@xopcai/xopc 0.0.231 → 0.0.232

package/dist/src/gateway/agents-admin.js

@@ -1,15 +1,13 @@
 import { init_agent_scope, listAgentEntries, normalizeAgentId, resolveAgentDir, resolveAgentProfileDir, resolveAgentWorkspaceDir, resolveDefaultAgentId, resolveUserPath, validateAgentIdForNewAgent } from "../agent/agent-scope.js";
-import { resolveCapabilityPresetLayer, resolveEffectiveAgentManifest } from "../agent-manifest/resolver.js";
 import { resolveEffectiveAgentProfile } from "../config/agent-profile.js";
 import { WORKSPACE_FILES, init_paths } from "../config/paths.js";
 import { AGENT_PROFILE_MARKDOWN_SYSTEM_FILES, REQUIRED_AGENT_PROFILE_MARKDOWN_FILE_SET } from "../agent/context/workspace.js";
 import { isPathUnderWorkspace, resolveWorkspaceSafePath } from "./workspace-editor-path.js";
 import { seedAgentProfileMarkdownFiles } from "../agent/context/workspace-seed.js";
 import { applyAgentConfig, findAgentEntryIndex, getAgentDeleteBlocker, pruneAgentConfig, removeAgentDirsFromDisk } from "../commands/agents.config.js";
-import { resolveEffectiveTypedModels } from "../config/agent-typed-models.js";
 import { GATEWAY_BUILTIN_TOOL_IDS } from "./agent-builtin-tools.js";
 import { join, resolve } from "node:path";
-import { cp, mkdir, readFile, readdir, realpath, stat, unlink, writeFile } from "node:fs/promises";
+import { mkdir, readFile, realpath, stat, unlink, writeFile } from "node:fs/promises";
 //#region src/gateway/agents-admin.ts
 /**
 * Gateway REST helpers for multi-agent management.
@@ -26,12 +24,6 @@ function collectAgentIdsForList(cfg) {
 	ids.add(defaultId);
 	return [...ids];
 }
-function rolesToTypedModels(roles) {
-	return Object.entries(roles ?? {}).map(([id, role]) => ({
-		id,
-		...role
-	})).sort((a, b) => a.id.localeCompare(b.id));
-}
 /** Extract `**Avatar:**` value from profile IDENTITY.md (same line shape as the gateway console parser). */
 function extractAvatarFromIdentityMarkdown(content) {
 	return parseIdentityMarkdown(content).avatar || void 0;
@@ -58,58 +50,23 @@ async function listGatewayAgents(cfg, _options = {}) {
 	for (const id of collectAgentIdsForList(cfg)) {
 		const profile = resolveEffectiveAgentProfile(cfg, id);
 		const entry = listAgentEntries(cfg).find((e) => normalizeAgentId(e.id) === id);
-		const presetLayer = resolveCapabilityPresetLayer({
-			presetIds: entry?.extends,
-			presets: cfg.agents.capabilityPresets,
-			defaultPresetId: cfg.agents.defaultPreset
-		});
-		const presetSkills = presetLayer.patch.skills?.mode === "allowlist" ? presetLayer.patch.skills.allow ?? [] : void 0;
-		const presetDenied = Object.entries(presetLayer.patch.tools?.builtin ?? {}).filter(([, policy]) => policy.mode === "deny").map(([name]) => name);
-		const presetTypedModels = rolesToTypedModels(presetLayer.patch.models?.roles);
-		const model = profile.primaryModelRef || profile.fallbacks.length > 0 ? {
-			...profile.primaryModelRef ? { primary: profile.primaryModelRef } : {},
-			...profile.fallbacks.length > 0 ? { fallbacks: profile.fallbacks } : {}
-		} : void 0;
-		const entrySkills = entry?.skills?.mode === "allowlist" ? entry.skills.allow ?? [] : void 0;
-		const entryDisable = Object.entries(entry?.tools?.builtin ?? {}).filter(([, policy]) => policy.mode === "deny").map(([name]) => name);
-		const entryTypedModels = rolesToTypedModels(entry?.models?.roles);
-		const effectiveTypedModels = [...resolveEffectiveTypedModels(cfg, id).values()].sort((a, b) => a.id.localeCompare(b.id));
