@xopcai/xopc 0.0.221 → 0.0.223

package/dist/src/cli/commands/tunnel.js

@@ -38,7 +38,7 @@ function configureTunnel(ctx) {
 	const brokerUrl = resolveTunnelBrokerUrl(config.tunnel?.brokerUrl);
 	getTunnelService().configure({
 		brokerUrl,
-		registrationSecret: resolveTunnelRegistrationSecret(process.env, brokerUrl, config.tunnel?.registrationSecret),
+		registrationSecret: resolveTunnelRegistrationSecret(brokerUrl, config.tunnel?.registrationSecret),
 		autoStart: config.tunnel?.autoStart ?? false,
 		gatewayHost: host,
 		frpSubdomainHost: resolveFrpSubdomainHost(resolveTunnelBrokerUrl(config.tunnel?.brokerUrl))
@@ -131,13 +131,12 @@ function createTunnelCommand(ctx) {
 		});
 		console.log("Tunnel security consent recorded.");
 	});
-	cmd.command("secret").description("Manage tunnel broker registration secret in config").command("set").description("Save tunnel.registrationSecret to xopc.json (env XOPC_TUNNEL_REGISTRATION_SECRET overrides at runtime)").argument("[secret]", "Registration secret (prompts securely when omitted in a TTY)").option("--stdin", "Read secret from stdin (single line, trimmed)").action(async (secretArg, opts) => {
+	cmd.command("secret").description("Manage tunnel broker registration secret in config").command("set").description("Save tunnel.registrationSecret to xopc.json").argument("[secret]", "Registration secret (prompts securely when omitted in a TTY)").option("--stdin", "Read secret from stdin (single line, trimmed)").action(async (secretArg, opts) => {
 		try {
 			await saveTunnelRegistrationSecret(ctx, await readTunnelRegistrationSecretFromCli({
 				secretArg,
 				stdin: opts.stdin
 			}));
-			if (process.env.XOPC_TUNNEL_REGISTRATION_SECRET?.trim()) console.log("Note: XOPC_TUNNEL_REGISTRATION_SECRET is set in the environment and overrides the saved config at runtime.");
 			console.log(`Saved tunnel registration secret to ${ctx.configPath}.`);
 		} catch (err) {
 			const em = err instanceof Error ? err.message : String(err);
@@ -227,7 +226,7 @@ function createTunnelCommand(ctx) {
 		console.log(`# Self-hosted FRP broker sketch for ${domain}`);
 		console.log("# 1. Run frps with vhost HTTP/HTTPS and a registration token");
 		console.log(`# 2. Point tunnel.brokerUrl to https://${domain}/api`);
-		console.log(`# 3. Set XOPC_TUNNEL_REGISTRATION_SECRET in the gateway environment`);
+		console.log("# 3. Save the broker registration key as tunnel.registrationSecret");
 		console.log("");
 		console.log(JSON.stringify({
 			frps: {
@@ -237,7 +236,7 @@ function createTunnelCommand(ctx) {
 			},
 			broker: {
 				apiUrl: `https://${domain}/api`,
-				registrationSecretEnv: "XOPC_TUNNEL_REGISTRATION_SECRET"
+				registrationSecretConfig: "tunnel.registrationSecret"
 			}
 		}, null, 2));
 	}));

