@xopcai/xopc 0.0.175 → 0.0.177

package/dist/src/config/schema.d.ts

@@ -787,6 +787,13 @@ export declare const GatewayBindModeSchema: z.ZodEnum<{
     lan: "lan";
     tailnet: "tailnet";
 }>;
+export declare const GatewayWebchatConfigSchema: z.ZodDefault<z.ZodObject<{
+    activityDetailDefault: z.ZodDefault<z.ZodEnum<{
+        stream: "stream";
+        on: "on";
+        off: "off";
+    }>>;
+}, z.core.$strip>>;
 export declare const GatewayConfigSchema: z.ZodDefault<z.ZodObject<{
     bind: z.ZodOptional<z.ZodEnum<{
         auto: "auto";
@@ -872,6 +879,13 @@ export declare const GatewayConfigSchema: z.ZodDefault<z.ZodObject<{
             timezone: z.ZodOptional<z.ZodString>;
         }, z.core.$strip>>;
     }, z.core.$strip>>>;
+    webchat: z.ZodOptional<z.ZodDefault<z.ZodObject<{
+        activityDetailDefault: z.ZodDefault<z.ZodEnum<{
+            stream: "stream";
+            on: "on";
+            off: "off";
+        }>>;
+    }, z.core.$strip>>>;
     maxSseConnections: z.ZodOptional<z.ZodNumber>;
     corsOrigins: z.ZodOptional<z.ZodArray<z.ZodString>>;
     publicUrl: z.ZodOptional<z.ZodString>;
@@ -2053,6 +2067,13 @@ export declare const ConfigSchema: z.ZodDefault<z.ZodObject<{
                 timezone: z.ZodOptional<z.ZodString>;
             }, z.core.$strip>>;
         }, z.core.$strip>>>;
+        webchat: z.ZodOptional<z.ZodDefault<z.ZodObject<{
+            activityDetailDefault: z.ZodDefault<z.ZodEnum<{
+                stream: "stream";
+                on: "on";
+                off: "off";
+            }>>;
+        }, z.core.$strip>>>;
         maxSseConnections: z.ZodOptional<z.ZodNumber>;
         corsOrigins: z.ZodOptional<z.ZodArray<z.ZodString>>;
         publicUrl: z.ZodOptional<z.ZodString>;

