@axiom-lattice/gateway 2.1.116 → 3.0.0

package/dist/index.mjs

@@ -12,19 +12,386 @@ import {
 } from "./chunk-LHQY46YB.mjs";
 
 // src/index.ts
+import "dotenv/config";
 import fastify from "fastify";
 import cors from "@fastify/cors";
 import multipart from "@fastify/multipart";
 import sensible from "@fastify/sensible";
 import websocket from "@fastify/websocket";
 import staticPlugin from "@fastify/static";
-import path2 from "path";
+import path3 from "path";
 import { fileURLToPath } from "url";
 
 // src/controllers/assistant.ts
 import { agentInstanceManager, getStoreLattice } from "@axiom-lattice/core";
+import { AgentType } from "@axiom-lattice/protocols";
 import { randomUUID } from "crypto";
 import { agentLatticeManager, eventBus } from "@axiom-lattice/core";
+
+// src/services/local-a2a.ts
+import { spawn } from "child_process";
+import { existsSync, statSync } from "fs";
+import { dirname, join, parse, resolve } from "path";
+import { setTimeout as delay } from "timers/promises";
+var STDERR_TAIL_LIMIT = 4096;
+function readBooleanEnv(name, defaultValue, env = process.env) {
+  const value = env[name];
+  if (value === void 0) return defaultValue;
+  return value === "1" || value.toLowerCase() === "true";
+}
+function findWorkspaceRoot(startDir) {
+  let current = resolve(startDir);
+  const { root } = parse(current);
+  while (current !== root) {
+    if (existsSync(join(current, "pnpm-workspace.yaml"))) {
+      return current;
+    }
+    const parent = dirname(current);
+    if (parent === current) return null;
+    current = parent;
+  }
+}
+function resolveLocalA2AWorkingDirectory(options) {
+  if (options.envWorkdir) return options.envWorkdir;
+  if (options.commandCwd) return options.commandCwd;
+  return findWorkspaceRoot(options.currentCwd) || options.currentCwd;
+}
+function validateWorkingDirectory(cwd) {
+  try {
+    const stat2 = statSync(cwd);
+    if (!stat2.isDirectory()) {
+      return `Working directory is not a directory: ${cwd}`;
+    }
+    return null;
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    return `Working directory is not accessible: ${cwd} (${message})`;
+  }
+}
+function appendStderrTail(current, chunk) {
+  const next = `${current}${chunk}`;
+  if (next.length <= STDERR_TAIL_LIMIT) return next;
+  return next.slice(-STDERR_TAIL_LIMIT);
+}
+function formatExitMessage(exitReason, stderrTail) {
+  const stderr = stderrTail.trim();
+  return stderr ? `Exited before becoming ready (${exitReason}): ${stderr}` : `Exited before becoming ready (${exitReason})`;
+}
+async function probeReady(agentCardUrl, healthUrl, timeoutMs) {
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), timeoutMs);
+  try {
+    if (healthUrl) {
+      const resp = await fetch(healthUrl, { signal: controller.signal });
+      if (!resp.ok) return false;
+    }
+    const cardResp = await fetch(agentCardUrl, { signal: controller.signal });
+    return cardResp.ok;
+  } catch {
+    return false;
+  } finally {
+    clearTimeout(timer);
+  }
+}
+var _LocalA2AService = class _LocalA2AService {
+  constructor() {
+    this.states = /* @__PURE__ */ new Map();
+    this.autoStartEnabled = readBooleanEnv("LOCAL_A2A_AUTO_START", true);
+  }
+  static getInstance() {
+    if (!_LocalA2AService.instance) {
+      _LocalA2AService.instance = new _LocalA2AService();
+    }
+    return _LocalA2AService.instance;
+  }
+  getOrCreateState(runtimeId, localRuntime) {
+    let state = this.states.get(runtimeId);
+    if (!state) {
+      state = {
+        runtimeId,
+        label: localRuntime.label || runtimeId,
+        status: this.autoStartEnabled ? "stopped" : "disabled",
+        enabled: this.autoStartEnabled,
+        assistantId: runtimeId,
+        agentCardUrl: localRuntime.agentCardUrl,
+        healthUrl: localRuntime.healthUrl,
+        localRuntime
+      };
+      this.states.set(runtimeId, state);
+    } else {
+      state.localRuntime = localRuntime;
+      state.label = localRuntime.label || state.label;
+      state.agentCardUrl = localRuntime.agentCardUrl;
+      state.healthUrl = localRuntime.healthUrl;
+    }
+    return state;
+  }
+  async getRegisteredState(runtimeId, localRuntime) {
+    const state = this.getOrCreateState(runtimeId, localRuntime);
+    if (state.process && state.status === "running") {
+      const alive = await probeReady(
+        localRuntime.agentCardUrl,
+        localRuntime.healthUrl,
+        2e3
+      );
+      if (!alive) {
+        state.process = void 0;
+        state.pid = void 0;
+        state.status = "stopped";
+        state.message = "Process exited unexpectedly";
+      }
+    }
+    return this.snapshotState(state);
+  }
+  async startProvider(runtimeId, localRuntime) {
+    const state = this.getOrCreateState(runtimeId, localRuntime);
+    if (!state.enabled) {
+      state.status = "disabled";
+      state.message = "Disabled by configuration";
+      return this.snapshotState(state);
+    }
+    if (state.process && state.status === "running") {
+      return this.snapshotState(state);
+    }
+    state.enabled = true;
+    const { executable, args, cwd, env: cmdEnv } = localRuntime.command;
+    const resolvedCwd = resolveLocalA2AWorkingDirectory({
+      envWorkdir: process.env.LOCAL_A2A_WORKDIR || void 0,
+      commandCwd: cwd,
+      currentCwd: process.cwd()
+    });
+    const cwdError = validateWorkingDirectory(resolvedCwd);
+    if (cwdError) {
+      state.process = void 0;
+      state.pid = void 0;
+      state.status = "failed";
+      state.message = cwdError;
+      return this.snapshotState(state);
+    }
+    state.status = "starting";
+    state.message = "Starting";
+    let stderrTail = "";
+    const childEnv = cmdEnv ? { ...process.env, ...cmdEnv } : process.env;
+    const child = spawn(executable, args, {
+      cwd: resolvedCwd,
+      env: childEnv,
+      stdio: ["ignore", "pipe", "pipe"],
+      shell: false
+    });
+    state.process = child;
+    state.pid = child.pid ?? void 0;
+    child.once("error", (error) => {
+      const current = this.states.get(runtimeId);
+      if (!current) return;
+      current.process = void 0;
+      current.pid = void 0;
+      current.status = "failed";
+      const stderr = stderrTail.trim();
+      current.message = stderr ? `Failed to start: ${error.message}: ${stderr}` : `Failed to start: ${error.message}`;
+    });
+    child.stdout.on("data", (chunk) => {
+      const text = chunk.toString("utf8").trim();
+      if (text) console.log(`[local-a2a:${runtimeId}] ${text}`);
+    });
+    child.stderr.on("data", (chunk) => {
+      const rawText = chunk.toString("utf8");
+      stderrTail = appendStderrTail(stderrTail, rawText);
+      const text = rawText.trim();
+      if (text) console.error(`[local-a2a:${runtimeId}] ${text}`);
+    });
+    child.on("close", (code, signal) => {
+      const current = this.states.get(runtimeId);
+      if (!current) return;
+      current.process = void 0;
+      current.pid = void 0;
+      const exitReason = signal ?? code ?? "unknown";
+      if (current.status === "running") {
+        current.status = "stopped";
+        current.message = `Stopped (${exitReason})`;
+      } else if (current.status === "starting") {
+        current.status = "failed";
+        current.message = formatExitMessage(exitReason, stderrTail);
+      }
+    });
+    const ready = await this.waitUntilReady(localRuntime, state, 15e3);
+    if (!ready) {
+      if (state.process) {
+        state.process.kill("SIGTERM");
+      }
+      state.process = void 0;
+      state.pid = void 0;
+      if (state.status !== "failed") {
+        state.status = "failed";
+        state.message = "Server did not become ready";
+      }
+      return this.snapshotState(state);
+    }
+    state.status = "running";
+    state.message = "Running";
+    state.lastStartedAt = (/* @__PURE__ */ new Date()).toISOString();
+    return this.snapshotState(state);
+  }
+  async stopProvider(runtimeId) {
+    const state = this.states.get(runtimeId);
+    if (!state) {
+      return this.emptyState(runtimeId);
+    }
+    const child = state.process;
+    if (child) {
+      child.kill("SIGTERM");
+      await delay(750);
+      if (child.exitCode === null) {
+        child.kill("SIGKILL");
+      }
+      state.process = void 0;
+    }
+    state.pid = void 0;
+    state.status = "stopped";
+    state.message = "Stopped";
+    state.lastStoppedAt = (/* @__PURE__ */ new Date()).toISOString();
+    return this.snapshotState(state);
+  }
+  async restartProvider(runtimeId, localRuntime) {
+    await this.stopProvider(runtimeId);
+    return this.startProvider(runtimeId, localRuntime);
+  }
+  removeState(runtimeId) {
+    const state = this.states.get(runtimeId);
+    if (state?.process) {
+      state.process.kill("SIGTERM");
+      state.process = void 0;
+    }
+    this.states.delete(runtimeId);
+  }
+  async waitUntilReady(localRuntime, state, timeoutMs) {
+    const start2 = Date.now();
+    while (Date.now() - start2 < timeoutMs) {
+      if (state.status === "failed") return false;
