@xopcai/xopc 0.0.208 → 0.0.210

package/dist/src/agent/memory/manager.js

@@ -1,5 +1,6 @@
 import { createLogger } from "../../utils/logger/index.js";
 import { init_logger } from "../../utils/logger.js";
+import { retrievalQueryAuditValue } from "../../retrieval/audit.js";
 import { setKnowledgeSourceItemSynthesisStatus } from "../../storage/sqlite/knowledge-repository.js";
 import { appendMemoryTraceEvent } from "../../storage/sqlite/memory-records-repository.js";
 import "../../storage/sqlite/index.js";
@@ -475,6 +476,7 @@ function writeTargetForRecord(request) {
 function sanitizeTraceRequest(request) {
 	if (!request || typeof request !== "object") return request;
 	const copy = { ...request };
+	if (typeof copy.query === "string") copy.query = retrievalQueryAuditValue(copy.query);
 	if (typeof copy.content === "string" && copy.content.length > 500) copy.content = `${copy.content.slice(0, 500)}…`;
 	return copy;
 }

package/dist/src/agent/memory/sensitivity.js

@@ -5,7 +5,7 @@ function inferMemorySensitivity(content) {
 	return /家庭|住址|生日|健康|关系|family|address|birthday|health/i.test(content) ? "personal" : "normal";
 }
 function redactSensitiveMemoryText(content) {
-	return content.replace(/-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z ]*PRIVATE KEY-----/g, "[REDACTED PRIVATE KEY]").replace(/\b(api[_-]?key|access[_-]?key|token|password|secret|credential|private[_-]?key|bearer)\b\s*[:=]?\s*[^\s,;]+/gi, "$1=[REDACTED]").replace(/(密钥|密码|令牌|私钥)\s*[：:=]?\s*[^\s，；]+/g, "$1=[REDACTED]").replace(/\b(?:sk|gh[opsu]|xox[abprs])-[a-z0-9_-]{8,}\b/gi, "[REDACTED TOKEN]").replace(/\bAKIA[A-Z0-9]{12,}\b/g, "[REDACTED ACCESS KEY]");
+	return content.replace(/-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z ]*PRIVATE KEY-----/g, "[REDACTED PRIVATE KEY]").replace(/\b(api[_-]?key|access[_-]?key|token|password|secret|credential|private[_-]?key|bearer)\b\s*[:=]?\s*[^\s,;]+/gi, "$1=[REDACTED]").replace(/(密钥|密码|令牌|私钥)\s*[：:=]?\s*[^\s，；]+/g, "$1=[REDACTED]").replace(/\b(?:sk|gh[opsu]|xox[abprs])-[a-z0-9_-]{8,}\b/gi, "[REDACTED TOKEN]").replace(/\bAKIA[A-Z0-9]{12,}\b/g, "[REDACTED ACCESS KEY]").replace(/\b(ssn|social security|bank account|credit card|medical record)\b(?:\s+(?:is|number))?\s*[:=]?\s*[^\s,;]+/gi, "$1=[REDACTED]").replace(/(身份证|银行卡|信用卡|医疗记录)\s*(?:是|号码)?\s*[：:=]?\s*[^\s，；]+/g, "$1=[REDACTED]");
 }
 //#endregion
 export { inferMemorySensitivity, redactSensitiveMemoryText };

