@xopcai/xopc 0.0.187 → 0.0.189

package/dist/src/extensions/extension-registry-impl.js

@@ -11,6 +11,7 @@ var ExtensionRegistryImpl = class {
 	services = /* @__PURE__ */ new Map();
 	gatewayMethods = /* @__PURE__ */ new Map();
 	tools = /* @__PURE__ */ new Map();
+	toolExtensionIds = /* @__PURE__ */ new Map();
 	channelPlugins = [];
 	cliRegistrations = [];
 	reloadRegistrations = [];
@@ -64,12 +65,14 @@ var ExtensionRegistryImpl = class {
 	getGatewayMethod(method) {
 		return this.gatewayMethods.get(method);
 	}
-	addTool(tool) {
+	addTool(tool, extensionId) {
 		if (this.tools.has(tool.name)) log.warn({ tool: tool.name }, `Tool already registered, overwriting`);
 		this.tools.set(tool.name, tool);
+		this.toolExtensionIds.set(tool.name, extensionId);
 	}
 	removeTool(name) {
 		this.tools.delete(name);
+		this.toolExtensionIds.delete(name);
 	}
 	getTools() {
 		return this.tools;
@@ -77,6 +80,9 @@ var ExtensionRegistryImpl = class {
 	getTool(name) {
 		return this.tools.get(name);
 	}
+	getToolExtensionId(name) {
+		return this.toolExtensionIds.get(name);
+	}
 	getAllTools() {
 		return Array.from(this.tools.values());
 	}

package/dist/src/extensions/loader.js

@@ -441,7 +441,7 @@ var ExtensionLoader = class {
 				source: config.source
 			});
 			const extensionTools = api._getTools();
-			for (const tool of extensionTools.values()) this.registry.addTool(tool);
+			for (const tool of extensionTools.values()) this.registry.addTool(tool, config.id);
 			this.extensionInstances.set(config.id, api);
 			this.cache.set(cacheKey, api);
 			this.diagnostics.info(config.id, `Loaded extension: ${manifest.name}`);

package/dist/src/extensions/types/core.d.ts

@@ -237,9 +237,10 @@ export interface ExtensionService {
     stop?: () => void | Promise<void>;
 }
 export interface ExtensionRegistry {
-    addTool(tool: AgentTool): void;
+    addTool(tool: AgentTool, extensionId: string): void;
     getTools(): Map<string, AgentTool>;
     getTool(name: string): AgentTool | undefined;
+    getToolExtensionId(name: string): string | undefined;
     getAllTools(): AgentTool[];
     getCommand(name: string): ExtensionCommand | undefined;
     addCliRegistration(reg: ExtensionCliRegistration): void;

package/dist/src/extensions/types/hooks.d.ts

@@ -246,7 +246,7 @@ export interface WebchatTurnCompleteEvent extends HookContext {
     inboundUserText: string;
     /** Last assistant visible text after persistence (may be empty). */
     assistantPlainText: string;
-    /** User aborted the HTTP/SSE run. */
+    /** User aborted the realtime run. */
     aborted: boolean;
     /** Set when the direct stream threw before normal completion. */
     streamError?: string;

package/dist/src/gateway/agent-builtin-tools.d.ts

@@ -2,5 +2,5 @@
  * Built-in agent tool `name` values for gateway admin UI (disable toggles).
  * Extension tools are not listed; users can still add arbitrary strings in config.
  */
-export declare const GATEWAY_BUILTIN_TOOL_IDS: readonly ["code_search", "code_read_symbol", "code_trace", "code_impact", "code_architecture", "read_file", "write_file", "apply_patch", "list_dir", "grep", "find", "exec_command", "update_plan", "session_status", "dreaming", "tool_manual", "clarify", "todo", "skills_list", "skill_view", "skill_manage", "skills_marketplace_search", "skill_install", "web_search", "web_fetch", "web_extract", "send_message", "send_media", "read_media", "create_share", "text_to_speech", "memory_search", "memory_get", "session_search", "automation", "workflow", "delegate_task", "execute_code", "image", "image_generate", "create_desktop_pet", "browser_use", "extensions", "bundle-mcp"];
+export declare const GATEWAY_BUILTIN_TOOL_IDS: readonly ["code_search", "code_read_symbol", "code_trace", "code_impact", "code_architecture", "read_file", "write_file", "apply_patch", "list_dir", "grep", "find", "exec_command", "update_plan", "session_status", "dreaming", "tool_manual", "clarify", "todo", "skills_list", "skill_view", "skill_manage", "skills_marketplace_search", "skill_install", "web_search", "web_fetch", "web_extract", "send_message", "send_media", "read_media", "create_share", "text_to_speech", "memory_search", "memory_get", "session_search", "automation", "workflow", "delegate_task", "execute_code", "image", "image_generate", "create_desktop_pet", "browser_use", "xopc_tool_search", "xopc_tool_describe", "xopc_tool_execute"];
 export type GatewayBuiltinToolId = (typeof GATEWAY_BUILTIN_TOOL_IDS)[number];

