@xopcai/xopc 0.0.230 → 0.0.231

package/dist/gateway/static/root/index.html

@@ -11,7 +11,7 @@
     <link rel="apple-touch-icon" sizes="180x180" href="/apple-touch-icon.png?v=20260713-1" />
     <link rel="manifest" href="/site.webmanifest?v=20260713-1" />
     <title>XOPC — Keep what matters moving.</title>
-    <script type="module" crossorigin src="/assets/index-Bbd_dXui.js"></script>
+    <script type="module" crossorigin src="/assets/index-0xQO5B_Q.js"></script>
     <link rel="modulepreload" crossorigin href="/assets/rolldown-runtime-aKtaBQYM.js">
     <link rel="modulepreload" crossorigin href="/assets/preload-helper-zJ_50EbN.js">
     <link rel="modulepreload" crossorigin href="/assets/vendor-react-BOUWij0V.js">
@@ -31,13 +31,14 @@
     <link rel="modulepreload" crossorigin href="/assets/schemas-zIBW3wiV.js">
     <link rel="modulepreload" crossorigin href="/assets/product-delivery-tRr-7IxY.js">
     <link rel="modulepreload" crossorigin href="/assets/copy-to-clipboard-HOJ79TWv.js">
-    <link rel="modulepreload" crossorigin href="/assets/markdown-view-DvM5PWEH.js">
+    <link rel="modulepreload" crossorigin href="/assets/markdown-view-RxNHwlNo.js">
     <link rel="modulepreload" crossorigin href="/assets/dist-J_ySZvz0.js">
     <link rel="modulepreload" crossorigin href="/assets/vendor-swr-BIWyz7Rc.js">
     <link rel="modulepreload" crossorigin href="/assets/check-DUBLcKHA.js">
     <link rel="modulepreload" crossorigin href="/assets/settings-shell-dialog-layer-BU3UuiJr.js">
     <link rel="modulepreload" crossorigin href="/assets/popover-select-CccGri5Y.js">
     <link rel="modulepreload" crossorigin href="/assets/circle-check-C23XjkUj.js">
+    <link rel="modulepreload" crossorigin href="/assets/cloud-C4-yfnnk.js">
     <link rel="modulepreload" crossorigin href="/assets/copy-Dv6d4Dvw.js">
     <link rel="modulepreload" crossorigin href="/assets/ellipsis-0k4rZLoy.js">
     <link rel="modulepreload" crossorigin href="/assets/external-link-DjqjBmc3.js">
@@ -45,25 +46,28 @@
     <link rel="modulepreload" crossorigin href="/assets/eye-CABVeTq0.js">
     <link rel="modulepreload" crossorigin href="/assets/file-code-corner-byQA1VfD.js">
     <link rel="modulepreload" crossorigin href="/assets/globe-DSSGFWFn.js">
-    <link rel="modulepreload" crossorigin href="/assets/notes-api-BFsOGYkd.js">
+    <link rel="modulepreload" crossorigin href="/assets/notes-api-EpgG-OQc.js">
     <link rel="modulepreload" crossorigin href="/assets/loader-circle-CifKLtgG.js">
     <link rel="modulepreload" crossorigin href="/assets/rotate-cw-LIg3Am9S.js">
     <link rel="modulepreload" crossorigin href="/assets/search-DA7gz22f.js">
     <link rel="modulepreload" crossorigin href="/assets/middleware-Pd0e8Igk.js">
+    <link rel="modulepreload" crossorigin href="/assets/files-Dp8_uGTO.js">
     <link rel="modulepreload" crossorigin href="/assets/tool-activity-R8V9l6nk.js">
     <link rel="modulepreload" crossorigin href="/assets/button-CSEbl4zT.js">
     <link rel="modulepreload" crossorigin href="/assets/gateway-startup-retry-B_zrtccP.js">
     <link rel="modulepreload" crossorigin href="/assets/registry-api-BFZrVYfy.js">
     <link rel="modulepreload" crossorigin href="/assets/config-reload-event-Bjh2zoKp.js">
     <link rel="modulepreload" crossorigin href="/assets/gateway-config-swr-BWGjnmDl.js">
+    <link rel="modulepreload" crossorigin href="/assets/models-hub-cache-0RjEwafI.js">
     <link rel="modulepreload" crossorigin href="/assets/electron-env-DH5wF8X8.js">
+    <link rel="modulepreload" crossorigin href="/assets/oauth-api-BwNLwbI8.js">
     <link rel="modulepreload" crossorigin href="/assets/form-field-width-DJw_jULe.js">
     <link rel="modulepreload" crossorigin href="/assets/interaction-BmQogeqz.js">
     <link rel="modulepreload" crossorigin href="/assets/is-masked-secret-DOkL5b_X.js">
     <link rel="modulepreload" crossorigin href="/assets/activity-store-M0nAY5XB.js">
-    <link rel="modulepreload" crossorigin href="/assets/theme-store-DOdCjyuw.js">
-    <link rel="stylesheet" crossorigin href="/assets/markdown-view-CLzTdVLW.css">
-    <link rel="stylesheet" crossorigin href="/assets/index-D_hrEKXM.css">
+    <link rel="modulepreload" crossorigin href="/assets/theme-store-Qgvo0Ga7.js">
+    <link rel="stylesheet" crossorigin href="/assets/markdown-view-B1bGSQqt.css">
+    <link rel="stylesheet" crossorigin href="/assets/index-CCyIdGuQ.css">
   </head>
   <body>
     <div id="root"></div>

