@xopcai/xopc 0.0.196 → 0.0.199

package/dist/src/gateway/hono/routes/side-chats.js

@@ -0,0 +1,173 @@
+import { validateWebchatContent } from "../../chat-limits.js";
+import { validateSideChatSelections } from "../../side-chat/context-snapshot.js";
+import { SideChatError, parseThinkingLevel } from "../../side-chat/manager.js";
+import "../../side-chat/index.js";
+import { createGatewayRouteLogger, logRouteError } from "../lib/route-logger.js";
+//#region src/gateway/hono/routes/side-chats.ts
+const CLIENT_HEADER = "x-xopc-client-instance-id";
+const log = createGatewayRouteLogger("SideChats");
+function registerSideChatRoutes(authenticated, deps) {
+	const { service } = deps;
+	authenticated.post("/api/sessions/:parentSessionKey/side-chats", deps.chatRateLimitMiddleware, async (c) => {
+		try {
+			const body = await c.req.json().catch(() => ({}));
+			const clientInstanceId = readClientInstanceId(c, body.clientInstanceId);
+			if (body.modelRef !== void 0 && typeof body.modelRef !== "string") throw new SideChatError("modelRef must be a string", "INVALID_REQUEST");
+			const modelRef = typeof body.modelRef === "string" ? body.modelRef : void 0;
+			let selections;
+			try {
+				selections = validateSideChatSelections(body.selections);
+			} catch (error) {
+				throw new SideChatError(error instanceof Error ? error.message : "Invalid selections", "INVALID_REQUEST");
+			}
+			const sideChat = await service.sideChats.create({
+				parentSessionKey: c.req.param("parentSessionKey"),
+				clientInstanceId,
+				selections,
+				config: {
+					modelRef,
+					thinkingLevel: parseThinkingLevel(body.thinkingLevel)
+				}
+			});
+			return c.json({
+				ok: true,
+				sideChat
+			}, 201);
+		} catch (error) {
+			return respondSideChatError(c, error);
+		}
+	});
+	authenticated.get("/api/side-chats/:sideChatId", (c) => {
+		try {
+			const sideChat = service.sideChats.get(c.req.param("sideChatId"), readClientInstanceId(c));
+			return c.json({
+				ok: true,
+				sideChat
+			});
+		} catch (error) {
+			return respondSideChatError(c, error);
+		}
+	});
+	authenticated.get("/api/side-chats/:sideChatId/messages", (c) => {
+		try {
+			const messages = service.sideChats.getMessages(c.req.param("sideChatId"), readClientInstanceId(c));
+			return c.json({
+				ok: true,
+				messages
+			});
+		} catch (error) {
+			return respondSideChatError(c, error);
+		}
+	});
+	authenticated.patch("/api/side-chats/:sideChatId/config", async (c) => {
+		try {
+			const body = await c.req.json().catch(() => ({}));
+			if (body.modelRef !== void 0 && typeof body.modelRef !== "string") throw new SideChatError("modelRef must be a string", "INVALID_REQUEST");
+			const modelRef = typeof body.modelRef === "string" ? body.modelRef : void 0;
+			const sideChat = service.sideChats.updateConfig(c.req.param("sideChatId"), readClientInstanceId(c, body.clientInstanceId), {
+				modelRef,
+				thinkingLevel: parseThinkingLevel(body.thinkingLevel)
+			});
+			return c.json({
+				ok: true,
+				sideChat
+			});
+		} catch (error) {
+			return respondSideChatError(c, error);
+		}
+	});
+	authenticated.post("/api/side-chats/:sideChatId/heartbeat", (c) => {
+		try {
+			const sideChat = service.sideChats.heartbeat(c.req.param("sideChatId"), readClientInstanceId(c));
+			return c.json({
+				ok: true,
+				sideChat
+			});
+		} catch (error) {
+			return respondSideChatError(c, error);
