@xopcai/xopc 0.0.175 → 0.0.176

package/dist/src/auth/model-credential-store.js

@@ -0,0 +1,110 @@
+import { __esmMin } from "../../_virtual/_rolldown/runtime.js";
+import { CredentialResolver, init_credentials } from "./credentials.js";
+//#region src/auth/model-credential-store.ts
+function normalizeProviderId(providerId) {
+	return providerId.toLowerCase();
+}
+function toRuntimeCredential(token) {
+	const { type: _type, provider: _provider, expiresAt, createdAt: _createdAt, updatedAt: _updatedAt, ...credential } = token;
+	return {
+		...credential,
+		type: "oauth",
+		access: token.access,
+		refresh: token.refresh ?? "",
+		expires: expiresAt ?? Number.MAX_SAFE_INTEGER
+	};
+}
+function toPersistedToken(credential, current) {
+	const { type: _type, expires, ...token } = credential;
+	let previous = {};
+	if (current) {
+		const { type: _previousType, expires: _previousExpires, ...previousFields } = toRuntimeCredential(current);
+		previous = previousFields;
+	}
+	return {
+		...previous,
+		...token,
+		access: credential.access,
+		refresh: credential.refresh || void 0,
+		expiresAt: expires,
+		createdAt: current?.createdAt ?? (/* @__PURE__ */ new Date()).toISOString()
+	};
+}
+async function serializeProviderModification(providerId, operation) {
+	const previous = providerModificationTails.get(providerId) ?? Promise.resolve();
+	let release;
+	const gate = new Promise((resolve) => {
+		release = resolve;
+	});
+	const tail = previous.catch(() => void 0).then(() => gate);
+	providerModificationTails.set(providerId, tail);
+	await previous.catch(() => void 0);
+	try {
+		return await operation();
+	} finally {
+		release();
+		if (providerModificationTails.get(providerId) === tail) providerModificationTails.delete(providerId);
+	}
+}
+var providerModificationTails, XopcModelCredentialStore;
+var init_model_credential_store = __esmMin((() => {
+	init_credentials();
+	providerModificationTails = /* @__PURE__ */ new Map();
+	XopcModelCredentialStore = class {
+		runtimeApiKeys = /* @__PURE__ */ new Map();
+		constructor(repository = new CredentialResolver()) {
+			this.repository = repository;
+		}
+		async read(providerId, options) {
+			options?.signal?.throwIfAborted();
+			const normalizedProvider = normalizeProviderId(providerId);
+			const runtimeApiKey = this.runtimeApiKeys.get(normalizedProvider);
+			if (runtimeApiKey) return runtimeApiKey;
+			const token = await this.repository.loadOAuthTokenRecord(normalizedProvider);
+			options?.signal?.throwIfAborted();
+			return token ? toRuntimeCredential(token) : void 0;
+		}
+		async list(options) {
+			options?.signal?.throwIfAborted();
+			const oauthTokens = await this.repository.listOAuthTokens();
+			options?.signal?.throwIfAborted();
+			const credentials = /* @__PURE__ */ new Map();
+			for (const token of oauthTokens) credentials.set(normalizeProviderId(token.provider), {
+				providerId: normalizeProviderId(token.provider),
+				type: "oauth"
+			});
+			for (const providerId of this.runtimeApiKeys.keys()) credentials.set(providerId, {
+				providerId,
+				type: "api_key"
+			});
+			return [...credentials.values()];
+		}
+		async modify(providerId, update, options) {
+			const normalizedProvider = normalizeProviderId(providerId);
+			return serializeProviderModification(normalizedProvider, async () => {
+				options?.signal?.throwIfAborted();
+				const persisted = await this.repository.loadOAuthTokenRecord(normalizedProvider);
+				const current = this.runtimeApiKeys.get(normalizedProvider) ?? (persisted ? toRuntimeCredential(persisted) : void 0);
+				const updated = await update(current);
+				options?.signal?.throwIfAborted();
+				if (!updated) return current;
+				if (updated.type === "oauth") {
+					await this.repository.saveOAuthToken(normalizedProvider, toPersistedToken(updated, persisted));
+					this.runtimeApiKeys.delete(normalizedProvider);
+				} else this.runtimeApiKeys.set(normalizedProvider, updated);
+				return updated;
+			});
+		}
+		async delete(providerId, options) {
+			const normalizedProvider = normalizeProviderId(providerId);
+			await serializeProviderModification(normalizedProvider, async () => {
+				options?.signal?.throwIfAborted();
+				await this.repository.deleteOAuthToken(normalizedProvider);
+				this.runtimeApiKeys.delete(normalizedProvider);
+			});
+		}
+	};
+}));
+//#endregion
+init_model_credential_store();
+export { XopcModelCredentialStore, init_model_credential_store };

package/dist/src/auth/oauth/github-copilot.js

@@ -18,7 +18,7 @@ function fromPiCredential({ type: _type, ...credentials }) {
 }
 function toAuthInteraction(callbacks) {
 	return {
-		signal: callbacks.signal,
+		signal: callbacks.signal ?? new AbortController().signal,
 		async prompt(prompt) {
 			if (prompt.type === "select") return await callbacks.onSelect({
 				message: prompt.message,
@@ -57,7 +57,7 @@ var init_github_copilot = __esmMin((() => {
 			return fromPiCredential(await getCopilotOAuth().login(toAuthInteraction(callbacks)));
 		},
 		async refreshToken(credentials) {
-			return fromPiCredential(await getCopilotOAuth().refresh(toPiCredential(credentials)));
+			return fromPiCredential(await getCopilotOAuth().refresh(toPiCredential(credentials), new AbortController().signal));
 		},
 		getApiKey(credentials) {
 			return credentials.access;

