@xopcai/xopc 0.0.188 → 0.0.190

package/dist/src/gateway/dreaming-automation-reconciler.js

@@ -1,100 +1,60 @@
-import { DREAMING_AUTOMATION_TAG, DREAMING_DEEP_AUTOMATION_NAME, DREAMING_LIGHT_AUTOMATION_NAME, DREAMING_LIGHT_SWEEP_TOKEN, DREAMING_REM_AUTOMATION_NAME, DREAMING_REM_SWEEP_TOKEN, DREAMING_SWEEP_TOKEN } from "../agent/memory/dreaming/constants.js";
-import { compileDreamingSchedule } from "../agent/memory/dreaming/schedule.js";
-import { resolveDreamingAgentScope } from "../agent/memory/dreaming/scope.js";
+import { init_agent_scope, normalizeAgentId, resolveAgentWorkspaceDir, resolveDefaultAgentId } from "../agent/agent-scope.js";
+import { USER_CONTEXT_CONSOLIDATION_AUTOMATION_ID, USER_CONTEXT_CONSOLIDATION_TOKEN, compileContextConsolidationCron, resolveContextConsolidationConfig } from "../user-context/consolidation.js";
 //#region src/gateway/dreaming-automation-reconciler.ts
-const DREAMING_AUTOMATIONS = [
-	{
-		phase: "light",
-		name: DREAMING_LIGHT_AUTOMATION_NAME,
-		token: DREAMING_LIGHT_SWEEP_TOKEN
-	},
-	{
-		phase: "deep",
-		name: DREAMING_DEEP_AUTOMATION_NAME,
-		token: DREAMING_SWEEP_TOKEN
-	},
-	{
-		phase: "rem",
-		name: DREAMING_REM_AUTOMATION_NAME,
-		token: DREAMING_REM_SWEEP_TOKEN
-	}
-];
-function phaseDescription(phase) {
-	return `${phase === "light" ? "Light sweep" : phase === "deep" ? "Deep promotion" : "REM pattern discovery"} for memory dreaming. ${DREAMING_AUTOMATION_TAG}`;
-}
-function buildTrigger(config, phase) {
-	const phaseConfig = config.phases[phase];
-	return {
+init_agent_scope();
+async function reconcileDreamingAutomations(params) {
+	const result = {
+		created: false,
+		updated: false,
+		disabled: false
+	};
+	const resolved = resolveContextConsolidationConfig(params.config);
+	const agentId = normalizeAgentId(resolveDefaultAgentId(params.config));
+	const workingDirectory = resolveAgentWorkspaceDir(params.config, agentId);
+	const trigger = {
 		kind: "schedule",
 		schedule: {
 			kind: "cron",
-			expr: compileDreamingSchedule(phaseConfig.schedule),
-			tz: config.timezone
+			expr: compileContextConsolidationCron(resolved.time),
+			tz: resolved.timezone
 		}
 	};
-}
-function dreamingAutomationId(phase) {
-	return `system-user-context-dreaming:${phase}`;
-}
-function buildAction(scope, token) {
-	return {
+	const action = {
 		kind: "agent",
-		agentId: scope.agentId,
-		instruction: token,
-		workingDirectory: scope.workspaceDir,
-		timeoutSeconds: 3600
+		agentId,
+		instruction: USER_CONTEXT_CONSOLIDATION_TOKEN,
+		workingDirectory,
+		timeoutSeconds: 300
 	};
-}
-function automationNeedsUpdate(current, next) {
-	return current.name !== next.name || current.description !== next.description || current.enabled !== next.enabled || JSON.stringify(current.trigger) !== JSON.stringify(next.trigger) || JSON.stringify(current.action) !== JSON.stringify(next.action) || current.safety?.mode !== "auto_apply" || current.afterRun?.kind !== "none" || current.reliability?.disableAfterConsecutiveFailures !== 3;
