@xopcai/xopc 0.0.179 → 0.0.187

package/dist/src/gateway/agents-admin.js

@@ -1,5 +1,5 @@
+import { resolveCapabilityPresetLayer, resolveEffectiveAgentManifest } from "../agent-manifest/resolver.js";
 import { init_agent_scope, listAgentEntries, normalizeAgentId, resolveAgentDir, resolveAgentProfileDir, resolveAgentWorkspaceDir, resolveDefaultAgentId, resolveUserPath, validateAgentIdForNewAgent } from "../agent/agent-scope.js";
-import { resolveEffectiveAgentManifest } from "../agent-manifest/resolver.js";
 import { resolveEffectiveAgentProfile } from "../config/agent-profile.js";
 import { WORKSPACE_FILES, init_paths, resolveUserProfilePath } from "../config/paths.js";
 import { AGENT_PROFILE_MARKDOWN_SYSTEM_FILES, REQUIRED_AGENT_PROFILE_MARKDOWN_FILE_SET } from "../agent/context/workspace.js";
@@ -55,17 +55,23 @@ function parseIdentityMarkdown(content) {
 async function listGatewayAgents(cfg, _options = {}) {
 	const defaultId = resolveDefaultAgentId(cfg);
 	const agents = [];
-	const presetDenied = [];
-	const presetTypedModels = [];
 	for (const id of collectAgentIdsForList(cfg)) {
 		const profile = resolveEffectiveAgentProfile(cfg, id);
 		const entry = listAgentEntries(cfg).find((e) => normalizeAgentId(e.id) === id);
+		const presetLayer = resolveCapabilityPresetLayer({
+			presetIds: entry?.extends,
+			presets: cfg.agents.capabilityPresets,
+			defaultPresetId: cfg.agents.defaultPreset
+		});
+		const presetSkills = presetLayer.patch.skills?.mode === "allowlist" ? presetLayer.patch.skills.allow ?? [] : void 0;
+		const presetDenied = Object.entries(presetLayer.patch.tools?.builtin ?? {}).filter(([, policy]) => policy.mode === "deny").map(([name]) => name);
+		const presetTypedModels = rolesToTypedModels(presetLayer.patch.models?.roles);
 		const model = profile.primaryModelRef || profile.fallbacks.length > 0 ? {
 			...profile.primaryModelRef ? { primary: profile.primaryModelRef } : {},
 			...profile.fallbacks.length > 0 ? { fallbacks: profile.fallbacks } : {}
 		} : void 0;
-		const entrySkills = entry?.skills.mode === "allowlist" ? entry.skills.allow ?? [] : void 0;
-		const entryDisable = Object.entries(entry?.tools.builtin ?? {}).filter(([, policy]) => policy.mode === "deny").map(([name]) => name);
+		const entrySkills = entry?.skills?.mode === "allowlist" ? entry.skills.allow ?? [] : void 0;
+		const entryDisable = Object.entries(entry?.tools?.builtin ?? {}).filter(([, policy]) => policy.mode === "deny").map(([name]) => name);
 		const entryTypedModels = rolesToTypedModels(entry?.models?.roles);
 		const effectiveTypedModels = [...resolveEffectiveTypedModels(cfg, id).values()].sort((a, b) => a.id.localeCompare(b.id));
 		let identity = {};
@@ -95,7 +101,7 @@ async function listGatewayAgents(cfg, _options = {}) {
 			extends: [...entry?.extends ?? []],
 			isDefault: id === defaultId,
 			skills: {
-				preset: [],
+				preset: presetSkills ? [...presetSkills] : [],
 				...entrySkills !== void 0 ? { entry: [...entrySkills] } : {},
 				...profile.skillsAllowlist !== void 0 ? { effectiveAllowlist: [...profile.skillsAllowlist] } : {}
 			},
@@ -214,7 +220,7 @@ function prepareCreateAgent(cfg, body) {
 				workspace: wsAbs,
 				extends: [...inheritedPresetIds],
 				...effectiveModels ? { models: effectiveModels } : {},
-				...body.skills !== void 0 ? { skills: body.skills.map((s) => String(s).trim()).filter(Boolean) } : cloneSourceEntry?.skills.mode === "allowlist" && body.cloneFrom ? { skills: [...cloneSourceEntry.skills.allow ?? []] } : {},
+				...body.skills !== void 0 ? { skills: body.skills.map((s) => String(s).trim()).filter(Boolean) } : cloneSourceEntry?.skills?.mode === "allowlist" && body.cloneFrom ? { skills: [...cloneSourceEntry.skills.allow ?? []] } : {},
 				...body.tools !== void 0 ? { tools: body.tools } : cloneSourceEntry?.tools && body.cloneFrom ? { tools: cloneSourceEntry.tools } : {}
 			}),
 			agentId,
@@ -273,15 +279,7 @@ function prepareUpdateAgent(cfg, agentIdRaw, body) {
 				tone: "direct"
 			},
 			responsibilities: { primary: ["Help the user complete tasks"] },
-			workspace: { root: `~/.xopc/workspace/${agentId}` },
-			tools: { builtin: {} },
-			skills: { mode: "all" },
-			workflows: {},
-			boundaries: {
-				requiresConfirmation: [],
-				forbidden: [],
-				escalation: []
-			}
+			workspace: { root: `~/.xopc/workspace/${agentId}` }
 		}];
 		idx = list.length - 1;
 	}
@@ -350,7 +348,7 @@ function prepareUpdateAgent(cfg, agentIdRaw, body) {
 			defaultRole
 		};
 	}
-	if (body.skills !== void 0) if (body.skills === null) entry.skills = { mode: "all" };
+	if (body.skills !== void 0) if (body.skills === null) delete entry.skills;
 	else {
 		const next = body.skills.map((s) => String(s).trim()).filter(Boolean);
 		if (next.length === 0) entry.skills = {
@@ -362,7 +360,7 @@ function prepareUpdateAgent(cfg, agentIdRaw, body) {
 			allow: next
 		};
 	}
-	if (body.tools !== void 0) if (body.tools === null) entry.tools = { builtin: {} };
+	if (body.tools !== void 0) if (body.tools === null) delete entry.tools;
 	else entry.tools = body.tools;
 	list[idx] = entry;
 	let next = {