package/dist/src/agent/memory/understanding/service.js

@@ -103,31 +103,63 @@ var UserUnderstandingService = class {
 			rejected: 0,
 			createdRecords: []
 		};
+		const safeCandidates = candidates.filter((candidate) => {
+			const content = normalizeContent(candidate.content);
+			const sensitivity = effectiveSensitivity(candidate.sensitivity, content);
+			return sensitivity !== "secret" && sensitivity !== "regulated";
+		});
+		if (!safeCandidates.length) return {
+			proposed: candidates.length,
+			created: 0,
+			deduplicated: 0,
+			rejected: candidates.length,
+			createdRecords: []
+		};
 		const evidence = createContextEvidence({
 			sourceType: "conversation",
 			sourceRef: params.sessionKey ? `session:${params.sessionKey}:turn:${params.turnId ?? "unknown"}` : `turn:${params.turnId ?? "unknown"}`,
-			redactedExcerpt: redactSensitiveMemoryText(params.userContent).slice(0, MAX_CANDIDATE_CHARS),
+			redactedExcerpt: redactSensitiveMemoryText(safeCandidates.map((candidate) => candidate.content).join("\n")).slice(0, MAX_CANDIDATE_CHARS),
 			trustLevel: "owner",
 			observedAt: Date.now()
 		});
+		const result = await this.applyCandidates(safeCandidates, {
+			sessionKey: params.sessionKey,
+			workspaceId: params.workspaceId,
+			projectId: params.projectId,
+			evidenceIds: [evidence.id],
+			reviewSource: "turn",
+			supersedesRecordIds: params.correctionTargetRecordIds
+		});
 		return {
-			...await this.applyCandidates(candidates, {
-				sessionKey: params.sessionKey,
-				workspaceId: params.workspaceId,
-				projectId: params.projectId,
-				evidenceIds: [evidence.id],
-				reviewSource: "turn",
-				supersedesRecordIds: params.correctionTargetRecordIds
-			}),
+			...result,
+			proposed: candidates.length,
+			rejected: result.rejected + candidates.length - safeCandidates.length,
 			sourceItemId: evidence.id
 		};
 	}
 	async applyCandidates(candidates, context) {
 		let created = 0;
 		let deduplicated = 0;
-		let rejected = 0;
 		const createdRecords = [];
 		const correctionTarget = context.supersedesRecordIds?.length === 1 ? context.supersedesRecordIds[0] : void 0;
+		const eligible = candidates.slice(0, 10).map((candidate) => {
+			const content = normalizeContent(candidate.content);
+			return {
+				candidate,
+				content,
+				sensitivity: effectiveSensitivity(candidate.sensitivity, content),
+				scope: scopeForCandidate(candidate, context),
+				key: candidate.canonicalKey ?? canonicalUnderstandingKey(candidate.kind, content)
+			};
+		}).filter(({ candidate, content, sensitivity, scope, key }) => content.length >= 4 && candidate.confidence >= .55 && sensitivity !== "secret" && sensitivity !== "regulated" && !isUnderstandingSuppressed(key, scope));
+		let rejected = candidates.length - eligible.length;
+		if (!eligible.length) return {
+			proposed: candidates.length,
+			created,
+			deduplicated,
+			rejected,
+			createdRecords
+		};
 		const evidenceIds = [...new Set(context.evidenceIds ?? [])];
 		const sourceItemIds = [context.sourceItemId, ...context.sourceItemIds ?? []].filter((value) => Boolean(value));
 		for (const sourceItemId of [...new Set(sourceItemIds)]) {
@@ -141,15 +173,7 @@ var UserUnderstandingService = class {
 			});
 			evidenceIds.push(evidence.id);
 		}
-		for (const candidate of candidates.slice(0, 10)) {
-			const content = normalizeContent(candidate.content);
-			const sensitivity = effectiveSensitivity(candidate.sensitivity, content);
-			const scope = scopeForCandidate(candidate, context);
-			const key = candidate.canonicalKey ?? canonicalUnderstandingKey(candidate.kind, content);
-			if (content.length < 4 || candidate.confidence < .55 || sensitivity === "secret" || sensitivity === "regulated" || isUnderstandingSuppressed(key, scope)) {
-				rejected += 1;
-				continue;
-			}
+		for (const { candidate, content, sensitivity, scope, key } of eligible) {
 			const duplicate = findDuplicateUnderstanding(listUnderstandings(), {
 				kind: candidate.kind,
 				statement: content,

package/dist/src/agent/memory/user-context-coordinator.js

@@ -43,8 +43,8 @@ var UserContextCoordinator = class {
 			consentRequests: [],
 			estimatedTokens: 0
 		});
-		const config = this.options.getConfig();
 		if (!this.options.isEnabledForSession(sessionKey)) return empty();
+		const config = this.options.getConfig();
 		if (!isPrivateSession(sessionKey)) return empty();
 		const userQuery = extractAgentUserPlainText(userMessage);
 		const taskContext = assembleTaskContext(sessionKey, userQuery);

package/dist/src/agent-runtime/index.js

@@ -1,7 +1,7 @@
-import { buildMemoryRuntime } from "./memory-runtime.js";
 import { checkBoundary } from "./boundary-guard.js";
 import { resolveModelRole } from "./model-router.js";
 import { buildRuntimeToolRegistry } from "./tool-registry.js";
+import { buildMemoryRuntime } from "./memory-runtime.js";
 import { resolveWorkflow, validateWorkflowForRuntime } from "./workflow-runtime.js";
 import { buildAgentRuntimeProfile } from "./runtime-profile.js";
 import { appendAgentRunEvent, createAgentRunTrace, finishAgentRunTrace, hashEffectiveManifest } from "./run-trace.js";

