@xopcai/xopc 0.0.223 → 0.0.225

package/dist/src/gateway/hono/routes/connectors.js

@@ -13,8 +13,9 @@ import { listConnectorProviders } from "../../../connectors/providers.js";
 import { getConnectorDefinition, listConnectorCatalog } from "../../../connectors/catalog.js";
 import { listUnderstandingSourceGrants, revokeUnderstandingSourceGrant } from "../../../user-context/sources/repository.js";
 import { recordConnectorHealthUsage } from "../../../connectors/usage.js";
-import { getConnectorInstance, listConnectorInstances } from "../../../connectors/instances.js";
+import { getConnectorInstance, getInstalledConnectorDefinition, listConnectorInstances } from "../../../connectors/instances.js";
 import { installConnector, installConnectorDefinition, uninstallConnector, updateConnectorConfig } from "../../../connectors/install.js";
+import { getMcpOAuthManager } from "../../../agent/mcp/oauth/mcp-oauth-manager.js";
 import { startConnectorAuthorization } from "../../../connectors/auth-provider-registry.js";
 import { composioLogoResponse } from "../../../connectors/composio-logo.js";
 import { inspectManagedComposioStatus } from "../../../connectors/composio-managed-client.js";
@@ -25,6 +26,7 @@ import { ingestLocalFolderSource } from "../../../connectors/connected-source-in
 import { previewConnectorDefinition, testConnectorInstance } from "../../../connectors/health.js";
 import { setConnectorEnabled } from "../../../connectors/lifecycle.js";
 import { projectComposioConnectionStatus } from "../../../connectors/runtime-status.js";
+import { ConfigPersistenceError, persistConfigMutation } from "../../../config/config-mutation.js";
 //#region src/gateway/hono/routes/connectors.ts
 init_agent_scope();
 function errorMessage(error) {
@@ -48,9 +50,39 @@ function registerConnectorRoutes(authenticated, deps) {
 			}
 		});
 	});
-	authenticated.get("/api/connectors/installed", (c) => {
+	authenticated.get("/api/connectors/installed", async (c) => {
 		const config = service.currentConfig;
-		const instances = listConnectorInstances(config);
+		const instances = await Promise.all(listConnectorInstances(config).map(async (instance) => {
+			if (!instance.enabled || instance.materialized.type !== "mcp") return instance;
+			const server = config.mcp?.servers?.[instance.materialized.serverId];
+			if (!server) return instance;
+			const oauth = await getMcpOAuthManager().status(instance.materialized.serverId, server);
+			if (!oauth.configured) return instance;
+			if (oauth.status === "connected") return {
+				...instance,
+				authStatus: "connected",
+				connectionStatus: "connected"
+			};
+			if (oauth.status === "authorizing") return {
+				...instance,
+				status: "connecting",
+				authStatus: "unknown",
+				connectionStatus: "connecting"
+			};
+			if (oauth.status === "error") return {
+				...instance,
+				status: "failed",
+				authStatus: "unauthorized",
+				connectionStatus: "error",
+				lastError: oauth.session?.error ?? instance.lastError
+			};
+			return {
+				...instance,
+				status: "unauthorized",
+				authStatus: "missing",
+				connectionStatus: "disconnected"
+			};
+		}));
 		const connections = listConnectorConnections({ principalId: "local-owner" });
 		return c.json({
 			ok: true,
@@ -348,12 +380,11 @@ function registerConnectorRoutes(authenticated, deps) {
 		}, 400);
 		const config = service.currentConfig;
 		try {
-			setComposioToolkitScope(config, toolkit, scope);
-			const saved = await service.saveConfig(config);
-			if (!saved.saved) return c.json({
-				ok: false,
-				error: saved.error
-			}, 500);
+			await persistConfigMutation({
+				config,
+				mutate: () => setComposioToolkitScope(config, toolkit, scope),