package/dist/src/auth/oauth/openai-codex.js

@@ -2,12 +2,17 @@ import { __esmMin } from "../../../_virtual/_rolldown/runtime.js";
 import { generatePKCE, init_pkce } from "./pkce.js";
 import { randomBytes } from "node:crypto";
 import http from "node:http";
+import { setTimeout as setTimeout$1 } from "node:timers/promises";
 //#region src/auth/oauth/openai-codex.ts
 /**
 * OpenAI Codex (ChatGPT) OAuth.
 *
 * Owns callback validation, manual prompt handling, and success/error pages.
 */
+function requestSignal(signal) {
+	const timeout = AbortSignal.timeout(TOKEN_REQUEST_TIMEOUT_MS);
+	return signal ? AbortSignal.any([signal, timeout]) : timeout;
+}
 function xopcOAuthHtml(params) {
 	const color = params.tone === "success" ? "#2563eb" : "#dc2626";
 	const escapedTitle = escapeHtml(params.title);
@@ -199,7 +204,7 @@ async function postTokenForm(body, signal) {
 			Accept: "application/json"
 		},
 		body,
-		signal: signal ?? AbortSignal.timeout(TOKEN_REQUEST_TIMEOUT_MS)
+		signal: requestSignal(signal)
 	});
 	const contentType = response.headers.get("content-type") ?? "";
 	const text = await response.text();
@@ -207,15 +212,82 @@ async function postTokenForm(body, signal) {
 	if (!contentType.toLowerCase().includes("application/json")) throw new Error(`OpenAI Codex token response was not JSON: ${contentType || "missing content-type"}`);
 	return JSON.parse(text);
 }
-async function exchangeAuthorizationCode(code, verifier, signal) {
+async function exchangeAuthorizationCode(code, verifier, signal, redirectUri = REDIRECT_URI) {
 	return normalizeTokenResponse(await postTokenForm(new URLSearchParams({
 		grant_type: "authorization_code",
 		client_id: CLIENT_ID,
 		code,
 		code_verifier: verifier,
-		redirect_uri: REDIRECT_URI
+		redirect_uri: redirectUri
 	}), signal));
 }
+async function requestDeviceCode(signal) {
+	const response = await fetch(DEVICE_USER_CODE_URL, {
+		method: "POST",
+		headers: {
+			"Content-Type": "application/json",
+			Accept: "application/json"
+		},
+		body: JSON.stringify({ client_id: CLIENT_ID }),
+		signal: requestSignal(signal)
+	});
+	const body = await response.json().catch(() => ({}));
+	if (!response.ok) {
+		if (response.status === 404) throw new Error("OpenAI Codex device code login is not enabled. Enable it in ChatGPT security or workspace settings, or use browser login.");
+		throw new Error(body.error_description ?? body.error ?? `OpenAI Codex device code request failed (${response.status})`);
+	}
+	if (!body.device_auth_id || !body.user_code) throw new Error("OpenAI Codex device code response is incomplete");
+	const intervalSeconds = Number(body.interval);
+	return {
+		deviceAuthId: body.device_auth_id,
+		userCode: body.user_code,
+		intervalMs: Math.max(1, Number.isFinite(intervalSeconds) ? intervalSeconds : 5) * 1e3
+	};
+}
+async function pollDeviceAuthorization(params) {
+	const expiresAt = Date.now() + DEVICE_AUTH_TIMEOUT_MS;
+	while (Date.now() < expiresAt) {
+		if (params.signal?.aborted) throw params.signal.reason instanceof Error ? params.signal.reason : /* @__PURE__ */ new Error("OpenAI Codex login cancelled");
+		const response = await fetch(DEVICE_TOKEN_URL, {
+			method: "POST",
+			headers: {
+				"Content-Type": "application/json",
+				Accept: "application/json"
+			},
+			body: JSON.stringify({
+				device_auth_id: params.deviceAuthId,
+				user_code: params.userCode
+			}),
+			signal: requestSignal(params.signal)
+		});
+		const body = await response.json().catch(() => ({}));
+		if (response.ok) {
+			if (!body.authorization_code || !body.code_verifier) throw new Error("OpenAI Codex device authorization response is incomplete");
+			return {
+				code: body.authorization_code,
+				verifier: body.code_verifier
+			};
+		}
+		if (response.status !== 403 && response.status !== 404) throw new Error(body.error_description ?? body.error ?? `OpenAI Codex device authorization failed (${response.status})`);
+		const remainingMs = expiresAt - Date.now();
+		await setTimeout$1(Math.min(params.intervalMs, remainingMs), void 0, params.signal ? { signal: params.signal } : void 0);
+	}
+	throw new Error("OpenAI Codex device authorization timed out");
+}
+async function loginOpenAICodexWithDeviceCode(callbacks) {
+	const device = await requestDeviceCode(callbacks.signal);
+	callbacks.onDeviceCode({
+		userCode: device.userCode,
+		verificationUri: DEVICE_VERIFICATION_URL,
+		intervalSeconds: device.intervalMs / 1e3,
+		expiresInSeconds: DEVICE_AUTH_TIMEOUT_MS / 1e3
+	});
+	const authorization = await pollDeviceAuthorization({
+		...device,
+		signal: callbacks.signal
+	});
+	return exchangeAuthorizationCode(authorization.code, authorization.verifier, callbacks.signal, DEVICE_REDIRECT_URI);
+}
 async function refreshAccessToken(refreshToken) {
 	return normalizeTokenResponse(await postTokenForm(new URLSearchParams({
 		grant_type: "refresh_token",
@@ -258,7 +330,7 @@ function getAccountId(accessToken) {
 		return null;
 	}
 }
-async function loginOpenAICodex(callbacks) {
+async function loginOpenAICodexWithBrowser(callbacks) {
 	const { verifier, state, url } = await createAuthorizationFlow();
 	const server = await startLocalOAuthServer(state);
 	try {
@@ -288,25 +360,44 @@ async function loginOpenAICodex(callbacks) {
 		server.close();
 	}
 }
+async function loginOpenAICodex(callbacks) {
+	return await callbacks.onSelect({
+		message: "Choose how to authorize OpenAI Codex",
+		options: [{
+			id: "browser",
+			label: "Browser (recommended for this device)"
+		}, {
+			id: "device_code",
+			label: "Device code (remote or headless)"
+		}]
+	}) === "device_code" ? loginOpenAICodexWithDeviceCode(callbacks) : loginOpenAICodexWithBrowser(callbacks);
+}
 async function refreshOpenAICodexToken(refreshToken) {
 	return refreshAccessToken(refreshToken);
 }
-var CLIENT_ID, AUTHORIZE_URL, TOKEN_URL, CALLBACK_PORT, CALLBACK_PATH, REDIRECT_URI, SCOPE, MANUAL_PROMPT_DELAY_MS, TOKEN_REQUEST_TIMEOUT_MS, openaiCodexOAuthProvider;
+var CLIENT_ID, AUTH_BASE_URL, AUTHORIZE_URL, TOKEN_URL, DEVICE_USER_CODE_URL, DEVICE_TOKEN_URL, DEVICE_VERIFICATION_URL, DEVICE_REDIRECT_URI, CALLBACK_PORT, CALLBACK_PATH, REDIRECT_URI, SCOPE, MANUAL_PROMPT_DELAY_MS, TOKEN_REQUEST_TIMEOUT_MS, DEVICE_AUTH_TIMEOUT_MS, openaiCodexOAuthProvider;
 var init_openai_codex = __esmMin((() => {
 	init_pkce();
 	CLIENT_ID = "app_EMoamEEZ73f0CkXaXp7hrann";
-	AUTHORIZE_URL = "https://auth.openai.com/oauth/authorize";
-	TOKEN_URL = "https://auth.openai.com/oauth/token";
+	AUTH_BASE_URL = "https://auth.openai.com";
+	AUTHORIZE_URL = `${AUTH_BASE_URL}/oauth/authorize`;
+	TOKEN_URL = `${AUTH_BASE_URL}/oauth/token`;
+	DEVICE_USER_CODE_URL = `${AUTH_BASE_URL}/api/accounts/deviceauth/usercode`;
+	DEVICE_TOKEN_URL = `${AUTH_BASE_URL}/api/accounts/deviceauth/token`;
+	DEVICE_VERIFICATION_URL = `${AUTH_BASE_URL}/codex/device`;
+	DEVICE_REDIRECT_URI = `${AUTH_BASE_URL}/deviceauth/callback`;
 	CALLBACK_PORT = 1455;
 	CALLBACK_PATH = "/auth/callback";
 	REDIRECT_URI = `http://localhost:${CALLBACK_PORT}${CALLBACK_PATH}`;
 	SCOPE = "openid profile email offline_access";
 	MANUAL_PROMPT_DELAY_MS = 15e3;
 	TOKEN_REQUEST_TIMEOUT_MS = 3e4;
+	DEVICE_AUTH_TIMEOUT_MS = 15 * 6e4;
 	openaiCodexOAuthProvider = {
 		id: "openai-codex",
 		name: "OpenAI Codex",
 		usesCallbackServer: true,
+		loginMethods: ["browser", "device_code"],
 		async login(callbacks) {
 			return loginOpenAICodex(callbacks);
 		},