package/dist/src/gateway/agent-builtin-tools.js

@@ -1,3 +1,5 @@
+import { EXTERNAL_TOOL_NAMES } from "../agent/external-tools/gateway-tools.js";
+import "../agent/external-tools/index.js";
 //#region src/gateway/agent-builtin-tools.ts
 /**
 * Built-in agent tool `name` values for gateway admin UI (disable toggles).
@@ -46,8 +48,9 @@ const GATEWAY_BUILTIN_TOOL_IDS = [
 	"image_generate",
 	"create_desktop_pet",
 	"browser_use",
-	"extensions",
-	"bundle-mcp"
+	EXTERNAL_TOOL_NAMES.search,
+	EXTERNAL_TOOL_NAMES.describe,
+	EXTERNAL_TOOL_NAMES.execute
 ];
 //#endregion
 export { GATEWAY_BUILTIN_TOOL_IDS };

package/dist/src/gateway/chat-stream/mapper.js

@@ -1,3 +1,4 @@
+import { resolveToolActivity } from "../../../packages/gateway-contract/src/tool-activity.js";
 import { createPetFeedback } from "./pet-feedback.js";
 //#region src/gateway/chat-stream/mapper.ts
 let lastTaskPlanRevision = 0;
@@ -252,6 +253,7 @@ var ChatStreamMapper = class {
 		}
 		events.push(this.make("assistant_message_end", {
 			messageId,
+			presentation: hasToolCall(message) ? "narration" : "answer",
 			usage: extractUsage(message)
 		}));
 		this.lastAssistantMessageId = messageId;
@@ -270,7 +272,8 @@ var ChatStreamMapper = class {
 			messageId,
 			toolCallId,
 			toolName,
-			args: event.args
+			args: event.args,
+			activity: resolveToolActivity(toolName, "running")
 		})];
 		if (toolName === "exec_command") {
 			const args = asRecord(event.args);
@@ -324,6 +327,7 @@ var ChatStreamMapper = class {
 			toolCallId,
 			toolName,
 			status: event.isError ? "error" : "success",
+			activity: resolveToolActivity(toolName, event.isError ? "failed" : "completed", result),
 			result,
 			errorMessage: event.isError ? result?.text : void 0
 		})];
@@ -431,6 +435,17 @@ function userMessageFromEvent(event) {
 function extractTextFromMessage(message) {
 	return extractText(message.content);
 }
+function hasToolCall(message) {
+	const raw = message;
+	if (Array.isArray(raw.toolCalls) && raw.toolCalls.length > 0) return true;
+	if (Array.isArray(raw.tool_calls) && raw.tool_calls.length > 0) return true;
+	if (!Array.isArray(raw.content)) return false;
+	return raw.content.some((block) => {
+		if (!block || typeof block !== "object") return false;
+		const type = block.type;
+		return type === "toolCall" || type === "tool_call" || type === "tool_use";
+	});
+}
 function extractReview(message) {
 	const metadata = message.metadata;
 	const metadataReview = asRecord(metadata)?.review;