package/dist/src/agent-runtime/runtime-profile.js

@@ -1,9 +1,9 @@
 import { buildAgentManifestPromptSection } from "../agent-manifest/prompt.js";
 import "../agent-manifest/index.js";
-import { buildMemoryRuntime } from "./memory-runtime.js";
 import { checkBoundary } from "./boundary-guard.js";
 import { resolveModelRole } from "./model-router.js";
 import { buildRuntimeToolRegistry } from "./tool-registry.js";
+import { buildMemoryRuntime } from "./memory-runtime.js";
 import { resolveWorkflow, validateWorkflowForRuntime } from "./workflow-runtime.js";
 //#region src/agent-runtime/runtime-profile.ts
 function buildAgentRuntimeProfile(params) {

package/dist/src/automations/domain/validation.d.ts

@@ -117,8 +117,8 @@ export declare const AutomationActionSchema: z.ZodDiscriminatedUnion<[z.ZodObjec
         type: z.ZodLiteral<"add_wait">;
         wait: z.ZodObject<{
             kind: z.ZodEnum<{
-                paused: "paused";
                 approval: "approval";
+                paused: "paused";
                 dependency: "dependency";
                 user_input: "user_input";
                 external_event: "external_event";
@@ -294,8 +294,8 @@ export declare const AutomationSchema: z.ZodObject<{
             type: z.ZodLiteral<"add_wait">;
             wait: z.ZodObject<{
                 kind: z.ZodEnum<{
-                    paused: "paused";
                     approval: "approval";
+                    paused: "paused";
                     dependency: "dependency";
                     user_input: "user_input";
                     external_event: "external_event";
@@ -341,8 +341,8 @@ export declare const AutomationSchema: z.ZodObject<{
         continuous: "continuous";
     }>>;
     notificationPolicy: z.ZodDefault<z.ZodEnum<{
-        none: "none";
         all: "all";
+        none: "none";
         attention: "attention";
     }>>;
     completionWebhookUrl: z.ZodPreprocess<z.ZodOptional<z.ZodString>>;
@@ -456,8 +456,8 @@ export declare const CreateAutomationSchema: z.ZodObject<{
             type: z.ZodLiteral<"add_wait">;
             wait: z.ZodObject<{
                 kind: z.ZodEnum<{
-                    paused: "paused";
                     approval: "approval";
+                    paused: "paused";
                     dependency: "dependency";
                     user_input: "user_input";
                     external_event: "external_event";
@@ -536,8 +536,8 @@ export declare const CreateAutomationSchema: z.ZodObject<{
         continuous: "continuous";
     }>>;
     notificationPolicy: z.ZodDefault<z.ZodEnum<{
-        none: "none";
         all: "all";
+        none: "none";
         attention: "attention";
     }>>;
     completionWebhookUrl: z.ZodPreprocess<z.ZodOptional<z.ZodString>>;
@@ -645,8 +645,8 @@ export declare const UpdateAutomationSchema: z.ZodObject<{
             type: z.ZodLiteral<"add_wait">;
             wait: z.ZodObject<{
                 kind: z.ZodEnum<{
-                    paused: "paused";
                     approval: "approval";
+                    paused: "paused";
                     dependency: "dependency";
                     user_input: "user_input";
                     external_event: "external_event";
@@ -741,8 +741,8 @@ export declare const UpdateAutomationSchema: z.ZodObject<{
         continuous: "continuous";
     }>>>;
     notificationPolicy: z.ZodOptional<z.ZodDefault<z.ZodEnum<{
-        none: "none";
         all: "all";
+        none: "none";
         attention: "attention";
     }>>>;
     completionWebhookUrl: z.ZodOptional<z.ZodPreprocess<z.ZodOptional<z.ZodString>>>;

package/dist/src/automations/draft/automation-draft-validator.d.ts

@@ -12,7 +12,7 @@ export declare function buildAutomationDraftResponse(draft: GeneratedAutomationD
     automation: {
         name: string;
         conversationMode: "new_session" | "continuous";
-        notificationPolicy: "none" | "all" | "attention";
+        notificationPolicy: "all" | "none" | "attention";
         projectId?: string;
         action?: {
             kind: "agent";
@@ -79,7 +79,7 @@ export declare function buildAutomationDraftResponse(draft: GeneratedAutomationD
             } | {
                 type: "add_wait";
                 wait: {
-                    kind: "paused" | "approval" | "dependency" | "user_input" | "external_event" | "scheduled_time" | "retry_backoff";
+                    kind: "approval" | "paused" | "dependency" | "user_input" | "external_event" | "scheduled_time" | "retry_backoff";
                     reason: string;
                     condition: Record<string, unknown>;
                     resumeAt?: number;