package/dist/package.js

@@ -1,4 +1,4 @@
 //#region package.json
-var version = "0.0.230";
+var version = "0.0.231";
 //#endregion
 export { version };

package/dist/src/agent/service.d.ts

@@ -108,6 +108,7 @@ export declare class AgentService {
     getAgentSkillAvailability(agentId: string): AgentSkillAvailabilityPayload;
     getSessionSkillAvailability(sessionKey: string): Promise<AgentSkillAvailabilityPayload>;
     getSessionWorkspaceTrust(sessionKey: string): Promise<WorkspaceTrustState>;
+    getResolvedWorkspaceForSession(sessionKey: string): string;
     setSessionWorkspaceTrust(sessionKey: string, trusted: boolean): Promise<WorkspaceTrustState>;
     getWorkspaceTrust(workspacePath: string): WorkspaceTrustState;
     setWorkspaceTrust(workspacePath: string, trusted: boolean): WorkspaceTrustState;

package/dist/src/agent/service.js

@@ -10,12 +10,12 @@ import { init_providers, resolveModel } from "../providers/index.js";
 import { extractTextContent } from "./context/workspace.js";
 import { effectiveWorkspacePathForSession } from "../session/session-workspace.js";
 import { getProjectForSession } from "../projects/workspace.js";
-import { resolveAgentTurnTimeoutMs } from "./orchestration/run-agent-turn-with-timeout.js";
-import { resolveResponseLanguageForSession } from "./prompt/response-language.js";
 import { resolveWorkspaceSkillsDir, resolveWorkspaceSkillsLockPath } from "./skills/workspace-skills-dir.js";
 import { removeSkillsLockEntry } from "./skills/hub-lock.js";
 import { installSkillFromZip } from "./skills/managed-store.js";
 import { pullSkillFromSource } from "./skills/hub-pull.js";
+import { resolveAgentTurnTimeoutMs } from "./orchestration/run-agent-turn-with-timeout.js";
+import { resolveResponseLanguageForSession } from "./prompt/response-language.js";
 import { normalizeSkillInstallTarget } from "./skills/install-target.js";
 import { onSessionTranscriptUpdate } from "../session/transcript-events.js";
 import { persistInboundAttachments } from "../channels/attachments/inbound-persist.js";
@@ -509,6 +509,9 @@ var AgentService = class {
 		await this.sessionHydrator.workspace(sessionKey);
 		return this.agentManager.getSessionWorkspaceTrust(sessionKey);
 	}
+	getResolvedWorkspaceForSession(sessionKey) {
+		return this.agentManager.getResolvedWorkspaceForSession(sessionKey);
+	}
 	async setSessionWorkspaceTrust(sessionKey, trusted) {
 		await this.sessionHydrator.workspace(sessionKey);
 		return this.agentManager.setSessionWorkspaceTrust(sessionKey, trusted);

package/dist/src/agent/skills/skill-manage-ops.js

@@ -1,8 +1,8 @@
 import { init_paths, resolveSkillsDir } from "../../config/paths.js";
 import { parseFrontmatter } from "../../markdown/frontmatter.js";
-import { fuzzyFindText, normalizeForFuzzyMatch, normalizeToLF, restoreLineEndings } from "../tools/edit-diff.js";
 import { resolveWorkspaceSkillsDir } from "./workspace-skills-dir.js";
 import { formatScanSummary, scanSkillDirectory } from "./scanner.js";
+import { fuzzyFindText, normalizeForFuzzyMatch, normalizeToLF, restoreLineEndings } from "../tools/edit-diff.js";
 import { join, resolve, sep } from "path";
 import { existsSync, realpathSync } from "fs";
 import { mkdir, writeFile } from "fs/promises";