package/dist/src/gateway/chat-stream/protocol.d.ts

@@ -1,3 +1,4 @@
+import type { ToolActivity } from '@xopcai/gateway-contract';
 export type ChatStreamStatus = 'success' | 'error' | 'cancelled';
 export type PetFeedbackTaskState = 'working' | 'waiting' | 'success' | 'error';
 export type PetFeedbackSensitivity = 'public' | 'private';
@@ -23,7 +24,6 @@ export type PetFeedback = {
 };
 export interface ChatStreamEnvelope<TType extends string, TPayload> {
     type: TType;
-    seq?: number;
     runId: string;
     sessionKey: string;
     timestamp: number;
@@ -58,6 +58,7 @@ export type ToolStartEvent = ChatStreamEnvelope<'tool_start', {
     toolCallId: string;
     toolName: string;
     args?: unknown;
+    activity: ToolActivity;
 }>;
 export type ToolUpdateEvent = ChatStreamEnvelope<'tool_update', {
     messageId: string;
@@ -71,6 +72,7 @@ export type ToolEndEvent = ChatStreamEnvelope<'tool_end', {
     toolCallId: string;
     toolName: string;
     status: ChatStreamStatus;
+    activity: ToolActivity;
     result?: {
         content?: unknown[];
         details?: unknown;
@@ -163,6 +165,7 @@ export type ReviewEvent = ChatStreamEnvelope<'review', {
 }>;
 export type AssistantMessageEndEvent = ChatStreamEnvelope<'assistant_message_end', {
     messageId: string;
+    presentation: 'narration' | 'answer';
     usage?: {
         inputTokens?: number;
         outputTokens?: number;

package/dist/src/gateway/clarify-bridge.d.ts

@@ -1,4 +1,6 @@
-import type { AgentRunRelay, RelayEvent } from './agent-run-relay.js';
+export type ClarifyStreamEvent = {
+    type: string;
+} & Record<string, unknown>;
 /** User inactivity window before pending clarification is rejected (web/Telegram, etc.). */
 export declare const CLARIFY_USER_RESPONSE_TIMEOUT_MS: number;
 export interface ClarifyBridgeRequest {
@@ -8,10 +10,9 @@ export interface ClarifyBridgeRequest {
 }
 export interface StartClarifyRequestOptions {
     sessionKey: string;
-    /** Present for in-flight webchat runs (SSE + relay). */
+    /** Present for in-flight webchat runs. */
     runId?: string;
-    relay: AgentRunRelay;
-    publishSse?: (event: RelayEvent) => void;
+    publishStream?: (event: ClarifyStreamEvent) => void;
     request: ClarifyBridgeRequest;
     /** e.g. Telegram inline keyboard + prompt message */
     deliver?: (ctx: {

package/dist/src/gateway/clarify-bridge.js

@@ -14,7 +14,7 @@ var ClarifyBridge = class {
 	/** sessionKey → requestId when waiting for a free-text reply (no multiple-choice). */
 	pendingFreeTextBySession = /* @__PURE__ */ new Map();
 	startRequest(opts) {
-		const { sessionKey, runId, relay, publishSse, request, deliver } = opts;
+		const { sessionKey, runId, publishStream, request, deliver } = opts;
 		const requestId = crypto.randomUUID();
 		const hasChoices = Array.isArray(request.choices) && request.choices.length >= 2;
 		const needsFreeText = !hasChoices;
@@ -44,14 +44,13 @@ var ClarifyBridge = class {
 				default: request.default,
 				petFeedback: createPetFeedback("clarify")
 			};
-			if (runId) relay.publish(runId, payload);
 			try {
-				publishSse?.(payload);
+				if (runId) publishStream?.(payload);
 			} catch (err) {
 				log.warn({
 					err,
 					requestId
-				}, "clarify SSE publish failed");
+				}, "Clarify stream publication failed");
 			}
 			if (deliver) deliver({
 				sessionKey,

package/dist/src/gateway/file-reference-errors.d.ts

@@ -0,0 +1,6 @@
+export type FileReferenceFsError = {
+    code: 'FILE_NOT_FOUND' | 'FILE_ACCESS_DENIED' | 'FILE_ACCESS_FAILED';
+    message: string;
+    status: 404 | 403 | 500;
+};
+export declare function classifyFileReferenceFsError(err: unknown): FileReferenceFsError;

