@xopcai/xopc 0.0.197 → 0.0.200

package/dist/src/gateway/hono/routes/tasks.js

@@ -1,18 +1,26 @@
+import { runSqliteWriteTransaction } from "../../../storage/sqlite/transaction.js";
 import { TaskRepository } from "../../../tasks/task-repository.js";
+import { TaskConversationRepository } from "../../../tasks/task-conversation-repository.js";
 import { TaskRunRepository } from "../../../tasks/task-run-repository.js";
 import { TaskReadModelProjector } from "../../../tasks/task-read-model-projector.js";
 import { TaskPhaseSchema } from "../../../../packages/gateway-contract/src/task-lifecycle.js";
-import { TaskCommandRequestSchema, TaskContextInputSchema, TaskCreateRequestSchema, TaskDependencyUpdateRequestSchema, TaskPatchRequestSchema } from "../../../../packages/gateway-contract/src/tasks.js";
+import { TaskBoardPositionRequestSchema, TaskCommandRequestSchema, TaskContextInputSchema, TaskCreateRequestSchema, TaskDependencyUpdateRequestSchema, TaskHandoffRequestSchema, TaskPatchRequestSchema } from "../../../../packages/gateway-contract/src/tasks.js";
 import { ProjectMonitoringUpdateSchema } from "../../../../packages/gateway-contract/src/project-monitoring.js";
+import { resolveProjectAgentId } from "../../../projects/project-agent.js";
 import { TaskContextRepository } from "../../../tasks/task-context-repository.js";
+import { enqueueTaskChangedEvent } from "../../../tasks/task-change-events.js";
 import { TaskDependencyError, TaskDependencyService } from "../../../tasks/task-dependency-service.js";
 import { TaskApplicationService } from "../../../tasks/task-application-service.js";
 import { ProjectMonitoringService } from "../../../tasks/project-monitoring-service.js";
 import { ProjectOperatingViewService } from "../../../tasks/project-operating-view-service.js";
 import { TaskValueMetricsService } from "../../../tasks/task-value-metrics-service.js";
+import { TaskHandoffService } from "../../../tasks/task-handoff-service.js";
 import { TaskSignalService } from "../../../tasks/task-signal-service.js";
+import { submitSessionInput } from "./session-input-handler.js";
+import { TaskConversationQueryService } from "../../service/task-conversation-query-service.js";
 //#region src/gateway/hono/routes/tasks.ts
 function registerTaskRoutes(authenticated, deps) {
+	const taskRateLimit = deps.taskRateLimitMiddleware ?? deps.strictRateLimitMiddleware;
 	const application = new TaskApplicationService();
 	const operatingViews = new ProjectOperatingViewService(deps.service.projects);
 	const monitoring = new ProjectMonitoringService();
@@ -20,9 +28,17 @@ function registerTaskRoutes(authenticated, deps) {
 	const tasks = new TaskRepository();
 	const runs = new TaskRunRepository();
 	const context = new TaskContextRepository();
+	const conversations = new TaskConversationRepository();
+	const conversationQuery = new TaskConversationQueryService(deps.service.sessions);
 	const projector = new TaskReadModelProjector();
 	const signals = new TaskSignalService(() => deps.service.dispatchTaskRuns());
 	const dependencies = new TaskDependencyService();
+	const handoffs = new TaskHandoffService({
+		getConfig: () => deps.service.currentConfig,
+		sessionIndex: deps.service.sessionIndexInstance,
+		getActiveRunId: (sessionKey) => deps.service.getActiveWebchatRunId(sessionKey),
+		abortRun: (runId) => deps.service.abortAgentRun(runId)
+	});
 	authenticated.get("/api/tasks", (c) => {
 		const phase = TaskPhaseSchema.safeParse(c.req.query("phase"));
 		const rawLimit = Number(c.req.query("limit") ?? 50);