+		}
+	});
+	authenticated.post("/api/side-chats/:sideChatId/inputs", deps.chatRateLimitMiddleware, async (c) => {
+		try {
+			const body = await c.req.json().catch(() => ({}));
+			const content = typeof body.content === "string" ? body.content : "";
+			const contentError = validateWebchatContent(content);
+			if (contentError) throw new SideChatError(contentError, "INVALID_REQUEST");
+			const result = service.sideChatRuns.submit(c.req.param("sideChatId"), readClientInstanceId(c, body.clientInstanceId), content);
+			return c.json({
+				ok: true,
+				payload: result
+			}, 202);
+		} catch (error) {
+			return respondSideChatError(c, error);
+		}
+	});
+	authenticated.post("/api/side-chats/:sideChatId/abort", deps.chatRateLimitMiddleware, async (c) => {
+		try {
+			const body = await c.req.json().catch(() => ({}));
+			const aborted = await service.sideChatRuns.abort(c.req.param("sideChatId"), readClientInstanceId(c, body.clientInstanceId), typeof body.runId === "string" ? body.runId : void 0);
+			return c.json({
+				ok: true,
+				payload: { aborted }
+			});
+		} catch (error) {
+			return respondSideChatError(c, error);
+		}
+	});
+	authenticated.post("/api/side-chats/:sideChatId/clarify/:requestId", deps.chatRateLimitMiddleware, async (c) => {
+		try {
+			const body = await c.req.json().catch(() => ({}));
+			const answer = body.skip === true ? "" : typeof body.answer === "string" ? body.answer.trim() : "";
+			if (body.skip !== true && !answer) throw new SideChatError("answer is required", "INVALID_REQUEST");
+			if (!service.sideChatRuns.submitClarification(c.req.param("sideChatId"), readClientInstanceId(c, body.clientInstanceId), c.req.param("requestId"), answer)) throw new SideChatError("Clarification request not found", "NOT_FOUND");
+			return c.json({ ok: true });
+		} catch (error) {
+			return respondSideChatError(c, error);
+		}
+	});
+	authenticated.delete("/api/side-chats/:sideChatId", async (c) => {
+		try {
+			return await service.sideChatRuns.dispose(c.req.param("sideChatId"), readClientInstanceId(c)) ? c.json({ ok: true }) : c.json({
+				ok: false,
+				error: "Side chat not found",
+				code: "NOT_FOUND"
+			}, 404);
+		} catch (error) {
+			return respondSideChatError(c, error);
+		}
+	});
+	authenticated.delete("/api/side-chats", async (c) => {
+		try {
+			const removed = await service.sideChats.disposeClient(readClientInstanceId(c, c.req.query("clientInstanceId")));
+			return c.json({
+				ok: true,
+				removed
+			});
+		} catch (error) {
+			return respondSideChatError(c, error);
+		}
+	});
+}
+function readClientInstanceId(c, fallback) {
+	const value = c.req.header(CLIENT_HEADER) || (typeof fallback === "string" ? fallback : "");
+	if (!value.trim()) throw new SideChatError("clientInstanceId is required", "INVALID_REQUEST");
+	return value.trim();
+}
+function respondSideChatError(c, error) {
+	if (!(error instanceof SideChatError)) {
+		logRouteError(log, c, error, "Side chat request failed");
+		return c.json({
+			ok: false,
+			error: "Side chat request failed",
+			code: "INTERNAL_ERROR"
+		}, 500);
+	}
+	const status = error.code === "NOT_FOUND" ? 404 : error.code === "CONFLICT" ? 409 : error.code === "LIMIT_REACHED" ? 429 : 400;
+	return c.json({
+		ok: false,
+		error: error.message,
+		code: error.code
+	}, status);
+}
+//#endregion
+export { registerSideChatRoutes };