package/dist/src/agent/tools/write.js

@@ -1,9 +1,10 @@
 import { checkFileSafety } from "../prompt/safety.js";
 import { isBareProfileMarkdownFileName, resolvePathUnderWorkspace, resolveProfileMarkdownPathIfBareName } from "./tool-paths.js";
 import { appendProductDeliveryText } from "../../../packages/gateway-contract/src/product-delivery.js";
+import { fileResourceId, fileSpaceId } from "../../files/file-service.js";
 import { evaluateFilePolicy } from "../sandbox/exec-policy.js";
-import { basename, dirname } from "path";
-import { mkdir, writeFile } from "fs/promises";
+import { basename, dirname, relative, sep } from "path";
+import { mkdir, realpath, writeFile } from "fs/promises";
 import { Type } from "@sinclair/typebox";
 //#region src/agent/tools/write.ts
 const MAX_FILE_SIZE = 10 * 1024 * 1024;
@@ -59,30 +60,26 @@ function createWriteFileTool(workspace, options) {
 				const target = writesProfileFile ? resolveProfileMarkdownPathIfBareName(p.path, options.profileMarkdownRoot) : resolvePathUnderWorkspace(p.path, workspace);
 				await mkdir(dirname(target), { recursive: true });
 				await writeFile(target, p.content, "utf-8");
-				const delivery = {
+				const delivery = writesProfileFile ? void 0 : await Promise.all([realpath(workspace), realpath(target)]).then(([root, canonicalTarget]) => ({
 					version: 1,
 					operation: "updated",
 					primary: {
 						kind: "file",
-						id: target,
+						id: fileResourceId(fileSpaceId(root), relative(root, canonicalTarget).split(sep).join("/")),
 						title: basename(target),
 						summary: `${contentBytes} bytes written`,
-						capabilities: [
-							"preview",
-							"reveal",
-							"share"
-						]
+						capabilities: ["preview", "share"]
 					}
-				};
+				}));
 				return {
 					content: [{
 						type: "text",
-						text: appendProductDeliveryText(`File written: ${target}`, delivery)
+						text: delivery ? appendProductDeliveryText(`File written: ${target}`, delivery) : `File written: ${target}`
 					}],
 					details: {
 						size: contentBytes,
 						path: target,
-						delivery
+						...delivery ? { delivery } : {}
 					}
 				};
 			} catch (error) {

package/dist/src/agent/tools/xopc-use-tool.js

@@ -11,10 +11,10 @@ import { TaskRunRepository } from "../../tasks/task-run-repository.js";
 import { TaskReadModelProjector } from "../../tasks/task-read-model-projector.js";
 import { TaskCommandSchema, TaskContextInputSchema } from "../../../packages/gateway-contract/src/tasks.js";
 import { appendProductDeliveryText } from "../../../packages/gateway-contract/src/product-delivery.js";
-import { CreateAutomationSchema, UpdateAutomationSchema } from "../../automations/domain/validation.js";
-import "../../automations/index.js";
 import { isValidProjectAgentId, normalizeProjectAgentId, resolveProjectAgentId } from "../../projects/project-agent.js";
 import "../../projects/index.js";
+import { CreateAutomationSchema, UpdateAutomationSchema } from "../../automations/domain/validation.js";
+import "../../automations/index.js";
 import { TaskContextRepository } from "../../tasks/task-context-repository.js";
 import { TaskDependencyError, TaskDependencyService } from "../../tasks/task-dependency-service.js";
 import { TaskApplicationService } from "../../tasks/task-application-service.js";

package/dist/src/auth/oauth/index.js

@@ -8,7 +8,7 @@ import { init_kimi_coding, kimiCodingOAuthProvider } from "./kimi-coding.js";
 import { init_minimax_cn, minimaxCnOAuthProvider } from "./minimax-cn.js";
 import { init_minimax, minimaxOAuthProvider } from "./minimax.js";
 import { init_openai_codex, loginOpenAICodex, openaiCodexOAuthProvider, refreshOpenAICodexToken } from "./openai-codex.js";
-import { init_xopc_cloud, xopcCloudOAuthProvider, xopcTunnelOAuthProvider } from "./xopc-cloud.js";
+import { init_xopc_cloud, xopcCloudOAuthProvider, xopcShareOAuthProvider, xopcTunnelOAuthProvider } from "./xopc-cloud.js";
 import { OAUTH_PROVIDER_DEFINITIONS, getModelOAuthProviderIds, getOAuthProviderDefinition, getOAuthProviderIds, getOAuthProviderInterfaces, init_registry, isOAuthOnlyProvider } from "./registry.js";
 //#region src/auth/oauth/index.ts
 init_anthropic();
@@ -22,4 +22,4 @@ init_openai_codex();
 init_xopc_cloud();
 init_registry();
 //#endregion
-export { OAUTH_PROVIDER_DEFINITIONS, anthropicOAuthProvider, getModelOAuthProviderIds, getOAuthProviderDefinition, getOAuthProviderIds, getOAuthProviderInterfaces, githubCopilotOAuthProvider, antigravityOAuthProvider as googleAntigravityOAuthProvider, geminiCliOAuthProvider as googleGeminiCliOAuthProvider, isOAuthOnlyProvider, kimiCodingOAuthProvider, loginAnthropic, loginAntigravity, loginGeminiCli, loginOpenAICodex, minimaxCnOAuthProvider, minimaxOAuthProvider, openaiCodexOAuthProvider, refreshAnthropicToken, refreshAntigravityToken, refreshGoogleCloudToken, refreshOpenAICodexToken, xopcCloudOAuthProvider, xopcTunnelOAuthProvider };
+export { OAUTH_PROVIDER_DEFINITIONS, anthropicOAuthProvider, getModelOAuthProviderIds, getOAuthProviderDefinition, getOAuthProviderIds, getOAuthProviderInterfaces, githubCopilotOAuthProvider, antigravityOAuthProvider as googleAntigravityOAuthProvider, geminiCliOAuthProvider as googleGeminiCliOAuthProvider, isOAuthOnlyProvider, kimiCodingOAuthProvider, loginAnthropic, loginAntigravity, loginGeminiCli, loginOpenAICodex, minimaxCnOAuthProvider, minimaxOAuthProvider, openaiCodexOAuthProvider, refreshAnthropicToken, refreshAntigravityToken, refreshGoogleCloudToken, refreshOpenAICodexToken, xopcCloudOAuthProvider, xopcShareOAuthProvider, xopcTunnelOAuthProvider };

