@xopcai/xopc 0.0.235 → 0.0.238

package/dist/src/gateway/hono/routes/execution-environments.js

@@ -0,0 +1,136 @@
+import { ExecutionEnvironmentStore } from "../../../execution-environments/store.js";
+import { LocalWorktreeManager } from "../../../execution-environments/local-worktree-manager.js";
+import { SessionEnvironmentService } from "../../../execution-environments/session-environment-service.js";
+//#region src/gateway/hono/routes/execution-environments.ts
+function executionMode(value) {
+	return value === "local_checkout" || value === "managed_worktree" ? value : void 0;
+}
+function errorResponse(error) {
+	return {
+		ok: false,
+		error: error instanceof Error ? error.message : String(error)
+	};
+}
+function registerExecutionEnvironmentRoutes(authenticated, deps) {
+	const store = new ExecutionEnvironmentStore();
+	const worktrees = new LocalWorktreeManager({ store });
+	const sessions = new SessionEnvironmentService({
+		store,
+		worktrees
+	});
+	authenticated.get("/api/projects/:projectId/environments", (c) => {
+		const projectId = c.req.param("projectId");
+		if (!deps.service.projects.get(projectId)) return c.json({
+			ok: false,
+			error: "Project not found"
+		}, 404);
+		return c.json({
+			ok: true,
+			environments: store.list({
+				projectId,
+				includeDeleted: c.req.query("includeDeleted") === "true"
+			})
+		});
+	});
+	authenticated.get("/api/sessions/:sessionKey/environment", (c) => {
+		const environment = sessions.get(c.req.param("sessionKey"));
+		return environment ? c.json({
+			ok: true,
+			environment
+		}) : c.json({
+			ok: false,
+			error: "Execution environment not found"
+		}, 404);
+	});
+	authenticated.post("/api/sessions/:sessionKey/environment", async (c) => {
+		const sessionKey = c.req.param("sessionKey");
+		if (deps.service.getActiveWebchatRunId(sessionKey)) return c.json({
+			ok: false,
+			error: "Stop the active session run before changing its environment"
+		}, 409);
+		const session = await deps.service.sessions.getSession(sessionKey);
+		if (!session) return c.json({
+			ok: false,
+			error: "Session not found"
+		}, 404);
+		const projectId = session.projectId?.trim();
+		const project = projectId ? deps.service.projects.get(projectId) : null;
+		if (!project) return c.json({
+			ok: false,
+			error: "Session is not attached to a project"
+		}, 409);
+		const body = await c.req.json().catch(() => ({}));
+		const mode = body.mode === void 0 ? void 0 : executionMode(body.mode);
+		if (body.mode !== void 0 && !mode) return c.json({
+			ok: false,
+			error: "Invalid execution mode"
+		}, 400);
+		try {
+			const environment = await sessions.attach({
+				sessionKey,
+				project,
+				mode,
+				baseRef: typeof body.baseRef === "string" ? body.baseRef : void 0
+			});
+			return c.json({
+				ok: true,
+				environment
+			}, 201);
+		} catch (error) {
+			return c.json(errorResponse(error), 409);
+		}
+	});
+	authenticated.delete("/api/sessions/:sessionKey/environment", async (c) => {
+		const sessionKey = c.req.param("sessionKey");
+		if (deps.service.getActiveWebchatRunId(sessionKey)) return c.json({
+			ok: false,
+			error: "Stop the active session run before releasing its environment"
+		}, 409);
+		try {
+			const environment = await sessions.release(sessionKey, c.req.query("keepManaged") !== "true");
+			return c.json({
+				ok: true,
+				environment
+			});
+		} catch (error) {
+			return c.json(errorResponse(error), 409);
+		}
+	});
+	authenticated.get("/api/execution-environments/:environmentId", async (c) => {
+		const environment = store.get(c.req.param("environmentId"));
+		if (!environment) return c.json({
+			ok: false,
+			error: "Execution environment not found"
+		}, 404);
+		const inspection = environment.kind === "managed_worktree" ? await worktrees.inspect(environment.id).catch(() => void 0) : void 0;
+		return c.json({
+			ok: true,
+			environment,
+			...inspection ? { inspection } : {}
+		});
+	});
+	authenticated.post("/api/execution-environments/:environmentId/reconcile", async (c) => {
+		try {
+			const environment = await worktrees.reconcile(c.req.param("environmentId"));
+			return c.json({
+				ok: true,
+				environment
+			});
+		} catch (error) {
+			return c.json(errorResponse(error), 409);
+		}
+	});
+	authenticated.delete("/api/execution-environments/:environmentId", async (c) => {
+		try {
+			const environment = await worktrees.remove(c.req.param("environmentId"));
+			return c.json({
+				ok: true,
+				environment
+			});
+		} catch (error) {
+			return c.json(errorResponse(error), 409);
+		}
+	});
+}
+//#endregion
+export { registerExecutionEnvironmentRoutes };