+      if (await probeReady(localRuntime.agentCardUrl, localRuntime.healthUrl, 1500)) {
+        return true;
+      }
+      await delay(500);
+    }
+    return false;
+  }
+  emptyState(runtimeId) {
+    return {
+      runtimeId,
+      label: runtimeId,
+      status: "stopped",
+      enabled: false
+    };
+  }
+  snapshotState(state) {
+    return {
+      runtimeId: state.runtimeId,
+      label: state.label,
+      status: state.status,
+      enabled: state.enabled,
+      assistantId: state.assistantId,
+      agentCardUrl: state.agentCardUrl,
+      healthUrl: state.healthUrl,
+      pid: state.pid,
+      message: state.message,
+      lastStartedAt: state.lastStartedAt,
+      lastStoppedAt: state.lastStoppedAt
+    };
+  }
+};
+_LocalA2AService.instance = null;
+var LocalA2AService = _LocalA2AService;
+var localA2AService = LocalA2AService.getInstance();
+
+// src/utils/a2a-url.ts
+var AGENT_CARD_PATH = "/.well-known/agent-card.json";
+function normalizeA2AAgentCardUrl(value, defaultProtocol = "https://") {
+  const raw = value?.trim() ?? "";
+  if (!raw) return "";
+  const withProtocol = /^https?:\/\//i.test(raw) ? raw : `${defaultProtocol}${raw.replace(/^\/+/, "")}`;
+  const trimmed = withProtocol.replace(/\/+$/, "");
+  if (trimmed.endsWith(AGENT_CARD_PATH)) {
+    return trimmed;
+  }
+  return `${trimmed}${AGENT_CARD_PATH}`;
+}
+
+// src/utils/local-a2a-runtime.ts
+function validateLocalRuntimeCommand(localRuntime) {
+  const runtime = localRuntime;
+  const executable = runtime.command?.executable;
+  if (typeof executable !== "string" || executable.trim().length === 0) {
+    return {
+      ok: false,
+      error: "Local managed A2A command executable is required"
+    };
+  }
+  const args = runtime.command?.args;
+  if (!Array.isArray(args) || !args.every((arg) => typeof arg === "string")) {
+    return {
+      ok: false,
+      error: "Local managed A2A command args must be an array of strings"
+    };
+  }
+  return { ok: true };
+}
+function getAgentCardPort(agentCardUrl) {
+  let url;
+  try {
+    url = new URL(agentCardUrl);
+  } catch {
+    return null;
+  }
+  if (url.port) {
+    const port = Number(url.port);
+    return Number.isInteger(port) ? port : null;
+  }
+  if (url.protocol === "http:") return 80;
+  if (url.protocol === "https:") return 443;
+  return null;
+}
+function parseCommandPort(args) {
+  for (let index = 0; index < args.length; index += 1) {
+    const arg = args[index];
+    const match = /^(--port|-p)(?:[=\s]+(\d+))?$/.exec(arg);
+    if (!match) continue;
+    const inlinePort = match[2];
+    if (inlinePort) return Number(inlinePort);
+    const nextArg = args[index + 1];
+    if (nextArg && /^\d+$/.test(nextArg)) {
+      return Number(nextArg);
+    }
+  }
+  return null;
+}
+function isLoopbackHost(hostname) {
+  const normalized = hostname.toLowerCase();
+  return normalized === "localhost" || normalized === "127.0.0.1" || normalized === "::1" || normalized === "[::1]";
+}
+function validateLocalRuntimePort(localRuntime, agentCardUrl) {
+  let url;
+  try {
+    url = new URL(agentCardUrl);
+  } catch {
+    return { ok: true };
+  }
+  if (!isLoopbackHost(url.hostname) || !url.port) {
+    return { ok: true };
+  }
+  const commandPort = parseCommandPort(localRuntime.command.args);
+  if (commandPort === null) {
+    return { ok: true };
+  }
+  const agentCardPort = Number(url.port);
+  if (commandPort === agentCardPort) {
+    return { ok: true };
+  }
+  return {
+    ok: false,
+    error: `Local managed A2A command port (${commandPort}) does not match agentCardUrl port (${agentCardPort}). Update the command args or Agent Card URL so they use the same port.`
+  };
+}
+
+// src/controllers/assistant.ts
 function getTenantId(request) {
   const userTenantId = request.user?.tenantId;
   if (userTenantId) {
@@ -154,6 +521,79 @@ async function createAssistant(request, reply) {
     });
   }
   const id = data.id ?? randomUUID();
+  if (data.graphDefinition && data.graphDefinition.type === AgentType.A2A_REMOTE) {
+    const a2aConfig = data.graphDefinition;
+    const warnings = [];
+    const isLocalManaged = !!a2aConfig.localRuntime;
+    a2aConfig.agentCardUrl = normalizeA2AAgentCardUrl(
+      a2aConfig.agentCardUrl,
+      isLocalManaged ? "http://" : "https://"
+    );
+    if (a2aConfig.localRuntime) {
+      const commandValidation = validateLocalRuntimeCommand(
+        a2aConfig.localRuntime
+      );
+      if (!commandValidation.ok) {
+        return reply.status(400).send({
+          success: false,
+          message: commandValidation.error
+        });
+      }
+      a2aConfig.localRuntime.command.executable = a2aConfig.localRuntime.command.executable.trim();
+      a2aConfig.localRuntime.agentCardUrl = normalizeA2AAgentCardUrl(
+        a2aConfig.localRuntime.agentCardUrl || a2aConfig.agentCardUrl,
+        "http://"
+      );
+      a2aConfig.agentCardUrl = a2aConfig.localRuntime.agentCardUrl;
+      const portValidation = validateLocalRuntimePort(
+        a2aConfig.localRuntime,
+        a2aConfig.agentCardUrl
+      );
+      if (!portValidation.ok) {
+        return reply.status(400).send({
+          success: false,
+          message: portValidation.error
+        });
+      }
+    }
+    if (a2aConfig.localRuntime) {
+      const existingAssistants = await getStoreLattice("default", "assistant").store.getAllAssistants(tenantId);
+      const targetPort = getAgentCardPort(a2aConfig.localRuntime.agentCardUrl);
+      const duplicate = existingAssistants.find((a) => {
+        if (a.id === id) return false;
+        const gd = a.graphDefinition && typeof a.graphDefinition === "object" ? a.graphDefinition : void 0;
+        if (!gd || gd.type !== AgentType.A2A_REMOTE) return false;
+        const lr = gd.localRuntime;
+        if (!lr) return false;
+        const existingAgentCardUrl = normalizeA2AAgentCardUrl(lr.agentCardUrl, "http://");
+        const existingPort = getAgentCardPort(existingAgentCardUrl);
+        if (targetPort !== null && existingPort !== null) {
+          return existingPort === targetPort;
+        }
+        return existingAgentCardUrl === a2aConfig.localRuntime.agentCardUrl;
+      });
+      if (duplicate) {
+        const conflictDetail = targetPort === null ? `agentCardUrl "${a2aConfig.localRuntime.agentCardUrl}"` : `port ${targetPort}`;
+        return reply.status(409).send({
+          success: false,
+          message: `A local managed A2A assistant using ${conflictDetail} already exists: "${duplicate.name}". Each local managed A2A assistant needs a unique port.`
+        });
+      }
+    }
+    try {
+      const resp = await fetch(a2aConfig.agentCardUrl, {
+        signal: AbortSignal.timeout(5e3)
+      });
+      if (!resp.ok) {
+        warnings.push(`agentCardUrl returned HTTP ${resp.status}`);
+      }
+    } catch {
+      warnings.push(`agentCardUrl is not reachable: ${a2aConfig.agentCardUrl}`);
+    }
+    if (warnings.length > 0) {
+      console.warn(`[createAssistant] A2A warnings for ${a2aConfig.agentCardUrl}:`, warnings);
+    }
+  }
   return upsertAssistant(tenantId, id, data, reply, true);
 }
 async function updateAssistant(request, reply) {
@@ -167,11 +607,28 @@ async function deleteAssistant(request, reply) {
   const { id } = request.params;
   const storeLattice = getStoreLattice("default", "assistant");
   const assistantStore = storeLattice.store;
+  const storedAssistant = await assistantStore.getAssistantById(tenantId, id);
+  const graphDefinition = storedAssistant?.graphDefinition;
+  const hasLocalRuntime = graphDefinition && typeof graphDefinition === "object" ? !!graphDefinition.localRuntime : false;
+  if (storedAssistant && hasLocalRuntime) {
+    localA2AService.removeState(id);
+    const deleted2 = await assistantStore.deleteAssistant(tenantId, id);
+    if (!deleted2) {
+      return reply.status(500).send({
+        success: false,
+        message: "Failed to delete assistant"
+      });
+    }
+    eventBus.publish("assistant:deleted", { id, tenantId });
+    return {
+      success: true,
+      message: "Deleted local A2A assistant"
+    };
+  }
   const agentConfig = await agentLatticeManager.getAgentConfigWithTenant(tenantId, id);
   const isCodeConfigured = !!agentConfig;
   if (isCodeConfigured) {
-    const exists2 = await assistantStore.hasAssistant(tenantId, id);
-    if (!exists2) {
+    if (!storedAssistant) {
       return reply.status(404).send({
         success: false,
         message: "Assistant not found (code-configured assistants cannot be deleted from code, only from store)"
@@ -184,8 +641,7 @@ async function deleteAssistant(request, reply) {
       message: "Deleted assistant from store (code-configured registration remains)"
     };
   }
-  const exists = await assistantStore.hasAssistant(tenantId, id);
-  if (!exists) {
+  if (!storedAssistant) {
     return reply.status(404).send({
       success: false,
       message: "Assistant not found"
@@ -319,7 +775,7 @@ var createRun = async (request, reply) => {
 
