@xopcai/xopc 0.0.197 → 0.0.199

package/dist/src/agent/tools/xopc-use-tool.d.ts

@@ -26,6 +26,7 @@ export interface XopcUseToolDeps {
     getNotesService?: () => NotesService | undefined;
     getProjectService?: () => ProjectService | undefined;
     getLocalAppService?: () => LocalAppService | undefined;
+    dispatchTaskEvents?: () => void;
     dispatchTaskRuns?: () => void;
 }
 type XopcUseDetails = {

package/dist/src/agent/tools/xopc-use-tool.js

@@ -1,4 +1,5 @@
 import { runWithActivityContext } from "../../activity/context.js";
+import { runSqliteWriteTransaction } from "../../storage/sqlite/transaction.js";
 import { getSessionMetadata } from "../../storage/sqlite/session-repository.js";
 import "../../storage/sqlite/index.js";
 import { ObjectLinkService } from "../../activity/service.js";
@@ -13,6 +14,7 @@ import "../../automations/index.js";
 import { isValidProjectAgentId, normalizeProjectAgentId } from "../../projects/project-agent.js";
 import "../../projects/index.js";
 import { TaskContextRepository } from "../../tasks/task-context-repository.js";
+import { enqueueTaskChangedEvent } from "../../tasks/task-change-events.js";
 import { TaskDependencyError, TaskDependencyService } from "../../tasks/task-dependency-service.js";
 import { TaskApplicationService } from "../../tasks/task-application-service.js";
 import { defineTaskContract } from "../../tasks/task-contract-definition.js";
@@ -1241,6 +1243,7 @@ async function handleTask(command, args, deps, dryRun) {
 			...created
 		};
 		if (created.runId) deps.dispatchTaskRuns?.();
+		else deps.dispatchTaskEvents?.();
 		return {
 			ok: true,
 			task: created.model.task,
@@ -1274,13 +1277,28 @@ async function handleTask(command, args, deps, dryRun) {
 			dependsOnTaskIds
 		};
 		try {
-			return {
-				ok: true,
-				task: dependencies.replace({
+			const task = runSqliteWriteTransaction((db) => {
+				const changed = dependencies.replace({
 					taskId: id,
 					dependsOnTaskIds,
 					expectedVersion
-				}),
+				});
+				enqueueTaskChangedEvent(db, {
+					taskId: changed.id,
+					projectId: changed.projectId,
+					version: changed.version,
+					changedFields: ["dependencies"],
+					actor: {
+						kind: "agent",
+						id: deps.getCurrentAgentId?.()
+					}
+				});
+				return changed;
+			});
+			deps.dispatchTaskEvents?.();
+			return {
+				ok: true,
+				task,
 				dependencies: dependencies.listDependencies(id),
 				dependents: dependencies.listDependents(id)
 			};
@@ -1330,9 +1348,22 @@ async function handleTask(command, args, deps, dryRun) {
 			action: "add_task_context",
 			input
 		};
+		const task = tasks.require(id);
+		const edge = runSqliteWriteTransaction((db) => {
+			const created = context.add(input);
+			enqueueTaskChangedEvent(db, {
+				taskId: task.id,
+				projectId: task.projectId,
+				version: task.version,
+				changedFields: ["context"],
+				actor: input.createdBy
+			});
+			return created;
+		});
+		deps.dispatchTaskEvents?.();
 		return {
 			ok: true,
-			edge: context.add(input),
+			edge,
 			context: context.list(id)
 		};
 	}
@@ -1354,7 +1385,24 @@ async function handleTask(command, args, deps, dryRun) {
 			taskId: id,
 			edgeId
 		};
-		return context.remove(id, edgeId) ? {
+		const task = tasks.get(id);
+		const actor = {
+			kind: "agent",
+			id: deps.getCurrentAgentId?.()
+		};
+		const removed = task ? runSqliteWriteTransaction((db) => {
+			const didRemove = context.remove(id, edgeId);
+			if (didRemove) enqueueTaskChangedEvent(db, {
+				taskId: task.id,
+				projectId: task.projectId,
+				version: task.version,
+				changedFields: ["context"],
+				actor
+			});
+			return didRemove;
+		}) : false;
+		if (removed) deps.dispatchTaskEvents?.();
+		return removed ? {
 			ok: true,
 			taskId: id,
 			edgeId,
@@ -1418,6 +1466,7 @@ async function handleTask(command, args, deps, dryRun) {
 			...result
 		};
 		if (result.runId) deps.dispatchTaskRuns?.();
+		else deps.dispatchTaskEvents?.();
 		return {
 			ok: true,
 			task: result.model.task,
@@ -1527,6 +1576,7 @@ async function handleTaskRun(command, args, dryRun, deps) {
 			error: result.reason,
 			...result
 		};
+		deps.dispatchTaskEvents?.();
 		return {
 			ok: true,
 			run: runs.get(runId),