package/dist/src/gateway/hono/routes/tasks.js

@@ -1,10 +1,12 @@
+import { runSqliteWriteTransaction } from "../../../storage/sqlite/transaction.js";
 import { TaskRepository } from "../../../tasks/task-repository.js";
 import { TaskRunRepository } from "../../../tasks/task-run-repository.js";
 import { TaskReadModelProjector } from "../../../tasks/task-read-model-projector.js";
 import { TaskPhaseSchema } from "../../../../packages/gateway-contract/src/task-lifecycle.js";
-import { TaskCommandRequestSchema, TaskContextInputSchema, TaskCreateRequestSchema, TaskDependencyUpdateRequestSchema, TaskPatchRequestSchema } from "../../../../packages/gateway-contract/src/tasks.js";
+import { TaskBoardPositionRequestSchema, TaskCommandRequestSchema, TaskContextInputSchema, TaskCreateRequestSchema, TaskDependencyUpdateRequestSchema, TaskPatchRequestSchema } from "../../../../packages/gateway-contract/src/tasks.js";
 import { ProjectMonitoringUpdateSchema } from "../../../../packages/gateway-contract/src/project-monitoring.js";
 import { TaskContextRepository } from "../../../tasks/task-context-repository.js";
+import { enqueueTaskChangedEvent } from "../../../tasks/task-change-events.js";
 import { TaskDependencyError, TaskDependencyService } from "../../../tasks/task-dependency-service.js";
 import { TaskApplicationService } from "../../../tasks/task-application-service.js";
 import { ProjectMonitoringService } from "../../../tasks/project-monitoring-service.js";
@@ -13,6 +15,7 @@ import { TaskValueMetricsService } from "../../../tasks/task-value-metrics-servi
 import { TaskSignalService } from "../../../tasks/task-signal-service.js";
 //#region src/gateway/hono/routes/tasks.ts
 function registerTaskRoutes(authenticated, deps) {
+	const taskRateLimit = deps.taskRateLimitMiddleware ?? deps.strictRateLimitMiddleware;
 	const application = new TaskApplicationService();
 	const operatingViews = new ProjectOperatingViewService(deps.service.projects);
 	const monitoring = new ProjectMonitoringService();
@@ -42,7 +45,7 @@ function registerTaskRoutes(authenticated, deps) {
 			})
 		});
 	});
-	authenticated.post("/api/tasks", deps.strictRateLimitMiddleware, async (c) => {
+	authenticated.post("/api/tasks", taskRateLimit, async (c) => {
 		const body = await c.req.json().catch(() => ({}));
 		const parsed = TaskCreateRequestSchema.safeParse(body);
 		if (!parsed.success) return c.json({
@@ -57,6 +60,7 @@ function registerTaskRoutes(authenticated, deps) {
 				error: created.reason
 			}, 409);
 			if (created.runId) deps.service.dispatchTaskRuns();
+			else deps.service.dispatchTaskEvents();
 			return c.json({
 				ok: true,
 				task: created.model.task,
@@ -97,33 +101,57 @@ function registerTaskRoutes(authenticated, deps) {
 			allowedCommands: model.allowedCommands
 		});
 	});
-	authenticated.patch("/api/tasks/:id", deps.strictRateLimitMiddleware, async (c) => {
+	authenticated.patch("/api/tasks/:id", taskRateLimit, async (c) => {
 		const parsed = TaskPatchRequestSchema.safeParse(await c.req.json().catch(() => ({})));
 		if (!parsed.success) return c.json({
 			ok: false,
 			error: "Invalid task patch"
 		}, 400);
-		const updated = tasks.update(c.req.param("id"), parsed.data);
+		const updated = runSqliteWriteTransaction((db) => {
+			const task = tasks.update(c.req.param("id"), parsed.data);
+			if (!task) return void 0;
+			const changedFields = Object.keys(parsed.data).filter((field) => field !== "expectedVersion");
+			enqueueTaskChangedEvent(db, {
+				taskId: task.id,
+				projectId: task.projectId,
+				version: task.version,
+				changedFields,
+				actor: { kind: "user" }
+			});
+			return task;
+		});
 		if (!updated) return c.json({
 			ok: false,
 			error: "Task changed or was not found"
 		}, 409);
+		deps.service.dispatchTaskEvents();
 		return c.json({
 			ok: true,
 			task: updated
 		});
 	});
-	authenticated.put("/api/tasks/:id/dependencies", deps.strictRateLimitMiddleware, async (c) => {
+	authenticated.put("/api/tasks/:id/dependencies", taskRateLimit, async (c) => {
 		const parsed = TaskDependencyUpdateRequestSchema.safeParse(await c.req.json().catch(() => ({})));
 		if (!parsed.success) return c.json({
 			ok: false,
 			error: "Invalid task dependencies"
 		}, 400);
 		try {
-			const task = dependencies.replace({
-				taskId: c.req.param("id"),
-				...parsed.data
+			const task = runSqliteWriteTransaction((db) => {
+				const changed = dependencies.replace({
+					taskId: c.req.param("id"),
+					...parsed.data
+				});
+				enqueueTaskChangedEvent(db, {
+					taskId: changed.id,
+					projectId: changed.projectId,
+					version: changed.version,
+					changedFields: ["dependencies"],
+					actor: { kind: "user" }
+				});
+				return changed;
 			});
+			deps.service.dispatchTaskEvents();
 			return c.json({
 				ok: true,
 				task,
@@ -140,7 +168,45 @@ function registerTaskRoutes(authenticated, deps) {
 			}, status);
 		}
 	});
-	authenticated.post("/api/tasks/:id/commands", deps.strictRateLimitMiddleware, async (c) => {
+	authenticated.put("/api/tasks/:id/board-position", taskRateLimit, async (c) => {