+		if (!entry) continue;
 		let identity = {};
 		try {
 			identity = parseIdentityMarkdown(await readFile(join(resolveAgentProfileDir(cfg, id), WORKSPACE_FILES.IDENTITY), "utf-8"));
 		} catch {}
 		agents.push({
 			id,
-			...identity.name ? { name: identity.name } : {},
+			name: entry.profile?.name ?? identity.name ?? id,
 			...identity.description ? { description: identity.description } : {},
 			...identity.language ? { language: identity.language } : {},
-			...profile.manifest.identity.role ? { role: profile.manifest.identity.role } : {},
-			responsibilities: {
-				primary: [...profile.manifest.responsibilities.primary],
-				...profile.manifest.responsibilities.secondary ? { secondary: [...profile.manifest.responsibilities.secondary] } : {}
-			},
 			...identity.avatar ? { avatar: identity.avatar } : {},
 			workspace: profile.resolvedWorkspacePath,
 			profileDir: resolveAgentProfileDir(cfg, id),
-			...model ? { model } : {},
-			typedModels: {
-				defaultRole: profile.manifest.models.defaultRole,
-				preset: [...presetTypedModels],
-				...entryTypedModels.length > 0 ? { entry: entryTypedModels } : {},
-				effective: effectiveTypedModels
-			},
-			extends: [...entry?.extends ?? []],
-			isDefault: id === defaultId,
-			skills: {
-				preset: presetSkills ? [...presetSkills] : [],
-				...entrySkills !== void 0 ? { entry: [...entrySkills] } : {},
-				...profile.skillsAllowlist !== void 0 ? { effectiveAllowlist: [...profile.skillsAllowlist] } : {}
-			},
-			tools: {
-				presetDenied: [...presetDenied],
-				entryDisable: [...entryDisable],
-				effectiveDisable: [...profile.tools.denied].sort((a, b) => a.localeCompare(b))
-			}
+			override: structuredClone(entry),
+			effective: structuredClone(profile.config),
+			sources: { ...profile.sources },
+			isDefault: id === defaultId
 		});
 	}
 	agents.sort((a, b) => a.id.localeCompare(b.id));
@@ -119,10 +76,9 @@ async function listGatewayAgents(cfg, _options = {}) {
 		builtinToolIds: [...GATEWAY_BUILTIN_TOOL_IDS]
 	};
 }
-function getGatewayAgentEffectiveManifest(cfg, agentIdRaw) {
+function getGatewayAgentEffectiveConfig(cfg, agentIdRaw) {
 	const agentId = normalizeAgentId(agentIdRaw);
-	const entry = listAgentEntries(cfg).find((e) => normalizeAgentId(e.id) === agentId);
-	if (!entry) return {
+	if (!listAgentEntries(cfg).find((e) => normalizeAgentId(e.id) === agentId)) return {
 		ok: false,
 		error: `agent "${agentId}" not found`,
 		status: 404
@@ -130,11 +86,13 @@ function getGatewayAgentEffectiveManifest(cfg, agentIdRaw) {
 	try {
 		return {
 			ok: true,
-			data: resolveEffectiveAgentManifest({
-				agent: entry,
-				presets: cfg.agents.capabilityPresets,
-				defaultPresetId: cfg.agents.defaultPreset
-			})
+			data: (() => {
+				const profile = resolveEffectiveAgentProfile(cfg, agentId);
+				return {
+					config: profile.config,
+					sources: profile.sources
+				};
+			})()
 		};
 	} catch (err) {
 		return {
@@ -145,35 +103,7 @@ function getGatewayAgentEffectiveManifest(cfg, agentIdRaw) {
 	}
 }
 function prepareCreateAgent(cfg, body) {
-	const workspace = body.workspace?.trim() ?? "";
-	if (!workspace) return {
-		ok: false,
-		error: "workspace is required",
-		status: 400
-	};
-	if (body.profileFiles !== void 0) {
-		if (typeof body.profileFiles !== "object" || body.profileFiles === null || Array.isArray(body.profileFiles)) return {
-			ok: false,
-			error: "profileFiles must be an object",