-}
-async function reconcileDreamingAutomations(params) {
-	const { config, automationService } = params;
-	const result = {
-		created: [],
-		updated: [],
-		disabled: []
-	};
-	const scope = resolveDreamingAgentScope(config);
-	const resolved = scope.config;
-	for (const spec of DREAMING_AUTOMATIONS) {
-		const id = dreamingAutomationId(spec.phase);
-		const current = await automationService.get(id);
-		const enabled = resolved.enabled && resolved.phases[spec.phase].enabled;
-		if (!resolved.enabled) {
-			if (current?.enabled) {
-				await automationService.update(id, { enabled: false });
-				result.disabled.push(id);
-			}
-			continue;
-		}
-		const next = {
-			name: spec.name,
-			description: phaseDescription(spec.phase),
-			enabled,
-			trigger: buildTrigger(resolved, spec.phase),
-			action: buildAction(scope, spec.token)
-		};
-		if (!current) {
-			await automationService.create({
-				id,
-				...next,
-				safety: { mode: "auto_apply" },
-				afterRun: { kind: "none" },
-				reliability: { disableAfterConsecutiveFailures: 3 }
-			});
-			result.created.push(id);
-			continue;
-		}
-		if (automationNeedsUpdate(current, next)) {
-			await automationService.update(id, {
-				...next,
-				safety: { mode: "auto_apply" },
-				afterRun: { kind: "none" },
-				reliability: { disableAfterConsecutiveFailures: 3 }
-			});
-			result.updated.push(id);
+	const current = await params.automationService.get(USER_CONTEXT_CONSOLIDATION_AUTOMATION_ID);
+	if (!resolved.enabled) {
+		if (current?.enabled) {
+			await params.automationService.update(USER_CONTEXT_CONSOLIDATION_AUTOMATION_ID, { enabled: false });
+			result.disabled = true;
 		}
+		return result;
+	}
+	const next = {
+		name: "User context review",
+		description: "Deterministically review structured user understanding for expiry and sufficient evidence.",
+		enabled: true,
+		trigger,
+		action,
+		safety: { mode: "auto_apply" },
+		afterRun: { kind: "none" },
+		reliability: { disableAfterConsecutiveFailures: 3 }
+	};
+	if (!current) {
+		await params.automationService.create({
+			id: USER_CONTEXT_CONSOLIDATION_AUTOMATION_ID,
+			...next
+		});
+		result.created = true;
+		return result;
+	}
+	if (current.name !== next.name || current.description !== next.description || !current.enabled || JSON.stringify(current.trigger) !== JSON.stringify(trigger) || JSON.stringify(current.action) !== JSON.stringify(action) || current.safety?.mode !== "auto_apply" || current.afterRun?.kind !== "none" || current.reliability?.disableAfterConsecutiveFailures !== 3) {
+		await params.automationService.update(USER_CONTEXT_CONSOLIDATION_AUTOMATION_ID, next);
+		result.updated = true;
 	}
 	return result;
 }