package/dist/src/automations/domain/validation.d.ts

@@ -67,6 +67,14 @@ export declare const AutomationActionSchema: z.ZodDiscriminatedUnion<[z.ZodObjec
     kind: z.ZodLiteral<"task_command">;
     taskId: z.ZodString;
     command: z.ZodDiscriminatedUnion<[z.ZodObject<{
+        type: z.ZodLiteral<"move">;
+        phase: z.ZodEnum<{
+            active: "active";
+            review: "review";
+            ready: "ready";
+            backlog: "backlog";
+        }>;
+    }, z.core.$strip>, z.ZodObject<{
         type: z.ZodLiteral<"mark_ready">;
     }, z.core.$strip>, z.ZodObject<{
         type: z.ZodLiteral<"start">;
@@ -101,7 +109,9 @@ export declare const AutomationActionSchema: z.ZodDiscriminatedUnion<[z.ZodObjec
         type: z.ZodLiteral<"reopen">;
         phase: z.ZodEnum<{
             active: "active";
+            review: "review";
             ready: "ready";
+            backlog: "backlog";
         }>;
     }, z.core.$strip>, z.ZodObject<{
         type: z.ZodLiteral<"add_wait">;
@@ -245,6 +255,14 @@ export declare const AutomationSchema: z.ZodObject<{
         kind: z.ZodLiteral<"task_command">;
         taskId: z.ZodString;
         command: z.ZodDiscriminatedUnion<[z.ZodObject<{
+            type: z.ZodLiteral<"move">;
+            phase: z.ZodEnum<{
+                active: "active";
+                review: "review";
+                ready: "ready";
+                backlog: "backlog";
+            }>;
+        }, z.core.$strip>, z.ZodObject<{
             type: z.ZodLiteral<"mark_ready">;
         }, z.core.$strip>, z.ZodObject<{
             type: z.ZodLiteral<"start">;
@@ -279,7 +297,9 @@ export declare const AutomationSchema: z.ZodObject<{
             type: z.ZodLiteral<"reopen">;
             phase: z.ZodEnum<{
                 active: "active";
+                review: "review";
                 ready: "ready";
+                backlog: "backlog";
             }>;
         }, z.core.$strip>, z.ZodObject<{
             type: z.ZodLiteral<"add_wait">;
@@ -398,6 +418,14 @@ export declare const CreateAutomationSchema: z.ZodObject<{
         kind: z.ZodLiteral<"task_command">;
         taskId: z.ZodString;
         command: z.ZodDiscriminatedUnion<[z.ZodObject<{
+            type: z.ZodLiteral<"move">;
+            phase: z.ZodEnum<{
+                active: "active";
+                review: "review";
+                ready: "ready";
+                backlog: "backlog";
+            }>;
+        }, z.core.$strip>, z.ZodObject<{
             type: z.ZodLiteral<"mark_ready">;
         }, z.core.$strip>, z.ZodObject<{
             type: z.ZodLiteral<"start">;
@@ -432,7 +460,9 @@ export declare const CreateAutomationSchema: z.ZodObject<{
             type: z.ZodLiteral<"reopen">;
             phase: z.ZodEnum<{
                 active: "active";
+                review: "review";
                 ready: "ready";
+                backlog: "backlog";
             }>;
         }, z.core.$strip>, z.ZodObject<{
             type: z.ZodLiteral<"add_wait">;
@@ -578,6 +608,14 @@ export declare const UpdateAutomationSchema: z.ZodObject<{
         kind: z.ZodLiteral<"task_command">;
         taskId: z.ZodString;
         command: z.ZodDiscriminatedUnion<[z.ZodObject<{
+            type: z.ZodLiteral<"move">;
+            phase: z.ZodEnum<{
+                active: "active";
+                review: "review";
+                ready: "ready";
+                backlog: "backlog";
+            }>;
+        }, z.core.$strip>, z.ZodObject<{
             type: z.ZodLiteral<"mark_ready">;
         }, z.core.$strip>, z.ZodObject<{
             type: z.ZodLiteral<"start">;
@@ -612,7 +650,9 @@ export declare const UpdateAutomationSchema: z.ZodObject<{
             type: z.ZodLiteral<"reopen">;
             phase: z.ZodEnum<{
                 active: "active";
+                review: "review";
                 ready: "ready";
+                backlog: "backlog";
             }>;
         }, z.core.$strip>, z.ZodObject<{
             type: z.ZodLiteral<"add_wait">;