-			status: 400
-		};
-		for (const [name, content] of Object.entries(body.profileFiles)) {
-			const bad = assertAllowedFile(name);
-			if (bad) return bad;
-			if (typeof content !== "string") return {
-				ok: false,
-				error: `profileFiles["${name}"] must be a string`,
-				status: 400
-			};
-		}
-	}
-	if (!body.cloneFrom && typeof body.profileFiles?.[WORKSPACE_FILES.IDENTITY] !== "string") return {
-		ok: false,
-		error: `profileFiles["${WORKSPACE_FILES.IDENTITY}"] is required`,
-		status: 400
-	};
-	const nameSeed = (body.profileFiles?.[WORKSPACE_FILES.IDENTITY] ? parseIdentityMarkdown(body.profileFiles[WORKSPACE_FILES.IDENTITY]) : {}).name ?? body.id ?? "";
-	const idRes = validateAgentIdForNewAgent(body.id, nameSeed);
+	const idRes = validateAgentIdForNewAgent(body.id, body.profile.name);
 	if (idRes.ok === false) return {
 		ok: false,
 		error: idRes.error,
@@ -185,50 +115,21 @@ function prepareCreateAgent(cfg, body) {
 		error: `agent "${agentId}" already exists`,
 		status: 409
 	};
-	let cloneSourceEntry;
-	if (body.cloneFrom) {
-		const srcId = normalizeAgentId(body.cloneFrom);
-		cloneSourceEntry = listAgentEntries(cfg).find((e) => normalizeAgentId(e.id) === srcId);
-		if (!cloneSourceEntry && srcId !== resolveDefaultAgentId(cfg)) return {
-			ok: false,
-			error: `source agent "${srcId}" not found`,
-			status: 404
-		};
-	}
-	const wsAbs = resolveUserPath(workspace);
-	const rawModels = body.models ?? cloneSourceEntry?.models;
-	const inheritedPresetIds = body.extends ?? cloneSourceEntry?.extends ?? [];
-	for (const presetId of inheritedPresetIds) if (!cfg.agents.capabilityPresets[presetId]) return {
-		ok: false,
-		error: `capability preset "${presetId}" not found`,
-		status: 400
-	};
-	const effectiveModels = rawModels?.roles ? {
-		defaultRole: rawModels.defaultRole ?? Object.keys(rawModels.roles)[0] ?? "deep",
-		roles: rawModels.roles
-	} : void 0;
-	if (effectiveModels && !effectiveModels.roles[effectiveModels.defaultRole]) return {
-		ok: false,
-		error: "models.defaultRole must reference models.roles",
-		status: 400
-	};
+	const wsAbs = resolveUserPath(body.workspace?.trim() || `~/.xopc/workspace/${agentId}`);
 	return {
 		ok: true,
 		data: {
 			nextConfig: applyAgentConfig(cfg, {
 				agentId,
-				workspace: wsAbs,
-				extends: [...inheritedPresetIds],
-				...effectiveModels ? { models: effectiveModels } : {},
-				...body.skills !== void 0 ? { skills: body.skills.map((s) => String(s).trim()).filter(Boolean) } : cloneSourceEntry?.skills?.mode === "allowlist" && body.cloneFrom ? { skills: [...cloneSourceEntry.skills.allow ?? []] } : {},
-				...body.tools !== void 0 ? { tools: body.tools } : cloneSourceEntry?.tools && body.cloneFrom ? { tools: cloneSourceEntry.tools } : {}
+				...body.workspace?.trim() ? { workspace: wsAbs } : {},
+				profile: structuredClone(body.profile)
 			}),
 			agentId,
 			workspace: wsAbs
 		}
 	};
 }
-async function finalizeCreateAgentDirs(cfg, agentId, opts) {
+async function finalizeCreateAgentDirs(cfg, agentId) {
 	const wsPath = resolveAgentWorkspaceDir(cfg, agentId);
 	const profilePath = resolveAgentProfileDir(cfg, agentId);
 	const adPath = resolveAgentDir(cfg, agentId);
@@ -236,29 +137,7 @@ async function finalizeCreateAgentDirs(cfg, agentId, opts) {
 	await mkdir(profilePath, { recursive: true });
 	await mkdir(adPath, { recursive: true });
 	const id = normalizeAgentId(agentId);