package/dist/src/connectors/auth-provider-registry.d.ts

@@ -1,3 +1,4 @@
+import type { Config } from '../config/schema.js';
 import type { ConnectorDefinition } from './types.js';
 export type ConnectorAuthStartResult = {
     connectorId: string;
@@ -6,4 +7,4 @@ export type ConnectorAuthStartResult = {
     authorizationUrl?: string;
     connectionId?: string;
 };
-export declare function startConnectorAuthorization(definition: ConnectorDefinition): Promise<ConnectorAuthStartResult>;
+export declare function startConnectorAuthorization(definition: ConnectorDefinition, config?: Config): Promise<ConnectorAuthStartResult>;

package/dist/src/connectors/auth-provider-registry.js

@@ -1,8 +1,11 @@
 import { startComposioAuthorize } from "./composio.js";
+import { getConnectorInstance } from "./instances.js";
 //#region src/connectors/auth-provider-registry.ts
-async function startConnectorAuthorization(definition) {
+async function startConnectorAuthorization(definition, config) {
 	if (definition.auth.mode !== "oauth" || definition.auth.provider !== "composio" || definition.runtime.type !== "composio" || definition.runtime.role !== "toolkit") throw new Error(`Connector "${definition.id}" does not support Composio authorization.`);
-	const authorization = await startComposioAuthorize(definition.id, definition.runtime.toolkit);
+	const configuredAuthConfigId = config ? getConnectorInstance(config, definition.id)?.config?.authConfigId : void 0;
+	const authConfigId = typeof configuredAuthConfigId === "string" && configuredAuthConfigId.trim() ? configuredAuthConfigId.trim() : void 0;
+	const authorization = await startComposioAuthorize(definition.id, definition.runtime.toolkit, void 0, authConfigId);
 	return {
 		connectorId: definition.id,
 		provider: "composio",

package/dist/src/connectors/composio-sessions.d.ts

@@ -17,6 +17,20 @@ export type ComposioAuthorizeResult = {
     connectUrl?: string;
     status: string;
 };
+export type ComposioAuthConfigOption = {
+    id: string;
+    name: string;
+    status: 'ENABLED' | 'DISABLED';
+    authScheme?: string;
+    isComposioManaged: boolean;
+    isEnabledForToolRouter: boolean;
+};
+export type ComposioToolkitAuthState = {
+    toolkit: string;
+    managedAuthAvailable: boolean;
+    requiresCustomAuthConfig: boolean;
+    authConfigs: ComposioAuthConfigOption[];
+};
 type SessionToolkitResponse = {
     items: Array<{
         slug: string;
@@ -69,12 +83,34 @@ export type ComposioSessionsClient = {
         delete(id: string): Promise<unknown>;
         refresh(id: string): Promise<unknown>;
     };
+    authConfigs?: {
+        list(query?: {
+            toolkit?: string;
+            showDisabled?: boolean;
+        }): Promise<{
+            items: Array<{
+                id: string;
+                name: string;
+                status: 'ENABLED' | 'DISABLED';
+                authScheme?: string;
+                isComposioManaged?: boolean;
+                isEnabledForToolRouter?: boolean;
+            }>;
+        }>;
+    };
+    toolkits?: {
+        get(slug: string): Promise<{
+            composioManagedAuthSchemes?: string[];
+            authConfigDetails?: unknown[];
+        }>;
+    };
 };
 export type ComposioSessionContext = {
     principalId: string;
     installationScope?: string;
     providerPrincipalId?: string;
     toolkits?: string[];
+    authConfigs?: Record<string, string>;
     connectedAccounts?: Record<string, string[]>;
     callbackUrl?: string;
 };
@@ -88,9 +124,11 @@ export declare class ComposioSessionsAdapter {
         clientFactory?: ClientFactory;
     });
     createSession(context: ComposioSessionContext): Promise<ComposioSessionLike>;
+    getToolkitAuthState(toolkit: string): Promise<ComposioToolkitAuthState>;
     listToolkitCatalog(context: Omit<ComposioSessionContext, 'toolkits'>): Promise<ComposioToolkitCatalogItem[]>;
     authorize(context: ComposioSessionContext & {
         toolkit: string;
+        authConfigId?: string;
         installationId?: string;
         alias?: string;
     }): Promise<ComposioAuthorizeResult>;

