@undefineds.co/xpod 0.4.25 → 0.4.28

package/dist/api/ApiServer.d.ts

@@ -110,6 +110,7 @@ export declare class ApiServer {
     getHttpServer(): Server | undefined;
     address(): AddressInfo | string | null;
     private handleRequest;
+    private observeTaskGatewayResponse;
     private findRoute;
     private pathToRegex;
     private handleCors;

package/dist/api/ApiServer.js

@@ -4,6 +4,7 @@ exports.ApiServer = void 0;
 const node_http_1 = require("node:http");
 const global_logger_factory_1 = require("global-logger-factory");
 const NodeRuntimeHost_1 = require("../runtime/host/node/NodeRuntimeHost");
+const task_model_diagnostics_1 = require("../util/task-model-diagnostics");
 /**
  * Standalone API Server
  */
@@ -183,6 +184,7 @@ class ApiServer {
         const method = request.method?.toUpperCase() ?? 'GET';
         const url = new URL(request.url ?? '/', `http://${request.headers.host ?? 'localhost'}`);
         const path = url.pathname;
+        this.observeTaskGatewayResponse(request, response, method, path);
         // Handle CORS preflight
         if (method === 'OPTIONS') {
             this.handleCors(request, response);
@@ -241,6 +243,42 @@ class ApiServer {
             }
         }
     }
+    observeTaskGatewayResponse(request, response, method, path) {
+        if (method !== 'POST')
+            return;
+        const route = path === '/v1/chat/completions' ? 'chat_completions' :
+            path === '/v1/responses' ? 'responses' :
+                path === '/v1/messages' ? 'anthropic_messages' : undefined;
+        if (!route)
+            return;
+        const correlationHash = (0, task_model_diagnostics_1.hashTaskModelDiagnosticSession)(request.headers['x-opencode-session']);
+        if (!correlationHash)
+            return;
+        const startedAt = Date.now();
+        const observe = (statusSource) => {
+            response.off('finish', onFinish);
+            response.off('close', onClose);
+            // An unsent close has no actual caller HTTP status, regardless of statusCode.
+            if (statusSource === 'response_closed' && !response.headersSent)
+                return;
+            try {
+                const receipt = (0, task_model_diagnostics_1.selectTaskModelDiagnosticReceipt)({
+                    event: 'xpod.task-gateway-http-diagnostic', schemaVersion: 1, scope: 'session',
+                    correlationHash, route, callerHTTPstatus: response.statusCode, statusSource,
+                    durationMs: Math.max(0, Math.min(2147483647, Date.now() - startedAt)),
+                });
+                if (receipt)
+                    this.logger.error(JSON.stringify(receipt));
+            }
+            catch {
+                // Diagnostics are observational; a failing sink must not affect HTTP or cleanup.
+            }
+        };
+        const onFinish = () => observe('response_finished');
+        const onClose = () => observe('response_closed');
+        response.once('finish', onFinish);
+        response.once('close', onClose);
+    }
     findRoute(method, path) {
         for (const route of this.routes) {
             if (!route.allMethods && route.method !== method) {

