@nextclaw/server 0.17.3 → 0.18.0

package/dist/index.js

@@ -64,13 +64,13 @@ async function readJson(req) {
 		return { ok: false };
 	}
 }
-function isRecord$2(value) {
+function isRecord$3(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function readErrorMessage(value, fallback) {
-	if (!isRecord$2(value)) return fallback;
+	if (!isRecord$3(value)) return fallback;
 	const maybeError = value.error;
-	if (!isRecord$2(maybeError)) return fallback;
+	if (!isRecord$3(maybeError)) return fallback;
 	return typeof maybeError.message === "string" && maybeError.message.trim().length > 0 ? maybeError.message : fallback;
 }
 function readNonEmptyString(value) {
@@ -477,7 +477,8 @@ const ingressKeys = {
 		channelCommandList: createTypedKey("extension.channel.command.list"),
 		channelCommandExecute: createTypedKey("extension.channel.command.execute"),
 		runtimeReady: createTypedKey("extension.runtime.ready"),
-		response: createTypedKey("extension.response")
+		response: createTypedKey("extension.response"),
+		observationEvent: createTypedKey("extension.observation.event")
 	},
 	agentRun: {
 		send: createTypedKey("agent-run.send"),
@@ -1456,7 +1457,7 @@ var ServerPathRoutesController = class {
 	watch = async (c) => {
 		if (!this.watchService) return c.json(err("SERVER_PATH_WATCH_UNAVAILABLE", "server path watch is unavailable"), 503);
 		const body = await readJson(c.req.raw);
-		if (!body.ok || !isRecord$2(body.data) || !Array.isArray(body.data.directories) || !body.data.directories.every((path) => typeof path === "string")) return c.json(err("INVALID_SERVER_PATH_WATCH", "directories are required"), 400);
+		if (!body.ok || !isRecord$3(body.data) || !Array.isArray(body.data.directories) || !body.data.directories.every((path) => typeof path === "string")) return c.json(err("INVALID_SERVER_PATH_WATCH", "directories are required"), 400);
 		try {
 			const request = {
 				directories: body.data.directories,
@@ -1502,7 +1503,7 @@ var ServerPathRoutesController = class {
 	};
 	createDirectory = async (c) => {
 		const body = await readJson(c.req.raw);
-		if (!body.ok || !isRecord$2(body.data)) return c.json(err("INVALID_SERVER_PATH_DIRECTORY", "directory input is required"), 400);
+		if (!body.ok || !isRecord$3(body.data)) return c.json(err("INVALID_SERVER_PATH_DIRECTORY", "directory input is required"), 400);
 		try {
 			return c.json(ok(await createServerPathDirectory({
 				basePath: body.data.basePath,
@@ -1539,7 +1540,7 @@ var ServerPathRoutesController = class {
 	};
 	createFile = async (c) => {
 		const body = await readJson(c.req.raw);
-		if (!body.ok || !isRecord$2(body.data)) return c.json(err("INVALID_SERVER_PATH_FILE", "file input is required"), 400);
+		if (!body.ok || !isRecord$3(body.data)) return c.json(err("INVALID_SERVER_PATH_FILE", "file input is required"), 400);
 		try {
 			return c.json(ok(await createServerPathFile({
 				basePath: body.data.basePath,
@@ -1553,7 +1554,7 @@ var ServerPathRoutesController = class {
 	};
 	renameEntry = async (c) => {
 		const body = await readJson(c.req.raw);
-		if (!body.ok || !isRecord$2(body.data)) return c.json(err("INVALID_SERVER_PATH_RENAME", "rename input is required"), 400);
+		if (!body.ok || !isRecord$3(body.data)) return c.json(err("INVALID_SERVER_PATH_RENAME", "rename input is required"), 400);
 		try {
 			return c.json(ok(await renameServerPathEntry({
 				basePath: body.data.basePath,
@@ -1905,20 +1906,62 @@ function buildFallbackBootstrapStatus() {
 		remote: { state: "pending" }
 	};
 }
+function buildExtensionsView(options) {
+	const manifests = options.kernel.extensions.getManifests();
+	const statuses = options.kernel.extensions.getRuntimeStatus();
+	const statusById = new Map(statuses.map((status) => [status.extensionId, status]));