package/dist/src/auth/oauth/types.d.ts

@@ -10,6 +10,7 @@ export type OAuthCredentials = {
     [key: string]: unknown;
 };
 export type OAuthProviderId = string;
+export type OAuthLoginMethod = 'browser' | 'device_code';
 export type OAuthPrompt = {
     message: string;
     placeholder?: string;
@@ -49,8 +50,10 @@ export interface OAuthProviderInterface {
     login(callbacks: OAuthLoginCallbacks): Promise<OAuthCredentials>;
     /** Whether login uses a local callback server and supports manual code input. */
     usesCallbackServer?: boolean;
+    /** Login methods exposed by providers that support more than one OAuth flow. */
+    loginMethods?: readonly OAuthLoginMethod[];
     /** Refresh expired credentials, return updated credentials to persist */
-    refreshToken(credentials: OAuthCredentials): Promise<OAuthCredentials>;
+    refreshToken(credentials: OAuthCredentials, signal?: AbortSignal): Promise<OAuthCredentials>;
     /** Convert credentials to API key string for the provider */
     getApiKey(credentials: OAuthCredentials): string;
 }

package/dist/src/auth/oauth/xopc-cloud.js

@@ -1,6 +1,9 @@
 import { __esmMin } from "../../../_virtual/_rolldown/runtime.js";
+import { generatePKCE, init_pkce } from "./pkce.js";
 import { hostname } from "node:os";
-import { setTimeout } from "node:timers/promises";
+import { randomBytes } from "node:crypto";
+import http from "node:http";
+import { setTimeout as setTimeout$1 } from "node:timers/promises";
 //#region src/auth/oauth/xopc-cloud.ts
 function consoleUrl() {
 	return (process.env.XOPC_CONSOLE_URL ?? DEFAULT_CONSOLE_URL).replace(/\/+$/, "");
@@ -29,7 +32,106 @@ async function tokenRequest(body, signal) {
 		signal: signal ?? AbortSignal.timeout(3e4)
 	});
 }
-async function login(callbacks) {
+function callbackHtml(title, message) {
+	return `<!doctype html><html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>${title}</title></head><body><main><h1>${title}</h1><p>${message}</p><p>You can close this window and return to XOPC.</p></main></body></html>`;
+}
+async function loginWithBrowser(callbacks) {
+	if (callbacks.signal?.aborted) throw callbacks.signal.reason instanceof Error ? callbacks.signal.reason : /* @__PURE__ */ new Error("XOPC OAuth login cancelled");
+	const { verifier, challenge } = await generatePKCE();
+	const state = randomBytes(24).toString("base64url");
+	let settle;
+	const callback = new Promise((resolve) => {
+		settle = resolve;
+	});
+	const server = http.createServer((request, response) => {
+		response.setHeader("content-type", "text/html; charset=utf-8");
+		try {
+			const url = new URL(request.url ?? "", "http://127.0.0.1");
+			if (url.pathname !== CALLBACK_PATH) {
+				response.statusCode = 404;
+				response.end(callbackHtml("Authorization callback not found", "This is not a valid XOPC OAuth callback URL."));
+				return;
+			}
+			const returnedState = url.searchParams.get("state");
+			const oauthError = url.searchParams.get("error");
+			const code = url.searchParams.get("code");
+			if (returnedState !== state) {
+				const error = /* @__PURE__ */ new Error("XOPC OAuth state mismatch");
+				response.statusCode = 400;
+				response.end(callbackHtml("Authorization failed", error.message));
+				settle?.({ error });
+				return;
+			}
+			if (oauthError || !code) {
+				const error = /* @__PURE__ */ new Error(oauthError === "access_denied" ? "XOPC OAuth authorization was denied" : "XOPC OAuth callback did not include an authorization code");
+				response.statusCode = 400;
+				response.end(callbackHtml("Authorization failed", error.message));
+				settle?.({ error });
+				return;
+			}
+			response.statusCode = 200;
+			response.end(callbackHtml("Authorization complete", "XOPC received the authorization callback successfully."));
+			settle?.({ code });
+		} catch {
+			const error = /* @__PURE__ */ new Error("XOPC OAuth callback could not be processed");
+			response.statusCode = 500;
+			response.end(callbackHtml("Authorization failed", error.message));
+			settle?.({ error });
+		}
+	});
+	const redirectUri = await new Promise((resolve, reject) => {
+		server.once("error", reject);
+		server.listen(0, "127.0.0.1", () => {
+			server.removeListener("error", reject);
+			const address = server.address();
+			if (!address || typeof address === "string") {
+				reject(/* @__PURE__ */ new Error("XOPC OAuth callback server did not expose a TCP port"));
+				return;
+			}
+			resolve(`http://127.0.0.1:${address.port}${CALLBACK_PATH}`);
+		});
+	});
+	const authorizationUrl = new URL(`${consoleUrl()}/oauth/authorize`);
+	authorizationUrl.search = new URLSearchParams({
+		response_type: "code",
+		client_id: CLIENT_ID,
+		redirect_uri: redirectUri,
+		scope: DEFAULT_SCOPE,
+		code_challenge: challenge,
+		code_challenge_method: "S256",
+		state,
+		device_name: hostname() || "XOPC client",
+		client_type: "cli"
+	}).toString();
+	const timeout = setTimeout(() => settle?.({ error: /* @__PURE__ */ new Error("XOPC OAuth authorization timed out") }), AUTHORIZATION_TIMEOUT_MS);
+	timeout.unref?.();
+	const abort = () => settle?.({ error: callbacks.signal?.reason instanceof Error ? callbacks.signal.reason : /* @__PURE__ */ new Error("XOPC OAuth login cancelled") });
+	callbacks.signal?.addEventListener("abort", abort, { once: true });
+	try {
+		callbacks.onAuth({
+			url: authorizationUrl.toString(),
+			instructions: "Complete authorization in your browser. XOPC will finish automatically after the local callback."
+		});
+		const result = await callback;
+		if (result.error) throw result.error;
+		if (!result.code) throw new Error("XOPC OAuth callback did not include an authorization code");
+		const token = await tokenRequest(new URLSearchParams({
+			grant_type: "authorization_code",
+			client_id: CLIENT_ID,
+			code: result.code,
+			code_verifier: verifier,
+			redirect_uri: redirectUri
+		}), callbacks.signal);
+		const body = await readJson(token);
+		if (!token.ok) throw new Error(body.error_description ?? body.error ?? "XOPC OAuth token exchange failed");
+		return credentials(body);
+	} finally {
+		clearTimeout(timeout);
+		callbacks.signal?.removeEventListener("abort", abort);
+		server.close();
+	}
+}
+async function loginWithDeviceCode(callbacks) {
 	const response = await fetch(`${consoleUrl()}/oauth/device_authorization`, {
 		method: "POST",
 		headers: {
@@ -60,7 +162,7 @@ async function login(callbacks) {
 	});
 	while (Date.now() < expiresAt) {
 		if (callbacks.signal?.aborted) throw callbacks.signal.reason ?? /* @__PURE__ */ new Error("OAuth login cancelled");
-		await setTimeout(intervalMs, void 0, callbacks.signal ? { signal: callbacks.signal } : void 0);
+		await setTimeout$1(intervalMs, void 0, callbacks.signal ? { signal: callbacks.signal } : void 0);
 		const token = await tokenRequest(new URLSearchParams({
 			grant_type: "urn:ietf:params:oauth:grant-type:device_code",
 			client_id: CLIENT_ID,
@@ -73,24 +175,40 @@ async function login(callbacks) {
 	}
 	throw new Error("XOPC OAuth authorization expired");
 }
-async function refreshToken(current) {
+async function login(callbacks) {
+	return await callbacks.onSelect({
+		message: "Choose how to authorize XOPC Model Service",
+		options: [{
+			id: "browser",
+			label: "Browser (recommended for this device)"
+		}, {
+			id: "device_code",
+			label: "Device code (remote or headless)"
+		}]
+	}) === "device_code" ? loginWithDeviceCode(callbacks) : loginWithBrowser(callbacks);
+}
+async function refreshToken(current, signal) {
 	const response = await tokenRequest(new URLSearchParams({
 		grant_type: "refresh_token",
 		client_id: CLIENT_ID,
 		refresh_token: current.refresh
-	}));
+	}), signal);
 	const body = await readJson(response);
 	if (!response.ok) throw new Error(body.error_description ?? body.error ?? "XOPC OAuth refresh failed");
 	return credentials(body);
 }
-var CLIENT_ID, DEFAULT_CONSOLE_URL, DEFAULT_SCOPE, xopcCloudOAuthProvider;
+var CLIENT_ID, DEFAULT_CONSOLE_URL, DEFAULT_SCOPE, CALLBACK_PATH, AUTHORIZATION_TIMEOUT_MS, xopcCloudOAuthProvider;
 var init_xopc_cloud = __esmMin((() => {
+	init_pkce();
 	CLIENT_ID = "xopc-native";
 	DEFAULT_CONSOLE_URL = "https://console.xopc.ai";
 	DEFAULT_SCOPE = "models:read models:invoke account:usage offline_access";
+	CALLBACK_PATH = "/oauth/callback";
+	AUTHORIZATION_TIMEOUT_MS = 5 * 6e4;
 	xopcCloudOAuthProvider = {
 		id: "xopc-cloud",
 		name: "XOPC Model Service",
+		loginMethods: ["browser", "device_code"],
 		login,
 		refreshToken,
 		getApiKey: (value) => value.access