package/dist/src/auth/oauth/registry.d.ts

@@ -2,7 +2,7 @@ import type { OAuthProviderInterface } from './types.js';
 export interface OAuthProviderDefinition {
     displayName: string;
     oauthOnly?: boolean;
-    purpose: 'models' | 'tunnel';
+    purpose: 'models' | 'tunnel' | 'share';
     provider: OAuthProviderInterface;
     profileId: string;
     urlPrompt: string;

package/dist/src/auth/oauth/registry.js

@@ -9,7 +9,7 @@ import { init_kimi_coding, kimiCodingOAuthProvider } from "./kimi-coding.js";
 import { init_minimax_cn, minimaxCnOAuthProvider } from "./minimax-cn.js";
 import { init_minimax, minimaxOAuthProvider } from "./minimax.js";
 import { init_openai_codex, openaiCodexOAuthProvider } from "./openai-codex.js";
-import { init_xopc_cloud, xopcCloudOAuthProvider, xopcTunnelOAuthProvider } from "./xopc-cloud.js";
+import { init_xopc_cloud, xopcCloudOAuthProvider, xopcShareOAuthProvider, xopcTunnelOAuthProvider } from "./xopc-cloud.js";
 //#region src/auth/oauth/registry.ts
 function definition(provider, purpose, displayName = provider.name) {
 	return {
@@ -55,6 +55,10 @@ var init_registry = __esmMin((() => {
 			...definition(xopcTunnelOAuthProvider, "tunnel"),
 			oauthOnly: true
 		},
+		"xopc-share": {
+			...definition(xopcShareOAuthProvider, "share"),
+			oauthOnly: true
+		},
 		anthropic: definition(anthropicOAuthProvider, "models", "Anthropic (Claude)"),
 		minimax: definition(minimaxOAuthProvider, "models", "MiniMax (幂维智能)"),
 		"minimax-cn": {

package/dist/src/auth/oauth/xopc-cloud.d.ts

@@ -1,3 +1,4 @@
 import type { OAuthProviderInterface } from './types.js';
 export declare const xopcCloudOAuthProvider: OAuthProviderInterface;
 export declare const xopcTunnelOAuthProvider: OAuthProviderInterface;
+export declare const xopcShareOAuthProvider: OAuthProviderInterface;