package/dist/src/config/schema.js

@@ -64,7 +64,7 @@ function parseModelRef(ref) {
 		model: trimmed.slice(idx + 1).trim()
 	};
 }
-var AgentModelRefSchema, AgentImageGenerationModelSchema, AgentTypedModelRoleSchema, AgentTypedModelRolesSchema, AgentModelsSchema, AgentsConfigSchema, BrowserCloudConfigSchema, BrowserExtensionConfigSchema, BrowserCloakConfigSchema, BrowserConfigSchema, BindingMatchSchema, BindingRuleSchema, BindingsConfigSchema, SessionDmScopeSchema, SessionStorageConfigSchema, SessionResetModeSchema, SessionResetConfigSchema, SessionResetByTypeSchema, SessionScopeSchema, SessionConfigSchema, ChannelsConfigSchema, SearchProviderEntrySchema, WebSearchConfigSchema, WebsiteBlocklistSchema, WebToolsConfigSchema, ToolsConfigSchema, GatewayAuthRateLimitSchema, GatewaySecuritySchema, GatewayTrustedProxySchema, GatewayAuthSchema, GatewayTailscaleConsentSchema, GatewayTailscaleSchema, GatewayRemoteSchema, GatewayTlsSchema, GatewayModeSchema, HeartbeatConfigSchema, GatewayChannelConnectDeferModeSchema, TunnelConsentSchema, TunnelConfigSchema, WorkspaceImportConfigSchema, WorkspaceConfigSchema, GatewayBindModeSchema, GatewayConfigSchema, ModelsDevConfigSchema, ModelCatalogConfigSchema, SttProviderConfigCatchallSchema, STTProviderConfigSchema, STTFallbackConfigSchema, MediaUnderstandingCapabilitiesSchema, MediaUnderstandingModelSchema, STTConfigSchema, TtsProviderConfigCatchallSchema, TTSProviderConfigSchema, TTSFallbackConfigSchema, TTSModelOverridesConfigSchema, TTSEdgeConfigSchema, TTSSummarizationConfigSchema, TTSConfigSchema, VoiceRefinementConfigSchema, VoiceConfigSchema, MessagesConfigSchema, ToolsMediaAudioConfigSchema, ToolsMediaConfigSchema, ProviderAzureConfigSchema, ProviderRequestOverridesSchema, ProviderAuthConfigSchema, ProvidersConfigSchema, ExtensionSecurityConfigSchema, ExtensionSlotsConfigSchema, ExtensionsConfigSchema, UpdateAutoConfigSchema, GoalNotificationEventSchema, GoalNotificationTargetSchema, GoalNotificationsConfigSchema, GoalsConfigSchema, UpdateConfigSchema, CommandsConfigSchema, TuiConfigSchema, McpHttpUrlSchema, ConnectorSecretReferenceSchema, McpConfigScalarSchema, McpServerSchema, McpConfigSchema, CodeIntelligenceConfigSchema, ConnectorsConfigSchema, ExperimentalConfigSchema, ConfigSchema;
+var AgentModelRefSchema, AgentImageGenerationModelSchema, AgentTypedModelRoleSchema, AgentTypedModelRolesSchema, AgentModelsSchema, AgentsConfigSchema, BrowserCloudConfigSchema, BrowserExtensionConfigSchema, BrowserCloakConfigSchema, BrowserConfigSchema, BindingMatchSchema, BindingRuleSchema, BindingsConfigSchema, SessionDmScopeSchema, SessionStorageConfigSchema, SessionResetModeSchema, SessionResetConfigSchema, SessionResetByTypeSchema, SessionScopeSchema, SessionConfigSchema, ChannelsConfigSchema, SearchProviderEntrySchema, WebSearchConfigSchema, WebsiteBlocklistSchema, WebToolsConfigSchema, ToolsConfigSchema, GatewayAuthRateLimitSchema, GatewaySecuritySchema, GatewayTrustedProxySchema, GatewayAuthSchema, GatewayTailscaleConsentSchema, GatewayTailscaleSchema, GatewayRemoteSchema, GatewayTlsSchema, GatewayModeSchema, HeartbeatConfigSchema, GatewayChannelConnectDeferModeSchema, TunnelConsentSchema, TunnelConfigSchema, WorkspaceImportConfigSchema, WorkspaceConfigSchema, GatewayBindModeSchema, GatewayWebchatConfigSchema, GatewayConfigSchema, ModelsDevConfigSchema, ModelCatalogConfigSchema, SttProviderConfigCatchallSchema, STTProviderConfigSchema, STTFallbackConfigSchema, MediaUnderstandingCapabilitiesSchema, MediaUnderstandingModelSchema, STTConfigSchema, TtsProviderConfigCatchallSchema, TTSProviderConfigSchema, TTSFallbackConfigSchema, TTSModelOverridesConfigSchema, TTSEdgeConfigSchema, TTSSummarizationConfigSchema, TTSConfigSchema, VoiceRefinementConfigSchema, VoiceConfigSchema, MessagesConfigSchema, ToolsMediaAudioConfigSchema, ToolsMediaConfigSchema, ProviderAzureConfigSchema, ProviderRequestOverridesSchema, ProviderAuthConfigSchema, ProvidersConfigSchema, ExtensionSecurityConfigSchema, ExtensionSlotsConfigSchema, ExtensionsConfigSchema, UpdateAutoConfigSchema, GoalNotificationEventSchema, GoalNotificationTargetSchema, GoalNotificationsConfigSchema, GoalsConfigSchema, UpdateConfigSchema, CommandsConfigSchema, TuiConfigSchema, McpHttpUrlSchema, ConnectorSecretReferenceSchema, McpConfigScalarSchema, McpServerSchema, McpConfigSchema, CodeIntelligenceConfigSchema, ConnectorsConfigSchema, ExperimentalConfigSchema, ConfigSchema;
 var init_schema = __esmMin((() => {
 	init_schema$1();
 	init_preset_chain();
@@ -451,6 +451,13 @@ strict: z.boolean().optional() }).optional();
 		"tailnet",
 		"custom"
 	]);
+	GatewayWebchatConfigSchema = z.object({ 
+	/** Default visibility of AI execution activity in the Web UI. */
+activityDetailDefault: z.enum([
+		"off",
+		"on",
+		"stream"
+	]).default("on") }).default({ activityDetailDefault: "on" });
 	GatewayConfigSchema = z.object({
 		/** Semantic bind mode. */
 		bind: GatewayBindModeSchema.optional(),
@@ -465,6 +472,7 @@ strict: z.boolean().optional() }).optional();
 		tls: GatewayTlsSchema.optional(),
 		auth: GatewayAuthSchema.optional(),
 		heartbeat: HeartbeatConfigSchema.optional(),
+		webchat: GatewayWebchatConfigSchema.optional(),