+				save: () => service.saveConfig(config)
+			});
 			return c.json({
 				ok: true,
 				payload: {
@@ -365,7 +396,7 @@ function registerConnectorRoutes(authenticated, deps) {
 			return c.json({
 				ok: false,
 				error: errorMessage(error)
-			}, 400);
+			}, error instanceof ConfigPersistenceError ? 500 : 400);
 		}
 	});
 	authenticated.post("/api/connectors/composio/tools/:slug/execute", strictRateLimitMiddleware, async (c) => {
@@ -573,14 +604,16 @@ function registerConnectorRoutes(authenticated, deps) {
 		});
 	});
 	authenticated.post("/api/connectors/:id/auth/start", strictRateLimitMiddleware, async (c) => {
-		const connectorId = c.req.param("id");
-		const connector = getConnectorDefinition(connectorId);
+		const connectorOrInstanceId = c.req.param("id");
+		const config = service.currentConfig;
+		const instance = getConnectorInstance(config, connectorOrInstanceId);
+		const connector = instance ? getInstalledConnectorDefinition(config, instance.instanceId) : getConnectorDefinition(connectorOrInstanceId);
 		if (!connector) return c.json({
 			ok: false,
-			error: `Unknown connector: ${connectorId}`
+			error: `Unknown connector: ${connectorOrInstanceId}`
 		}, 404);
 		try {
-			const authorization = await startConnectorAuthorization(connector, service.currentConfig);
+			const authorization = await startConnectorAuthorization(connector, config, instance?.instanceId);
 			return c.json({
 				ok: true,
 				payload: { authorization }
@@ -628,12 +661,11 @@ function registerConnectorRoutes(authenticated, deps) {
 		const registryDefinition = body && typeof body === "object" && !Array.isArray(body) && body.definition && typeof body.definition === "object" && !Array.isArray(body.definition) ? body.definition : void 0;
 		const config = service.currentConfig;
 		try {
-			const instance = registryDefinition?.id === connectorId ? await installConnectorDefinition(config, registryDefinition, input) : await installConnector(config, connectorId, input);
-			const saved = await service.saveConfig(config);
-			if (!saved.saved) return c.json({
-				ok: false,
-				error: saved.error
-			}, 500);
+			const instance = await persistConfigMutation({
+				config,
+				mutate: () => registryDefinition?.id === connectorId ? installConnectorDefinition(config, registryDefinition, input) : installConnector(config, connectorId, input),
+				save: () => service.saveConfig(config)
+			});
 			return c.json({
 				ok: true,
 				payload: { instance }
@@ -642,7 +674,7 @@ function registerConnectorRoutes(authenticated, deps) {
 			return c.json({
 				ok: false,
 				error: errorMessage(error)
-			}, 400);
+			}, error instanceof ConfigPersistenceError ? 500 : 400);
 		}
 	});
 	authenticated.post("/api/connectors/:id/test", async (c) => {
@@ -659,12 +691,11 @@ function registerConnectorRoutes(authenticated, deps) {
 		}, 400);
 		try {
 			const result = await testConnectorInstance(config, instance.materialized.serverId);
-			recordConnectorHealthUsage(config, instance.instanceId, result);
-			const saved = await service.saveConfig(config);
-			if (!saved.saved) return c.json({
-				ok: false,
-				error: saved.error
-			}, 500);
+			await persistConfigMutation({
+				config,
+				mutate: () => recordConnectorHealthUsage(config, instance.instanceId, result),
+				save: () => service.saveConfig(config)
+			});
 			return c.json({
 				ok: true,
 				payload: result
@@ -701,12 +732,11 @@ function registerConnectorRoutes(authenticated, deps) {
 		const input = body && typeof body === "object" && !Array.isArray(body) ? body : {};
 		const config = service.currentConfig;
 		try {
-			const instance = updateConnectorConfig(config, instanceId, input);