package/dist/src/gateway/file-reference-errors.js

@@ -0,0 +1,21 @@
+//#region src/gateway/file-reference-errors.ts
+function classifyFileReferenceFsError(err) {
+	const code = err?.code;
+	if (code === "ENOENT" || code === "ENOTDIR") return {
+		code: "FILE_NOT_FOUND",
+		message: "File not found",
+		status: 404
+	};
+	if (code === "EACCES" || code === "EPERM") return {
+		code: "FILE_ACCESS_DENIED",
+		message: "Gateway does not have permission to access this file",
+		status: 403
+	};
+	return {
+		code: "FILE_ACCESS_FAILED",
+		message: "Gateway could not access this file",
+		status: 500
+	};
+}
+//#endregion
+export { classifyFileReferenceFsError };

package/dist/src/gateway/heartbeat/service.js

@@ -1,9 +1,9 @@
 import { createLogger } from "../../utils/logger/index.js";
 import { init_logger } from "../../utils/logger.js";
 import { shouldSilence, stripHeartbeatToken } from "../../heartbeat/tokens.js";
-import { appendCronEventLines } from "../../heartbeat/event-prompt.js";
 import { isWithinActiveHours } from "../../heartbeat/active-hours.js";
 import { isHeartbeatContentEmpty } from "../../heartbeat/content-check.js";
+import { appendCronEventLines } from "../../heartbeat/event-prompt.js";
 import { createHeartbeatWake } from "../../heartbeat/wake.js";
 import { resolveHeartbeatMdPath } from "../workspace-heartbeat-path.js";
 import { readFile } from "fs/promises";
@@ -138,7 +138,10 @@ var HeartbeatService = class {
 		}
 		let reply;
 		try {
-			reply = await this.deps.agentService.turnDispatcher.processDirect(prompt, sessionKey);
+			reply = await this.deps.agentService.turnDispatcher.processDirect(prompt, sessionKey, {
+				type: "system",
+				source: "heartbeat"
+			});
 		} catch (error) {
 			log.error({ err: error }, "Heartbeat: agent call failed");
 			return;

package/dist/src/gateway/hono/app.js

@@ -223,11 +223,7 @@ function createHonoApp(config) {
 			trustedProxies: service.currentConfig.gateway?.trustedProxies,
 			allowRealIpFallback: service.currentConfig.gateway?.allowRealIpFallback === true
 		}) }),
-		channelRateLimitMiddleware,
-		sseConfig: {
-			service,
-			maxSseConnections: service.currentConfig.gateway.maxSseConnections
-		}
+		channelRateLimitMiddleware
 	});
 	const prewarm = prewarmStaticUiCache();
 	if (prewarm.loaded > 0) log.debug({

package/dist/src/gateway/hono/index.d.ts

@@ -1,2 +1 @@
 export { createHonoApp, type HonoAppConfig } from './app.js';
-export { createAgentResumeHandler, createSendHandler, createEventsSSEHandler, type SSEHandlerConfig } from './sse.js';

package/dist/src/gateway/hono/index.js

@@ -1,3 +1,2 @@
-import { createAgentResumeHandler, createEventsSSEHandler, createSendHandler } from "./sse.js";
 import { createHonoApp } from "./app.js";
-export { createAgentResumeHandler, createEventsSSEHandler, createHonoApp, createSendHandler };
+export { createHonoApp };

package/dist/src/gateway/hono/lib/config-payload.d.ts

@@ -209,7 +209,7 @@ export declare function buildSafeWebConfigPayload(service: GatewayService, optio
     /** Masked `cfg.providers` for capability keys (image / STT / etc.). */
     providersConfig: Record<string, import("./safe-providers-config.js").SafeProviderAuthEntry>;
     gateway: {
-        bind: "auto" | "custom" | "loopback" | "lan" | "tailnet";
+        bind: "custom" | "auto" | "loopback" | "lan" | "tailnet";
         customBindHost: string;
         port: number;
         corsOrigins: string[];
@@ -255,7 +255,6 @@ export declare function buildSafeWebConfigPayload(service: GatewayService, optio
         webchat: {
             activityDetailDefault: "stream" | "on" | "off";
         };
-        maxSseConnections: number;
         channelConnectDeferMode: "explicit" | "off" | "auto";
         channelConnectDeferIds: string[];
         channelConnectDeferSkipIds: string[];