package/dist/src/automations/draft/automation-draft-validator.d.ts

@@ -43,6 +43,9 @@ export declare function buildAutomationDraftResponse(draft: GeneratedAutomationD
             kind: "task_command";
             taskId: string;
             command?: {
+                type: "move";
+                phase: "active" | "review" | "ready" | "backlog";
+            } | {
                 type: "mark_ready";
             } | {
                 type: "start";
@@ -70,7 +73,7 @@ export declare function buildAutomationDraftResponse(draft: GeneratedAutomationD
                 resolution: "cancelled" | "done" | "duplicate" | "wont_do";
             } | {
                 type: "reopen";
-                phase: "active" | "ready";
+                phase: "active" | "review" | "ready" | "backlog";
             } | {
                 type: "add_wait";
                 wait: {

package/dist/src/cli/commands/doctor/checks/database-schema.js

@@ -52,7 +52,7 @@ async function checkDatabaseSchema(ctx) {
 		id: "database-schema",
 		label: "Database schema",
 		status: "pass",
-		message: `SQLite schema v${status.dbVersion} (current release v117).`,
+		message: `SQLite schema v${status.dbVersion} (current release v119).`,
 		hints: []
 	};
 }

package/dist/src/config/rules.js

@@ -75,8 +75,8 @@ const BASE_RELOAD_RULES = [
 	},
 	{
 		prefix: "gateway.corsOrigins",
-		kind: "restart",
-		description: "CORS settings"
+		kind: "hot",
+		description: "CORS allowlist"
 	},
 	{
 		prefix: "gateway.trustedProxies",

package/dist/src/gateway/hono/app.d.ts

@@ -2,6 +2,8 @@ import { Hono } from 'hono';
 import type { GatewayService } from '../service.js';
 export interface HonoAppConfig {
     service: GatewayService;
+    /** Actual host selected for this process; bind config changes take effect after restart. */
+    listenHost?: string;
 }
 /**
  * Extension sandbox HTML under `/api/extensions/:id/assets/*` ships its own CSP