package/dist/src/gateway/capability-presets-admin.d.ts

@@ -26,6 +26,16 @@ export type CapabilityPresetsListResponse = {
     }>;
     builtinToolIds: string[];
 };
+export type CapabilityPresetPreviewDiff = {
+    path: string;
+    before?: unknown;
+    after?: unknown;
+};
+export type CapabilityPresetPreviewAgent = {
+    agentId: string;
+    agentName?: string;
+    diffs: CapabilityPresetPreviewDiff[];
+};
 export type CreateCapabilityPresetBody = {
     id?: string;
     name?: string;
@@ -61,6 +71,9 @@ export declare function prepareCreateCapabilityPreset(cfg: Config, body: CreateC
 export declare function prepareUpdateCapabilityPreset(cfg: Config, presetIdRaw: string, body: UpdateCapabilityPresetBody): CapabilityPresetAdminResult<{
     nextConfig: Config;
 }>;
+export declare function previewCapabilityPresetUpdate(cfg: Config, presetIdRaw: string, body: UpdateCapabilityPresetBody): CapabilityPresetAdminResult<{
+    agents: CapabilityPresetPreviewAgent[];
+}>;
 export declare function prepareDeleteCapabilityPreset(cfg: Config, presetIdRaw: string): CapabilityPresetAdminResult<{
     nextConfig: Config;
 }>;