package/dist/src/config/index.js

@@ -2,15 +2,15 @@ import { ENV_VARS, XOPC_DB_FILENAME, resolveHomeDir, resolveStateDir, resolveXop
 import { TelegramAccountConfigSchema, TelegramConfigSchema, TelegramGroupConfigSchema, TelegramTopicConfigSchema } from "../../extensions/telegram/src/config-schema.js";
 import { WeixinAccountConfigSchema, WeixinConfigSchema } from "../../extensions/weixin/src/config-schema.js";
 import { AgentImageGenerationModelSchema, AgentModelRefSchema, AgentModelsSchema, AgentTypedModelRoleSchema, AgentsConfigSchema, BindingMatchSchema, BindingRuleSchema, BindingsConfigSchema, BrowserConfigSchema, ChannelsConfigSchema, CommandsConfigSchema, ConfigSchema, ConnectorsConfigSchema, ExperimentalConfigSchema, ExtensionSecurityConfigSchema, ExtensionSlotsConfigSchema, ExtensionsConfigSchema, GatewayAuthRateLimitSchema, GatewayAuthSchema, GatewayBindModeSchema, GatewayChannelConnectDeferModeSchema, GatewayConfigSchema, GatewayModeSchema, GatewayRemoteSchema, GatewaySecuritySchema, GatewayTailscaleConsentSchema, GatewayTailscaleSchema, GatewayTlsSchema, GatewayTrustedProxySchema, GatewayWebchatConfigSchema, HeartbeatConfigSchema, McpConfigSchema, McpServerSchema, MediaUnderstandingCapabilitiesSchema, MediaUnderstandingModelSchema, MessagesConfigSchema, ModelCatalogConfigSchema, ModelsDevConfigSchema, ProviderAuthConfigSchema, ProviderAzureConfigSchema, ProviderRequestOverridesSchema, ProvidersConfigSchema, RuntimeToolsConfigSchema, STTConfigSchema, STTFallbackConfigSchema, STTProviderConfigSchema, SearchProviderEntrySchema, SessionConfigSchema, SessionDmScopeSchema, SessionResetByTypeSchema, SessionResetConfigSchema, SessionResetModeSchema, SessionScopeSchema, SessionStorageConfigSchema, TTSConfigSchema, TTSEdgeConfigSchema, TTSFallbackConfigSchema, TTSModelOverridesConfigSchema, TTSProviderConfigSchema, TTSSummarizationConfigSchema, ToolsConfigSchema, ToolsMediaAudioConfigSchema, ToolsMediaConfigSchema, TuiConfigSchema, TunnelConfigSchema, TunnelConsentSchema, UpdateAutoConfigSchema, UpdateConfigSchema, VoiceConfigSchema, VoiceRefinementConfigSchema, WebSearchConfigSchema, WebToolsConfigSchema, WebsiteBlocklistSchema, WorkspaceConfigSchema, WorkspaceImportConfigSchema, getAgentDefaultImageGenerationModelConfig, getAgentDefaultImageModelConfig, getAgentDefaultModelRef, init_schema, parseModelRef } from "./schema.js";
-import { clearConfigValueCache, getAllowedCommands, getCacheStats, init_resolve_config_value, resolveConfigValue, resolveHeaders, testApiKeyResolution } from "./resolve-config-value.js";
+import { applyConfigOverrides, getConfigOverrides, resetConfigOverrides, setConfigOverride, unsetConfigOverride } from "./runtime-overrides.js";
 import { expandWorkspacePathString, init_workspace_path, normalizeWorkspaceDir, resolveWorkspaceRoot } from "./workspace-path.js";
 import { resolveDefaultAgentWorkspaceDir } from "./workspace-defaults.js";
 import { resolveAgentDir as resolveAgentDir$1, resolveAgentHomeDir as resolveAgentHomeDir$1, resolveAgentWorkspaceDir } from "../agent/agent-scope.js";
+import { extractProfileAgentId, resolveEffectiveAgentManifestForAgent, resolveEffectiveAgentManifestForSession, resolveEffectiveAgentProfile, resolveEffectiveAgentProfileForSession } from "./agent-profile.js";
 import { FILENAMES, WORKSPACE_FILES, existsSync, hasBundledExtensionManifest, init_paths, resolveAgentAuthProfilesPath, resolveAgentDir, resolveAgentHomeDir, resolveAgentProfileDir, resolveAgentProfileMarkdownPath, resolveAuthProfilesPath, resolveBinDir, resolveBundledExtensionsDir, resolveBundledSkillsDir, resolveConfigPath, resolveCredentialsDir, resolveExtensionSdkPath, resolveExtensionsDir, resolveExtensionsLockPath, resolveInboxDir, resolveInboxMessagePath, resolveInboxPendingDir, resolveInboxProcessedDir, resolveLogPath, resolveLogsDir, resolveModelsJsonPath, resolveNodeBinDir, resolveNodeBinPath, resolveNodeToolsDir, resolveNpmBinPath, resolveOAuthPath, resolvePidPath, resolveSkillPath, resolveSkillsCachePath, resolveSkillsDir, resolveSkillsLockPath, resolveSocketPath, resolveStatusPath, resolveToolsDir, resolveWorkspaceExtensionsDir, resolveWorkspaceFile, resolveWorkspaceStateDir, resolveWorkspaceStatePath, resolveXopcBinPath } from "./paths.js";
-import { CustomModelSchema, ImageGenerationCapabilitiesSchema, ImageGenerationModelSchema, ImageGenerationProviderSchema, ModelOverrideSchema, ModelsJsonSchema, OpenAICompatSchema, OpenAICompletionsCompatSchema, OpenAIResponsesCompatSchema, OpenRouterRoutingSchema, ProviderConfigSchema, VercelGatewayRoutingSchema, getDefaultModelValues, init_models_json, loadModelsJson, modelsJsonExists, saveModelsJson, validateModelsConfig } from "./models-json.js";
 import { init_loader, loadConfig, saveConfig } from "./loader.js";
-import { applyConfigOverrides, getConfigOverrides, resetConfigOverrides, setConfigOverride, unsetConfigOverride } from "./runtime-overrides.js";
-import { extractProfileAgentId, resolveEffectiveAgentManifestForAgent, resolveEffectiveAgentManifestForSession, resolveEffectiveAgentProfile, resolveEffectiveAgentProfileForSession } from "./agent-profile.js";
+import { clearConfigValueCache, getAllowedCommands, getCacheStats, init_resolve_config_value, resolveConfigValue, resolveHeaders, testApiKeyResolution } from "./resolve-config-value.js";
+import { CustomModelSchema, ImageGenerationCapabilitiesSchema, ImageGenerationModelSchema, ImageGenerationProviderSchema, ModelOverrideSchema, ModelsJsonSchema, OpenAICompatSchema, OpenAICompletionsCompatSchema, OpenAIResponsesCompatSchema, OpenRouterRoutingSchema, ProviderConfigSchema, VercelGatewayRoutingSchema, getDefaultModelValues, init_models_json, loadModelsJson, modelsJsonExists, saveModelsJson, validateModelsConfig } from "./models-json.js";
 import { canonicalizeConfiguredMcpServer, isKnownCliMcpTypeAlias, normalizeConfiguredMcpServers, resolveXopcMcpTransportAlias } from "./mcp-config-normalize.js";
 import { formatThinkingLevels, listThinkingLevels, normalizeElevatedMode, normalizeReasoningLevel, normalizeThinkLevel, normalizeVerboseLevel, thinkLevelToNumber } from "../agent/transcript/thinking-types.js";
 import { getWorkspacePath } from "./workspace-path-helpers.js";