package/dist/api/ai-config/AiConfigStore.js

@@ -17,7 +17,7 @@ class DrizzlePodAiConfigStore {
             db.findById(models_1.aiConfigResource, id),
             db.findById(XpodAiConfigSchema_1.xpodAiConfigResource, id),
         ]);
-        return policyFromRows(sharedRow, productRow);
+        return policyFromRows(sharedRow, productRow, input.podUrl);
     }
     async update(input) {
         const { db } = await this.open(input);
@@ -26,7 +26,7 @@ class DrizzlePodAiConfigStore {
             db.findById(models_1.aiConfigResource, id),
             db.findById(XpodAiConfigSchema_1.xpodAiConfigResource, id),
         ]);
-        const mergedPolicy = mergePolicy(policyFromRows(sharedCurrent, productCurrent), input.patch, this.now());
+        const mergedPolicy = mergePolicy(policyFromRows(sharedCurrent, productCurrent, input.podUrl), input.patch, this.now(), input.podUrl);
         await Promise.all([
             writeRow(db, models_1.aiConfigResource, id, sharedCurrent, sharedRowFromPolicy(mergedPolicy)),
             writeRow(db, XpodAiConfigSchema_1.xpodAiConfigResource, id, productCurrent, productRowFromPolicy(mergedPolicy)),
@@ -49,7 +49,7 @@ exports.DrizzlePodAiConfigStore = DrizzlePodAiConfigStore;
 function aiConfigResourceId() {
     return models_1.aiConfigResource.buildId({ id: 'config' });
 }
-function policyFromRows(sharedRow, productRow) {
+function policyFromRows(sharedRow, productRow, podUrl) {
     const defaults = defaultPolicy();
     if (!sharedRow && !productRow)
         return defaults;
@@ -58,7 +58,7 @@ function policyFromRows(sharedRow, productRow) {
     const models = {};
     for (const key of modelKeys) {
         if (typeof shared[key] === 'string' && shared[key])
-            models[key] = shared[key];
+            models[key] = canonicalModelReference(shared[key], podUrl);
     }
     return {
         schemaVersion: '1.0',
@@ -92,14 +92,14 @@ function policyFromRows(sharedRow, productRow) {
         updatedAt: isoDate(shared.updatedAt),
     };
 }
-function mergePolicy(current, patch, now) {
+function mergePolicy(current, patch, now, podUrl) {
     const models = { ...current.models };
     for (const key of modelKeys) {
         const value = patch.models?.[key];
         if (value === null)
             delete models[key];
         else if (value !== undefined)
-            models[key] = value;
+            models[key] = canonicalModelReference(value, podUrl);
     }
     return {
         schemaVersion: '1.0',
@@ -110,6 +110,18 @@ function mergePolicy(current, patch, now) {
         updatedAt: now.toISOString(),
     };
 }
+/** API refs may be Pod-root-relative; linked ORM columns require target-relative ids or absolute IRIs. */
+function canonicalModelReference(ref, podUrl) {
+    if (/^[a-z][a-z\d+.-]*:/i.test(ref)) {
+        // Validate without serializing: external IRI lexical identity must survive.
+        new URL(ref);
+        return ref;
+    }
+    const parsed = models_1.aiModelResource.parseRef(ref);
+    if (!parsed)
+        throw new Error('Invalid AI model resource reference');
+    return models_1.aiModelResource.buildIri(podUrl, { id: parsed.resourceId });
+}
 function sharedRowFromPolicy(policy) {
     return {
         ...Object.fromEntries(modelKeys.map((key) => [key, policy.models[key] ?? null])),

package/dist/api/ai-gateway/connect/index.d.ts

@@ -687,6 +687,7 @@ export declare class ProviderConnectService {
         credentialId: string;
         expectedVersion: number;
         patch: {
+            apiKey?: string;
             label?: string;
             enabled?: boolean;
             priority?: number;

