@xopcai/xopc 0.0.235 → 0.0.239

package/dist/src/execution-environments/subject.js

@@ -0,0 +1,12 @@
+import { isXopcDatabaseOpen } from "../storage/sqlite/connection.js";
+import "../storage/sqlite/index.js";
+import { ExecutionEnvironmentStore } from "./store.js";
+//#region src/execution-environments/subject.ts
+function getExecutionEnvironmentForSession(sessionKey) {
+	if (!isXopcDatabaseOpen()) return void 0;
+	const store = new ExecutionEnvironmentStore();
+	const binding = store.resolveBinding(sessionKey);
+	return binding ? store.get(binding.environmentId) : void 0;
+}
+//#endregion
+export { getExecutionEnvironmentForSession };

package/dist/src/execution-environments/types.d.ts

@@ -0,0 +1,74 @@
+export declare const EXECUTION_ENVIRONMENT_KINDS: readonly ["local_checkout", "managed_worktree"];
+export type ExecutionEnvironmentKind = (typeof EXECUTION_ENVIRONMENT_KINDS)[number];
+export declare const EXECUTION_ENVIRONMENT_STATUSES: readonly ["requested", "provisioning", "ready", "degraded", "deleting", "deleted", "error"];
+export type ExecutionEnvironmentStatus = (typeof EXECUTION_ENVIRONMENT_STATUSES)[number];
+export interface ExecutionEnvironment {
+    id: string;
+    projectId?: string;
+    kind: ExecutionEnvironmentKind;
+    status: ExecutionEnvironmentStatus;
+    rootPath: string;
+    repositoryRoot?: string;
+    gitCommonDir?: string;
+    baseRef?: string;
+    baseSha?: string;
+    branchRef?: string;
+    version: number;
+    lastError?: string;
+    createdAt: number;
+    updatedAt: number;
+    lastUsedAt?: number;
+    deletedAt?: number;
+}
+export interface ExecutionEnvironmentBinding {
+    id: string;
+    sessionKey: string;
+    environmentId: string;
+    createdAt: number;
+    releasedAt?: number;
+}
+export interface ExecutionEnvironmentEvent {
+    id: string;
+    environmentId: string;
+    fromStatus?: ExecutionEnvironmentStatus;
+    toStatus: ExecutionEnvironmentStatus;
+    reason: string;
+    metadata: Record<string, unknown>;
+    createdAt: number;
+}
+export interface CreateExecutionEnvironmentInput {
+    id?: string;
+    projectId?: string;
+    kind: ExecutionEnvironmentKind;
+    rootPath: string;
+    repositoryRoot?: string;
+    gitCommonDir?: string;
+    baseRef?: string;
+    baseSha?: string;
+    branchRef?: string;
+}
+export interface ExecutionEnvironmentListQuery {
+    projectId?: string;
+    status?: ExecutionEnvironmentStatus;
+    includeDeleted?: boolean;
+    limit?: number;
+}
+export interface BindExecutionEnvironmentInput {
+    sessionKey: string;
+    environmentId: string;
+}
+export interface TransitionExecutionEnvironmentInput {
+    environmentId: string;
+    toStatus: ExecutionEnvironmentStatus;
+    expectedVersion: number;
+    reason: string;
+    error?: string;
+    metadata?: Record<string, unknown>;
+}
+export declare class ExecutionEnvironmentConflictError extends Error {
+    constructor(message: string);
+}
+export declare class ExecutionEnvironmentNotFoundError extends Error {
+    constructor(environmentId: string);
+}
+export declare function canTransitionExecutionEnvironment(fromStatus: ExecutionEnvironmentStatus, toStatus: ExecutionEnvironmentStatus): boolean;