 		maxSseConnections: z.number().optional(),
 		corsOrigins: z.array(z.string()).optional(),
 		/**
@@ -638,6 +646,7 @@ strict: z.boolean().optional() }).optional();
 			intervalMs: 18e5,
 			includeSystemPromptSection: false
 		},
+		webchat: { activityDetailDefault: "on" },
 		maxSseConnections: 100,
 		corsOrigins: [],
 		skillsMarketplaceProvider: "store",
@@ -1116,6 +1125,7 @@ workDiscoveryOnboarding: z.boolean().default(true) }).strict().default({ workDis
 				intervalMs: 18e5,
 				includeSystemPromptSection: false
 			},
+			webchat: { activityDetailDefault: "on" },
 			maxSseConnections: 100,
 			corsOrigins: [],
 			skillsMarketplaceProvider: "store",
@@ -1183,4 +1193,4 @@ workDiscoveryOnboarding: z.boolean().default(true) }).strict().default({ workDis
 }));
 //#endregion
 init_schema();
-export { AgentImageGenerationModelSchema, AgentModelRefSchema, AgentModelsSchema, AgentTypedModelRoleSchema, AgentsConfigSchema, BindingMatchSchema, BindingRuleSchema, BindingsConfigSchema, BrowserConfigSchema, ChannelsConfigSchema, CodeIntelligenceConfigSchema, CommandsConfigSchema, ConfigSchema, ConnectorsConfigSchema, ExperimentalConfigSchema, ExtensionSecurityConfigSchema, ExtensionSlotsConfigSchema, ExtensionsConfigSchema, GatewayAuthRateLimitSchema, GatewayAuthSchema, GatewayBindModeSchema, GatewayChannelConnectDeferModeSchema, GatewayConfigSchema, GatewayModeSchema, GatewayRemoteSchema, GatewaySecuritySchema, GatewayTailscaleConsentSchema, GatewayTailscaleSchema, GatewayTlsSchema, GatewayTrustedProxySchema, GoalNotificationEventSchema, GoalNotificationTargetSchema, GoalNotificationsConfigSchema, GoalsConfigSchema, HeartbeatConfigSchema, McpConfigSchema, McpServerSchema, MediaUnderstandingCapabilitiesSchema, MediaUnderstandingModelSchema, MessagesConfigSchema, ModelCatalogConfigSchema, ModelsDevConfigSchema, ProviderAuthConfigSchema, ProviderAzureConfigSchema, ProviderRequestOverridesSchema, ProvidersConfigSchema, STTConfigSchema, STTFallbackConfigSchema, STTProviderConfigSchema, SearchProviderEntrySchema, SessionConfigSchema, SessionDmScopeSchema, SessionResetByTypeSchema, SessionResetConfigSchema, SessionResetModeSchema, SessionScopeSchema, SessionStorageConfigSchema, TTSConfigSchema, TTSEdgeConfigSchema, TTSFallbackConfigSchema, TTSModelOverridesConfigSchema, TTSProviderConfigSchema, TTSSummarizationConfigSchema, TelegramAccountConfigSchema, TelegramConfigSchema, TelegramGroupConfigSchema, TelegramTopicConfigSchema, ToolsConfigSchema, ToolsMediaAudioConfigSchema, ToolsMediaConfigSchema, TuiConfigSchema, TunnelConfigSchema, TunnelConsentSchema, UpdateAutoConfigSchema, UpdateConfigSchema, VoiceConfigSchema, VoiceRefinementConfigSchema, WebSearchConfigSchema, WebToolsConfigSchema, WebsiteBlocklistSchema, WeixinAccountConfigSchema, WeixinConfigSchema, WorkspaceConfigSchema, WorkspaceImportConfigSchema, getAgentDefaultImageGenerationModelConfig, getAgentDefaultImageModelConfig, getAgentDefaultModelRef, init_schema, parseModelRef };
+export { AgentImageGenerationModelSchema, AgentModelRefSchema, AgentModelsSchema, AgentTypedModelRoleSchema, AgentsConfigSchema, BindingMatchSchema, BindingRuleSchema, BindingsConfigSchema, BrowserConfigSchema, ChannelsConfigSchema, CodeIntelligenceConfigSchema, CommandsConfigSchema, ConfigSchema, ConnectorsConfigSchema, ExperimentalConfigSchema, ExtensionSecurityConfigSchema, ExtensionSlotsConfigSchema, ExtensionsConfigSchema, GatewayAuthRateLimitSchema, GatewayAuthSchema, GatewayBindModeSchema, GatewayChannelConnectDeferModeSchema, GatewayConfigSchema, GatewayModeSchema, GatewayRemoteSchema, GatewaySecuritySchema, GatewayTailscaleConsentSchema, GatewayTailscaleSchema, GatewayTlsSchema, GatewayTrustedProxySchema, GatewayWebchatConfigSchema, GoalNotificationEventSchema, GoalNotificationTargetSchema, GoalNotificationsConfigSchema, GoalsConfigSchema, HeartbeatConfigSchema, McpConfigSchema, McpServerSchema, MediaUnderstandingCapabilitiesSchema, MediaUnderstandingModelSchema, MessagesConfigSchema, ModelCatalogConfigSchema, ModelsDevConfigSchema, ProviderAuthConfigSchema, ProviderAzureConfigSchema, ProviderRequestOverridesSchema, ProvidersConfigSchema, STTConfigSchema, STTFallbackConfigSchema, STTProviderConfigSchema, SearchProviderEntrySchema, SessionConfigSchema, SessionDmScopeSchema, SessionResetByTypeSchema, SessionResetConfigSchema, SessionResetModeSchema, SessionScopeSchema, SessionStorageConfigSchema, TTSConfigSchema, TTSEdgeConfigSchema, TTSFallbackConfigSchema, TTSModelOverridesConfigSchema, TTSProviderConfigSchema, TTSSummarizationConfigSchema, TelegramAccountConfigSchema, TelegramConfigSchema, TelegramGroupConfigSchema, TelegramTopicConfigSchema, ToolsConfigSchema, ToolsMediaAudioConfigSchema, ToolsMediaConfigSchema, TuiConfigSchema, TunnelConfigSchema, TunnelConsentSchema, UpdateAutoConfigSchema, UpdateConfigSchema, VoiceConfigSchema, VoiceRefinementConfigSchema, WebSearchConfigSchema, WebToolsConfigSchema, WebsiteBlocklistSchema, WeixinAccountConfigSchema, WeixinConfigSchema, WorkspaceConfigSchema, WorkspaceImportConfigSchema, getAgentDefaultImageGenerationModelConfig, getAgentDefaultImageModelConfig, getAgentDefaultModelRef, init_schema, parseModelRef };

