@axiom-lattice/gateway 5.0.0 → 6.0.1

package/dist/index.js

@@ -1334,6 +1334,241 @@ var init_a2a = __esm({
   }
 });
 
+// src/services/open/sandboxOpenReflection.ts
+function invalidateAgentReflectionCache(tenantId, assistantId) {
+  if (!tenantId) {
+    cache.clear();
+    return;
+  }
+  if (assistantId) {
+    cache.delete(`${tenantId}:${assistantId}`);
+    return;
+  }
+  const prefix = `${tenantId}:`;
+  for (const key of cache.keys()) {
+    if (key.startsWith(prefix)) cache.delete(key);
+  }
+}
+function cloneGrants(grants) {
+  return grants.map((grant) => ({
+    ...grant,
+    items: grant.items ? [...grant.items] : void 0
+  }));
+}
+function normalizeOpenExpose(value) {
+  if (!Array.isArray(value)) return [];
+  const out = [];
+  for (const entry of value) {
+    if (typeof entry === "string") {
+      if (entry) out.push(entry);
+    } else if (entry && typeof entry === "object") {
+      const name = entry.name;
+      if (typeof name === "string" && name) out.push(name);
+    }
+  }
+  return out;
+}
+function extractMiddleware(container) {
+  if (!container || typeof container !== "object") return void 0;
+  const raw = container.middleware;
+  if (!Array.isArray(raw)) return void 0;
+  const out = [];
+  for (const entry of raw) {
+    if (!entry || typeof entry !== "object") continue;
+    const type = entry.type;
+    if (typeof type !== "string" || type.length === 0) continue;
+    const enabled = entry.enabled;
+    const rawAllowed = entry.allowedTools;
+    const allowedTools = Array.isArray(rawAllowed) ? rawAllowed.filter((t2) => typeof t2 === "string" && t2.length > 0) : void 0;
+    out.push({ type, enabled: typeof enabled === "boolean" ? enabled : void 0, allowedTools });
+  }
+  return out;
+}
+function extractSubAgents(config) {
+  if (!config || typeof config !== "object") return void 0;
+  const raw = config.subAgents;
+  if (!Array.isArray(raw)) return void 0;
+  const out = raw.filter((id3) => typeof id3 === "string" && id3.length > 0);
+  return out.length > 0 ? out : void 0;
+}
+async function computeGrants(tenantId, assistantId, deps) {
+  await deps.ensure?.(tenantId);
+  let context = await deps.getAgentConfig?.(tenantId, assistantId);
+  if (context === void 0) {
+    const middleware = await deps.getAssistantMiddleware?.(tenantId, assistantId);
+    if (middleware === void 0) return [];
+    context = { middleware };
+  }
+  const byDomain = /* @__PURE__ */ new Map();
+  const add = (domain, items) => {
+    let bucket = byDomain.get(domain);
+    if (!bucket) {
+      bucket = /* @__PURE__ */ new Set();
+      byDomain.set(domain, bucket);
+    }
+    for (const item of items) bucket.add(item);
+  };
+  for (const entry of context.middleware ?? []) {
+    if (!entry || entry.enabled === false) continue;
+    if (typeof entry.type !== "string" || entry.type.length === 0) continue;
+    let actions = deps.exposedActionsByType(entry.type);
+    if (actions.length === 0) continue;
+    const allowedTools = entry.allowedTools;
+    if (Array.isArray(allowedTools) && allowedTools.length > 0) {
+      const allowed = new Set(allowedTools);
+      actions = actions.filter((action) => allowed.has(action));
+      if (actions.length === 0) continue;
+    }
+    add(entry.type, actions);
+  }
+  const subAgents = context.subAgents ?? [];
+  if (subAgents.length > 0 && deps.resolvableAssistants) {
+    const resolvable = await deps.resolvableAssistants(tenantId);
+    const kept = subAgents.filter(
+      (id3) => typeof id3 === "string" && id3.length > 0 && resolvable.has(id3)
+    );
+    if (kept.length > 0) add("agent", kept);
+  }
+  return [...byDomain].map(([domain, items]) => ({ domain, items: [...items] }));
+}
+async function resolveAgentOpenGrants(tenantId, assistantId, deps) {
+  try {
+    const key = `${tenantId}:${assistantId}`;
+    const now = deps.now ? deps.now() : Date.now();
+    const hit = cache.get(key);
+    if (hit && hit.expiresAt > now) return cloneGrants(hit.grants);
+    const grants = await computeGrants(tenantId, assistantId, deps);
+    cache.set(key, { grants, expiresAt: now + AGENT_REFLECTION_CACHE_TTL_MS });
+    return cloneGrants(grants);
+  } catch {
+    return [];
+  }
+}
+function createDefaultAgentReflectionDeps(tenantId) {
+  (0, import_core74.ensureBuiltinAgentsForTenant)(tenantId);
+  return {
+    ensure: (t2) => import_core74.agentLatticeManager.initializeStoredAssistantsForTenant(t2),
+    getAgentConfig: (t2, assistantId) => {
+      const config = import_core74.agentLatticeManager.getAgentConfigWithTenant(t2, assistantId);
+      if (!config) return void 0;
+      return {
+        middleware: extractMiddleware(config),
+        subAgents: extractSubAgents(config)
+      };
+    },
+    getAssistantMiddleware: async (t2, assistantId) => {
+      const store2 = (0, import_core74.getStoreLattice)("default", "assistant").store;
+      const assistant = await store2.getAssistantById(t2, assistantId);
+      return extractMiddleware(assistant?.graphDefinition);
+    },
+    exposedActionsByType: (type) => {
+      const plugin = import_core74.PluginRegistry.get(type);
+      return plugin ? normalizeOpenExpose(plugin.meta.openExpose) : [];
+    },
+    resolvableAssistants: async (t2) => new Set(
+      import_core74.agentLatticeManager.getAllAgentLatticesByTenant(t2).map((lattice) => lattice.config.key)
+    )
+  };
+}
+function invalidatePluginReflectionCache(tenantId) {
+  if (!tenantId) {
+    pluginCache.clear();
+    return;
+  }
+  pluginCache.delete(tenantId);
+}
+function mergeGrantsByDomain(grants) {
+  const order = [];
+  const items = /* @__PURE__ */ new Map();
+  const unrestricted = /* @__PURE__ */ new Set();
+  for (const grant of grants) {
+    if (!grant || typeof grant.domain !== "string" || grant.domain.length === 0) continue;
+    if (!items.has(grant.domain)) {
+      items.set(grant.domain, /* @__PURE__ */ new Set());
+      order.push(grant.domain);
+    }
+    if (!grant.items || grant.items.length === 0) {
+      unrestricted.add(grant.domain);
+      continue;
+    }
+    const bucket = items.get(grant.domain);
+    if (!bucket) continue;
+    for (const item of grant.items) {
+      if (typeof item === "string" && item.length > 0) bucket.add(item);
+    }
+  }
+  return order.map((domain) => {
+    if (unrestricted.has(domain)) return { domain };
+    return { domain, items: [...items.get(domain) ?? []] };
+  });
+}
+async function computePluginGrants(tenantId, deps) {
+  const grants = [...deps.globalExposedDomains?.() ?? []];
+  if (deps.tenantExposedDomains) {
+    grants.push(...await deps.tenantExposedDomains(tenantId));
+  }
+  if (deps.resolvableAssistants) {
+    const resolvable = await deps.resolvableAssistants(tenantId);
+    if (resolvable.size > 0) {
+      grants.push({ domain: "agent", items: [...resolvable] });
+    }
+  }
+  return mergeGrantsByDomain(grants);
+}
+async function resolvePluginOpenGrants(tenantId, deps) {
+  try {
+    const now = deps.now ? deps.now() : Date.now();
+    const hit = pluginCache.get(tenantId);
+    if (hit && hit.expiresAt > now) return cloneGrants(hit.grants);
+    await deps.ensure?.(tenantId);
+    const grants = await computePluginGrants(tenantId, deps);
+    pluginCache.set(tenantId, { grants, expiresAt: now + PLUGIN_REFLECTION_CACHE_TTL_MS });
+    return cloneGrants(grants);
+  } catch {
+    return [];
+  }
+}
+function buildTenantExposedGrants(manifests) {
+  const grants = [];
+  for (const manifest of manifests) {
+    const items = (manifest.tools ?? []).filter((tool) => tool.expose === true).map((tool) => tool.name);
+    if (items.length > 0) grants.push({ domain: manifest.type, items });
+  }
+  return grants;
+}
+function createDefaultPluginReflectionDeps() {
+  return {
+    ensure: (tenantId) => import_core74.agentLatticeManager.initializeStoredAssistantsForTenant(tenantId),
+    globalExposedDomains: () => {
+      const grants = [];
+      for (const type of import_core74.PluginRegistry.list()) {
+        const plugin = import_core74.PluginRegistry.get(type);
+        const items = normalizeOpenExpose(plugin?.meta.openExpose);
+        if (items.length > 0) grants.push({ domain: type, items });
+      }
+      return grants;
+    },
+    tenantExposedDomains: async (tenantId) => {
+      const { manifests } = await (0, import_core74.getSandboxPluginCatalog)().ensureLoaded(tenantId);
+      return buildTenantExposedGrants(Object.values(manifests));
+    },
+    resolvableAssistants: async (tenantId) => new Set(
+      import_core74.agentLatticeManager.getAllAgentLatticesByTenant(tenantId).map((lattice) => lattice.config.key)
+    )
+  };
+}
+var import_core74, AGENT_REFLECTION_CACHE_TTL_MS, cache, PLUGIN_REFLECTION_CACHE_TTL_MS, pluginCache;
+var init_sandboxOpenReflection = __esm({
+  "src/services/open/sandboxOpenReflection.ts"() {
+    "use strict";
+    import_core74 = require("@axiom-lattice/core");
+    AGENT_REFLECTION_CACHE_TTL_MS = 6e4;
+    cache = /* @__PURE__ */ new Map();
+    PLUGIN_REFLECTION_CACHE_TTL_MS = 6e4;
+    pluginCache = /* @__PURE__ */ new Map();
+  }
+});
+
 // src/services/collaboration/TopCallerRecovery.ts
 function hasPendingInterrupts(state) {
   return (state.tasks ?? []).some((t2) => (t2.interrupts?.length ?? 0) > 0);
@@ -1373,7 +1608,7 @@ function outcome(task) {
   });
 }
 async function backfillTopCallerGroup(tasks, top, deps) {
-  const registry = deps.registry ?? import_core76.taskRunRegistry;
+  const registry = deps.registry ?? import_core77.taskRunRegistry;
   const results = [];
   const eligible = [];
   for (const task of tasks) {
@@ -1427,11 +1662,11 @@ async function recoverTask(task, deps) {
   if (task.status !== "in_progress") {
     return { kind: "skipped", reason: "not_in_progress" };
   }
-  const registry = deps.registry ?? import_core76.taskRunRegistry;
+  const registry = deps.registry ?? import_core77.taskRunRegistry;
   if (registry.isLive(task.id) || deps.isTaskLive && await deps.isTaskLive(task)) {
     return { kind: "skipped", reason: "live" };
   }
-  const { convergedTasks } = await (0, import_core76.reconcileStaleTaskRuns)({
+  const { convergedTasks } = await (0, import_core77.reconcileStaleTaskRuns)({
     tasks: [task],
     actor: "system:on-demand-recovery",
     lifecycle: deps.lifecycle,
@@ -1527,30 +1762,30 @@ async function runOrphanRecovery(deps) {
   deps.log.info("Task orphan recovery complete", { recovered, skipped });
   return { recovered, skipped };
 }
-var import_messages, import_core76;
+var import_messages, import_core77;
 var init_TopCallerRecovery = __esm({
   "src/services/collaboration/TopCallerRecovery.ts"() {
     "use strict";
     import_messages = require("@langchain/core/messages");
-    import_core76 = require("@axiom-lattice/core");
+    import_core77 = require("@axiom-lattice/core");
   }
 });
 