+	const extensions = manifests.map((manifest) => {
+		const status = statusById.get(manifest.id);
+		const observations = manifest.contributes?.observations;
+		const channels = (manifest.contributes?.channels ?? []).map((channel) => ({
+			id: channel.id,
+			...channel.name ? { name: channel.name } : {},
+			...typeof channel.meta?.description === "string" ? { description: channel.meta.description } : {}
+		}));
+		return {
+			id: manifest.id,
+			name: manifest.name?.trim() || manifest.id,
+			...manifest.version ? { version: manifest.version } : {},
+			state: status?.state ?? "stopped",
+			...status?.generation ? { generation: status.generation } : {},
+			...status?.pid ? { pid: status.pid } : {},
+			...status?.startedAt ? { startedAt: status.startedAt } : {},
+			leaseCount: status?.leaseReasons.length ?? 0,
+			observations: {
+				context: Boolean(observations?.read),
+				events: Boolean(observations?.events)
+			},
+			channels
+		};
+	});
+	return {
+		extensions,
+		counts: {
+			total: extensions.length,
+			running: extensions.filter((extension) => extension.state === "running").length,
+			withObservations: extensions.filter((extension) => extension.observations.context || extension.observations.events).length,
+			withChannels: extensions.filter((extension) => extension.channels.length > 0).length
+		}
+	};
+}
 var AppRoutesController = class {
 	constructor(options) {
 		this.options = options;
 	}
-	health = (c) => c.json(ok({
-		status: "ok",
-		services: {
-			ncpAgent: "ready",
-			cronService: this.options.cron ? "ready" : "unavailable"
-		}
-	}));
+	health = (c) => {
+		const bootstrapStatus = this.options.bootstrapStatus?.getStatus() ?? buildFallbackBootstrapStatus();
+		return c.json(ok({
+			status: "ok",
+			services: {
+				ncpAgent: bootstrapStatus.ncpAgent.state,
+				cronService: this.options.cron ? "ready" : "unavailable"
+			}
+		}));
+	};
 	appMeta = (c) => c.json(ok(buildAppMetaView(this.options)));
 	bootstrapStatus = (c) => c.json(ok(this.options.bootstrapStatus?.getStatus() ?? buildFallbackBootstrapStatus()));
-	extensionRuntimeStatus = (c) => c.json(ok(this.options.extensions?.getRuntimeStatus?.() ?? []));
+	extensionRuntimeStatus = (c) => c.json(ok(this.options.kernel.extensions.getRuntimeStatus()));
+	extensionCatalog = (c) => c.json(ok(buildExtensionsView(this.options)));
 };
 //#endregion
 //#region src/features/app-packages/controllers/app-packages.controller.ts
@@ -1930,7 +1973,7 @@ var AppPackagesRoutesController = class {
 	listOperations = async (c) => c.json(ok(await this.manager.listOperations()));
 	startInstallOperation = async (c) => {
 		const body = await readJson(c.req.raw);
-		if (!body.ok || !isRecord$2(body.data) || typeof body.data.source !== "string") return c.json(err("INVALID_APP_PACKAGE_INSTALL", "source is required"), 400);
+		if (!body.ok || !isRecord$3(body.data) || typeof body.data.source !== "string") return c.json(err("INVALID_APP_PACKAGE_INSTALL", "source is required"), 400);
 		try {
 			return c.json(ok(await this.manager.startOperation({
 				action: "install",
@@ -1943,7 +1986,7 @@ var AppPackagesRoutesController = class {
 	};
 	startUpdateOperation = async (c) => {
 		const body = await readJson(c.req.raw);
-		if (!body.ok || !isRecord$2(body.data)) return c.json(err("INVALID_APP_PACKAGE_UPDATE", "invalid update request"), 400);
+		if (!body.ok || !isRecord$3(body.data)) return c.json(err("INVALID_APP_PACKAGE_UPDATE", "invalid update request"), 400);
 		try {
 			return c.json(ok(await this.manager.startOperation({
 				action: "update",
@@ -1957,7 +2000,7 @@ var AppPackagesRoutesController = class {
 	};
 	startRollbackOperation = async (c) => {
 		const body = await readJson(c.req.raw);