package/dist/src/gateway/agents-admin.js

@@ -1,5 +1,5 @@
-import { init_agent_scope, listAgentEntries, normalizeAgentId, resolveAgentDir, resolveAgentProfileDir, resolveAgentWorkspaceDir, resolveDefaultAgentId, resolveUserPath, validateAgentIdForNewAgent } from "../agent/agent-scope.js";
 import { resolveEffectiveAgentManifest } from "../agent-manifest/resolver.js";
+import { init_agent_scope, listAgentEntries, normalizeAgentId, resolveAgentDir, resolveAgentProfileDir, resolveAgentWorkspaceDir, resolveDefaultAgentId, resolveUserPath, validateAgentIdForNewAgent } from "../agent/agent-scope.js";
 import { resolveEffectiveAgentProfile } from "../config/agent-profile.js";
 import { WORKSPACE_FILES, init_paths, resolveUserProfilePath } from "../config/paths.js";
 import { AGENT_PROFILE_MARKDOWN_SYSTEM_FILES, REQUIRED_AGENT_PROFILE_MARKDOWN_FILE_SET } from "../agent/context/workspace.js";

package/dist/src/gateway/hono/lib/config-payload.d.ts

@@ -252,6 +252,9 @@ export declare function buildSafeWebConfigPayload(service: GatewayService, optio
                 timezone?: string;
             };
         };
+        webchat: {
+            activityDetailDefault: "stream" | "on" | "off";
+        };
         maxSseConnections: number;
         channelConnectDeferMode: "explicit" | "off" | "auto";
         channelConnectDeferIds: string[];

package/dist/src/gateway/hono/lib/config-payload.js

@@ -165,6 +165,7 @@ async function buildSafeWebConfigPayload(service, options = {}) {
 				isolatedSession: config.gateway?.heartbeat?.isolatedSession,
 				activeHours: config.gateway?.heartbeat?.activeHours
 			},
+			webchat: { activityDetailDefault: config.gateway?.webchat?.activityDetailDefault ?? "on" },
 			maxSseConnections: typeof config.gateway?.maxSseConnections === "number" ? config.gateway.maxSseConnections : 100,
 			channelConnectDeferMode: config.gateway?.channelConnectDeferMode ?? "auto",
 			channelConnectDeferIds: Array.isArray(config.gateway?.channelConnectDeferIds) ? config.gateway.channelConnectDeferIds : [],

package/dist/src/gateway/hono/oauth-async.d.ts

@@ -8,6 +8,11 @@
 import { Hono } from 'hono';
 import type { GatewayService } from '../service.js';
 import { type OAuthCredentials } from '../../auth/oauth/types.js';
+export declare function resolveOAuthLoginMethodPreference(params: {
+    requestedMethod?: unknown;
+    supportedMethods?: readonly string[];
+    remote: boolean;
+}): string | undefined;
 export declare function createOAuthAsyncHandler(service: GatewayService): Hono<import("hono/dist/types/types.js").BlankEnv, import("hono/dist/types/types.js").BlankSchema, "/">;
 export declare function getOAuthCredentialsFromCache(provider: string): OAuthCredentials | undefined;
 export declare function setOAuthCredentialsToCache(provider: string, creds: OAuthCredentials): void;