 // src/services/collaboration/taskRunLiveness.ts
 function createTaskRunLiveness() {
   try {
-    import_core77.storeLatticeManager.getStoreLattice("default", "lease");
+    import_core78.storeLatticeManager.getStoreLattice("default", "lease");
   } catch {
     return void 0;
   }
-  return (task) => (0, import_core78.isTaskRunLeaseHeld)(task);
+  return (task) => (0, import_core79.isTaskRunLeaseHeld)(task);
 }
-var import_core77, import_core78;
+var import_core78, import_core79;
 var init_taskRunLiveness = __esm({
   "src/services/collaboration/taskRunLiveness.ts"() {
     "use strict";
-    import_core77 = require("@axiom-lattice/core");
     import_core78 = require("@axiom-lattice/core");
+    import_core79 = require("@axiom-lattice/core");
   }
 });
 
@@ -1560,7 +1795,7 @@ __export(OrphanRecoveryRuntime_exports, {
   createOrphanRecoveryRuntime: () => createOrphanRecoveryRuntime
 });
 function createOrphanRecoveryRuntime(deps) {
-  const lifecycle = deps.lifecycle ?? (0, import_core79.createTaskLifecycleService)({
+  const lifecycle = deps.lifecycle ?? (0, import_core80.createTaskLifecycleService)({
     taskStore: deps.taskStore,
     workItemStore: deps.workItemStore
   });
@@ -1568,7 +1803,7 @@ function createOrphanRecoveryRuntime(deps) {
     async recoverAll() {
       const isTaskLive = deps.isTaskLive ?? createTaskRunLiveness();
       return runOrphanRecovery({
-        reconcile: () => (0, import_core79.reconcileAllTenantTaskRuns)({
+        reconcile: () => (0, import_core80.reconcileAllTenantTaskRuns)({
           actor: "system:orphan-recovery",
           tenantStore: {
             listTenants: async () => (await deps.tenantStore.getAllTenants()).map((tenant2) => ({ id: tenant2.id }))
@@ -1594,7 +1829,7 @@ function createOrphanRecoveryRuntime(deps) {
       const isTaskLive = deps.isTaskLive ?? createTaskRunLiveness();
       return recoverTask(task, {
         lifecycle,
-        registry: import_core79.taskRunRegistry,
+        registry: import_core80.taskRunRegistry,
         orphans,
         callerFor: deps.callerFor,
         resume: deps.resume,
@@ -1603,11 +1838,11 @@ function createOrphanRecoveryRuntime(deps) {
     }
   };
 }
-var import_core79;
+var import_core80;
 var init_OrphanRecoveryRuntime = __esm({
   "src/services/collaboration/OrphanRecoveryRuntime.ts"() {
     "use strict";
-    import_core79 = require("@axiom-lattice/core");
+    import_core80 = require("@axiom-lattice/core");
     init_TopCallerRecovery();
     init_projectTaskScope();
     init_taskRunLiveness();
@@ -1623,12 +1858,12 @@ function createRecoveryCallerDeps() {
   return {
     callerFor: async (top, tenantId) => {
       if (!top.assistantId) return void 0;
-      const load = import_core80.getAgentClientAsync ?? import_core80.getAgentClient;
+      const load = import_core81.getAgentClientAsync ?? import_core81.getAgentClient;
       const client = await load(tenantId, top.assistantId);
       const config = { configurable: { thread_id: top.threadId, runConfig: { tenantId, assistant_id: top.assistantId } } };
       let agent;
       try {
-        agent = import_core80.agentInstanceManager.getAgent({ assistant_id: top.assistantId, thread_id: top.threadId, tenant_id: tenantId });
+        agent = import_core81.agentInstanceManager.getAgent({ assistant_id: top.assistantId, thread_id: top.threadId, tenant_id: tenantId });
       } catch {
       }
       return agent ? { client, config, agent } : { client, config };
@@ -1645,11 +1880,11 @@ function createRecoveryCallerDeps() {
     }
   };
 }
-var import_core80;
+var import_core81;
 var init_RecoveryCallerDeps = __esm({
   "src/services/collaboration/RecoveryCallerDeps.ts"() {
     "use strict";
-    import_core80 = require("@axiom-lattice/core");
+    import_core81 = require("@axiom-lattice/core");
   }
 });
 