package/dist/api/ai-gateway/connect/index.js

@@ -1874,28 +1874,49 @@ class ProviderConnectService {
             throw new Error('credential_pool_not_configured');
         }
         const existing = await this.credentialRepository.getCredentialById(input);
-        const metadata = metadataFromRowValue(existing?.metadata) ?? {};
+        if (!existing)
+            return undefined;
+        if (input.expectedVersion !== (existing.version ?? 0))
+            throw new Error('credential_version_conflict');
+        const replacingKey = Object.prototype.hasOwnProperty.call(input.patch, 'apiKey');
+        let replacement = {};
+        if (replacingKey) {
+            if (typeof input.patch.apiKey !== 'string' || !input.patch.apiKey.trim())
+                throw new Error('invalid_api_key');
+            if (existing.authMode !== 'apiKey')
+                throw new Error('credential_auth_mode_mismatch');
+            if (!this.vault)
+                throw new Error('credential_pool_not_configured');
+            replacement = {
+                encryptedSecret: await this.vault.seal({ webId: input.webId }, existing.credentialIri, existing.provider, { type: 'apiKey', apiKey: input.patch.apiKey.trim() }),
+                reauthRequired: false, failCount: 0, lastFailureCode: undefined,
+                lastFailureAt: undefined, rateLimitResetAt: undefined,
+                health: (input.patch.enabled ?? existing.enabled) === false ? 'disabled' : 'unknown',
+            };
+        }
+        const metadata = metadataFromRowValue(existing.metadata) ?? {};
         const updated = await this.credentialRepository.updateCredential({
             ...input,
-            patch: metadataWithoutUndefined({
-                accountLabel: input.patch.label,
-                enabled: input.patch.enabled,
-                priority: input.patch.priority,
-                proxyUrl: input.patch.proxyUrl === undefined
-                    ? undefined
-                    : (0, provider_http_transport_1.normalizeProviderProxyUrl)(input.patch.proxyUrl),
-                health: input.patch.enabled === false ? 'disabled' : undefined,
-                metadata: metadataWithoutUndefined({
-                    ...metadata,
-                    baseUrl: input.patch.baseUrl ?? metadata.baseUrl,
+            patch: { ...metadataWithoutUndefined({
+                    accountLabel: input.patch.label,
+                    enabled: input.patch.enabled,
+                    priority: input.patch.priority,
                     proxyUrl: input.patch.proxyUrl === undefined
-                        ? metadata.proxyUrl
+                        ? undefined
                         : (0, provider_http_transport_1.normalizeProviderProxyUrl)(input.patch.proxyUrl),
-                    priority: input.patch.priority ?? metadata.priority,
-                    enabled: input.patch.enabled ?? metadata.enabled,
-                    health: input.patch.enabled === false ? 'disabled' : metadata.health,
-                }),
-            }),
+                    health: input.patch.enabled === false ? 'disabled' : undefined,
+                    metadata: metadataWithoutUndefined({
+                        ...metadata,
+                        baseUrl: input.patch.baseUrl ?? metadata.baseUrl,
+                        proxyUrl: input.patch.proxyUrl === undefined
+                            ? metadata.proxyUrl
+                            : (0, provider_http_transport_1.normalizeProviderProxyUrl)(input.patch.proxyUrl),
+                        priority: input.patch.priority ?? metadata.priority,
+                        enabled: input.patch.enabled ?? metadata.enabled,
+                        health: replacingKey ? replacement.health : input.patch.enabled === false ? 'disabled' : metadata.health,
+                        ...(replacingKey ? { maskedHint: maskApiKey(input.patch.apiKey.trim()) } : {}),
+                    }),
+                }), ...replacement },
         });
         return updated ? publicPoolCredentialSummary(updated) : undefined;
     }

package/dist/api/ai-gateway/models/ProviderModelsAdapter.js

@@ -29,12 +29,15 @@ class ProviderModelsResponseError extends Error {
     }
 }
 exports.ProviderModelsResponseError = ProviderModelsResponseError;
+// Codex protocol compatibility baseline, independent of Xpod and ACP wrapper versions.
+// Verified release: https://github.com/openai/codex/releases/tag/rust-v0.160.0
+const CODEX_MODELS_CLIENT_VERSION = '0.160.0';
 /** Discovers the models currently enabled for a ChatGPT Codex subscription. */
 class CodexSubscriptionModelsAdapter {
     constructor(options = {}) {
         this.protocol = 'codex-models';
         this.transport = options.transport ?? new provider_http_transport_1.ProviderHttpTransport();
-        this.clientVersion = options.clientVersion ?? '0.0.0';
+        this.clientVersion = options.clientVersion ?? CODEX_MODELS_CLIENT_VERSION;
     }
     async fetch(input) {
         const accessToken = stringSecret(input.secret, 'accessToken', 'access_token');
@@ -57,7 +60,7 @@ class CodexSubscriptionModelsAdapter {
             const models = Array.isArray(body?.models) ? body.models : [];
             return models
                 .filter((model) => Boolean(model) && typeof model === 'object')
-                .filter((model) => model.visibility !== 'hide')
+                .filter((model) => model.visibility === 'list')
                 .map((model) => ({
                 id: String(model.slug ?? model.id ?? '').trim(),
                 ...(typeof model.display_name === 'string' && model.display_name.trim()

package/dist/api/container/common.js

@@ -88,13 +88,19 @@ function resolveHostedPodCssBaseUrl(config) {
     // instead of a foreign loopback port.
     return config.solidBaseUrl;
 }
-function resolveAiConnectionsBaseUrl(config) {
-    const origin = config.publicUrl
+function resolveAiConnectionsCanonicalOrigin(config) {
+    return config.publicUrl
         ?? process.env.XPOD_PUBLIC_URL
         ?? process.env.CSS_BASE_URL
         ?? `http://${config.host === '0.0.0.0' ? '127.0.0.1' : config.host}:${config.port}`;
+}
+function aiConnectionsV1Url(origin) {
     return new URL('/v1', origin.endsWith('/') ? origin : `${origin}/`).toString().replace(/\/$/u, '');
 }
+/** The canonical identity realm: token audience/issuer and the two authenticators use this. */
+function resolveAiConnectionsBaseUrl(config) {
+    return aiConnectionsV1Url(resolveAiConnectionsCanonicalOrigin(config));
+}
 function credentialVaultForConfig(config) {
     return new PlaintextCredentialVault_1.PlaintextCredentialVault({
         legacyVault: config.secretCellCredentialVaultFactory?.(),