package/dist/src/gateway/hono/oauth-async.js

@@ -28,6 +28,7 @@ function formatOAuthAsyncError(err) {
 const OAUTH_PROVIDERS = getOAuthProviderInterfaces();
 const oauthSessions = /* @__PURE__ */ new Map();
 const SESSION_TTL_MS = 600 * 1e3;
+const SESSION_EXPIRY_GRACE_MS = 3e4;
 setInterval(() => {
 	const now = Date.now();
 	for (const [id, session] of oauthSessions.entries()) if (now > session.expiresAt) {
@@ -64,11 +65,21 @@ function requestLooksRemote(c) {
 		hostWithoutPort(c.req.header("host"))
 	].some((candidate) => candidate && !isLoopbackHost(candidate));
 }
+function resolveOAuthLoginMethodPreference(params) {
+	if (typeof params.requestedMethod === "string" && params.requestedMethod.trim()) {
+		const requested = params.requestedMethod.trim();
+		return !params.supportedMethods || params.supportedMethods.includes(requested) ? requested : void 0;
+	}
+	if (params.remote && params.supportedMethods?.includes("browser") && params.supportedMethods.includes("device_code")) return "device_code";
+}
 function preferredOAuthLoginMethod(params) {
-	if (typeof params.requestedMethod === "string" && params.requestedMethod.trim()) return params.requestedMethod.trim();
-	if (params.provider !== "openai-codex") return;
 	const publicHost = hostWithoutPort(resolveReverseProxyPublicUrl(params.service.currentConfig) ?? void 0);
-	if (publicHost && !isLoopbackHost(publicHost) || requestLooksRemote(params.c)) return "device_code";
+	const remote = Boolean(publicHost && !isLoopbackHost(publicHost) || requestLooksRemote(params.c));
+	return resolveOAuthLoginMethodPreference({
+		requestedMethod: params.requestedMethod,
+		supportedMethods: OAUTH_PROVIDERS[params.provider]?.loginMethods,
+		remote
+	});
 }
 function createOAuthAsyncHandler(service) {
 	const oauth = new Hono();
@@ -99,9 +110,9 @@ function createOAuthAsyncHandler(service) {
 		oauthSessions.set(sessionId, session);
 		runOAuthFlow(session, oauthProvider, service).catch((err) => {
 			log.error({
+				err,
 				sessionId,
-				provider,
-				error: err
+				provider
 			}, "Background OAuth flow failed");
 			session.status = "failed";
 			session.error = err instanceof Error ? err.message : "OAuth flow failed";
@@ -220,6 +231,7 @@ async function runOAuthFlow(session, oauthProvider, _service) {
 			session.verificationUri = info.verificationUri;
 			session.instructions = `Enter code ${info.userCode}`;
 			session.message = `Open ${info.verificationUri} and enter code ${info.userCode}`;
+			if (info.expiresInSeconds) session.expiresAt = Math.max(session.expiresAt, Date.now() + info.expiresInSeconds * 1e3 + SESSION_EXPIRY_GRACE_MS);
 		},
 		onPrompt: async (prompt) => {
 			session.status = "waiting_code";
@@ -285,9 +297,9 @@ async function runOAuthFlow(session, oauthProvider, _service) {
 			session.status = "failed";
 			session.error = formatOAuthAsyncError(err);
 			log.error({
+				err,
 				sessionId: session.id,
-				provider: session.provider,
-				error: err
+				provider: session.provider
 			}, "OAuth login failed");
 		}
 	} finally {
@@ -307,4 +319,4 @@ function deleteOAuthCredentialsFromCache(provider) {
 	oauthCredentialsCache.delete(provider);
 }
 //#endregion
-export { createOAuthAsyncHandler, deleteOAuthCredentialsFromCache, getOAuthCredentialsFromCache, setOAuthCredentialsToCache };
+export { createOAuthAsyncHandler, deleteOAuthCredentialsFromCache, getOAuthCredentialsFromCache, resolveOAuthLoginMethodPreference, setOAuthCredentialsToCache };

package/dist/src/gateway/hono/routes/browser-install.js

@@ -1,5 +1,5 @@
-import { acquireBrowserInstallLock, cancelBrowserInstall } from "../../../browser/install-lock.js";
 import { createGatewayRouteLogger } from "../lib/route-logger.js";
+import { acquireBrowserInstallLock, cancelBrowserInstall } from "../../../browser/install-lock.js";
 import { runPlaywrightChromiumInstallWithProgress } from "../../../browser/providers/playwright-install.js";
 import { streamSSE } from "hono/streaming";
 //#region src/gateway/hono/routes/browser-install.ts

package/dist/src/gateway/hono/routes/config-patch/gateway.d.ts

@@ -3,7 +3,7 @@
  *
  * Covers heartbeat, bind/customBindHost/port, tailscale, auth (mode + token +
  * password + rateLimit + trustedProxy), trustedProxies, allowRealIpFallback,
- * dangerouslyAllowHostHeaderOriginFallback, security, share, siteShare, publicUrl,
+ * dangerouslyAllowHostHeaderOriginFallback, security, share, siteShare, publicUrl, webchat,
  * corsOrigins, maxSseConnections, and channelConnectDefer{Mode,Ids,SkipIds}.
  *
  * Validation policy: each subsection that can reject rejects with a 400 and a

package/dist/src/gateway/hono/routes/config-patch/gateway.js

@@ -32,6 +32,15 @@ function parseDeferIdList(raw) {
 	return ids;
 }
 function applyGatewayPatch(config, body) {
+	if (body.gateway?.webchat?.activityDetailDefault !== void 0) {
+		const level = body.gateway.webchat.activityDetailDefault;
+		if (level !== "off" && level !== "on" && level !== "stream") return patchError("gateway.webchat.activityDetailDefault must be off, on, or stream");
+		const gw = ensureGateway(config);
+		gw.webchat = {
+			...gw.webchat ?? { activityDetailDefault: "on" },
+			activityDetailDefault: level
+		};
+	}
 	if (body.gateway?.heartbeat !== void 0 && typeof body.gateway.heartbeat === "object") {
 		const gw = ensureGateway(config);
 		if (!gw.heartbeat) gw.heartbeat = {

package/dist/src/gateway/hono/routes/goals.js

@@ -532,6 +532,8 @@ function registerGoalsRoutes(authenticated, deps) {
 			error: "Goal not found"
 		}, 404);
 		const patch = {};
+		let requestedProjectId;
+		let projectChanged = false;
 		if (typeof body.title === "string") patch.title = body.title;
 		if ("description" in body) patch.description = typeof body.description === "string" ? body.description : void 0;
 		const priority = parsePriority(body.priority);
@@ -547,10 +549,21 @@ function registerGoalsRoutes(authenticated, deps) {
 				ok: false,
 				error: "Project not found"
 			}, 404);
+			requestedProjectId = nextProjectId;
+			projectChanged = nextProjectId !== goal.projectId;
 			patch.projectId = nextProjectId;
 		}
 		const locale = normalizeGoalUiLocale(body.uiLocale);
 		if (locale) patch.uiLocale = locale;
+		if (projectChanged && goal.activeSessionKey) try {
+			if (requestedProjectId) deps.service.projects.attachSession(goal.activeSessionKey, requestedProjectId);
+			else deps.service.projects.detachSession(goal.activeSessionKey);
+		} catch (error) {
+			return c.json({
+				ok: false,
+				error: error instanceof Error ? error.message : String(error)
+			}, 404);
+		}
 		if (Object.keys(patch).length > 0) goal = goals.update(goalId, patch);
 		if (status) {
 			const previousStatus = goal?.status;