package/dist/src/execution-environments/types.js

@@ -0,0 +1,54 @@
+//#region src/execution-environments/types.ts
+const EXECUTION_ENVIRONMENT_KINDS = ["local_checkout", "managed_worktree"];
+const EXECUTION_ENVIRONMENT_STATUSES = [
+	"requested",
+	"provisioning",
+	"ready",
+	"degraded",
+	"deleting",
+	"deleted",
+	"error"
+];
+var ExecutionEnvironmentConflictError = class extends Error {
+	constructor(message) {
+		super(message);
+		this.name = "ExecutionEnvironmentConflictError";
+	}
+};
+var ExecutionEnvironmentNotFoundError = class extends Error {
+	constructor(environmentId) {
+		super(`Execution environment not found: ${environmentId}`);
+		this.name = "ExecutionEnvironmentNotFoundError";
+	}
+};
+const STATUS_TRANSITIONS = {
+	requested: [
+		"provisioning",
+		"deleting",
+		"error"
+	],
+	provisioning: [
+		"ready",
+		"degraded",
+		"deleting",
+		"error"
+	],
+	ready: [
+		"degraded",
+		"deleting",
+		"error"
+	],
+	degraded: [
+		"provisioning",
+		"deleting",
+		"error"
+	],
+	deleting: ["deleted", "error"],
+	deleted: [],
+	error: ["provisioning", "deleting"]
+};
+function canTransitionExecutionEnvironment(fromStatus, toStatus) {
+	return STATUS_TRANSITIONS[fromStatus].includes(toStatus);
+}
+//#endregion
+export { EXECUTION_ENVIRONMENT_KINDS, EXECUTION_ENVIRONMENT_STATUSES, ExecutionEnvironmentConflictError, ExecutionEnvironmentNotFoundError, canTransitionExecutionEnvironment };

package/dist/src/extensions/lockfile.js

@@ -1,7 +1,7 @@
 import { createLogger } from "../utils/logger/index.js";
 import { init_logger } from "../utils/logger.js";
-import { init_write_file_atomic, writeTextAtomic } from "../infra/write-file-atomic.js";
 import { init_paths, resolveExtensionsDir, resolveExtensionsLockPath } from "../config/paths.js";
+import { init_write_file_atomic, writeTextAtomic } from "../infra/write-file-atomic.js";
 import { dirname, join } from "path";
 import { existsSync } from "fs";
 import { mkdir, readFile } from "fs/promises";

package/dist/src/extensions/sdk/index.js

@@ -7,8 +7,8 @@ import { SlotRegistry, getSlotRegistry, registerSlotType } from "../slots.js";
 import { ExtensionDiagnostics, ExtensionLoaderCacheImpl, getExtensionCache, getExtensionDiagnostics } from "../diagnostics.js";
 import "../loader.js";
 import { ExtensionHookRunner, createHookContext, isHookEvent } from "../hooks.js";
-import { registerExtensionCliProgram } from "./channel-helpers.js";
 import { defineChannelPluginEntry } from "./channel-entry.js";
+import { registerExtensionCliProgram } from "./channel-helpers.js";
 import { lazyFunction, lazyModule } from "./lazy.js";
 import { createMockExtensionApi, createTestGateway } from "./testing.js";
 //#region src/extensions/sdk/index.ts

package/dist/src/extensions/update.js

@@ -4,8 +4,8 @@ import { init_paths, resolveBundledExtensionsDir, resolveExtensionsDir } from ".
 import { init_loader, loadConfig } from "../config/loader.js";
 import { downloadExtensionStoreZipBuffer, resolveExtensionZipDownloadUrl, resolveExtensionsStoreBaseUrl, verifyStoreArtifactSha256 } from "../agent/skills/marketplace/adapters/store/store-api-client.js";
 import { getExtensionLockfileManager } from "./lockfile.js";
-import { installExtensionFromStoreZip, installFromNpm } from "./install.js";
 import { findExtension } from "./marketplace.js";
+import { installExtensionFromStoreZip, installFromNpm } from "./install.js";
 import { join } from "node:path";
 import { existsSync, readFileSync, readdirSync, rmSync } from "node:fs";
 import semver from "semver";