package/dist/src/cli/commands/gateway/lifecycle.js

@@ -1,10 +1,10 @@
 import { init_paths, resolveConfigPath } from "../../../config/paths.js";
 import { loadConfig } from "../../../config/loader.js";
 import "../../../config/index.js";
-import { resolveGatewayService } from "../../../daemon/service.js";
 import { isRestartEnabled } from "../../../config/commands.flags.js";
-import { authorizeGatewaySigusr1Restart, writeGatewayRestartIntentSync } from "../../../infra/restart.js";
+import { resolveGatewayService } from "../../../daemon/service.js";
 import { findVerifiedGatewayListenerPidsOnPortSync, formatGatewayPidList, signalVerifiedGatewayPidSync } from "../../../infra/gateway-processes.js";
+import { authorizeGatewaySigusr1Restart, writeGatewayRestartIntentSync } from "../../../infra/restart.js";
 import { runServiceRestart, runServiceStop } from "./lifecycle-core.js";
 import { DEFAULT_RESTART_HEALTH_ATTEMPTS, renderGatewayPortHealthDiagnostics, waitForGatewayHealthyListener } from "./restart-health.js";
 import { parsePortFromArgs, renderGatewayServiceStartHints, resolveGatewayPortFromConfig } from "./shared.js";

package/dist/src/cli/commands/update.js

@@ -2,9 +2,9 @@ import { PACKAGE_VERSION, init_package_version } from "../../package-version.js"
 import { loadConfig } from "../../config/loader.js";
 import { formatExamples, register } from "../registry.js";
 import "../../config/index.js";
-import { acquireUpdateLock } from "../../infra/update-lock.js";
 import { normalizeUpdateChannel } from "../../infra/update-channels.js";
 import { compareSemver, resolveNpmChannelTag } from "../../infra/update-check.js";
+import { acquireUpdateLock } from "../../infra/update-lock.js";
 import { formatUpdateApiResult, resolveUpdateInstallSurface, runGatewayUpdateWithPostSteps } from "../../infra/update-runner.js";
 import { Command } from "commander";
 //#region src/cli/commands/update.ts