package/dist/src/gateway/hono/routes/home.d.ts

@@ -1,8 +1,8 @@
 import type { Hono } from 'hono';
 import { type HomeAttentionSubjectKind } from '../../../storage/sqlite/index.js';
 import type { AuthenticatedRouteDeps } from './deps.js';
-type HomeDecisionKind = 'work_item' | 'goal' | 'connector_approval' | 'goal_evidence';
-type HomeDecisionReason = 'needs_input' | 'in_review' | 'blocked' | 'overdue' | 'due_soon' | 'approval_required';
+type HomeDecisionKind = 'agent_judgment' | 'work_item' | 'goal' | 'connector_approval' | 'goal_evidence';
+type HomeDecisionReason = 'needs_input' | 'in_review' | 'blocked' | 'overdue' | 'due_soon' | 'decision_needed' | 'approval_required';
 type HomeAttention = {
     id: string;
     kind: HomeAttentionSubjectKind;
@@ -25,6 +25,22 @@ type HomeDecision = {
     projectId?: string;
     projectName?: string;
     updatedAt: number;
+    judgment?: {
+        inboxItemId: string;
+        whyNow: string;
+        impact: string;
+        workDone: string;
+        recommendation: string;
+        confidence: number;
+        decision?: {
+            question: string;
+            options: Array<{
+                id: string;
+                label: string;
+                consequence: string;
+            }>;
+        };
+    };
     response?: {
         kind: 'connector_approval';
         approvalId: string;

package/dist/src/gateway/hono/routes/home.js

@@ -245,6 +245,25 @@ function registerHomeRoutes(authenticated, deps) {
 		const latestAutomationRuns = [...automationRuns].sort((left, right) => right.createdAtMs - left.createdAtMs).filter((run, index, all) => all.findIndex((candidate) => candidate.automationId === run.automationId) === index);
 		const automationsById = new Map(automations.map((automation) => [automation.id, automation]));
 		const decisions = [
+			...service.proactiveInbox.list({ limit: 20 }).filter((item) => item.status === "unread" || item.status === "read").map((item) => ({
+				id: `agent-judgment:${item.id}`,
+				kind: "agent_judgment",
+				title: item.insight.title,
+				detail: item.insight.summary,
+				reason: "decision_needed",
+				urgency: item.insight.urgency === "critical" || item.insight.urgency === "high" ? "now" : "soon",
+				href: `/work?judgment=${encodeURIComponent(item.id)}`,
+				updatedAt: Date.parse(item.updatedAt),
+				judgment: {
+					inboxItemId: item.id,
+					whyNow: item.insight.whyNow,
+					impact: item.insight.impact,
+					workDone: item.insight.workDone,
+					recommendation: item.insight.recommendation,
+					confidence: item.insight.confidence,
+					...item.insight.decision ? { decision: item.insight.decision } : {}
+				}
+			})),
 			...activeWorkItems.map((item) => decisionFromWorkItem(item, projectsById.get(item.projectId)?.name ?? "Project", nowMs)).filter((item) => Boolean(item)),
 			...activeGoals.map((goal) => decisionFromGoal(goal, goal.projectId ? projectsById.get(goal.projectId)?.name : void 0)).filter((item) => Boolean(item)),
 			...connectorApprovals.filter((approval) => Date.parse(approval.expiresAt) > nowMs).map((approval) => ({

package/dist/src/gateway/hono/routes/index.js

@@ -12,7 +12,7 @@ import { registerInteractionStateRoutes } from "./interaction-state.js";
 import { registerComposerHistoryRoutes } from "./composer-history.js";
 import { registerLocalAppsRoutes } from "./local-apps.js";
 import { registerWorkDiscoveryRoutes } from "./work-discovery.js";
-import { registerFocusRoutes } from "./focuses.js";
+import { registerProactiveRoutes } from "./proactive.js";
 import { mountAppLazyRoutePrefixes, registerAuthenticatedLazyRouteFallback } from "./lazy-fallback.js";
 //#region src/gateway/hono/routes/index.ts
 function registerCoreAuthenticatedRoutes(authenticated, deps) {
@@ -25,7 +25,7 @@ function registerCoreAuthenticatedRoutes(authenticated, deps) {
 	registerProjectSkillRoutes(authenticated, deps);
 	registerLocalAppsRoutes(authenticated, deps);
 	registerWorkDiscoveryRoutes(authenticated, deps);
-	registerFocusRoutes(authenticated, deps);
+	registerProactiveRoutes(authenticated, deps);
 	registerSearchRoutes(authenticated, deps);
 	registerMobileRoutes(authenticated, deps);
 	registerTaskOutcomeRoutes(authenticated, deps);