-		if (!body.ok || !isRecord$2(body.data) || typeof body.data.version !== "string") return c.json(err("INVALID_APP_PACKAGE_ROLLBACK", "version is required"), 400);
+		if (!body.ok || !isRecord$3(body.data) || typeof body.data.version !== "string") return c.json(err("INVALID_APP_PACKAGE_ROLLBACK", "version is required"), 400);
 		try {
 			return c.json(ok(await this.manager.startOperation({
 				action: "rollback",
@@ -1970,7 +2013,7 @@ var AppPackagesRoutesController = class {
 	};
 	startUninstallOperation = async (c) => {
 		const body = await readJson(c.req.raw);
-		const purgeData = body.ok && isRecord$2(body.data) && body.data.purgeData === true;
+		const purgeData = body.ok && isRecord$3(body.data) && body.data.purgeData === true;
 		try {
 			return c.json(ok(await this.manager.startOperation({
 				action: "uninstall",
@@ -1990,7 +2033,7 @@ var AppPackagesRoutesController = class {
 	};
 	install = async (c) => {
 		const body = await readJson(c.req.raw);
-		if (!body.ok || !isRecord$2(body.data) || typeof body.data.source !== "string") return c.json(err("INVALID_APP_PACKAGE_INSTALL", "source is required"), 400);
+		if (!body.ok || !isRecord$3(body.data) || typeof body.data.source !== "string") return c.json(err("INVALID_APP_PACKAGE_INSTALL", "source is required"), 400);
 		try {
 			return c.json(ok(await this.manager.install(body.data.source, typeof body.data.registryUrl === "string" ? body.data.registryUrl : void 0)));
 		} catch (error) {
@@ -2013,7 +2056,7 @@ var AppPackagesRoutesController = class {
 	};
 	update = async (c) => {
 		const body = await readJson(c.req.raw);
-		if (!body.ok || !isRecord$2(body.data)) return c.json(err("INVALID_APP_PACKAGE_UPDATE", "invalid update request"), 400);
+		if (!body.ok || !isRecord$3(body.data)) return c.json(err("INVALID_APP_PACKAGE_UPDATE", "invalid update request"), 400);
 		try {
 			return c.json(ok(await this.manager.update(c.req.param("appId"), {
 				version: typeof body.data.version === "string" ? body.data.version : void 0,
@@ -2025,7 +2068,7 @@ var AppPackagesRoutesController = class {
 	};
 	rollback = async (c) => {
 		const body = await readJson(c.req.raw);
-		if (!body.ok || !isRecord$2(body.data) || typeof body.data.version !== "string") return c.json(err("INVALID_APP_PACKAGE_ROLLBACK", "version is required"), 400);
+		if (!body.ok || !isRecord$3(body.data) || typeof body.data.version !== "string") return c.json(err("INVALID_APP_PACKAGE_ROLLBACK", "version is required"), 400);
 		try {
 			return c.json(ok(await this.manager.rollback(c.req.param("appId"), body.data.version)));
 		} catch (error) {
@@ -2034,7 +2077,7 @@ var AppPackagesRoutesController = class {
 	};
 	uninstall = async (c) => {
 		const body = await readJson(c.req.raw);
-		const purgeData = body.ok && isRecord$2(body.data) && body.data.purgeData === true;
+		const purgeData = body.ok && isRecord$3(body.data) && body.data.purgeData === true;
 		try {
 			return c.json(ok(await this.manager.uninstall(c.req.param("appId"), purgeData)));
 		} catch (error) {
@@ -2060,7 +2103,7 @@ var AppDataRoutesController = class {
 	};
 	deleteRetained = async (c) => {
 		const body = await readJson(c.req.raw);
-		if (!body.ok || !isRecord$2(body.data) || typeof body.data.confirmAppId !== "string" || !body.data.confirmAppId.trim()) return c.json(err("INVALID_APP_DATA_DELETE_REQUEST", "confirmAppId is required."), 400);
+		if (!body.ok || !isRecord$3(body.data) || typeof body.data.confirmAppId !== "string" || !body.data.confirmAppId.trim()) return c.json(err("INVALID_APP_DATA_DELETE_REQUEST", "confirmAppId is required."), 400);
 		try {
 			return c.json(ok(await this.manager.deleteRetained(c.req.param("dataId"), body.data.confirmAppId.trim())));
 		} catch (error) {
@@ -2097,7 +2140,7 @@ var SystemObjectReferencesRoutesController = class {