package/dist/src/config/index.js

@@ -1,7 +1,7 @@
 import { ENV_VARS, XOPC_DB_FILENAME, resolveHomeDir, resolveStateDir, resolveXopcDatabasePath } from "./paths-state.js";
 import { TelegramAccountConfigSchema, TelegramConfigSchema, TelegramGroupConfigSchema, TelegramTopicConfigSchema } from "../../extensions/telegram/src/config-schema.js";
 import { WeixinAccountConfigSchema, WeixinConfigSchema } from "../../extensions/weixin/src/config-schema.js";
-import { AgentImageGenerationModelSchema, AgentModelRefSchema, AgentModelsSchema, AgentTypedModelRoleSchema, AgentsConfigSchema, BindingMatchSchema, BindingRuleSchema, BindingsConfigSchema, BrowserConfigSchema, ChannelsConfigSchema, CodeIntelligenceConfigSchema, CommandsConfigSchema, ConfigSchema, ConnectorsConfigSchema, ExperimentalConfigSchema, ExtensionSecurityConfigSchema, ExtensionSlotsConfigSchema, ExtensionsConfigSchema, GatewayAuthRateLimitSchema, GatewayAuthSchema, GatewayBindModeSchema, GatewayChannelConnectDeferModeSchema, GatewayConfigSchema, GatewayModeSchema, GatewayRemoteSchema, GatewaySecuritySchema, GatewayTailscaleConsentSchema, GatewayTailscaleSchema, GatewayTlsSchema, GatewayTrustedProxySchema, GoalNotificationEventSchema, GoalNotificationTargetSchema, GoalNotificationsConfigSchema, GoalsConfigSchema, HeartbeatConfigSchema, McpConfigSchema, McpServerSchema, MediaUnderstandingCapabilitiesSchema, MediaUnderstandingModelSchema, MessagesConfigSchema, ModelCatalogConfigSchema, ModelsDevConfigSchema, ProviderAuthConfigSchema, ProviderAzureConfigSchema, ProviderRequestOverridesSchema, ProvidersConfigSchema, STTConfigSchema, STTFallbackConfigSchema, STTProviderConfigSchema, SearchProviderEntrySchema, SessionConfigSchema, SessionDmScopeSchema, SessionResetByTypeSchema, SessionResetConfigSchema, SessionResetModeSchema, SessionScopeSchema, SessionStorageConfigSchema, TTSConfigSchema, TTSEdgeConfigSchema, TTSFallbackConfigSchema, TTSModelOverridesConfigSchema, TTSProviderConfigSchema, TTSSummarizationConfigSchema, ToolsConfigSchema, ToolsMediaAudioConfigSchema, ToolsMediaConfigSchema, TuiConfigSchema, TunnelConfigSchema, TunnelConsentSchema, UpdateAutoConfigSchema, UpdateConfigSchema, VoiceConfigSchema, VoiceRefinementConfigSchema, WebSearchConfigSchema, WebToolsConfigSchema, WebsiteBlocklistSchema, WorkspaceConfigSchema, WorkspaceImportConfigSchema, getAgentDefaultImageGenerationModelConfig, getAgentDefaultImageModelConfig, getAgentDefaultModelRef, init_schema, parseModelRef } from "./schema.js";
+import { AgentImageGenerationModelSchema, AgentModelRefSchema, AgentModelsSchema, AgentTypedModelRoleSchema, AgentsConfigSchema, BindingMatchSchema, BindingRuleSchema, BindingsConfigSchema, BrowserConfigSchema, ChannelsConfigSchema, CodeIntelligenceConfigSchema, CommandsConfigSchema, ConfigSchema, ConnectorsConfigSchema, ExperimentalConfigSchema, ExtensionSecurityConfigSchema, ExtensionSlotsConfigSchema, ExtensionsConfigSchema, GatewayAuthRateLimitSchema, GatewayAuthSchema, GatewayBindModeSchema, GatewayChannelConnectDeferModeSchema, GatewayConfigSchema, GatewayModeSchema, GatewayRemoteSchema, GatewaySecuritySchema, GatewayTailscaleConsentSchema, GatewayTailscaleSchema, GatewayTlsSchema, GatewayTrustedProxySchema, GatewayWebchatConfigSchema, GoalNotificationEventSchema, GoalNotificationTargetSchema, GoalNotificationsConfigSchema, GoalsConfigSchema, HeartbeatConfigSchema, McpConfigSchema, McpServerSchema, MediaUnderstandingCapabilitiesSchema, MediaUnderstandingModelSchema, MessagesConfigSchema, ModelCatalogConfigSchema, ModelsDevConfigSchema, ProviderAuthConfigSchema, ProviderAzureConfigSchema, ProviderRequestOverridesSchema, ProvidersConfigSchema, STTConfigSchema, STTFallbackConfigSchema, STTProviderConfigSchema, SearchProviderEntrySchema, SessionConfigSchema, SessionDmScopeSchema, SessionResetByTypeSchema, SessionResetConfigSchema, SessionResetModeSchema, SessionScopeSchema, SessionStorageConfigSchema, TTSConfigSchema, TTSEdgeConfigSchema, TTSFallbackConfigSchema, TTSModelOverridesConfigSchema, TTSProviderConfigSchema, TTSSummarizationConfigSchema, ToolsConfigSchema, ToolsMediaAudioConfigSchema, ToolsMediaConfigSchema, TuiConfigSchema, TunnelConfigSchema, TunnelConsentSchema, UpdateAutoConfigSchema, UpdateConfigSchema, VoiceConfigSchema, VoiceRefinementConfigSchema, WebSearchConfigSchema, WebToolsConfigSchema, WebsiteBlocklistSchema, WorkspaceConfigSchema, WorkspaceImportConfigSchema, getAgentDefaultImageGenerationModelConfig, getAgentDefaultImageModelConfig, getAgentDefaultModelRef, init_schema, parseModelRef } from "./schema.js";
 import { applyConfigOverrides, getConfigOverrides, resetConfigOverrides, setConfigOverride, unsetConfigOverride } from "./runtime-overrides.js";
 import { expandWorkspacePathString, init_workspace_path, normalizeWorkspaceDir, resolveWorkspaceRoot } from "./workspace-path.js";
 import { resolveDefaultAgentWorkspaceDir } from "./workspace-defaults.js";
@@ -27,4 +27,4 @@ init_workspace_path();
 init_models_json();
 init_resolve_config_value();