package/dist/src/connectors/composio-sessions.js

@@ -63,6 +63,25 @@ function connectionStatus(value) {
 		default: return "unknown";
 	}
 }
+function errorChainMessage(error) {
+	const messages = [];
+	const visited = /* @__PURE__ */ new Set();
+	let current = error;
+	while (current && !visited.has(current)) {
+		visited.add(current);
+		if (current instanceof Error) messages.push(current.message);
+		else if (typeof current === "string") messages.push(current);
+		if (!current || typeof current !== "object" || !("cause" in current)) break;
+		current = current.cause;
+	}
+	return messages.join(" ");
+}
+function missingAuthConfigMessage(error, toolkit, authConfigId) {
+	const message = errorChainMessage(error);
+	if (!message.includes("require auth configs") && !message.includes("cannot be auto-created")) return null;
+	if (authConfigId) return `The Composio auth config "${authConfigId}" is not available for toolkit "${toolkit}". Make sure it is enabled for Tool Router and belongs to the same Composio project as the configured API key.`;
+	return `The Composio toolkit "${toolkit}" requires a custom auth config. Create one in the Composio dashboard, enable it for Tool Router, then select it in the connector settings.`;
+}
 var ComposioSessionsAdapter = class {
 	createClient;
 	constructor(options = {}) {
@@ -106,10 +125,36 @@ var ComposioSessionsAdapter = class {
 				requireExplicitSelection: true
 			},
 			...context.toolkits?.length ? { toolkits: { enable: context.toolkits } } : {},
+			...context.authConfigs && Object.keys(context.authConfigs).length > 0 ? { authConfigs: context.authConfigs } : {},
 			...context.connectedAccounts && Object.keys(context.connectedAccounts).length > 0 ? { connectedAccounts: context.connectedAccounts } : {}
 		};
 		return client.sessions.create(context.providerPrincipalId ?? createComposioPrincipalId(context.principalId, context.installationScope), config);
 	}
+	async getToolkitAuthState(toolkit) {
+		const normalizedToolkit = toolkit.trim().toLowerCase();
+		if (!normalizedToolkit) throw new Error("Composio toolkit is required.");
+		const client = await this.createClient();
+		if (!client.authConfigs || !client.toolkits) throw new Error("The installed Composio runtime does not support auth config discovery.");
+		const [toolkitDetails, authConfigList] = await Promise.all([client.toolkits.get(normalizedToolkit), client.authConfigs.list({
+			toolkit: normalizedToolkit,
+			showDisabled: true
+		})]);
+		const managedAuthAvailable = (toolkitDetails.composioManagedAuthSchemes?.length ?? 0) > 0;
+		const authConfigs = authConfigList.items.map((item) => ({
+			id: item.id,
+			name: item.name,
+			status: item.status,
+			authScheme: item.authScheme,
+			isComposioManaged: item.isComposioManaged === true,
+			isEnabledForToolRouter: item.isEnabledForToolRouter !== false
+		}));
+		return {
+			toolkit: normalizedToolkit,
+			managedAuthAvailable,
+			requiresCustomAuthConfig: !managedAuthAvailable && (toolkitDetails.authConfigDetails?.length ?? 0) > 0,
+			authConfigs
+		};
+	}
 	async listToolkitCatalog(context) {
 		const session = await this.createSession(context);
 		const items = [];
@@ -134,11 +179,20 @@ var ComposioSessionsAdapter = class {
 	}
 	async authorize(context) {
 		const providerPrincipalId = createComposioPrincipalId(context.principalId, context.installationScope);
-		const request = await (await this.createSession({
-			...context,
-			providerPrincipalId,
-			toolkits: [context.toolkit]
-		})).authorize(context.toolkit, {
+		let session;
+		try {
+			session = await this.createSession({
+				...context,
+				providerPrincipalId,
+				toolkits: [context.toolkit],
+				...context.authConfigId ? { authConfigs: { [context.toolkit]: context.authConfigId } } : {}
+			});
+		} catch (error) {
+			const actionableMessage = missingAuthConfigMessage(error, context.toolkit, context.authConfigId);
+			if (actionableMessage) throw new Error(actionableMessage, { cause: error });
+			throw error;
+		}
+		const request = await session.authorize(context.toolkit, {
 			callbackUrl: context.callbackUrl,
 			alias: context.alias
 		});
@@ -159,7 +213,8 @@ var ComposioSessionsAdapter = class {
 			}).length === 0,
 			metadata: {
 				toolkit: context.toolkit,
-				providerPrincipalId
+				providerPrincipalId,
+				...context.authConfigId ? { authConfigId: context.authConfigId } : {}
 			}
 		});
 		return {
@@ -207,6 +262,7 @@ var ComposioSessionsAdapter = class {
 				connectedAt: readString(row, ["createdAt", "created_at"]),
 				lastError: readString(row, ["lastError", "last_error"]),
 				metadata: {
+					...existing?.metadata,
 					toolkit,
 					providerPrincipalId
 				}
@@ -266,10 +322,12 @@ var ComposioSessionsAdapter = class {
 			const toolkit = input.action.toolkit;
 			const connectedAccounts = toolkit && input.connection ? { [toolkit]: [input.connection.providerConnectionId] } : input.context.connectedAccounts;
 			const providerPrincipalId = input.connection?.metadata.providerPrincipalId;
+			const connectionAuthConfigId = input.connection?.metadata.authConfigId;
 			if (input.connection && (typeof providerPrincipalId !== "string" || !providerPrincipalId.trim())) throw new Error("Connected account is missing its provider identity. Reconnect the account and try again.");
 			const result = await (await this.createSession({
 				...input.context,
 				connectedAccounts,
+				...toolkit && typeof connectionAuthConfigId === "string" && connectionAuthConfigId.trim() ? { authConfigs: { [toolkit]: connectionAuthConfigId.trim() } } : {},
 				...typeof providerPrincipalId === "string" ? { providerPrincipalId } : {}
 			})).execute(input.action.actionId, input.args ?? {}, input.connection ? { account: input.connection.providerConnectionId } : void 0);
 			appendConnectorExecutionAudit({