package/dist/src/gateway/hono/routes/index.js

@@ -2,6 +2,7 @@ import { registerActivityRoutes } from "./activity.js";
 import { registerAgentStreamRoutes } from "./agent-stream.js";
 import { registerDiscussionRoutes } from "./discussions.js";
 import { registerSessionsRoutes } from "./sessions.js";
+import { registerExecutionEnvironmentRoutes } from "./execution-environments.js";
 import { registerSideChatRoutes } from "./side-chats.js";
 import { registerStatusRoutes } from "./status.js";
 import { registerProjectsRoutes } from "./projects.js";
@@ -19,12 +20,15 @@ import { registerWorkDiscoveryRoutes } from "./work-discovery.js";
 import { registerUnderstandingSourceRoutes } from "./understanding-sources.js";
 import { registerTaskRoutes } from "./tasks.js";
 import { registerProactiveRoutes } from "./proactive.js";
+import { registerMobilePrivacyRoutes } from "./mobile-privacy.js";
 import { mountAppLazyRoutePrefixes, registerAuthenticatedLazyRouteFallback } from "./lazy-fallback.js";
 //#region src/gateway/hono/routes/index.ts
 function registerCoreAuthenticatedRoutes(authenticated, deps) {
 	registerStatusRoutes(authenticated, deps);
+	registerMobilePrivacyRoutes(authenticated, deps);
 	registerAgentStreamRoutes(authenticated, deps);
 	registerSessionsRoutes(authenticated, deps);
+	registerExecutionEnvironmentRoutes(authenticated, deps);
 	registerSideChatRoutes(authenticated, deps);
 	registerActivityRoutes(authenticated, deps);
 	registerDiscussionRoutes(authenticated, deps);

package/dist/src/gateway/hono/routes/mobile-privacy.d.ts

@@ -0,0 +1,3 @@
+import type { Hono } from 'hono';
+import type { AuthenticatedRouteDeps } from './deps.js';
+export declare function registerMobilePrivacyRoutes(authenticated: Hono, { service }: AuthenticatedRouteDeps): void;

package/dist/src/gateway/hono/routes/mobile-privacy.js

@@ -0,0 +1,13 @@
+//#region src/gateway/hono/routes/mobile-privacy.ts
+function registerMobilePrivacyRoutes(authenticated, { service }) {
+	authenticated.get("/api/mobile/privacy", async (c) => {
+		c.header("Cache-Control", "no-store");
+		const { getMobilePrivacyDisclosure } = await import("../../mobile-privacy.js");
+		return c.json({
+			ok: true,
+			payload: await getMobilePrivacyDisclosure(service.currentConfig)
+		});
+	});
+}
+//#endregion
+export { registerMobilePrivacyRoutes };