package/dist/src/auth/oauth/xopc-cloud.js

@@ -388,13 +388,14 @@ function createXopcOAuthProvider(options) {
 		getApiKey: (value) => value.access
 	};
 }
-var CLIENT_ID, DEFAULT_CONSOLE_URL, MODEL_SERVICE_SCOPE, TUNNEL_REGISTRATION_SCOPE, CALLBACK_PATH, AUTHORIZATION_TIMEOUT_MS, xopcCloudOAuthProvider, xopcTunnelOAuthProvider;
+var CLIENT_ID, DEFAULT_CONSOLE_URL, MODEL_SERVICE_SCOPE, TUNNEL_REGISTRATION_SCOPE, HOSTED_SHARE_SCOPE, CALLBACK_PATH, AUTHORIZATION_TIMEOUT_MS, xopcCloudOAuthProvider, xopcTunnelOAuthProvider, xopcShareOAuthProvider;
 var init_xopc_cloud = __esmMin((() => {
 	init_pkce();
 	CLIENT_ID = "xopc-native";
 	DEFAULT_CONSOLE_URL = "https://console.xopc.ai";
 	MODEL_SERVICE_SCOPE = "models:read models:invoke account:usage connectors:read connectors:manage connectors:execute offline_access";
 	TUNNEL_REGISTRATION_SCOPE = "tunnel:register";
+	HOSTED_SHARE_SCOPE = "shares:read shares:write offline_access";
 	CALLBACK_PATH = "/oauth/callback";
 	AUTHORIZATION_TIMEOUT_MS = 5 * 6e4;
 	xopcCloudOAuthProvider = createXopcOAuthProvider({
@@ -407,7 +408,12 @@ var init_xopc_cloud = __esmMin((() => {
 		name: "XOPC Public Tunnel",
 		scope: TUNNEL_REGISTRATION_SCOPE
 	});
+	xopcShareOAuthProvider = createXopcOAuthProvider({
+		id: "xopc-share",
+		name: "XOPC Hosted Share",
+		scope: HOSTED_SHARE_SCOPE
+	});
 }));
 //#endregion
 init_xopc_cloud();
-export { init_xopc_cloud, xopcCloudOAuthProvider, xopcTunnelOAuthProvider };
+export { init_xopc_cloud, xopcCloudOAuthProvider, xopcShareOAuthProvider, xopcTunnelOAuthProvider };

package/dist/src/files/file-service.d.ts

@@ -0,0 +1,36 @@
+import type { FileResource, FileSpace } from '@xopcai/gateway-contract';
+import type { Config } from '../config/schema.js';
+import { type ProjectService } from '../projects/index.js';
+export type ResolvedFileSpace = FileSpace & {
+    root: string;
+};
+export declare function fileSpaceId(root: string): string;
+export declare function fileResourceId(spaceId: string, relativePath: string): string;
+export declare function parseFileResourceId(id: string): {
+    spaceId: string;
+    relativePath: string;
+};
+export declare function resolveFilePath(root: string, path: string, mustExist?: boolean): Promise<string>;
+export declare class FileServiceError extends Error {
+    readonly status: 400 | 403 | 404 | 409;
+    constructor(status: 400 | 403 | 404 | 409, message: string);
+}
+export declare function fileResourceFromPath(space: ResolvedFileSpace, absolutePath: string): Promise<FileResource>;
+export declare class FileSpaceService {
+    private readonly getConfig;
+    private readonly projects;
+    private readonly resolveSessionWorkspace;
+    private readonly dynamicSpaces;
+    private cache;
+    constructor(getConfig: () => Config, projects: ProjectService, resolveSessionWorkspace: (sessionKey: string) => string);
+    private createSpace;
+    list(): Promise<ResolvedFileSpace[]>;
+    forContext(kind: 'agent' | 'project' | 'session', id: string): Promise<ResolvedFileSpace>;
+    get(id: string): Promise<ResolvedFileSpace>;
+    resource(id: string): Promise<{
+        space: ResolvedFileSpace;
+        resource: FileResource;
+        absolutePath: string;
+    }>;
+    children(spaceId: string, path?: string): Promise<FileResource[]>;
+}