-	const displayName = opts?.profileFiles?.[WORKSPACE_FILES.IDENTITY] ? parseIdentityMarkdown(opts.profileFiles[WORKSPACE_FILES.IDENTITY]).name ?? id : id;
-	if (opts?.cloneFrom) {
-		const srcProfilePath = resolveAgentProfileDir(cfg, normalizeAgentId(opts.cloneFrom));
-		try {
-			if ((await stat(srcProfilePath)).isDirectory()) {
-				const srcFiles = await readdir(srcProfilePath);
-				for (const fileName of srcFiles) {
-					const srcFile = join(srcProfilePath, fileName);
-					const dstFile = join(profilePath, fileName);
-					try {
-						if ((await stat(srcFile)).isFile()) await cp(srcFile, dstFile);
-					} catch {}
-				}
-			}
-		} catch {
-			seedAgentProfileMarkdownFiles(profilePath, wsPath, { displayName });
-		}
-	} else seedAgentProfileMarkdownFiles(profilePath, wsPath, { displayName });
-	const profileFiles = opts?.profileFiles;
-	if (profileFiles && Object.keys(profileFiles).length > 0) for (const [name, content] of Object.entries(profileFiles)) {
-		const written = await writeAgentProfileFile(cfg, agentId, name, content);
-		if (written.ok === false) return written;
-	}
+	seedAgentProfileMarkdownFiles(profilePath, wsPath, { displayName: listAgentEntries(cfg).find((candidate) => normalizeAgentId(candidate.id) === id)?.profile?.name ?? id });
 	return {
 		ok: true,
 		data: void 0
@@ -266,23 +145,8 @@ async function finalizeCreateAgentDirs(cfg, agentId, opts) {
 }
 function prepareUpdateAgent(cfg, agentIdRaw, body) {
 	const agentId = normalizeAgentId(agentIdRaw);
-	let list = [...listAgentEntries(cfg)];
-	let idx = findAgentEntryIndex(list, agentId);
-	if (idx < 0 && agentId === resolveDefaultAgentId(cfg)) {
-		list = [...list, {
-			id: agentId,
-			enabled: true,
-			identity: {
-				name: agentId,
-				role: "Agent",
-				language: "en",
-				tone: "direct"
-			},
-			responsibilities: { primary: ["Help the user complete tasks"] },
-			workspace: { root: `~/.xopc/workspace/${agentId}` }
-		}];
-		idx = list.length - 1;
-	}
+	const list = [...listAgentEntries(cfg)];
+	const idx = findAgentEntryIndex(list, agentId);
 	if (idx < 0) return {
 		ok: false,
 		error: `agent "${agentId}" not found`,
@@ -290,78 +154,22 @@ function prepareUpdateAgent(cfg, agentIdRaw, body) {
 	};
 	const entry = { ...list[idx] };
 	if (body.workspace !== void 0) {
-		const w = body.workspace.trim();
-		if (w) entry.workspace = { root: resolveUserPath(w) };
-	}
-	if (body.extends !== void 0) {
-		const nextExtends = Array.from(new Set(body.extends.map((id) => normalizeAgentId(id)).filter(Boolean)));
-		for (const presetId of nextExtends) if (!cfg.agents.capabilityPresets[presetId]) return {
-			ok: false,
-			error: `capability preset "${presetId}" not found`,
-			status: 400
-		};
-		if (nextExtends.length > 0) entry.extends = nextExtends;
-		else delete entry.extends;
+		const workspace = body.workspace?.trim();
+		if (workspace) entry.workspace = resolveUserPath(workspace);
+		else delete entry.workspace;
 	}
+	if (body.profile !== void 0) if (body.profile === null) delete entry.profile;
+	else entry.profile = structuredClone(body.profile);
 	if (body.models !== void 0) if (body.models === null) delete entry.models;
-	else {
-		if (body.models.defaultRole !== void 0) {
-			if (body.models.defaultRole === null || !body.models.defaultRole.trim()) return {
-				ok: false,
-				error: "models.defaultRole must be a non-empty string",
-				status: 400
-			};
-			entry.models = {
-				defaultRole: body.models.defaultRole.trim(),