package/dist/api/container/index.js

@@ -220,8 +220,8 @@ function loadConfigFromEnv() {
             baseStorageDomain: process.env.CSS_BASE_STORAGE_DOMAIN,
             cloudflareAccountId: process.env.CLOUDFLARE_ACCOUNT_ID,
             cloudflareApiToken: process.env.CLOUDFLARE_API_TOKEN,
-            tencentDnsSecretId: process.env.TENCENT_DNS_SECRET_ID,
-            tencentDnsSecretKey: process.env.TENCENT_DNS_SECRET_KEY,
+            tencentDnsSecretId: process.env.TENCENT_DNSPOD_ID,
+            tencentDnsSecretKey: process.env.TENCENT_DNSPOD_TOKEN,
         },
         // Local 托管式：连接 Cloud
         cloudApiEndpoint,

package/dist/api/container/local.js

@@ -137,9 +137,12 @@ function registerLocalServices(container) {
     // The settings page lets an operator pick the DNS provider, so the runtime honours that
     // choice instead of always wiring Cloudflare and ignoring a saved "tencent".
     const dnsProviderId = process.env.XPOD_DNS_PROVIDER?.trim().toLowerCase() || 'cloudflare';
-    const tencentDnsToken = process.env.XPOD_TENCENT_DNS_TOKEN?.trim();
-    const tencentDnsTokenId = process.env.XPOD_TENCENT_DNS_TOKEN_ID?.trim();
-    const dnsCredentialReady = dnsProviderId === 'tencent' ? Boolean(tencentDnsToken) : Boolean(apiToken);
+    const tencentDnsToken = process.env.TENCENT_DNSPOD_TOKEN?.trim();
+    const tencentDnsTokenId = process.env.TENCENT_DNSPOD_ID?.trim();
+    // DNSPod 需要 ID 与 Token 同时具备；只看 token 会注册一个实际禁用的 provider（静默失效）。
+    const dnsCredentialReady = dnsProviderId === 'tencent'
+        ? Boolean(tencentDnsToken && tencentDnsTokenId)
+        : Boolean(apiToken);
     if (dnsCredentialReady && baseDomain) {
         console.log(`[Local] Self-hosted DNS mode detected (provider: ${dnsProviderId})`);
         container.register({

package/dist/api/handlers/AiGatewayHandler.d.ts

@@ -18,6 +18,7 @@ export declare class AiGatewayHandler {
     handleModels(request: AuthenticatedRequest, response: ServerResponse): Promise<void>;
     handleAcceptanceProvenance(request: AuthenticatedRequest, response: ServerResponse): Promise<void>;
     private sendEventStream;
+    private logTaskGatewayFailure;
     private logInference;
     private writeTerminalStreamError;
     private sendGatewayError;