package/dist/src/files/file-service.js

@@ -0,0 +1,282 @@
+import { init_agent_scope, listAgentEntries, resolveAgentWorkspaceDir } from "../agent/agent-scope.js";
+import { resolveProjectAgentId } from "../projects/project-agent.js";
+import "../projects/index.js";
+import { basename, dirname, isAbsolute, relative, resolve, sep } from "node:path";
+import { constants } from "node:fs";
+import { createHash } from "node:crypto";
+import { access, lstat, opendir, realpath, stat } from "node:fs/promises";
+//#region src/files/file-service.ts
+init_agent_scope();
+const SKIPPED_NAMES = new Set([
+	".DS_Store",
+	".git",
+	"node_modules"
+]);
+const TEXT_EXTENSIONS = new Set([
+	"css",
+	"csv",
+	"html",
+	"htm",
+	"js",
+	"json",
+	"jsx",
+	"md",
+	"mjs",
+	"cjs",
+	"svg",
+	"ts",
+	"tsx",
+	"txt",
+	"xml",
+	"yaml",
+	"yml"
+]);
+const MIME_TYPES = {
+	png: "image/png",
+	jpg: "image/jpeg",
+	jpeg: "image/jpeg",
+	gif: "image/gif",
+	webp: "image/webp",
+	svg: "image/svg+xml",
+	md: "text/markdown",
+	txt: "text/plain",
+	json: "application/json",
+	html: "text/html",
+	htm: "text/html",
+	css: "text/css",
+	js: "text/javascript",
+	mjs: "text/javascript",
+	cjs: "text/javascript",
+	ts: "text/typescript",
+	tsx: "text/typescript",
+	csv: "text/csv",
+	xml: "application/xml",
+	yaml: "application/yaml",
+	yml: "application/yaml",
+	pdf: "application/pdf",
+	mp3: "audio/mpeg",
+	wav: "audio/wav",
+	ogg: "audio/ogg",
+	m4a: "audio/mp4",
+	mp4: "video/mp4",
+	mov: "video/quicktime",
+	webm: "video/webm"
+};
+function isWithin(root, target) {
+	const rel = relative(root, target);
+	return rel === "" || !rel.startsWith(`..${sep}`) && rel !== ".." && !isAbsolute(rel);
+}
+function normalizeRelativePath(input) {
+	const normalized = input.replace(/\\/g, "/").replace(/^\/+/, "").replace(/\/+$/, "");
+	if (normalized.includes("\0") || normalized.split("/").some((part) => part === "..")) throw new FileServiceError(400, "Invalid file path");
+	return normalized.split("/").filter((part) => part && part !== ".").join("/");
+}
+function mimeType(name, directory) {
+	if (directory) return "inode/directory";
+	return MIME_TYPES[name.includes(".") ? name.split(".").pop().toLowerCase() : ""] ?? "application/octet-stream";
+}
+function capabilities(name, directory, writable) {
+	if (directory) return writable ? ["upload"] : [];
+	const extension = name.includes(".") ? name.split(".").pop().toLowerCase() : "";
+	const result = ["download", "share"];
+	if (MIME_TYPES[extension] || TEXT_EXTENSIONS.has(extension)) result.unshift("preview");
+	if (writable && TEXT_EXTENSIONS.has(extension)) result.push("edit");
+	return result;
+}
+function fileSpaceId(root) {
+	return createHash("sha256").update(root).digest("base64url").slice(0, 24);
+}
+function fileResourceId(spaceId, relativePath) {
+	return `${spaceId}.${Buffer.from(normalizeRelativePath(relativePath)).toString("base64url")}`;
+}
+function parseFileResourceId(id) {
+	const separator = id.indexOf(".");
+	if (separator <= 0) throw new FileServiceError(400, "Invalid file id");
+	try {
+		return {
+			spaceId: id.slice(0, separator),
+			relativePath: normalizeRelativePath(Buffer.from(id.slice(separator + 1), "base64url").toString("utf8"))
+		};
+	} catch (error) {
+		if (error instanceof FileServiceError) throw error;
+		throw new FileServiceError(400, "Invalid file id");
+	}
+}
+async function resolveFilePath(root, path, mustExist = true) {
+	const canonicalRoot = await realpath(root).catch(() => {
+		throw new FileServiceError(404, "File space is unavailable");
+	});
+	const candidate = resolve(canonicalRoot, normalizeRelativePath(path));
+	if (!isWithin(canonicalRoot, candidate)) throw new FileServiceError(400, "Invalid file path");
+	if (!mustExist) {
+		if (!isWithin(canonicalRoot, await realpath(dirname(candidate)).catch(() => {
+			throw new FileServiceError(404, "Parent directory not found");
+		}))) throw new FileServiceError(400, "Invalid file path");
+		return candidate;
+	}
+	const canonicalTarget = await realpath(candidate).catch(() => {
+		throw new FileServiceError(404, "File not found");
+	});
+	if (!isWithin(canonicalRoot, canonicalTarget)) throw new FileServiceError(400, "File is outside its space");
+	return canonicalTarget;
+}
+var FileServiceError = class extends Error {
+	constructor(status, message) {
+		super(message);
+		this.status = status;
+	}
+};
+async function fileResourceFromPath(space, absolutePath) {
+	const info = await stat(absolutePath);
+	const revisionInfo = await stat(absolutePath, { bigint: true });
+	const relativePath = relative(await realpath(space.root), absolutePath).split(sep).join("/");
+	const name = basename(absolutePath);
+	const directory = info.isDirectory();
+	return {
+		id: fileResourceId(space.id, relativePath),
+		spaceId: space.id,
+		name,
+		relativePath,
+		parentPath: dirname(relativePath).split(sep).join("/").replace(/^\.$/, ""),
+		kind: directory ? "directory" : "file",
+		mimeType: mimeType(name, directory),
+		size: info.size,
