@xopcai/xopc 0.0.231 → 0.0.232

package/dist/src/gateway/hono/lib/config-payload.d.ts

@@ -29,165 +29,83 @@ export declare function buildSafeWebConfigPayload(service: GatewayService, optio
         defaultId: string;
         list: {
             id: string;
-            identity: {
-                name: string;
-                role: string;
-                language: string;
-                tone: string;
-                description?: string;
-                avatar?: string;
-            };
-            workspace: {
-                root: string;
-            };
+            workspace: string;
             models: {
-                defaultRole?: string;
-                roles?: Record<string, {
-                    model: string;
-                    fallbacks?: string[];
-                    description?: string;
-                }>;
-                imageModel?: {
+                chat?: {
                     primary: string;
-                    fallbacks?: string[];
-                    timeoutMs?: number;
-                    autoProviderFallback?: boolean;
+                    fallbacks: string[];
                 };
-                imageGenerationModel?: {
+                intents?: Partial<Record<"understanding" | "fast" | "reasoning" | "coding" | "review" | "vision", {
                     primary: string;
-                    fallbacks?: string[];
-                    timeoutMs?: number;
-                    autoProviderFallback?: boolean;
-                };
-                policy?: {
-                    allowFallbacks?: boolean;
-                    maxCostTier?: "low" | "high" | "medium";
+                    fallbacks: string[];
+                }>>;
+                imageUnderstanding?: {
+                    primary: string;
+                    fallbacks: string[];
                 };
-            };
-            tools: {
-                builtin?: Record<string, {
-                    mode: "allow" | "deny" | "confirm";
-                    scope?: "workspace" | "readonly" | "unrestricted";
-                    limits?: {
-                        maxCallsPerTurn?: number;
-                        timeoutMs?: number;
-                    };
-                }>;
-                mcp?: {
-                    servers?: Record<string, {
-                        mode: "allow" | "deny" | "confirm";
-                        scope?: "workspace" | "readonly" | "unrestricted";
-                        limits?: {
-                            maxCallsPerTurn?: number;
-                            timeoutMs?: number;
-                        };
-                    }>;
-                    tools?: Record<string, {
-                        mode: "allow" | "deny" | "confirm";
-                        scope?: "workspace" | "readonly" | "unrestricted";
-                        limits?: {
-                            maxCallsPerTurn?: number;
-                            timeoutMs?: number;
-                        };
-                    }>;
+                imageGeneration?: {
+                    primary: string;
+                    fallbacks: string[];
+                    autoProviderFallback: boolean;
+                    timeoutMs?: number;
                 };
             };
+            tools: Record<string, {
+                mode: "allow" | "deny" | "ask";
+                maxCallsPerTurn?: number;
+                timeoutMs?: number;
+            }>;
             skills: {
-                mode: "off" | "all" | "allowlist" | "denylist";
-                allow?: string[];
-                deny?: string[];
+                mode: "merge";
+                add: string[];
+                remove: string[];
+            } | {
+                mode: "replace";
+                include: string[];
             };
             workflows: {
                 default?: string;
                 allowed?: string[];
-                suggested?: {
-                    intent: string;
-                    workflow: string;
-                }[];
-            };
-            boundaries: {
-                requiresConfirmation?: string[];
-                forbidden?: string[];
-                escalation?: string[];
             };
         }[];
-        capabilityPresets: Record<string, {
-            id: string;
-            name: string;
-            version: number;
-            description?: string;
-            extends?: string[];
-            models?: {
-                defaultRole?: string;
-                roles?: Record<string, {
-                    model: string;
-                    fallbacks?: string[];
-                    description?: string;
-                }>;
-                imageModel?: {
+        defaults: {
+            models: {
+                chat: {
                     primary: string;
-                    fallbacks?: string[];
-                    timeoutMs?: number;
-                    autoProviderFallback?: boolean;
+                    fallbacks: string[];
                 };
-                imageGenerationModel?: {
+                intents: Partial<Record<"understanding" | "fast" | "reasoning" | "coding" | "review" | "vision", {
                     primary: string;
-                    fallbacks?: string[];
-                    timeoutMs?: number;
-                    autoProviderFallback?: boolean;
-                };
-                policy?: {
-                    allowFallbacks?: boolean;
-                    maxCostTier?: "low" | "high" | "medium";
+                    fallbacks: string[];
+                }>>;
+                imageUnderstanding?: {
+                    primary: string;
+                    fallbacks: string[];
                 };
-            };
-            tools?: {
-                builtin?: Record<string, {
-                    mode: "allow" | "deny" | "confirm";
-                    scope?: "workspace" | "readonly" | "unrestricted";
-                    limits?: {
-                        maxCallsPerTurn?: number;
-                        timeoutMs?: number;
-                    };
-                }>;
-                mcp?: {
-                    servers?: Record<string, {
-                        mode: "allow" | "deny" | "confirm";
-                        scope?: "workspace" | "readonly" | "unrestricted";
-                        limits?: {
-                            maxCallsPerTurn?: number;
-                            timeoutMs?: number;
-                        };
-                    }>;
-                    tools?: Record<string, {
-                        mode: "allow" | "deny" | "confirm";
-                        scope?: "workspace" | "readonly" | "unrestricted";
-                        limits?: {
-                            maxCallsPerTurn?: number;
-                            timeoutMs?: number;
-                        };
-                    }>;
+                imageGeneration?: {
+                    primary: string;
+                    fallbacks: string[];
+                    autoProviderFallback: boolean;
+                    timeoutMs?: number;
                 };
             };
-            skills?: {
-                mode: "off" | "all" | "allowlist" | "denylist";
-                allow?: string[];
-                deny?: string[];
+            skills: {
+                mode: "all-enabled";
+                exclude: string[];
+            } | {
+                mode: "selected";
+                include: string[];
             };
-            workflows?: {
+            tools: Record<string, {
+                mode: "allow" | "deny" | "ask";
+                maxCallsPerTurn?: number;
+                timeoutMs?: number;
+            }>;
+            workflows: {
                 default?: string;
                 allowed?: string[];
-                suggested?: {
-                    intent: string;
-                    workflow: string;
-                }[];
-            };
-            boundaries?: {
-                requiresConfirmation?: string[];
-                forbidden?: string[];
-                escalation?: string[];
             };
-            runtime?: {
+            runtime: {
                 maxTurns?: number;
                 timeoutMs?: number;
                 maxToolFailuresPerTurn?: number;
@@ -196,8 +114,7 @@ export declare function buildSafeWebConfigPayload(service: GatewayService, optio
                     lifetime: "short" | "long";
                 };
             };
-            locks?: string[];
-        }>;
+        };
     };
     channels: {
         [k: string]: {