package/dist/src/gateway/heartbeat/service.js

@@ -138,7 +138,10 @@ var HeartbeatService = class {
 		}
 		let reply;
 		try {
-			reply = await this.deps.agentService.turnDispatcher.processDirect(prompt, sessionKey);
+			reply = await this.deps.agentService.turnDispatcher.processDirect(prompt, sessionKey, {
+				type: "system",
+				source: "heartbeat"
+			});
 		} catch (error) {
 			log.error({ err: error }, "Heartbeat: agent call failed");
 			return;

package/dist/src/gateway/hono/app.js

@@ -223,11 +223,7 @@ function createHonoApp(config) {
 			trustedProxies: service.currentConfig.gateway?.trustedProxies,
 			allowRealIpFallback: service.currentConfig.gateway?.allowRealIpFallback === true
 		}) }),
-		channelRateLimitMiddleware,
-		sseConfig: {
-			service,
-			maxSseConnections: service.currentConfig.gateway.maxSseConnections
-		}
+		channelRateLimitMiddleware
 	});
 	const prewarm = prewarmStaticUiCache();
 	if (prewarm.loaded > 0) log.debug({

package/dist/src/gateway/hono/index.d.ts

@@ -1,2 +1 @@
 export { createHonoApp, type HonoAppConfig } from './app.js';
-export { createAgentResumeHandler, createSendHandler, createEventsSSEHandler, type SSEHandlerConfig } from './sse.js';

package/dist/src/gateway/hono/index.js

@@ -1,3 +1,2 @@
-import { createAgentResumeHandler, createEventsSSEHandler, createSendHandler } from "./sse.js";
 import { createHonoApp } from "./app.js";
-export { createAgentResumeHandler, createEventsSSEHandler, createHonoApp, createSendHandler };
+export { createHonoApp };

package/dist/src/gateway/hono/lib/config-payload.d.ts

@@ -66,7 +66,7 @@ export declare function buildSafeWebConfigPayload(service: GatewayService, optio
             };
             tools: {
                 builtin?: Record<string, {
-                    mode: "allow" | "confirm" | "deny";
+                    mode: "allow" | "deny" | "confirm";
                     scope?: "workspace" | "readonly" | "unrestricted";
                     limits?: {
                         maxCallsPerTurn?: number;
@@ -75,7 +75,7 @@ export declare function buildSafeWebConfigPayload(service: GatewayService, optio
                 }>;
                 mcp?: {
                     servers?: Record<string, {
-                        mode: "allow" | "confirm" | "deny";
+                        mode: "allow" | "deny" | "confirm";
                         scope?: "workspace" | "readonly" | "unrestricted";
                         limits?: {
                             maxCallsPerTurn?: number;
@@ -83,7 +83,7 @@ export declare function buildSafeWebConfigPayload(service: GatewayService, optio
                         };
                     }>;
                     tools?: Record<string, {
-                        mode: "allow" | "confirm" | "deny";
+                        mode: "allow" | "deny" | "confirm";
                         scope?: "workspace" | "readonly" | "unrestricted";
                         limits?: {
                             maxCallsPerTurn?: number;
@@ -143,7 +143,7 @@ export declare function buildSafeWebConfigPayload(service: GatewayService, optio
             };
             tools?: {
                 builtin?: Record<string, {
-                    mode: "allow" | "confirm" | "deny";
+                    mode: "allow" | "deny" | "confirm";
                     scope?: "workspace" | "readonly" | "unrestricted";
                     limits?: {
                         maxCallsPerTurn?: number;
@@ -152,7 +152,7 @@ export declare function buildSafeWebConfigPayload(service: GatewayService, optio
                 }>;
                 mcp?: {
                     servers?: Record<string, {
-                        mode: "allow" | "confirm" | "deny";
+                        mode: "allow" | "deny" | "confirm";
                         scope?: "workspace" | "readonly" | "unrestricted";
                         limits?: {
                             maxCallsPerTurn?: number;
@@ -160,7 +160,7 @@ export declare function buildSafeWebConfigPayload(service: GatewayService, optio
                         };
                     }>;
                     tools?: Record<string, {
-                        mode: "allow" | "confirm" | "deny";
+                        mode: "allow" | "deny" | "confirm";
                         scope?: "workspace" | "readonly" | "unrestricted";
                         limits?: {
                             maxCallsPerTurn?: number;
@@ -209,7 +209,7 @@ export declare function buildSafeWebConfigPayload(service: GatewayService, optio
     /** Masked `cfg.providers` for capability keys (image / STT / etc.). */
     providersConfig: Record<string, import("./safe-providers-config.js").SafeProviderAuthEntry>;
     gateway: {
-        bind: "auto" | "custom" | "loopback" | "lan" | "tailnet";
+        bind: "custom" | "auto" | "loopback" | "lan" | "tailnet";
         customBindHost: string;
         port: number;
         corsOrigins: string[];
@@ -255,7 +255,6 @@ export declare function buildSafeWebConfigPayload(service: GatewayService, optio
         webchat: {
             activityDetailDefault: "stream" | "on" | "off";
         };
-        maxSseConnections: number;
         channelConnectDeferMode: "explicit" | "off" | "auto";
         channelConnectDeferIds: string[];
         channelConnectDeferSkipIds: string[];
@@ -291,6 +290,18 @@ export declare function buildSafeWebConfigPayload(service: GatewayService, optio
         preferences: {
             responseLanguage: "auto" | "zh-CN" | "en";
         };
+        dreaming: {
+            mode: "off" | "review";
+            schedule: {
+                time: string;
+            };
+            minEvidenceSources: number;
+            limit: number;
+            timezone?: string;
+        };
+        privacy: {
+            sensitiveWritePolicy: "allow" | "deny" | "confirm";
+        };
         memory: {
             retention: {
                 compaction: {
@@ -346,7 +357,7 @@ export declare function buildSafeWebConfigPayload(service: GatewayService, optio
         language?: "en" | "zh";
         input?: {
             refinement?: {
-                mode: "off" | "light" | "custom" | "punctuation";
+                mode: "off" | "custom" | "punctuation" | "light";
                 model?: string;
                 customInstruction?: string;
             };