 //#endregion
-export { AgentImageGenerationModelSchema, AgentModelRefSchema, AgentModelsSchema, AgentTypedModelRoleSchema, AgentsConfigSchema, BASE_RELOAD_RULES, BindingMatchSchema, BindingRuleSchema, BindingsConfigSchema, BrowserConfigSchema, ChannelsConfigSchema, CodeIntelligenceConfigSchema, CommandsConfigSchema, ConfigHotReloader, ConfigSchema, ConnectorsConfigSchema, CustomModelSchema, ENV_VARS, ExperimentalConfigSchema, ExtensionSecurityConfigSchema, ExtensionSlotsConfigSchema, ExtensionsConfigSchema, FILENAMES, GatewayAuthRateLimitSchema, GatewayAuthSchema, GatewayBindModeSchema, GatewayChannelConnectDeferModeSchema, GatewayConfigSchema, GatewayModeSchema, GatewayRemoteSchema, GatewaySecuritySchema, GatewayTailscaleConsentSchema, GatewayTailscaleSchema, GatewayTlsSchema, GatewayTrustedProxySchema, GoalNotificationEventSchema, GoalNotificationTargetSchema, GoalNotificationsConfigSchema, GoalsConfigSchema, HeartbeatConfigSchema, ImageGenerationCapabilitiesSchema, ImageGenerationModelSchema, ImageGenerationProviderSchema, McpConfigSchema, McpServerSchema, MediaUnderstandingCapabilitiesSchema, MediaUnderstandingModelSchema, MessagesConfigSchema, ModelCatalogConfigSchema, ModelOverrideSchema, ModelsDevConfigSchema, ModelsJsonSchema, OpenAICompatSchema, OpenAICompletionsCompatSchema, OpenAIResponsesCompatSchema, OpenRouterRoutingSchema, ProfileManager, ProviderAuthConfigSchema, ProviderAzureConfigSchema, ProviderConfigSchema, ProviderRequestOverridesSchema, ProvidersConfigSchema, STTConfigSchema, STTFallbackConfigSchema, STTProviderConfigSchema, SearchProviderEntrySchema, SessionConfigSchema, SessionDmScopeSchema, SessionResetByTypeSchema, SessionResetConfigSchema, SessionResetModeSchema, SessionScopeSchema, SessionStorageConfigSchema, TTSConfigSchema, TTSEdgeConfigSchema, TTSFallbackConfigSchema, TTSModelOverridesConfigSchema, TTSProviderConfigSchema, TTSSummarizationConfigSchema, TelegramAccountConfigSchema, TelegramConfigSchema, TelegramGroupConfigSchema, TelegramTopicConfigSchema, ToolsConfigSchema, ToolsMediaAudioConfigSchema, ToolsMediaConfigSchema, TuiConfigSchema, TunnelConfigSchema, TunnelConsentSchema, USER_MEMORY_FILENAME, USER_PROFILE_FILENAME, UpdateAutoConfigSchema, UpdateConfigSchema, VercelGatewayRoutingSchema, VoiceConfigSchema, VoiceRefinementConfigSchema, WORKSPACE_FILES, WebSearchConfigSchema, WebToolsConfigSchema, WebsiteBlocklistSchema, WeixinAccountConfigSchema, WeixinConfigSchema, WorkspaceConfigSchema, WorkspaceImportConfigSchema, XOPC_DB_FILENAME, applyConfigOverrides, buildReloadPlan, canonicalizeConfiguredMcpServer, clearConfigValueCache, createProfile, deleteProfile, diffConfigPaths, existsSync, expandWorkspacePathString, extractProfileAgentId, formatThinkingLevels, getAgentDefaultImageGenerationModelConfig, getAgentDefaultImageModelConfig, getAgentDefaultModelRef, getAllowedCommands, getCacheStats, getConfigOverrides, getCurrentProfile, getDefaultModelValues, resolveModelsJsonPath as getModelsJsonPath, getProfileManager, getProfileNameFromDir, getSwitchCommand, getWorkspacePath, hasBundledExtensionManifest, isKnownCliMcpTypeAlias, listAgentProfileMarkdownDirs, listAgentWorkspaceDirs, listProfiles, listThinkingLevels, loadConfig, loadModelsJson, matchReloadRule, modelsJsonExists, normalizeConfiguredMcpServers, normalizeElevatedMode, normalizeReasoningLevel, normalizeThinkLevel, normalizeVerboseLevel, normalizeWorkspaceDir, parseModelRef, resetConfigOverrides, resolveAgentAuthProfilesPath, resolveAgentDir, resolveAgentDir$1 as resolveAgentDirFromConfig, resolveAgentHomeDir, resolveAgentHomeDir$1 as resolveAgentHomeDirFromConfig, resolveAgentProfileDir, resolveAgentProfileMarkdownPath, resolveAgentWorkspaceDir, resolveAuthProfilesPath, resolveBinDir, resolveBundledExtensionsDir, resolveBundledSkillsDir, resolveConfigPath, resolveConfigValue, resolveCredentialsDir, resolveDefaultAgentWorkspaceDir, resolveEffectiveAgentManifestForAgent, resolveEffectiveAgentManifestForSession, resolveEffectiveAgentProfile, resolveEffectiveAgentProfileForSession, resolveExtensionSdkPath, resolveExtensionsDir, resolveExtensionsLockPath, resolveHeaders, resolveHomeDir, resolveInboxDir, resolveInboxMessagePath, resolveInboxPendingDir, resolveInboxProcessedDir, resolveLogPath, resolveLogsDir, resolveModelsJsonPath, resolveNodeBinDir, resolveNodeBinPath, resolveNodeToolsDir, resolveNpmBinPath, resolveOAuthPath, resolvePidPath, resolveProfileStateDir, resolveSkillPath, resolveSkillsCachePath, resolveSkillsDir, resolveSkillsLockPath, resolveSocketPath, resolveStateDir, resolveStatusPath, resolveToolsDir, resolveUserDir, resolveUserMemoryPath, resolveUserProfilePath, resolveWorkspaceExtensionsDir, resolveWorkspaceFile, resolveWorkspaceRoot, resolveWorkspaceStateDir, resolveWorkspaceStatePath, resolveXopcBinPath, resolveXopcDatabasePath, resolveXopcMcpTransportAlias, saveConfig, saveModelsJson, setConfigOverride, testApiKeyResolution, thinkLevelToNumber, unsetConfigOverride, validateModelsConfig };