-			const saved = await service.saveConfig(config);
-			if (!saved.saved) return c.json({
-				ok: false,
-				error: saved.error
-			}, 500);
+			const instance = await persistConfigMutation({
+				config,
+				mutate: () => updateConnectorConfig(config, instanceId, input),
+				save: () => service.saveConfig(config)
+			});
 			return c.json({
 				ok: true,
 				payload: { instance }
@@ -715,19 +745,18 @@ function registerConnectorRoutes(authenticated, deps) {
 			return c.json({
 				ok: false,
 				error: errorMessage(error)
-			}, 400);
+			}, error instanceof ConfigPersistenceError ? 500 : 400);
 		}
 	});
 	authenticated.post("/api/connectors/:id/enable", strictRateLimitMiddleware, async (c) => {
 		const instanceId = c.req.param("id");
 		const config = service.currentConfig;
 		try {
-			const instance = setConnectorEnabled(config, instanceId, true);
-			const saved = await service.saveConfig(config);
-			if (!saved.saved) return c.json({
-				ok: false,
-				error: saved.error
-			}, 500);
+			const instance = await persistConfigMutation({
+				config,
+				mutate: () => setConnectorEnabled(config, instanceId, true),
+				save: () => service.saveConfig(config)
+			});
 			return c.json({
 				ok: true,
 				payload: { instance }
@@ -736,19 +765,18 @@ function registerConnectorRoutes(authenticated, deps) {
 			return c.json({
 				ok: false,
 				error: errorMessage(error)
-			}, 400);
+			}, error instanceof ConfigPersistenceError ? 500 : 400);
 		}
 	});
 	authenticated.post("/api/connectors/:id/disable", strictRateLimitMiddleware, async (c) => {
 		const instanceId = c.req.param("id");
 		const config = service.currentConfig;
 		try {
-			const instance = setConnectorEnabled(config, instanceId, false);
-			const saved = await service.saveConfig(config);
-			if (!saved.saved) return c.json({
-				ok: false,
-				error: saved.error
-			}, 500);
+			const instance = await persistConfigMutation({
+				config,
+				mutate: () => setConnectorEnabled(config, instanceId, false),
+				save: () => service.saveConfig(config)
+			});
 			return c.json({
 				ok: true,
 				payload: { instance }
@@ -757,19 +785,23 @@ function registerConnectorRoutes(authenticated, deps) {
 			return c.json({
 				ok: false,
 				error: errorMessage(error)
-			}, 400);
+			}, error instanceof ConfigPersistenceError ? 500 : 400);
 		}
 	});
 	authenticated.delete("/api/connectors/:id", strictRateLimitMiddleware, async (c) => {
 		const instanceId = c.req.param("id");
 		const config = service.currentConfig;
 		try {
-			const instance = uninstallConnector(config, instanceId);
-			const saved = await service.saveConfig(config);
-			if (!saved.saved) return c.json({
-				ok: false,
-				error: saved.error
-			}, 500);
+			const definition = getInstalledConnectorDefinition(config, instanceId);
+			const installed = getConnectorInstance(config, instanceId);
+			const serverId = installed?.materialized.type === "mcp" ? installed.materialized.serverId : void 0;
+			const rawServer = serverId ? config.mcp?.servers?.[serverId] : void 0;
+			if (definition?.auth.mode === "oauth" && definition.runtime.type === "mcp" && rawServer) await getMcpOAuthManager().disconnect(serverId, rawServer);
+			const instance = await persistConfigMutation({
+				config,
+				mutate: () => uninstallConnector(config, instanceId),
+				save: () => service.saveConfig(config)
+			});
 			return c.json({
 				ok: true,
 				payload: { instance }
@@ -778,7 +810,7 @@ function registerConnectorRoutes(authenticated, deps) {
 			return c.json({
 				ok: false,
 				error: errorMessage(error)
-			}, 400);
+			}, error instanceof ConfigPersistenceError ? 500 : 400);
 		}
 	});
 }