package/dist/src/gateway/hono/app.js

@@ -10,7 +10,7 @@ import { buildGatewayConsoleCspHeader } from "../security/csp.js";
 import { checkBrowserOrigin } from "../security/origin-check.js";
 import { auth } from "./middleware/auth.js";
 import { operatorScopes } from "./middleware/scopes.js";
-import { createChannelRateLimitMiddleware, createChatRateLimitMiddleware, createStrictRateLimitMiddleware, createXopcCloudPollRateLimitMiddleware } from "./middleware/strict-rate-limit.js";
+import { createChannelRateLimitMiddleware, createChatRateLimitMiddleware, createStrictRateLimitMiddleware, createTaskRateLimitMiddleware, createXopcCloudPollRateLimitMiddleware } from "./middleware/strict-rate-limit.js";
 import { logContextMiddleware } from "./middleware/log-context.js";
 import { logger } from "./middleware/logger.js";
 import { routeErrorMiddleware } from "./middleware/route-errors.js";
@@ -42,10 +42,11 @@ function createHonoApp(config) {
 	const { service } = config;
 	const app = new Hono();
 	const gatewayPort = resolveGatewayServiceListenPort(service);
+	const gatewayBindHost = config.listenHost ?? resolveGatewayEffectiveHost(service.currentConfig);
 	const resolveBrowserOrigins = () => resolveAllowedBrowserOrigins({
 		configuredOrigins: service.currentConfig.gateway.corsOrigins,
 		port: gatewayPort,
-		bindHost: resolveGatewayEffectiveHost(service.currentConfig),
+		bindHost: gatewayBindHost,
 		tunnelPublicUrl: loadTunnelState()?.publicUrl,
 		reverseProxyPublicUrl: resolveReverseProxyPublicUrl(service.currentConfig)
 	});
@@ -153,6 +154,7 @@ function createHonoApp(config) {
 		if (/^\/api\/notes\/[^/]+\/media$/.test(path)) return true;
 		return path === "/api/notes" && contentType?.includes("multipart/form-data") === true;
 	};
+	const isProjectFileUploadRequest = (path, method, contentType) => method === "POST" && /^\/api\/projects\/[^/]+\/files\/upload$/.test(path) && contentType?.includes("multipart/form-data") === true;
 	const discussionUploadBodyMax = (path, method, contentType) => {
 		if (method !== "PUT" || contentType?.includes("multipart/form-data") !== true) return void 0;
 		if (/^\/api\/discussions\/[^/]+\/recording$/.test(path)) return NOTE_MEDIA_BODY_MAX;
@@ -173,7 +175,7 @@ function createHonoApp(config) {
 	}));
 	app.use("/api/*", async (c, next) => {
 		const contentType = c.req.header("content-type");
-		const maxSize = c.req.method === "POST" && c.req.path === "/api/tasks" || c.req.method === "POST" && /^\/api\/sessions\/[^/]+\/inputs$/.test(c.req.path) || c.req.method === "PATCH" && /^\/api\/sessions\/[^/]+\/inputs\/[^/]+$/.test(c.req.path) ? SESSION_INPUT_BODY_MAX : c.req.path === "/api/skills/upload" ? SKILL_UPLOAD_BODY_MAX : c.req.path === "/api/voice/transcribe" || c.req.path === "/api/voice/transcriptions" ? VOICE_TRANSCRIBE_BODY_MAX : isNoteMediaUploadRequest(c.req.path, c.req.method, contentType) ? NOTE_MEDIA_BODY_MAX : discussionUploadBodyMax(c.req.path, c.req.method, contentType) ?? DEFAULT_API_BODY_MAX;
+		const maxSize = c.req.method === "POST" && c.req.path === "/api/tasks" || c.req.method === "POST" && /^\/api\/sessions\/[^/]+\/inputs$/.test(c.req.path) || c.req.method === "PATCH" && /^\/api\/sessions\/[^/]+\/inputs\/[^/]+$/.test(c.req.path) ? SESSION_INPUT_BODY_MAX : c.req.path === "/api/skills/upload" ? SKILL_UPLOAD_BODY_MAX : c.req.path === "/api/voice/transcribe" || c.req.path === "/api/voice/transcriptions" ? VOICE_TRANSCRIBE_BODY_MAX : isNoteMediaUploadRequest(c.req.path, c.req.method, contentType) ? NOTE_MEDIA_BODY_MAX : isProjectFileUploadRequest(c.req.path, c.req.method, contentType) ? NOTE_MEDIA_BODY_MAX : discussionUploadBodyMax(c.req.path, c.req.method, contentType) ?? DEFAULT_API_BODY_MAX;
 		const maxSizeMb = Math.ceil(maxSize / (1024 * 1024));
 		return bodyLimit({
 			maxSize,
@@ -211,6 +213,10 @@ function createHonoApp(config) {
 		trustedProxies: service.currentConfig.gateway?.trustedProxies,
 		allowRealIpFallback: service.currentConfig.gateway?.allowRealIpFallback === true
 	}) });
+	const taskRateLimitMiddleware = createTaskRateLimitMiddleware({ getTrustedProxyContext: () => ({
+		trustedProxies: service.currentConfig.gateway?.trustedProxies,
+		allowRealIpFallback: service.currentConfig.gateway?.allowRealIpFallback === true
+	}) });
 	const channelRateLimitMiddleware = createChannelRateLimitMiddleware({ getTrustedProxyContext: () => ({
 		trustedProxies: service.currentConfig.gateway?.trustedProxies,
 		allowRealIpFallback: service.currentConfig.gateway?.allowRealIpFallback === true
@@ -219,6 +225,7 @@ function createHonoApp(config) {
 		service,
 		strictRateLimitMiddleware,
 		chatRateLimitMiddleware,
+		taskRateLimitMiddleware,
 		xopcCloudPollRateLimitMiddleware: createXopcCloudPollRateLimitMiddleware({ getTrustedProxyContext: () => ({
 			trustedProxies: service.currentConfig.gateway?.trustedProxies,
 			allowRealIpFallback: service.currentConfig.gateway?.allowRealIpFallback === true