+		const parsed = TaskBoardPositionRequestSchema.safeParse(await c.req.json().catch(() => ({})));
+		if (!parsed.success) return c.json({
+			ok: false,
+			error: "Invalid task board position"
+		}, 400);
+		try {
+			const task = runSqliteWriteTransaction((db) => {
+				const reordered = tasks.reorder({
+					taskId: c.req.param("id"),
+					...parsed.data
+				});
+				if (!reordered) return void 0;
+				enqueueTaskChangedEvent(db, {
+					taskId: reordered.id,
+					projectId: reordered.projectId,
+					version: reordered.version,
+					changedFields: ["boardRank"],
+					actor: { kind: "user" }
+				});
+				return reordered;
+			});
+			if (!task) return c.json({
+				ok: false,
+				error: "Task changed or was not found"
+			}, 409);
+			deps.service.dispatchTaskEvents();
+			return c.json({
+				ok: true,
+				task
+			});
+		} catch (error) {
+			return c.json({
+				ok: false,
+				error: error instanceof Error ? error.message : String(error)
+			}, 400);
+		}
+	});
+	authenticated.post("/api/tasks/:id/commands", taskRateLimit, async (c) => {
 		const parsed = TaskCommandRequestSchema.safeParse(await c.req.json().catch(() => ({})));
 		if (!parsed.success) return c.json({
 			ok: false,
@@ -165,6 +231,7 @@ function registerTaskRoutes(authenticated, deps) {
 			}, 409);
 		}
 		if (result.runId || parsed.data.command?.type === "resolve_wait") deps.service.dispatchTaskRuns();
+		else deps.service.dispatchTaskEvents();
 		if (parsed.data.command?.type === "close" && parsed.data.command.resolution === "done") signals.dependencyClosed(c.req.param("id"));
 		return c.json({
 			ok: true,
@@ -172,7 +239,7 @@ function registerTaskRoutes(authenticated, deps) {
 			...result.runId ? { run: runs.get(result.runId) } : {}
 		});
 	});
-	authenticated.post("/api/tasks/:id/context", deps.strictRateLimitMiddleware, async (c) => {
+	authenticated.post("/api/tasks/:id/context", taskRateLimit, async (c) => {
 		const task = tasks.get(c.req.param("id"));
 		if (!task) return c.json({
 			ok: false,
@@ -183,17 +250,42 @@ function registerTaskRoutes(authenticated, deps) {
 			ok: false,
 			error: "Invalid task context edge"
 		}, 400);
-		return c.json({
-			ok: true,
-			edge: context.add({
+		const edge = runSqliteWriteTransaction((db) => {
+			const created = context.add({
 				taskId: task.id,
 				...parsed.data,
 				createdBy: { kind: "user" }
-			})
+			});
+			enqueueTaskChangedEvent(db, {
+				taskId: task.id,
+				projectId: task.projectId,
+				version: task.version,
+				changedFields: ["context"],
+				actor: { kind: "user" }
+			});
+			return created;
+		});
+		deps.service.dispatchTaskEvents();
+		return c.json({
+			ok: true,
+			edge
 		}, 201);
 	});
-	authenticated.delete("/api/tasks/:id/context/:edgeId", deps.strictRateLimitMiddleware, (c) => {
-		return context.remove(c.req.param("id"), c.req.param("edgeId")) ? c.json({ ok: true }) : c.json({
+	authenticated.delete("/api/tasks/:id/context/:edgeId", taskRateLimit, (c) => {
+		const task = tasks.get(c.req.param("id"));
+		const removed = task ? runSqliteWriteTransaction((db) => {
+			const didRemove = context.remove(task.id, c.req.param("edgeId"));
+			if (didRemove) enqueueTaskChangedEvent(db, {
+				taskId: task.id,
+				projectId: task.projectId,
+				version: task.version,
+				changedFields: ["context"],
+				actor: { kind: "user" }
+			});
+			return didRemove;
+		}) : false;
+		if (removed) deps.service.dispatchTaskEvents();
+		return removed ? c.json({ ok: true }) : c.json({
 			ok: false,
 			error: "Task context edge not found"
 		}, 404);
@@ -219,7 +311,7 @@ function registerTaskRoutes(authenticated, deps) {
 			error: "TaskRun not found"
 		}, 404);
 	});
-	authenticated.post("/api/task-runs/:runId/cancel", deps.strictRateLimitMiddleware, async (c) => {
+	authenticated.post("/api/task-runs/:runId/cancel", taskRateLimit, async (c) => {
 		const body = await c.req.json().catch(() => ({}));
 		const run = runs.get(c.req.param("runId"));
 		if (!run) return c.json({
@@ -256,13 +348,14 @@ function registerTaskRoutes(authenticated, deps) {
 			ok: false,
 			error: result.reason
 		}, 409);
+		deps.service.dispatchTaskEvents();
 		return c.json({
 			ok: true,
 			run: runs.get(run.id),
 			receipt: runs.getReceipt(run.id)
 		});
 	});
-	authenticated.post("/api/task-runs/:runId/feedback", deps.strictRateLimitMiddleware, async (c) => {
+	authenticated.post("/api/task-runs/:runId/feedback", taskRateLimit, async (c) => {
 		const body = await c.req.json().catch(() => ({}));
 		if (body.rating !== "helpful" && body.rating !== "not_helpful") return c.json({
 			ok: false,
@@ -306,7 +399,7 @@ function registerTaskRoutes(authenticated, deps) {
 			policy: monitoring.get(projectId)
 		});
 	});
-	authenticated.patch("/api/projects/:projectId/monitoring", deps.strictRateLimitMiddleware, async (c) => {
+	authenticated.patch("/api/projects/:projectId/monitoring", taskRateLimit, async (c) => {
 		const projectId = c.req.param("projectId");
 		if (!deps.service.projects.get(projectId)) return c.json({
 			ok: false,