package/dist/src/connectors/composio.d.ts

@@ -1,5 +1,6 @@
 import { CredentialResolver } from '../auth/credentials.js';
 import type { Config } from '../config/schema.js';
+import { type ComposioToolkitAuthState } from './composio-sessions.js';
 import type { ConnectorConfirmationPolicy, ConnectorDefinition, ConnectorInstallationPolicy } from './types.js';
 export type ComposioConnection = {
     id: string;
@@ -38,6 +39,7 @@ export type ComposioConnectorHealth = {
     recovery: 'none' | 'connect' | 'reconnect' | 'retry';
     errorCode?: 'missing_credential' | 'unauthorized' | 'forbidden' | 'network' | 'timeout' | 'provider_error';
 };
+export declare function getConfiguredComposioAuthConfigs(config: Config | undefined, toolkits: string[]): Record<string, string>;
 export declare function toolkitFromComposioSlug(slug: string): string | undefined;
 export declare function scopeForComposioAction(slug: string): {
     toolkit?: string;
@@ -64,6 +66,7 @@ export declare function saveComposioApiKey(input: {
 export declare function configureComposioApiKey(apiKey: string, resolver?: CredentialResolver): Promise<void>;
 export declare function listComposioConnections(resolver?: CredentialResolver): Promise<ComposioConnection[]>;
 export declare function inspectComposioConnectorHealth(toolkit: string, resolver?: CredentialResolver): Promise<ComposioConnectorHealth>;
+export declare function getComposioToolkitAuthState(toolkit: string, resolver?: CredentialResolver): Promise<ComposioToolkitAuthState>;
 export declare function getComposioInstallationPolicy(config: Config | undefined, toolkit: string): ConnectorInstallationPolicy;
 export declare function updateComposioInstallationPolicy(config: Config | undefined, toolkit: string, patch: {
     allowedAgentIds?: string[];
@@ -76,7 +79,7 @@ export declare function updateComposioConnection(id: string, patch: {
 }): ComposioConnection;
 export declare function refreshComposioConnection(id: string, resolver?: CredentialResolver): Promise<void>;
 export declare function revokeComposioConnection(id: string, resolver?: CredentialResolver): Promise<void>;
-export declare function startComposioAuthorize(connectorId: string, toolkit: string, resolver?: CredentialResolver): Promise<{
+export declare function startComposioAuthorize(connectorId: string, toolkit: string, resolver?: CredentialResolver, authConfigId?: string): Promise<{
     toolkit: string;
     connectUrl: string;
     connectionId?: string;