@@ -2068,13 +2303,13 @@ function isA2ATaskSnapshot(value) {
 function snapshotSequence(value) {
   return typeof value === "number" && Number.isSafeInteger(value) && value >= 0 ? value : void 0;
 }
-var import_node_crypto31, import_node_util, import_core81, TASK_STATUS_TO_A2A_STATE, TITLE_MAX_LENGTH, A2ATaskScopeConflictError, A2ATaskStoreAdapter;
+var import_node_crypto31, import_node_util, import_core82, TASK_STATUS_TO_A2A_STATE, TITLE_MAX_LENGTH, A2ATaskScopeConflictError, A2ATaskStoreAdapter;
 var init_A2ATaskStoreAdapter = __esm({
   "src/services/a2a/A2ATaskStoreAdapter.ts"() {
     "use strict";
     import_node_crypto31 = require("crypto");
     import_node_util = require("util");
-    import_core81 = require("@axiom-lattice/core");
+    import_core82 = require("@axiom-lattice/core");
     TASK_STATUS_TO_A2A_STATE = {
       pending: "submitted",
       in_progress: "working",
@@ -2100,7 +2335,7 @@ var init_A2ATaskStoreAdapter = __esm({
         this.workItemStore = options.workItemStore;
         this.lifecycle = options.lifecycle;
         this.scope = options.scope;
-        this.runBridge = (0, import_core81.createTaskRunBridge)({
+        this.runBridge = (0, import_core82.createTaskRunBridge)({
           lifecycle: this.lifecycle,
           taskStore: this.taskStore,
           workItemStore: this.workItemStore
@@ -2451,12 +2686,12 @@ function assistantHasGovernedTask(assistant) {
   const allowedTools = taskMiddleware?.allowedTools;
   return !!taskMiddleware && (allowedTools === void 0 || Array.isArray(allowedTools) && (allowedTools.length === 0 || allowedTools.includes("manage_task")));
 }
-var import_uuid11, import_core82, import_protocols35, _AxiomAgentExecutor, AxiomAgentExecutor;
+var import_uuid11, import_core83, import_protocols35, _AxiomAgentExecutor, AxiomAgentExecutor;
 var init_AxiomAgentExecutor = __esm({
   "src/services/a2a/AxiomAgentExecutor.ts"() {
     "use strict";
     import_uuid11 = require("uuid");
-    import_core82 = require("@axiom-lattice/core");
+    import_core83 = require("@axiom-lattice/core");
     import_protocols35 = require("@axiom-lattice/protocols");
     init_a2aFileRefs();
     init_task_file_refs();
@@ -2553,7 +2788,7 @@ var init_AxiomAgentExecutor = __esm({
           await this.taskStore.save(initialTask);
           bus.publish(initialTask);
           try {
-            const agent = import_core82.agentInstanceManager.getAgent(this.agentParams(threadId));
+            const agent = import_core83.agentInstanceManager.getAgent(this.agentParams(threadId));
             const requestText = inputFiles.length > 0 ? `${text}
 
 ${formatFileRefsSection(inputFiles)}` : text;
@@ -2741,7 +2976,7 @@ ${formatFileRefsSection(inputFiles)}` : text;
         const threadId = task ? asString2(task.metadata?.threadId) : void 0;
         if (threadId) {
           try {
-            const agent = import_core82.agentInstanceManager.getAgent(this.agentParams(threadId));
+            const agent = import_core83.agentInstanceManager.getAgent(this.agentParams(threadId));
             await agent.abort();
           } catch (err) {
             console.warn({
@@ -3115,10 +3350,10 @@ function isAsyncGenerator(value) {
 }
 function registerA2AStandardRoutes(app2, deps) {
   const authService = deps.authService;
-  const resolveTasks = deps.getTaskStoreLattice ?? (() => (0, import_core83.getStoreLattice)("default", "task").store);
-  const resolveTaskWorkItems = deps.getTaskWorkItemStore ?? (() => (0, import_core83.getStoreLattice)("default", "taskWorkItem").store);
-  const getAssistantStore2 = deps.getAssistantStore ?? (() => (0, import_core83.getStoreLattice)("default", "assistant").store);
-  const getProjectStore2 = deps.getProjectStore ?? (() => (0, import_core83.getStoreLattice)("default", "project").store);
+  const resolveTasks = deps.getTaskStoreLattice ?? (() => (0, import_core84.getStoreLattice)("default", "task").store);
+  const resolveTaskWorkItems = deps.getTaskWorkItemStore ?? (() => (0, import_core84.getStoreLattice)("default", "taskWorkItem").store);
+  const getAssistantStore2 = deps.getAssistantStore ?? (() => (0, import_core84.getStoreLattice)("default", "assistant").store);
+  const getProjectStore2 = deps.getProjectStore ?? (() => (0, import_core84.getStoreLattice)("default", "project").store);
   const runtimeRegistry = deps.runtimeRegistry ?? new A2ARuntimeRegistry();
   app2.addHook("onClose", async () => {
     runtimeRegistry.close();
@@ -3201,7 +3436,7 @@ function registerA2AStandardRoutes(app2, deps) {
       const taskStore = assistantHasGovernedTask(assistant) ? new A2ATaskStoreAdapter({
         taskStore: internalTasks,
         workItemStore: workItems,
-        lifecycle: (0, import_core83.createTaskLifecycleService)({
+        lifecycle: (0, import_core84.createTaskLifecycleService)({
           taskStore: internalTasks,
           workItemStore: workItems
         }),
@@ -3320,7 +3555,7 @@ data: ${JSON.stringify(errorResponse)}
       const taskStore = assistantHasGovernedTask(assistant) ? new A2ATaskStoreAdapter({
         taskStore: internalTasks,
         workItemStore: workItems,
-        lifecycle: (0, import_core83.createTaskLifecycleService)({
+        lifecycle: (0, import_core84.createTaskLifecycleService)({
           taskStore: internalTasks,
           workItemStore: workItems
         }),
@@ -3375,13 +3610,13 @@ data: ${JSON.stringify(data)}
     }
   );
 }
-var import_uuid12, import_server2, import_core83, SSE_HEADERS;
+var import_uuid12, import_server2, import_core84, SSE_HEADERS;
 var init_a2a_standard = __esm({
   "src/routes/a2a-standard.ts"() {
     "use strict";
     import_uuid12 = require("uuid");
     import_server2 = require("@a2a-js/sdk/server");
-    import_core83 = require("@axiom-lattice/core");
+    import_core84 = require("@axiom-lattice/core");
     init_A2AAuthService();
     init_A2AAgentCardBuilder();
     init_A2ATaskStoreAdapter();
@@ -3948,8 +4183,8 @@ function exposedDeclarations(plugin) {
   return (plugin.meta.tools ?? []).filter((t2) => t2.expose);
 }
 async function registerExposedPluginTools() {
-  for (const key of import_core84.PluginRegistry.list()) {
-    const plugin = import_core84.PluginRegistry.get(key);
+  for (const key of import_core85.PluginRegistry.list()) {
+    const plugin = import_core85.PluginRegistry.get(key);
     if (!plugin?.middleware) continue;
     const exposed = exposedDeclarations(plugin);
     if (exposed.length === 0) continue;
@@ -3984,8 +4219,8 @@ async function registerExposedPluginTools() {
 }
 function collectExposedPluginUiResources(grants) {
   const resources = /* @__PURE__ */ new Map();
-  for (const type of import_core84.PluginRegistry.list()) {
-    const plugin = import_core84.PluginRegistry.get(type);
+  for (const type of import_core85.PluginRegistry.list()) {
+    const plugin = import_core85.PluginRegistry.get(type);
     if (!plugin?.middleware) continue;
     const exposedNames = new Set(exposedDeclarations(plugin).map((d) => d.name));
     if (exposedNames.size === 0) continue;
@@ -4009,11 +4244,11 @@ function collectExposedPluginUiResources(grants) {
   }
   return resources;
 }
-var import_core84;
+var import_core85;
 var init_registerExposedPlugins = __esm({
   "src/services/open/registerExposedPlugins.ts"() {
     "use strict";
-    import_core84 = require("@axiom-lattice/core");
+    import_core85 = require("@axiom-lattice/core");
     init_openLattice();
     init_pluginExposeAdapter();
   }
@@ -4028,14 +4263,14 @@ function toText(result) {
 }
 function defaultCatalog() {
   return {
-    getValidatedManifest: (tenantId, type) => (0, import_core85.getSandboxPluginCatalog)().getValidatedManifest(tenantId, type),
-    getExecutor: () => (0, import_core85.getSandboxPluginCatalog)().getExecutor(),
-    readPluginFile: (tenantId, type, relPath) => (0, import_core85.getSandboxPluginCatalog)().readPluginFile(tenantId, type, relPath)
+    getValidatedManifest: (tenantId, type) => (0, import_core86.getSandboxPluginCatalog)().getValidatedManifest(tenantId, type),
+    getExecutor: () => (0, import_core86.getSandboxPluginCatalog)().getExecutor(),
+    readPluginFile: (tenantId, type, relPath) => (0, import_core86.getSandboxPluginCatalog)().readPluginFile(tenantId, type, relPath)
   };
 }
 async function defaultResolveConnections(pluginType, ctx) {
   try {
-    return await (0, import_core85.resolveSandboxPluginConnections)(
+    return await (0, import_core86.resolveSandboxPluginConnections)(
       pluginType,
       { connectAll: true },
       {
@@ -4064,7 +4299,7 @@ function mergeOpenCatalog(globalCatalog, tenantTools) {
 async function buildTenantOpenPlugins(tenantId, grants, deps = {}) {
   const catalog = deps.catalog ?? defaultCatalog();
   const listPlugins = deps.listPlugins ?? (async (tenant2) => {
-    const snapshot = await (0, import_core85.getSandboxPluginCatalog)().ensureLoaded(tenant2);
+    const snapshot = await (0, import_core86.getSandboxPluginCatalog)().ensureLoaded(tenant2);
     return { plugins: snapshot.plugins, diagnostics: snapshot.diagnostics };
   });
   const resolveConnections = deps.resolveConnections ?? defaultResolveConnections;
@@ -4106,7 +4341,7 @@ async function buildTenantOpenPlugins(tenantId, grants, deps = {}) {
         domain,
         action: tool.name,
         description: tool.description,
-        schema: (0, import_core85.jsonSchemaToZod)(tool.schema),
+        schema: (0, import_core86.jsonSchemaToZod)(tool.schema),
         annotations: {
           readOnlyHint: tool.readOnly ?? false,
           destructiveHint: tool.destructive ?? false
@@ -4157,11 +4392,11 @@ async function buildTenantOpenPlugins(tenantId, grants, deps = {}) {
     }
   };
 }
-var import_core85;
+var import_core86;
 var init_tenantOpenPlugins = __esm({
   "src/services/open/tenantOpenPlugins.ts"() {
     "use strict";
-    import_core85 = require("@axiom-lattice/core");
+    import_core86 = require("@axiom-lattice/core");
     init_openLattice();
     init_pluginToolExecution();
   }
@@ -4198,13 +4433,13 @@ function emptyTenantPlugins() {
 }
 function registerOpenRoutes(app2, deps = {}) {
   const openAuth = deps.openAuth ?? new OpenCredentialService(
-    (0, import_core86.getStoreLattice)("default", "a2aApiKey").store,
-    (0, import_core86.getStoreLattice)("default", "project").store
+    (0, import_core87.getStoreLattice)("default", "a2aApiKey").store,
+    (0, import_core87.getStoreLattice)("default", "project").store
   );
   const grantsSource = deps.grantsSource ?? ((ctx) => ctx.grants);
   const audit = deps.audit ?? (() => {
     try {
-      const store2 = (0, import_core86.getStoreLattice)("default", "openAudit").store;
+      const store2 = (0, import_core87.getStoreLattice)("default", "openAudit").store;
       return new OpenAuditService(store2);
     } catch {
       return void 0;
@@ -4347,6 +4582,23 @@ function registerOpenRoutes(app2, deps = {}) {
     reply.hijack();
     await built.transport.handleRequest(request.raw, reply.raw, body);
   });
+  app2.get("/open/mcp", async (request, reply) => {
+    const sessionId = readSessionId(request);
+    if (!sessionId) {
+      reply.header("Allow", "GET, POST, DELETE");
+      return reply.status(405).send();
+    }
+    const context = await openAuth.resolve(extractBearer(request));
+    if (!context) {
+      return reply.status(401).send({ error: "AUTH_FAILED" });
+    }
+    const session = await getSession(sessionId);
+    if (!session || session.credential.credentialId !== context.credentialId) {
+      return reply.status(404).send({ error: "SESSION_NOT_FOUND" });
+    }
+    reply.hijack();
+    await session.transport.handleRequest(request.raw, reply.raw);
+  });
   app2.delete(
     "/open/mcp",
     async (request, reply) => {
@@ -4359,12 +4611,12 @@ function registerOpenRoutes(app2, deps = {}) {
     }
   );
 }
-var import_types, import_core86, RPC_ERROR;
+var import_types, import_core87, RPC_ERROR;
 var init_open = __esm({
   "src/routes/open.ts"() {
     "use strict";
     import_types = require("@modelcontextprotocol/sdk/types.js");
-    import_core86 = require("@axiom-lattice/core");
+    import_core87 = require("@axiom-lattice/core");
     init_openCredentialService();
     init_openAuditService();
     init_openRateLimiter();
@@ -4397,7 +4649,7 @@ function registerOpenSessionRoutes(app2) {
       if (typeof shareToken !== "string" || shareToken.length === 0) {
         return reply.status(400).send({ error: "SHARE_TOKEN_REQUIRED" });
       }
-      const store2 = (0, import_core87.getStoreLattice)("default", "sharedResource").store;
+      const store2 = (0, import_core88.getStoreLattice)("default", "sharedResource").store;
       const record = await store2.findByToken(shareToken);
       if (!record || record.revoked) {
         return reply.status(404).send({ error: "SHARE_NOT_FOUND" });
@@ -4422,11 +4674,11 @@ function registerOpenSessionRoutes(app2) {
     }
   );
 }
-var import_core87;
+var import_core88;
 var init_open_session = __esm({
   "src/routes/open-session.ts"() {
     "use strict";
-    import_core87 = require("@axiom-lattice/core");
+    import_core88 = require("@axiom-lattice/core");
     init_openToken();
     init_previewToken();
     init_openLattice();
@@ -4435,13 +4687,13 @@ var init_open_session = __esm({
 