package/dist/src/gateway/hono/lib/config-payload.js

@@ -6,9 +6,9 @@ import { init_models_json, loadModelsJson } from "../../../config/models-json.js
 import { CredentialResolver, init_credentials } from "../../../auth/credentials.js";
 import { getProviderRegistry, init_plugin_registry } from "../../../providers/plugin-registry.js";
 import { getAllProviders, init_providers, isProviderConfigured } from "../../../providers/index.js";
+import { normalizeConfiguredMcpServers } from "../../../config/mcp-config-normalize.js";
 import { resolveShareConfig } from "../../../share/share-config.js";
 import { maskTunnelSecretForWeb } from "../../../tunnel/env.js";
-import { normalizeConfiguredMcpServers } from "../../../config/mcp-config-normalize.js";
 import { resolveSessionConfigForWeb, resolveUpdateConfigForWeb } from "../../../config/web-patch.js";
 import { GENERIC_MASKED_SECRET, maskSecretLength } from "./mask-secret-length.js";
 import { safeToolsWebForGet } from "../../config-tools-web.js";
@@ -166,7 +166,6 @@ async function buildSafeWebConfigPayload(service, options = {}) {
 				activeHours: config.gateway?.heartbeat?.activeHours
 			},
 			webchat: { activityDetailDefault: config.gateway?.webchat?.activityDetailDefault ?? "on" },
-			maxSseConnections: typeof config.gateway?.maxSseConnections === "number" ? config.gateway.maxSseConnections : 100,
 			channelConnectDeferMode: config.gateway?.channelConnectDeferMode ?? "auto",
 			channelConnectDeferIds: Array.isArray(config.gateway?.channelConnectDeferIds) ? config.gateway.channelConnectDeferIds : [],
 			channelConnectDeferSkipIds: Array.isArray(config.gateway?.channelConnectDeferSkipIds) ? config.gateway.channelConnectDeferSkipIds : [],

package/dist/src/gateway/hono/middleware/auth.js

@@ -29,18 +29,16 @@ function extractTokenFromHeader(authHeader) {
 }
 /**
 * SECURITY: query-string tokens leak into server logs, Referer headers, and
-* browser history. We accept them only where the `Authorization` header cannot
-* be set — SSE/WebSocket (`EventSource`) and `<img>` subresource loads for agent
-* avatars. Note media uses Bearer-authenticated blob fetch in the gateway console.
+* browser history. We accept them only for agent avatar `<img>` loads, where an
+* Authorization header cannot be set. Realtime WebSocket authentication uses a
+* one-time ticket acquired over authenticated HTTP.
 */
 function extractTokenFromQuery(url) {
 	return new URL(url).searchParams.get("token");
 }
-const QUERY_TOKEN_ALLOWED_PATHS = new Set(["/api/events", "/api/ws"]);
 const AGENT_AVATAR_GET_PATH = /^\/api\/agents\/[^/]+\/avatar$/;
 /** Exported for gateway security tests. */
 function isQueryTokenAllowedPath(path, method) {
-	if (QUERY_TOKEN_ALLOWED_PATHS.has(path) || path.startsWith("/api/events")) return true;
 	if (method === "GET" && AGENT_AVATAR_GET_PATH.test(path)) return true;
 	return false;
 }