@@ -42,7 +58,7 @@ function registerTaskRoutes(authenticated, deps) {
 			})
 		});
 	});
-	authenticated.post("/api/tasks", deps.strictRateLimitMiddleware, async (c) => {
+	authenticated.post("/api/tasks", taskRateLimit, async (c) => {
 		const body = await c.req.json().catch(() => ({}));
 		const parsed = TaskCreateRequestSchema.safeParse(body);
 		if (!parsed.success) return c.json({
@@ -50,13 +66,32 @@ function registerTaskRoutes(authenticated, deps) {
 			error: "Invalid task request"
 		}, 400);
 		try {
-			const created = application.create(parsed.data);
+			const requestedAgentId = parsed.data.delegateAgentId ?? (parsed.data.activation.mode === "start" && parsed.data.activation.executor?.kind === "agent" ? parsed.data.activation.executor.agentId : void 0);
+			const agentId = resolveProjectAgentId({
+				config: deps.service.currentConfig,
+				projects: deps.service.projects,
+				explicitAgentId: requestedAgentId,
+				projectId: parsed.data.projectId
+			});
+			const input = {
+				...parsed.data,
+				delegateAgentId: agentId,
+				activation: parsed.data.activation.mode === "start" ? {
+					...parsed.data.activation,
+					executor: parsed.data.activation.executor?.kind === "agent" || !parsed.data.activation.executor ? {
+						kind: "agent",
+						agentId
+					} : parsed.data.activation.executor
+				} : parsed.data.activation
+			};
+			const created = application.create(input);
 			if (created.ok === false) return c.json({
 				ok: false,
 				code: created.reason,
 				error: created.reason
 			}, 409);
 			if (created.runId) deps.service.dispatchTaskRuns();
+			else deps.service.dispatchTaskEvents();
 			return c.json({
 				ok: true,
 				task: created.model.task,
@@ -91,39 +126,191 @@ function registerTaskRoutes(authenticated, deps) {
 			runs: runs.listByTask(task.id),
 			receipts: runs.listReceipts(task.id),
 			context: context.list(task.id),
+			conversation: conversations.requireState(task.id),
+			sessions: conversations.listSessions(task.id),
 			authorityGrants: context.listActiveGrants(task.id),
 			dependencies: dependencies.listDependencies(task.id),
 			dependents: dependencies.listDependents(task.id),
 			allowedCommands: model.allowedCommands
 		});
 	});
-	authenticated.patch("/api/tasks/:id", deps.strictRateLimitMiddleware, async (c) => {
+	authenticated.post("/api/tasks/:id/conversation", taskRateLimit, async (c) => {
+		try {
+			const result = await deps.service.ensureTaskConversation(c.req.param("id"));
+			if (result.created) {
+				const task = tasks.require(c.req.param("id"));
+				runSqliteWriteTransaction((db) => enqueueTaskChangedEvent(db, {
+					taskId: task.id,
+					projectId: task.projectId,
+					version: task.version,
+					changedFields: ["conversation"],
+					actor: { kind: "user" }
+				}));
+				deps.service.dispatchTaskEvents();
+			}
+			return c.json({
+				ok: true,
+				...result
+			});
+		} catch (error) {
+			const message = error instanceof Error ? error.message : String(error);
+			return c.json({
+				ok: false,
+				error: message
+			}, message.startsWith("Task not found") ? 404 : 409);
+		}
+	});
+	authenticated.post("/api/tasks/:id/handoff", taskRateLimit, async (c) => {
+		const parsed = TaskHandoffRequestSchema.safeParse(await c.req.json().catch(() => ({})));
+		if (!parsed.success) return c.json({
+			ok: false,
+			error: "Invalid task handoff request"
+		}, 400);
+		try {
+			const result = await handoffs.handoff({
+				taskId: c.req.param("id"),
+				...parsed.data
+			});
+			runSqliteWriteTransaction((db) => enqueueTaskChangedEvent(db, {