package/dist/src/gateway/hono/routes/models.js

@@ -1,5 +1,5 @@
-import { init_resolve_config_value, testApiKeyResolution } from "../../../config/resolve-config-value.js";
 import { resolveModelsJsonPath } from "../../../config/paths.js";
+import { init_resolve_config_value, testApiKeyResolution } from "../../../config/resolve-config-value.js";
 import { init_models_json, loadModelsJson, saveModelsJson, validateModelsConfig } from "../../../config/models-json.js";
 import { getModelCatalogStore, init_model_catalog_store } from "../../../providers/model-catalog-store.js";
 import { getModelRegistry } from "../../../providers/model-registry.js";
@@ -11,6 +11,7 @@ import { buildCapabilityPlansForConfig } from "../../../capabilities/readiness/f
 import "../../../capabilities/readiness/index.js";
 import { getImageGenerationProvider, reloadImageGenerationProviders, resolveImageGenerationCredentialMode } from "../../../agent/image/generation/provider-registry.js";
 import { SessionConfigStore } from "../../../session/config-store.js";
+import { getModelThinking } from "../../../providers/model-thinking.js";
 import { deleteCustomImageProvider, listCustomImageProviders, upsertCustomImageProvider } from "../../custom-image-providers.js";
 import { getAgentImageGenerationConfig, getImageGenerationCatalog, prepareImageGenerationSetup, verifyImageGenerationCredential } from "../../image-generation-setup.js";
 import { discoverProviderModels, isProviderApiDiscoverable } from "../../../providers/model-discovery.js";
@@ -58,6 +59,12 @@ function mapPluginModel(providerId, model, available) {
 		maxTokens: model.maxOutputTokens ?? 4096,
 		reasoning: false,
 		vision: model.supportsImages ?? false,
+		thinking: {
+			mode: "none",
+			options: ["off"],
+			initialValue: "off",
+			supportsAdaptive: false
+		},
 		cost: {
 			input: model.pricing?.input ?? 0,
 			output: model.pricing?.output ?? 0
@@ -289,6 +296,7 @@ function registerModelsRoutes(authenticated, deps) {
 			contextWindow: m.contextWindow ?? 128e3,
 			maxTokens: m.maxTokens ?? 4096,
 			reasoning: m.reasoning ?? false,
+			thinking: getModelThinking(m),
 			vision: m.input?.includes("image") ?? false,
 			recommended: isRecommendedModel(m.provider, m.id),
 			cost: {
@@ -593,6 +601,7 @@ function registerModelsRoutes(authenticated, deps) {
 			contextWindow: m.contextWindow ?? 128e3,
 			maxTokens: m.maxTokens ?? 4096,
 			reasoning: m.reasoning ?? false,
+			thinking: getModelThinking(m),
 			vision: m.input?.includes("image") ?? false,
 			recommended: isRecommendedModel(m.provider, m.id),
 			cost: {