package/dist/src/gateway/agent-builtin-tools.d.ts

@@ -247,4 +247,4 @@ export declare const GATEWAY_BUILTIN_TOOLS: readonly [{
         readonly zh: "使用已验证的参数执行选定的外部工具。";
     };
 }];
-export declare const GATEWAY_BUILTIN_TOOL_IDS: ("automation" | "workflow" | "find" | "todo" | "image" | "clarify" | "dreaming" | "memory_search" | "memory_get" | "web_search" | "web_fetch" | "browser_use" | "grep" | "session_search" | "read_file" | "list_dir" | "write_file" | "apply_patch" | "exec_command" | "update_plan" | "web_extract" | "image_generate" | "skills_list" | "skill_view" | "skill_manage" | "skills_marketplace_search" | "xopc_tool_search" | "xopc_tool_describe" | "xopc_tool_execute" | "send_message" | "send_media" | "read_media" | "create_share" | "session_status" | "tool_manual" | "delegate_task" | "skill_install" | "text_to_speech" | "execute_code" | "create_desktop_pet")[];
+export declare const GATEWAY_BUILTIN_TOOL_IDS: ("automation" | "workflow" | "find" | "image" | "memory_search" | "memory_get" | "web_search" | "web_fetch" | "browser_use" | "grep" | "session_search" | "read_file" | "list_dir" | "write_file" | "apply_patch" | "exec_command" | "update_plan" | "todo" | "clarify" | "dreaming" | "web_extract" | "image_generate" | "skills_list" | "skill_view" | "skill_manage" | "skills_marketplace_search" | "xopc_tool_search" | "xopc_tool_describe" | "xopc_tool_execute" | "send_message" | "send_media" | "read_media" | "create_share" | "session_status" | "tool_manual" | "delegate_task" | "skill_install" | "text_to_speech" | "execute_code" | "create_desktop_pet")[];

package/dist/src/gateway/agents-admin.js

@@ -1,6 +1,6 @@
 import { init_agent_scope, listAgentEntries, normalizeAgentId, resolveAgentDir, resolveAgentProfileDir, resolveAgentWorkspaceDir, resolveDefaultAgentId, resolveUserPath, validateAgentIdForNewAgent } from "../agent/agent-scope.js";
-import { WORKSPACE_FILES, init_paths } from "../config/paths.js";
 import { resolveEffectiveAgentProfile } from "../config/agent-profile.js";
+import { WORKSPACE_FILES, init_paths } from "../config/paths.js";
 import { AGENT_PROFILE_MARKDOWN_SYSTEM_FILES, REQUIRED_AGENT_PROFILE_MARKDOWN_FILE_SET } from "../agent/context/workspace.js";
 import { isPathUnderWorkspace, resolveWorkspaceSafePath } from "./workspace-editor-path.js";
 import { seedAgentProfileMarkdownFiles } from "../agent/context/workspace-seed.js";

package/dist/src/gateway/custom-image-providers.d.ts

@@ -53,8 +53,8 @@ export declare const CustomImageProviderInputSchema: z.ZodObject<{
                     qualities: z.ZodOptional<z.ZodArray<z.ZodEnum<{
                         low: "low";
                         high: "high";
-                        auto: "auto";
                         medium: "medium";
+                        auto: "auto";
                     }>>>;
                     formats: z.ZodOptional<z.ZodArray<z.ZodEnum<{
                         png: "png";

package/dist/src/gateway/file-path-classifier.js

@@ -1,7 +1,7 @@
 import { init_paths_state, resolveStateDir } from "../config/paths-state.js";
 import { init_agent_scope, resolveAgentProfileDir } from "../agent/agent-scope.js";
-import { init_paths, resolveConfigPath, resolveSkillsDir } from "../config/paths.js";
 import { extractProfileAgentId } from "../config/agent-profile.js";
+import { init_paths, resolveConfigPath, resolveSkillsDir } from "../config/paths.js";
 import { isBareProfileMarkdownFileName, resolveProfileMarkdownPathIfBareName } from "../agent/tools/tool-paths.js";
 import { isPathUnderWorkspace, resolveWorkspaceSafePath } from "./workspace-editor-path.js";
 import { basename, isAbsolute, resolve } from "node:path";