+export { AgentImageGenerationModelSchema, AgentModelRefSchema, AgentModelsSchema, AgentTypedModelRoleSchema, AgentsConfigSchema, BASE_RELOAD_RULES, BindingMatchSchema, BindingRuleSchema, BindingsConfigSchema, BrowserConfigSchema, ChannelsConfigSchema, CodeIntelligenceConfigSchema, CommandsConfigSchema, ConfigHotReloader, ConfigSchema, ConnectorsConfigSchema, CustomModelSchema, ENV_VARS, ExperimentalConfigSchema, ExtensionSecurityConfigSchema, ExtensionSlotsConfigSchema, ExtensionsConfigSchema, FILENAMES, GatewayAuthRateLimitSchema, GatewayAuthSchema, GatewayBindModeSchema, GatewayChannelConnectDeferModeSchema, GatewayConfigSchema, GatewayModeSchema, GatewayRemoteSchema, GatewaySecuritySchema, GatewayTailscaleConsentSchema, GatewayTailscaleSchema, GatewayTlsSchema, GatewayTrustedProxySchema, GatewayWebchatConfigSchema, GoalNotificationEventSchema, GoalNotificationTargetSchema, GoalNotificationsConfigSchema, GoalsConfigSchema, HeartbeatConfigSchema, ImageGenerationCapabilitiesSchema, ImageGenerationModelSchema, ImageGenerationProviderSchema, McpConfigSchema, McpServerSchema, MediaUnderstandingCapabilitiesSchema, MediaUnderstandingModelSchema, MessagesConfigSchema, ModelCatalogConfigSchema, ModelOverrideSchema, ModelsDevConfigSchema, ModelsJsonSchema, OpenAICompatSchema, OpenAICompletionsCompatSchema, OpenAIResponsesCompatSchema, OpenRouterRoutingSchema, ProfileManager, ProviderAuthConfigSchema, ProviderAzureConfigSchema, ProviderConfigSchema, ProviderRequestOverridesSchema, ProvidersConfigSchema, STTConfigSchema, STTFallbackConfigSchema, STTProviderConfigSchema, SearchProviderEntrySchema, SessionConfigSchema, SessionDmScopeSchema, SessionResetByTypeSchema, SessionResetConfigSchema, SessionResetModeSchema, SessionScopeSchema, SessionStorageConfigSchema, TTSConfigSchema, TTSEdgeConfigSchema, TTSFallbackConfigSchema, TTSModelOverridesConfigSchema, TTSProviderConfigSchema, TTSSummarizationConfigSchema, TelegramAccountConfigSchema, TelegramConfigSchema, TelegramGroupConfigSchema, TelegramTopicConfigSchema, ToolsConfigSchema, ToolsMediaAudioConfigSchema, ToolsMediaConfigSchema, TuiConfigSchema, TunnelConfigSchema, TunnelConsentSchema, USER_MEMORY_FILENAME, USER_PROFILE_FILENAME, UpdateAutoConfigSchema, UpdateConfigSchema, VercelGatewayRoutingSchema, VoiceConfigSchema, VoiceRefinementConfigSchema, WORKSPACE_FILES, WebSearchConfigSchema, WebToolsConfigSchema, WebsiteBlocklistSchema, WeixinAccountConfigSchema, WeixinConfigSchema, WorkspaceConfigSchema, WorkspaceImportConfigSchema, XOPC_DB_FILENAME, applyConfigOverrides, buildReloadPlan, canonicalizeConfiguredMcpServer, clearConfigValueCache, createProfile, deleteProfile, diffConfigPaths, existsSync, expandWorkspacePathString, extractProfileAgentId, formatThinkingLevels, getAgentDefaultImageGenerationModelConfig, getAgentDefaultImageModelConfig, getAgentDefaultModelRef, getAllowedCommands, getCacheStats, getConfigOverrides, getCurrentProfile, getDefaultModelValues, resolveModelsJsonPath as getModelsJsonPath, getProfileManager, getProfileNameFromDir, getSwitchCommand, getWorkspacePath, hasBundledExtensionManifest, isKnownCliMcpTypeAlias, listAgentProfileMarkdownDirs, listAgentWorkspaceDirs, listProfiles, listThinkingLevels, loadConfig, loadModelsJson, matchReloadRule, modelsJsonExists, normalizeConfiguredMcpServers, normalizeElevatedMode, normalizeReasoningLevel, normalizeThinkLevel, normalizeVerboseLevel, normalizeWorkspaceDir, parseModelRef, resetConfigOverrides, resolveAgentAuthProfilesPath, resolveAgentDir, resolveAgentDir$1 as resolveAgentDirFromConfig, resolveAgentHomeDir, resolveAgentHomeDir$1 as resolveAgentHomeDirFromConfig, resolveAgentProfileDir, resolveAgentProfileMarkdownPath, resolveAgentWorkspaceDir, resolveAuthProfilesPath, resolveBinDir, resolveBundledExtensionsDir, resolveBundledSkillsDir, resolveConfigPath, resolveConfigValue, resolveCredentialsDir, resolveDefaultAgentWorkspaceDir, resolveEffectiveAgentManifestForAgent, resolveEffectiveAgentManifestForSession, resolveEffectiveAgentProfile, resolveEffectiveAgentProfileForSession, resolveExtensionSdkPath, resolveExtensionsDir, resolveExtensionsLockPath, resolveHeaders, resolveHomeDir, resolveInboxDir, resolveInboxMessagePath, resolveInboxPendingDir, resolveInboxProcessedDir, resolveLogPath, resolveLogsDir, resolveModelsJsonPath, resolveNodeBinDir, resolveNodeBinPath, resolveNodeToolsDir, resolveNpmBinPath, resolveOAuthPath, resolvePidPath, resolveProfileStateDir, resolveSkillPath, resolveSkillsCachePath, resolveSkillsDir, resolveSkillsLockPath, resolveSocketPath, resolveStateDir, resolveStatusPath, resolveToolsDir, resolveUserDir, resolveUserMemoryPath, resolveUserProfilePath, resolveWorkspaceExtensionsDir, resolveWorkspaceFile, resolveWorkspaceRoot, resolveWorkspaceStateDir, resolveWorkspaceStatePath, resolveXopcBinPath, resolveXopcDatabasePath, resolveXopcMcpTransportAlias, saveConfig, saveModelsJson, setConfigOverride, testApiKeyResolution, thinkLevelToNumber, unsetConfigOverride, validateModelsConfig };