package/dist/src/gateway/hono/routes/proactive.d.ts

@@ -0,0 +1,4 @@
+import type { Hono } from 'hono';
+import type { AuthenticatedRouteDeps } from './deps.js';
+/** User-facing judgment inbox plus internal diagnostics. There is intentionally no proactive control-panel API. */
+export declare function registerProactiveRoutes(authenticated: Hono, deps: AuthenticatedRouteDeps): void;

package/dist/src/gateway/hono/routes/proactive.js

@@ -0,0 +1,157 @@
+//#region src/gateway/hono/routes/proactive.ts
+function positiveInt(value, fallback) {
+	const parsed = Number(value);
+	return Number.isInteger(parsed) && parsed > 0 ? parsed : fallback;
+}
+/** User-facing judgment inbox plus internal diagnostics. There is intentionally no proactive control-panel API. */
+function registerProactiveRoutes(authenticated, deps) {
+	authenticated.get("/api/inbox/judgments", (c) => {
+		const status = c.req.query("status");
+		if (status && ![
+			"unread",
+			"read",
+			"snoozed",
+			"resolved"
+		].includes(status)) return c.json({
+			ok: false,
+			error: "Invalid inbox status"
+		}, 400);
+		return c.json({
+			ok: true,
+			items: deps.service.proactiveInbox.list({
+				...status ? { status } : {},
+				limit: positiveInt(c.req.query("limit"), 50)
+			})
+		});
+	});
+	authenticated.post("/api/inbox/judgments/:itemId/transition", deps.strictRateLimitMiddleware, async (c) => {
+		const body = await c.req.json().catch(() => null);
+		if (!body || ![
+			"unread",
+			"read",
+			"snoozed",
+			"resolved"
+		].includes(String(body.status))) return c.json({
+			ok: false,
+			error: "Valid status is required"
+		}, 400);
+		try {
+			return c.json({
+				ok: true,
+				item: deps.service.proactiveInbox.transition(c.req.param("itemId"), {
+					status: body.status,
+					...typeof body.snoozedUntil === "string" ? { snoozedUntil: body.snoozedUntil } : {},
+					...typeof body.resolution === "string" ? { resolution: body.resolution } : {}
+				})
+			});
+		} catch (error) {
+			return c.json({
+				ok: false,
+				error: error instanceof Error ? error.message : String(error)
+			}, 400);
+		}
+	});
+	authenticated.post("/api/inbox/judgments/:itemId/decisions", deps.strictRateLimitMiddleware, async (c) => {
+		const body = await c.req.json().catch(() => null);
+		if (!body || typeof body.choice !== "string") return c.json({
+			ok: false,
+			error: "choice is required"
+		}, 400);
+		try {
+			return c.json({
+				ok: true,
+				item: deps.service.proactiveInbox.decide(c.req.param("itemId"), body.choice, typeof body.note === "string" ? body.note : "")
+			}, 201);
+		} catch (error) {
+			return c.json({
+				ok: false,
+				error: error instanceof Error ? error.message : String(error)
+			}, 400);
+		}
+	});
+	authenticated.post("/api/inbox/judgments/:itemId/feedback", deps.strictRateLimitMiddleware, async (c) => {
+		const body = await c.req.json().catch(() => null);
+		if (!body || body.rating !== "useful" && body.rating !== "not_useful") return c.json({
+			ok: false,
+			error: "Valid rating is required"
+		}, 400);
+		try {
+			deps.service.proactiveInbox.feedback(c.req.param("itemId"), body.rating, typeof body.note === "string" ? body.note : "");
+			return c.json({ ok: true }, 201);
+		} catch (error) {
+			return c.json({
+				ok: false,
+				error: error instanceof Error ? error.message : String(error)
+			}, 400);
+		}
+	});
+	authenticated.post("/api/inbox/judgments/:itemId/instructions", deps.strictRateLimitMiddleware, async (c) => {
+		const body = await c.req.json().catch(() => null);
+		if (!body || typeof body.instruction !== "string" || !body.instruction.trim()) return c.json({
+			ok: false,
+			error: "instruction is required"
+		}, 400);
+		try {
+			return c.json({
+				ok: true,
+				...deps.service.proactiveInbox.instruct(c.req.param("itemId"), body.instruction)
+			}, 201);
+		} catch (error) {
+			return c.json({
+				ok: false,
+				error: error instanceof Error ? error.message : String(error)
+			}, 400);
+		}
+	});
+	authenticated.get("/api/internal/proactive/insights", (c) => c.json({
+		ok: true,
+		insights: deps.service.proactiveInsights()
+	}));
+	authenticated.get("/api/internal/proactive/scenarios", (c) => c.json({
+		ok: true,
+		scenarios: deps.service.proactiveScenarios.list(),
+		subscriptions: deps.service.proactiveScenarios.subscriptions()
+	}));
+	authenticated.post("/api/internal/proactive/events", deps.strictRateLimitMiddleware, async (c) => {
+		const body = await c.req.json().catch(() => null);
+		if (!body || typeof body !== "object" || Array.isArray(body)) return c.json({
+			ok: false,
+			error: "Event body must be an object"
+		}, 400);
+		try {
+			const result = deps.service.proactive.publish(body);
+			return c.json({
+				ok: true,
+				...result
+			}, result.inserted ? 201 : 200);
+		} catch (error) {
+			return c.json({
+				ok: false,
+				error: error instanceof Error ? error.message : String(error)
+			}, 400);
+		}
+	});
+	authenticated.get("/api/internal/proactive/events", (c) => {
+		const events = deps.service.proactive.listEvents({
+			limit: positiveInt(c.req.query("limit"), 50),
+			...c.req.query("type") ? { type: c.req.query("type") } : {}
+		}).map((event) => event.sensitivity === "public" || event.sensitivity === "personal" ? event : {
+			...event,
+			payload: { redacted: true }
+		});
+		return c.json({
+			ok: true,
+			events
+		});
+	});
+	authenticated.get("/api/internal/proactive/batches", (c) => c.json({
+		ok: true,
+		batches: deps.service.proactive.listBatches({ limit: positiveInt(c.req.query("limit"), 50) })
+	}));
+	authenticated.get("/api/internal/proactive/health", (c) => c.json({
+		ok: true,
+		health: deps.service.proactive.health()
+	}));
+}
+//#endregion
+export { registerProactiveRoutes };