package/dist/src/gateway/host.d.ts

@@ -6,6 +6,13 @@ export declare function isAllInterfacesHost(host: string | undefined): boolean;
 export declare const GATEWAY_DEV_CONSOLE_ORIGINS: readonly ["http://localhost:3000", "http://127.0.0.1:3000"];
 /** Expo / React Native web dev server (Metro defaults to port 8081). */
 export declare const GATEWAY_EXPO_DEV_ORIGINS: readonly ["http://localhost:8081", "http://127.0.0.1:8081"];
+export type LanGatewayCandidate = {
+    url: string;
+    address: string;
+    interfaceName: string;
+};
+/** Non-internal IPv4 addresses that can serve this gateway on the local network. */
+export declare function enumerateLanGatewayCandidates(port: number): LanGatewayCandidate[];
 /** Effective HTTP listen port: CLI `--port` override wins over config (default 18790). */
 export declare function resolveEffectiveGatewayPort(config: {
     gateway?: {
@@ -27,7 +34,8 @@ export declare function buildDefaultCorsOrigins(params: {
 }): string[];
 /**
  * Effective browser origins for CORS and CSRF checks.
- * Custom `gateway.corsOrigins` (e.g. after LAN pairing) still merge loopback Vite dev origins.
+ * Configured origins extend the gateway's own browser origins instead of replacing them.
+ * This keeps the bundled console reachable while allowing explicit external frontends.
  */
 export declare function resolveGatewayCorsOrigins(params: {
     configuredOrigins?: string[];