package/dist/src/gateway/hono/routes/projects.js

@@ -8,9 +8,10 @@ import "../../../activity/index.js";
 import { resolveEffectiveAgentProfile } from "../../../config/agent-profile.js";
 import { TaskRepository } from "../../../tasks/task-repository.js";
 import { TaskReadModelProjector } from "../../../tasks/task-read-model-projector.js";
+import { ExecutionEnvironmentStore } from "../../../execution-environments/store.js";
 import { ProjectWorkspaceConflictError, ProjectWorkspaceMissingError } from "../../../projects/workspace-project.js";
+import { inferProjectExecutionMode, inferProjectKind } from "../../../projects/project-kind.js";
 import { isValidProjectAgentId, normalizeProjectAgentId, resolveProjectAgentId } from "../../../projects/project-agent.js";
-import { inferProjectKind } from "../../../projects/project-kind.js";
 import { inferSuggestedProjectDefaultAgentId } from "../../../projects/project-agent-suggestion.js";
 import { buildProjectLoopOverview } from "../../../projects/project-loop.js";
 import "../../../projects/index.js";
@@ -24,6 +25,9 @@ import { randomUUID } from "node:crypto";
 function parseProjectStatus(raw) {
 	return raw === "planned" || raw === "active" || raw === "paused" || raw === "completed" || raw === "cancelled" || raw === "archived" ? raw : void 0;
 }
+function parseProjectExecutionMode(raw) {
+	return raw === "local_checkout" || raw === "managed_worktree" ? raw : void 0;
+}
 function parseLimit(raw, fallback = 50) {
 	if (!raw) return void 0;
 	const n = Number.parseInt(raw, 10);
@@ -144,6 +148,7 @@ function registerProjectsRoutes(authenticated, deps) {
 	const { service } = deps;
 	const activity = new ActivityService();
 	const operatingViews = new ProjectOperatingViewService(service.projects);
+	const environments = new ExecutionEnvironmentStore();
 	authenticated.post("/api/projects", async (c) => {
 		const body = await c.req.json().catch(() => ({}));
 		const name = textField(body, "name")?.trim();
@@ -152,6 +157,11 @@ function registerProjectsRoutes(authenticated, deps) {
 			ok: false,
 			error: "Missing name"
 		}, 400);
+		const executionMode = parseProjectExecutionMode(body.executionMode);
+		if (body.executionMode !== void 0 && !executionMode) return c.json({
+			ok: false,
+			error: "Invalid project execution mode"
+		}, 400);
 		const hasDefaultAgentPatch = Object.hasOwn(body, "defaultAgentId");
 		const explicitDefaultAgentId = normalizeProjectAgentId(textField(body, "defaultAgentId"));
 		const defaultAgentId = hasDefaultAgentPatch ? explicitDefaultAgentId : inferSuggestedProjectDefaultAgentId({
@@ -173,6 +183,7 @@ function registerProjectsRoutes(authenticated, deps) {
 				workspaceRoot,
 				createWorkspaceRoot: body.createWorkspaceRoot === true,
 				projectKind: textField(body, "projectKind"),
+				executionMode,
 				brief: textField(body, "brief"),
 				instructions: textField(body, "instructions"),
 				outcome: textField(body, "outcome"),
@@ -251,10 +262,12 @@ function registerProjectsRoutes(authenticated, deps) {
 			config: service.currentConfig,
 			...input
 		});
+		const executionMode = inferProjectExecutionMode(input);
 		return c.json({
 			ok: true,
 			inference,
-			defaultAgentId
+			defaultAgentId,
+			executionMode
 		});
 	});
 	authenticated.post("/api/projects/resolve-workspace", async (c) => {
@@ -600,6 +613,7 @@ function registerProjectsRoutes(authenticated, deps) {
 	});
 	authenticated.patch("/api/projects/:id", async (c) => {
 		const body = await c.req.json().catch(() => ({}));
+		const projectId = c.req.param("id");
 		const status = parseProjectStatus(body.status);
 		const defaultAgentPatch = optionalTextField(body, "defaultAgentId");
 		const defaultAgentId = defaultAgentPatch === void 0 ? void 0 : normalizeProjectAgentId(defaultAgentPatch);
@@ -611,18 +625,34 @@ function registerProjectsRoutes(authenticated, deps) {
 			ok: false,
 			error: "Invalid project health"
 		}, 400);
+		const executionMode = parseProjectExecutionMode(body.executionMode);
+		if (body.executionMode !== void 0 && !executionMode) return c.json({
+			ok: false,
+			error: "Invalid project execution mode"
+		}, 400);
 		if (defaultAgentId && !isValidProjectAgentId(service.currentConfig, defaultAgentId)) return c.json({
 			ok: false,
 			error: "Default agent not found"
 		}, 400);
+		const currentProject = service.projects.get(projectId);
+		const requestedWorkspaceRoot = optionalTextField(body, "workspaceRoot");
+		if (currentProject && requestedWorkspaceRoot !== void 0 && requestedWorkspaceRoot !== (currentProject.workspaceRoot ?? null) && environments.list({
+			projectId,
+			limit: 1
+		}).length > 0) return c.json({
+			ok: false,
+			code: "execution_environments_exist",
+			error: "Delete the project execution environments before changing its workspace"
+		}, 409);
 		try {
-			const project = service.projects.update(c.req.param("id"), {
+			const project = service.projects.update(projectId, {
 				...textField(body, "name") !== void 0 ? { name: textField(body, "name") } : {},
 				...optionalTextField(body, "description") !== void 0 ? { description: optionalTextField(body, "description") } : {},
 				...status ? { status } : {},
 				...defaultAgentPatch !== void 0 ? { defaultAgentId: defaultAgentId ?? null } : {},
 				...optionalTextField(body, "workspaceRoot") !== void 0 ? { workspaceRoot: optionalTextField(body, "workspaceRoot") } : {},
 				createWorkspaceRoot: body.createWorkspaceRoot === true,
+				...executionMode ? { executionMode } : {},
 				...optionalTextField(body, "brief") !== void 0 ? { brief: optionalTextField(body, "brief") } : {},
 				...optionalTextField(body, "instructions") !== void 0 ? { instructions: optionalTextField(body, "instructions") } : {},
 				...optionalTextField(body, "outcome") !== void 0 ? { outcome: optionalTextField(body, "outcome") } : {},
@@ -657,7 +687,16 @@ function registerProjectsRoutes(authenticated, deps) {
 		}
 	});
 	authenticated.delete("/api/projects/:id", async (c) => {
-		service.projects.delete(c.req.param("id"));
+		const projectId = c.req.param("id");
+		if (environments.list({
+			projectId,
+			limit: 1
+		}).length > 0) return c.json({
+			ok: false,
+			code: "execution_environments_exist",
+			error: "Delete the project execution environments before deleting the project"
+		}, 409);
+		service.projects.delete(projectId);
 		return c.json({ ok: true });
 	});
 	authenticated.get("/api/projects/:id/sessions", async (c) => {