package/dist/api/handlers/AiGatewayHandler.js

@@ -6,7 +6,9 @@ const global_logger_factory_1 = require("global-logger-factory");
 const readBoundedJsonBody_1 = require("../http/readBoundedJsonBody");
 const errors_1 = require("../ai-gateway/errors");
 const InvocationMetadata_1 = require("../ai-gateway/InvocationMetadata");
+const task_model_diagnostics_1 = require("../../util/task-model-diagnostics");
 const DEFAULT_JSON_BODY_LIMIT_BYTES = 2 * 1024 * 1024;
+const TASK_GATEWAY_CODES = new Set(task_model_diagnostics_1.TASK_GATEWAY_DIAGNOSTIC_CODES);
 function registerAiGatewayRoutes(server, options) {
     const handler = new AiGatewayHandler(options);
     server.post('/v1/responses', (request, response) => handler.handleInference(request, response, 'responses'));
@@ -25,12 +27,20 @@ class AiGatewayHandler {
     }
     async handleInference(request, response, protocol) {
         const startedAt = Date.now();
+        // Observation only: preserve the existing body/header validation ordering.
+        let correlationHash;
+        try {
+            correlationHash = (0, task_model_diagnostics_1.hashTaskModelDiagnosticSession)((0, InvocationMetadata_1.readGatewayInvocationMetadata)(request.headers, request.rawHeaders).sessionId);
+        }
+        catch { /* Invalid invocation metadata is rejected by the existing path. */ }
         const bodyResult = await (0, readBoundedJsonBody_1.readBoundedJsonBody)(request, { limitBytes: this.jsonBodyLimitBytes });
         if (!bodyResult.ok) {
-            this.sendGatewayError(response, new errors_1.GatewayProtocolError(bodyResult.error, {
+            const error = new errors_1.GatewayProtocolError(bodyResult.error, {
                 code: 'invalid_request',
                 status: bodyResult.status,
-            }));
+            });
+            this.sendGatewayError(response, error);
+            this.logTaskGatewayFailure(correlationHash, response, protocol, startedAt, false, taskGatewayFailure(error));
             return;
         }
         const model = readRequestedModel(bodyResult.value);
@@ -69,16 +79,25 @@ class AiGatewayHandler {
             });
             const outcome = await this.sendEventStream(response, execution.frontend, execution.events);
             this.logInference({ protocol, model, stream: true, startedAt, ...outcome });
+            if (outcome.failure) {
+                this.logTaskGatewayFailure(correlationHash, response, protocol, startedAt, true, outcome.failure);
+            }
         }
         catch (error) {
             if (controller.signal.aborted || response.destroyed) {
                 return;
             }
             if (response.headersSent) {
-                await this.writeTerminalStreamError(response, error);
+                try {
+                    await this.writeTerminalStreamError(response, error);
+                }
+                finally {
+                    this.logTaskGatewayFailure(correlationHash, response, protocol, startedAt, isStreamRequest(bodyResult.value), taskGatewayFailure(error));
+                }
                 return;
             }
             this.sendGatewayError(response, error);
+            this.logTaskGatewayFailure(correlationHash, response, protocol, startedAt, false, taskGatewayFailure(error));
         }
         finally {
             response.off('close', abort);
@@ -175,6 +194,7 @@ class AiGatewayHandler {
         }
         catch (error) {
             outcome.outcome = disconnected ? 'disconnected' : 'failed';
+            outcome.failure = taskGatewayFailure(error);
             await returnIterator();
             if (!disconnected) {
                 await this.writeTerminalStreamError(response, error);
@@ -188,9 +208,26 @@ class AiGatewayHandler {
         }
         if (disconnected) {
             outcome.outcome = 'disconnected';
+            outcome.failure ??= taskGatewayFailure(undefined);
         }
         return outcome;
     }
+    logTaskGatewayFailure(correlationHash, response, protocol, startedAt, streamOpen, failure) {
+        if (!correlationHash || !diagnosticHTTPStatus(response.statusCode))
+            return;
+        const route = protocol === 'chatCompletions' ? 'chat_completions'
+            : protocol === 'responses' ? 'responses' : 'anthropic_messages';
+        try {
+            const receipt = (0, task_model_diagnostics_1.selectTaskModelDiagnosticReceipt)({
+                event: 'xpod.task-gateway-diagnostic', schemaVersion: 1, scope: 'session', correlationHash, route,
+                callerHTTPstatus: response.statusCode, ...failure, streamOpen,
+                durationMs: Math.min(2_147_483_647, Math.max(0, Math.floor(Date.now() - startedAt))),
+            });
+            if (receipt)
+                this.logger.error(JSON.stringify(receipt));
+        }
+        catch { /* An observational receipt must not alter the response or cleanup. */ }
+    }
     logInference(summary) {
         const fields = [
             `protocol=${summary.protocol}`,
@@ -232,6 +269,19 @@ class AiGatewayHandler {
     }
 }
 exports.AiGatewayHandler = AiGatewayHandler;
+function diagnosticHTTPStatus(value) {
+    return typeof value === 'number' && Number.isInteger(value) && value >= 100 && value <= 599 ? value : undefined;
+}
+function taskGatewayFailure(error) {
+    const code = (0, errors_1.normalizeGatewayError)(error).error.code;
+    const source = error && typeof error === 'object' ? error : undefined;
+    const cause = source?.cause && typeof source.cause === 'object' ? source.cause : undefined;
+    const underlyingErrorStatus = diagnosticHTTPStatus(cause?.status) ?? diagnosticHTTPStatus(source?.status);
+    return {
+        code: TASK_GATEWAY_CODES.has(code) ? code : 'internal_error',
+        ...(underlyingErrorStatus !== undefined ? { underlyingErrorStatus } : {}),
+    };
+}
 async function writeSerializedEvents(response, serialized) {
     for (const event of Array.isArray(serialized) ? serialized : [serialized]) {
         await writeWithBackpressure(response, `data: ${JSON.stringify(event)}\n\n`);

