {
   try {
-    const storeLattice = (0, import_core39.getStoreLattice)("default", "mcp");
+    const storeLattice = (0, import_core41.getStoreLattice)("default", "mcp");
     const store2 = storeLattice.store;
     if (!store2) {
       logger5.info("MCP store not configured, skipping connection restoration");
@@ -10237,15 +10460,15 @@ async function restoreMcpConnections() {
     for (const config of connectedConfigs) {
       try {
         const connection = convertToConnection2(config.config);
-        import_core39.mcpManager.addServer(config.key, connection);
+        import_core41.mcpManager.addServer(config.key, connection);
       } catch (err) {
         logger5.warn(`Failed to prepare MCP server "${config.key}" for restoration`, { error: err });
       }
     }
-    await import_core39.mcpManager.connect();
+    await import_core41.mcpManager.connect();
     for (const config of connectedConfigs) {
       try {
-        await import_core39.mcpManager.registerToolsToToolLattice(config.key, config.selectedTools);
+        await import_core41.mcpManager.registerToolsToToolLattice(config.key, config.selectedTools);
         logger5.info(`MCP server "${config.key}" restored with ${config.selectedTools.length} tools`);
       } catch (err) {
         logger5.warn(`Failed to register tools for MCP server "${config.key}"`, { error: err });
@@ -10278,7 +10501,7 @@ var start = async (config) => {
       const { getStoreLattice: getStore2 } = await import("@axiom-lattice/core");
       const bindingStore = getStore2("default", "channelBinding").store;
       const installationStore = getStore2("default", "channelInstallation").store;
-      (0, import_core38.setBindingRegistry)(bindingStore);
+      (0, import_core40.setBindingRegistry)(bindingStore);
       const router = new MessageRouter({
         middlewares: [
           createDeduplicationMiddleware(),
@@ -10304,8 +10527,8 @@ var start = async (config) => {
       });
     }
     try {
-      const menuStore = (0, import_core39.getStoreLattice)("default", "menu").store;
-      (0, import_core38.setMenuRegistry)(menuStore);
+      const menuStore = (0, import_core41.getStoreLattice)("default", "menu").store;
+      (0, import_core40.setMenuRegistry)(menuStore);
       logger5.info("Menu registry initialized");
     } catch {
     }
@@ -10313,17 +10536,17 @@ var start = async (config) => {
       setChannelControllerDeps({ adapterRegistry, router: channelDeps.router });
     }
     registerLatticeRoutes(app, channelDeps);
-    if (!import_core39.sandboxLatticeManager.hasLattice("default")) {
-      import_core39.sandboxLatticeManager.registerLattice("default", getConfiguredSandboxProvider());
+    if (!import_core41.sandboxLatticeManager.hasLattice("default")) {
+      import_core41.sandboxLatticeManager.registerLattice("default", getConfiguredSandboxProvider());
       logger5.info("Registered sandbox manager from env configuration");
     }
     try {
       const { ResourceController: ResourceController2 } = await Promise.resolve().then(() => (init_resources(), resources_exports));
-      const sharedResourceStore = (0, import_core39.getStoreLattice)("default", "sharedResource").store;
-      const cache = new import_core39.TokenCache();
+      const sharedResourceStore = (0, import_core41.getStoreLattice)("default", "sharedResource").store;
+      const cache = new import_core41.TokenCache();
       const resourceController = new ResourceController2({
         store: sharedResourceStore,
-        sandboxManager: import_core39.sandboxLatticeManager,
+        sandboxManager: import_core41.sandboxLatticeManager,
         cache,
         logger: logger5
       });
@@ -10363,7 +10586,7 @@ var start = async (config) => {
         agentTaskConsumer.startPollingQueue();
       }
     }
-    import_core39.agentInstanceManager.restore().then((stats) => {
+    import_core41.agentInstanceManager.restore().then((stats) => {
       logger5.info(`Agent recovery complete: ${stats.restored} threads restored, ${stats.errors} errors`);
     }).catch((error) => {
       logger5.error("Agent recovery failed", { error });