-				roles: entry.models?.roles ?? {},
-				...entry.models?.policy ? { policy: entry.models.policy } : {}
-			};
-		}
-		if (Object.hasOwn(body.models, "roles")) {
-			if (body.models.roles !== void 0) {
-				const roles = Object.fromEntries(Object.entries(body.models.roles).map(([id, row]) => ({
-					id: id.trim(),
-					model: row.model.trim(),
-					fallbacks: (row.fallbacks ?? []).map((ref) => ref.trim()).filter(Boolean),
-					description: row.description?.trim()
-				})).filter((row) => row.id && row.model).map((row) => [row.id, {
-					model: row.model,
-					...row.fallbacks.length > 0 ? { fallbacks: row.fallbacks } : {},
-					...row.description ? { description: row.description } : {}
-				}]));
-				entry.models = {
-					defaultRole: entry.models?.defaultRole ?? Object.keys(roles)[0] ?? "deep",
-					roles,
-					...entry.models?.policy ? { policy: entry.models.policy } : {}
-				};
-			}
-		}
-		const roles = entry.models?.roles ?? {};
-		const defaultRole = entry.models?.defaultRole ?? Object.keys(roles)[0];
-		if (!defaultRole || !roles[defaultRole]) return {
-			ok: false,
-			error: "models.defaultRole must reference models.roles",
-			status: 400
-		};
-		entry.models = {
-			...entry.models,
-			defaultRole
-		};
-	}
+	else entry.models = structuredClone(body.models);
 	if (body.skills !== void 0) if (body.skills === null) delete entry.skills;
-	else {
-		const next = body.skills.map((s) => String(s).trim()).filter(Boolean);
-		if (next.length === 0) entry.skills = {
-			mode: "allowlist",
-			allow: []
-		};
-		else entry.skills = {
-			mode: "allowlist",
-			allow: next
-		};
-	}
+	else entry.skills = structuredClone(body.skills);
 	if (body.tools !== void 0) if (body.tools === null) delete entry.tools;
 	else entry.tools = body.tools;
+	if (body.workflows !== void 0) if (body.workflows === null) delete entry.workflows;
+	else entry.workflows = structuredClone(body.workflows);
+	if (body.runtime !== void 0) if (body.runtime === null) delete entry.runtime;
+	else entry.runtime = structuredClone(body.runtime);
 	list[idx] = entry;
 	let next = {
 		...cfg,
@@ -672,4 +480,4 @@ async function deleteAgentAvatarFile(cfg, agentId) {
 	};
 }
 //#endregion
-export { deleteAgentAvatarFile, extractAvatarFromIdentityMarkdown, finalizeCreateAgentDirs, getGatewayAgentEffectiveManifest, listAgentProfileFiles, listGatewayAgents, parseIdentityMarkdown, prepareCreateAgent, prepareDeleteAgent, prepareUpdateAgent, readAgentAvatarFile, readAgentProfileFile, runAfterDeletePurge, writeAgentAvatarFromBase64, writeAgentProfileFile };
+export { deleteAgentAvatarFile, extractAvatarFromIdentityMarkdown, finalizeCreateAgentDirs, getGatewayAgentEffectiveConfig, listAgentProfileFiles, listGatewayAgents, parseIdentityMarkdown, prepareCreateAgent, prepareDeleteAgent, prepareUpdateAgent, readAgentAvatarFile, readAgentProfileFile, runAfterDeletePurge, writeAgentAvatarFromBase64, writeAgentProfileFile };

package/dist/src/gateway/device-routes.d.ts

@@ -0,0 +1,3 @@
+import type { Config } from '../config/schema.js';
+import type { DeviceRoute } from '../storage/sqlite/device-pairing-repository.js';
+export declare function resolveSecureDeviceRoutes(config: Config): DeviceRoute[];

package/dist/src/gateway/device-routes.js

@@ -0,0 +1,47 @@
+import { resolveReverseProxyPublicUrl } from "./public-url.js";
+import { getTailscaleExposureState } from "./tailscale-lifecycle.js";