package/dist/src/gateway/capability-presets-admin.js

@@ -1,5 +1,6 @@
 import { CapabilityPresetSchema, init_schema } from "../agent-manifest/schema.js";
 import { init_preset_chain, linearizePresetIds } from "../agent-manifest/preset-chain.js";
+import { resolveEffectiveAgentManifest } from "../agent-manifest/resolver.js";
 import { GATEWAY_BUILTIN_TOOL_IDS } from "./agent-builtin-tools.js";
 //#region src/gateway/capability-presets-admin.ts
 init_schema();
@@ -10,6 +11,23 @@ function presetMap(cfg) {
 function normalizePresetId(id) {
 	return id.trim().toLowerCase();
 }
+function flattenPolicy(value, path = "", out = /* @__PURE__ */ new Map()) {
+	if (Array.isArray(value) || value === null || typeof value !== "object") {
+		if (path) out.set(path, value);
+		return out;
+	}
+	for (const [key, child] of Object.entries(value)) flattenPolicy(child, path ? `${path}.${key}` : key, out);
+	return out;
+}
+function manifestDiff(before, after) {
+	const beforeFlat = flattenPolicy(before);
+	const afterFlat = flattenPolicy(after);
+	return [...new Set([...beforeFlat.keys(), ...afterFlat.keys()])].filter((path) => JSON.stringify(beforeFlat.get(path)) !== JSON.stringify(afterFlat.get(path))).sort((a, b) => a.localeCompare(b)).map((path) => ({
+		path,
+		...beforeFlat.has(path) ? { before: beforeFlat.get(path) } : {},
+		...afterFlat.has(path) ? { after: afterFlat.get(path) } : {}
+	}));
+}
 function agentUsage(cfg, presetId) {
 	const defaultPresetId = cfg.agents.defaultPreset || "default";
 	return cfg.agents.list.filter((agent) => {
@@ -91,6 +109,20 @@ function nextConfigWithPresets(cfg, presets) {
 		error: agentRefs.error,
 		status: agentRefs.status
 	};
+	for (const agent of nextConfig.agents.list) try {
+		resolveEffectiveAgentManifest({
+			agent,
+			presets,
+			defaultPresetId: nextConfig.agents.defaultPreset
+		});
+	} catch (error) {
+		const message = error instanceof Error ? error.message : String(error);
+		return {
+			ok: false,
+			error: `agent "${agent.id}" effective manifest is invalid: ${message}`,
+			status: 400
+		};
+	}
 	return {
 		ok: true,
 		data: { nextConfig }
@@ -180,7 +212,6 @@ function prepareUpdateCapabilityPreset(cfg, presetIdRaw, body) {
 		"models",
 		"tools",
 		"skills",
-		"memory",
 		"workflows",
 		"boundaries",
 		"runtime",
@@ -201,6 +232,32 @@ function prepareUpdateCapabilityPreset(cfg, presetIdRaw, body) {
 		[presetId]: parsed.data
 	});
 }
+function previewCapabilityPresetUpdate(cfg, presetIdRaw, body) {
+	const prepared = prepareUpdateCapabilityPreset(cfg, presetIdRaw, body);
+	if (prepared.ok === false) return prepared;
+	return {
+		ok: true,
+		data: { agents: cfg.agents.list.flatMap((agent) => {
+			const before = resolveEffectiveAgentManifest({
+				agent,
+				presets: cfg.agents.capabilityPresets,
+				defaultPresetId: cfg.agents.defaultPreset
+			}).manifest;
+			const after = resolveEffectiveAgentManifest({
+				agent,
+				presets: prepared.data.nextConfig.agents.capabilityPresets,
+				defaultPresetId: prepared.data.nextConfig.agents.defaultPreset
+			}).manifest;
+			const diffs = manifestDiff(before, after);
+			if (diffs.length === 0) return [];
+			return [{
+				agentId: agent.id,
+				...agent.identity.name ? { agentName: agent.identity.name } : {},
+				diffs
+			}];
+		}) }
+	};
+}
 function prepareDeleteCapabilityPreset(cfg, presetIdRaw) {
 	const presetId = normalizePresetId(presetIdRaw);
 	const presets = presetMap(cfg);
@@ -225,4 +282,4 @@ function prepareDeleteCapabilityPreset(cfg, presetIdRaw) {
 	return nextConfigWithPresets(cfg, nextPresets);
 }
 //#endregion
-export { listCapabilityPresets, prepareCreateCapabilityPreset, prepareDeleteCapabilityPreset, prepareUpdateCapabilityPreset };
+export { listCapabilityPresets, prepareCreateCapabilityPreset, prepareDeleteCapabilityPreset, prepareUpdateCapabilityPreset, previewCapabilityPresetUpdate };

package/dist/src/gateway/chat-limits.d.ts

@@ -1,9 +1,13 @@
 /** Web chat: max files per user message (keep in sync with `web` MAX_CHAT_ATTACHMENTS). */
 export declare const MAX_CHAT_ATTACHMENTS = 10;
+/** Inline chat text stays bounded; larger content belongs in an attachment. */
+export declare const MAX_CHAT_INLINE_TEXT_BYTES: number;
 /**
  * Max raw bytes per attachment in web chat (keep in sync with `web` MAX_WEBCHAT_ATTACHMENT_FILE_BYTES).
  * JSON requests send base64 (`data`); gateway body limit must allow worst-case payload.
  */
 export declare const MAX_WEBCHAT_ATTACHMENT_FILE_BYTES: number;
-/** Upper bound for `POST /api/agent` JSON body when every slot is a max-sized binary attachment (base64 ~4/3). */
-export declare function maxWebchatAgentRequestBodyBytes(): number;
+export declare function validateWebchatAttachments(attachments: unknown[] | undefined): string | null;
+export declare function validateWebchatContent(content: unknown): string | null;
+/** Upper bound for a session input request when every attachment is encoded as base64. */
+export declare function maxSessionInputRequestBodyBytes(): number;