+				taskId: result.task.id,
+				projectId: result.task.projectId,
+				version: result.task.version,
+				changedFields: ["delegateAgentId", "conversation"],
+				actor: { kind: "user" }
+			}));
+			deps.service.dispatchTaskEvents();
+			return c.json({
+				ok: true,
+				task: result.task,
+				conversation: result.conversation,
+				...result.fromAgentId ? { fromAgentId: result.fromAgentId } : {},
+				toAgentId: result.toAgentId,
+				activeSessionKey: result.activeSessionKey,
+				assignmentEpoch: result.assignmentEpoch
+			});
+		} catch (error) {
+			const message = error instanceof Error ? error.message : String(error);
+			return c.json({
+				ok: false,
+				error: message
+			}, message.startsWith("Agent not found") || message.startsWith("Task not found") ? 404 : 409);
+		}
+	});
+	authenticated.post("/api/tasks/:id/inputs", deps.chatRateLimitMiddleware, async (c) => {
+		const active = conversations.getActiveSession(c.req.param("id"));
+		if (!active?.sessionKey) return c.json({
+			ok: false,
+			error: {
+				code: "NOT_FOUND",
+				message: "Task has no active conversation"
+			}
+		}, 404);
+		const expectedSessionKey = c.req.header("X-Xopc-Expected-Session-Key")?.trim();
+		if (expectedSessionKey && expectedSessionKey !== active.sessionKey) return c.json({
+			ok: false,
+			error: {
+				code: "CONFLICT",
+				message: "Task executor changed; refresh the conversation"
+			}
+		}, 409);
+		return submitSessionInput(c, deps, active.sessionKey);
+	});
+	authenticated.patch("/api/tasks/:id/conversation/config", taskRateLimit, async (c) => {
+		const body = await c.req.json().catch(() => null);
+		const model = typeof body?.model === "string" ? body.model.trim() : "";
+		if (!model) return c.json({
+			ok: false,
+			error: "Missing model"
+		}, 400);
+		const active = conversations.getActiveSession(c.req.param("id"));
+		if (!active?.sessionKey) return c.json({
+			ok: false,
+			error: "Task has no active conversation"
+		}, 404);
+		const result = await deps.service.sessions.patchAgentConfig(active.sessionKey, { model });
+		if (!result.ok) return c.json({
+			ok: false,
+			error: result.error
+		}, 400);
+		return c.json({
+			ok: true,
+			activeSessionKey: active.sessionKey
+		});
+	});
+	authenticated.get("/api/tasks/:id/conversation/history", async (c) => {
+		const parsedLimit = Number.parseInt(c.req.query("limit") ?? "50", 10);
+		const parsedOffset = Number.parseInt(c.req.query("offset") ?? "0", 10);
+		const rawBefore = c.req.query("before")?.trim();
+		const before = rawBefore === void 0 ? void 0 : Number.parseInt(rawBefore, 10);
+		if (rawBefore !== void 0 && (!Number.isInteger(before) || before < 0)) return c.json({ error: "Invalid conversation history cursor" }, 400);
+		const result = await conversationQuery.getMessagePage(c.req.param("id"), {
+			limit: Number.isFinite(parsedLimit) ? Math.min(200, Math.max(1, parsedLimit)) : 50,
+			offset: Number.isFinite(parsedOffset) ? Math.max(0, parsedOffset) : 0,
+			...before === void 0 ? {} : { before }
+		});
+		return result ? c.json(result) : c.json({ error: "Task conversation not found" }, 404);
+	});
+	authenticated.get("/api/tasks/:id/conversation/timeline", async (c) => {
+		const items = await conversationQuery.getTimeline(c.req.param("id"));
+		return items ? c.json({
+			ok: true,
+			items
+		}) : c.json({
+			ok: false,
+			error: "Task conversation not found"
+		}, 404);
+	});
+	authenticated.patch("/api/tasks/:id", taskRateLimit, async (c) => {
 		const parsed = TaskPatchRequestSchema.safeParse(await c.req.json().catch(() => ({})));