package/dist/src/gateway/heartbeat/service.js

@@ -1,9 +1,9 @@
 import { createLogger } from "../../utils/logger/index.js";
 import { init_logger } from "../../utils/logger.js";
 import { shouldSilence, stripHeartbeatToken } from "../../heartbeat/tokens.js";
+import { appendCronEventLines } from "../../heartbeat/event-prompt.js";
 import { isWithinActiveHours } from "../../heartbeat/active-hours.js";
 import { isHeartbeatContentEmpty } from "../../heartbeat/content-check.js";
-import { appendCronEventLines } from "../../heartbeat/event-prompt.js";
 import { createHeartbeatWake } from "../../heartbeat/wake.js";
 import { resolveHeartbeatMdPath } from "../workspace-heartbeat-path.js";
 import { readFile } from "fs/promises";

package/dist/src/gateway/hono/lib/config-payload.d.ts

@@ -35,7 +35,7 @@ export declare function buildSafeWebConfigPayload(service: GatewayService, optio
                     primary: string;
                     fallbacks: string[];
                 };
-                intents?: Partial<Record<"understanding" | "fast" | "reasoning" | "coding" | "review" | "vision", {
+                intents?: Partial<Record<"review" | "coding" | "understanding" | "fast" | "reasoning" | "vision", {
                     primary: string;
                     fallbacks: string[];
                 }>>;
@@ -74,7 +74,7 @@ export declare function buildSafeWebConfigPayload(service: GatewayService, optio
                     primary: string;
                     fallbacks: string[];
                 };
-                intents: Partial<Record<"understanding" | "fast" | "reasoning" | "coding" | "review" | "vision", {
+                intents: Partial<Record<"review" | "coding" | "understanding" | "fast" | "reasoning" | "vision", {
                     primary: string;
                     fallbacks: string[];
                 }>>;
@@ -209,7 +209,7 @@ export declare function buildSafeWebConfigPayload(service: GatewayService, optio
     };
     userContext: {
         preferences: {
-            responseLanguage: "auto" | "zh-CN" | "en";
+            responseLanguage: "en" | "auto" | "zh-CN";
         };
         dreaming: {
             mode: "off" | "review";
@@ -221,7 +221,7 @@ export declare function buildSafeWebConfigPayload(service: GatewayService, optio
             timezone?: string;
         };
         privacy: {
-            sensitiveWritePolicy: "allow" | "deny" | "confirm";
+            sensitiveWritePolicy: "allow" | "confirm" | "deny";
         };
         memory: {
             retention: {

package/dist/src/gateway/hono/lib/config-payload.js

@@ -1,9 +1,9 @@
 import { ContextCompactionPolicySchema, UserContextDreamingSchema, UserContextPrivacySchema, init_config } from "../../../user-context/config.js";
 import { init_agent_scope, listAgentEntries, normalizeAgentId, resolveDefaultAgentId } from "../../../agent/agent-scope.js";
 import { resolveModelsJsonPath } from "../../../config/paths.js";
+import { buildChannelCatalogForConfig, buildChannelCatalogFromSnapshot, getChannelSetupStatus, init_channel_catalog_service } from "../../../channels/catalog/channel-catalog-service.js";
 import { init_models_json, loadModelsJson } from "../../../config/models-json.js";
 import { CredentialResolver, init_credentials } from "../../../auth/credentials.js";
-import { buildChannelCatalogForConfig, buildChannelCatalogFromSnapshot, getChannelSetupStatus, init_channel_catalog_service } from "../../../channels/catalog/channel-catalog-service.js";
 import { getProviderRegistry, init_plugin_registry } from "../../../providers/plugin-registry.js";
 import { getAllProviders, init_providers, isProviderConfigured } from "../../../providers/index.js";
 import { normalizeConfiguredMcpServers } from "../../../config/mcp-config-normalize.js";

package/dist/src/gateway/hono/routes/auth-registry-extensions.js

@@ -1,8 +1,8 @@
 import { getAllModels, getAvailableModels, init_providers } from "../../../providers/index.js";
 import { ActivationPlanner } from "../../../extensions/activation-planner.js";
 import { mergeActivationContext } from "../../../extensions/activation-context.js";
-import { fetchRegistry, listExtensions, searchExtensions } from "../../../extensions/marketplace.js";
 import { buildWhenContextSnapshot } from "../../../extensions/when-context.js";
+import { fetchRegistry, listExtensions, searchExtensions } from "../../../extensions/marketplace.js";
 import { createOAuthAsyncHandler } from "../oauth-async.js";
 import { createOAuthHandler } from "../oauth.js";
 import { extensionAssetMimeType } from "../lib/extension-assets.js";