package/dist/src/gateway/hono/routes/agent-stream.js

@@ -1,9 +1,8 @@
+import { endpointTurnClaimSchema } from "../../../../packages/endpoint-tools-protocol/src/index.js";
 import { validateWebchatAttachments, validateWebchatContent } from "../../chat-limits.js";
-import { createAgentResumeHandler, createEventsSSEHandler, createSendHandler } from "../sse.js";
 //#region src/gateway/hono/routes/agent-stream.ts
 function registerAgentStreamRoutes(authenticated, deps) {
-	const { service, chatRateLimitMiddleware, sseConfig } = deps;
-	authenticated.post("/api/agent/resume", chatRateLimitMiddleware, createAgentResumeHandler(sseConfig));
+	const { service, chatRateLimitMiddleware } = deps;
 	authenticated.post("/api/agent/abort", chatRateLimitMiddleware, async (c) => {
 		const body = await c.req.json().catch(() => null);
 		const runId = body && typeof body === "object" && typeof body.runId === "string" ? body.runId.trim() : "";
@@ -70,13 +69,32 @@ function registerAgentStreamRoutes(authenticated, deps) {
 				message: "Missing delivery"
 			}
 		}, 400);
+		const origin = endpointTurnClaimSchema.safeParse(body.origin);
+		if (!origin.success) return c.json({
+			ok: false,
+			error: {
+				code: "BAD_REQUEST",
+				message: "Invalid endpoint origin"
+			}
+		}, 400);
+		if (!service.endpointTools.registry.verifyTurnClaim(origin.data.endpointId, origin.data.token)) return c.json({
+			ok: false,
+			error: {
+				code: "INVALID_ENDPOINT",
+				message: "Endpoint connection is not active"
+			}
+		}, 401);
 		const result = await service.submitSessionInput({
 			sessionKey,
 			clientMessageId: typeof body.clientMessageId === "string" ? body.clientMessageId : "",
 			delivery,
 			content,
 			attachments,
-			thinking: typeof body.thinking === "string" ? body.thinking : void 0
+			thinking: typeof body.thinking === "string" ? body.thinking : void 0,
+			origin: {
+				type: "endpoint",
+				endpointId: origin.data.endpointId
+			}
 		});
 		if (result.ok === false) return c.json({
 			ok: false,
@@ -195,8 +213,33 @@ function registerAgentStreamRoutes(authenticated, deps) {
 			payload: { received: true }
 		});
 	});
-	authenticated.post("/api/send", chatRateLimitMiddleware, createSendHandler(sseConfig));
-	authenticated.get("/api/events", createEventsSSEHandler(sseConfig));
+	authenticated.post("/api/send", chatRateLimitMiddleware, async (c) => {
+		const body = await c.req.json().catch(() => null);
+		const channel = typeof body?.channel === "string" ? body.channel : "";
+		const chatId = typeof body?.chatId === "string" ? body.chatId : "";
+		const content = typeof body?.content === "string" ? body.content : "";
+		if (!channel || !chatId || !content) return c.json({
+			ok: false,
+			error: {
+				code: "BAD_REQUEST",
+				message: "Missing required fields: channel, chatId, content"
+			}
+		}, 400);
+		try {
+			return c.json({
+				ok: true,
+				payload: await service.sendMessage(channel, chatId, content)
+			});
+		} catch (error) {
+			return c.json({
+				ok: false,
+				error: {
+					code: "INTERNAL_ERROR",
+					message: error instanceof Error ? error.message : "Unknown error"
+				}
+			}, 500);
+		}
+	});
 }
 //#endregion
 export { registerAgentStreamRoutes };

package/dist/src/gateway/hono/routes/config-patch/gateway.d.ts

@@ -4,13 +4,13 @@
  * Covers heartbeat, bind/customBindHost/port, tailscale, auth (mode + token +
  * password + rateLimit + trustedProxy), trustedProxies, allowRealIpFallback,
  * dangerouslyAllowHostHeaderOriginFallback, security, share, siteShare, publicUrl, webchat,
- * corsOrigins, maxSseConnections, and channelConnectDefer{Mode,Ids,SkipIds}.
+ * corsOrigins and channelConnectDefer{Mode,Ids,SkipIds}.
  *
  * Validation policy: each subsection that can reject rejects with a 400 and a
  * specific `message`. The dispatcher converts these into `c.json(...)`.
  *
  * Initial-state branches use the same literal defaults the inline code did
- * (loopback + port 18790 + 1800s heartbeat + 100 SSE conn + empty CORS) so
+ * (loopback + port 18790 + 1800s heartbeat + empty CORS) so
  * a brand-new install gets a working gateway after the first PATCH.
  */
 import type { Config } from '../../../../config/schema.js';