+		modifiedAt: Math.max(0, Math.round(info.mtimeMs)),
+		revision: `${revisionInfo.mtimeNs}:${revisionInfo.ctimeNs}:${revisionInfo.ino}:${revisionInfo.size}`,
+		capabilities: capabilities(name, directory, space.writable)
+	};
+}
+var FileSpaceService = class {
+	dynamicSpaces = /* @__PURE__ */ new Map();
+	cache = null;
+	constructor(getConfig, projects, resolveSessionWorkspace) {
+		this.getConfig = getConfig;
+		this.projects = projects;
+		this.resolveSessionWorkspace = resolveSessionWorkspace;
+	}
+	async createSpace(root, title, bindings) {
+		const canonicalRoot = await realpath(root).catch(() => null);
+		if (!canonicalRoot) return null;
+		const rootStat = await stat(canonicalRoot).catch(() => null);
+		if (!rootStat?.isDirectory()) return null;
+		const writable = await access(canonicalRoot, constants.W_OK).then(() => true).catch(() => false);
+		return {
+			id: fileSpaceId(canonicalRoot),
+			title,
+			kind: "workspace",
+			bindings,
+			writable,
+			root: canonicalRoot,
+			lastActivityAt: Math.max(0, Math.round(rootStat.mtimeMs))
+		};
+	}
+	async list() {
+		if (this.cache && Date.now() - this.cache.at < 5e3) return this.cache.spaces;
+		const config = this.getConfig();
+		const spaces = [];
+		for (const agent of listAgentEntries(config)) {
+			const space = await this.createSpace(resolveAgentWorkspaceDir(config, agent.id), agent.id, [{
+				kind: "agent",
+				id: agent.id
+			}]);
+			if (space) spaces.push(space);
+		}
+		let offset = 0;
+		while (true) {
+			const page = this.projects.list({
+				limit: 500,
+				offset
+			});
+			for (const project of page.items) {
+				const agentId = resolveProjectAgentId({
+					config,
+					projects: this.projects,
+					projectId: project.id
+				});
+				const root = project.workspaceRoot ?? resolveAgentWorkspaceDir(config, agentId);
+				const space = await this.createSpace(root, project.name, [{
+					kind: "project",
+					id: project.id
+				}]);
+				if (space) spaces.push(space);
+			}
+			if (!page.hasMore || page.items.length === 0) break;
+			offset += page.items.length;
+		}
+		const merged = /* @__PURE__ */ new Map();
+		for (const space of [...spaces, ...this.dynamicSpaces.values()]) {
+			const existing = merged.get(space.id);
+			if (existing) existing.bindings = [...existing.bindings, ...space.bindings.filter((binding) => !existing.bindings.some((item) => item.kind === binding.kind && item.id === binding.id))];
+			else merged.set(space.id, {
+				...space,
+				bindings: [...space.bindings]
+			});
+		}
+		const result = [...merged.values()].sort((a, b) => (b.lastActivityAt ?? 0) - (a.lastActivityAt ?? 0));
+		this.cache = {
+			at: Date.now(),
+			spaces: result
+		};
+		return result;
+	}
+	async forContext(kind, id) {
+		let root;
+		let title = id;
+		if (kind === "agent") root = resolveAgentWorkspaceDir(this.getConfig(), id);
+		if (kind === "project") {
+			const project = this.projects.get(id);
+			if (project) {
+				const config = this.getConfig();
+				const agentId = resolveProjectAgentId({
+					config,
+					projects: this.projects,
+					projectId: id
+				});
+				root = project.workspaceRoot ?? resolveAgentWorkspaceDir(config, agentId);
+			}
+			title = project?.name ?? id;
+		}
+		if (kind === "session") root = this.resolveSessionWorkspace(id);
+		if (!root) throw new FileServiceError(404, "File space not found");
+		const space = await this.createSpace(root, title, [{
+			kind,
+			id
+		}]);
+		if (!space) throw new FileServiceError(404, "File space is unavailable");
+		this.dynamicSpaces.set(space.id, space);
+		this.cache = null;
+		return space;
+	}
+	async get(id) {
+		const space = (await this.list()).find((item) => item.id === id);
+		if (!space) throw new FileServiceError(404, "File space not found");
+		return space;
+	}
+	async resource(id) {
+		const locator = parseFileResourceId(id);
+		const space = await this.get(locator.spaceId);
+		const absolutePath = await resolveFilePath(space.root, locator.relativePath);
+		return {
+			space,
+			resource: await fileResourceFromPath(space, absolutePath),
+			absolutePath
+		};
+	}
+	async children(spaceId, path = "") {
+		const space = await this.get(spaceId);
+		const directory = await resolveFilePath(space.root, path);
+		if (!(await stat(directory)).isDirectory()) throw new FileServiceError(400, "Path is not a directory");
+		const entries = [];
+		const dir = await opendir(directory);
+		for await (const entry of dir) {
+			if (SKIPPED_NAMES.has(entry.name)) continue;
+			const target = resolve(directory, entry.name);
+			const linkInfo = await lstat(target).catch(() => null);
+			if (!linkInfo || linkInfo.isSymbolicLink()) continue;
+			entries.push(await fileResourceFromPath(space, target));
+		}
+		return entries.sort((a, b) => a.kind === b.kind ? a.name.localeCompare(b.name) : a.kind === "directory" ? -1 : 1);
+	}
+};
+//#endregion
+export { FileServiceError, FileSpaceService, fileResourceFromPath, fileResourceId, fileSpaceId, parseFileResourceId, resolveFilePath };