 // src/services/open/openCatalogService.ts
 async function defaultListTenantPlugins(tenantId) {
-  return (await (0, import_core88.getSandboxPluginCatalog)().ensureLoaded(tenantId)).plugins;
+  return (await (0, import_core89.getSandboxPluginCatalog)().ensureLoaded(tenantId)).plugins;
 }
-var import_core88, OpenCatalogService;
+var import_core89, OpenCatalogService;
 var init_openCatalogService = __esm({
   "src/services/open/openCatalogService.ts"() {
     "use strict";
-    import_core88 = require("@axiom-lattice/core");
+    import_core89 = require("@axiom-lattice/core");
     init_openLattice();
     OpenCatalogService = class {
       constructor(assistantStore, lattice = openLattice, listTenantPlugins2 = defaultListTenantPlugins) {
@@ -4516,17 +4768,17 @@ function registerOpenCatalogRoutes(app2) {
     if (!tenantId) {
       return reply.status(401).send({ success: false, error: "Unauthorized" });
     }
-    const assistantStore = (0, import_core89.getStoreLattice)("default", "assistant").store;
+    const assistantStore = (0, import_core90.getStoreLattice)("default", "assistant").store;
     const service2 = new OpenCatalogService(assistantStore);
     const catalog = await service2.buildForTenant(tenantId);
     return reply.status(200).send({ success: true, data: catalog });
   });
 }
-var import_core89;
+var import_core90;
 var init_open_catalog = __esm({
   "src/routes/open-catalog.ts"() {
     "use strict";
-    import_core89 = require("@axiom-lattice/core");
+    import_core90 = require("@axiom-lattice/core");
     init_openCatalogService();
   }
 });
@@ -4541,11 +4793,11 @@ async function resolveContextSandbox(ctx) {
   const sandboxName = ctx.runConfig?.sandboxName;
   if (typeof sandboxName === "string" && sandboxName.length > 0) {
     try {
-      return await import_core90.sandboxLatticeManager.getSandbox(sandboxName);
+      return await import_core91.sandboxLatticeManager.getSandbox(sandboxName);
     } catch {
     }
   }
-  return import_core90.sandboxLatticeManager.getSandboxFromConfig({
+  return import_core91.sandboxLatticeManager.getSandboxFromConfig({
     assistant_id: "",
     thread_id: "",
     tenantId: ctx.tenantId,
@@ -4643,12 +4895,12 @@ ${truncated}`
     }
   };
 }
-var import_zod22, import_core90, MAX_OUTPUT_BYTES;
+var import_zod22, import_core91, MAX_OUTPUT_BYTES;
 var init_sandboxProvider = __esm({
   "src/services/open/providers/sandboxProvider.ts"() {
     "use strict";
     import_zod22 = require("zod");
-    import_core90 = require("@axiom-lattice/core");
+    import_core91 = require("@axiom-lattice/core");
     MAX_OUTPUT_BYTES = 64e3;
   }
 });
@@ -4670,12 +4922,12 @@ function safePath(raw) {
 }
 function registerOpenFilesRoutes(app2, deps = {}) {
   const openAuth = deps.openAuth ?? new OpenCredentialService(
-    (0, import_core91.getStoreLattice)("default", "a2aApiKey").store,
-    (0, import_core91.getStoreLattice)("default", "project").store
+    (0, import_core92.getStoreLattice)("default", "a2aApiKey").store,
+    (0, import_core92.getStoreLattice)("default", "project").store
   );
   const audit = deps.audit ?? (() => {
     try {
-      const store2 = (0, import_core91.getStoreLattice)("default", "openAudit").store;
+      const store2 = (0, import_core92.getStoreLattice)("default", "openAudit").store;
       return new OpenAuditService(store2);
     } catch {
       return void 0;
@@ -4785,11 +5037,11 @@ function registerOpenFilesRoutes(app2, deps = {}) {
     }
   });
 }
-var import_core91;
+var import_core92;
 var init_open_files = __esm({
   "src/routes/open-files.ts"() {
     "use strict";
-    import_core91 = require("@axiom-lattice/core");
+    import_core92 = require("@axiom-lattice/core");
     init_openCredentialService();
     init_openLattice();
     init_sandboxProvider();
@@ -4811,7 +5063,7 @@ function registerOpenAuditRoutes(app2) {
         return reply.status(401).send({ success: false, error: "Unauthorized" });
       }
       const status = request.query.status === "ok" || request.query.status === "error" ? request.query.status : void 0;
-      const store2 = (0, import_core92.getStoreLattice)("default", "openAudit").store;
+      const store2 = (0, import_core93.getStoreLattice)("default", "openAudit").store;
       const records = await store2.query({
         tenantId,
         credentialId: request.query.credentialId,
@@ -4826,11 +5078,11 @@ function registerOpenAuditRoutes(app2) {
     }
   );
 }
-var import_core92;
+var import_core93;
 var init_open_audit = __esm({
   "src/routes/open-audit.ts"() {
     "use strict";
-    import_core92 = require("@axiom-lattice/core");
+    import_core93 = require("@axiom-lattice/core");
   }
 });
 