package/dist/src/gateway/hono/middleware/strict-rate-limit.d.ts

@@ -16,6 +16,10 @@ export declare function createChatRateLimitMiddleware(deps: StrictRateLimitDeps)
     error: string;
     code: string;
 }, 429, "json">>;
+export declare function createTaskRateLimitMiddleware(deps: StrictRateLimitDeps): import("hono").MiddlewareHandler<any, string, {}, Response & import("hono").TypedResponse<{
+    error: string;
+    code: string;
+}, 429, "json">>;
 export declare function createXopcCloudPollRateLimitMiddleware(deps: StrictRateLimitDeps): import("hono").MiddlewareHandler<any, string, {}, Response & import("hono").TypedResponse<{
     error: string;
     code: string;

package/dist/src/gateway/hono/middleware/strict-rate-limit.js

@@ -70,6 +70,13 @@ function createChatRateLimitMiddleware(deps) {
 		reason: "chat_rate_limit_exceeded"
 	});
 }
+function createTaskRateLimitMiddleware(deps) {
+	return createClientRateLimitMiddleware(deps, {
+		limiter: () => buckets.taskApi(),
+		exceededMessage: "Task API rate limit exceeded",
+		reason: "task_rate_limit_exceeded"
+	});
+}
 function createXopcCloudPollRateLimitMiddleware(deps) {
 	return createClientRateLimitMiddleware(deps, {
 		limiter: () => buckets.xopcCloudPoll(),
@@ -85,4 +92,4 @@ function createChannelRateLimitMiddleware(deps) {
 	});
 }
 //#endregion
-export { createChannelRateLimitMiddleware, createChatRateLimitMiddleware, createStrictRateLimitMiddleware, createXopcCloudPollRateLimitMiddleware };
+export { createChannelRateLimitMiddleware, createChatRateLimitMiddleware, createStrictRateLimitMiddleware, createTaskRateLimitMiddleware, createXopcCloudPollRateLimitMiddleware };

package/dist/src/gateway/hono/routes/config-patch/misc.js

@@ -176,12 +176,13 @@ async function applyMiscPatch(config, body) {
 function validateGatewayAfterPatch(config, body) {
 	if (body.gateway === void 0) return PATCH_OK;
 	try {
+		const port = config.gateway?.port ?? 18790;
 		const auth = resolveGatewayAuth({ authConfig: config.gateway?.auth });
 		assertGatewayAuthConfigured(auth);
 		assertGatewayRuntimeConfig({
 			cfg: config,
 			auth,
-			port: config.gateway?.port ?? 18790
+			port
 		});
 	} catch (err) {
 		return patchError(err instanceof Error ? err.message : String(err));