package/dist/src/config/loader.js

@@ -2,8 +2,8 @@ import { __esmMin } from "../../_virtual/_rolldown/runtime.js";
 import { createLogger } from "../utils/logger/index.js";
 import { init_logger } from "../utils/logger.js";
 import { ConfigSchema, init_schema } from "./schema.js";
-import { init_write_file_atomic, writeTextAtomic } from "../infra/write-file-atomic.js";
 import { init_paths, resolveConfigPath } from "./paths.js";
+import { init_write_file_atomic, writeTextAtomic } from "../infra/write-file-atomic.js";
 import { assertChannelPluginConfigs, init_validate_channel_configs } from "./validate-channel-configs.js";
 import { dirname } from "path";
 import { existsSync, mkdirSync, promises, readFileSync } from "fs";

package/dist/src/config/models-json.js

@@ -1,6 +1,6 @@
 import { __esmMin } from "../../_virtual/_rolldown/runtime.js";
-import { init_write_file_atomic, writeTextAtomicSync } from "../infra/write-file-atomic.js";
 import { init_paths, resolveModelsJsonPath } from "./paths.js";
+import { init_write_file_atomic, writeTextAtomicSync } from "../infra/write-file-atomic.js";
 import { existsSync, readFileSync } from "fs";
 import { z } from "zod";
 //#region src/config/models-json.ts

package/dist/src/config/schema.d.ts

@@ -991,6 +991,15 @@ export declare const GatewayConfigSchema: z.ZodDefault<z.ZodObject<{
             listingCacheMs: z.ZodDefault<z.ZodNumber>;
             zipConcurrency: z.ZodDefault<z.ZodNumber>;
         }, z.core.$strip>>;
+        note: z.ZodDefault<z.ZodObject<{
+            enabled: z.ZodDefault<z.ZodBoolean>;
+            maxMarkdownBytes: z.ZodDefault<z.ZodNumber>;
+            maxAttachmentCount: z.ZodDefault<z.ZodNumber>;
+            maxAttachmentSize: z.ZodDefault<z.ZodNumber>;
+            maxTotalSize: z.ZodDefault<z.ZodNumber>;
+            assetTicketTtlMs: z.ZodDefault<z.ZodNumber>;
+            revokeOnSourceDelete: z.ZodDefault<z.ZodBoolean>;
+        }, z.core.$strip>>;
     }, z.core.$strip>>;
     siteShare: z.ZodOptional<z.ZodObject<{
         enabled: z.ZodDefault<z.ZodBoolean>;
@@ -2067,6 +2076,15 @@ export declare const ConfigSchema: z.ZodDefault<z.ZodObject<{
                 listingCacheMs: z.ZodDefault<z.ZodNumber>;
                 zipConcurrency: z.ZodDefault<z.ZodNumber>;
             }, z.core.$strip>>;
+            note: z.ZodDefault<z.ZodObject<{
+                enabled: z.ZodDefault<z.ZodBoolean>;
+                maxMarkdownBytes: z.ZodDefault<z.ZodNumber>;
+                maxAttachmentCount: z.ZodDefault<z.ZodNumber>;
+                maxAttachmentSize: z.ZodDefault<z.ZodNumber>;
+                maxTotalSize: z.ZodDefault<z.ZodNumber>;
+                assetTicketTtlMs: z.ZodDefault<z.ZodNumber>;
+                revokeOnSourceDelete: z.ZodDefault<z.ZodBoolean>;
+            }, z.core.$strip>>;
         }, z.core.$strip>>;
         siteShare: z.ZodOptional<z.ZodObject<{
             enabled: z.ZodDefault<z.ZodBoolean>;