@@ -4847,7 +5099,7 @@ function registerOpenExposureRoutes(app2, deps = {}) {
       if (!tenantId) {
         return reply.status(401).send({ success: false, error: "Unauthorized" });
       }
-      const keyStore = (0, import_core93.getStoreLattice)("default", "a2aApiKey").store;
+      const keyStore = (0, import_core94.getStoreLattice)("default", "a2aApiKey").store;
       const record = await keyStore.findById(request.params.id);
       if (!record || record.tenantId !== tenantId) {
         return reply.status(404).send({ success: false, error: "Key not found" });
@@ -4881,7 +5133,7 @@ function registerOpenExposureRoutes(app2, deps = {}) {
         hasUi: Boolean(t2.ui)
       }));
       const agentGrant = grants.find((g) => g.domain === "agent");
-      const assistantStore = (0, import_core93.getStoreLattice)("default", "assistant").store;
+      const assistantStore = (0, import_core94.getStoreLattice)("default", "assistant").store;
       const agents = [];
       for (const assistantId of agentGrant?.items ?? []) {
         const assistant = await assistantStore.getAssistantById(
@@ -4916,11 +5168,11 @@ function registerOpenExposureRoutes(app2, deps = {}) {
     }
   );
 }
-var import_core93, import_protocols38;
+var import_core94, import_protocols38;
 var init_open_exposure = __esm({
   "src/routes/open-exposure.ts"() {
     "use strict";
-    import_core93 = require("@axiom-lattice/core");
+    import_core94 = require("@axiom-lattice/core");
     import_protocols38 = require("@axiom-lattice/protocols");
     init_openLattice();
     init_tenantOpenPlugins();
@@ -5040,253 +5292,39 @@ function createAgentProvider(deps = {}) {
         } catch {
         }
       }
-      const agent = import_core94.agentInstanceManager.getAgent({
+      const agent = import_core95.agentInstanceManager.getAgent({
         tenant_id: ctx.tenantId,
         assistant_id: assistantId,
         thread_id: threadId,
         workspace_id: ctx.workspaceId ?? "",
-        project_id: ctx.projectId
-      });
-      const { messageId } = await agent.addMessage({
-        input: { message }
-      });
-      const parts = [];
-      const stream = agent.chunkStream(messageId, [...STOP_TYPES]);
-      for await (const chunk of stream) {
-        const text = chunk.data?.content;
-        if (chunk.type === import_protocols39.MessageChunkTypes.INTERRUPT) break;
-        if (chunk.type === import_protocols39.MessageChunkTypes.AI && text) {
-          parts.push(text);
-        }
-      }
-      return {
-        content: [{ type: "text", text: parts.join("") || "(no output)" }]
-      };
-    }
-  };
-}
-var import_zod24, import_core94, import_protocols39, STOP_TYPES;
-var init_agentProvider = __esm({
-  "src/services/open/providers/agentProvider.ts"() {
-    "use strict";
-    import_zod24 = require("zod");
-    import_core94 = require("@axiom-lattice/core");
-    import_protocols39 = require("@axiom-lattice/protocols");
-    STOP_TYPES = [import_protocols39.MessageChunkTypes.MESSAGE_COMPLETED];
-  }
-});
-
-// src/services/open/sandboxOpenReflection.ts
-function cloneGrants(grants) {
-  return grants.map((grant) => ({
-    ...grant,
-    items: grant.items ? [...grant.items] : void 0
-  }));
-}
-function normalizeOpenExpose(value) {
-  if (!Array.isArray(value)) return [];
-  const out = [];
-  for (const entry of value) {
-    if (typeof entry === "string") {
-      if (entry) out.push(entry);
-    } else if (entry && typeof entry === "object") {
-      const name = entry.name;
-      if (typeof name === "string" && name) out.push(name);
-    }
-  }
-  return out;
-}
-function extractMiddleware(container) {
-  if (!container || typeof container !== "object") return void 0;
-  const raw = container.middleware;
-  if (!Array.isArray(raw)) return void 0;
-  const out = [];
-  for (const entry of raw) {
-    if (!entry || typeof entry !== "object") continue;
-    const type = entry.type;
-    if (typeof type !== "string" || type.length === 0) continue;
-    const enabled = entry.enabled;
-    const rawAllowed = entry.allowedTools;
-    const allowedTools = Array.isArray(rawAllowed) ? rawAllowed.filter((t2) => typeof t2 === "string" && t2.length > 0) : void 0;
-    out.push({ type, enabled: typeof enabled === "boolean" ? enabled : void 0, allowedTools });
-  }
-  return out;
-}
-function extractSubAgents(config) {
-  if (!config || typeof config !== "object") return void 0;
-  const raw = config.subAgents;
-  if (!Array.isArray(raw)) return void 0;
-  const out = raw.filter((id3) => typeof id3 === "string" && id3.length > 0);
-  return out.length > 0 ? out : void 0;
-}
-async function computeGrants(tenantId, assistantId, deps) {
-  await deps.ensure?.(tenantId);
-  let context = await deps.getAgentConfig?.(tenantId, assistantId);
-  if (context === void 0) {
-    const middleware = await deps.getAssistantMiddleware?.(tenantId, assistantId);
-    if (middleware === void 0) return [];
-    context = { middleware };
-  }
-  const byDomain = /* @__PURE__ */ new Map();
-  const add = (domain, items) => {
-    let bucket = byDomain.get(domain);
-    if (!bucket) {
-      bucket = /* @__PURE__ */ new Set();
-      byDomain.set(domain, bucket);
-    }
-    for (const item of items) bucket.add(item);
-  };
-  for (const entry of context.middleware ?? []) {
-    if (!entry || entry.enabled === false) continue;
-    if (typeof entry.type !== "string" || entry.type.length === 0) continue;
-    let actions = deps.exposedActionsByType(entry.type);
-    if (actions.length === 0) continue;
-    const allowedTools = entry.allowedTools;
-    if (Array.isArray(allowedTools) && allowedTools.length > 0) {
-      const allowed = new Set(allowedTools);
-      actions = actions.filter((action) => allowed.has(action));
-      if (actions.length === 0) continue;
-    }
-    add(entry.type, actions);
-  }
-  const subAgents = context.subAgents ?? [];
-  if (subAgents.length > 0 && deps.resolvableAssistants) {
-    const resolvable = await deps.resolvableAssistants(tenantId);
-    const kept = subAgents.filter(
-      (id3) => typeof id3 === "string" && id3.length > 0 && resolvable.has(id3)
-    );
-    if (kept.length > 0) add("agent", kept);
-  }
-  return [...byDomain].map(([domain, items]) => ({ domain, items: [...items] }));
-}
-async function resolveAgentOpenGrants(tenantId, assistantId, deps) {
-  try {
-    const key = `${tenantId}:${assistantId}`;
-    const now = deps.now ? deps.now() : Date.now();
-    const hit = cache.get(key);
-    if (hit && hit.expiresAt > now) return cloneGrants(hit.grants);
-    const grants = await computeGrants(tenantId, assistantId, deps);
-    cache.set(key, { grants, expiresAt: now + AGENT_REFLECTION_CACHE_TTL_MS });
-    return cloneGrants(grants);
-  } catch {
-    return [];
-  }
-}
-function createDefaultAgentReflectionDeps(tenantId) {
-  (0, import_core95.ensureBuiltinAgentsForTenant)(tenantId);
-  return {
-    ensure: (t2) => import_core95.agentLatticeManager.initializeStoredAssistantsForTenant(t2),
-    getAgentConfig: (t2, assistantId) => {
-      const config = import_core95.agentLatticeManager.getAgentConfigWithTenant(t2, assistantId);
-      if (!config) return void 0;
-      return {
-        middleware: extractMiddleware(config),
-        subAgents: extractSubAgents(config)
-      };
-    },
-    getAssistantMiddleware: async (t2, assistantId) => {
-      const store2 = (0, import_core95.getStoreLattice)("default", "assistant").store;
-      const assistant = await store2.getAssistantById(t2, assistantId);
-      return extractMiddleware(assistant?.graphDefinition);
-    },
-    exposedActionsByType: (type) => {
-      const plugin = import_core95.PluginRegistry.get(type);
-      return plugin ? normalizeOpenExpose(plugin.meta.openExpose) : [];
-    },
-    resolvableAssistants: async (t2) => new Set(
-      import_core95.agentLatticeManager.getAllAgentLatticesByTenant(t2).map((lattice) => lattice.config.key)
-    )
-  };
-}
-function mergeGrantsByDomain(grants) {
-  const order = [];
-  const items = /* @__PURE__ */ new Map();
-  const unrestricted = /* @__PURE__ */ new Set();
-  for (const grant of grants) {
-    if (!grant || typeof grant.domain !== "string" || grant.domain.length === 0) continue;
-    if (!items.has(grant.domain)) {
-      items.set(grant.domain, /* @__PURE__ */ new Set());
-      order.push(grant.domain);
-    }
-    if (!grant.items || grant.items.length === 0) {
-      unrestricted.add(grant.domain);
-      continue;
-    }
-    const bucket = items.get(grant.domain);
-    if (!bucket) continue;
-    for (const item of grant.items) {
-      if (typeof item === "string" && item.length > 0) bucket.add(item);
-    }
-  }
-  return order.map((domain) => {
-    if (unrestricted.has(domain)) return { domain };
-    return { domain, items: [...items.get(domain) ?? []] };
-  });
-}
-async function computePluginGrants(tenantId, deps) {
-  const grants = [...deps.globalExposedDomains?.() ?? []];
-  if (deps.tenantExposedDomains) {
-    grants.push(...await deps.tenantExposedDomains(tenantId));
-  }
-  if (deps.resolvableAssistants) {
-    const resolvable = await deps.resolvableAssistants(tenantId);
-    if (resolvable.size > 0) {
-      grants.push({ domain: "agent", items: [...resolvable] });
-    }
-  }
-  return mergeGrantsByDomain(grants);
-}
-async function resolvePluginOpenGrants(tenantId, deps) {
-  try {
-    const now = deps.now ? deps.now() : Date.now();
-    const hit = pluginCache.get(tenantId);
-    if (hit && hit.expiresAt > now) return cloneGrants(hit.grants);
-    await deps.ensure?.(tenantId);
-    const grants = await computePluginGrants(tenantId, deps);
-    pluginCache.set(tenantId, { grants, expiresAt: now + PLUGIN_REFLECTION_CACHE_TTL_MS });
-    return cloneGrants(grants);
-  } catch {
-    return [];
-  }
-}
-function buildTenantExposedGrants(manifests) {
-  const grants = [];
-  for (const manifest of manifests) {
-    const items = (manifest.tools ?? []).filter((tool) => tool.expose === true).map((tool) => tool.name);
-    if (items.length > 0) grants.push({ domain: manifest.type, items });
-  }
-  return grants;
-}
-function createDefaultPluginReflectionDeps() {
-  return {
-    ensure: (tenantId) => import_core95.agentLatticeManager.initializeStoredAssistantsForTenant(tenantId),
-    globalExposedDomains: () => {
-      const grants = [];
-      for (const type of import_core95.PluginRegistry.list()) {
-        const plugin = import_core95.PluginRegistry.get(type);
-        const items = normalizeOpenExpose(plugin?.meta.openExpose);
-        if (items.length > 0) grants.push({ domain: type, items });
+        project_id: ctx.projectId
+      });
+      const { messageId } = await agent.addMessage({
+        input: { message }
+      });
+      const parts = [];
+      const stream = agent.chunkStream(messageId, [...STOP_TYPES]);
+      for await (const chunk of stream) {
+        const text = chunk.data?.content;
+        if (chunk.type === import_protocols39.MessageChunkTypes.INTERRUPT) break;
+        if (chunk.type === import_protocols39.MessageChunkTypes.AI && text) {
+          parts.push(text);
+        }
       }
-      return grants;
-    },
-    tenantExposedDomains: async (tenantId) => {
-      const { manifests } = await (0, import_core95.getSandboxPluginCatalog)().ensureLoaded(tenantId);
-      return buildTenantExposedGrants(Object.values(manifests));
-    },
-    resolvableAssistants: async (tenantId) => new Set(
-      import_core95.agentLatticeManager.getAllAgentLatticesByTenant(tenantId).map((lattice) => lattice.config.key)
-    )
+      return {
+        content: [{ type: "text", text: parts.join("") || "(no output)" }]
+      };
+    }
   };
 }
-var import_core95, AGENT_REFLECTION_CACHE_TTL_MS, cache, PLUGIN_REFLECTION_CACHE_TTL_MS, pluginCache;
-var init_sandboxOpenReflection = __esm({
-  "src/services/open/sandboxOpenReflection.ts"() {
+var import_zod24, import_core95, import_protocols39, STOP_TYPES;
+var init_agentProvider = __esm({
+  "src/services/open/providers/agentProvider.ts"() {
     "use strict";
+    import_zod24 = require("zod");
     import_core95 = require("@axiom-lattice/core");
-    AGENT_REFLECTION_CACHE_TTL_MS = 6e4;
-    cache = /* @__PURE__ */ new Map();
-    PLUGIN_REFLECTION_CACHE_TTL_MS = 6e4;
-    pluginCache = /* @__PURE__ */ new Map();
+    import_protocols39 = require("@axiom-lattice/protocols");
+    STOP_TYPES = [import_protocols39.MessageChunkTypes.MESSAGE_COMPLETED];
   }
 });
 