 	};
 	resolve = async (c) => {
 		const body = await readJson(c.req.raw);
-		if (!body.ok || !isRecord$2(body.data) || typeof body.data.uri !== "string" || !body.data.uri.trim()) return c.json(err("INVALID_SYSTEM_OBJECT_REFERENCE", "uri must be a non-empty string"), 400);
+		if (!body.ok || !isRecord$3(body.data) || typeof body.data.uri !== "string" || !body.data.uri.trim()) return c.json(err("INVALID_SYSTEM_OBJECT_REFERENCE", "uri must be a non-empty string"), 400);
 		try {
 			return c.json(ok(await this.manager.resolveReference(body.data.uri)));
 		} catch (error) {
@@ -4492,7 +4535,7 @@ var InboxDeliveriesRoutesController = class {
 	};
 	updateState = async (c) => {
 		const body = await readJson(c.req.raw);
-		if (!body.ok || !isRecord$2(body.data) || !isStateAction(body.data.action)) return c.json(err("INVALID_INBOX_DELIVERY_ACTION", "invalid inbox delivery action"), 400);
+		if (!body.ok || !isRecord$3(body.data) || !isStateAction(body.data.action)) return c.json(err("INVALID_INBOX_DELIVERY_ACTION", "invalid inbox delivery action"), 400);
 		return await this.handleManagerAction(c, () => this.manager.updateDeliveryState(c.req.param("deliveryId"), body.data.action));
 	};
 	delete = async (c) => {
@@ -5472,21 +5515,19 @@ function isDeferrableMessage(message) {
 function deferMessageToolPayload(message) {
 	const tools = message.parts.filter((part) => part.type === "tool-invocation");
 	const toolNames = [...new Set(tools.map((part) => part.toolName.trim()).filter(Boolean))].slice(0, SUMMARY_TOOL_NAME_LIMIT);
-	const parts = [];
 	let keptRepresentative = false;
-	for (const part of message.parts) {
-		if (part.type !== "tool-invocation") {
-			parts.push(part);
-			continue;
-		}
-		if (keptRepresentative) continue;
+	const parts = message.parts.map((part) => {
+		if (part.type !== "tool-invocation") return part;
+		const isRepresentative = !keptRepresentative;
 		keptRepresentative = true;
-		parts.push({
+		return {
 			...part,
+			...isRepresentative ? {} : { payloadDeferred: true },
 			args: void 0,
-			result: void 0
-		});
-	}
+			result: void 0,
+			resultContentItems: void 0
+		};
+	});
 	return {
 		...message,
 		metadata: {
@@ -5499,6 +5540,20 @@ function deferMessageToolPayload(message) {
 		parts
 	};
 }
+function sanitizeContextCompactionHistoryMessage(message) {
+	const metadata = message.metadata;
+	if (metadata?.nextclaw_timeline_kind !== "context_compaction") return message;
+	const checkpoint = metadata.checkpoint;
+	if (!checkpoint || typeof checkpoint !== "object" || Array.isArray(checkpoint)) return message;
+	const { summary: _summary, summaryDiagnostics: _summaryDiagnostics, ...uiCheckpoint } = checkpoint;
+	return {
+		...message,
+		metadata: {
+			...metadata,
+			checkpoint: uiCheckpoint
+		}
+	};
+}
 function buildSessionMessageHistoryPayloadView(params) {
 	const { messageBudgetBytes: requestedMessageBudgetBytes, messageDetailCursors, messages, messageToolCallBudget: requestedMessageToolCallBudget, pageBudgetBytes: requestedPageBudgetBytes, pageToolCallBudget: requestedPageToolCallBudget } = params;
 	const messageBudgetBytes = requestedMessageBudgetBytes ?? 262144;
@@ -5530,7 +5585,10 @@ function buildSessionMessageHistoryPayloadView(params) {
 	}
 	const deferredToolPayloads = Object.fromEntries([...deferredIds].map((messageId) => [messageId, { cursor: messageDetailCursors[messageId] }]));
 	return {
-		messages: messages.map((message) => deferredIds.has(message.id) ? deferMessageToolPayload(message) : message),
+		messages: messages.map((message) => {
+			const sanitized = sanitizeContextCompactionHistoryMessage(message);
+			return deferredIds.has(message.id) ? deferMessageToolPayload(sanitized) : sanitized;
+		}),
 		deferredToolPayloads
 	};
 }