 		if (!parsed.success) return c.json({
 			ok: false,
 			error: "Invalid task patch"
 		}, 400);
-		const updated = tasks.update(c.req.param("id"), parsed.data);
+		const updated = runSqliteWriteTransaction((db) => {
+			const task = tasks.update(c.req.param("id"), parsed.data);
+			if (!task) return void 0;
+			const changedFields = Object.keys(parsed.data).filter((field) => field !== "expectedVersion");
+			enqueueTaskChangedEvent(db, {
+				taskId: task.id,
+				projectId: task.projectId,
+				version: task.version,
+				changedFields,
+				actor: { kind: "user" }
+			});
+			return task;
+		});
 		if (!updated) return c.json({
 			ok: false,
 			error: "Task changed or was not found"
 		}, 409);
+		deps.service.dispatchTaskEvents();
 		return c.json({
 			ok: true,
 			task: updated
 		});
 	});
-	authenticated.put("/api/tasks/:id/dependencies", deps.strictRateLimitMiddleware, async (c) => {
+	authenticated.put("/api/tasks/:id/dependencies", taskRateLimit, async (c) => {
 		const parsed = TaskDependencyUpdateRequestSchema.safeParse(await c.req.json().catch(() => ({})));
 		if (!parsed.success) return c.json({
 			ok: false,
 			error: "Invalid task dependencies"
 		}, 400);
 		try {
-			const task = dependencies.replace({
-				taskId: c.req.param("id"),
-				...parsed.data
+			const task = runSqliteWriteTransaction((db) => {
+				const changed = dependencies.replace({
+					taskId: c.req.param("id"),
+					...parsed.data
+				});
+				enqueueTaskChangedEvent(db, {
+					taskId: changed.id,
+					projectId: changed.projectId,
+					version: changed.version,
+					changedFields: ["dependencies"],
+					actor: { kind: "user" }
+				});
+				return changed;
 			});
+			deps.service.dispatchTaskEvents();
 			return c.json({
 				ok: true,
 				task,
@@ -140,7 +327,45 @@ function registerTaskRoutes(authenticated, deps) {
 			}, status);
 		}
 	});
-	authenticated.post("/api/tasks/:id/commands", deps.strictRateLimitMiddleware, async (c) => {
+	authenticated.put("/api/tasks/:id/board-position", taskRateLimit, async (c) => {
+		const parsed = TaskBoardPositionRequestSchema.safeParse(await c.req.json().catch(() => ({})));
+		if (!parsed.success) return c.json({
+			ok: false,
+			error: "Invalid task board position"
+		}, 400);
+		try {
+			const task = runSqliteWriteTransaction((db) => {
+				const reordered = tasks.reorder({
+					taskId: c.req.param("id"),
+					...parsed.data
+				});
+				if (!reordered) return void 0;
+				enqueueTaskChangedEvent(db, {
+					taskId: reordered.id,
+					projectId: reordered.projectId,
+					version: reordered.version,
+					changedFields: ["boardRank"],
+					actor: { kind: "user" }
+				});
+				return reordered;
+			});
+			if (!task) return c.json({
+				ok: false,
+				error: "Task changed or was not found"
+			}, 409);
+			deps.service.dispatchTaskEvents();
+			return c.json({
+				ok: true,
+				task
+			});
+		} catch (error) {
+			return c.json({
+				ok: false,
+				error: error instanceof Error ? error.message : String(error)
+			}, 400);
+		}
+	});
+	authenticated.post("/api/tasks/:id/commands", taskRateLimit, async (c) => {
 		const parsed = TaskCommandRequestSchema.safeParse(await c.req.json().catch(() => ({})));
 		if (!parsed.success) return c.json({
 			ok: false,
@@ -165,6 +390,7 @@ function registerTaskRoutes(authenticated, deps) {
 			}, 409);
 		}
 		if (result.runId || parsed.data.command?.type === "resolve_wait") deps.service.dispatchTaskRuns();
+		else deps.service.dispatchTaskEvents();