package/dist/src/gateway/hono/lib/config-payload.js

@@ -1,4 +1,4 @@
-import { ContextCompactionPolicySchema, init_config } from "../../../user-context/config.js";
+import { ContextCompactionPolicySchema, UserContextDreamingSchema, UserContextPrivacySchema, init_config } from "../../../user-context/config.js";
 import { init_agent_scope, listAgentEntries, normalizeAgentId, resolveDefaultAgentId } from "../../../agent/agent-scope.js";
 import { resolveModelsJsonPath } from "../../../config/paths.js";
 import { buildChannelCatalogForConfig, buildChannelCatalogFromSnapshot, getChannelSetupStatus, init_channel_catalog_service } from "../../../channels/catalog/channel-catalog-service.js";
@@ -166,7 +166,6 @@ async function buildSafeWebConfigPayload(service, options = {}) {
 				activeHours: config.gateway?.heartbeat?.activeHours
 			},
 			webchat: { activityDetailDefault: config.gateway?.webchat?.activityDetailDefault ?? "on" },
-			maxSseConnections: typeof config.gateway?.maxSseConnections === "number" ? config.gateway.maxSseConnections : 100,
 			channelConnectDeferMode: config.gateway?.channelConnectDeferMode ?? "auto",
 			channelConnectDeferIds: Array.isArray(config.gateway?.channelConnectDeferIds) ? config.gateway.channelConnectDeferIds : [],
 			channelConnectDeferSkipIds: Array.isArray(config.gateway?.channelConnectDeferSkipIds) ? config.gateway.channelConnectDeferSkipIds : [],
@@ -179,6 +178,8 @@ async function buildSafeWebConfigPayload(service, options = {}) {
 		session: resolveSessionConfigForWeb(config),
 		userContext: {
 			preferences: config.userContext?.preferences ?? { responseLanguage: "auto" },
+			dreaming: UserContextDreamingSchema.parse(config.userContext?.dreaming),
+			privacy: UserContextPrivacySchema.parse(config.userContext?.privacy),
 			memory: { retention: { compaction: ContextCompactionPolicySchema.parse(config.userContext?.memory.retention?.compaction) } }
 		},
 		tui: { defaultAgent: config.tui?.defaultAgent ?? "coder" },

package/dist/src/gateway/hono/middleware/auth.js

@@ -29,18 +29,16 @@ function extractTokenFromHeader(authHeader) {
 }
 /**
 * SECURITY: query-string tokens leak into server logs, Referer headers, and
-* browser history. We accept them only where the `Authorization` header cannot
-* be set — SSE/WebSocket (`EventSource`) and `<img>` subresource loads for agent
-* avatars. Note media uses Bearer-authenticated blob fetch in the gateway console.
+* browser history. We accept them only for agent avatar `<img>` loads, where an
+* Authorization header cannot be set. Realtime WebSocket authentication uses a
+* one-time ticket acquired over authenticated HTTP.
 */
 function extractTokenFromQuery(url) {
 	return new URL(url).searchParams.get("token");
 }
-const QUERY_TOKEN_ALLOWED_PATHS = new Set(["/api/events", "/api/ws"]);
 const AGENT_AVATAR_GET_PATH = /^\/api\/agents\/[^/]+\/avatar$/;
 /** Exported for gateway security tests. */
 function isQueryTokenAllowedPath(path, method) {
-	if (QUERY_TOKEN_ALLOWED_PATHS.has(path) || path.startsWith("/api/events")) return true;
 	if (method === "GET" && AGENT_AVATAR_GET_PATH.test(path)) return true;
 	return false;
 }