 `);
           if (!success) {
-            await new Promise((resolve) => reply.raw.once("drain", resolve));
+            await new Promise((resolve3) => reply.raw.once("drain", resolve3));
           }
         }
       } catch (error) {
@@ -2911,15 +3367,14 @@ function getStore() {
 async function listTasks(request, reply) {
   try {
     const tenantId = getTenantId9(request);
-    const userId = getUserId4(request);
     const query = request.query;
     const store = getStore();
     const tasks = await store.list({
       tenantId,
-      ownerId: query.ownerId || userId,
       status: query.status,
       priority: query.priority,
-      ownerType: query.ownerType,
+      ...query.ownerId && { ownerId: query.ownerId },
+      ...query.ownerType && { ownerType: query.ownerType },
       metadata: query.metadata ? JSON.parse(query.metadata) : void 0,
       projectId: query.projectId,
       limit: query.limit ? parseInt(query.limit) : void 0,
@@ -4054,12 +4509,41 @@ function registerSandboxProxyRoutes(app2) {
 }
 
 // src/controllers/workspace.ts
-import * as fs from "fs/promises";
-import * as path from "path";
+import * as fs2 from "fs/promises";
+import * as path2 from "path";
+import * as os from "os";
 import { getStoreLattice as getStoreLattice7 } from "@axiom-lattice/core";
 import { SandboxFilesystem, FilesystemBackend } from "@axiom-lattice/core";
 import { getSandBoxManager as getSandBoxManager3 } from "@axiom-lattice/core";
 import { v4 as uuidv42 } from "uuid";
+
+// src/utils/path-containment.ts
+import * as fs from "fs/promises";
+import * as path from "path";
+var PathOutsideRootError = class extends Error {
+  constructor(rootPath, targetPath) {
+    super(`Path is outside the allowed root: ${targetPath}`);
+    this.rootPath = rootPath;
+    this.targetPath = targetPath;
+    this.name = "PathOutsideRootError";
+  }
+};
+function isPathWithinRoot(rootPath, targetPath) {
+  const relative2 = path.relative(rootPath, targetPath);
+  return relative2 === "" || relative2 !== ".." && !relative2.startsWith(`..${path.sep}`) && !path.isAbsolute(relative2);
+}
+async function resolvePathWithinRoot(rootPath, targetPath) {
+  const [resolvedRoot, resolvedTarget] = await Promise.all([
+    fs.realpath(rootPath),
+    fs.realpath(targetPath)
+  ]);
+  if (!isPathWithinRoot(resolvedRoot, resolvedTarget)) {
+    throw new PathOutsideRootError(resolvedRoot, resolvedTarget);
+  }
+  return { rootPath: resolvedRoot, targetPath: resolvedTarget };
+}
+
+// src/controllers/workspace.ts
 var WorkspaceController = class {
   constructor() {
     this.workspaceStore = getStoreLattice7("default", "workspace").store;
@@ -4220,16 +4704,23 @@ var WorkspaceController = class {
         }),
         workspace
       };
-    } else {
-      console.log(`[getBackend] using FilesystemBackend rootDir=/lattice_store/tenants/${tenantId}/workspaces/${workspaceId}/${projectId}`);
-      return {
-        backend: new FilesystemBackend({
-          rootDir: `/lattice_store/tenants/${tenantId}/workspaces/${workspaceId}/${projectId}`,
-          virtualMode: true
-        }),
-        workspace
-      };
     }
+    const rootDir = await this.getFilesystemRootDirectory(
+      tenantId,
+      workspaceId,
+      projectId
+    );
+    console.log(`[getBackend] using FilesystemBackend rootDir=${rootDir}`);
+    return {
+      backend: new FilesystemBackend({
+        rootDir,
+        virtualMode: true
+      }),
+      workspace
+    };
+  }
+  async getFilesystemRootDirectory(tenantId, workspaceId, projectId) {
+    return `/lattice_store/tenants/${tenantId}/workspaces/${workspaceId}/${projectId}`;
   }
   isBinaryContentType(filename) {
     const ext = filename.split(".").pop()?.toLowerCase() || "";
@@ -4418,21 +4909,21 @@ var WorkspaceController = class {
   async listPath(request) {
     const tenantId = this.getTenantId(request);
     const { workspaceId, projectId } = request.params;
-    const path3 = request.query.path || "/";
+    const path4 = request.query.path || "/";
     const assistantId = request.query.assistantId;
-    console.log(`[listPath] tenantId=${tenantId} workspaceId=${workspaceId} projectId=${projectId} path=${path3} assistantId=${assistantId}`);
-    const { backend } = await this.getBackend(tenantId, workspaceId, projectId, assistantId, path3);
-    console.log(`[listPath] backend type=${backend.constructor.name} calling lsInfo(${path3})`);
-    const files = await backend.lsInfo(path3);
+    console.log(`[listPath] tenantId=${tenantId} workspaceId=${workspaceId} projectId=${projectId} path=${path4} assistantId=${assistantId}`);
+    const { backend } = await this.getBackend(tenantId, workspaceId, projectId, assistantId, path4);
+    console.log(`[listPath] backend type=${backend.constructor.name} calling lsInfo(${path4})`);
+    const files = await backend.lsInfo(path4);
     console.log(`[listPath] result count=${files.length}`);
     return { success: true, data: files };
   }
   async readFile(request) {
     const tenantId = this.getTenantId(request);
     const { workspaceId, projectId } = request.params;
-    const { path: path3, offset = 0, limit = 1e3, assistantId } = request.query;
-    const { backend } = await this.getBackend(tenantId, workspaceId, projectId, assistantId, path3);
-    const content = await backend.read(path3, Number(offset), Number(limit));
+    const { path: path4, offset = 0, limit = 1e3, assistantId } = request.query;
+    const { backend } = await this.getBackend(tenantId, workspaceId, projectId, assistantId, path4);
+    const content = await backend.read(path4, Number(offset), Number(limit));
     return { success: true, data: { content, offset, limit } };
   }
   /**
@@ -4444,7 +4935,7 @@ var WorkspaceController = class {
    * - `path`: optional directory path relative to project root (e.g., "docs", "src/utils")
    * - `assistantId`: optional query parameter for sandbox identity matching
    * For sandbox storage, delegates to the sandbox upload API.
-   * For filesystem storage, writes directly under /lattice_store/workspaces/{workspaceId}/{projectId}.
+   * For filesystem storage, writes under the same project root used by the file backend.
    */
   async uploadFile(request, reply) {
     const tenantId = this.getTenantId(request);
@@ -4478,7 +4969,7 @@ var WorkspaceController = class {
           workspaceId,
           projectId
         };
-        const realPath = pathValue ? path.posix.join(pathValue, filename) : path.posix.join("/project/uploads", filename);
+        const realPath = pathValue ? path2.posix.join(pathValue, filename) : path2.posix.join("/project/uploads", filename);
         const isBinary = this.isBinaryContentType(filename);
         const volumeBackend = await sandboxManager.getVolumeBackendForPath(volumeConfig, realPath);
         if (volumeBackend && !isBinary) {
@@ -4489,7 +4980,7 @@ var WorkspaceController = class {
           const sandbox = await sandboxManager.getSandboxFromConfig(volumeConfig);
           await sandbox.file.uploadFile({ file: realPath, data: buffer });
         }
-        const relativePath = pathValue ? path.posix.join(pathValue, filename) : path.posix.join("/project/uploads", filename);
+        const relativePath = pathValue ? path2.posix.join(pathValue, filename) : path2.posix.join("/project/uploads", filename);
         const result2 = {
           path: relativePath,
           name: filename,
@@ -4499,14 +4990,43 @@ var WorkspaceController = class {
         };
         return reply.status(200).send({ success: true, data: result2 });
       }
-      const rootDir = `/lattice_store/tenants/${tenantId}/workspaces/${workspaceId}/${projectId}`;
-      const targetDir = pathValue ? path.join(rootDir, pathValue) : rootDir;
-      const targetPath = path.join(targetDir, filename);
-      await fs.mkdir(path.dirname(targetPath), { recursive: true });
-      await fs.writeFile(targetPath, buffer);
-      const stat2 = await fs.stat(targetPath);
+      const rootDir = await this.getFilesystemRootDirectory(
+        tenantId,
+        workspaceId,
+        projectId
+      );
+      await fs2.mkdir(rootDir, { recursive: true });
+      const relativeDirectory = pathValue?.replace(/^[/\\]+/, "") || ".";
+      const targetDir = path2.resolve(rootDir, relativeDirectory);
+      if (!isPathWithinRoot(path2.resolve(rootDir), targetDir)) {
+        return reply.status(400).send({
+          success: false,
+          error: "Upload path must stay within the project directory"
+        });
+      }
+      await fs2.mkdir(targetDir, { recursive: true });
+      const [resolvedRoot, resolvedTargetDir] = await Promise.all([
+        fs2.realpath(rootDir),
+        fs2.realpath(targetDir)
+      ]);
+      if (!isPathWithinRoot(resolvedRoot, resolvedTargetDir)) {
+        return reply.status(400).send({
+          success: false,
+          error: "Upload path must stay within the project directory"
+        });
+      }
+      const safeFilename = path2.basename(filename);
+      if (safeFilename !== filename) {
+        return reply.status(400).send({
+          success: false,
+          error: "Invalid filename"
+        });
+      }
+      const targetPath = path2.join(resolvedTargetDir, safeFilename);
+      await fs2.writeFile(targetPath, buffer);
+      const stat2 = await fs2.stat(targetPath);
       const result = {
-        path: pathValue ? `/${pathValue}/${filename}` : `/${filename}`,
+        path: path2.posix.join("/", relativeDirectory, safeFilename),
         name: filename,
         is_dir: false,
         size: stat2.size,
@@ -4514,9 +5034,63 @@ var WorkspaceController = class {
       };
       return reply.status(200).send({ success: true, data: result });
     } catch (error) {
+      const message = error instanceof Error ? error.message : String(error);
       return reply.status(500).send({
         success: false,
-        error: `Upload handler error: ${error?.message || String(error)}`
+        error: `Upload handler error: ${message}`
+      });
+    }
+  }
+  /**
+   * Browse local filesystem directories for the folder picker.
+   *
+   * Security constraints:
+   * - Restricted to os.homedir()
+   * - Blacklists system directories
+   * - Returns only directory names, no file contents or hidden files
+   */
+  async browseFilesystem(request, reply) {
+    const homeDir = os.homedir();
+    const requestedPath = request.query.path || homeDir;
+    const SYSTEM_BLACKLIST = ["/etc", "/sys", "/proc", "/var", "/tmp", "/dev"];
+    try {
+      const resolved = await resolvePathWithinRoot(homeDir, requestedPath);
+      const normalized = resolved.targetPath;
+      for (const blacklisted of SYSTEM_BLACKLIST) {
+        if (isPathWithinRoot(blacklisted, normalized)) {
+          return reply.status(403).send({
+            success: false,
+            error: `Cannot browse system directory: ${blacklisted}`
+          });
+        }
+      }
+      const entries = await fs2.readdir(normalized, { withFileTypes: true });
+      const dirEntries = entries.filter((entry) => !entry.name.startsWith(".") && entry.isDirectory()).map((entry) => ({
+        name: entry.name,
+        path: path2.join(normalized, entry.name),
+        isDirectory: true
+      }));
+      const parentPath = path2.dirname(normalized);
+      const hasParent = parentPath !== normalized && isPathWithinRoot(resolved.rootPath, parentPath);
+      return {
+        success: true,
+        data: {
+          path: normalized,
+          parentPath: hasParent ? parentPath : void 0,
+          entries: dirEntries
+        }
+      };
+    } catch (error) {
+      if (error instanceof PathOutsideRootError) {
+        return reply.status(403).send({
+          success: false,
+          error: "Browse restricted to home directory"
+        });
+      }
+      const message = error instanceof Error ? error.message : String(error);
+      return reply.status(400).send({
+        success: false,
+        error: `Cannot read directory: ${message}`
       });
     }
   }
@@ -4577,6 +5151,10 @@ function registerWorkspaceRoutes(app2) {
     "/api/workspaces/:workspaceId/projects/:projectId/viewfile",
     controller.viewFile.bind(controller)
   );
+  app2.get(
+    "/api/filesystem/browse",
+    controller.browseFilesystem.bind(controller)
+  );
 }
 