package/dist/src/config/schema.js

@@ -490,7 +490,7 @@ strict: z.boolean().optional() }).optional();
 	TunnelConfigSchema = z.object({
 		enabled: z.boolean().default(false),
 		brokerUrl: z.string().url().default("https://frp.xopc.ai/api"),
-		/** Broker register API secret (env `XOPC_TUNNEL_REGISTRATION_SECRET` overrides when set). */
+		/** Broker register API secret. */
 		registrationSecret: z.string().min(1).optional(),
 		autoStart: z.boolean().default(false),
 		subdomain: z.string().optional(),
@@ -620,6 +620,24 @@ activityDetailDefault: z.enum([
 				maxDepth: 20,
 				listingCacheMs: 6e4,
 				zipConcurrency: 1
+			}),
+			/** Note snapshot-sharing controls. */
+			note: z.object({
+				enabled: z.boolean().default(true),
+				maxMarkdownBytes: z.number().int().min(1024).max(10485760).default(2097152),
+				maxAttachmentCount: z.number().int().min(0).max(500).default(50),
+				maxAttachmentSize: z.number().int().min(1024).max(1073741824).default(104857600),
+				maxTotalSize: z.number().int().min(1024).max(2147483648).default(262144e3),
+				assetTicketTtlMs: z.number().int().min(6e4).max(36e5).default(6e5),
+				revokeOnSourceDelete: z.boolean().default(true)
+			}).default({
+				enabled: true,
+				maxMarkdownBytes: 2097152,
+				maxAttachmentCount: 50,
+				maxAttachmentSize: 104857600,
+				maxTotalSize: 262144e3,
+				assetTicketTtlMs: 6e5,
+				revokeOnSourceDelete: true
 			})
 		}).optional(),
 		/** Site-share configuration (static directory or reverse-proxy a local dev server). */

package/dist/src/connectors/learning-coordinator.js

@@ -10,7 +10,7 @@ import { connectorIdentityKey, normalizeConnectorIdentity } from "./connector-id
 import { ComposioSessionsAdapter } from "./composio-sessions.js";
 import { buildConnectorLearningArguments, getConnectorLearningPlan } from "./learning-recipes.js";
 import { getConnectorDefinition } from "./catalog.js";
-import { createUnderstandingSourceRun, getUnderstandingSourceGrant, listUnderstandingSourceRuns, updateUnderstandingSourceGrantCheckpoint, updateUnderstandingSourceRun, upsertUnderstandingSourceGrant, upsertUserFocus } from "../user-context/sources/repository.js";
+import { createUnderstandingSourceRun, getUnderstandingSourceGrant, listUnderstandingSourceRuns, updateUnderstandingSourceGrantCheckpoint, updateUnderstandingSourceRun, upsertUnderstandingSourceGrant } from "../user-context/sources/repository.js";
 import { claimRegisteredExtraction } from "../user-context/extraction/registry.js";
 import { getWorkspacePath } from "../config/workspace-path-helpers.js";
 import { ConnectedKnowledgePipeline } from "../knowledge/connected-knowledge-pipeline.js";
@@ -227,20 +227,10 @@ function startConnectorLearningCoordinator(options) {
 		};
 		if (structuralExtraction.shouldExecute) try {
 			understanding = await new ConnectedUnderstandingPipeline(options.getMemoryManager()).process(job.agentId, structuralExtraction.run.id);
-			const structuralFocuses = understanding.createdRecords.filter((item) => item.kind === "project_context").map((record) => upsertUserFocus({
-				canonicalKey: `connector-focus:${job.accountId}:${record.id}`,
-				title: record.content.slice(0, 120),
-				summary: record.content,
-				horizon: "ongoing",
-				status: "candidate",
-				confidence: .72,
-				evidenceRefs: [`connector-account:${job.accountId}`],
-				sourceRunId: sourceRun.id
-			}));
 			finishContextExtractionRun({
 				runId: structuralExtraction.run.id,
 				status: "completed",
-				outputs: [...(understanding.writeOutputs ?? []).map((output) => ({
+				outputs: (understanding.writeOutputs ?? []).map((output) => ({
 					candidateKey: output.candidateKey,
 					...output.objectId ? {
 						objectType: "understanding",
@@ -248,13 +238,7 @@ function startConnectorLearningCoordinator(options) {
 					} : {},
 					...output.versionId ? { versionId: output.versionId } : {},
 					outcome: output.outcome
-				})), ...structuralFocuses.map((focus) => ({
-					candidateKey: focus.canonicalKey,
-					objectType: "focus",
-					objectId: focus.id,
-					versionId: focus.versionId,
-					outcome: "created"
-				}))]
+				}))
 			});
 		} catch (error) {
 			finishContextExtractionRun({