package/dist/src/gateway/hono/oauth-async.d.ts

@@ -8,6 +8,7 @@
 import { Hono } from 'hono';
 import type { GatewayService } from '../service.js';
 import { type OAuthCredentials } from '../../auth/oauth/types.js';
+export declare function refreshModelCatalogAfterOAuth(provider: string, service: Pick<GatewayService, 'getModelCatalogSync'>): Promise<void>;
 export declare function resolveOAuthLoginMethodPreference(params: {
     requestedMethod?: unknown;
     supportedMethods?: readonly string[];

package/dist/src/gateway/hono/oauth-async.js

@@ -17,6 +17,19 @@ init_registry();
 init_credentials();
 init_logger();
 const log = createLogger("OAuthAsync");
+async function refreshModelCatalogAfterOAuth(provider, service) {
+	if (provider !== "xopc-cloud") return;
+	try {
+		await service.getModelCatalogSync().refreshNow();
+	} catch (err) {
+		const errorMessage = err instanceof Error ? err.message : String(err);
+		log.warn({
+			err,
+			provider,
+			errorMessage
+		}, `OAuth completed, but the model catalog could not be refreshed: ${errorMessage}`);
+	}
+}
 /** User-facing message when undici/fetch fails (often DNS, firewall, or wrong machine for localhost callback). */
 function formatOAuthAsyncError(err) {
 	const base = err instanceof Error ? err.message : "OAuth login failed";
@@ -200,7 +213,7 @@ function createOAuthAsyncHandler(service) {
 /**
 * Run OAuth flow in background
 */
-async function runOAuthFlow(session, oauthProvider, _service) {
+async function runOAuthFlow(session, oauthProvider, service) {
 	const abortController = new AbortController();
 	session.abortController = abortController;
 	let manualCodePromise = null;
@@ -276,6 +289,8 @@ async function runOAuthFlow(session, oauthProvider, _service) {
 		const credentials = await oauthProvider.login(callbacks);
 		setOAuthCredentialsToCache(session.provider, credentials);
 		await new CredentialResolver().saveOAuthCredentials(session.provider, credentials);
+		session.message = session.provider === "xopc-cloud" ? "OAuth login successful. Syncing available models..." : "OAuth login successful";
+		await refreshModelCatalogAfterOAuth(session.provider, service);
 		session.status = "completed";
 		session.credentials = credentials;
 		session.message = "OAuth login successful";
@@ -313,4 +328,4 @@ function deleteOAuthCredentialsFromCache(provider) {
 	oauthCredentialsCache.delete(provider);
 }
 //#endregion
-export { createOAuthAsyncHandler, deleteOAuthCredentialsFromCache, getOAuthCredentialsFromCache, resolveOAuthLoginMethodPreference, setOAuthCredentialsToCache };
+export { createOAuthAsyncHandler, deleteOAuthCredentialsFromCache, getOAuthCredentialsFromCache, refreshModelCatalogAfterOAuth, resolveOAuthLoginMethodPreference, setOAuthCredentialsToCache };