package/dist/src/gateway/host.js

@@ -1,4 +1,5 @@
 import "../daemon/constants.js";
+import { networkInterfaces } from "node:os";
 //#region src/gateway/host.ts
 /** True when the bind address is local-only (127.x, localhost, ::1). */
 function isLoopbackHost(host) {
@@ -17,6 +18,21 @@ const GATEWAY_DEV_CONSOLE_ORIGINS = ["http://localhost:3000", "http://127.0.0.1:
 /** Expo / React Native web dev server (Metro defaults to port 8081). */
 const GATEWAY_EXPO_DEV_ORIGINS = ["http://localhost:8081", "http://127.0.0.1:8081"];
 const GATEWAY_LOOPBACK_DEV_ORIGINS = [...GATEWAY_DEV_CONSOLE_ORIGINS, ...GATEWAY_EXPO_DEV_ORIGINS];
+/** Non-internal IPv4 addresses that can serve this gateway on the local network. */
+function enumerateLanGatewayCandidates(port) {
+	const seen = /* @__PURE__ */ new Set();
+	const candidates = [];
+	for (const [interfaceName, addresses] of Object.entries(networkInterfaces())) for (const address of addresses ?? []) {
+		if (address.family !== "IPv4" || address.internal || seen.has(address.address)) continue;
+		seen.add(address.address);
+		candidates.push({
+			address: address.address,
+			interfaceName,
+			url: `http://${address.address}:${port}`
+		});
+	}
+	return candidates;
+}
 /** Effective HTTP listen port: CLI `--port` override wins over config (default 18790). */
 function resolveEffectiveGatewayPort(config, listenPortOverride) {
 	if (typeof listenPortOverride === "number" && Number.isFinite(listenPortOverride)) return listenPortOverride;
@@ -35,19 +51,20 @@ function buildDefaultCorsOrigins(params) {
 	]);
 	const bindHost = params.bindHost?.trim();
 	if (bindHost && !isLoopbackHost(bindHost) && !isAllInterfacesHost(bindHost)) origins.add(`http://${bindHost}:${params.port}`);
+	if (isAllInterfacesHost(bindHost)) for (const candidate of enumerateLanGatewayCandidates(params.port)) origins.add(candidate.url);
 	return [...origins];
 }
 /**
 * Effective browser origins for CORS and CSRF checks.
-* Custom `gateway.corsOrigins` (e.g. after LAN pairing) still merge loopback Vite dev origins.
+* Configured origins extend the gateway's own browser origins instead of replacing them.
+* This keeps the bundled console reachable while allowing explicit external frontends.
 */
 function resolveGatewayCorsOrigins(params) {
 	const configured = (params.configuredOrigins ?? []).map((origin) => origin.trim()).filter(Boolean);
-	if (configured.length === 0) return buildDefaultCorsOrigins({
+	return [...new Set([...configured, ...buildDefaultCorsOrigins({
 		port: params.port,
 		bindHost: params.bindHost
-	});
-	return [...new Set([...configured, ...GATEWAY_LOOPBACK_DEV_ORIGINS])];
+	})])];
 }
 /** Browser origin (`https://host`) from a gateway public/tunnel root URL. */
 function originFromGatewayPublicUrl(publicUrl) {
@@ -73,4 +90,4 @@ function resolveAllowedBrowserOrigins(params) {
 	return origins;
 }
 //#endregion
-export { GATEWAY_DEV_CONSOLE_ORIGINS, GATEWAY_EXPO_DEV_ORIGINS, buildDefaultCorsOrigins, isAllInterfacesHost, isLoopbackHost, originFromGatewayPublicUrl, resolveAllowedBrowserOrigins, resolveEffectiveGatewayPort, resolveGatewayCorsOrigins, resolveGatewayServiceListenPort };
+export { GATEWAY_DEV_CONSOLE_ORIGINS, GATEWAY_EXPO_DEV_ORIGINS, buildDefaultCorsOrigins, enumerateLanGatewayCandidates, isAllInterfacesHost, isLoopbackHost, originFromGatewayPublicUrl, resolveAllowedBrowserOrigins, resolveEffectiveGatewayPort, resolveGatewayCorsOrigins, resolveGatewayServiceListenPort };