package/dist/src/gateway/hono/routes/config-patch/gateway.js

@@ -20,7 +20,6 @@ function ensureGateway(config) {
 			intervalMs: 18e5,
 			includeSystemPromptSection: false
 		},
-		maxSseConnections: 100,
 		corsOrigins: []
 	};
 	return config.gateway;
@@ -98,7 +97,6 @@ function applyGatewayPatch(config, body) {
 				intervalMs: 18e5,
 				includeSystemPromptSection: false
 			},
-			maxSseConnections: 100,
 			corsOrigins: []
 		};
 		else config.gateway.bind = bind;
@@ -123,7 +121,6 @@ function applyGatewayPatch(config, body) {
 				intervalMs: 18e5,
 				includeSystemPromptSection: false
 			},
-			maxSseConnections: 100,
 			corsOrigins: []
 		};
 		else config.gateway.port = Math.floor(body.gateway.port);
@@ -139,7 +136,6 @@ function applyGatewayPatch(config, body) {
 				intervalMs: 18e5,
 				includeSystemPromptSection: false
 			},
-			maxSseConnections: 100,
 			corsOrigins: []
 		};
 		config.gateway.tailscale = { ...config.gateway.tailscale ?? {
@@ -251,21 +247,6 @@ function applyGatewayPatch(config, body) {
 		const gw = ensureGateway(config);
 		gw.corsOrigins = body.gateway.corsOrigins.filter((x) => typeof x === "string" && x.trim().length > 0).map((x) => x.trim());
 	}
-	if (body.gateway?.maxSseConnections !== void 0) {
-		if (typeof body.gateway.maxSseConnections !== "number" || !Number.isFinite(body.gateway.maxSseConnections) || body.gateway.maxSseConnections < 1) return patchError("gateway.maxSseConnections must be a positive integer");
-		if (!config.gateway) config.gateway = {
-			bind: "loopback",
-			port: 18790,
-			heartbeat: {
-				enabled: true,
-				intervalMs: 18e5,
-				includeSystemPromptSection: false
-			},
-			maxSseConnections: Math.floor(body.gateway.maxSseConnections),
-			corsOrigins: []
-		};
-		else config.gateway.maxSseConnections = Math.floor(body.gateway.maxSseConnections);
-	}
 	if (body.gateway?.channelConnectDeferMode !== void 0) {
 		const mode = body.gateway.channelConnectDeferMode;
 		if (mode !== "auto" && mode !== "off" && mode !== "explicit") return patchError("gateway.channelConnectDeferMode must be auto, off, or explicit");

package/dist/src/gateway/hono/routes/config-patch/misc.js

@@ -1,9 +1,9 @@
 import { ContextCompactionPolicySchema, init_config } from "../../../../user-context/config.js";
 import { BindingsConfigSchema, BrowserConfigSchema, McpConfigSchema, VoiceConfigSchema, init_schema } from "../../../../config/schema.js";
 import { CredentialResolver, init_credentials } from "../../../../auth/credentials.js";
+import { canonicalizeConfiguredMcpServer } from "../../../../config/mcp-config-normalize.js";
 import { setTuiDefaultAgentConfig } from "../../../../commands/agents.config.js";
 import { mergeTunnelConfigPatch } from "../../../../tunnel/tunnel-config.js";
-import { canonicalizeConfiguredMcpServer } from "../../../../config/mcp-config-normalize.js";
 import { mergeGatewaySkillsMarketplacePatch, mergeSessionConfigPatch, mergeUpdateConfigPatch } from "../../../../config/web-patch.js";
 import { assertGatewayAuthConfigured, resolveGatewayAuth } from "../../../auth.js";
 import { isMaskedSecretPatchValue } from "../../lib/mask-secret-length.js";

package/dist/src/gateway/hono/routes/deps.d.ts

@@ -1,11 +1,9 @@
 import type { MiddlewareHandler } from 'hono';
 import type { GatewayService } from '../../service.js';
-import type { SSEHandlerConfig } from '../sse.js';
 export interface AuthenticatedRouteDeps {
     service: GatewayService;
     strictRateLimitMiddleware: MiddlewareHandler;
     chatRateLimitMiddleware: MiddlewareHandler;
     xopcCloudPollRateLimitMiddleware: MiddlewareHandler;
     channelRateLimitMiddleware?: MiddlewareHandler;
-    sseConfig: SSEHandlerConfig;
 }

package/dist/src/gateway/hono/routes/endpoint-tools.d.ts

@@ -0,0 +1,3 @@
+import type { Hono } from 'hono';
+import type { AuthenticatedRouteDeps } from './deps.js';
+export declare function registerEndpointToolRoutes(authenticated: Hono, deps: AuthenticatedRouteDeps): void;