package/dist/src/gateway/hono/lib/config-payload.js

@@ -113,15 +113,13 @@ async function buildSafeWebConfigPayload(service, options = {}) {
 			defaultId: resolveDefaultAgentId(config),
 			list: listAgentEntries(config).filter((e) => e.enabled !== false).map((e) => ({
 				id: normalizeAgentId(e.id),
-				identity: e.identity,
 				workspace: e.workspace,
 				models: e.models,
 				tools: e.tools,
 				skills: e.skills,
-				workflows: e.workflows,
-				boundaries: e.boundaries
+				workflows: e.workflows
 			})),
-			capabilityPresets: config.agents?.capabilityPresets ?? {}
+			defaults: config.agents.defaults
 		},
 		channels: channelsPayload,
 		providers: Object.fromEntries(await Promise.all(getAllProviders().map(async (provider) => [provider, await maskLlmProviderApiKeyForWeb(provider)]))),

package/dist/src/gateway/hono/middleware/auth.js

@@ -1,6 +1,7 @@
 import { logAuthEvent } from "../../../utils/logger/audit.js";
 import { createLogger } from "../../../utils/logger/index.js";
 import { init_logger } from "../../../utils/logger.js";
+import { authenticateDeviceAccessToken } from "../../../storage/sqlite/device-access-repository.js";
 import { safeEqualSecret } from "../../security/secret-equal.js";
 import { resolveClientIpFromRequest } from "../../client-ip.js";
 import { authPolicyConfig, buckets, resolveAuthRateLimit } from "../../rate-limit/buckets.js";
@@ -9,6 +10,7 @@ import { resolveAuthTracking } from "../../rate-limit/auth-policy.js";
 import { isAuthRateLimitGloballyDisabled } from "../../rate-limit/env-flags.js";
 import "../../rate-limit/index.js";
 import { authorizeTrustedProxy } from "../../trusted-proxy.js";
+import { setGatewayPrincipal } from "../../security/gateway-principal.js";
 import { createMiddleware } from "hono/factory";
 import { getConnInfo } from "@hono/node-server/conninfo";
 //#region src/gateway/hono/middleware/auth.ts
@@ -165,10 +167,22 @@ function auth(config) {
 				}, 401);
 			}
 			recordSuccess(rl);
+			setGatewayPrincipal(c, {
+				kind: "trusted-proxy",
+				principalId: result.user,
+				scopes: ["gateway.admin"]
+			});
 			await next();
 			return;
 		}
-		if (authMode === "none") return next();
+		if (authMode === "none") {
+			setGatewayPrincipal(c, {
+				kind: "owner",
+				principalId: "gateway-owner",
+				scopes: ["gateway.admin"]
+			});
+			return next();
+		}
 		const expectedCredential = resolveExpectedCredential(resolvedAuth);
 		if (!expectedCredential) {
 			log.error({
@@ -196,6 +210,24 @@ function auth(config) {
 		const providedCredential = authHeader || queryToken;
 		if (providedCredential && validateCredential(providedCredential, expectedCredential)) {
 			recordSuccess(rl);
+			setGatewayPrincipal(c, {
+				kind: "owner",
+				principalId: "gateway-owner",
+				scopes: ["gateway.admin"]
+			});
+			await next();
+			return;
+		}
+		const deviceIdentity = providedCredential?.startsWith("xopc_at_") ? authenticateDeviceAccessToken(providedCredential) : void 0;
+		if (deviceIdentity) {
+			recordSuccess(rl);
+			setGatewayPrincipal(c, {
+				kind: "device",
+				principalId: deviceIdentity.deviceId,
+				deviceId: deviceIdentity.deviceId,
+				accessSessionId: deviceIdentity.accessSessionId,
+				scopes: deviceIdentity.scopes
+			});
 			await next();
 			return;
 		}

package/dist/src/gateway/hono/middleware/scopes.d.ts

@@ -1,15 +1,5 @@
-/**
- * Middleware that enforces operator scope requirements on API routes.
- *
- * This middleware runs AFTER the auth middleware. For authenticated requests,
- * it checks that the declared operator scopes (defaulting to full access for
- * token-authenticated users) satisfy the minimum scope required by the route.
- *
- * The scope system is currently implicit: all authenticated users get
- * DEFAULT_OPERATOR_SCOPES. This lays the groundwork for future per-device
- * or per-token scope restrictions (similar to OpenClaw's device pairing scopes).
- */
-export declare function operatorScopes(): import("hono/dist/types/types.js").MiddlewareHandler<any, string, {}, Response & import("hono/dist/types/types.js").TypedResponse<{
+/** Enforces fail-closed route scopes after authentication establishes a principal. */
+export declare function gatewayScopes(): import("hono/dist/types/types.js").MiddlewareHandler<any, string, {}, Response & import("hono/dist/types/types.js").TypedResponse<{
     error: string;
     message: string;
 }, 403, "json">>;