 // src/controllers/database-configs.ts
@@ -4796,7 +5374,7 @@ async function testDatabaseConnection(request, reply) {
       await db.connect();
       await db.listTables();
       const latency = Date.now() - startTime;
-      await new Promise((resolve) => setTimeout(resolve, 100));
+      await new Promise((resolve3) => setTimeout(resolve3, 100));
       await db.disconnect();
       await sqlDatabaseManager.removeDatabase(tenantId, testKey);
       return {
@@ -5690,6 +6268,9 @@ var EvalRunner = class {
     const runId = uuidv43();
     const concurrency = Math.max(1, Math.floor(project.concurrency) || 3);
     await store.createRun(tenantId, projectId, runId, { totalCases, concurrency });
+    const tsc = project.targetServerConfig ?? {};
+    const workspaceId = tsc.workspace_id || "";
+    const projectIdFromConfig = tsc.project_id || "";
     const projectConfig = {
       projectName: project.name,
       version: project.version,
@@ -5697,7 +6278,9 @@ var EvalRunner = class {
       suites: evalSuites,
       judge_agent_config: { modelKey: resolvedJudgeModelKey },
       lattice_server_config: {
-        tenant_id: tenantId
+        tenant_id: tenantId,
+        workspace_id: workspaceId,
+        project_id: projectIdFromConfig
       },
       concurrency
     };
@@ -7109,8 +7692,8 @@ function getTenantId14(request) {
   return request.headers["x-tenant-id"] || "default";
 }
 async function getInstallationStore() {
-  const { getStoreLattice: getStoreLattice30 } = await import("@axiom-lattice/core");
-  const store = getStoreLattice30("default", "channelInstallation").store;
+  const { getStoreLattice: getStoreLattice31 } = await import("@axiom-lattice/core");
+  const store = getStoreLattice31("default", "channelInstallation").store;
   if (store) return store;
   const { PostgreSQLChannelInstallationStore } = await import("@axiom-lattice/pg-stores");
   const databaseUrl = process.env.DATABASE_URL;
@@ -7591,8 +8174,8 @@ var log = {
 };
 var connections = /* @__PURE__ */ new Map();
 var pending = /* @__PURE__ */ new Map();
-function getAgentIdFromPath(path3) {
-  const match = path3.match(/^\/api\/a2a\/bridge\/proxy\/([^/]+)/);
+function getAgentIdFromPath(path4) {
+  const match = path4.match(/^\/api\/a2a\/bridge\/proxy\/([^/]+)/);
   return match ? match[1] : null;
 }
 function handleBridgeConnection(socket, _request) {
@@ -7700,12 +8283,12 @@ async function handleBridgeProxy(request, reply) {
   };
   const timeout = 3e5;
   try {
-    const response = await new Promise((resolve, reject) => {
+    const response = await new Promise((resolve3, reject) => {
       const timer = setTimeout(() => {
         pending.delete(requestId);
         reject(new Error(`Bridge request timeout after ${timeout}ms`));
       }, timeout);
-      pending.set(requestId, { resolve, reject, timer, agentId });
+      pending.set(requestId, { resolve: resolve3, reject, timer, agentId });
       try {
         if (conn.ws.readyState !== conn.ws.OPEN) {
           pending.delete(requestId);
@@ -7750,9 +8333,352 @@ function registerA2ABridgeRoutes(app2) {
   });
 }
 