package/dist/src/connectors/composio.js

@@ -174,6 +174,22 @@ function toolkitFromConnectionMetadata(connection) {
 function normalizeToolkit(toolkit) {
 	return toolkit.trim().toLowerCase().replace(/[^a-z0-9_]+/g, "");
 }
+function getConfiguredComposioAuthConfigs(config, toolkits) {
+	const requested = new Set(toolkits.map(normalizeToolkit));
+	return Object.values(config?.connectors?.instances ?? {}).reduce((result, record) => {
+		if (!record || typeof record !== "object" || Array.isArray(record)) return result;
+		const row = record;
+		const runtime = row.runtime;
+		const marker = row.xopcConnector;
+		if (!runtime || typeof runtime !== "object" || Array.isArray(runtime) || runtime.type !== "composio" || runtime.role !== "toolkit" || typeof runtime.toolkit !== "string" || !marker || typeof marker !== "object" || Array.isArray(marker)) return result;
+		const toolkit = normalizeToolkit(runtime.toolkit);
+		if (!requested.has(toolkit)) return result;
+		const configValue = marker.config;
+		const authConfigId = configValue && typeof configValue === "object" && !Array.isArray(configValue) ? configValue.authConfigId : void 0;
+		if (typeof authConfigId === "string" && authConfigId.trim()) result[toolkit] = authConfigId.trim();
+		return result;
+	}, {});
+}
 function toolkitFromComposioSlug(slug) {
 	const upper = slug.trim().toUpperCase();
 	if (!upper) return void 0;
@@ -399,6 +415,9 @@ async function inspectComposioConnectorHealth(toolkit, resolver = new Credential
 		};
 	}
 }
+async function getComposioToolkitAuthState(toolkit, resolver = new CredentialResolver()) {
+	return new ComposioSessionsAdapter({ resolver }).getToolkitAuthState(normalizeToolkit(toolkit));
+}
 function classifyComposioHealthError(error) {
 	const message = error instanceof Error ? error.message : String(error);
 	if (/api key is not configured|missing.*api key/i.test(message)) return {
@@ -473,11 +492,12 @@ async function revokeComposioConnection(id, resolver = new CredentialResolver())
 	await new ComposioSessionsAdapter({ resolver }).revokeConnection(connection);
 	if (connection.accountId) refreshConnectorAccountCurrent(connection.accountId);
 }
-async function startComposioAuthorize(connectorId, toolkit, resolver = new CredentialResolver()) {
+async function startComposioAuthorize(connectorId, toolkit, resolver = new CredentialResolver(), authConfigId) {
 	const normalizedToolkit = normalizeToolkit(toolkit);
 	const authorization = await new ComposioSessionsAdapter({ resolver }).authorize({
 		principalId: LOCAL_OWNER_PRINCIPAL,
 		toolkit: normalizedToolkit,
+		authConfigId,
 		installationId: getConnectorInstallation(`${connectorId}-${LOCAL_OWNER_PRINCIPAL}`)?.id
 	});
 	if (!authorization.connectUrl) throw new Error("Composio authorize did not return a connect URL.");
@@ -491,7 +511,8 @@ async function listComposioTools(toolkit, config, resolver = new CredentialResol
 	const normalizedToolkit = normalizeToolkit(toolkit);
 	const payload = await (await new ComposioSessionsAdapter({ resolver }).createSession({
 		principalId: LOCAL_OWNER_PRINCIPAL,
-		toolkits: [normalizedToolkit]
+		toolkits: [normalizedToolkit],
+		authConfigs: getConfiguredComposioAuthConfigs(config, [normalizedToolkit])
 	})).search({
 		query: `List the available ${normalizedToolkit} actions and their exact input contracts.`,
 		toolkits: [normalizedToolkit]
@@ -551,7 +572,8 @@ async function executeComposioTool(params, resolver = new CredentialResolver())
 	const result = await new ComposioSessionsAdapter({ resolver }).executeWithPolicy({
 		context: {
 			principalId: LOCAL_OWNER_PRINCIPAL,
-			toolkits: [allowed.toolkit]
+			toolkits: [allowed.toolkit],
+			authConfigs: getConfiguredComposioAuthConfigs(params.config, [allowed.toolkit])
 		},
 		installation,
 		connection,
@@ -570,4 +592,4 @@ async function executeComposioTool(params, resolver = new CredentialResolver())
 	return result.result;
 }
 //#endregion
-export { COMPOSIO_CONNECTORS, canUseComposioAction, configureComposioApiKey, executeComposioTool, getComposioInstallationPolicy, getComposioToolkitScope, inspectComposioConnectorHealth, isComposioActionAllowedByCatalog, listComposioConnections, listComposioTools, refreshComposioConnection, revokeComposioConnection, saveComposioApiKey, scopeForComposioAction, setComposioToolkitScope, startComposioAuthorize, toolkitFromComposioSlug, updateComposioConnection, updateComposioInstallationPolicy };
+export { COMPOSIO_CONNECTORS, canUseComposioAction, configureComposioApiKey, executeComposioTool, getComposioInstallationPolicy, getComposioToolkitAuthState, getComposioToolkitScope, getConfiguredComposioAuthConfigs, inspectComposioConnectorHealth, isComposioActionAllowedByCatalog, listComposioConnections, listComposioTools, refreshComposioConnection, revokeComposioConnection, saveComposioApiKey, scopeForComposioAction, setComposioToolkitScope, startComposioAuthorize, toolkitFromComposioSlug, updateComposioConnection, updateComposioInstallationPolicy };