package/dist/src/gateway/hono/middleware/scopes.js

@@ -1,30 +1,21 @@
 import { createLogger } from "../../../utils/logger/index.js";
 import { init_logger } from "../../../utils/logger.js";
-import { DEFAULT_OPERATOR_SCOPES, authorizeRouteScope } from "../../security/operator-scopes.js";
+import { hasGatewayScope, requiredGatewayScope } from "../../security/gateway-scopes.js";
+import { getGatewayPrincipal } from "../../security/gateway-principal.js";
 import { createMiddleware } from "hono/factory";
 //#region src/gateway/hono/middleware/scopes.ts
 init_logger();
 const log = createLogger("Hono:Scopes");
-/**
-* Middleware that enforces operator scope requirements on API routes.
-*
-* This middleware runs AFTER the auth middleware. For authenticated requests,
-* it checks that the declared operator scopes (defaulting to full access for
-* token-authenticated users) satisfy the minimum scope required by the route.
-*
-* The scope system is currently implicit: all authenticated users get
-* DEFAULT_OPERATOR_SCOPES. This lays the groundwork for future per-device
-* or per-token scope restrictions (similar to OpenClaw's device pairing scopes).
-*/
-function operatorScopes() {
+/** Enforces fail-closed route scopes after authentication establishes a principal. */
+function gatewayScopes() {
 	return createMiddleware(async (c, next) => {
-		const grantedScopes = [...DEFAULT_OPERATOR_SCOPES];
-		const scopeCheck = authorizeRouteScope(c.req.path, grantedScopes);
-		if (!scopeCheck.allowed && "requiredScope" in scopeCheck) {
-			const { requiredScope } = scopeCheck;
+		const principal = getGatewayPrincipal(c);
+		const requiredScope = requiredGatewayScope(c.req.method, c.req.path);
+		if (!hasGatewayScope(principal.scopes, requiredScope)) {
 			log.warn({
 				path: c.req.path,
 				method: c.req.method,
+				principalId: principal.principalId,
 				requiredScope
 			}, `Scope check failed: missing ${requiredScope}`);
 			return c.json({
@@ -36,4 +27,4 @@ function operatorScopes() {
 	});
 }
 //#endregion
-export { operatorScopes };
+export { gatewayScopes };