package/dist/api/handlers/AiGatewayManagementHandler.js

@@ -1200,6 +1200,11 @@ function publicGatewayAccessKeyRecord(record, plaintextAvailable, plaintext) {
 }
 function normalizeCredentialPatch(body) {
     const patch = {};
+    if (Object.prototype.hasOwnProperty.call(body, 'apiKey')) {
+        if (typeof body.apiKey !== 'string' || !body.apiKey.trim())
+            return undefined;
+        patch.apiKey = body.apiKey.trim();
+    }
     if (body.label !== undefined) {
         const label = normalizeOptionalString(body.label);
         if (!label) {
@@ -1330,6 +1335,10 @@ function sendCredentialPoolError(response, error) {
         sendJson(response, message === 'local_session_refresh_failed' ? 502 : 409, { error: message });
         return;
     }
+    if (message === 'invalid_api_key' || message === 'credential_auth_mode_mismatch') {
+        sendJson(response, 400, { error: message });
+        return;
+    }
     if (message === 'credential_version_conflict') {
         sendJson(response, 409, { error: 'credential_version_conflict' });
         return;

package/dist/api/handlers/TaskHandler.js

@@ -2,11 +2,12 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.registerTaskRoutes = registerTaskRoutes;
 exports.projectTask = projectTask;
+const TaskResumeDiagnostics_1 = require("../tasks/TaskResumeDiagnostics");
 const RunCancellation_1 = require("../runs/RunCancellation");
 const PodAccessFailureResponse_1 = require("./PodAccessFailureResponse");
 /** UI reads durable Pod projections; the scheduler is never a query backend. */
 function registerTaskRoutes(server, options) {
-    const guarded = (handler) => async (request, response) => {
+    const guarded = (handler, resume = false) => async (request, response) => {
         if (request.auth?.type !== 'solid') {
             send(response, 401, { error: 'Authentication required' });
             return;
@@ -17,7 +18,7 @@ function registerTaskRoutes(server, options) {
         catch (error) {
             if ((0, PodAccessFailureResponse_1.sendPodAccessFailure)(response, error))
                 return;
-            send(response, 400, { error: error instanceof Error ? error.message : 'Task request failed' });
+            send(response, 400, { error: error instanceof Error ? error.message : 'Task request failed', ...(resume ? { taskResumeStage: (0, TaskResumeDiagnostics_1.getTaskResumeStage)(error) ?? 'route_request', taskResumeErrorType: (0, TaskResumeDiagnostics_1.getTaskResumeErrorType)(error), taskResumeFailure: (0, TaskResumeDiagnostics_1.getTaskResumeFailure)(error) } : {}) });
         }
     };
     const idOf = (request) => {
@@ -96,16 +97,20 @@ function registerTaskRoutes(server, options) {
         return { runs: (await options.runStore.listRuns({ task: task.id }, context)).map(projectRun) };
     }));
     server.post('/api/tasks/resume', guarded(async (request, context, owner) => {
-        const input = await body(request);
-        const approval = requiredString(input.approval, 'Approval');
-        const target = idOf(request);
-        const run = (await options.runStore.listRuns({}, context)).find(item => item.id === target)
-            ?? (target.startsWith('https://') || target.startsWith('http://') ? undefined : await options.runStore.loadRun(target, context));
-        if (!run)
-            throw new Error('Run not found');
+        const { approval, target } = await (0, TaskResumeDiagnostics_1.withTaskResumeStage)('route_validation', async () => {
+            const input = await body(request);
+            return { approval: requiredString(input.approval, 'Approval'), target: idOf(request) };
+        });
+        const run = await (0, TaskResumeDiagnostics_1.withTaskResumeStage)('route_run_read', async () => {
+            const run = (await options.runStore.listRuns({}, context)).find(item => item.id === target)
+                ?? (target.startsWith('https://') || target.startsWith('http://') ? undefined : await options.runStore.loadRun(target, context));
+            if (!run)
+                throw new Error('Run not found');
+            return run;
+        });
         const result = await options.taskService.resumeApprovedRun({ runId: run.id, approval, owner }, context, options.resolveExecutionContext);
         return { ...result, run: projectRun(result.run) };
-    }));
+    }, true));
     server.get('/api/tasks/selection', guarded(async (request, context, owner) => {
         const target = idOf(request);
         const runs = await options.runStore.listRuns({}, context);