package/dist/src/gateway/hono/routes/mcp.js

@@ -2,21 +2,31 @@ import { canonicalizeConfiguredMcpServer, normalizeConfiguredMcpServers } from "
 import { loadMergedBundleMcpConfig } from "../../../agent/mcp/bundle-mcp-config.js";
 import { isManagedConnectorServer } from "../../../connectors/materialize.js";
 import { getWorkspacePath } from "../../../config/workspace-path-helpers.js";
+import { getMcpOAuthManager } from "../../../agent/mcp/oauth/mcp-oauth-manager.js";
 import { listBundleMcpServerCapabilitiesForGateway, listBundleMcpServerToolsForGateway } from "../../../agent/mcp/bundle-mcp-gateway.js";
 //#region src/gateway/hono/routes/mcp.ts
 function registerMcpRoutes(authenticated, deps) {
-	authenticated.get("/api/mcp/servers", (c) => {
+	const resolveServer = (id) => {
+		const cfg = deps.service.currentConfig;
+		return loadMergedBundleMcpConfig({
+			workspaceDir: getWorkspacePath(cfg) || "./workspace",
+			cfg
+		}).config.mcpServers[id];
+	};
+	authenticated.get("/api/mcp/servers", async (c) => {
 		const cfg = deps.service.currentConfig;
 		const merged = loadMergedBundleMcpConfig({
 			workspaceDir: getWorkspacePath(cfg) || "./workspace",
 			cfg
 		});
 		const configured = normalizeConfiguredMcpServers(cfg.mcp?.servers);
-		const servers = Object.entries(configured).map(([id, server]) => ({
+		const oauthManager = getMcpOAuthManager();
+		const servers = await Promise.all(Object.entries(configured).map(async ([id, server]) => ({
 			id,
 			managed: isManagedConnectorServer(server),
-			connectorId: isManagedConnectorServer(server) ? server.xopcConnector.connectorId : void 0
-		}));
+			connectorId: isManagedConnectorServer(server) ? server.xopcConnector.connectorId : void 0,
+			oauth: await oauthManager.status(id, server)
+		})));
 		return c.json({
 			ok: true,
 			payload: {
@@ -26,6 +36,62 @@ function registerMcpRoutes(authenticated, deps) {
 			}
 		});
 	});
+	authenticated.get("/api/mcp/servers/:id/oauth", async (c) => {
+		const id = c.req.param("id");
+		const server = resolveServer(id);
+		if (!server) return c.json({
+			ok: false,
+			error: `Unknown MCP server: ${id}`
+		}, 404);
+		return c.json({
+			ok: true,
+			payload: await getMcpOAuthManager().status(id, server)
+		});
+	});
+	authenticated.post("/api/mcp/servers/:id/oauth/start", deps.strictRateLimitMiddleware, async (c) => {
+		const id = c.req.param("id");
+		const server = resolveServer(id);
+		if (!server) return c.json({
+			ok: false,
+			error: `Unknown MCP server: ${id}`
+		}, 404);
+		try {
+			const payload = await getMcpOAuthManager().start({
+				serverId: id,
+				rawServer: server,
+				cfg: deps.service.currentConfig
+			});
+			return c.json({
+				ok: true,
+				payload
+			});
+		} catch (err) {
+			return c.json({
+				ok: false,
+				error: err instanceof Error ? err.message : String(err)
+			}, 400);
+		}
+	});
+	authenticated.delete("/api/mcp/servers/:id/oauth", deps.strictRateLimitMiddleware, async (c) => {
+		const id = c.req.param("id");
+		const server = resolveServer(id);
+		if (!server) return c.json({
+			ok: false,
+			error: `Unknown MCP server: ${id}`
+		}, 404);
+		try {
+			const payload = await getMcpOAuthManager().disconnect(id, server);
+			return c.json({
+				ok: true,
+				payload
+			});
+		} catch (err) {
+			return c.json({
+				ok: false,
+				error: err instanceof Error ? err.message : String(err)
+			}, 400);
+		}
+	});
 	authenticated.get("/api/mcp/servers/:id/tools", async (c) => {
 		const id = c.req.param("id");
 		const cfg = deps.service.currentConfig;
@@ -79,11 +145,17 @@ function registerMcpRoutes(authenticated, deps) {
 			workspaceDir,
 			cfg
 		}).config.mcpServers;
-		if (!(inlineServer ?? servers[id] ?? mergedServers[id])) return c.json({
+		const knownServer = inlineServer ?? servers[id] ?? mergedServers[id];
+		if (!knownServer) return c.json({
 			ok: false,
 			error: `Unknown MCP server: ${id}`
 		}, 404);
 		try {
+			const oauth = await getMcpOAuthManager().status(id, knownServer);
+			if (oauth.configured && oauth.status !== "connected") return c.json({
+				ok: false,
+				error: oauth.session?.error ?? "MCP server authorization is required"
+			}, 409);
 			const capabilities = await listBundleMcpServerCapabilitiesForGateway({
 				workspaceDir,
 				cfg: inlineServer ? {