package/dist/src/gateway/hono/routes/chat-model-config.d.ts

@@ -0,0 +1,34 @@
+import type { Context } from 'hono';
+import type { AuthenticatedRouteDeps } from './deps.js';
+export declare function patchChatModelConfig(c: Context, service: AuthenticatedRouteDeps['service'], sessionKey: string, body: Record<string, unknown>): Promise<(Response & import("hono").TypedResponse<{
+    ok: false;
+    error: string;
+    code: string;
+}, 409, "json">) | (Response & import("hono").TypedResponse<{
+    ok: false;
+    error: string;
+}, 400, "json">) | (Response & import("hono").TypedResponse<{
+    ok: false;
+    error: string;
+    code: "CONFIG_CHANGED" | "INVALID_MODEL" | "INVALID_THINKING";
+}, 400 | 409, "json">) | (Response & import("hono").TypedResponse<{
+    ok: true;
+    payload: {
+        thinkingLevel: import("@earendil-works/pi-agent-core").ThinkingLevel;
+        model: string;
+        configVersion: number;
+        fixedModel: boolean;
+        reasoningLevel: import("../../../config/index.js").ReasoningLevel;
+        activityDetail: {
+            default: import("../../../config/index.js").ReasoningLevel;
+            override: import("../../../config/index.js").ReasoningLevel | null;
+            effective: import("../../../config/index.js").ReasoningLevel;
+            source: "session" | "default";
+        };
+        verboseLevel: import("../../../config/index.js").VerboseLevel;
+        effectiveWorkspacePath: string;
+        workingDirectoryLocked: boolean;
+        workspaceSource: "execution_environment" | "project" | "session_override" | "agent_default_root" | "agent_workspace";
+        userContextMode: "enabled" | "off" | "temporary";
+    };
+}, import("hono/dist/types/utils/http-status.js").ContentfulStatusCode, "json">)>;

package/dist/src/gateway/hono/routes/chat-model-config.js

@@ -0,0 +1,42 @@
+import { withModelConfigLock } from "../../../session/model-config-lock.js";
+//#region src/gateway/hono/routes/chat-model-config.ts
+async function patchChatModelConfig(c, service, sessionKey, body) {
+	return withModelConfigLock(sessionKey, async () => {
+		const changesModel = body.model !== void 0 || body.thinkingLevel !== void 0;
+		if (changesModel) {
+			const state = service.getSessionInputState(sessionKey);
+			if (service.sessions.getActiveRun(sessionKey).active || state.activeRunId || state.inputs.length > 0) return c.json({
+				ok: false,
+				error: "Wait for the current reply and pending inputs to finish",
+				code: "SESSION_BUSY"
+			}, 409);
+			if (body.thinkingLevel !== void 0 && typeof body.thinkingLevel !== "string") return c.json({
+				ok: false,
+				error: "Invalid thinking level"
+			}, 400);
+			if (body.configVersion !== void 0 && (!Number.isSafeInteger(body.configVersion) || Number(body.configVersion) < 0)) return c.json({
+				ok: false,
+				error: "Invalid configuration version"
+			}, 400);
+			if (body.model !== void 0 && (typeof body.model !== "string" || !body.model.trim())) return c.json({
+				ok: false,
+				error: "Select a specific model"
+			}, 400);
+		}
+		const result = await service.sessions.patchAgentConfig(sessionKey, {
+			...body,
+			...changesModel ? { fixedModel: true } : {}
+		});
+		if (!result.ok) return c.json({
+			ok: false,
+			error: result.error,
+			code: result.code
+		}, result.code === "CONFIG_CHANGED" ? 409 : 400);
+		return c.json({
+			ok: true,
+			payload: await service.sessions.getAgentConfig(sessionKey)
+		});
+	});
+}
+//#endregion
+export { patchChatModelConfig };