@@ -5477,12 +5515,7 @@ var init_resources = __esm({
           const ext = subPath.endsWith(".py") ? "py" : "js";
           return this._execApi(record2, subPath, ext, request, reply);
         }
-        const cached = this.deps.cache.get(token);
-        if (cached && !cached.requiresUnlock) {
-          this.deps.logger.info("[share] cache hit", { token, volume: cached.address.volume, resourcePath: cached.address.resourcePath });
-          return this._serveFile(cached.address, token, subPath, cached.sandboxConfig ?? { tenantId: "default", workspaceId: "", projectId: "", assistantId: null }, reply, request.headers.range);
-        }
-        this.deps.logger.info("[share] cache miss, querying DB", { token });
+        this.deps.logger.info("[share] querying DB", { token });
         const record = await this.deps.store.findByToken(token);
         if (!record || record.revoked) {
           this.deps.logger.warn("[share] token not found or revoked", { token, found: !!record, revoked: record?.revoked });
@@ -5509,11 +5542,6 @@ var init_resources = __esm({
             const unlocked = this._isUnlocked(request, token);
             if (!unlocked) {
               this.deps.logger.info("[share] password protected, returning password page", { token });
-              this.deps.cache.set(token, {
-                address: record.address,
-                requiresUnlock: true,
-                sandboxConfig: { tenantId: record.tenantId, workspaceId: record.workspaceId, projectId: record.projectId, assistantId: record.assistantId }
-              });
               return reply.type("text/html").send(this._passwordPage(token));
             }
             this.deps.logger.info("[share] password unlocked", { token });
@@ -5527,11 +5555,6 @@ var init_resources = __esm({
           });
         }
         const sandboxConfig = { tenantId: record.tenantId, workspaceId: record.workspaceId, projectId: record.projectId, assistantId: record.assistantId };
-        this.deps.cache.set(token, {
-          address: record.address,
-          requiresUnlock: record.visibility === "password" && !isInternal,
-          sandboxConfig
-        });
         return this._serveFile(record.address, token, subPath, sandboxConfig, reply, request.headers.range);
       }
       /**
@@ -5792,7 +5815,7 @@ __export(index_exports, {
   runOrphanRecovery: () => runOrphanRecovery
 });
 module.exports = __toCommonJS(index_exports);
-var import_config2 = require("dotenv/config");
+var import_config = require("dotenv/config");
 var import_fastify = __toESM(require("fastify"));
 var import_cors = __toESM(require("@fastify/cors"));
 var import_multipart = __toESM(require("@fastify/multipart"));
@@ -6503,11 +6526,7 @@ async function getAssistantStats(request, reply) {
     const assistantMap = /* @__PURE__ */ new Map();
     codeConfiguredAssistants.forEach((a) => assistantMap.set(a.id, a));
     storedAssistants.forEach((a) => assistantMap.set(a.id, a));
-    const userId = getUserId(request);
-    const assistants = Array.from(assistantMap.values()).filter((a) => {
-      if (!a.ownerUserId) return true;
-      return a.ownerUserId === userId;
-    });
+    const assistants = Array.from(assistantMap.values());
     const threadStore = (0, import_core.getStoreLattice)("default", "thread").store;
     const evalStore = (0, import_core.getStoreLattice)("default", "eval").store;
     const now = Date.now();
@@ -7539,202 +7558,11 @@ async function resumeScheduledTask(request, reply) {
   }
 }
 