package/dist/src/gateway/hono/routes/agents.js

@@ -1,83 +1,40 @@
-import { ToolPolicySetSchema, init_schema } from "../../../agent-manifest/schema.js";
-import { AgentModelsSchema, init_schema as init_schema$1 } from "../../../config/schema.js";
+import { AgentModelsOverrideSchema, AgentProfileSchema, RuntimePolicySchema, SkillOverrideSchema, ToolPoliciesSchema, WorkflowPolicySchema } from "../../../agent-config/schema.js";
+import { init_agent_config } from "../../../agent-config/index.js";
 import { init_agent_scope, normalizeAgentId } from "../../../agent/agent-scope.js";
-import { deleteAgentAvatarFile, finalizeCreateAgentDirs, getGatewayAgentEffectiveManifest, listAgentProfileFiles, listGatewayAgents, prepareCreateAgent, prepareDeleteAgent, prepareUpdateAgent, readAgentAvatarFile, readAgentProfileFile, runAfterDeletePurge, writeAgentAvatarFromBase64, writeAgentProfileFile } from "../../agents-admin.js";
+import { deleteAgentAvatarFile, finalizeCreateAgentDirs, getGatewayAgentEffectiveConfig, listAgentProfileFiles, listGatewayAgents, prepareCreateAgent, prepareDeleteAgent, prepareUpdateAgent, readAgentAvatarFile, readAgentProfileFile, runAfterDeletePurge, writeAgentAvatarFromBase64, writeAgentProfileFile } from "../../agents-admin.js";
 import { getVoiceModelsConfig } from "../../../config/voice.js";
 //#region src/gateway/hono/routes/agents.ts
-init_schema$1();
-init_schema();
+init_agent_config();
 init_agent_scope();
-function parseProfileFiles(raw) {
-	if (raw === void 0) return;
-	if (raw === null || typeof raw !== "object" || Array.isArray(raw)) return { error: "profileFiles must be an object" };
-	const profileFiles = {};
-	for (const [name, content] of Object.entries(raw)) {
-		if (typeof content !== "string") return { error: `profileFiles["${name}"] must be a string` };
-		profileFiles[name] = content;
-	}
-	return profileFiles;
-}
 function isParseError(value) {
 	return typeof value === "object" && value !== null && "error" in value && typeof value.error === "string";
 }
 function parseCreateAgentBody(raw) {
 	if (raw === null || typeof raw !== "object" || Array.isArray(raw)) return { error: "each agent must be an object" };
 	const body = raw;
-	if (Object.hasOwn(body, "model")) return { error: "model is not supported; use models.defaultRole and models.roles" };
-	if (Object.hasOwn(body, "toolsDisable")) return { error: "toolsDisable was removed; use tools.builtin policies" };
-	if (Object.hasOwn(body, "typedModels")) return { error: "typedModels is not supported; use models.roles" };
-	if (Object.hasOwn(body, "agentDir")) return { error: "agentDir was removed from agent manifests" };
-	if (Object.hasOwn(body, "name")) return { error: "name is not supported; write IDENTITY.md in profileFiles" };
-	if (Object.hasOwn(body, "description")) return { error: "description is not supported; write IDENTITY.md in profileFiles" };
-	const workspace = typeof body.workspace === "string" ? body.workspace : "";
-	const models = Object.hasOwn(body, "models") ? AgentModelsSchema.safeParse(body.models) : void 0;
-	if (models && !models.success) return { error: `models ${models.error.issues[0]?.message ?? "is invalid"}` };
+	const allowedKeys = new Set([
+		"id",
+		"workspace",
+		"profile"
+	]);
+	const unknownKey = Object.keys(body).find((key) => !allowedKeys.has(key));
+	if (unknownKey) return { error: `unknown create-agent field "${unknownKey}"` };