package/dist/src/config/schema.d.ts

@@ -787,6 +787,13 @@ export declare const GatewayBindModeSchema: z.ZodEnum<{
     lan: "lan";
     tailnet: "tailnet";
 }>;
+export declare const GatewayWebchatConfigSchema: z.ZodDefault<z.ZodObject<{
+    activityDetailDefault: z.ZodDefault<z.ZodEnum<{
+        stream: "stream";
+        on: "on";
+        off: "off";
+    }>>;
+}, z.core.$strip>>;
 export declare const GatewayConfigSchema: z.ZodDefault<z.ZodObject<{
     bind: z.ZodOptional<z.ZodEnum<{
         auto: "auto";
@@ -872,6 +879,13 @@ export declare const GatewayConfigSchema: z.ZodDefault<z.ZodObject<{
             timezone: z.ZodOptional<z.ZodString>;
         }, z.core.$strip>>;
     }, z.core.$strip>>>;
+    webchat: z.ZodOptional<z.ZodDefault<z.ZodObject<{
+        activityDetailDefault: z.ZodDefault<z.ZodEnum<{
+            stream: "stream";
+            on: "on";
+            off: "off";
+        }>>;
+    }, z.core.$strip>>>;
     maxSseConnections: z.ZodOptional<z.ZodNumber>;
     corsOrigins: z.ZodOptional<z.ZodArray<z.ZodString>>;
     publicUrl: z.ZodOptional<z.ZodString>;
@@ -2053,6 +2067,13 @@ export declare const ConfigSchema: z.ZodDefault<z.ZodObject<{
                 timezone: z.ZodOptional<z.ZodString>;
             }, z.core.$strip>>;
         }, z.core.$strip>>>;
+        webchat: z.ZodOptional<z.ZodDefault<z.ZodObject<{
+            activityDetailDefault: z.ZodDefault<z.ZodEnum<{
+                stream: "stream";
+                on: "on";
+                off: "off";
+            }>>;
+        }, z.core.$strip>>>;
         maxSseConnections: z.ZodOptional<z.ZodNumber>;
         corsOrigins: z.ZodOptional<z.ZodArray<z.ZodString>>;
         publicUrl: z.ZodOptional<z.ZodString>;