@@ -5538,7 +5596,14 @@ function compactSessionMessageHistoryPayloadView(params) {
 	const { view } = params;
 	const budgetBytes = params.budgetBytes ?? 24576;
 	const minimumMessages = Math.max(1, Math.trunc(params.minimumMessages ?? 5));
-	let startIndex = Math.max(0, view.messages.length - minimumMessages);
+	let startIndex = view.messages.length;
+	let conversationMessageCount = 0;
+	while (startIndex > 0 && conversationMessageCount < minimumMessages) {
+		startIndex -= 1;
+		const message = view.messages[startIndex];
+		if (message?.role === "user" || message?.role === "assistant") conversationMessageCount += 1;
+	}
+	if (startIndex === view.messages.length) startIndex = Math.max(0, view.messages.length - minimumMessages);
 	let bytes = view.messages.slice(startIndex).reduce((total, message) => total + serializedBytes(message), 0);
 	while (startIndex > 0) {
 		const previousBytes = serializedBytes(view.messages[startIndex - 1]);
@@ -5555,6 +5620,115 @@ function compactSessionMessageHistoryPayloadView(params) {
 	};
 }
 //#endregion
+//#region src/features/sessions/utils/session-observation-view.utils.ts
+const SENSITIVE_KEY_PATTERN = /(token|secret|password|cookie|api[-_]?key|credential|authorization)/i;
+const MAX_PREVIEW_ENTRIES = 6;
+const MAX_PREVIEW_VALUE_LENGTH = 80;
+function isRecord$2(value) {
+	return Boolean(value) && typeof value === "object" && !Array.isArray(value);
+}
+function previewValue(key, value) {
+	if (SENSITIVE_KEY_PATTERN.test(key)) return "••••••";
+	if (value === null) return "null";
+	if (typeof value === "string") {
+		const normalized = value.trim();
+		if (normalized.length <= MAX_PREVIEW_VALUE_LENGTH) return normalized || "空字符串";
+		return `${normalized.slice(0, MAX_PREVIEW_VALUE_LENGTH - 1)}…`;
+	}
+	if (typeof value === "number" || typeof value === "boolean") return String(value);
+	if (Array.isArray(value)) return `[${value.length} 项]`;
+	if (isRecord$2(value)) return "已配置";
+	return "已配置";
+}
+function buildSafeConfigPreview(config) {
+	if (!isRecord$2(config)) return config === void 0 ? void 0 : "已配置";
+	const entries = Object.entries(config).slice(0, MAX_PREVIEW_ENTRIES);
+	if (entries.length === 0) return void 0;
+	const preview = entries.map(([key, value]) => `${key}: ${previewValue(key, value)}`);
+	if (Object.keys(config).length > MAX_PREVIEW_ENTRIES) preview.push("…");
+	return preview.join(" · ");
+}
+function buildDescriptorMap(descriptors) {
+	return new Map(descriptors.map((descriptor) => [`${descriptor.kind}:${descriptor.extensionId}`, descriptor]));
+}
+function buildDeliveryCounts(deliveries) {
+	const counts = /* @__PURE__ */ new Map();
+	for (const delivery of deliveries) {
+		const current = counts.get(delivery.subscriptionId) ?? {
+			pending: 0,
+			failures: 0
+		};
+		if (delivery.status === "pending" || delivery.status === "submitted") current.pending += 1;
+		if (delivery.status === "failed") current.failures += 1;
+		counts.set(delivery.subscriptionId, current);
+	}
+	return counts;
+}
+function buildContextView(binding, descriptors) {
+	const descriptor = descriptors.get(`context:${binding.extensionId}`);
+	const safeConfigPreview = buildSafeConfigPreview(binding.config);
+	return {
+		id: binding.bindingId,
+		kind: "context",
+		extensionId: binding.extensionId,
+		title: descriptor?.title ?? binding.extensionId,
+		...descriptor?.description ? { description: descriptor.description } : {},
+		status: binding.status,
+		...binding.statusReason ? { statusReason: binding.statusReason } : {},
+		createdAt: binding.createdAt,
+		...binding.expiresAt ? { expiresAt: binding.expiresAt } : {},
+		...binding.lastReadAt ? { lastReadAt: binding.lastReadAt } : {},
+		...safeConfigPreview ? { safeConfigPreview } : {}
+	};
+}