package/dist/src/gateway/hono/routes/projects.js

@@ -15,7 +15,7 @@ import { inferProjectKind } from "../../../projects/project-kind.js";
 import { inferSuggestedProjectDefaultAgentId } from "../../../projects/project-agent-suggestion.js";
 import { buildProjectLoopOverview } from "../../../projects/project-loop.js";
 import "../../../projects/index.js";
-import { WORK_ITEM_ATTACHMENT_MAX_BYTES, WorkItemService } from "../../../work-items/work-item-service.js";
+import { WORK_ITEM_ATTACHMENT_MAX_BYTES } from "../../../work-items/work-item-service.js";
 import { buildWorkItemAgentContext } from "../../../work-items/agent-context.js";
 import "../../../work-items/index.js";
 import { createGatewayRouteLogger } from "../lib/route-logger.js";
@@ -373,7 +373,7 @@ function registerProjectsRoutes(authenticated, deps) {
 	const { service } = deps;
 	const activity = new ActivityService();
 	const goals = new GoalService();
-	const workItems = new WorkItemService();
+	const workItems = service.workItems;
 	authenticated.post("/api/projects", async (c) => {
 		const body = await c.req.json().catch(() => ({}));
 		const name = textField(body, "name")?.trim();

package/dist/src/gateway/service/sessions-api.d.ts

@@ -88,7 +88,8 @@ export declare class GatewaySessionsApi {
     patchAgentConfig(sessionKey: string, body: {
         thinkingLevel?: string;
         model?: string | null;
-        reasoningLevel?: string;
+        activityDetailLevel?: string | null;
+        reasoningLevel?: string | null;
         verboseLevel?: string;
         workingDirectory?: string;
     }): Promise<import("../../agent/session/session-config-service.js").PatchSessionAgentConfigResult>;

package/dist/src/gateway/service.d.ts

@@ -12,7 +12,9 @@ import { AgentRunRelay } from './agent-run-relay.js';
 import { type EnqueueGoalRunOptions } from '../goals/index.js';
 import { ProjectService } from '../projects/index.js';
 import { LocalAppService } from '../local-apps/index.js';
+import { WorkItemService } from '../work-items/index.js';
 import { type BrowserRecipeService } from '../browser/recipes/index.js';
+import { listInsights, ProactiveEventService, ProactiveInboxService, ProactiveInboxWorker, ProactiveScenarioService, ProactiveWorker } from '../proactive/index.js';
 import { GatewaySessionsApi } from './service/sessions-api.js';
 import { GatewayMarketplaceService } from './service/marketplace-service.js';
 import { GatewayAgentRunner } from './service/agent-runner.js';
@@ -68,7 +70,6 @@ export declare class GatewayService {
     private connectedKnowledgeCoordinator;
     private stopAutomationProductEventBridge;
     private stopSessionTranscriptAutomationEvents;
-    private stopFocusReconciler;
     /**
      * Webchat agent invocation surface (`runAgent`, `abortAgentRun`, `steer*`,
      * `submitClarifyResponse`, clarify-bridge dispatch). Owns the
@@ -90,8 +91,16 @@ export declare class GatewayService {
     readonly marketplace: GatewayMarketplaceService;
     /** First-class project grouping surface. */
     readonly projects: ProjectService;
+    readonly workItems: WorkItemService;
     /** Local user-created apps, their coder projects, previews, and installs. */
     readonly localApps: LocalAppService;
+    /** Unified durable event spine for proactive scenarios. */
+    readonly proactiveScenarios: ProactiveScenarioService;
+    readonly proactive: ProactiveEventService;
+    readonly proactiveInbox: ProactiveInboxService;
+    readonly proactiveInsights: typeof listInsights;
+    readonly proactiveWorker: ProactiveWorker;
+    readonly proactiveInboxWorker: ProactiveInboxWorker;
     constructor(serviceConfig?: GatewayServiceConfig);
     /** Lazy AgentService — constructed on first use or during `start()`. */
     get agentService(): AgentService;