package/dist/src/gateway/chat-limits.js

@@ -1,15 +1,29 @@
 //#region src/gateway/chat-limits.ts
 /** Web chat: max files per user message (keep in sync with `web` MAX_CHAT_ATTACHMENTS). */
 const MAX_CHAT_ATTACHMENTS = 10;
+/** Inline chat text stays bounded; larger content belongs in an attachment. */
+const MAX_CHAT_INLINE_TEXT_BYTES = 256 * 1024;
 /**
 * Max raw bytes per attachment in web chat (keep in sync with `web` MAX_WEBCHAT_ATTACHMENT_FILE_BYTES).
 * JSON requests send base64 (`data`); gateway body limit must allow worst-case payload.
 */
 const MAX_WEBCHAT_ATTACHMENT_FILE_BYTES = 32 * 1024 * 1024;
-/** Upper bound for `POST /api/agent` JSON body when every slot is a max-sized binary attachment (base64 ~4/3). */
-function maxWebchatAgentRequestBodyBytes() {
+function validateWebchatAttachments(attachments) {
+	if (!attachments) return null;
+	if (attachments.length > 10) return `Too many attachments (maximum 10)`;
+	const maxBase64Length = 4 * Math.ceil(MAX_WEBCHAT_ATTACHMENT_FILE_BYTES / 3);
+	if (attachments.some((item) => item && typeof item === "object" && typeof item.data === "string" && item.data.length > maxBase64Length)) return `Attachment exceeds maximum size (${MAX_WEBCHAT_ATTACHMENT_FILE_BYTES} bytes)`;
+	return null;
+}
+function validateWebchatContent(content) {
+	if (typeof content !== "string") return "Message content must be a string";
+	if (Buffer.byteLength(content, "utf8") > 262144) return `Message content exceeds maximum size (${MAX_CHAT_INLINE_TEXT_BYTES} bytes)`;
+	return null;
+}
+/** Upper bound for a session input request when every attachment is encoded as base64. */
+function maxSessionInputRequestBodyBytes() {
 	const rawMax = MAX_WEBCHAT_ATTACHMENT_FILE_BYTES * 10;
 	return Math.ceil(rawMax * 4 / 3) + 1024 * 1024;
 }
 //#endregion
-export { MAX_CHAT_ATTACHMENTS, MAX_WEBCHAT_ATTACHMENT_FILE_BYTES, maxWebchatAgentRequestBodyBytes };
+export { MAX_CHAT_ATTACHMENTS, MAX_CHAT_INLINE_TEXT_BYTES, MAX_WEBCHAT_ATTACHMENT_FILE_BYTES, maxSessionInputRequestBodyBytes, validateWebchatAttachments, validateWebchatContent };

package/dist/src/gateway/chat-stream/thinking-delta-coalescer.js

@@ -56,13 +56,13 @@ async function* coalesceThinkingDeltas(source, options = {}) {
 				}
 				continue;
 			}
-			const outcome = await nextBeforeDeadline(next, deadlineAt);
-			if (outcome.kind === "timeout") {
+			const task = await nextBeforeDeadline(next, deadlineAt);
+			if (task.kind === "timeout") {
 				yield pending;
 				pending = void 0;
 				continue;
 			}
-			const result = outcome.result;
+			const result = task.result;
 			if (result.done) {
 				yield pending;
 				pending = void 0;

package/dist/src/gateway/dreaming-automation-reconciler.js

@@ -1,42 +1,42 @@
-import { DREAMING_CRON_NAME, DREAMING_CRON_TAG, DREAMING_LIGHT_CRON_NAME, DREAMING_LIGHT_SWEEP_TOKEN, DREAMING_REM_CRON_NAME, DREAMING_REM_SWEEP_TOKEN, DREAMING_SWEEP_TOKEN } from "../agent/memory/dreaming/constants.js";
-import { resolveDreamingConfig } from "../agent/memory/dreaming/config.js";
+import { DREAMING_AUTOMATION_TAG, DREAMING_DEEP_AUTOMATION_NAME, DREAMING_LIGHT_AUTOMATION_NAME, DREAMING_LIGHT_SWEEP_TOKEN, DREAMING_REM_AUTOMATION_NAME, DREAMING_REM_SWEEP_TOKEN, DREAMING_SWEEP_TOKEN } from "../agent/memory/dreaming/constants.js";
+import { compileDreamingSchedule } from "../agent/memory/dreaming/schedule.js";
 import { resolveDreamingAgentScope } from "../agent/memory/dreaming/scope.js";
 //#region src/gateway/dreaming-automation-reconciler.ts
 const DREAMING_AUTOMATIONS = [
 	{
 		phase: "light",
-		name: DREAMING_LIGHT_CRON_NAME,
+		name: DREAMING_LIGHT_AUTOMATION_NAME,
 		token: DREAMING_LIGHT_SWEEP_TOKEN
 	},
 	{
 		phase: "deep",
-		name: DREAMING_CRON_NAME,
+		name: DREAMING_DEEP_AUTOMATION_NAME,
 		token: DREAMING_SWEEP_TOKEN
 	},
 	{
 		phase: "rem",
-		name: DREAMING_REM_CRON_NAME,
+		name: DREAMING_REM_AUTOMATION_NAME,
 		token: DREAMING_REM_SWEEP_TOKEN
 	}
 ];
 function phaseDescription(phase) {
-	return `${phase === "light" ? "Light sweep" : phase === "deep" ? "Deep promotion" : "REM pattern discovery"} for memory dreaming. ${DREAMING_CRON_TAG}`;
+	return `${phase === "light" ? "Light sweep" : phase === "deep" ? "Deep promotion" : "REM pattern discovery"} for memory dreaming. ${DREAMING_AUTOMATION_TAG}`;
 }
 function buildTrigger(config, phase) {
+	const phaseConfig = config.phases[phase];
 	return {
 		kind: "schedule",
 		schedule: {
 			kind: "cron",
-			expr: config.phases[phase].cron,
-			...config.timezone ? { tz: config.timezone } : {}
+			expr: compileDreamingSchedule(phaseConfig.schedule),
+			tz: config.timezone
 		}
 	};
 }
 function dreamingAutomationId(phase) {
 	return `system-user-context-dreaming:${phase}`;
 }
-function buildAction(config, token) {
-	const scope = resolveDreamingAgentScope(config);
+function buildAction(scope, token) {
 	return {
 		kind: "agent",
 		agentId: scope.agentId,
@@ -55,7 +55,8 @@ async function reconcileDreamingAutomations(params) {
 		updated: [],
 		disabled: []
 	};
-	const resolved = resolveDreamingConfig(config);
+	const scope = resolveDreamingAgentScope(config);
+	const resolved = scope.config;
 	for (const spec of DREAMING_AUTOMATIONS) {
 		const id = dreamingAutomationId(spec.phase);
 		const current = await automationService.get(id);
@@ -72,7 +73,7 @@ async function reconcileDreamingAutomations(params) {
 			description: phaseDescription(spec.phase),
 			enabled,
 			trigger: buildTrigger(resolved, spec.phase),
-			action: buildAction(config, spec.token)
+			action: buildAction(scope, spec.token)
 		};
 		if (!current) {
 			await automationService.create({