package/dist/src/gateway/rate-limit/buckets.d.ts

@@ -36,6 +36,7 @@ declare class BucketRegistry {
     private authFailureSignature?;
     private strictApiLimiter?;
     private chatApiLimiter?;
+    private taskApiLimiter?;
     private xopcCloudPollLimiter?;
     private channelApiLimiter?;
     private tunnelMutateLimiter?;
@@ -52,6 +53,8 @@ declare class BucketRegistry {
     strictApi(): RateLimiter;
     /** Interactive chat actions — 180 req / 60 s per client IP. */
     chatApi(): RateLimiter;
+    /** Interactive task and board mutations — 300 req / 60 s per client IP. */
+    taskApi(): RateLimiter;
     /** XOPC Cloud authorization polling — 60 req / 60 s per client IP. */
     xopcCloudPoll(): RateLimiter;
     /** Channel mutation/action endpoints — 20 req / 60 s per client IP. */

package/dist/src/gateway/rate-limit/buckets.js

@@ -48,6 +48,7 @@ var BucketRegistry = class {
 	authFailureSignature;
 	strictApiLimiter;
 	chatApiLimiter;
+	taskApiLimiter;
 	xopcCloudPollLimiter;
 	channelApiLimiter;
 	tunnelMutateLimiter;
@@ -89,6 +90,14 @@ var BucketRegistry = class {
 		});
 		return this.chatApiLimiter;
 	}
+	/** Interactive task and board mutations — 300 req / 60 s per client IP. */
+	taskApi() {
+		if (!this.taskApiLimiter) this.taskApiLimiter = new RateLimiter({
+			maxRequests: 300,
+			windowMs: 6e4
+		});
+		return this.taskApiLimiter;
+	}
 	/** XOPC Cloud authorization polling — 60 req / 60 s per client IP. */
 	xopcCloudPoll() {
 		if (!this.xopcCloudPollLimiter) this.xopcCloudPollLimiter = new RateLimiter({
@@ -142,6 +151,7 @@ var BucketRegistry = class {
 		this.authFailureLimiter?.destroy();
 		this.strictApiLimiter?.destroy();
 		this.chatApiLimiter?.destroy();
+		this.taskApiLimiter?.destroy();
 		this.xopcCloudPollLimiter?.destroy();
 		this.channelApiLimiter?.destroy();
 		this.tunnelMutateLimiter?.destroy();
@@ -151,6 +161,7 @@ var BucketRegistry = class {
 		this.authFailureLimiter = void 0;
 		this.strictApiLimiter = void 0;
 		this.chatApiLimiter = void 0;
+		this.taskApiLimiter = void 0;
 		this.xopcCloudPollLimiter = void 0;
 		this.channelApiLimiter = void 0;
 		this.tunnelMutateLimiter = void 0;
@@ -164,6 +175,7 @@ var BucketRegistry = class {
 		this.authFailureLimiter?.resetForTests();
 		this.strictApiLimiter?.resetForTests();
 		this.chatApiLimiter?.resetForTests();
+		this.taskApiLimiter?.resetForTests();
 		this.xopcCloudPollLimiter?.resetForTests();
 		this.channelApiLimiter?.resetForTests();
 		this.tunnelMutateLimiter?.resetForTests();