 		if (parsed.data.command?.type === "close" && parsed.data.command.resolution === "done") signals.dependencyClosed(c.req.param("id"));
 		return c.json({
 			ok: true,
@@ -172,7 +398,7 @@ function registerTaskRoutes(authenticated, deps) {
 			...result.runId ? { run: runs.get(result.runId) } : {}
 		});
 	});
-	authenticated.post("/api/tasks/:id/context", deps.strictRateLimitMiddleware, async (c) => {
+	authenticated.post("/api/tasks/:id/context", taskRateLimit, async (c) => {
 		const task = tasks.get(c.req.param("id"));
 		if (!task) return c.json({
 			ok: false,
@@ -183,17 +409,42 @@ function registerTaskRoutes(authenticated, deps) {
 			ok: false,
 			error: "Invalid task context edge"
 		}, 400);
-		return c.json({
-			ok: true,
-			edge: context.add({
+		const edge = runSqliteWriteTransaction((db) => {
+			const created = context.add({
 				taskId: task.id,
 				...parsed.data,
 				createdBy: { kind: "user" }
-			})
+			});
+			enqueueTaskChangedEvent(db, {
+				taskId: task.id,
+				projectId: task.projectId,
+				version: task.version,
+				changedFields: ["context"],
+				actor: { kind: "user" }
+			});
+			return created;
+		});
+		deps.service.dispatchTaskEvents();
+		return c.json({
+			ok: true,
+			edge
 		}, 201);
 	});
-	authenticated.delete("/api/tasks/:id/context/:edgeId", deps.strictRateLimitMiddleware, (c) => {
-		return context.remove(c.req.param("id"), c.req.param("edgeId")) ? c.json({ ok: true }) : c.json({
+	authenticated.delete("/api/tasks/:id/context/:edgeId", taskRateLimit, (c) => {
+		const task = tasks.get(c.req.param("id"));
+		const removed = task ? runSqliteWriteTransaction((db) => {
+			const didRemove = context.remove(task.id, c.req.param("edgeId"));
+			if (didRemove) enqueueTaskChangedEvent(db, {
+				taskId: task.id,
+				projectId: task.projectId,
+				version: task.version,
+				changedFields: ["context"],
+				actor: { kind: "user" }
+			});
+			return didRemove;
+		}) : false;
+		if (removed) deps.service.dispatchTaskEvents();
+		return removed ? c.json({ ok: true }) : c.json({
 			ok: false,
 			error: "Task context edge not found"
 		}, 404);
@@ -219,7 +470,7 @@ function registerTaskRoutes(authenticated, deps) {
 			error: "TaskRun not found"
 		}, 404);
 	});
-	authenticated.post("/api/task-runs/:runId/cancel", deps.strictRateLimitMiddleware, async (c) => {
+	authenticated.post("/api/task-runs/:runId/cancel", taskRateLimit, async (c) => {
 		const body = await c.req.json().catch(() => ({}));
 		const run = runs.get(c.req.param("runId"));
 		if (!run) return c.json({
@@ -256,13 +507,14 @@ function registerTaskRoutes(authenticated, deps) {
 			ok: false,
 			error: result.reason
 		}, 409);
+		deps.service.dispatchTaskEvents();
 		return c.json({
 			ok: true,
 			run: runs.get(run.id),
 			receipt: runs.getReceipt(run.id)
 		});
 	});
-	authenticated.post("/api/task-runs/:runId/feedback", deps.strictRateLimitMiddleware, async (c) => {
+	authenticated.post("/api/task-runs/:runId/feedback", taskRateLimit, async (c) => {
 		const body = await c.req.json().catch(() => ({}));
 		if (body.rating !== "helpful" && body.rating !== "not_helpful") return c.json({
 			ok: false,
@@ -306,7 +558,7 @@ function registerTaskRoutes(authenticated, deps) {
 			policy: monitoring.get(projectId)
 		});
 	});
-	authenticated.patch("/api/projects/:projectId/monitoring", deps.strictRateLimitMiddleware, async (c) => {
+	authenticated.patch("/api/projects/:projectId/monitoring", taskRateLimit, async (c) => {
 		const projectId = c.req.param("projectId");
 		if (!deps.service.projects.get(projectId)) return c.json({
 			ok: false,