+	const workspace = typeof body.workspace === "string" ? body.workspace : void 0;
+	const profile = AgentProfileSchema.safeParse(body.profile);
+	if (!profile.success) return { error: `profile ${profile.error.issues[0]?.message ?? "is required"}` };
 	const id = typeof body.id === "string" ? body.id : void 0;
-	const presetIds = Object.hasOwn(body, "extends") ? Array.isArray(body.extends) ? body.extends.map((x) => normalizeAgentId(String(x))).filter(Boolean) : null : void 0;
-	if (presetIds === null) return { error: "extends must be an array" };
-	const skills = Object.hasOwn(body, "skills") ? Array.isArray(body.skills) ? body.skills.map((x) => String(x).trim()).filter(Boolean) : null : void 0;
-	if (skills === null) return { error: "skills must be an array" };
-	const toolsRaw = Object.hasOwn(body, "tools") ? body.tools : void 0;
-	let tools;
-	if (toolsRaw !== void 0) {
-		if (toolsRaw === null || typeof toolsRaw !== "object" || Array.isArray(toolsRaw)) return { error: "tools must be an object" };
-		const parsedTools = ToolPolicySetSchema.safeParse(toolsRaw);
-		if (!parsedTools.success) return { error: `tools ${parsedTools.error.issues[0]?.message ?? "is invalid"}` };
-		tools = parsedTools.data;
-	}
-	let profileFiles;
-	if (Object.hasOwn(body, "profileFiles")) {
-		const parsed = parseProfileFiles(body.profileFiles);
-		if (isParseError(parsed)) return parsed;
-		profileFiles = parsed;
-	}
-	if (!profileFiles?.["IDENTITY.md"] && typeof body.cloneFrom !== "string") return { error: "profileFiles.IDENTITY.md is required" };
-	const cloneFrom = typeof body.cloneFrom === "string" ? body.cloneFrom : void 0;
 	return {
 		workspace,
-		...models && models.data !== void 0 ? { models: models.data } : {},
-		...id !== void 0 ? { id } : {},
-		...presetIds !== void 0 ? { extends: presetIds } : {},
-		...skills !== void 0 ? { skills } : {},
-		...tools !== void 0 ? { tools } : {},
-		...profileFiles !== void 0 ? { profileFiles } : {},
-		...cloneFrom !== void 0 ? { cloneFrom } : {}
+		profile: profile.data,
+		...id !== void 0 ? { id } : {}
 	};
 }
 function parsePatchModels(raw) {
 	if (raw === void 0) return;
 	if (raw === null) return null;
 	if (typeof raw !== "object" || Array.isArray(raw)) return { error: "models must be an object or null" };
-	const body = raw;
-	const out = {};
-	if (Object.hasOwn(body, "defaultRole")) out.defaultRole = body.defaultRole === null ? null : String(body.defaultRole ?? "").trim();
-	if (Object.hasOwn(body, "roles")) if (body.roles === null) return { error: "models.roles must be an object" };
-	else {
-		const parsed = AgentModelsSchema.safeParse({ roles: body.roles });
-		if (!parsed.success) return { error: `models.roles ${parsed.error.issues[0]?.message ?? "is invalid"}` };
-		out.roles = parsed.data?.roles;
-	}
-	return out;
+	const parsed = AgentModelsOverrideSchema.safeParse(raw);
+	return parsed.success ? parsed.data : { error: `models ${parsed.error.issues[0]?.message ?? "is invalid"}` };
 }
 function registerAgentsRoutes(authenticated, deps) {
 	const { service, strictRateLimitMiddleware } = deps;
@@ -115,10 +72,7 @@ function registerAgentsRoutes(authenticated, deps) {
 			ok: false,
 			error: { message: save.error ?? "save failed" }
 		}, 500);
-		const finalized = await finalizeCreateAgentDirs(service.currentConfig, agentId, {
-			...parsed.profileFiles !== void 0 ? { profileFiles: parsed.profileFiles } : {},