+// src/routes/stt.ts
+import { getSTTClient, sttModelLatticeManager } from "@axiom-lattice/core";
+var ALLOWED_AUDIO_FORMATS = /* @__PURE__ */ new Set([
+  "webm",
+  "wav",
+  "mp3",
+  "m4a",
+  "ogg",
+  "flac",
+  "aac"
+]);
+var MAX_AUDIO_FILE_SIZE = 25 * 1024 * 1024;
+var registerSTTRoutes = (app2) => {
+  app2.get("/api/stt/models", async (_request, reply) => {
+    const models = sttModelLatticeManager.getAllSTTModelInfo();
+    return reply.send({ models });
+  });
+  app2.post(
+    "/api/stt/transcribe",
+    {
+      schema: {
+        querystring: {
+          type: "object",
+          properties: {
+            model: { type: "string" }
+          }
+        },
+        response: {
+          200: {
+            type: "object",
+            properties: {
+              text: { type: "string" },
+              confidence: { type: "number" }
+            }
+          }
+        }
+      }
+    },
+    async (request, reply) => {
+      const modelKey = request.query.model || "default";
+      const data = await request.file({
+        limits: { fileSize: MAX_AUDIO_FILE_SIZE }
+      });
+      if (!data) {
+        return reply.status(400).send({ error: "No audio file provided" });
+      }
+      const buffer = await data.toBuffer();
+      if (buffer.length === 0) {
+        return reply.status(400).send({ error: "Empty audio file" });
+      }
+      const format = (data.filename.split(".").pop() || "webm").toLowerCase();
+      if (!ALLOWED_AUDIO_FORMATS.has(format)) {
+        return reply.status(400).send({ error: `Unsupported audio format: ${format}` });
+      }
+      try {
+        let client;
+        try {
+          client = getSTTClient(modelKey);
+        } catch {
+          return reply.status(404).send({ error: `STT model "${modelKey}" not found` });
+        }
+        const result = await client.transcribe(buffer, format);
+        return reply.send({
+          text: result.text,
+          confidence: result.confidence
+        });
+      } catch (error) {
+        const sanitizedMessage = error instanceof Error ? error.message : "Transcription failed";
+        request.log.error(
+          { error: sanitizedMessage },
+          "STT transcription failed"
+        );
+        return reply.status(500).send({ error: "Transcription service error. Please try again." });
+      }
+    }
+  );
+};
+
+// src/controllers/local-a2a.ts
+import { getStoreLattice as getStoreLattice15 } from "@axiom-lattice/core";
+import {
+  AgentType as AgentType2
+} from "@axiom-lattice/protocols";
+function getTenantId17(request) {
+  const userTenantId = request.user?.tenantId;
+  if (userTenantId) return userTenantId;
+  return request.headers["x-tenant-id"] || "default";
+}
+function getLocalRuntime(assistant) {
+  const graphDefinition = assistant.graphDefinition;
+  if (!graphDefinition || typeof graphDefinition !== "object") return void 0;
+  if (graphDefinition.type !== AgentType2.A2A_REMOTE) return void 0;
+  return graphDefinition.localRuntime;
+}
+async function getLocalA2AAssistants(tenantId) {
+  const storeLattice = getStoreLattice15("default", "assistant");
+  const assistants = await storeLattice.store.getAllAssistants(tenantId);
+  const results = [];
+  for (const assistant of assistants) {
+    const runtime = getLocalRuntime(assistant);
+    if (runtime) {
+      results.push({ assistant, localRuntime: runtime });
+    }
+  }
+  return results;
+}
+async function getLocalA2AAssistant(tenantId, assistantId) {
+  const storeLattice = getStoreLattice15("default", "assistant");
+  const assistant = await storeLattice.store.getAssistantById(tenantId, assistantId);
+  if (!assistant) return null;
+  const runtime = getLocalRuntime(assistant);
+  if (!runtime) return null;
+  return { assistant, localRuntime: runtime };
+}
+async function requireManagedAssistant(request, reply) {
+  const assistantId = request.params.assistantId;
+  if (!assistantId) {
+    reply.status(400).send({ success: false, error: "assistantId is required" });
+    return null;
+  }
+  const registered = await getLocalA2AAssistant(getTenantId17(request), assistantId);
+  if (!registered) {
+    reply.status(404).send({
+      success: false,
+      error: `Assistant ${assistantId} is not a local managed A2A assistant`
+    });
+    return null;
+  }
+  return { assistantId, localRuntime: registered.localRuntime };
+}
+async function getLocalA2AStatus(request, reply) {
+  const tenantId = getTenantId17(request);
+  const managed = await getLocalA2AAssistants(tenantId);
+  const states = await Promise.all(
+    managed.map(
+      ({ assistant, localRuntime }) => localA2AService.getRegisteredState(assistant.id, localRuntime)
+    )
+  );
+  reply.send({ success: true, data: { records: states, total: states.length } });
+}
+async function getLocalA2AProvider(request, reply) {
+  const registered = await requireManagedAssistant(request, reply);
+  if (!registered) return;
+  const state = await localA2AService.getRegisteredState(
+    registered.assistantId,
+    registered.localRuntime
+  );
+  reply.send({ success: true, data: state });
+}
+async function startLocalA2AProvider(request, reply) {
+  const registered = await requireManagedAssistant(request, reply);
+  if (!registered) return;
+  const state = await localA2AService.startProvider(
+    registered.assistantId,
+    registered.localRuntime
+  );
+  reply.send({ success: true, data: state });
+}
+async function stopLocalA2AProvider(request, reply) {
+  const registered = await requireManagedAssistant(request, reply);
+  if (!registered) return;
+  const state = await localA2AService.stopProvider(registered.assistantId);
+  reply.send({ success: true, data: state });
+}
+async function restartLocalA2AProvider(request, reply) {
+  const registered = await requireManagedAssistant(request, reply);
+  if (!registered) return;
+  const state = await localA2AService.restartProvider(
+    registered.assistantId,
+    registered.localRuntime
+  );
+  reply.send({ success: true, data: state });
+}
+
+// src/config/local-a2a-templates.ts
+import { cliA2AEntryPath } from "@axiom-lattice/cli-a2a/cli-path";