package/dist/src/gateway/hono/routes/session-input-handler.d.ts

@@ -15,7 +15,13 @@ export declare function submitSessionInput(c: Context, deps: AuthenticatedRouteD
 }, 401, "json">) | (Response & import("hono").TypedResponse<{
     ok: false;
     error: {
-        code: "BAD_REQUEST" | "QUEUE_FULL" | "CONTEXT_UNAVAILABLE";
+        code: string;
+        message: string;
+    };
+}, 409, "json">) | (Response & import("hono").TypedResponse<{
+    ok: false;
+    error: {
+        code: "BAD_REQUEST" | "QUEUE_FULL" | "CONTEXT_UNAVAILABLE" | "SESSION_CHANGED";
         message: string;
     };
 }, 400 | 409, "json">) | (Response & import("hono").TypedResponse<{
@@ -33,6 +39,7 @@ export declare function submitSessionInput(c: Context, deps: AuthenticatedRouteD
                 id: string;
                 sessionKey: string;
                 clientMessageId: string;
+                expectedSessionId?: string;
                 requestedDelivery: import("../../../storage/sqlite/session-input-repository.js").SessionInputDelivery;
                 effectiveDelivery: import("../../../storage/sqlite/session-input-repository.js").SessionInputDelivery;
                 status: import("../../../storage/sqlite/session-input-repository.js").SessionInputStatus;
@@ -95,6 +102,12 @@ export declare function replaceLatestSessionTurn(c: Context, deps: Authenticated
         message: string;
     };
 }, 401, "json">) | (Response & import("hono").TypedResponse<{
+    ok: false;
+    error: {
+        code: string;
+        message: string;
+    };
+}, 409, "json">) | (Response & import("hono").TypedResponse<{
     ok: false;
     error: {
         code: "TARGET_NOT_FOUND" | "NOT_LATEST" | "SESSION_BUSY" | "BAD_REQUEST" | "CONTEXT_UNAVAILABLE";
@@ -115,6 +128,7 @@ export declare function replaceLatestSessionTurn(c: Context, deps: Authenticated
                 id: string;
                 sessionKey: string;
                 clientMessageId: string;
+                expectedSessionId?: string;
                 requestedDelivery: import("../../../storage/sqlite/session-input-repository.js").SessionInputDelivery;
                 effectiveDelivery: import("../../../storage/sqlite/session-input-repository.js").SessionInputDelivery;
                 status: import("../../../storage/sqlite/session-input-repository.js").SessionInputStatus;