package/dist/src/gateway/hono/routes/agent-stream.js

@@ -1,9 +1,8 @@
+import { endpointTurnClaimSchema } from "../../../../packages/endpoint-tools-protocol/src/index.js";
 import { validateWebchatAttachments, validateWebchatContent } from "../../chat-limits.js";
-import { createAgentResumeHandler, createEventsSSEHandler, createSendHandler } from "../sse.js";
 //#region src/gateway/hono/routes/agent-stream.ts
 function registerAgentStreamRoutes(authenticated, deps) {
-	const { service, chatRateLimitMiddleware, sseConfig } = deps;
-	authenticated.post("/api/agent/resume", chatRateLimitMiddleware, createAgentResumeHandler(sseConfig));
+	const { service, chatRateLimitMiddleware } = deps;
 	authenticated.post("/api/agent/abort", chatRateLimitMiddleware, async (c) => {
 		const body = await c.req.json().catch(() => null);
 		const runId = body && typeof body === "object" && typeof body.runId === "string" ? body.runId.trim() : "";
@@ -70,13 +69,32 @@ function registerAgentStreamRoutes(authenticated, deps) {
 				message: "Missing delivery"
 			}
 		}, 400);
+		const origin = endpointTurnClaimSchema.safeParse(body.origin);
+		if (!origin.success) return c.json({
+			ok: false,
+			error: {
+				code: "BAD_REQUEST",
+				message: "Invalid endpoint origin"
+			}
+		}, 400);
+		if (!service.endpointTools.registry.verifyTurnClaim(origin.data.endpointId, origin.data.token)) return c.json({
+			ok: false,
+			error: {
+				code: "INVALID_ENDPOINT",
+				message: "Endpoint connection is not active"
+			}
+		}, 401);
 		const result = await service.submitSessionInput({
 			sessionKey,
 			clientMessageId: typeof body.clientMessageId === "string" ? body.clientMessageId : "",
 			delivery,
 			content,
 			attachments,
-			thinking: typeof body.thinking === "string" ? body.thinking : void 0
+			thinking: typeof body.thinking === "string" ? body.thinking : void 0,
+			origin: {
+				type: "endpoint",
+				endpointId: origin.data.endpointId
+			}
 		});
 		if (result.ok === false) return c.json({
 			ok: false,
@@ -195,8 +213,33 @@ function registerAgentStreamRoutes(authenticated, deps) {
 			payload: { received: true }
 		});
 	});
-	authenticated.post("/api/send", chatRateLimitMiddleware, createSendHandler(sseConfig));
-	authenticated.get("/api/events", createEventsSSEHandler(sseConfig));
+	authenticated.post("/api/send", chatRateLimitMiddleware, async (c) => {
+		const body = await c.req.json().catch(() => null);
+		const channel = typeof body?.channel === "string" ? body.channel : "";
+		const chatId = typeof body?.chatId === "string" ? body.chatId : "";
+		const content = typeof body?.content === "string" ? body.content : "";
+		if (!channel || !chatId || !content) return c.json({
+			ok: false,
+			error: {
+				code: "BAD_REQUEST",
+				message: "Missing required fields: channel, chatId, content"
+			}
+		}, 400);
+		try {
+			return c.json({
+				ok: true,
+				payload: await service.sendMessage(channel, chatId, content)
+			});
+		} catch (error) {
+			return c.json({
+				ok: false,
+				error: {
+					code: "INTERNAL_ERROR",
+					message: error instanceof Error ? error.message : "Unknown error"
+				}
+			}, 500);
+		}
+	});
 }
 //#endregion
 export { registerAgentStreamRoutes };