package/dist/src/gateway/hono/routes/voice.js

@@ -14,8 +14,8 @@ import "../../../voice/stt/index.js";
 import { listSttProvidersForApi } from "../../../voice/stt/list-providers.js";
 import "../../../voice/tts/index.js";
 import { createGatewayRouteLogger } from "../lib/route-logger.js";
-import { listLocalVoiceModelStatuses, removeLocalVoiceModel, startLocalVoiceModelInstall } from "../../../voice/local/model-manager.js";
 import { listTtsProvidersForApi } from "../../../voice/tts/list-providers.js";
+import { listLocalVoiceModelStatuses, removeLocalVoiceModel, startLocalVoiceModelInstall } from "../../../voice/local/model-manager.js";
 //#region src/gateway/hono/routes/voice.ts
 init_providers();
 const log = createGatewayRouteLogger("Voice");

package/dist/src/gateway/run-loop.js

@@ -67,6 +67,9 @@ async function runGatewayLoop(opts) {
 				forceCloseRequested = true;
 				console.warn(`[GatewayRunLoop] Received ${signal} again; force closing connections`);
 				server?.forceCloseConnections();
+			} else if (signal === "SIGINT" || signal === "SIGTERM") {
+				console.warn(`[GatewayRunLoop] Received ${signal} again; force exiting`);
+				exitProcess(0);
 			}
 			return;
 		}

package/dist/src/gateway/server.d.ts

@@ -14,6 +14,8 @@ export interface GatewayServerConfig {
 export declare class GatewayServer {
     private server?;
     private extraServers;
+    private readonly serverSockets;
+    private stopPromise;
     private config;
     private service;
     constructor(config: GatewayServerConfig);
@@ -23,6 +25,7 @@ export declare class GatewayServer {
         restartExpectedMs?: number | null;
     }): Promise<void>;
     stop(): Promise<void>;
+    private stopInternal;
     forceCloseConnections(): void;
     get isRunning(): boolean;
     get serviceInstance(): GatewayService;