package/dist/api/network/NetworkEnvironmentConfigurationStore.js

@@ -159,7 +159,7 @@ function firstString(...values) {
 function splitList(value) { return value?.split(',').map((item) => item.trim()).filter(Boolean) ?? []; }
 function positiveInteger(value, fallback) { const parsed = Number(value); return Number.isInteger(parsed) && parsed > 0 ? parsed : fallback; }
 function dnsCredential(env, provider) { return env[dnsCredentialKey(provider)]; }
-function dnsCredentialKey(provider) { return provider === 'tencent' ? 'XPOD_TENCENT_DNS_TOKEN' : provider === 'cloudflare' ? 'CLOUDFLARE_API_TOKEN' : 'XPOD_DNS_PROVIDER_TOKEN'; }
+function dnsCredentialKey(provider) { return provider === 'tencent' ? 'TENCENT_DNSPOD_TOKEN' : provider === 'cloudflare' ? 'CLOUDFLARE_API_TOKEN' : 'XPOD_DNS_PROVIDER_TOKEN'; }
 function p2pFallback(value) { return value === 'never' || value === 'prefer-p2p' ? value : 'when-direct-unavailable'; }
 function plainStringRecord(value) { return Boolean(value) && typeof value === 'object' && !Array.isArray(value) && Object.values(value).every((item) => typeof item === 'string'); }
 function boolString(value) { return value === undefined ? undefined : String(value); }

package/dist/api/runs/ManagedRunWorker.d.ts

@@ -37,7 +37,6 @@ export declare class ManagedRunWorker<TContext = StoreContext> {
     private loadRunInput;
     private resolveUserMessage;
     private resolveRuntimeConfig;
-    private authBindingIdFromRun;
     private asRuntimeConfig;
     private parseRunner;
     private isRunnerType;

package/dist/api/runs/ManagedRunWorker.js

@@ -76,7 +76,7 @@ class ManagedRunWorker {
                 conversation,
                 retrievedContext,
                 config: runtimeConfig,
-                authBindingId: this.authBindingIdFromRun(run),
+                authBindingId: (0, store_1.resolveRunAuthBindingId)(run),
                 context: context,
             })) {
                 const cancelled = await finishCancellation();
@@ -209,7 +209,7 @@ class ManagedRunWorker {
             conversation,
             retrievedContext,
             config: loaded.runtimeConfig,
-            authBindingId: this.authBindingIdFromRun(loaded.run),
+            authBindingId: (0, store_1.resolveRunAuthBindingId)(loaded.run),
             context: context,
         };
     }
@@ -266,18 +266,6 @@ class ManagedRunWorker {
             runner: this.parseRunner(run.runner),
         };
     }
-    authBindingIdFromRun(run) {
-        const authBindingId = run.metadata?.authBindingId;
-        if (typeof authBindingId === 'string' && authBindingId.length > 0) {
-            return authBindingId;
-        }
-        const authBinding = run.metadata?.authBinding;
-        if (authBinding && typeof authBinding === 'object') {
-            const id = authBinding.id;
-            return typeof id === 'string' && id.length > 0 ? id : undefined;
-        }
-        return undefined;
-    }
     asRuntimeConfig(value) {
         if (!value || typeof value !== 'object') {
             return undefined;

package/dist/api/runs/PiAgentRuntimeDriver.d.ts

@@ -97,14 +97,6 @@ export declare class PiAgentRuntimeDriver implements RunExecutionBackend {
     private workerEnv;
     private extractText;
     private formatError;
-    /**
-     * Record a failed assistant turn with allowlisted wire facts only.
-     *
-     * The provider `errorMessage` can contain credentials, prompts, or response bodies, so it never
-     * leaves this method. What is kept is enough to place the failure: the protocol/provider/model
-     * and a stable coarse classification derived from the shape of the message (never its text).
-     */
-    private logAssistantFailure;
     private startupErrorToEvent;
     private logWorkspaceRollbackError;
     private loadPiSdk;