package/dist/src/gateway/hono/app.js

@@ -4,15 +4,13 @@ import { resolveAllowedBrowserOrigins, resolveGatewayServiceListenPort } from ".
 import { resolveGatewayEffectiveHost } from "../../config/gateway-bind.js";
 import { loadTunnelState } from "../../tunnel/tunnel-state.js";
 import { resolveReverseProxyPublicUrl } from "../public-url.js";
-import "../../work-items/work-item-service.js";
-import "../../work-items/index.js";
-import { maxWebchatAgentRequestBodyBytes } from "../chat-limits.js";
+import { maxSessionInputRequestBodyBytes } from "../chat-limits.js";
 import { isLoopbackIpAddress, isTrustedProxyAddress } from "../client-ip.js";
 import { buildGatewayConsoleCspHeader } from "../security/csp.js";
 import { checkBrowserOrigin } from "../security/origin-check.js";
 import { auth } from "./middleware/auth.js";
 import { operatorScopes } from "./middleware/scopes.js";
-import { createChannelRateLimitMiddleware, createStrictRateLimitMiddleware, createXopcCloudPollRateLimitMiddleware } from "./middleware/strict-rate-limit.js";
+import { createChannelRateLimitMiddleware, createChatRateLimitMiddleware, createStrictRateLimitMiddleware, createXopcCloudPollRateLimitMiddleware } from "./middleware/strict-rate-limit.js";
 import { logContextMiddleware } from "./middleware/log-context.js";
 import { logger } from "./middleware/logger.js";
 import { routeErrorMiddleware } from "./middleware/route-errors.js";
@@ -149,7 +147,7 @@ function createHonoApp(config) {
 	const SKILL_UPLOAD_BODY_MAX = 10 * 1024 * 1024;
 	const NOTE_MEDIA_BODY_MAX = 25 * 1024 * 1024;
 	const VOICE_TRANSCRIBE_BODY_MAX = 35 * 1024 * 1024;
-	const WEBCHAT_AGENT_BODY_MAX = maxWebchatAgentRequestBodyBytes();
+	const SESSION_INPUT_BODY_MAX = maxSessionInputRequestBodyBytes();
 	const isNoteMediaUploadRequest = (path, method, contentType) => {
 		if (method !== "POST") return false;
 		if (/^\/api\/notes\/[^/]+\/media$/.test(path)) return true;
@@ -160,10 +158,6 @@ function createHonoApp(config) {
 		if (/^\/api\/discussions\/[^/]+\/recording$/.test(path)) return NOTE_MEDIA_BODY_MAX;
 		if (/^\/api\/discussions\/[^/]+\/segments\/\d+$/.test(path)) return 2 * 1024 * 1024;
 	};
-	const isWorkItemAttachmentUploadRequest = (path, method, contentType) => {
-		if (method !== "POST" || contentType?.includes("multipart/form-data") !== true) return false;
-		return /^\/api\/work-items\/[^/]+\/attachments$/.test(path) || /^\/api\/projects\/[^/]+\/work-items$/.test(path);
-	};
 	app.use("/api/skills/upload", bodyLimit({
 		maxSize: SKILL_UPLOAD_BODY_MAX,
 		onError: (c) => {
@@ -179,7 +173,7 @@ function createHonoApp(config) {
 	}));
 	app.use("/api/*", async (c, next) => {
 		const contentType = c.req.header("content-type");
-		const maxSize = c.req.path === "/api/agent" ? WEBCHAT_AGENT_BODY_MAX : c.req.path === "/api/skills/upload" ? SKILL_UPLOAD_BODY_MAX : c.req.path === "/api/voice/transcribe" || c.req.path === "/api/voice/transcriptions" ? VOICE_TRANSCRIBE_BODY_MAX : isNoteMediaUploadRequest(c.req.path, c.req.method, contentType) ? NOTE_MEDIA_BODY_MAX : discussionUploadBodyMax(c.req.path, c.req.method, contentType) ?? (isWorkItemAttachmentUploadRequest(c.req.path, c.req.method, contentType) ? 263192576 : DEFAULT_API_BODY_MAX);