+import { getTunnelService } from "../tunnel/tunnel-service.js";
+import crypto from "node:crypto";
+//#region src/gateway/device-routes.ts
+function secureUrl(value) {
+	if (!value) return null;
+	try {
+		const parsed = new URL(value);
+		if (parsed.protocol !== "https:" || parsed.username || parsed.password) return null;
+		return parsed.origin;
+	} catch {
+		return null;
+	}
+}
+function routeId(kind, url) {
+	return `${kind}-${crypto.createHash("sha256").update(url).digest("hex").slice(0, 12)}`;
+}
+function resolveSecureDeviceRoutes(config) {
+	const tunnelStatus = getTunnelService().getStatus();
+	const candidates = [{
+		kind: "custom-https",
+		url: secureUrl(resolveReverseProxyPublicUrl(config))
+	}, {
+		kind: "xopc-secure-link",
+		url: tunnelStatus.state === "connected" ? secureUrl(tunnelStatus.publicUrl) : null
+	}];
+	const tailscale = getTailscaleExposureState();
+	if (tailscale.active && tailscale.hostname) candidates.push({
+		kind: "tailscale",
+		url: secureUrl(`https://${tailscale.hostname}`)
+	});
+	const seen = /* @__PURE__ */ new Set();
+	const routes = [];
+	for (const candidate of candidates) {
+		if (!candidate.url || seen.has(candidate.url)) continue;
+		seen.add(candidate.url);
+		routes.push({
+			id: routeId(candidate.kind, candidate.url),
+			kind: candidate.kind,
+			url: candidate.url
+		});
+	}
+	return routes;
+}
+//#endregion
+export { resolveSecureDeviceRoutes };

package/dist/src/gateway/global-defaults-admin.d.ts

@@ -1,25 +1,12 @@
-import { type CapabilityPreset } from '../agent-manifest/schema.js';
+import { type AgentDefaults } from '../agent-config/index.js';
 import type { Config } from '../config/schema.js';
-export type GlobalDefaultsProviderSource = 'config' | 'env' | 'oauth' | 'extension' | 'models_json' | 'agent' | null;
-export type GlobalDefaultsProviderRow = {
-    id: string;
-    name: string;
-    configured: boolean;
-    source: GlobalDefaultsProviderSource;
-};
-export type GlobalDefaultsRecommendation = {
-    provider: string;
-    model: string;
-    reason: 'configured-provider' | 'recommended';
-};
+import { type GatewayBuiltinToolSummary } from './agent-builtin-tools.js';
 export type GlobalDefaultsPayload = {
-    presetId: string;
-    models: NonNullable<CapabilityPreset['models']>;
-    providers: GlobalDefaultsProviderRow[];
-    recommendations: GlobalDefaultsRecommendation[];
+    defaults: AgentDefaults;
+    builtinTools: GatewayBuiltinToolSummary[];
 };
 export type UpdateGlobalDefaultsBody = {
-    models?: CapabilityPreset['models'];
+    defaults: AgentDefaults;
 };
 export type GlobalDefaultsAdminResult<T> = {
     ok: true;
@@ -29,8 +16,7 @@ export type GlobalDefaultsAdminResult<T> = {
     error: string;
     status?: 400 | 404 | 500;
 };
-export declare function ensureGlobalDefaultsConfig(cfg: Config): Config;
-export declare function listGlobalDefaults(cfg: Config): Promise<GlobalDefaultsPayload>;
+export declare function listGlobalDefaults(cfg: Config): GlobalDefaultsPayload;
 export declare function prepareUpdateGlobalDefaults(cfg: Config, body: UpdateGlobalDefaultsBody): GlobalDefaultsAdminResult<{
     nextConfig: Config;
 }>;

package/dist/src/gateway/global-defaults-admin.js

@@ -1,134 +1,34 @@
-import { CapabilityPresetSchema, init_schema } from "../agent-manifest/schema.js";
-import { DEFAULT_AGENT_MODELS, init_default_model } from "../config/default-model.js";