-			...parsed.cloneFrom ? { cloneFrom: parsed.cloneFrom } : {}
-		});
+		const finalized = await finalizeCreateAgentDirs(service.currentConfig, agentId);
 		if (finalized.ok === false) return c.json({
 			ok: false,
 			error: { message: finalized.error }
@@ -133,9 +87,9 @@ function registerAgentsRoutes(authenticated, deps) {
 			}
 		});
 	});
-	authenticated.get("/api/agents/:id/effective-manifest", async (c) => {
+	authenticated.get("/api/agents/:id/effective-config", async (c) => {
 		const id = normalizeAgentId(c.req.param("id") ?? "");
-		const res = getGatewayAgentEffectiveManifest(service.currentConfig, id);
+		const res = getGatewayAgentEffectiveConfig(service.currentConfig, id);
 		if (res.ok === false) return c.json({
 			ok: false,
 			error: { message: res.error }
@@ -156,40 +110,30 @@ function registerAgentsRoutes(authenticated, deps) {
 				error: { message: "Invalid JSON" }
 			}, 400);
 		}
-		if (Object.hasOwn(body, "model")) return c.json({
-			ok: false,
-			error: { message: "model is not supported; use models.defaultRole and models.roles" }
-		}, 400);
-		if (Object.hasOwn(body, "typedModels")) return c.json({
-			ok: false,
-			error: { message: "typedModels is not supported; use models.roles" }
-		}, 400);
-		if (Object.hasOwn(body, "toolsDisable")) return c.json({
-			ok: false,
-			error: { message: "toolsDisable was removed; use tools.builtin policies" }
-		}, 400);
-		if (Object.hasOwn(body, "agentDir")) return c.json({
+		const allowedPatchKeys = new Set([
+			"workspace",
+			"profile",
+			"models",
+			"skills",
+			"tools",
+			"workflows",
+			"runtime",
+			"setDefault"
+		]);
+		const unknownPatchKey = Object.keys(body).find((key) => !allowedPatchKeys.has(key));
+		if (unknownPatchKey) return c.json({
 			ok: false,
-			error: { message: "agentDir was removed from agent manifests" }
+			error: { message: `unknown agent field "${unknownPatchKey}"` }
 		}, 400);
-		if (Object.hasOwn(body, "name")) return c.json({
+		const skillsPatch = body.skills === null ? null : Object.hasOwn(body, "skills") ? SkillOverrideSchema.safeParse(body.skills) : void 0;
+		if (skillsPatch && skillsPatch !== null && !skillsPatch.success) return c.json({
 			ok: false,
-			error: { message: "name is not supported; edit IDENTITY.md" }
-		}, 400);
-		if (Object.hasOwn(body, "description")) return c.json({
-			ok: false,
-			error: { message: "description is not supported; edit IDENTITY.md" }
-		}, 400);
-		const skillsPatch = body.skills === null ? null : Array.isArray(body.skills) ? body.skills.map((x) => String(x).trim()).filter(Boolean) : void 0;
-		const extendsPatch = Object.hasOwn(body, "extends") ? Array.isArray(body.extends) ? body.extends.map((x) => String(x).trim()).filter(Boolean) : void 0 : void 0;
-		if (Object.hasOwn(body, "extends") && extendsPatch === void 0) return c.json({
-			ok: false,
-			error: { message: "extends must be an array" }
+			error: { message: `skills ${skillsPatch.error.issues[0]?.message ?? "is invalid"}` }
 		}, 400);
 		let toolsPatch;
 		if (Object.hasOwn(body, "tools")) if (body.tools === null) toolsPatch = null;
 		else if (typeof body.tools === "object" && !Array.isArray(body.tools)) {
-			const parsedTools = ToolPolicySetSchema.safeParse(body.tools);
+			const parsedTools = ToolPoliciesSchema.safeParse(body.tools);
 			if (!parsedTools.success) return c.json({