+function buildSubscriptionView(subscription, descriptors, deliveryCounts) {
+	const descriptor = descriptors.get(`events:${subscription.extensionId}`);
+	const counts = deliveryCounts.get(subscription.subscriptionId) ?? {
+		pending: 0,
+		failures: 0
+	};
+	const safeConfigPreview = buildSafeConfigPreview(subscription.config);
+	return {
+		id: subscription.subscriptionId,
+		kind: "events",
+		extensionId: subscription.extensionId,
+		title: descriptor?.title ?? subscription.extensionId,
+		...descriptor?.description ? { description: descriptor.description } : {},
+		status: subscription.status,
+		...subscription.statusReason ? { statusReason: subscription.statusReason } : {},
+		createdAt: subscription.createdAt,
+		...subscription.expiresAt ? { expiresAt: subscription.expiresAt } : {},
+		...safeConfigPreview ? { safeConfigPreview } : {},
+		pendingCount: counts.pending,
+		...subscription.suppressedCount ? { suppressedCount: subscription.suppressedCount } : {},
+		...counts.failures > 0 ? { deliveryFailureCount: counts.failures } : {},
+		...subscription.lastSuppressionReason ? { lastSuppressionReason: subscription.lastSuppressionReason } : {},
+		...subscription.lastGapAt ? { lastGapAt: subscription.lastGapAt } : {},
+		...subscription.gapReason ? { gapReason: subscription.gapReason } : {},
+		delivery: subscription.delivery
+	};
+}
+function needsAttention(observation) {
+	return observation.status !== "active" || (observation.deliveryFailureCount ?? 0) > 0 || Boolean(observation.lastGapAt);
+}
+function buildSessionObservationsView(input) {
+	const descriptors = buildDescriptorMap(input.descriptors);
+	const deliveryCounts = buildDeliveryCounts(input.deliveries);
+	const bindings = input.bindings.map((binding) => buildContextView(binding, descriptors));
+	const subscriptions = input.subscriptions.map((subscription) => buildSubscriptionView(subscription, descriptors, deliveryCounts));
+	return {
+		sessionId: input.sessionId,
+		bindings,
+		subscriptions,
+		counts: {
+			total: bindings.length + subscriptions.length,
+			context: bindings.length,
+			events: subscriptions.length,
+			needsAttention: [...bindings, ...subscriptions].filter(needsAttention).length
+		}
+	};
+}
+//#endregion
 //#region src/features/sessions/controllers/sessions.controller.ts
 const DEFAULT_SESSION_MESSAGE_PAGE_SIZE = 40;
 const MAX_SESSION_MESSAGE_PAGE_SIZE = 200;
@@ -5689,6 +5863,42 @@ var NcpSessionRoutesController = class {
 		if (!payload) return c.json(err("NOT_FOUND", `ncp session not found: ${sessionId}`), 404);
 		return c.json(ok(payload));
 	};
+	listSessionObservations = async (c) => {
+		const sessionId = decodeURIComponent(c.req.param("sessionId"));
+		if (!await this.options.kernel.sessionManager.getSession(sessionId)) return c.json(err("NOT_FOUND", `ncp session not found: ${sessionId}`), 404);
+		const payload = buildSessionObservationsView({
+			sessionId,
+			...await this.options.kernel.observations.listObservations(sessionId),
+			descriptors: this.options.kernel.observations.discoverObservations()
+		});
+		return c.json(ok(payload));
+	};
+	updateSessionObservation = async (c) => {
+		const sessionId = decodeURIComponent(c.req.param("sessionId"));
+		const kind = c.req.param("kind");
+		const id = decodeURIComponent(c.req.param("id"));
+		if (!await this.options.kernel.sessionManager.getSession(sessionId)) return c.json(err("NOT_FOUND", `ncp session not found: ${sessionId}`), 404);
+		const body = await readJson(c.req.raw);
+		const action = body.ok && body.data?.action;
+		if (action !== "pause" && action !== "resume" && action !== "remove") return c.json(err("INVALID_BODY", "action must be pause, resume, or remove"), 400);
+		if (kind !== "context" && kind !== "events") return c.json(err("NOT_FOUND", `observation kind not found: ${kind}`), 404);