package/dist/src/extensions/lockfile.js

@@ -1,7 +1,7 @@
 import { createLogger } from "../utils/logger/index.js";
 import { init_logger } from "../utils/logger.js";
-import { init_write_file_atomic, writeTextAtomic } from "../infra/write-file-atomic.js";
 import { init_paths, resolveExtensionsDir, resolveExtensionsLockPath } from "../config/paths.js";
+import { init_write_file_atomic, writeTextAtomic } from "../infra/write-file-atomic.js";
 import { dirname, join } from "path";
 import { existsSync } from "fs";
 import { mkdir, readFile } from "fs/promises";

package/dist/src/gateway/agents-admin.js

@@ -1,7 +1,7 @@
 import { resolveCapabilityPresetLayer, resolveEffectiveAgentManifest } from "../agent-manifest/resolver.js";
 import { init_agent_scope, listAgentEntries, normalizeAgentId, resolveAgentDir, resolveAgentProfileDir, resolveAgentWorkspaceDir, resolveDefaultAgentId, resolveUserPath, validateAgentIdForNewAgent } from "../agent/agent-scope.js";
-import { WORKSPACE_FILES, init_paths } from "../config/paths.js";
 import { resolveEffectiveAgentProfile } from "../config/agent-profile.js";
+import { WORKSPACE_FILES, init_paths } from "../config/paths.js";
 import { AGENT_PROFILE_MARKDOWN_SYSTEM_FILES, REQUIRED_AGENT_PROFILE_MARKDOWN_FILE_SET } from "../agent/context/workspace.js";
 import { isPathUnderWorkspace, resolveWorkspaceSafePath } from "./workspace-editor-path.js";
 import { seedAgentProfileMarkdownFiles } from "../agent/context/workspace-seed.js";

package/dist/src/gateway/file-path-classifier.js

@@ -1,7 +1,7 @@
 import { init_paths_state, resolveStateDir } from "../config/paths-state.js";
 import { init_agent_scope, resolveAgentProfileDir } from "../agent/agent-scope.js";
-import { init_paths, resolveConfigPath, resolveSkillsDir } from "../config/paths.js";
 import { extractProfileAgentId } from "../config/agent-profile.js";
+import { init_paths, resolveConfigPath, resolveSkillsDir } from "../config/paths.js";
 import { isBareProfileMarkdownFileName, resolveProfileMarkdownPathIfBareName } from "../agent/tools/tool-paths.js";
 import { isPathUnderWorkspace, resolveWorkspaceSafePath } from "./workspace-editor-path.js";
 import { basename, isAbsolute, resolve } from "node:path";