-// src/config.ts
-var ConfigService = class {
-  constructor() {
-    this.config = this.loadFromEnv();
-  }
-  /**
-   * Load configuration from environment variables
-   */
-  loadFromEnv() {
-    return {
-      port: process.env.PORT ? Number(process.env.PORT) : void 0,
-      queueServiceType: process.env.QUEUE_SERVICE_TYPE,
-      redisUrl: process.env.REDIS_URL,
-      redisPassword: process.env.REDIS_PASSWORD,
-      queueName: process.env.QUEUE_NAME
-    };
-  }
-  /**
-   * Update configuration from JSON object
-   * This will update both the internal config and process.env
-   */
-  updateConfig(jsonConfig) {
-    for (const [key, value] of Object.entries(jsonConfig)) {
-      if (value !== null && value !== void 0) {
-        if (typeof value === "object" && !Array.isArray(value)) {
-          for (const [nestedKey, nestedValue] of Object.entries(value)) {
-            const envKey = `${key.toUpperCase()}_${nestedKey.toUpperCase()}`;
-            process.env[envKey] = String(nestedValue);
-          }
-        } else {
-          process.env[key.toUpperCase()] = String(value);
-        }
-      }
-    }
-    this.config = this.loadFromEnv();
-    this.config = this.deepMerge(this.config, jsonConfig);
-  }
-  /**
-   * Deep merge two objects
-   */
-  deepMerge(target, source) {
-    const output = { ...target };
-    if (this.isObject(target) && this.isObject(source)) {
-      Object.keys(source).forEach((key) => {
-        if (this.isObject(source[key])) {
-          if (!(key in target)) {
-            Object.assign(output, { [key]: source[key] });
-          } else {
-            output[key] = this.deepMerge(target[key], source[key]);
-          }
-        } else {
-          Object.assign(output, { [key]: source[key] });
-        }
-      });
-    }
-    return output;
-  }
-  /**
-   * Check if value is a plain object
-   */
-  isObject(item) {
-    return item && typeof item === "object" && !Array.isArray(item);
-  }
-  /**
-   * Get current configuration
-   */
-  getConfig() {
-    return { ...this.config };
-  }
-};
-var configService = new ConfigService();
-
-// src/services/queue_service.ts
-var import_core8 = require("@axiom-lattice/core");
-var import_protocols3 = require("@axiom-lattice/protocols");
-var import_queue_redis = require("@axiom-lattice/queue-redis");
-var DEFAULT_QUEUE_KEY = "default";
-var queueServiceType = process.env.QUEUE_SERVICE_TYPE || "memory";
-var setQueueServiceType = (type) => {
-  queueServiceType = type;
-  console.log(`Queue service type set to: ${type}`);
-  const queueName = process.env.QUEUE_NAME || "tasks";
-  const config = {
-    name: "Default Queue Service",
-    description: `Default ${type} queue service`,
-    type: type === "redis" ? import_protocols3.QueueType.REDIS : import_protocols3.QueueType.MEMORY,
-    queueName,
-    options: type === "redis" ? {
-      redisUrl: process.env.REDIS_URL,
-      redisPassword: process.env.REDIS_PASSWORD
-    } : void 0
-  };
-  if (import_core8.queueLatticeManager.hasLattice(DEFAULT_QUEUE_KEY)) {
-    import_core8.queueLatticeManager.removeLattice(DEFAULT_QUEUE_KEY);
-  }
-  let client;
-  if (type === "redis") {
-    client = new import_queue_redis.RedisQueueClient(queueName, {
-      redisUrl: process.env.REDIS_URL,
-      redisPassword: process.env.REDIS_PASSWORD
-    });
-  }
-  (0, import_core8.registerQueueLattice)(DEFAULT_QUEUE_KEY, config, client);
-};
-var getQueueServiceType = () => {
-  return queueServiceType;
-};
-var getQueueService = () => {
-  if (!import_core8.queueLatticeManager.hasLattice(DEFAULT_QUEUE_KEY)) {
-    setQueueServiceType(queueServiceType);
-  }
-  return (0, import_core8.getQueueLattice)(DEFAULT_QUEUE_KEY);
-};
-var popAgentTaskFromQueue = async () => {
-  const queue = getQueueService();
-  const result = await queue.pop();
-  return result;
-};
-
-// src/controllers/config.ts
-async function updateConfig(request, reply) {
-  try {
-    const { config: jsonConfig } = request.body;
-    if (!jsonConfig || typeof jsonConfig !== "object") {
-      return reply.status(400).send({
-        success: false,
-        error: "Invalid configuration: config must be an object"
-      });
-    }
-    configService.updateConfig(jsonConfig);
-    const warnings = [];
-    const requiresRestart = [];
-    if (jsonConfig.port !== void 0) {
-      requiresRestart.push("PORT");
-      warnings.push("Port change requires server restart to take effect");
-    }
-    if (jsonConfig.queueServiceType) {
-      setQueueServiceType(jsonConfig.queueServiceType);
-    }
-    if ((jsonConfig.redisUrl || jsonConfig.redisPassword) && (process.env.QUEUE_SERVICE_TYPE === "redis" || jsonConfig.queueServiceType === "redis")) {
-      const currentType = jsonConfig.queueServiceType || process.env.QUEUE_SERVICE_TYPE || "memory";
-      if (currentType === "redis") {
-        setQueueServiceType("redis");
-      }
-    }
-    const updatedConfig = configService.getConfig();
-    const safeConfig = {
-      ...updatedConfig,
-      redisPassword: updatedConfig.redisPassword ? "***" : updatedConfig.redisPassword
-    };
-    return reply.send({
-      success: true,
-      message: "Configuration updated successfully",
-      data: safeConfig,
-      warnings: warnings.length > 0 ? warnings : void 0,
-      requiresRestart: requiresRestart.length > 0 ? requiresRestart : void 0
-    });
-  } catch (error) {
-    console.error("Failed to update configuration", {
-      error: error.message,
-      stack: error.stack
-    });
-    return reply.status(500).send({
-      success: false,
-      error: error.message || "Failed to update configuration"
-    });
-  }
-}
-async function getConfig(request, reply) {
-  try {
-    const currentConfig = configService.getConfig();
-    const safeConfig = {
-      ...currentConfig,
-      redisPassword: currentConfig.redisPassword ? "***" : currentConfig.redisPassword
-    };
-    return reply.send({
-      success: true,
-      data: safeConfig
-    });
-  } catch (error) {
-    console.error("Failed to get configuration", {
-      error: error.message,
-      stack: error.stack
-    });
-    return reply.status(500).send({
-      success: false,
-      error: error.message || "Failed to get configuration"
-    });
-  }
-}
-
 // src/controllers/models.ts
-var import_core9 = require("@axiom-lattice/core");
+var import_core8 = require("@axiom-lattice/core");
 async function getModels(request, reply) {
   try {
-    const allLattices = import_core9.modelLatticeManager.getAllLatticesByTenant("default");
+    const allLattices = import_core8.modelLatticeManager.getAllLatticesByTenant("default");
     const models = allLattices.map((lattice) => {
       const config = lattice.client.getConfig();
       const displayName = config.displayName || lattice.key.split("-").map((word) => word.charAt(0).toUpperCase() + word.slice(1)).join(" ");
@@ -7792,10 +7620,10 @@ async function updateModels(request, reply) {
         continue;
       }
       try {
-        const existingConfig = import_core9.modelLatticeManager.hasLattice(modelConfig.key) ? import_core9.modelLatticeManager.getModelLattice(modelConfig.key).client.getConfig() : void 0;
+        const existingConfig = import_core8.modelLatticeManager.hasLattice(modelConfig.key) ? import_core8.modelLatticeManager.getModelLattice(modelConfig.key).client.getConfig() : void 0;
         const effectiveApiKey = modelConfig.clearApiKey ? void 0 : modelConfig.apiKey || existingConfig?.apiKey;
-        if (import_core9.modelLatticeManager.hasLattice(modelConfig.key)) {
-          import_core9.modelLatticeManager.removeLattice(modelConfig.key);
+        if (import_core8.modelLatticeManager.hasLattice(modelConfig.key)) {
+          import_core8.modelLatticeManager.removeLattice(modelConfig.key);
         }
         const llmConfig = {
           provider: modelConfig.provider,
@@ -7809,7 +7637,7 @@ async function updateModels(request, reply) {
           timeout: modelConfig.timeout,
           maxRetries: modelConfig.maxRetries
         };
-        (0, import_core9.registerModelLattice)(modelConfig.key, llmConfig);
+        (0, import_core8.registerModelLattice)(modelConfig.key, llmConfig);
         registeredModels.push(modelConfig.key);
       } catch (error) {
         errors.push(
@@ -7845,6 +7673,55 @@ async function updateModels(request, reply) {
 