package/dist/src/gateway/hono/routes/agents.js

@@ -1,7 +1,7 @@
 import { ToolPolicySetSchema, init_schema } from "../../../agent-manifest/schema.js";
 import { AgentModelsSchema, init_schema as init_schema$1 } from "../../../config/schema.js";
 import { init_agent_scope, normalizeAgentId } from "../../../agent/agent-scope.js";
-import { deleteAgentAvatarFile, finalizeCreateAgentDirs, getGatewayAgentEffectiveManifest, listAgentProfileFiles, listGatewayAgents, prepareCreateAgent, prepareDeleteAgent, prepareUpdateAgent, readAgentAvatarFile, readAgentProfileFile, readUserProfileFile, runAfterDeletePurge, writeAgentAvatarFromBase64, writeAgentProfileFile, writeUserProfileFile } from "../../agents-admin.js";
+import { deleteAgentAvatarFile, finalizeCreateAgentDirs, getGatewayAgentEffectiveManifest, listAgentProfileFiles, listGatewayAgents, prepareCreateAgent, prepareDeleteAgent, prepareUpdateAgent, readAgentAvatarFile, readAgentProfileFile, runAfterDeletePurge, writeAgentAvatarFromBase64, writeAgentProfileFile } from "../../agents-admin.js";
 import { getVoiceModelsConfig } from "../../../config/voice.js";
 //#region src/gateway/hono/routes/agents.ts
 init_schema$1();
@@ -89,38 +89,6 @@ function registerAgentsRoutes(authenticated, deps) {
 			payload
 		});
 	});
-	authenticated.get("/api/user-profile", async (c) => {
-		const res = await readUserProfileFile();
-		if (res.ok === false) return c.json({
-			ok: false,
-			error: { message: res.error }
-		}, res.status ?? 400);
-		return c.json({
-			ok: true,
-			payload: res.data
-		});
-	});
-	authenticated.put("/api/user-profile", strictRateLimitMiddleware, async (c) => {
-		let content = "";
-		try {
-			const body = await c.req.json();
-			content = typeof body.content === "string" ? body.content : "";
-		} catch {
-			return c.json({
-				ok: false,
-				error: { message: "Invalid JSON" }
-			}, 400);
-		}
-		const res = await writeUserProfileFile(content);
-		if (res.ok === false) return c.json({
-			ok: false,
-			error: { message: res.error }
-		}, res.status ?? 400);
-		return c.json({
-			ok: true,
-			payload: res.data
-		});
-	});
 	authenticated.post("/api/agents", strictRateLimitMiddleware, async (c) => {
 		let body = {};
 		try {

package/dist/src/gateway/hono/routes/auth-registry-extensions.js

@@ -1,8 +1,8 @@
 import { getAllModels, getAvailableModels, init_providers } from "../../../providers/index.js";
 import { ActivationPlanner } from "../../../extensions/activation-planner.js";
 import { mergeActivationContext } from "../../../extensions/activation-context.js";
-import { buildWhenContextSnapshot } from "../../../extensions/when-context.js";
 import { fetchRegistry, listExtensions, searchExtensions } from "../../../extensions/marketplace.js";
+import { buildWhenContextSnapshot } from "../../../extensions/when-context.js";
 import { createOAuthHandler } from "../oauth.js";
 import { createOAuthAsyncHandler } from "../oauth-async.js";
 import { extensionAssetMimeType } from "../lib/extension-assets.js";

package/dist/src/gateway/hono/routes/config-patch/gateway.d.ts

@@ -4,13 +4,13 @@
  * Covers heartbeat, bind/customBindHost/port, tailscale, auth (mode + token +
  * password + rateLimit + trustedProxy), trustedProxies, allowRealIpFallback,
  * dangerouslyAllowHostHeaderOriginFallback, security, share, siteShare, publicUrl, webchat,
- * corsOrigins, maxSseConnections, and channelConnectDefer{Mode,Ids,SkipIds}.
+ * corsOrigins and channelConnectDefer{Mode,Ids,SkipIds}.
  *
  * Validation policy: each subsection that can reject rejects with a 400 and a
  * specific `message`. The dispatcher converts these into `c.json(...)`.
  *
  * Initial-state branches use the same literal defaults the inline code did
- * (loopback + port 18790 + 1800s heartbeat + 100 SSE conn + empty CORS) so
+ * (loopback + port 18790 + 1800s heartbeat + empty CORS) so
  * a brand-new install gets a working gateway after the first PATCH.
  */
 import type { Config } from '../../../../config/schema.js';