+		const ref = kind === "context" ? {
+			kind: "context_binding",
+			id
+		} : {
+			kind: "event_subscription",
+			id
+		};
+		const observation = await this.options.kernel.observations.getObservation(ref);
+		if (!observation || observation.target.sessionId !== sessionId) return c.json(err("NOT_FOUND", `observation not found in session: ${sessionId}`), 404);
+		await this.options.kernel.observations.updateObservation(action, ref);
+		const state = await this.options.kernel.observations.listObservations(sessionId);
+		return c.json(ok(buildSessionObservationsView({
+			sessionId,
+			...state,
+			descriptors: this.options.kernel.observations.discoverObservations()
+		})));
+	};
 	getSessionSkills = async (c) => {
 		const sessionManager = this.options.kernel.sessionManager;
 		const sessionId = decodeURIComponent(c.req.param("sessionId"));
@@ -6020,7 +6230,7 @@ var PanelAppsRoutesController = class {
 	};
 	updatePanelAppPreferences = async (c) => {
 		const body = await readJson(c.req.raw);
-		if (!body.ok || !isRecord$2(body.data)) return c.json(err("INVALID_PANEL_APP_PREFERENCES", "invalid panel app preferences"), 400);
+		if (!body.ok || !isRecord$3(body.data)) return c.json(err("INVALID_PANEL_APP_PREFERENCES", "invalid panel app preferences"), 400);
 		if (body.data.mainSidebar !== void 0 && typeof body.data.mainSidebar !== "boolean") return c.json(err("INVALID_PANEL_APP_PREFERENCES", "mainSidebar must be boolean"), 400);
 		try {
 			const preferences = {
@@ -6100,7 +6310,7 @@ var PanelAppsRoutesController = class {
 	};
 	createBridgeSession = async (c) => {
 		const body = await readJson(c.req.raw);
-		if (!body.ok || !isRecord$2(body.data) || typeof body.data.panelAppId !== "string" && typeof body.data.appId !== "string") return c.json(err("INVALID_PANEL_APP_BRIDGE_SESSION", "invalid bridge session request"), 400);
+		if (!body.ok || !isRecord$3(body.data) || typeof body.data.panelAppId !== "string" && typeof body.data.appId !== "string") return c.json(err("INVALID_PANEL_APP_BRIDGE_SESSION", "invalid bridge session request"), 400);
 		const panelAppId = typeof body.data.appId === "string" ? body.data.appId : body.data.panelAppId;
 		if (typeof panelAppId !== "string") return c.json(err("INVALID_PANEL_APP_BRIDGE_SESSION", "invalid bridge session request"), 400);
 		try {
@@ -6137,7 +6347,7 @@ var PanelAppsRoutesController = class {
 	};
 	sendAgentMessage = async (c) => {
 		const body = await readJson(c.req.raw);
-		if (!body.ok || !isRecord$2(body.data) || !isRecord$2(body.data.payload)) return c.json(err("INVALID_PANEL_APP_AGENT_REQUEST", "invalid agent send request"), 400);
+		if (!body.ok || !isRecord$3(body.data) || !isRecord$3(body.data.payload)) return c.json(err("INVALID_PANEL_APP_AGENT_REQUEST", "invalid agent send request"), 400);
 		try {
 			return c.json(ok(await this.panelAppManager.sendAgentMessage(this.requireBridgeSessionToken(c), body.data.payload)));
 		} catch (error) {
@@ -6146,7 +6356,7 @@ var PanelAppsRoutesController = class {
 	};
 	generateAgentObject = async (c) => {
 		const body = await readJson(c.req.raw);
-		if (!body.ok || !isRecord$2(body.data) || !isRecord$2(body.data.input)) return c.json(err("INVALID_PANEL_APP_AGENT_REQUEST", "invalid generateObject request"), 400);
+		if (!body.ok || !isRecord$3(body.data) || !isRecord$3(body.data.input)) return c.json(err("INVALID_PANEL_APP_AGENT_REQUEST", "invalid generateObject request"), 400);
 		try {
 			return c.json(ok(await this.panelAppManager.generateAgentObject(this.requireBridgeSessionToken(c), body.data.input)));
 		} catch (error) {
@@ -6219,7 +6429,7 @@ var PreferencesRoutesController = class {
 	};
 	update = async (c) => {
 		const body = await readJson(c.req.raw);