package/dist/src/connectors/runtime-adapter-registry.js

@@ -107,7 +107,7 @@ registerConnectorRuntimeAdapter({
 		if (definition.runtime.type !== "composio") throw new Error(`Invalid Composio connector definition: ${definition.id}`);
 		if (definition.runtime.role === "credential") await saveComposioApiKey(input, resolver);
 		if (definition.runtime.role === "toolkit") await assertComposioApiKeyConfigured(resolver);
-		const instance = installRecord(config, definition, definition.runtime.role === "toolkit" ? { scope: "read" } : {});
+		const instance = installRecord(config, definition, definition.runtime.role === "toolkit" ? { scope: "read" } : {}, definition.runtime.role === "toolkit" ? { config: input.config ?? {} } : {});
 		if (definition.runtime.role === "toolkit" && isXopcDatabaseOpen()) {
 			const installationId = `${definition.id}-local-owner`;
 			const existing = getConnectorInstallation(installationId);
@@ -129,6 +129,19 @@ registerConnectorRuntimeAdapter({
 		if (definition.runtime.type !== "composio") throw new Error(`Invalid Composio connector definition: ${definition.id}`);
 		uninstallRecord(config, instance.instanceId);
 		if (definition.runtime.role === "toolkit" && isXopcDatabaseOpen()) deleteConnectorInstallation(`${definition.id}-local-owner`);
+	},
+	update({ config, definition, input, instanceId }) {
+		if (definition.runtime.type !== "composio" || definition.runtime.role !== "toolkit") throw new Error(`Invalid Composio toolkit definition: ${definition.id}`);
+		const record = config.connectors?.instances?.[instanceId];
+		const marker = record?.xopcConnector;
+		if (!marker || typeof marker !== "object" || Array.isArray(marker)) throw new Error(`Connector instance not found: ${instanceId}`);
+		const markerRecord = marker;
+		if (markerRecord.managed !== true) throw new Error(`Connector instance not found: ${instanceId}`);
+		record.xopcConnector = {
+			...markerRecord,
+			config: input.config ?? {}
+		};
+		return installedInstance(config, instanceId, definition.id);
 	}
 });
 for (const type of [

package/dist/src/gateway/heartbeat/service.js

@@ -1,9 +1,9 @@
 import { createLogger } from "../../utils/logger/index.js";
 import { init_logger } from "../../utils/logger.js";
 import { shouldSilence, stripHeartbeatToken } from "../../heartbeat/tokens.js";
+import { appendCronEventLines } from "../../heartbeat/event-prompt.js";
 import { isWithinActiveHours } from "../../heartbeat/active-hours.js";
 import { isHeartbeatContentEmpty } from "../../heartbeat/content-check.js";
-import { appendCronEventLines } from "../../heartbeat/event-prompt.js";
 import { createHeartbeatWake } from "../../heartbeat/wake.js";
 import { resolveHeartbeatMdPath } from "../workspace-heartbeat-path.js";
 import { readFile } from "fs/promises";

package/dist/src/gateway/hono/routes/agent-stream.js

@@ -1,5 +1,5 @@
 import { validateWebchatAttachments, validateWebchatContent } from "../../chat-limits.js";
-import { submitSessionInput } from "./session-input-handler.js";
+import { replaceLatestSessionTurn, submitSessionInput } from "./session-input-handler.js";
 //#region src/gateway/hono/routes/agent-stream.ts
 function registerAgentStreamRoutes(authenticated, deps) {
 	const { service, chatRateLimitMiddleware } = deps;
@@ -36,6 +36,9 @@ function registerAgentStreamRoutes(authenticated, deps) {
 	authenticated.post("/api/sessions/:sessionKey/inputs", chatRateLimitMiddleware, async (c) => {
 		return submitSessionInput(c, deps, (c.req.param("sessionKey") ?? "").trim());
 	});
+	authenticated.post("/api/sessions/:sessionKey/turns/:turnId/replace", chatRateLimitMiddleware, async (c) => {
+		return replaceLatestSessionTurn(c, deps, (c.req.param("sessionKey") ?? "").trim(), (c.req.param("turnId") ?? "").trim());
+	});
 	authenticated.patch("/api/sessions/:sessionKey/inputs/:inputId", chatRateLimitMiddleware, async (c) => {
 		const sessionKey = (c.req.param("sessionKey") ?? "").trim();
 		const inputId = c.req.param("inputId")?.trim() ?? "";