-import { getAllProviders, getModelsByProvider, getProviderAuthState, getProviderDisplayName, init_providers } from "../providers/index.js";
-import { getRecommendedModelsForProvider } from "../providers/presentation.js";
+import { AgentDefaultsSchema } from "../agent-config/schema.js";
+import { init_agent_config } from "../agent-config/index.js";
+import { GATEWAY_BUILTIN_TOOLS } from "./agent-builtin-tools.js";
 //#region src/gateway/global-defaults-admin.ts
-init_schema();
-init_default_model();
-init_providers();
-function defaultPresetId(cfg) {
-	return cfg.agents.defaultPreset || "default";
-}
-function emptyGlobalDefaultsPreset(id) {
-	return {
-		id,
-		name: "Global defaults",
-		description: "Default capabilities inherited by every agent.",
-		version: 1,
-		models: DEFAULT_AGENT_MODELS
-	};
-}
-function ensureGlobalDefaultsConfig(cfg) {
-	const presetId = defaultPresetId(cfg);
-	const current = cfg.agents.capabilityPresets[presetId];
-	const preset = current ? {
-		...current,
-		id: presetId,
-		name: current.name || "Global defaults",
-		version: current.version || 1,
-		models: current.models ?? DEFAULT_AGENT_MODELS
-	} : emptyGlobalDefaultsPreset(presetId);
-	return {
-		...cfg,
-		agents: {
-			...cfg.agents,
-			defaultPreset: presetId,
-			capabilityPresets: {
-				...cfg.agents.capabilityPresets,
-				[presetId]: preset
-			}
-		}
-	};
-}
-function sourceFromAuthMode(authMode) {
-	if (authMode === "gateway") return "config";
-	if (authMode === "env") return "env";
-	if (authMode === "oauth") return "oauth";
-	if (authMode === "extension") return "extension";
-	if (authMode === "models_json") return "models_json";
-	if (authMode === "agent") return "agent";
-	return null;
-}
-function recommendedModelForProvider(provider) {
-	const recommended = getRecommendedModelsForProvider(provider, 1)[0];
-	if (recommended) return recommended.ref;
-	const model = getModelsByProvider(provider)[0];
-	return model ? `${provider}/${model.id}` : null;
-}
-async function listGlobalDefaults(cfg) {
-	const normalized = ensureGlobalDefaultsConfig(cfg);
-	const presetId = defaultPresetId(normalized);
-	const preset = normalized.agents.capabilityPresets[presetId] ?? emptyGlobalDefaultsPreset(presetId);
-	const providers = [];
-	const recommendations = [];
-	for (const provider of getAllProviders()) {
-		const auth = await getProviderAuthState(provider);
-		const configured = auth.authStatus === "connected";
-		const source = configured ? sourceFromAuthMode(auth.authMode) : null;
-		providers.push({
-			id: provider,
-			name: getProviderDisplayName(provider),
-			configured,
-			source
-		});
-		if (configured) {
-			const model = recommendedModelForProvider(provider);
-			if (model) recommendations.push({
-				provider,
-				model,
-				reason: "configured-provider"
-			});
-		}
-	}
-	providers.sort((a, b) => Number(b.configured) - Number(a.configured) || a.name.localeCompare(b.name));
+init_agent_config();
+function listGlobalDefaults(cfg) {
 	return {
-		presetId,
-		models: preset.models ?? DEFAULT_AGENT_MODELS,
-		providers,
-		recommendations
+		defaults: structuredClone(cfg.agents.defaults),
+		builtinTools: GATEWAY_BUILTIN_TOOLS.map((tool) => ({
+			id: tool.id,
+			description: { ...tool.description }
+		}))
 	};
 }
 function prepareUpdateGlobalDefaults(cfg, body) {
-	const normalized = ensureGlobalDefaultsConfig(cfg);
-	const presetId = defaultPresetId(normalized);
-	let nextPreset = normalized.agents.capabilityPresets[presetId] ?? emptyGlobalDefaultsPreset(presetId);