package/dist/src/gateway/hono/routes/config-patch/gateway.js

@@ -20,7 +20,6 @@ function ensureGateway(config) {
 			intervalMs: 18e5,
 			includeSystemPromptSection: false
 		},
-		maxSseConnections: 100,
 		corsOrigins: []
 	};
 	return config.gateway;
@@ -98,7 +97,6 @@ function applyGatewayPatch(config, body) {
 				intervalMs: 18e5,
 				includeSystemPromptSection: false
 			},
-			maxSseConnections: 100,
 			corsOrigins: []
 		};
 		else config.gateway.bind = bind;
@@ -123,7 +121,6 @@ function applyGatewayPatch(config, body) {
 				intervalMs: 18e5,
 				includeSystemPromptSection: false
 			},
-			maxSseConnections: 100,
 			corsOrigins: []
 		};
 		else config.gateway.port = Math.floor(body.gateway.port);
@@ -139,7 +136,6 @@ function applyGatewayPatch(config, body) {
 				intervalMs: 18e5,
 				includeSystemPromptSection: false
 			},
-			maxSseConnections: 100,
 			corsOrigins: []
 		};
 		config.gateway.tailscale = { ...config.gateway.tailscale ?? {
@@ -251,21 +247,6 @@ function applyGatewayPatch(config, body) {
 		const gw = ensureGateway(config);
 		gw.corsOrigins = body.gateway.corsOrigins.filter((x) => typeof x === "string" && x.trim().length > 0).map((x) => x.trim());
 	}
-	if (body.gateway?.maxSseConnections !== void 0) {
-		if (typeof body.gateway.maxSseConnections !== "number" || !Number.isFinite(body.gateway.maxSseConnections) || body.gateway.maxSseConnections < 1) return patchError("gateway.maxSseConnections must be a positive integer");
-		if (!config.gateway) config.gateway = {
-			bind: "loopback",
-			port: 18790,
-			heartbeat: {
-				enabled: true,
-				intervalMs: 18e5,
-				includeSystemPromptSection: false
-			},
-			maxSseConnections: Math.floor(body.gateway.maxSseConnections),
-			corsOrigins: []
-		};
-		else config.gateway.maxSseConnections = Math.floor(body.gateway.maxSseConnections);
-	}
 	if (body.gateway?.channelConnectDeferMode !== void 0) {
 		const mode = body.gateway.channelConnectDeferMode;
 		if (mode !== "auto" && mode !== "off" && mode !== "explicit") return patchError("gateway.channelConnectDeferMode must be auto, off, or explicit");

package/dist/src/gateway/hono/routes/config-patch/misc.js

@@ -1,4 +1,4 @@
-import { ContextCompactionPolicySchema, init_config } from "../../../../user-context/config.js";
+import { ContextCompactionPolicySchema, UserContextDreamingSchema, UserContextPrivacySchema, init_config } from "../../../../user-context/config.js";
 import { BindingsConfigSchema, BrowserConfigSchema, McpConfigSchema, VoiceConfigSchema, init_schema } from "../../../../config/schema.js";
 import { CredentialResolver, init_credentials } from "../../../../auth/credentials.js";
 import { canonicalizeConfiguredMcpServer } from "../../../../config/mcp-config-normalize.js";
@@ -28,6 +28,22 @@ async function applyMiscPatch(config, body) {
 	if (body.userContext !== void 0) {
 		if (typeof body.userContext !== "object" || body.userContext === null || Array.isArray(body.userContext)) return patchError("userContext must be an object");
 		const userContextPatch = body.userContext;
+		if (userContextPatch.dreaming !== void 0) {
+			const parsed = UserContextDreamingSchema.safeParse(userContextPatch.dreaming);
+			if (!parsed.success) return patchError(parsed.error.issues.map((issue) => issue.message).join("; "));
+			config.userContext = {
+				...config.userContext,
+				dreaming: parsed.data
+			};
+		}
+		if (userContextPatch.privacy !== void 0) {
+			const parsed = UserContextPrivacySchema.safeParse(userContextPatch.privacy);
+			if (!parsed.success) return patchError(parsed.error.issues.map((issue) => issue.message).join("; "));
+			config.userContext = {
+				...config.userContext,
+				privacy: parsed.data
+			};
+		}
 		if (userContextPatch.memory !== void 0) {
 			if (typeof userContextPatch.memory !== "object" || userContextPatch.memory === null || Array.isArray(userContextPatch.memory)) return patchError("userContext.memory must be an object");
 			const memoryPatch = userContextPatch.memory;