+		const maxSize = c.req.method === "POST" && c.req.path === "/api/tasks" || c.req.method === "POST" && /^\/api\/sessions\/[^/]+\/inputs$/.test(c.req.path) || c.req.method === "PATCH" && /^\/api\/sessions\/[^/]+\/inputs\/[^/]+$/.test(c.req.path) ? SESSION_INPUT_BODY_MAX : c.req.path === "/api/skills/upload" ? SKILL_UPLOAD_BODY_MAX : c.req.path === "/api/voice/transcribe" || c.req.path === "/api/voice/transcriptions" ? VOICE_TRANSCRIBE_BODY_MAX : isNoteMediaUploadRequest(c.req.path, c.req.method, contentType) ? NOTE_MEDIA_BODY_MAX : discussionUploadBodyMax(c.req.path, c.req.method, contentType) ?? DEFAULT_API_BODY_MAX;
 		const maxSizeMb = Math.ceil(maxSize / (1024 * 1024));
 		return bodyLimit({
 			maxSize,
@@ -213,6 +207,10 @@ function createHonoApp(config) {
 		trustedProxies: service.currentConfig.gateway?.trustedProxies,
 		allowRealIpFallback: service.currentConfig.gateway?.allowRealIpFallback === true
 	}) });
+	const chatRateLimitMiddleware = createChatRateLimitMiddleware({ getTrustedProxyContext: () => ({
+		trustedProxies: service.currentConfig.gateway?.trustedProxies,
+		allowRealIpFallback: service.currentConfig.gateway?.allowRealIpFallback === true
+	}) });
 	const channelRateLimitMiddleware = createChannelRateLimitMiddleware({ getTrustedProxyContext: () => ({
 		trustedProxies: service.currentConfig.gateway?.trustedProxies,
 		allowRealIpFallback: service.currentConfig.gateway?.allowRealIpFallback === true
@@ -220,6 +218,7 @@ function createHonoApp(config) {
 	registerAuthenticatedRoutes(app, authenticated, {
 		service,
 		strictRateLimitMiddleware,
+		chatRateLimitMiddleware,
 		xopcCloudPollRateLimitMiddleware: createXopcCloudPollRateLimitMiddleware({ getTrustedProxyContext: () => ({
 			trustedProxies: service.currentConfig.gateway?.trustedProxies,
 			allowRealIpFallback: service.currentConfig.gateway?.allowRealIpFallback === true

package/dist/src/gateway/hono/index.d.ts

@@ -1,2 +1,2 @@
 export { createHonoApp, type HonoAppConfig } from './app.js';
-export { createAgentSSEHandler, createAgentResumeHandler, createSendHandler, createEventsSSEHandler, type SSEHandlerConfig } from './sse.js';
+export { createAgentResumeHandler, createSendHandler, createEventsSSEHandler, type SSEHandlerConfig } from './sse.js';

package/dist/src/gateway/hono/index.js

@@ -1,3 +1,3 @@
-import { createAgentResumeHandler, createAgentSSEHandler, createEventsSSEHandler, createSendHandler } from "./sse.js";
+import { createAgentResumeHandler, createEventsSSEHandler, createSendHandler } from "./sse.js";
 import { createHonoApp } from "./app.js";
-export { createAgentResumeHandler, createAgentSSEHandler, createEventsSSEHandler, createHonoApp, createSendHandler };
+export { createAgentResumeHandler, createEventsSSEHandler, createHonoApp, createSendHandler };