-	if (body.models !== void 0) {
-		const parsed = CapabilityPresetSchema.pick({ models: true }).safeParse({ models: body.models });
-		if (!parsed.success) return {
-			ok: false,
-			error: `models ${parsed.error.issues[0]?.message ?? "is invalid"}`,
-			status: 400
-		};
-		const models = parsed.data.models ?? DEFAULT_AGENT_MODELS;
-		const roles = models.roles ?? {};
-		const defaultRole = models.defaultRole ?? Object.keys(roles)[0] ?? "deep";
-		if (Object.keys(roles).length > 0 && !roles[defaultRole]) return {
-			ok: false,
-			error: "models.defaultRole must reference models.roles",
-			status: 400
-		};
-		nextPreset = {
-			...nextPreset,
-			models: {
-				...models,
-				defaultRole,
-				roles
-			}
-		};
-	}
+	const parsed = AgentDefaultsSchema.safeParse(body.defaults);
+	if (!parsed.success) return {
+		ok: false,
+		error: `defaults ${parsed.error.issues[0]?.message ?? "is invalid"}`,
+		status: 400
+	};
 	return {
 		ok: true,
 		data: { nextConfig: {
-			...normalized,
+			...cfg,
 			agents: {
-				...normalized.agents,
-				capabilityPresets: {
-					...normalized.agents.capabilityPresets,
-					[presetId]: nextPreset
-				}
+				...cfg.agents,
+				defaults: parsed.data
 			}
 		} }
 	};
 }
 //#endregion
-export { ensureGlobalDefaultsConfig, listGlobalDefaults, prepareUpdateGlobalDefaults };
+export { listGlobalDefaults, prepareUpdateGlobalDefaults };

package/dist/src/gateway/hono/app.js

@@ -9,12 +9,13 @@ import { isLoopbackIpAddress, isTrustedProxyAddress } from "../client-ip.js";
 import { buildGatewayConsoleCspHeader } from "../security/csp.js";
 import { checkBrowserOrigin } from "../security/origin-check.js";
 import { auth } from "./middleware/auth.js";
-import { operatorScopes } from "./middleware/scopes.js";
+import { gatewayScopes } from "./middleware/scopes.js";
 import { createChannelRateLimitMiddleware, createChatRateLimitMiddleware, createMediaRateLimitMiddleware, createStrictRateLimitMiddleware, createTaskRateLimitMiddleware, createXopcCloudPollRateLimitMiddleware } from "./middleware/strict-rate-limit.js";
 import { logContextMiddleware } from "./middleware/log-context.js";
 import { logger } from "./middleware/logger.js";
 import { routeErrorMiddleware } from "./middleware/route-errors.js";
 import { registerPublicExtensionAssetRoutes } from "./routes/auth-registry-extensions.js";
+import { registerDeviceAuthPublicRoutes } from "./routes/devices.js";
 import { registerPublicLocalAppPreviewRoutes } from "./routes/local-apps.js";
 import { resetLazyRouteBundlesForTests } from "./routes/lazy-fallback.js";
 import { registerAuthenticatedRoutes } from "./routes/index.js";
@@ -193,6 +194,7 @@ function createHonoApp(config) {
 		})(c, next);
 	});
 	registerPublicGatewayRoutes(app, service);
+	registerDeviceAuthPublicRoutes(app);
 	registerPublicExtensionAssetRoutes(app, service);
 	registerPublicLocalAppPreviewRoutes(app, service);
 	const authenticated = new Hono();
@@ -205,7 +207,7 @@ function createHonoApp(config) {
 			allowRealIpFallback: service.currentConfig.gateway?.allowRealIpFallback === true
 		})
 	}));
-	authenticated.use(operatorScopes());
+	authenticated.use(gatewayScopes());
 	const strictRateLimitMiddleware = createStrictRateLimitMiddleware({ getTrustedProxyContext: () => ({
 		trustedProxies: service.currentConfig.gateway?.trustedProxies,
 		allowRealIpFallback: service.currentConfig.gateway?.allowRealIpFallback === true