package/dist/src/gateway/server.js

@@ -10,6 +10,8 @@ ensureXopcCliOnPath();
 var GatewayServer = class {
 	server;
 	extraServers = [];
+	serverSockets = /* @__PURE__ */ new Map();
+	stopPromise = null;
 	config;
 	service;
 	constructor(config) {
@@ -57,7 +59,14 @@ var GatewayServer = class {
 		});
 		const primaryHost = listenHosts[0] ?? bindHost;
 		const attachUpgrade = (server) => {
-			server.on("upgrade", (req, socket, head) => {
+			const inner = server;
+			const sockets = /* @__PURE__ */ new Set();
+			this.serverSockets.set(server, sockets);
+			inner.on("connection", (socket) => {
+				sockets.add(socket);
+				socket.once("close", () => sockets.delete(socket));
+			});
+			inner.on("upgrade", (req, socket, head) => {
 				try {
 					if (this.service.realtime.handleUpgrade(req, socket, head)) return;
 					if (handleSiteShareUpgrade(this.service, req, socket, head)) return;
@@ -98,11 +107,20 @@ var GatewayServer = class {
 		await this.stop();
 	}
 	async stop() {
+		if (this.stopPromise) return this.stopPromise;
+		this.stopPromise = this.stopInternal();
+		return this.stopPromise;
+	}
+	async stopInternal() {
 		console.log("[GatewayServer] Stopping gateway server...");
+		const forceCloseServer = (server) => {
+			server.closeAllConnections?.();
+			for (const socket of this.serverSockets.get(server) ?? []) socket.destroy();
+		};
 		const closeServer = async (server) => {
 			if (!server) return;
 			const forceClose = setTimeout(() => {
-				server.closeAllConnections?.();
+				forceCloseServer(server);
 			}, 2e3);
 			await new Promise((resolve) => {
 				server.close(() => {
@@ -111,16 +129,23 @@ var GatewayServer = class {
 				});
 			});
 		};
-		await closeServer(this.server);
+		const primaryServer = this.server;
+		const extraServers = this.extraServers;
+		const closePromises = [closeServer(primaryServer), ...extraServers.map(closeServer)];
+		const activeServers = [primaryServer, ...extraServers].filter((server) => server !== void 0);
+		await this.service.stop();
+		for (const server of activeServers) forceCloseServer(server);
+		await Promise.all(closePromises);
+		for (const server of activeServers) this.serverSockets.delete(server);
 		this.server = void 0;
-		for (const extra of this.extraServers) await closeServer(extra);
 		this.extraServers = [];
-		await this.service.stop();
 		console.log("[GatewayServer] Gateway server stopped");
 	}
 	forceCloseConnections() {
 		const close = (server) => {
+			if (!server) return;
 			server?.closeAllConnections?.();
+			for (const socket of this.serverSockets.get(server) ?? []) socket.destroy();
 		};
 		close(this.server);
 		for (const extra of this.extraServers) close(extra);

package/dist/src/heartbeat/index.js

@@ -1,6 +1,6 @@
 import { DEFAULT_ACK_MAX_CHARS, HEARTBEAT_OK, NO_REPLY, shouldSilence, stripHeartbeatToken } from "./tokens.js";
+import { appendCronEventLines } from "./event-prompt.js";
 import { isWithinActiveHours } from "./active-hours.js";
 import { isHeartbeatContentEmpty } from "./content-check.js";
-import { appendCronEventLines } from "./event-prompt.js";
 import { createHeartbeatWake } from "./wake.js";
 export { DEFAULT_ACK_MAX_CHARS, HEARTBEAT_OK, NO_REPLY, appendCronEventLines, createHeartbeatWake, isHeartbeatContentEmpty, isWithinActiveHours, shouldSilence, stripHeartbeatToken };

package/dist/src/infra/update-restart.js

@@ -2,8 +2,8 @@ import { createLogger } from "../utils/logger/index.js";
 import { init_logger } from "../utils/logger.js";
 import { init_paths, resolveConfigPath } from "../config/paths.js";
 import { init_loader, loadConfig } from "../config/loader.js";
-import { isRestartEnabled } from "../config/commands.flags.js";
 import { resolveGatewayService } from "../daemon/service.js";
+import { isRestartEnabled } from "../config/commands.flags.js";
 import { authorizeGatewaySigusr1Restart, writeGatewayRestartIntentSync } from "./restart.js";
 import { findVerifiedGatewayListenerPidsOnPortSync, signalVerifiedGatewayPidSync } from "./gateway-processes.js";
 import { refreshGatewayServiceAfterUpdate } from "./update-service-refresh.js";