 // src/services/multiReplicaReadiness.ts
 var import_core10 = require("@axiom-lattice/core");
+
+// src/services/queue_service.ts
+var import_core9 = require("@axiom-lattice/core");
+var import_protocols3 = require("@axiom-lattice/protocols");
+var import_queue_redis = require("@axiom-lattice/queue-redis");
+var DEFAULT_QUEUE_KEY = "default";
+var queueServiceType = process.env.QUEUE_SERVICE_TYPE || "memory";
+var setQueueServiceType = (type) => {
+  queueServiceType = type;
+  console.log(`Queue service type set to: ${type}`);
+  const queueName = process.env.QUEUE_NAME || "tasks";
+  const config = {
+    name: "Default Queue Service",
+    description: `Default ${type} queue service`,
+    type: type === "redis" ? import_protocols3.QueueType.REDIS : import_protocols3.QueueType.MEMORY,
+    queueName,
+    options: type === "redis" ? {
+      redisUrl: process.env.REDIS_URL,
+      redisPassword: process.env.REDIS_PASSWORD
+    } : void 0
+  };
+  if (import_core9.queueLatticeManager.hasLattice(DEFAULT_QUEUE_KEY)) {
+    import_core9.queueLatticeManager.removeLattice(DEFAULT_QUEUE_KEY);
+  }
+  let client;
+  if (type === "redis") {
+    client = new import_queue_redis.RedisQueueClient(queueName, {
+      redisUrl: process.env.REDIS_URL,
+      redisPassword: process.env.REDIS_PASSWORD
+    });
+  }
+  (0, import_core9.registerQueueLattice)(DEFAULT_QUEUE_KEY, config, client);
+};
+var getQueueServiceType = () => {
+  return queueServiceType;
+};
+var getQueueService = () => {
+  if (!import_core9.queueLatticeManager.hasLattice(DEFAULT_QUEUE_KEY)) {
+    setQueueServiceType(queueServiceType);
+  }
+  return (0, import_core9.getQueueLattice)(DEFAULT_QUEUE_KEY);
+};
+var popAgentTaskFromQueue = async () => {
+  const queue = getQueueService();
+  const result = await queue.pop();
+  return result;
+};
+
+// src/services/multiReplicaReadiness.ts
 var SHARED_STORE_KINDS = [
   "lease",
   "outbox",
@@ -10543,77 +10420,6 @@ var triggerAgentTaskSchema = {
     }
   }
 };
-var updateConfigSchema = {
-  description: "Update gateway configuration",
-  tags: ["Configuration"],
-  summary: "Update Configuration",
-  body: {
-    type: "object",
-    properties: {
-      config: {
-        type: "object",
-        description: "Configuration object to update",
-        properties: {
-          port: { type: "number", description: "Server port" },
-          queueServiceType: {
-            type: "string",
-            enum: ["memory", "redis"],
-            description: "Queue service type"
-          },
-          redisUrl: { type: "string", description: "Redis URL" },
-          redisPassword: { type: "string", description: "Redis password" },
-          queueName: { type: "string", description: "Queue name" }
-        }
-      }
-    },
-    required: ["config"]
-  },
-  response: {
-    200: {
-      type: "object",
-      properties: {
-        success: { type: "boolean" },
-        message: { type: "string" },
-        data: { type: "object" }
-      }
-    },
-    400: {
-      type: "object",
-      properties: {
-        success: { type: "boolean" },
-        error: { type: "string" }
-      }
-    },
-    500: {
-      type: "object",
-      properties: {
-        success: { type: "boolean" },
-        error: { type: "string" }
-      }
-    }
-  }
-};
-var getConfigSchema = {
-  description: "Get current gateway configuration",
-  tags: ["Configuration"],
-  summary: "Get Configuration",
-  response: {
-    200: {
-      type: "object",
-      properties: {
-        success: { type: "boolean" },
-        data: { type: "object" }
-      }
-    },
-    500: {
-      type: "object",
-      properties: {
-        success: { type: "boolean" },
-        error: { type: "string" }
-      }
-    }
-  }
-};
 var getHealthSchema = {
   description: "Health check endpoint for monitoring and load balancer checks",
   tags: ["Health"],
@@ -29201,16 +29007,6 @@ var registerLatticeRoutes = (app2, channelDeps, options = {}) => {
     "/api/assistants/:assistantId/threads/:threadId",
     deleteThread
   );
-  app2.get(
-    "/api/config",
-    { schema: getConfigSchema },
-    getConfig
-  );
-  app2.put(
-    "/api/config",
-    { schema: updateConfigSchema },
-    updateConfig
-  );
   app2.get("/api/models", getModels);
   app2.put("/api/models", updateModels);
   app2.get("/api/tools", getToolConfigs);
@@ -32413,6 +32209,9 @@ function createChannelInfrastructure(deps) {
   return { router, installationStore, bindingRegistry };
 }
 
+// src/index.ts
+init_sandboxOpenReflection();
+
 // src/services/collaboration/ProjectTaskRuntimeStartup.ts
 async function prepareProjectTaskRuntime(runtime, log2) {
   try {
@@ -32427,11 +32226,11 @@ async function prepareProjectTaskRuntime(runtime, log2) {
 }
 
 // src/services/plugins/PluginDeploymentRuntimeStartup.ts
-var import_core75 = require("@axiom-lattice/core");
+var import_core76 = require("@axiom-lattice/core");
 
 // src/services/plugins/PluginDeploymentService.ts
 var import_node_crypto30 = require("crypto");
-var import_core74 = require("@axiom-lattice/core");
+var import_core75 = require("@axiom-lattice/core");
 
 // src/services/plugins/pluginDeploymentNaming.ts
 var import_node_crypto29 = require("crypto");
@@ -32449,7 +32248,7 @@ function pluginSandboxName(tenantId, pluginType) {
 }
 
 // src/services/plugins/PluginDeploymentService.ts
-var PLUGIN_HOST_SERVER_PATH = `${import_core74.PLUGIN_HOST_DIR}/server.js`;
+var PLUGIN_HOST_SERVER_PATH = `${import_core75.PLUGIN_HOST_DIR}/server.js`;
 var DEFAULT_PLUGIN_IDLE_TIMEOUT_MS = 15 * 60 * 1e3;
 var DEFAULT_PLUGIN_HEALTH_TIMEOUT_MS = 3e4;
 var DEFAULT_PLUGIN_HEALTH_POLL_INTERVAL_MS = 500;
@@ -32488,7 +32287,7 @@ var PluginDeploymentService = class {
     this.catalog = deps.catalog;
     this.installPluginHost = deps.installPluginHost;
     this.lease = deps.lease;
-    this.registry = deps.registry ?? new import_core74.PluginDeploymentRuntimeRegistry({ now: deps.clock ?? Date.now });
+    this.registry = deps.registry ?? new import_core75.PluginDeploymentRuntimeRegistry({ now: deps.clock ?? Date.now });
     this.now = deps.clock ?? Date.now;
     this.logger = deps.logger ?? { info: () => void 0 };
     this.limits = deps.limits ?? {};
@@ -33205,7 +33004,7 @@ function startPluginDeploymentRuntime(options) {
     );
     return { reconcile: Promise.resolve(), dispose: async () => void 0 };
   }
-  const register = options.register ?? ((service3) => (0, import_core75.setPluginDeploymentService)(service3));
+  const register = options.register ?? ((service3) => (0, import_core76.setPluginDeploymentService)(service3));
   const setIntervalFn = options.setIntervalFn ?? setInterval;
   const clearIntervalFn = options.clearIntervalFn ?? clearInterval;
   const watchdogIntervalMs = options.watchdogIntervalMs ?? DEFAULT_PLUGIN_WATCHDOG_INTERVAL_MS;
@@ -33924,7 +33723,11 @@ var start = async (config) => {
         [ROOM_EVENT_TOPIC]: async (payload) => {
           if (projectRoomRealtimeRuntime) ingestRoomEvent(payload, projectRoomRealtimeRuntime.broker);
         },
-        "assistant-changed": (payload) => handleAssistantChanged(payload, (tenantId) => import_core99.agentLatticeManager.initializeStoredAssistantsForTenant(tenantId)),
+        "assistant-changed": (payload) => handleAssistantChanged(payload, async (tenantId) => {
+          await import_core99.agentLatticeManager.initializeStoredAssistantsForTenant(tenantId);
+          invalidateAgentReflectionCache(tenantId);
+          invalidatePluginReflectionCache(tenantId);
+        }),
         [A2A_KEY_CHANGED_TOPIC]: (payload) => handleA2AKeyChanged(payload, () => refreshStoreKeyMap()),
         [MCP_CONFIG_CHANGED_TOPIC]: (payload) => reconcileMcpConfigChange(payload, {
           store: (0, import_core99.getStoreLattice)("default", "mcp").store,
@@ -33935,6 +33738,8 @@ var start = async (config) => {
           const tenantId = payload?.tenantId;
           if (typeof tenantId === "string" && tenantId.length > 0) {
             (0, import_core99.getSandboxPluginCatalog)().invalidate(tenantId);
+            invalidatePluginReflectionCache(tenantId);
+            invalidateAgentReflectionCache(tenantId);
             await getMcpUiResourceResolver()?.invalidateTenantPlugins(tenantId);
           }
         },