package/dist/src/gateway/hono/app.js

@@ -147,6 +147,7 @@ function createHonoApp(config) {
 	const DEFAULT_API_BODY_MAX = 1 * 1024 * 1024;
 	const SKILL_UPLOAD_BODY_MAX = 10 * 1024 * 1024;
 	const NOTE_MEDIA_BODY_MAX = 25 * 1024 * 1024;
+	const MEDIA_UPLOAD_BODY_MAX = 33 * 1024 * 1024;
 	const VOICE_TRANSCRIBE_BODY_MAX = 26 * 1024 * 1024;
 	const SESSION_INPUT_BODY_MAX = maxSessionInputRequestBodyBytes();
 	const isNoteMediaUploadRequest = (path, method, contentType) => {
@@ -175,7 +176,7 @@ function createHonoApp(config) {
 	}));
 	app.use("/api/*", async (c, next) => {
 		const contentType = c.req.header("content-type");
-		const maxSize = c.req.method === "POST" && c.req.path === "/api/tasks" || c.req.method === "POST" && /^\/api\/sessions\/[^/]+\/inputs$/.test(c.req.path) || c.req.method === "POST" && /^\/api\/tasks\/[^/]+\/inputs$/.test(c.req.path) || c.req.method === "PATCH" && /^\/api\/sessions\/[^/]+\/inputs\/[^/]+$/.test(c.req.path) ? SESSION_INPUT_BODY_MAX : c.req.path === "/api/skills/upload" ? SKILL_UPLOAD_BODY_MAX : c.req.path === "/api/voice/transcriptions" ? VOICE_TRANSCRIBE_BODY_MAX : isNoteMediaUploadRequest(c.req.path, c.req.method, contentType) ? NOTE_MEDIA_BODY_MAX : isProjectFileUploadRequest(c.req.path, c.req.method, contentType) ? NOTE_MEDIA_BODY_MAX : discussionUploadBodyMax(c.req.path, c.req.method, contentType) ?? DEFAULT_API_BODY_MAX;
+		const maxSize = c.req.method === "POST" && c.req.path === "/api/tasks" || c.req.method === "POST" && /^\/api\/sessions\/[^/]+\/inputs$/.test(c.req.path) || c.req.method === "POST" && /^\/api\/tasks\/[^/]+\/inputs$/.test(c.req.path) || c.req.method === "PATCH" && /^\/api\/sessions\/[^/]+\/inputs\/[^/]+$/.test(c.req.path) ? SESSION_INPUT_BODY_MAX : c.req.path === "/api/skills/upload" ? SKILL_UPLOAD_BODY_MAX : c.req.path === "/api/voice/transcriptions" ? VOICE_TRANSCRIBE_BODY_MAX : c.req.path === "/api/media" && c.req.method === "POST" ? MEDIA_UPLOAD_BODY_MAX : isNoteMediaUploadRequest(c.req.path, c.req.method, contentType) ? NOTE_MEDIA_BODY_MAX : isProjectFileUploadRequest(c.req.path, c.req.method, contentType) ? NOTE_MEDIA_BODY_MAX : discussionUploadBodyMax(c.req.path, c.req.method, contentType) ?? DEFAULT_API_BODY_MAX;
 		const maxSizeMb = Math.ceil(maxSize / (1024 * 1024));
 		return bodyLimit({
 			maxSize,

package/dist/src/gateway/hono/lib/config-payload.js

@@ -1,9 +1,9 @@
 import { ContextCompactionPolicySchema, UserContextDreamingSchema, UserContextPrivacySchema, init_config } from "../../../user-context/config.js";
 import { init_agent_scope, listAgentEntries, normalizeAgentId, resolveDefaultAgentId } from "../../../agent/agent-scope.js";
 import { resolveModelsJsonPath } from "../../../config/paths.js";
+import { buildChannelCatalogForConfig, buildChannelCatalogFromSnapshot, getChannelSetupStatus, init_channel_catalog_service } from "../../../channels/catalog/channel-catalog-service.js";
 import { init_models_json, loadModelsJson } from "../../../config/models-json.js";
 import { CredentialResolver, init_credentials } from "../../../auth/credentials.js";
-import { buildChannelCatalogForConfig, buildChannelCatalogFromSnapshot, getChannelSetupStatus, init_channel_catalog_service } from "../../../channels/catalog/channel-catalog-service.js";
 import { getProviderRegistry, init_plugin_registry } from "../../../providers/plugin-registry.js";
 import { getAllProviders, init_providers, isProviderConfigured } from "../../../providers/index.js";
 import { normalizeConfiguredMcpServers } from "../../../config/mcp-config-normalize.js";

package/dist/src/gateway/hono/oauth-async.d.ts

@@ -23,6 +23,7 @@ export interface OAuthCompletionReadiness {
 export declare function buildOAuthCompletionReadiness(config: Config, catalog: CatalogReadiness): OAuthCompletionReadiness;
 export declare function refreshModelCatalogAfterOAuth(provider: string, service: Pick<GatewayService, 'getModelCatalogSync'>): Promise<CatalogReadiness | undefined>;
 export declare function normalizeDesktopOAuthReturnPath(value: unknown): string | undefined;
+export declare function buildDesktopOAuthReturnUrl(provider: string, sessionId: string, returnPath: unknown): string | undefined;
 export declare function resolveOAuthLoginMethodPreference(params: {
     requestedMethod?: unknown;
     supportedMethods?: readonly string[];