package/dist/src/knowledge/connected-knowledge-pipeline.js

@@ -87,7 +87,14 @@ var ConnectedKnowledgePipeline = class {
 					expiresAt: existing.expiresAt,
 					canonicalKey: existing.canonicalKey,
 					supersedesRecordId: existing.supersedesRecordId,
-					conflictGroupId: existing.conflictGroupId
+					conflictGroupId: existing.conflictGroupId,
+					originClass: existing.provenance.originClass,
+					sessionKind: existing.provenance.sessionKind,
+					observedAt: existing.provenance.observedAt,
+					sourceSessionId: existing.provenance.sourceSessionId,
+					sourceTurnId: existing.provenance.sourceTurnId,
+					supersedesKey: existing.provenance.supersedesKey,
+					derivedFromRecalledContext: existing.provenance.derivedFromRecalledContext
 				});
 				completeKnowledgeSourceItemSynthesis({
 					itemId: item.id,
@@ -141,7 +148,11 @@ var ConnectedKnowledgePipeline = class {
 					confidence: .78,
 					observedAt: item.occurredAt ?? item.sourceUpdatedAt
 				}],
-				validFrom: item.occurredAt ?? item.sourceUpdatedAt
+				validFrom: item.occurredAt ?? item.sourceUpdatedAt,
+				originClass: "untrusted",
+				sessionKind: "background",
+				observedAt: item.occurredAt ?? item.sourceUpdatedAt ?? item.updatedAt,
+				derivedFromRecalledContext: false
 			});
 			attachMemoryEvidence({
 				recordId: record.id,
@@ -238,7 +249,14 @@ var ConnectedKnowledgePipeline = class {
 				validTo: (/* @__PURE__ */ new Date()).toISOString(),
 				reviewAfter: existing.reviewAfter,
 				expiresAt: existing.expiresAt,
-				canonicalKey: existing.canonicalKey
+				canonicalKey: existing.canonicalKey,
+				originClass: existing.provenance.originClass,
+				sessionKind: existing.provenance.sessionKind,
+				observedAt: existing.provenance.observedAt,
+				sourceSessionId: existing.provenance.sourceSessionId,
+				sourceTurnId: existing.provenance.sourceTurnId,
+				supersedesKey: existing.provenance.supersedesKey,
+				derivedFromRecalledContext: existing.provenance.derivedFromRecalledContext
 			});
 			return false;
 		}
@@ -282,7 +300,11 @@ var ConnectedKnowledgePipeline = class {
 				confidence: .72,
 				observedAt: item.occurredAt ?? item.sourceUpdatedAt
 			})),
-			validFrom: `${day}T00:00:00.000Z`
+			validFrom: `${day}T00:00:00.000Z`,
+			originClass: "untrusted",
+			sessionKind: "background",
+			observedAt: items.map((item) => item.occurredAt ?? item.sourceUpdatedAt ?? item.updatedAt).sort().at(-1),
+			derivedFromRecalledContext: false
 		});
 		deleteMemoryEvidenceForRecord(summary.id, "derived_from");
 		for (const item of items) attachMemoryEvidence({