package/dist/src/gateway/hono/lib/config-payload.d.ts

@@ -41,8 +41,8 @@ export declare function buildSafeWebConfigPayload(service: GatewayService, optio
                 root: string;
             };
             models: {
-                defaultRole: string;
-                roles: Record<string, {
+                defaultRole?: string;
+                roles?: Record<string, {
                     model: string;
                     fallbacks?: string[];
                     description?: string;
@@ -65,7 +65,7 @@ export declare function buildSafeWebConfigPayload(service: GatewayService, optio
                 };
             };
             tools: {
-                builtin: Record<string, {
+                builtin?: Record<string, {
                     mode: "allow" | "confirm" | "deny";
                     scope?: "workspace" | "readonly" | "unrestricted";
                     limits?: {
@@ -106,9 +106,9 @@ export declare function buildSafeWebConfigPayload(service: GatewayService, optio
                 }[];
             };
             boundaries: {
-                requiresConfirmation: string[];
-                forbidden: string[];
-                escalation: string[];
+                requiresConfirmation?: string[];
+                forbidden?: string[];
+                escalation?: string[];
             };
         }[];
         capabilityPresets: Record<string, {
@@ -142,7 +142,7 @@ export declare function buildSafeWebConfigPayload(service: GatewayService, optio
                 };
             };
             tools?: {
-                builtin: Record<string, {
+                builtin?: Record<string, {
                     mode: "allow" | "confirm" | "deny";
                     scope?: "workspace" | "readonly" | "unrestricted";
                     limits?: {
@@ -183,9 +183,9 @@ export declare function buildSafeWebConfigPayload(service: GatewayService, optio
                 }[];
             };
             boundaries?: {
-                requiresConfirmation: string[];
-                forbidden: string[];
-                escalation: string[];
+                requiresConfirmation?: string[];
+                forbidden?: string[];
+                escalation?: string[];
             };
             runtime?: {
                 maxTurns?: number;
@@ -280,29 +280,6 @@ export declare function buildSafeWebConfigPayload(service: GatewayService, optio
         dialogPolicy: unknown;
         dialogTimeoutSeconds: number;
     };
-    goals: {
-        maxTurns: number;
-        checklistMode: boolean;
-        checklistDecomposePolicy: "empty_only" | "supplement_existing";
-        maxConsecutiveParseFailures: number;
-        judgeTimeoutMs: number;
-        checklistHistoryChars: number;
-        notifications: {
-            enabled: boolean;
-            includeLinkedSessions: boolean;
-            channels: string[];
-            events: ("done" | "blocked" | "needs_input" | "queue_failed" | "queue_retry" | "queue_succeeded" | "queue_skipped")[];
-            targets: {
-                channel: string;
-                chatId: string;
-                accountId?: string;
-                threadId?: string | number;
-                silent?: boolean;
-                events?: ("done" | "blocked" | "needs_input" | "queue_failed" | "queue_retry" | "queue_succeeded" | "queue_skipped")[];
-            }[];
-        };
-        judgeModelRef?: string;
-    };
     session: {
         dmScope: "main" | "per-peer" | "per-channel-peer" | "per-account-channel-peer";
         storage: {
@@ -311,6 +288,9 @@ export declare function buildSafeWebConfigPayload(service: GatewayService, optio
         };
     };
     userContext: {
+        preferences: {
+            responseLanguage: "auto" | "zh-CN" | "en";
+        };
         memory: {
             retention: {
                 compaction: {
@@ -362,11 +342,11 @@ export declare function buildSafeWebConfigPayload(service: GatewayService, optio
     stt: unknown;
     tts: unknown;
     voice: {
-        languageMode?: "auto" | "manual";
+        languageMode?: "manual" | "auto";
         language?: "en" | "zh";
         input?: {
             refinement?: {
-                mode: "off" | "custom" | "light" | "punctuation";
+                mode: "off" | "light" | "custom" | "punctuation";
                 model?: string;
                 customInstruction?: string;
             };

package/dist/src/gateway/hono/lib/config-payload.js

@@ -9,7 +9,7 @@ import { getAllProviders, init_providers, isProviderConfigured } from "../../../
 import { resolveShareConfig } from "../../../share/share-config.js";
 import { maskTunnelSecretForWeb } from "../../../tunnel/env.js";
 import { normalizeConfiguredMcpServers } from "../../../config/mcp-config-normalize.js";
-import { resolveGoalsConfigForWeb, resolveSessionConfigForWeb, resolveUpdateConfigForWeb } from "../../../config/web-patch.js";
+import { resolveSessionConfigForWeb, resolveUpdateConfigForWeb } from "../../../config/web-patch.js";
 import { GENERIC_MASKED_SECRET, maskSecretLength } from "./mask-secret-length.js";
 import { safeToolsWebForGet } from "../../config-tools-web.js";
 import { buildSafeProvidersConfigForWeb } from "./safe-providers-config.js";
@@ -176,9 +176,11 @@ async function buildSafeWebConfigPayload(service, options = {}) {
 			skillsStoreBaseUrl: config.gateway?.skillsStoreBaseUrl ?? "https://store.xopc.ai"
 		},
 		browser: buildSafeBrowserConfigForWeb(config.browser),
-		goals: resolveGoalsConfigForWeb(config),
 		session: resolveSessionConfigForWeb(config),
-		userContext: { memory: { retention: { compaction: ContextCompactionPolicySchema.parse(config.userContext?.memory.retention?.compaction) } } },
+		userContext: {
+			preferences: config.userContext?.preferences ?? { responseLanguage: "auto" },
+			memory: { retention: { compaction: ContextCompactionPolicySchema.parse(config.userContext?.memory.retention?.compaction) } }
+		},
 		tui: { defaultAgent: config.tui?.defaultAgent ?? "coder" },
 		tunnel: {
 			enabled: config.tunnel?.enabled === true,