package/dist/src/gateway/hono/routes/config.js

@@ -1,3 +1,4 @@
+import { enumerateLanGatewayCandidates } from "../../host.js";
 import { buildSafeWebConfigPayload } from "../lib/config-payload.js";
 import { applyAgentsPatch } from "./config-patch/agents.js";
 import { applyChannelsPatch } from "./config-patch/channels.js";
@@ -39,6 +40,14 @@ function registerConfigRoutes(authenticated, deps) {
 			payload: { config: safeConfig }
 		});
 	});
+	authenticated.get("/api/gateway/cors-origin-candidates", (c) => {
+		const requestedPort = Number(c.req.query("port"));
+		const port = Number.isInteger(requestedPort) && requestedPort >= 1 && requestedPort <= 65535 ? requestedPort : service.currentConfig.gateway?.port ?? 18790;
+		return c.json({
+			ok: true,
+			payload: { candidates: enumerateLanGatewayCandidates(port) }
+		});
+	});
 	authenticated.patch("/api/config", strictRateLimitMiddleware, async (c) => {
 		const body = await c.req.json();
 		const config = service.currentConfig;

package/dist/src/gateway/hono/routes/deps.d.ts

@@ -4,6 +4,7 @@ export interface AuthenticatedRouteDeps {
     service: GatewayService;
     strictRateLimitMiddleware: MiddlewareHandler;
     chatRateLimitMiddleware: MiddlewareHandler;
+    taskRateLimitMiddleware?: MiddlewareHandler;
     xopcCloudPollRateLimitMiddleware: MiddlewareHandler;
     channelRateLimitMiddleware?: MiddlewareHandler;
 }

package/dist/src/gateway/hono/routes/projects.js

@@ -1128,6 +1128,61 @@ function registerProjectsRoutes(authenticated, deps) {
 			}, 500);
 		}
 	});
+	authenticated.post("/api/projects/:id/files/upload", async (c) => {
+		let body;
+		try {
+			body = await c.req.parseBody();
+		} catch {
+			return c.json({
+				ok: false,
+				error: { message: "Invalid multipart body" }
+			}, 400);
+		}
+		const file = body.file;
+		if (!(file instanceof File)) return c.json({
+			ok: false,
+			error: { message: "Missing file" }
+		}, 400);
+		const requestedPath = typeof body.path === "string" ? body.path.trim() : "";
+		if (!requestedPath) return c.json({
+			ok: false,
+			error: { message: "Missing path" }
+		}, 400);
+		const resolved = await resolveProjectWorkspaceWritePath(service, c.req.param("id"), requestedPath);
+		if (resolved.ok === false) return c.json({
+			ok: false,
+			error: { message: resolved.error }
+		}, resolved.status);
+		if (resolved.existingStat) return c.json({
+			ok: false,
+			error: { message: "File already exists" }
+		}, 409);
+		try {
+			await writeFile(resolved.absolutePath, Buffer.from(await file.arrayBuffer()), { flag: "wx" });
+			const entryStat = await stat(resolved.absolutePath);
+			return c.json({
+				ok: true,
+				entry: {
+					name: path$1.basename(resolved.relativePath),
+					path: resolved.relativePath,
+					absolutePath: resolved.absolutePath,
+					type: "file",
+					size: entryStat.size,
+					updatedAt: entryStat.mtime.toISOString()
+				}
+			}, 201);
+		} catch (err) {
+			log.error({
+				err,
+				projectId: resolved.projectId,
+				path: resolved.absolutePath
+			}, "project file upload failed");
+			return c.json({
+				ok: false,
+				error: { message: "Upload failed" }
+			}, 500);
+		}
+	});
 	authenticated.post("/api/projects/:id/sessions/:sessionKey", async (c) => {
 		try {
 			service.projects.attachSession(c.req.param("sessionKey"), c.req.param("id"));