-		if (!body.ok || !isRecord$2(body.data) || !Object.hasOwn(body.data, "value")) return c.json(err("INVALID_PREFERENCE", "preference value is required"), 400);
+		if (!body.ok || !isRecord$3(body.data) || !Object.hasOwn(body.data, "value")) return c.json(err("INVALID_PREFERENCE", "preference value is required"), 400);
 		try {
 			const entry = await this.preferenceManager.setPreference(c.req.param("key"), body.data.value);
 			return c.json(ok({
@@ -6262,7 +6472,7 @@ var ProjectsRoutesController = class {
 	};
 	create = async (c) => {
 		const body = await readJson(c.req.raw);
-		if (!body.ok || !isRecord$2(body.data) || typeof body.data.name !== "string") return c.json(err("INVALID_PROJECT", "project name is required"), 400);
+		if (!body.ok || !isRecord$3(body.data) || typeof body.data.name !== "string") return c.json(err("INVALID_PROJECT", "project name is required"), 400);
 		try {
 			return c.json(ok(await this.projectManager.createProject(body.data)), 201);
 		} catch (error) {
@@ -6272,7 +6482,7 @@ var ProjectsRoutesController = class {
 	};
 	addExisting = async (c) => {
 		const body = await readJson(c.req.raw);
-		if (!body.ok || !isRecord$2(body.data) || typeof body.data.rootPath !== "string") return c.json(err("INVALID_PROJECT", "project directory is required"), 400);
+		if (!body.ok || !isRecord$3(body.data) || typeof body.data.rootPath !== "string") return c.json(err("INVALID_PROJECT", "project directory is required"), 400);
 		try {
 			const project = await this.projectManager.registerExistingProject(body.data.rootPath);
 			if (!project) return c.json(err("PROJECT_PATH_IS_DEFAULT_WORKSPACE", "the default workspace cannot be registered as a project"), 400);
@@ -6334,13 +6544,13 @@ var ServiceAppsRoutesController = class {
 	};
 	invokeServiceAction = async (c) => {
 		const body = await readJson(c.req.raw);
-		if (!body.ok || body.data !== void 0 && !isRecord$2(body.data)) return c.json(err("INVALID_SERVICE_ACTION_REQUEST", "invalid service action request"), 400);
+		if (!body.ok || body.data !== void 0 && !isRecord$3(body.data)) return c.json(err("INVALID_SERVICE_ACTION_REQUEST", "invalid service action request"), 400);
 		try {
 			const bridgeSession = this.requireBridgeSession(c);
 			const payload = await this.params.serviceAppManager.invokeServiceAction(c.req.param("actionId"), {
 				caller: bridgeSession.caller,
 				declaredActions: bridgeSession.declaredActions,
-				input: isRecord$2(body.data.input) ? body.data.input : {}
+				input: isRecord$3(body.data.input) ? body.data.input : {}
 			});
 			return c.json(ok(payload));
 		} catch (error) {
@@ -6404,7 +6614,7 @@ var ServiceAppsRoutesController = class {
 	};
 	deleteServiceApp = async (c) => {
 		const body = await readJson(c.req.raw);
-		const purgeData = body.ok && isRecord$2(body.data) && body.data.purgeData === true;
+		const purgeData = body.ok && isRecord$3(body.data) && body.data.purgeData === true;
 		try {
 			return c.json(ok(await this.params.serviceAppManager.deleteServiceApp(c.req.param("appId"), purgeData)));
 		} catch (error) {
@@ -6658,6 +6868,16 @@ var UiRouteRegistry = class {
 				"/api/ncp/sessions/:sessionId/context/compact",
 				ncpSession.compactSessionContext
 			],
+			[
+				"get",
+				"/api/ncp/sessions/:sessionId/observations",
+				ncpSession.listSessionObservations
+			],
+			[
+				"patch",
+				"/api/ncp/sessions/:sessionId/observations/:kind/:id",
+				ncpSession.updateSessionObservation
+			],
 			[
 				"get",
 				"/api/ncp/sessions/:sessionId/usage",
@@ -7058,6 +7278,11 @@ var UiRouteRegistry = class {
 				"/api/runtime/extensions",
 				app.extensionRuntimeStatus
 			],
+			[
+				"get",
+				"/api/runtime/extensions/catalog",
+				app.extensionCatalog
+			],
 			[
 				"get",
 				"/api/auth/status",