package/dist/src/gateway/hono/middleware/strict-rate-limit.d.ts

@@ -12,6 +12,10 @@ export declare function createStrictRateLimitMiddleware(deps: StrictRateLimitDep
     error: string;
     code: string;
 }, 429, "json">>;
+export declare function createChatRateLimitMiddleware(deps: StrictRateLimitDeps): import("hono").MiddlewareHandler<any, string, {}, Response & import("hono").TypedResponse<{
+    error: string;
+    code: string;
+}, 429, "json">>;
 export declare function createXopcCloudPollRateLimitMiddleware(deps: StrictRateLimitDeps): import("hono").MiddlewareHandler<any, string, {}, Response & import("hono").TypedResponse<{
     error: string;
     code: string;

package/dist/src/gateway/hono/middleware/strict-rate-limit.js

@@ -63,6 +63,13 @@ function createStrictRateLimitMiddleware(deps) {
 		reason: "strict_rate_limit_exceeded"
 	});
 }
+function createChatRateLimitMiddleware(deps) {
+	return createClientRateLimitMiddleware(deps, {
+		limiter: () => buckets.chatApi(),
+		exceededMessage: "Chat API rate limit exceeded",
+		reason: "chat_rate_limit_exceeded"
+	});
+}
 function createXopcCloudPollRateLimitMiddleware(deps) {
 	return createClientRateLimitMiddleware(deps, {
 		limiter: () => buckets.xopcCloudPoll(),
@@ -78,4 +85,4 @@ function createChannelRateLimitMiddleware(deps) {
 	});
 }
 //#endregion
-export { createChannelRateLimitMiddleware, createStrictRateLimitMiddleware, createXopcCloudPollRateLimitMiddleware };
+export { createChannelRateLimitMiddleware, createChatRateLimitMiddleware, createStrictRateLimitMiddleware, createXopcCloudPollRateLimitMiddleware };

package/dist/src/gateway/hono/oauth-async.js

@@ -275,13 +275,7 @@ async function runOAuthFlow(session, oauthProvider, _service) {
 	try {
 		const credentials = await oauthProvider.login(callbacks);
 		setOAuthCredentialsToCache(session.provider, credentials);
-		await new CredentialResolver().saveOAuthToken(session.provider, {
-			access: oauthProvider.getApiKey(credentials),
-			refresh: credentials.refresh,
-			expiresAt: credentials.expires,
-			scope: Array.isArray(credentials.scope) ? credentials.scope.filter((value) => typeof value === "string") : void 0,
-			createdAt: (/* @__PURE__ */ new Date()).toISOString()
-		});
+		await new CredentialResolver().saveOAuthCredentials(session.provider, credentials);
 		session.status = "completed";
 		session.credentials = credentials;
 		session.message = "OAuth login successful";

package/dist/src/gateway/hono/oauth.js

@@ -74,13 +74,7 @@ function createOAuthHandler(_service) {
 				}
 			});
 			setOAuthCredentialsToCache(provider, credentials);
-			await new CredentialResolver().saveOAuthToken(provider, {
-				access: oauthProvider.getApiKey(credentials),
-				refresh: credentials.refresh,
-				expiresAt: credentials.expires,
-				scope: Array.isArray(credentials.scope) ? credentials.scope.filter((value) => typeof value === "string") : void 0,
-				createdAt: (/* @__PURE__ */ new Date()).toISOString()
-			});
+			await new CredentialResolver().saveOAuthCredentials(provider, credentials);
 			return c.json({
 				ok: true,
 				payload: {

package/dist/src/gateway/hono/routes/activity.js

@@ -4,9 +4,8 @@ import "../../../activity/index.js";
 const ACTIVITY_OBJECT_KINDS = new Set([
 	"project",
 	"note",
-	"work_item",
 	"session",
-	"goal",
+	"task",
 	"workflow_run",
 	"automation"
 ]);