package/dist/src/gateway/hono/oauth-async.js

@@ -82,11 +82,17 @@ function normalizeDesktopOAuthReturnPath(value) {
 	if (path.length === 0 || path.length > 2048 || !path.startsWith("/") || path.startsWith("//") || path.includes("\\") || /[\u0000-\u001f\u007f]/.test(path)) return;
 	return path;
 }
-function desktopOAuthReturnUrl(sessionId, returnPath) {
+const DESKTOP_OAUTH_CALLBACK_PATHS = {
+	"xopc-cloud": "model-connected",
+	"xopc-tunnel": "tunnel-connected"
+};
+function buildDesktopOAuthReturnUrl(provider, sessionId, returnPath) {
+	const callbackPath = DESKTOP_OAUTH_CALLBACK_PATHS[provider];
+	if (!callbackPath) return void 0;
 	const params = new URLSearchParams({ request_id: sessionId });
 	const normalizedReturnPath = normalizeDesktopOAuthReturnPath(returnPath);
 	if (normalizedReturnPath) params.set("return_path", normalizedReturnPath);
-	return `xopc://cloud/model-connected?${params.toString()}`;
+	return `xopc://cloud/${callbackPath}?${params.toString()}`;
 }
 function cancelOAuthSession(session, message = "OAuth flow cancelled") {
 	if (session.abortController) session.abortController.abort();
@@ -142,10 +148,11 @@ function createOAuthAsyncHandler(service) {
 		const oauthProvider = OAUTH_PROVIDERS[provider];
 		if (!oauthProvider) return c.json({ error: `Unknown OAuth provider: ${provider}` }, 400);
 		const sessionId = generateSessionId();
+		const returnToAppUrl = body.client === "desktop" ? buildDesktopOAuthReturnUrl(provider, sessionId, body.returnPath) : void 0;
 		const session = {
 			id: sessionId,
 			provider,
-			...body.client === "desktop" && provider === "xopc-cloud" ? { returnToAppUrl: desktopOAuthReturnUrl(sessionId, body.returnPath) } : {},
+			...returnToAppUrl ? { returnToAppUrl } : {},
 			preferredLoginMethod: preferredOAuthLoginMethod({
 				provider,
 				requestedMethod: body.loginMethod,
@@ -378,4 +385,4 @@ async function runOAuthFlow(session, oauthProvider, service) {
 	}
 }
 //#endregion
-export { buildOAuthCompletionReadiness, createOAuthAsyncHandler, normalizeDesktopOAuthReturnPath, refreshModelCatalogAfterOAuth, resolveOAuthLoginMethodPreference };
+export { buildDesktopOAuthReturnUrl, buildOAuthCompletionReadiness, createOAuthAsyncHandler, normalizeDesktopOAuthReturnPath, refreshModelCatalogAfterOAuth, resolveOAuthLoginMethodPreference };

package/dist/src/gateway/hono/routes/config.js

@@ -1,4 +1,5 @@
 import { enumerateLanGatewayCandidates } from "../../host.js";
+import { getTunnelService } from "../../../tunnel/tunnel-service.js";
 import { prepareLocalVoiceModelAfterProviderSwitch } from "../../../voice/local/provider-switch.js";
 import { buildSafeWebConfigPayload } from "../lib/config-payload.js";
 import { applyAgentsPatch } from "./config-patch/agents.js";
@@ -70,6 +71,15 @@ function registerConfigRoutes(authenticated, deps) {
 			ok: false,
 			error: finalGwCheck.error
 		}, finalGwCheck.status);
+		if (body?.tunnel && typeof body.tunnel === "object" && !Array.isArray(body.tunnel) && body.tunnel.registrationSecret === null) try {
+			await getTunnelService().stop();
+		} catch (err) {
+			const message = err instanceof Error ? err.message : String(err);
+			return c.json({
+				ok: false,
+				error: `Failed to stop tunnel before clearing key: ${message}`
+			}, 500);
+		}
 		const result = await service.saveConfig(config);
 		if (!result.saved) return c.json({
 			ok: false,