package/dist/src/gateway/heartbeat/service.js

@@ -1,9 +1,9 @@
 import { createLogger } from "../../utils/logger/index.js";
 import { init_logger } from "../../utils/logger.js";
 import { shouldSilence, stripHeartbeatToken } from "../../heartbeat/tokens.js";
+import { appendCronEventLines } from "../../heartbeat/event-prompt.js";
 import { isWithinActiveHours } from "../../heartbeat/active-hours.js";
 import { isHeartbeatContentEmpty } from "../../heartbeat/content-check.js";
-import { appendCronEventLines } from "../../heartbeat/event-prompt.js";
 import { createHeartbeatWake } from "../../heartbeat/wake.js";
 import { resolveHeartbeatMdPath } from "../workspace-heartbeat-path.js";
 import { readFile } from "fs/promises";

package/dist/src/gateway/hono/app.js

@@ -155,7 +155,7 @@ function createHonoApp(config) {
 		if (/^\/api\/notes\/[^/]+\/media$/.test(path)) return true;
 		return path === "/api/notes" && contentType?.includes("multipart/form-data") === true;
 	};
-	const isProjectFileUploadRequest = (path, method, contentType) => method === "POST" && /^\/api\/projects\/[^/]+\/files\/upload$/.test(path) && contentType?.includes("multipart/form-data") === true;
+	const isFileUploadRequest = (path, method, contentType) => method === "POST" && /^\/api\/files\/spaces\/[^/]+\/upload$/.test(path) && contentType?.includes("multipart/form-data") === true;
 	const discussionUploadBodyMax = (path, method, contentType) => {
 		if (method !== "PUT" || contentType?.includes("multipart/form-data") !== true) return void 0;
 		if (/^\/api\/discussions\/[^/]+\/recording$/.test(path)) return NOTE_MEDIA_BODY_MAX;
@@ -176,7 +176,7 @@ function createHonoApp(config) {
 	}));
 	app.use("/api/*", async (c, next) => {
 		const contentType = c.req.header("content-type");
-		const maxSize = c.req.method === "POST" && c.req.path === "/api/tasks" || c.req.method === "POST" && /^\/api\/sessions\/[^/]+\/inputs$/.test(c.req.path) || c.req.method === "POST" && /^\/api\/tasks\/[^/]+\/inputs$/.test(c.req.path) || c.req.method === "PATCH" && /^\/api\/sessions\/[^/]+\/inputs\/[^/]+$/.test(c.req.path) ? SESSION_INPUT_BODY_MAX : c.req.path === "/api/skills/upload" ? SKILL_UPLOAD_BODY_MAX : c.req.path === "/api/voice/transcriptions" ? VOICE_TRANSCRIBE_BODY_MAX : c.req.path === "/api/media" && c.req.method === "POST" ? MEDIA_UPLOAD_BODY_MAX : isNoteMediaUploadRequest(c.req.path, c.req.method, contentType) ? NOTE_MEDIA_BODY_MAX : isProjectFileUploadRequest(c.req.path, c.req.method, contentType) ? NOTE_MEDIA_BODY_MAX : discussionUploadBodyMax(c.req.path, c.req.method, contentType) ?? DEFAULT_API_BODY_MAX;
+		const maxSize = c.req.method === "POST" && c.req.path === "/api/tasks" || c.req.method === "POST" && /^\/api\/sessions\/[^/]+\/inputs$/.test(c.req.path) || c.req.method === "POST" && /^\/api\/tasks\/[^/]+\/inputs$/.test(c.req.path) || c.req.method === "PATCH" && /^\/api\/sessions\/[^/]+\/inputs\/[^/]+$/.test(c.req.path) ? SESSION_INPUT_BODY_MAX : c.req.path === "/api/skills/upload" ? SKILL_UPLOAD_BODY_MAX : c.req.path === "/api/voice/transcriptions" ? VOICE_TRANSCRIBE_BODY_MAX : c.req.path === "/api/media" && c.req.method === "POST" ? MEDIA_UPLOAD_BODY_MAX : isNoteMediaUploadRequest(c.req.path, c.req.method, contentType) ? NOTE_MEDIA_BODY_MAX : isFileUploadRequest(c.req.path, c.req.method, contentType) ? NOTE_MEDIA_BODY_MAX : discussionUploadBodyMax(c.req.path, c.req.method, contentType) ?? DEFAULT_API_BODY_MAX;
 		const maxSizeMb = Math.ceil(maxSize / (1024 * 1024));
 		return bodyLimit({
 			maxSize,

package/dist/src/gateway/hono/routes/files.d.ts

@@ -0,0 +1,3 @@
+import type { Hono } from 'hono';
+import type { AuthenticatedRouteDeps } from './deps.js';
+export declare function registerFilesRoutes(authenticated: Hono, deps: AuthenticatedRouteDeps): void;