package/dist/src/gateway/host.d.ts

@@ -6,6 +6,13 @@ export declare function isAllInterfacesHost(host: string | undefined): boolean;
 export declare const GATEWAY_DEV_CONSOLE_ORIGINS: readonly ["http://localhost:3000", "http://127.0.0.1:3000"];
 /** Expo / React Native web dev server (Metro defaults to port 8081). */
 export declare const GATEWAY_EXPO_DEV_ORIGINS: readonly ["http://localhost:8081", "http://127.0.0.1:8081"];
+export type LanGatewayCandidate = {
+    url: string;
+    address: string;
+    interfaceName: string;
+};
+/** Non-internal IPv4 addresses that can serve this gateway on the local network. */
+export declare function enumerateLanGatewayCandidates(port: number): LanGatewayCandidate[];
 /** Effective HTTP listen port: CLI `--port` override wins over config (default 18790). */
 export declare function resolveEffectiveGatewayPort(config: {
     gateway?: {
@@ -27,7 +34,8 @@ export declare function buildDefaultCorsOrigins(params: {
 }): string[];
 /**
  * Effective browser origins for CORS and CSRF checks.
- * Custom `gateway.corsOrigins` (e.g. after LAN pairing) still merge loopback Vite dev origins.
+ * Configured origins extend the gateway's own browser origins instead of replacing them.
+ * This keeps the bundled console reachable while allowing explicit external frontends.
  */
 export declare function resolveGatewayCorsOrigins(params: {
     configuredOrigins?: string[];

package/dist/src/gateway/host.js

@@ -1,4 +1,5 @@
 import "../daemon/constants.js";
+import { networkInterfaces } from "node:os";
 //#region src/gateway/host.ts
 /** True when the bind address is local-only (127.x, localhost, ::1). */
 function isLoopbackHost(host) {
@@ -17,6 +18,21 @@ const GATEWAY_DEV_CONSOLE_ORIGINS = ["http://localhost:3000", "http://127.0.0.1:
 /** Expo / React Native web dev server (Metro defaults to port 8081). */
 const GATEWAY_EXPO_DEV_ORIGINS = ["http://localhost:8081", "http://127.0.0.1:8081"];
 const GATEWAY_LOOPBACK_DEV_ORIGINS = [...GATEWAY_DEV_CONSOLE_ORIGINS, ...GATEWAY_EXPO_DEV_ORIGINS];
+/** Non-internal IPv4 addresses that can serve this gateway on the local network. */
+function enumerateLanGatewayCandidates(port) {
+	const seen = /* @__PURE__ */ new Set();
+	const candidates = [];
+	for (const [interfaceName, addresses] of Object.entries(networkInterfaces())) for (const address of addresses ?? []) {
+		if (address.family !== "IPv4" || address.internal || seen.has(address.address)) continue;
+		seen.add(address.address);
+		candidates.push({
+			address: address.address,
+			interfaceName,
+			url: `http://${address.address}:${port}`
+		});
+	}
+	return candidates;
+}
 /** Effective HTTP listen port: CLI `--port` override wins over config (default 18790). */
 function resolveEffectiveGatewayPort(config, listenPortOverride) {
 	if (typeof listenPortOverride === "number" && Number.isFinite(listenPortOverride)) return listenPortOverride;
@@ -35,19 +51,20 @@ function buildDefaultCorsOrigins(params) {
 	]);
 	const bindHost = params.bindHost?.trim();
 	if (bindHost && !isLoopbackHost(bindHost) && !isAllInterfacesHost(bindHost)) origins.add(`http://${bindHost}:${params.port}`);
+	if (isAllInterfacesHost(bindHost)) for (const candidate of enumerateLanGatewayCandidates(params.port)) origins.add(candidate.url);
 	return [...origins];
 }
 /**
 * Effective browser origins for CORS and CSRF checks.
-* Custom `gateway.corsOrigins` (e.g. after LAN pairing) still merge loopback Vite dev origins.
+* Configured origins extend the gateway's own browser origins instead of replacing them.
+* This keeps the bundled console reachable while allowing explicit external frontends.
 */
 function resolveGatewayCorsOrigins(params) {
 	const configured = (params.configuredOrigins ?? []).map((origin) => origin.trim()).filter(Boolean);
-	if (configured.length === 0) return buildDefaultCorsOrigins({
+	return [...new Set([...configured, ...buildDefaultCorsOrigins({
 		port: params.port,
 		bindHost: params.bindHost
-	});
-	return [...new Set([...configured, ...GATEWAY_LOOPBACK_DEV_ORIGINS])];
+	})])];
 }
 /** Browser origin (`https://host`) from a gateway public/tunnel root URL. */
 function originFromGatewayPublicUrl(publicUrl) {
@@ -73,4 +90,4 @@ function resolveAllowedBrowserOrigins(params) {
 	return origins;
 }
 //#endregion
-export { GATEWAY_DEV_CONSOLE_ORIGINS, GATEWAY_EXPO_DEV_ORIGINS, buildDefaultCorsOrigins, isAllInterfacesHost, isLoopbackHost, originFromGatewayPublicUrl, resolveAllowedBrowserOrigins, resolveEffectiveGatewayPort, resolveGatewayCorsOrigins, resolveGatewayServiceListenPort };
+export { GATEWAY_DEV_CONSOLE_ORIGINS, GATEWAY_EXPO_DEV_ORIGINS, buildDefaultCorsOrigins, enumerateLanGatewayCandidates, isAllInterfacesHost, isLoopbackHost, originFromGatewayPublicUrl, resolveAllowedBrowserOrigins, resolveEffectiveGatewayPort, resolveGatewayCorsOrigins, resolveGatewayServiceListenPort };