package/dist/src/session/store.js

@@ -4,6 +4,7 @@ import { init_logger } from "../utils/logger.js";
 import { requireXopcDatabase } from "../storage/sqlite/connection.js";
 import { buildSessionContextForLlm, buildSessionDisplayMessages, isRuntimeOnlyTranscriptMessage, isTranscriptCompactionEntry, mergeLlmMessagesPreservingContextRows, transcriptRowsFromJsonArray } from "./session-context-for-llm.js";
 import "./types.js";
+import { init_agent_session_key, resolveAgentIdFromSessionKey } from "../routing/agent-session-key.js";
 import { estimateTokensFromMessages } from "../storage/sqlite/row-mappers.js";
 import { deleteSessionRecord, ensureSessionRecord, findSessionKeyBySessionId, getGlobalSessionStats, getSessionMetadata, listSessionMetadata, listSessionsByAgent, patchSessionMetadata, resetSessionRecord } from "../storage/sqlite/session-repository.js";
 import { appendCompactionBoundaryIfUnchanged, appendTranscriptEntry, listCompactionBoundaries, loadCompactionSourceSnapshot, loadLlmMessagesForSession, loadTranscriptHistoryRowsForSession, loadTranscriptRowsForSession, paginateTranscriptMessages, replaceTranscriptRows, restoreBeforeCompactionBoundary, searchSessionTranscript } from "../storage/sqlite/transcript-repository.js";
@@ -12,12 +13,14 @@ import { resolveEffectiveAgentProfileForSession } from "../config/agent-profile.
 import { readPostCompactionContext } from "../agent/reply/post-compaction-context.js";
 import { SessionCompactor } from "../agent/memory/compaction.js";
 import { resolveCompactionPolicy } from "../agent/memory/compaction-policy.js";
+import { promoteCompactionLedger } from "../agent/memory/compaction-promotion.js";
 import { SlidingWindow } from "../agent/memory/window.js";
 import { isAppendOnlyLlmTranscriptMessage } from "./transcript-stats.js";
 import { transcriptRowsToClientHistory } from "./client-history.js";
 import { computeTranscriptUserRoundDeleteRange } from "./user-round-delete.js";
 //#region src/session/store.ts
 init_paths_state();
+init_agent_session_key();
 init_logger();
 const log = createLogger("SessionStore");
 const INDEX_VERSION = "1.0";
@@ -455,6 +458,30 @@ var SessionStore = class {
 				tokensBefore: result.tokensBefore,
 				tokensAfter: result.tokensAfter
 			})) throw new Error(`Session changed while compaction was running: ${key}`);
+			try {
+				const metadata = getSessionMetadata(key);
+				const promoted = promoteCompactionLedger({
+					sessionKey: key,
+					sessionId: expectedSnapshot.sessionId,
+					sourceAgentId: resolveAgentIdFromSessionKey(key),
+					workspaceId: this.resolveWorkspaceCwd(key),
+					projectId: metadata?.projectId,
+					handover: result.handover,
+					audit: result.audit,
+					sourceEntries: expectedSnapshot.entries
+				});
+				log.info({
+					sessionKey: key,
+					episodicCount: promoted.episodicRecordIds.length,
+					durableCount: promoted.durableRecordIds.length,
+					rejectedCount: promoted.rejectedRecordIds.length
+				}, "Compaction ledger memory promotion completed");
+			} catch (err) {
+				log.warn({
+					err,
+					sessionKey: key
+				}, "Compaction ledger memory promotion failed");
+			}
 			log.info({
 				key,
 				tokensBefore: result.tokensBefore,

package/dist/src/storage/sqlite/memory-records-repository.d.ts

@@ -1,4 +1,4 @@
-import type { MemoryDisclosurePolicy, MemoryDurability, MemoryExplicitness, MemoryKind, MemoryRecord, MemorySensitivity, MemorySearchResult, MemorySignal, MemoryStatus } from '../../agent/memory/types.js';
+import type { MemoryDisclosurePolicy, MemoryDurability, MemoryExplicitness, MemoryKind, MemoryOriginClass, MemoryRecord, MemorySessionKind, MemorySensitivity, MemorySearchResult, MemorySignal, MemoryStatus } from '../../agent/memory/types.js';
 export interface UpsertMemoryRecordInput {
     id?: string;
     providerId: string;
@@ -26,6 +26,13 @@ export interface UpsertMemoryRecordInput {
     expiresAt?: string;
     supersedesRecordId?: string;
     conflictGroupId?: string;
+    originClass?: MemoryOriginClass;
+    sessionKind?: MemorySessionKind;
+    observedAt?: string;
+    sourceSessionId?: string;
+    sourceTurnId?: string;
+    supersedesKey?: string;
+    derivedFromRecalledContext?: boolean;
     nowMs?: number;
 }
 export interface ListMemoryRecordsOptions {
@@ -73,6 +80,7 @@ export interface SearchMemoryRecordsOptions {
     statuses?: MemoryStatus[];
     maxResults?: number;
     minScore?: number;
+    trustedOnly?: boolean;
 }
 export interface AppendMemorySignalInput {
     signal: MemorySignal;