package/dist/src/gateway/hono/routes/host-fs.js

@@ -1,7 +1,7 @@
 import { createGatewayRouteLogger } from "../lib/route-logger.js";
 import * as os$1 from "node:os";
 import * as path$1 from "node:path";
-import { readdir, realpath, stat } from "node:fs/promises";
+import { mkdir, readdir, realpath, stat } from "node:fs/promises";
 //#region src/gateway/hono/routes/host-fs.ts
 const log = createGatewayRouteLogger("HostFs");
 function jsonError(status, message) {
@@ -172,6 +172,45 @@ function registerHostFsRoutes(authenticated, _deps) {
 			return jsonError(500, msg || "Failed to read directory");
 		}
 	});
+	/** Create one directory below an existing absolute directory on the gateway host. */
+	authenticated.post("/api/host/fs/directory", async (c) => {
+		const body = await c.req.json().catch(() => null);
+		const parentPath = body && typeof body === "object" && typeof body.parentPath === "string" ? body.parentPath.trim() : "";
+		const name = body && typeof body === "object" && typeof body.name === "string" ? body.name.trim() : "";
+		if (!parentPath || !path$1.isAbsolute(parentPath)) return jsonError(400, "An absolute parent path is required");
+		if (!name || name === "." || name === ".." || name.includes("/") || name.includes("\\") || name.includes("\0") || name.length > 255) return jsonError(400, "Invalid folder name");
+		let resolvedParent;
+		try {
+			resolvedParent = await realpath(path$1.normalize(parentPath));
+			if (!(await stat(resolvedParent)).isDirectory()) return jsonError(400, "Parent path is not a directory");
+		} catch (err) {
+			log.warn({
+				err,
+				path: parentPath
+			}, "Host fs create parent lookup failed");
+			return jsonError(404, "Parent path not found");
+		}
+		const directoryPath = path$1.join(resolvedParent, name);
+		try {
+			await mkdir(directoryPath);
+			const createdPath = await realpath(directoryPath);
+			log.info({ path: createdPath }, "Host fs directory created");
+			return c.json({
+				ok: true,
+				payload: { absolutePath: createdPath }
+			}, 201);
+		} catch (err) {
+			const code = err?.code;
+			if (code === "EEXIST") return jsonError(409, "A file or folder with this name already exists");
+			log.warn({
+				err,
+				path: directoryPath
+			}, "Host fs directory create failed");
+			if (code === "EACCES" || code === "EPERM" || code === "EROFS") return jsonError(403, "Permission denied");
+			if (code === "ENOENT") return jsonError(404, "Parent path not found");
+			return jsonError(500, "Failed to create folder");
+		}
+	});
 }
 //#endregion
 export { registerHostFsRoutes };

package/dist/src/gateway/hono/routes/media.js

@@ -1,15 +1,47 @@
 import { TaskRepository } from "../../../tasks/task-repository.js";
 import { parseMediaUri } from "../../../media/uri.js";
-import { mimeTypeFromMediaPath } from "../../../media/store.js";
+import { mimeTypeFromMediaPath, saveMediaBuffer } from "../../../media/store.js";
 import { readMediaReference } from "../../../media/media-reference.js";
 import { TaskContextRepository } from "../../../tasks/task-context-repository.js";
 import { pendingTranscriptReferencesMediaUri } from "../../../agent/inbound/attachment-pipeline.js";
+import { MAX_WEBCHAT_ATTACHMENT_FILE_BYTES } from "../../chat-limits.js";
 import { messagesReferenceMediaUri } from "../../../media/session-references.js";
 import { createGatewayRouteLogger } from "../lib/route-logger.js";
 //#region src/gateway/hono/routes/media.ts
 const log = createGatewayRouteLogger("Media");
 function registerMediaRoutes(authenticated, deps) {
 	const tasks = new TaskRepository();
+	authenticated.post("/api/media", deps.strictRateLimitMiddleware, async (c) => {
+		const file = (await c.req.formData().catch(() => null))?.get("file");
+		if (!(file instanceof Blob)) return c.json({
+			ok: false,
+			error: { message: "Missing required file field: file" }
+		}, 400);
+		if (file.size === 0) return c.json({
+			ok: false,
+			error: { message: "Uploaded file is empty" }
+		}, 400);
+		if (file.size > 33554432) return c.json({
+			ok: false,
+			error: { message: "Uploaded file exceeds 32 MB limit" }
+		}, 413);
+		const name = "name" in file && typeof file.name === "string" && file.name.trim() ? file.name.trim() : `upload-${Date.now()}`;
+		const saved = await saveMediaBuffer(Buffer.from(await file.arrayBuffer()), {
+			bucket: "inbound",
+			contentType: file.type || "application/octet-stream",
+			maxBytes: MAX_WEBCHAT_ATTACHMENT_FILE_BYTES,
+			originalFilename: name
+		});
+		return c.json({
+			ok: true,
+			payload: {
+				uri: saved.uri,
+				mimeType: saved.contentType,
+				name,
+				size: saved.size
+			}
+		}, 201);
+	});
 	authenticated.get("/api/media/read", async (c) => {
 		const uriRaw = c.req.query("uri");
 		if (!uriRaw || typeof uriRaw !== "string") return c.json({

package/dist/src/gateway/hono/routes/models.js

@@ -1,5 +1,5 @@
-import { init_resolve_config_value, testApiKeyResolution } from "../../../config/resolve-config-value.js";
 import { resolveModelsJsonPath } from "../../../config/paths.js";
+import { init_resolve_config_value, testApiKeyResolution } from "../../../config/resolve-config-value.js";
 import { init_models_json, loadModelsJson, saveModelsJson, validateModelsConfig } from "../../../config/models-json.js";
 import { getModelCatalogStore, init_model_catalog_store } from "../../../providers/model-catalog-store.js";
 import { getModelRegistry } from "../../../providers/model-registry.js";