package/dist/src/gateway/runtime-config.js

@@ -1,12 +1,9 @@
-import { isAllInterfacesHost, isLoopbackHost } from "./host.js";
+import { isAllInterfacesHost, isLoopbackHost, resolveGatewayCorsOrigins } from "./host.js";
 import { isAuthRateLimitGloballyDisabled, isGatewayStrictSecurityEnabled } from "./rate-limit/env-flags.js";
 import "./rate-limit/index.js";
 import { resolveGatewayListenPlan } from "./listen.js";
 import { assertTailscaleExposureCompatible } from "./tailscale-lifecycle.js";
 //#region src/gateway/runtime-config.ts
-function normalizeCorsOrigins(cfg) {
-	return (cfg.gateway?.corsOrigins ?? []).map((value) => value.trim()).filter(Boolean);
-}
 function hasSharedSecret(auth) {
 	if (auth.mode === "trusted-proxy") return true;
 	if (auth.mode === "token") return typeof auth.token === "string" && auth.token.trim().length > 0;
@@ -23,7 +20,11 @@ function assertGatewayRuntimeConfig(params) {
 		bindOverride: params.bindOverride
 	});
 	const loopback = isLoopbackHost(bindHost);
-	const corsOrigins = normalizeCorsOrigins(params.cfg);
+	const corsOrigins = resolveGatewayCorsOrigins({
+		configuredOrigins: params.cfg.gateway?.corsOrigins,
+		port: params.port,
+		bindHost
+	});
 	const dangerouslyAllowHostHeaderOriginFallback = params.cfg.gateway?.dangerouslyAllowHostHeaderOriginFallback === true;
 	if (bindMode === "loopback" && !loopback) throw new Error(`gateway bind=loopback resolved to non-loopback host ${bindHost}; refusing fallback to a network bind`);
 	if (bindMode === "custom") {

package/dist/src/gateway/security/audit.js

@@ -110,13 +110,6 @@ function collectGatewayConfigFindings(params) {
 		title: "Large number of CORS origins configured",
 		detail: `${params.corsOrigins.length} CORS origins configured. Review whether all are necessary.`
 	});
-	if (!loopback && (!params.corsOrigins || params.corsOrigins.length === 0) && params.dangerouslyAllowHostHeaderOriginFallback !== true) findings.push({
-		checkId: "gateway.cors.no_explicit_origins",
-		severity: "info",
-		title: "No custom CORS origins — loopback browsers only",
-		detail: "Gateway listens on a network address with empty gateway.corsOrigins. localhost and 127.0.0.1 on the gateway port are allowed by default; LAN or remote browser URLs must be added explicitly.",
-		remediation: "Add gateway.corsOrigins entries (e.g. http://192.168.x.x:<port>) for non-loopback browser access, or enable gateway.dangerouslyAllowHostHeaderOriginFallback only if you understand the CSRF risk."
-	});
 	if (!loopback && params.auth.mode !== "none" && params.auth.mode !== "trusted-proxy" && params.rateLimitEnabled === false) findings.push({
 		checkId: "gateway.auth.no_rate_limit",
 		severity: "warn",

package/dist/src/gateway/server.js

@@ -51,7 +51,10 @@ var GatewayServer = class {
 		});
 		const { configureTunnelFromGatewayConfig } = await import("../tunnel/gateway-lifecycle.js");
 		await configureTunnelFromGatewayConfig(this.service.currentConfig, { deferWellKnownFetch: true });
-		const app = createHonoApp({ service: this.service });
+		const app = createHonoApp({
+			service: this.service,
+			listenHost: bindHost
+		});
 		const primaryHost = listenHosts[0] ?? bindHost;
 		const attachUpgrade = (server) => {
 			server.on("upgrade", (req, socket, head) => {

package/dist/src/gateway/service/agent-runner.d.ts

@@ -49,6 +49,7 @@ export declare class GatewayAgentRunner {
     private readonly clarifyBridge;
     /** Maps webchat session key → active `runId` for `clarify` tool routing. */
     private readonly activeWebchatRunBySession;
+    private readonly externalStreamBySession;
     readonly inputs: SessionInputCoordinator;
     constructor(opts: GatewayAgentRunnerOptions);
     /** True when a webchat agent run is currently in-flight for `sessionKey`. */
@@ -57,6 +58,9 @@ export declare class GatewayAgentRunner {
     getClarifyBridge(): ClarifyBridge;
     /** Called from `GatewayService.stop()` so the bridge gets cleaned up. */
     disposeClarifyBridge(): void;
+    registerExternalWebchatRun(sessionKey: string, runId: string, publish: (event: ClarifyStreamEvent) => void): void;
+    unregisterExternalWebchatRun(sessionKey: string, runId: string): void;
+    cancelClarificationForRun(runId: string): void;
     runAgent(message: string, channel: string, chatId: string, origin: TurnOrigin, attachments?: UserTurnAttachment[], thinking?: string, runOptions?: {
         signal?: AbortSignal;
         runId?: string;