 				ok: false,
 				error: { message: `tools ${parsedTools.error.issues[0]?.message ?? "is invalid"}` }
@@ -204,17 +148,37 @@ function registerAgentsRoutes(authenticated, deps) {
 			ok: false,
 			error: { message: modelsPatch.error }
 		}, 400);
-		if (Object.hasOwn(body, "memory")) return c.json({
+		const profilePatch = body.profile === null ? null : Object.hasOwn(body, "profile") ? AgentProfileSchema.safeParse(body.profile) : void 0;
+		if (profilePatch && profilePatch !== null && !profilePatch.success) return c.json({
+			ok: false,
+			error: { message: `profile ${profilePatch.error.issues[0]?.message ?? "is invalid"}` }
+		}, 400);
+		const workflowsPatch = body.workflows === null ? null : Object.hasOwn(body, "workflows") ? WorkflowPolicySchema.safeParse(body.workflows) : void 0;
+		if (workflowsPatch && workflowsPatch !== null && !workflowsPatch.success) return c.json({
+			ok: false,
+			error: { message: `workflows ${workflowsPatch.error.issues[0]?.message ?? "is invalid"}` }
+		}, 400);
+		const runtimePatch = body.runtime === null ? null : Object.hasOwn(body, "runtime") ? RuntimePolicySchema.safeParse(body.runtime) : void 0;
+		if (runtimePatch && runtimePatch !== null && !runtimePatch.success) return c.json({
+			ok: false,
+			error: { message: `runtime ${runtimePatch.error.issues[0]?.message ?? "is invalid"}` }
+		}, 400);
+		let workspacePatch;
+		if (Object.hasOwn(body, "workspace")) if (body.workspace === null) workspacePatch = null;
+		else if (typeof body.workspace === "string") workspacePatch = body.workspace;
+		else return c.json({
 			ok: false,
-			error: { message: "Agent memory configuration is not supported; use userContext" }
+			error: { message: "workspace must be a string or null" }
 		}, 400);
 		const prep = prepareUpdateAgent(service.currentConfig, id, {
-			workspace: typeof body.workspace === "string" ? body.workspace : void 0,
-			...extendsPatch !== void 0 ? { extends: extendsPatch } : {},
+			...workspacePatch !== void 0 ? { workspace: workspacePatch } : {},
+			...profilePatch !== void 0 ? { profile: profilePatch === null ? null : profilePatch.data } : {},
 			...modelsPatch !== void 0 ? { models: modelsPatch } : {},
 			setDefault: body.setDefault === true,
-			...skillsPatch !== void 0 ? { skills: skillsPatch } : {},
-			...toolsPatch !== void 0 ? { tools: toolsPatch } : {}
+			...skillsPatch !== void 0 ? { skills: skillsPatch === null ? null : skillsPatch.data } : {},
+			...toolsPatch !== void 0 ? { tools: toolsPatch } : {},
+			...workflowsPatch !== void 0 ? { workflows: workflowsPatch === null ? null : workflowsPatch.data } : {},
+			...runtimePatch !== void 0 ? { runtime: runtimePatch === null ? null : runtimePatch.data } : {}
 		});
 		if (prep.ok === false) return c.json({
 			ok: false,

package/dist/src/gateway/hono/routes/connectors.js

@@ -514,7 +514,7 @@ function registerConnectorRoutes(authenticated, deps) {
 			const policy = getComposioInstallationPolicy(config, c.req.param("toolkit"));
 			const agents = config.agents.list.filter((agent) => agent.enabled).map((agent) => ({
 				id: agent.id,
-				name: agent.identity?.name ?? agent.id
+				name: agent.id
 			}));
 			return c.json({
 				ok: true,

package/dist/src/gateway/hono/routes/device-push.d.ts

@@ -0,0 +1,2 @@
+import type { Hono } from 'hono';
+export declare function registerDevicePushRoutes(authenticated: Hono): void;