+function buildCliA2ACommand(provider, agentName, agentDescription) {
+  return {
+    executable: process.execPath,
+    args: [
+      cliA2AEntryPath,
+      "--provider",
+      provider,
+      "--hostname",
+      "localhost",
+      "--advertise-host",
+      "localhost",
+      "--agent-name",
+      agentName,
+      "--agent-description",
+      agentDescription,
+      "--log-level",
+      "info"
+    ]
+  };
+}
+var LOCAL_A2A_TEMPLATES = [
+  {
+    key: "claude",
+    name: "Claude Code",
+    command: buildCliA2ACommand(
+      "claude",
+      "Claude Code",
+      "Local Claude Code wrapper exposed through A2A."
+    )
+  },
+  {
+    key: "codex",
+    name: "Codex",
+    command: buildCliA2ACommand(
+      "codex",
+      "Codex",
+      "Local Codex wrapper exposed through A2A."
+    )
+  },
+  {
+    key: "opencode",
+    name: "OpenCode",
+    command: buildCliA2ACommand(
+      "opencode",
+      "OpenCode",
+      "Local OpenCode wrapper exposed through A2A."
+    )
+  }
+];
+
+// src/controllers/local-a2a-templates.ts
+async function getLocalA2ATemplates(_request, reply) {
+  reply.send({
+    success: true,
+    data: {
+      records: LOCAL_A2A_TEMPLATES,
+      total: LOCAL_A2A_TEMPLATES.length
+    }
+  });
+}
+
+// src/routes/a2a-test-connection.ts
+import { randomUUID as randomUUID8 } from "crypto";
+function describeTestConnectionError(error, agentCardUrl) {
+  if (!(error instanceof Error)) {
+    return `Failed to fetch agent card from ${agentCardUrl}: ${String(error)}`;
+  }
+  const cause = error.cause;
+  const causeParts = [];
+  if (cause instanceof Error) {
+    causeParts.push(cause.message);
+    const causeCode = cause.code;
+    if (causeCode && !causeParts.some((part) => part.includes(causeCode))) {
+      causeParts.push(causeCode);
+    }
+  } else if (typeof cause === "object" && cause !== null) {
+    const code = "code" in cause ? String(cause.code) : "";
+    const message = "message" in cause ? String(cause.message) : "";
+    if (message) causeParts.push(message);
+    if (code && !message.includes(code)) causeParts.push(code);
+  }
+  const detail = causeParts.length > 0 ? ` (${causeParts.join(", ")})` : "";
+  return `Failed to fetch agent card from ${agentCardUrl}: ${error.message}${detail}`;
+}
+async function ensureLocalRuntimeForConnectionTest(localRuntime, agentCardUrl) {
+  const commandValidation = validateLocalRuntimeCommand(localRuntime);
+  if (!commandValidation.ok) {
+    return { error: commandValidation.error };
+  }
+  const testRuntime = {
+    ...localRuntime,
+    agentCardUrl,
+    command: {
+      ...localRuntime.command,
+      executable: localRuntime.command.executable.trim()
+    }
+  };
+  const portValidation = validateLocalRuntimePort(testRuntime, agentCardUrl);
+  if (!portValidation.ok) {
+    return { error: portValidation.error };
+  }
+  const state = await localA2AService.startProvider(
+    `test-${randomUUID8()}`,
+    testRuntime
+  );
+  if (state.status === "running") return { runtimeId: state.runtimeId };
+  const detail = state.message ? ` ${state.message}` : "";
+  localA2AService.removeState(state.runtimeId);
+  return { error: `Local managed A2A server could not start for connection test.${detail}` };
+}
+async function readShortResponseBody(resp) {
+  const body = await resp.text().catch(() => "");
+  return body.length > 500 ? `${body.slice(0, 500)}...` : body;
+}
+function registerA2ATestConnectionRoute(app2) {
+  app2.post("/api/a2a/test-connection", async (request, reply) => {
+    const { agentCardUrl, apiKey, localRuntime } = request.body ?? {};
+    const normalizedAgentCardUrl = normalizeA2AAgentCardUrl(
+      agentCardUrl,
+      localRuntime ? "http://" : "https://"
+    );
+    if (!normalizedAgentCardUrl) {
+      return reply.status(400).send({ success: false, error: "agentCardUrl is required" });
+    }
+    let testRuntimeId = null;
+    try {
+      const headers = {};
+      if (apiKey) headers["Authorization"] = `Bearer ${apiKey}`;
+      if (localRuntime) {
+        const localStartResult = await ensureLocalRuntimeForConnectionTest(localRuntime, normalizedAgentCardUrl);
+        if ("error" in localStartResult) {
+          return reply.send({ success: true, data: { reachable: false, error: localStartResult.error } });
+        }
+        testRuntimeId = localStartResult.runtimeId;
+      }
+      const resp = await fetch(normalizedAgentCardUrl, { headers, signal: AbortSignal.timeout(8e3) });
+      if (!resp.ok) {
+        const body = await readShortResponseBody(resp);
+        const suffix = body ? `: ${body}` : "";
+        return reply.send({ success: true, data: { reachable: false, error: `HTTP ${resp.status} ${resp.statusText}${suffix}` } });
+      }
+      const card = await resp.json();
+      return reply.send({ success: true, data: { reachable: true, agentName: card.name, agentCard: card } });
+    } catch (error) {
+      return reply.send({
+        success: true,
+        data: {
+          reachable: false,
+          error: describeTestConnectionError(error, normalizedAgentCardUrl)
+        }
+      });
+    } finally {
+      if (testRuntimeId) {
+        localA2AService.removeState(testRuntimeId);
+      }
+    }
+  });
+}
+
 // src/routes/index.ts
 var registerLatticeRoutes = (app2, channelDeps) => {
   registerA2ABridgeRoutes(app2);
+  registerSTTRoutes(app2);
+  app2.get("/api/local-a2a", getLocalA2AStatus);
+  app2.get("/api/local-a2a/templates", getLocalA2ATemplates);
+  app2.get("/api/local-a2a/:assistantId", getLocalA2AProvider);
+  app2.post("/api/local-a2a/:assistantId/start", startLocalA2AProvider);
+  app2.post("/api/local-a2a/:assistantId/stop", stopLocalA2AProvider);
+  app2.post("/api/local-a2a/:assistantId/restart", restartLocalA2AProvider);
+  registerA2ATestConnectionRoute(app2);
   app2.post("/api/runs", createRun);
   app2.post("/api/resume_stream", resumeStream);
   app2.post("/api/assistants/:assistantId/threads/:threadId/abort", abortRun);
@@ -8047,9 +8973,9 @@ function registerResourceRoutes(app2, controller) {
 import { ExportableEntityRegistry as ExportableEntityRegistry3 } from "@axiom-lattice/core";
 