package/dist/src/gateway/rate-limit/buckets.d.ts

@@ -36,6 +36,7 @@ declare class BucketRegistry {
     private authFailureSignature?;
     private strictApiLimiter?;
     private chatApiLimiter?;
+    private taskApiLimiter?;
     private xopcCloudPollLimiter?;
     private channelApiLimiter?;
     private tunnelMutateLimiter?;
@@ -52,6 +53,8 @@ declare class BucketRegistry {
     strictApi(): RateLimiter;
     /** Interactive chat actions — 180 req / 60 s per client IP. */
     chatApi(): RateLimiter;
+    /** Interactive task and board mutations — 300 req / 60 s per client IP. */
+    taskApi(): RateLimiter;
     /** XOPC Cloud authorization polling — 60 req / 60 s per client IP. */
     xopcCloudPoll(): RateLimiter;
     /** Channel mutation/action endpoints — 20 req / 60 s per client IP. */

package/dist/src/gateway/rate-limit/buckets.js

@@ -48,6 +48,7 @@ var BucketRegistry = class {
 	authFailureSignature;
 	strictApiLimiter;
 	chatApiLimiter;
+	taskApiLimiter;
 	xopcCloudPollLimiter;
 	channelApiLimiter;
 	tunnelMutateLimiter;
@@ -89,6 +90,14 @@ var BucketRegistry = class {
 		});
 		return this.chatApiLimiter;
 	}
+	/** Interactive task and board mutations — 300 req / 60 s per client IP. */
+	taskApi() {
+		if (!this.taskApiLimiter) this.taskApiLimiter = new RateLimiter({
+			maxRequests: 300,
+			windowMs: 6e4
+		});
+		return this.taskApiLimiter;
+	}
 	/** XOPC Cloud authorization polling — 60 req / 60 s per client IP. */
 	xopcCloudPoll() {
 		if (!this.xopcCloudPollLimiter) this.xopcCloudPollLimiter = new RateLimiter({
@@ -142,6 +151,7 @@ var BucketRegistry = class {
 		this.authFailureLimiter?.destroy();
 		this.strictApiLimiter?.destroy();
 		this.chatApiLimiter?.destroy();
+		this.taskApiLimiter?.destroy();
 		this.xopcCloudPollLimiter?.destroy();
 		this.channelApiLimiter?.destroy();
 		this.tunnelMutateLimiter?.destroy();
@@ -151,6 +161,7 @@ var BucketRegistry = class {
 		this.authFailureLimiter = void 0;
 		this.strictApiLimiter = void 0;
 		this.chatApiLimiter = void 0;
+		this.taskApiLimiter = void 0;
 		this.xopcCloudPollLimiter = void 0;
 		this.channelApiLimiter = void 0;
 		this.tunnelMutateLimiter = void 0;
@@ -164,6 +175,7 @@ var BucketRegistry = class {
 		this.authFailureLimiter?.resetForTests();
 		this.strictApiLimiter?.resetForTests();
 		this.chatApiLimiter?.resetForTests();
+		this.taskApiLimiter?.resetForTests();
 		this.xopcCloudPollLimiter?.resetForTests();
 		this.channelApiLimiter?.resetForTests();
 		this.tunnelMutateLimiter?.resetForTests();