package/dist/src/gateway/hono/routes/device-pairing-approval.d.ts

@@ -0,0 +1,3 @@
+import type { Hono } from 'hono';
+export declare function registerPairingApprovalPublicRoutes(app: Hono): void;
+export declare function registerPairingApprovalAdminRoutes(app: Hono): void;

package/dist/src/gateway/hono/routes/device-pairing-approval.js

@@ -0,0 +1,100 @@
+import { devicePairingCompleteSchema, devicePairingProofSchema, devicePairingRequestSchema } from "../../../../packages/gateway-contract/src/device-pairing.js";
+import { getOrCreateGatewayIdentity, signGatewayPayload } from "../../../storage/sqlite/gateway-identity-repository.js";
+import { DevicePairingError, cancelDevicePairingSetup, decideDevicePairingRequest, operateDevicePairingRequest, readDevicePairingSetup, submitDevicePairingRequest } from "../../../storage/sqlite/device-pairing-approval.js";
+import os from "node:os";
+import { z } from "zod";
+//#region src/gateway/hono/routes/device-pairing-approval.ts
+function pairingError(c, error) {
+	if (error instanceof DevicePairingError) return c.json({
+		ok: false,
+		error: {
+			code: error.code,
+			message: error.code
+		}
+	}, error.status);
+	return c.json({
+		ok: false,
+		error: {
+			code: "PAIRING_FAILED",
+			message: "Pairing could not be completed"
+		}
+	}, 500);
+}
+function registerPairingApprovalPublicRoutes(app) {
+	for (const action of [
+		"request",
+		"status",
+		"complete",
+		"cancel"
+	]) {
+		const path = action === "request" ? "/api/device-pairing/requests" : `/api/device-pairing/requests/:id/${action}`;
+		app.post(path, async (c) => {
+			const parsed = (action === "request" ? devicePairingRequestSchema : action === "complete" ? devicePairingCompleteSchema : devicePairingProofSchema).safeParse(await c.req.json().catch(() => null));
+			if (!parsed.success || action !== "request" && parsed.data.requestId !== c.req.param("id")) return c.json({
+				ok: false,
+				error: {
+					code: "BAD_REQUEST",
+					message: "Invalid pairing request"
+				}
+			}, 400);
+			try {
+				const result = action === "request" ? { request: submitDevicePairingRequest(parsed.data) } : operateDevicePairingRequest(action, parsed.data);
+				const signedPayload = Buffer.from(JSON.stringify({
+					...result,
+					gateway: {
+						id: getOrCreateGatewayIdentity().id,
+						name: os.hostname()
+					},
+					nonce: parsed.data.nonce,
+					issuedAt: Date.now()
+				})).toString("base64url");
+				return c.json({
+					ok: true,
+					signedPayload,
+					signature: signGatewayPayload(signedPayload)
+				});
+			} catch (error) {
+				return pairingError(c, error);
+			}
+		});
+	}
+}
+function registerPairingApprovalAdminRoutes(app) {
+	app.get("/api/device-pairing/setups/:id", (c) => {
+		try {
+			return c.json({
+				ok: true,
+				...readDevicePairingSetup(c.req.param("id"))
+			});
+		} catch (error) {
+			return pairingError(c, error);
+		}
+	});
+	app.delete("/api/device-pairing/setups/:id", (c) => {
+		cancelDevicePairingSetup(c.req.param("id"));
+		return c.json({ ok: true });
+	});
+	app.post("/api/device-pairing/requests/:id/decision", async (c) => {
+		const parsed = z.strictObject({
+			decision: z.enum(["approve", "reject"]),
+			expectedRevision: z.number().int().positive()
+		}).safeParse(await c.req.json().catch(() => null));
+		if (!parsed.success) return c.json({
+			ok: false,
+			error: {
+				code: "BAD_REQUEST",
+				message: "Invalid decision"
+			}
+		}, 400);
+		try {
+			return c.json({
+				ok: true,
+				request: decideDevicePairingRequest(c.req.param("id"), parsed.data.decision, parsed.data.expectedRevision)
+			});
+		} catch (error) {
+			return pairingError(c, error);
+		}
+	});
+}
+//#endregion
+export { registerPairingApprovalAdminRoutes, registerPairingApprovalPublicRoutes };