 // src/export_registrations/skill.registration.ts
-import { getStoreLattice as getStoreLattice15 } from "@axiom-lattice/core";
+import { getStoreLattice as getStoreLattice16 } from "@axiom-lattice/core";
 function getStore2() {
-  return getStoreLattice15("default", "skill").store;
+  return getStoreLattice16("default", "skill").store;
 }
 var skillRegistration = {
   entityType: "skill",
@@ -8124,9 +9050,9 @@ var skillRegistration = {
 };
 
 // src/export_registrations/agent.registration.ts
-import { getStoreLattice as getStoreLattice16 } from "@axiom-lattice/core";
+import { getStoreLattice as getStoreLattice17 } from "@axiom-lattice/core";
 function getStore3() {
-  return getStoreLattice16("default", "assistant").store;
+  return getStoreLattice17("default", "assistant").store;
 }
 var agentRegistration = {
   entityType: "agent",
@@ -8193,9 +9119,9 @@ var agentRegistration = {
 };
 
 // src/export_registrations/binding.registration.ts
-import { getStoreLattice as getStoreLattice17 } from "@axiom-lattice/core";
+import { getStoreLattice as getStoreLattice18 } from "@axiom-lattice/core";
 function getStore4() {
-  return getStoreLattice17("default", "channelBinding").store;
+  return getStoreLattice18("default", "channelBinding").store;
 }
 var bindingRegistration = {
   entityType: "binding",
@@ -8283,9 +9209,9 @@ var bindingRegistration = {
 };
 
 // src/export_registrations/database-config.registration.ts
-import { getStoreLattice as getStoreLattice18 } from "@axiom-lattice/core";
+import { getStoreLattice as getStoreLattice19 } from "@axiom-lattice/core";
 function getStore5() {
-  return getStoreLattice18("default", "database").store;
+  return getStoreLattice19("default", "database").store;
 }
 var databaseConfigRegistration = {
   entityType: "database_config",
@@ -8365,9 +9291,9 @@ var databaseConfigRegistration = {
 };
 
 // src/export_registrations/metrics-config.registration.ts
-import { getStoreLattice as getStoreLattice19 } from "@axiom-lattice/core";
+import { getStoreLattice as getStoreLattice20 } from "@axiom-lattice/core";
 function getStore6() {
-  return getStoreLattice19("default", "metrics").store;
+  return getStoreLattice20("default", "metrics").store;
 }
 var metricsConfigRegistration = {
   entityType: "metrics_config",
@@ -8447,9 +9373,9 @@ var metricsConfigRegistration = {
 };
 
 // src/export_registrations/mcp-config.registration.ts
-import { getStoreLattice as getStoreLattice20 } from "@axiom-lattice/core";
+import { getStoreLattice as getStoreLattice21 } from "@axiom-lattice/core";
 function getStore7() {
-  return getStoreLattice20("default", "mcp").store;
+  return getStoreLattice21("default", "mcp").store;
 }
 var mcpConfigRegistration = {
   entityType: "mcp_config",
@@ -8532,9 +9458,9 @@ var mcpConfigRegistration = {
 };
 
 // src/export_registrations/connection.registration.ts
-import { getStoreLattice as getStoreLattice21 } from "@axiom-lattice/core";
+import { getStoreLattice as getStoreLattice22 } from "@axiom-lattice/core";
 function getStore8() {
-  return getStoreLattice21("default", "connection").store;
+  return getStoreLattice22("default", "connection").store;
 }
 async function listAllConnections(tenantId) {
   const store = getStore8();
@@ -8616,9 +9542,9 @@ var connectionRegistration = {
 };
 
 // src/export_registrations/collection.registration.ts
-import { getStoreLattice as getStoreLattice22 } from "@axiom-lattice/core";
+import { getStoreLattice as getStoreLattice23 } from "@axiom-lattice/core";
 function getStore9() {
-  return getStoreLattice22("default", "collection").store;
+  return getStoreLattice23("default", "collection").store;
 }
 var collectionRegistration = {
   entityType: "collection",
@@ -8689,9 +9615,9 @@ var collectionRegistration = {
 };
 
 // src/export_registrations/channel-installation.registration.ts
-import { getStoreLattice as getStoreLattice23 } from "@axiom-lattice/core";
+import { getStoreLattice as getStoreLattice24 } from "@axiom-lattice/core";
 function getStore10() {
-  return getStoreLattice23("default", "channelInstallation").store;
+  return getStoreLattice24("default", "channelInstallation").store;
 }
 var channelInstallationRegistration = {
   entityType: "channel_installation",
@@ -8766,9 +9692,9 @@ var channelInstallationRegistration = {
 };
 