package/dist/src/gateway/runtime-config.js

@@ -1,12 +1,9 @@
-import { isAllInterfacesHost, isLoopbackHost } from "./host.js";
+import { isAllInterfacesHost, isLoopbackHost, resolveGatewayCorsOrigins } from "./host.js";
 import { isAuthRateLimitGloballyDisabled, isGatewayStrictSecurityEnabled } from "./rate-limit/env-flags.js";
 import "./rate-limit/index.js";
 import { resolveGatewayListenPlan } from "./listen.js";
 import { assertTailscaleExposureCompatible } from "./tailscale-lifecycle.js";
 //#region src/gateway/runtime-config.ts
-function normalizeCorsOrigins(cfg) {
-	return (cfg.gateway?.corsOrigins ?? []).map((value) => value.trim()).filter(Boolean);
-}
 function hasSharedSecret(auth) {
 	if (auth.mode === "trusted-proxy") return true;
 	if (auth.mode === "token") return typeof auth.token === "string" && auth.token.trim().length > 0;
@@ -23,7 +20,11 @@ function assertGatewayRuntimeConfig(params) {
 		bindOverride: params.bindOverride
 	});
 	const loopback = isLoopbackHost(bindHost);
-	const corsOrigins = normalizeCorsOrigins(params.cfg);
+	const corsOrigins = resolveGatewayCorsOrigins({
+		configuredOrigins: params.cfg.gateway?.corsOrigins,
+		port: params.port,
+		bindHost
+	});
 	const dangerouslyAllowHostHeaderOriginFallback = params.cfg.gateway?.dangerouslyAllowHostHeaderOriginFallback === true;
 	if (bindMode === "loopback" && !loopback) throw new Error(`gateway bind=loopback resolved to non-loopback host ${bindHost}; refusing fallback to a network bind`);
 	if (bindMode === "custom") {

package/dist/src/gateway/security/audit.js

@@ -110,13 +110,6 @@ function collectGatewayConfigFindings(params) {
 		title: "Large number of CORS origins configured",
 		detail: `${params.corsOrigins.length} CORS origins configured. Review whether all are necessary.`
 	});
-	if (!loopback && (!params.corsOrigins || params.corsOrigins.length === 0) && params.dangerouslyAllowHostHeaderOriginFallback !== true) findings.push({
-		checkId: "gateway.cors.no_explicit_origins",
-		severity: "info",
-		title: "No custom CORS origins — loopback browsers only",
-		detail: "Gateway listens on a network address with empty gateway.corsOrigins. localhost and 127.0.0.1 on the gateway port are allowed by default; LAN or remote browser URLs must be added explicitly.",
-		remediation: "Add gateway.corsOrigins entries (e.g. http://192.168.x.x:<port>) for non-loopback browser access, or enable gateway.dangerouslyAllowHostHeaderOriginFallback only if you understand the CSRF risk."
-	});
 	if (!loopback && params.auth.mode !== "none" && params.auth.mode !== "trusted-proxy" && params.rateLimitEnabled === false) findings.push({
 		checkId: "gateway.auth.no_rate_limit",
 		severity: "warn",

package/dist/src/gateway/server.js

@@ -51,7 +51,10 @@ var GatewayServer = class {
 		});
 		const { configureTunnelFromGatewayConfig } = await import("../tunnel/gateway-lifecycle.js");
 		await configureTunnelFromGatewayConfig(this.service.currentConfig, { deferWellKnownFetch: true });
-		const app = createHonoApp({ service: this.service });
+		const app = createHonoApp({
+			service: this.service,
+			listenHost: bindHost
+		});
 		const primaryHost = listenHosts[0] ?? bindHost;
 		const attachUpgrade = (server) => {
 			server.on("upgrade", (req, socket, head) => {