package/dist/src/gateway/hono/routes/devices.js

@@ -5,6 +5,7 @@ import { getGatewayIdentityPublicKeyRaw, getOrCreateGatewayIdentity, signGateway
 import { consumeDevicePairingToken, createDevicePairingSetup, isDevicePairingSetupActive } from "../../../storage/sqlite/device-pairing-repository.js";
 import { resolveSecureDeviceRoutes } from "../../device-routes.js";
 import { getGatewayPrincipal } from "../../security/gateway-principal.js";
+import { registerPairingApprovalAdminRoutes, registerPairingApprovalPublicRoutes } from "./device-pairing-approval.js";
 import os from "node:os";
 import { z } from "zod";
 //#region src/gateway/hono/routes/devices.ts
@@ -31,12 +32,10 @@ const pairingExchangeSchema = z.strictObject({
 });
 const pairingProbeSchema = z.strictObject({ pairingId: z.string().uuid() });
 function pairingLinkPayload(input) {
-	return Buffer.from(JSON.stringify({
-		version: 2,
-		...input
-	})).toString("base64url");
+	return Buffer.from(JSON.stringify(input)).toString("base64url");
 }
 function registerDeviceAuthPublicRoutes(app) {
+	registerPairingApprovalPublicRoutes(app);
 	app.post("/api/device-auth/refresh", async (c) => {
 		const parsed = refreshRequestSchema.safeParse(await c.req.json().catch(() => null));
 		if (!parsed.success) return c.json({
@@ -138,15 +137,21 @@ function registerDeviceAuthPublicRoutes(app) {
 	});
 }
 function registerDeviceRoutes(authenticated, deps) {
+	registerPairingApprovalAdminRoutes(authenticated);
 	authenticated.get("/api/device-pairing/readiness", (c) => {
 		const routes = resolveSecureDeviceRoutes(deps.service.currentConfig);
 		return c.json({
 			ok: true,
 			ready: routes.length > 0,
-			routes
+			routes,
+			protocolVersions: [2, 3],
+			routeState: routes.length > 0 ? "configured" : "missing",
+			nextAction: routes.length > 0 ? "scan" : "configure-route",
+			serverTime: Date.now()
 		});
 	});
-	authenticated.post("/api/device-pairing/setups", (c) => {
+	authenticated.post("/api/device-pairing/setups", async (c) => {
+		const version = (await c.req.json().catch(() => ({}))).protocolVersion === 3 ? 3 : 2;
 		const routes = resolveSecureDeviceRoutes(deps.service.currentConfig);
 		if (routes.length === 0) return c.json({
 			ok: false,
@@ -155,9 +160,10 @@ function registerDeviceRoutes(authenticated, deps) {
 				message: "Configure XOPC Secure Link, Tailscale Serve, or an HTTPS public URL first"
 			}
 		}, 409);
-		const setup = createDevicePairingSetup(routes);
+		const setup = createDevicePairingSetup(routes, Date.now(), version);
 		const identity = getOrCreateGatewayIdentity();
 		const encoded = pairingLinkPayload({
+			version,
 			pairingToken: setup.token,
 			gatewayId: identity.id,
 			gatewayName: os.hostname(),
@@ -171,7 +177,8 @@ function registerDeviceRoutes(authenticated, deps) {
 				id: setup.id,
 				universalLink: `https://link.xopc.ai/connect#p=${encoded}`,
 				expiresAt: setup.expiresAt,
-				routes
+				routes,
+				protocolVersion: version
 			}
 		}, 201);
 	});

package/dist/src/gateway/hono/routes/execution-environments.d.ts

@@ -0,0 +1,3 @@
+import type { Hono } from 'hono';
+import type { AuthenticatedRouteDeps } from './deps.js';
+export declare function registerExecutionEnvironmentRoutes(authenticated: Hono, deps: AuthenticatedRouteDeps): void;