package/dist/src/gateway/hono/routes/session-input-handler.js

@@ -1,7 +1,11 @@
 import { endpointTurnClaimSchema } from "../../../../packages/endpoint-tools-protocol/src/index.js";
+import { init_providers, resolveModel } from "../../../providers/index.js";
 import { parseTurnContextRefs } from "../../../agent/source-context/types.js";
+import { getModelThinking } from "../../../providers/model-thinking.js";
 import { validateWebchatAttachments, validateWebchatContent } from "../../chat-limits.js";
+import { withModelConfigLock } from "../../../session/model-config-lock.js";
 //#region src/gateway/hono/routes/session-input-handler.ts
+init_providers();
 const MAX_TURN_CONTEXTS = 5;
 async function submitSessionInput(c, deps, sessionKey) {
 	const body = await c.req.json().catch(() => null);
@@ -61,33 +65,70 @@ async function submitSessionInput(c, deps, sessionKey) {
 			message: "Endpoint connection is not active"
 		}
 	}, 401);
-	const result = await deps.service.submitSessionInput({
-		sessionKey,
-		clientMessageId: typeof body.clientMessageId === "string" ? body.clientMessageId : "",
-		delivery,
-		content,
-		attachments,
-		contextRefs,
-		thinking: typeof body.thinking === "string" ? body.thinking : void 0,
-		origin: {
-			type: "endpoint",
-			endpointId: origin.data.endpointId
-		}
-	});
-	if (result.ok === false) return c.json({
+	if (body.expectedSessionId !== void 0 && (typeof body.expectedSessionId !== "string" || !body.expectedSessionId || body.expectedSessionId.length > 128)) return c.json({
 		ok: false,
 		error: {
-			code: result.code,
-			message: result.code === "CONTEXT_UNAVAILABLE" ? "A referenced Note changed or is no longer available. Select it again." : "Input was not accepted"
+			code: "BAD_REQUEST",
+			message: "Invalid session identity"
 		}
-	}, result.code === "QUEUE_FULL" || result.code === "CONTEXT_UNAVAILABLE" ? 409 : 400);
-	return c.json({
-		ok: true,
-		payload: {
-			...result,
-			sessionKey
+	}, 400);
+	return withModelConfigLock(sessionKey, async () => {
+		const selection = body.configVersion !== void 0 ? await deps.service.sessions.getAgentConfig(sessionKey) : void 0;
+		if (selection) {
+			if (!Number.isSafeInteger(body.configVersion) || selection.configVersion !== body.configVersion || !selection.fixedModel) return c.json({
+				ok: false,
+				error: {
+					code: "CONFIG_CHANGED",
+					message: "Model configuration changed. Refresh before sending."
+				}
+			}, 409);
+			try {
+				if (!getModelThinking(resolveModel(selection.model)).options.includes(selection.thinkingLevel)) return c.json({
+					ok: false,
+					error: {
+						code: "INVALID_THINKING",
+						message: "Select a supported thinking level before sending."
+					}
+				}, 409);
+			} catch {
+				return c.json({
+					ok: false,
+					error: {
+						code: "MODEL_UNAVAILABLE",
+						message: `Model unavailable: ${selection.model}`
+					}
+				}, 409);
+			}
 		}
-	}, 202);
+		const result = await deps.service.submitSessionInput({
+			expectedSessionId: body.expectedSessionId,
+			sessionKey,
+			clientMessageId: typeof body.clientMessageId === "string" ? body.clientMessageId : "",
+			delivery,
+			content,
+			attachments,
+			contextRefs,
+			thinking: selection?.thinkingLevel ?? (typeof body.thinking === "string" ? body.thinking : void 0),
+			origin: {
+				type: "endpoint",
+				endpointId: origin.data.endpointId
+			}
+		});
+		if (result.ok === false) return c.json({
+			ok: false,
+			error: {
+				code: result.code,
+				message: result.code === "CONTEXT_UNAVAILABLE" ? "A referenced Note changed or is no longer available. Select it again." : "Input was not accepted"
+			}
+		}, result.code === "SESSION_CHANGED" || result.code === "QUEUE_FULL" || result.code === "CONTEXT_UNAVAILABLE" ? 409 : 400);