 // src/export_registrations/menu.registration.ts
-import { getStoreLattice as getStoreLattice24 } from "@axiom-lattice/core";
+import { getStoreLattice as getStoreLattice25 } from "@axiom-lattice/core";
 function getStore11() {
-  return getStoreLattice24("default", "menu").store;
+  return getStoreLattice25("default", "menu").store;
 }
 var menuRegistration = {
   entityType: "menu",
@@ -8846,9 +9772,9 @@ var menuRegistration = {
 };
 
 // src/export_registrations/task.registration.ts
-import { getStoreLattice as getStoreLattice25 } from "@axiom-lattice/core";
+import { getStoreLattice as getStoreLattice26 } from "@axiom-lattice/core";
 function getStore12() {
-  return getStoreLattice25("default", "task").store;
+  return getStoreLattice26("default", "task").store;
 }
 var taskRegistration = {
   entityType: "task",
@@ -8934,9 +9860,9 @@ var taskRegistration = {
 };
 
 // src/export_registrations/a2a-api-key.registration.ts
-import { getStoreLattice as getStoreLattice26 } from "@axiom-lattice/core";
+import { getStoreLattice as getStoreLattice27 } from "@axiom-lattice/core";
 function getStore13() {
-  return getStoreLattice26("default", "a2aApiKey").store;
+  return getStoreLattice27("default", "a2aApiKey").store;
 }
 var a2aApiKeyRegistration = {
   entityType: "a2a_api_key",
@@ -9007,9 +9933,9 @@ var a2aApiKeyRegistration = {
 };
 
 // src/export_registrations/eval.registration.ts
-import { getStoreLattice as getStoreLattice27 } from "@axiom-lattice/core";
+import { getStoreLattice as getStoreLattice28 } from "@axiom-lattice/core";
 function getStore14() {
-  return getStoreLattice27("default", "eval").store;
+  return getStoreLattice28("default", "eval").store;
 }
 var evalRegistration = {
   entityType: "eval",
@@ -9353,10 +10279,10 @@ function registerAllBuiltinEntities() {
 
 // src/router/MessageRouter.ts
 import {
-  getStoreLattice as getStoreLattice28,
+  getStoreLattice as getStoreLattice29,
   agentInstanceManager as agentInstanceManager6
 } from "@axiom-lattice/core";
-import { randomUUID as randomUUID8 } from "crypto";
+import { randomUUID as randomUUID9 } from "crypto";
 var BindingNotFoundError = class extends Error {
   constructor(message) {
     super(message);
@@ -9516,7 +10442,7 @@ var MessageRouter = class {
             channel: message.channel,
             adapterChannel: adapter.channel
           }, "Thread resolved by adapter strategy");
-          const threadStore = getStoreLattice28("default", "thread").store;
+          const threadStore = getStoreLattice29("default", "thread").store;
           try {
             await threadStore.createThread(
               tenantId,
@@ -9553,8 +10479,8 @@ var MessageRouter = class {
           }
         }
         if (!threadId) {
-          const threadStore = getStoreLattice28("default", "thread").store;
-          const newThreadId = randomUUID8();
+          const threadStore = getStoreLattice29("default", "thread").store;
+          const newThreadId = randomUUID9();
           console.log({
             event: "dispatch:thread:create",
             agentId,
@@ -9979,7 +10905,7 @@ ${summary}`
       console.log(
         `\u5C06\u5728 ${delayMs}ms \u540E\u91CD\u8BD5\u4EFB\u52A1 (${nextRetryCount}/${maxRetries})`
       );
-      await new Promise((resolve) => setTimeout(resolve, delayMs));
+      await new Promise((resolve3) => setTimeout(resolve3, delayMs));
       return handleAgentTask(taskRequest, nextRetryCount);
     }
     if (callback_event) {
@@ -10159,7 +11085,7 @@ import {
   getLoggerLattice,
   loggerLatticeManager,
   sandboxLatticeManager as sandboxLatticeManager2,
-  getStoreLattice as getStoreLattice29,
+  getStoreLattice as getStoreLattice30,
   agentInstanceManager as agentInstanceManager8,
   createSandboxProvider,
   TokenCache,
@@ -10209,7 +11135,7 @@ var getHeaderValue = (header) => {
   }
   return header;
 };
-var PUBLIC_ROUTES = ["/api/auth/login", "/api/auth/register", "/health"];
+var PUBLIC_ROUTES = ["/api/auth/login", "/api/auth/register", "/health", "/api/stt/models"];
 app.addHook("preHandler", async (request, reply) => {
   const user = extractUserFromAuthHeader(request.headers.authorization);
   if (user) {
@@ -10269,9 +11195,9 @@ app.register(multipart, {
 });
 app.register(websocket);
 var __filename = fileURLToPath(import.meta.url);
-var __dirname = path2.dirname(__filename);
+var __dirname = path3.dirname(__filename);
 app.register(staticPlugin, {
-  root: path2.join(__dirname, "../public"),
+  root: path3.join(__dirname, "../public"),
   prefix: "/"
 });
 app.setErrorHandler((error, request, reply) => {
@@ -10312,7 +11238,7 @@ function getConfiguredSandboxProvider() {
 }
 async function restoreMcpConnections() {
   try {
-    const storeLattice = getStoreLattice29("default", "mcp");
+    const storeLattice = getStoreLattice30("default", "mcp");
     const store = storeLattice.store;
     if (!store) {
       logger4.info("MCP store not configured, skipping connection restoration");
@@ -10381,7 +11307,7 @@ var start = async (config) => {
       channelDeps = { router, installationStore };
       try {
         const a2aKeyStore = getStore15("default", "a2aApiKey").store;
-        const a2a = await import("./a2a-ERG5RMUW.mjs");
+        const a2a = await import("./a2a-QMHEH3ZT.mjs");
         a2a.setA2AKeyStore(a2aKeyStore);
         await a2a.refreshStoreKeyMap();
         logger4.info("A2A key store initialized");
@@ -10394,7 +11320,7 @@ var start = async (config) => {
     }
     setEvalRunService(evalRunner);
     try {
-      const menuStore = getStoreLattice29("default", "menu").store;
+      const menuStore = getStoreLattice30("default", "menu").store;
       setMenuRegistry(menuStore);
       logger4.info("Menu registry initialized");
     } catch {
@@ -10410,7 +11336,7 @@ var start = async (config) => {
     }
     try {
       const { ResourceController } = await import("./resources-VA7LSDKN.mjs");
-      const sharedResourceStore = getStoreLattice29("default", "sharedResource").store;
+      const sharedResourceStore = getStoreLattice30("default", "sharedResource").store;
       const cache = new TokenCache();
       const resourceController = new ResourceController({
         store: sharedResourceStore,
@@ -10441,11 +11367,6 @@ var start = async (config) => {
     const target_port = config?.port || Number(process.env.PORT) || 4001;
     await app.listen({ port: target_port, host: "0.0.0.0" });
     logger4.info(`Lattice Gateway is running on port: ${target_port}`);
-    try {
-      logger4.info("AgentLifecycleManager initialized");
-    } catch (error) {
-      logger4.warn("Failed to initialize AgentLifecycleManager", { error });
-    }
     const queueServiceConfig = config?.queueServiceConfig;
     if (queueServiceConfig) {
       setQueueServiceType(queueServiceConfig.type);