+		return c.json({
+			ok: true,
+			payload: {
+				...result,
+				sessionKey
+			}
+		}, 202);
+	});
 }
 async function replaceLatestSessionTurn(c, deps, sessionKey, targetTurnId) {
 	const body = await c.req.json().catch(() => null);
@@ -139,38 +180,67 @@ async function replaceLatestSessionTurn(c, deps, sessionKey, targetTurnId) {
 			message: "Endpoint connection is not active"
 		}
 	}, 401);
-	const result = await deps.service.replaceLatestSessionTurn({
-		sessionKey,
-		targetTurnId,
-		clientMessageId: typeof body.clientMessageId === "string" ? body.clientMessageId : "",
-		delivery: "next",
-		content,
-		attachments,
-		contextRefs,
-		thinking: typeof body.thinking === "string" ? body.thinking : void 0,
-		origin: {
-			type: "endpoint",
-			endpointId: origin.data.endpointId
+	return withModelConfigLock(sessionKey, async () => {
+		const selection = body.configVersion !== void 0 ? await deps.service.sessions.getAgentConfig(sessionKey) : void 0;
+		if (selection) {
+			if (!Number.isSafeInteger(body.configVersion) || selection.configVersion !== body.configVersion || !selection.fixedModel) return c.json({
+				ok: false,
+				error: {
+					code: "CONFIG_CHANGED",
+					message: "Model configuration changed. Refresh before sending."
+				}
+			}, 409);
+			try {
+				if (!getModelThinking(resolveModel(selection.model)).options.includes(selection.thinkingLevel)) return c.json({
+					ok: false,
+					error: {
+						code: "INVALID_THINKING",
+						message: "Select a supported thinking level before sending."
+					}
+				}, 409);
+			} catch {
+				return c.json({
+					ok: false,
+					error: {
+						code: "MODEL_UNAVAILABLE",
+						message: `Model unavailable: ${selection.model}`
+					}
+				}, 409);
+			}
+		}
+		const result = await deps.service.replaceLatestSessionTurn({
+			sessionKey,
+			targetTurnId,
+			clientMessageId: typeof body.clientMessageId === "string" ? body.clientMessageId : "",
+			delivery: "next",
+			content,
+			attachments,
+			contextRefs,
+			thinking: selection?.thinkingLevel ?? (typeof body.thinking === "string" ? body.thinking : void 0),
+			origin: {
+				type: "endpoint",
+				endpointId: origin.data.endpointId
+			}
+		});
+		if (result.ok === false) {
+			const status = result.code === "TARGET_NOT_FOUND" ? 404 : result.code === "BAD_REQUEST" ? 400 : 409;
+			const message = result.code === "NOT_LATEST" ? "Only the latest user turn can be replaced" : result.code === "SESSION_BUSY" ? "Session has pending input" : result.code === "TARGET_NOT_FOUND" ? "User turn was not found" : result.code === "CONTEXT_UNAVAILABLE" ? "A referenced Note changed or is no longer available. Select it again." : "Replacement input was not accepted";
+			return c.json({
+				ok: false,
+				error: {
+					code: result.code,
+					message
+				}
+			}, status);
 		}
-	});
-	if (result.ok === false) {
-		const status = result.code === "TARGET_NOT_FOUND" ? 404 : result.code === "BAD_REQUEST" ? 400 : 409;
-		const message = result.code === "NOT_LATEST" ? "Only the latest user turn can be replaced" : result.code === "SESSION_BUSY" ? "Session has pending input" : result.code === "TARGET_NOT_FOUND" ? "User turn was not found" : result.code === "CONTEXT_UNAVAILABLE" ? "A referenced Note changed or is no longer available. Select it again." : "Replacement input was not accepted";
 		return c.json({
-			ok: false,
-			error: {
-				code: result.code,
-				message
+			ok: true,
+			payload: {
+				...result,
+				sessionKey
 			}
-		}, status);
-	}
-	return c.json({
-		ok: true,
-		payload: {
-			...result,
-			sessionKey
-		}
-	}, 202);
+		}, 202);
+	});
 }
 //#endregion
 export { replaceLatestSessionTurn, submitSessionInput };