@xopcai/xopc 0.0.249 → 0.0.251

package/dist/src/connectors/connection-recovery-service.js

@@ -1,17 +1,19 @@
 import { createLogger } from "../utils/logger/index.js";
 import { init_logger } from "../utils/logger.js";
 import { getSqliteDatabase } from "../storage/sqlite/transaction.js";
-import { cancelConnectionObjective, getActiveConnectionWait, getConnectionWait, listConnectionWaitsToCheck, publishConnectionWait, queueConnectionResolution, updateConnectionWait } from "../storage/sqlite/connection-wait-repository.js";
-import { readCurrentSessionId } from "../storage/sqlite/session-repository.js";
+import { readCurrentSessionId } from "../storage/sqlite/session-instance-repository.js";
 import { getSessionInputState } from "../storage/sqlite/session-input-repository.js";
+import { cancelConnectionObjective, getActiveConnectionWait, getConnectionWait, listConnectionWaitsToCheck, publishConnectionWait, queueConnectionResolution, updateConnectionWait } from "../storage/sqlite/connection-wait-repository.js";
+import "../storage/sqlite/session-repository.js";
 import { getConnectorInstallation, listConnectorConnections, upsertConnectorInstallation } from "../storage/sqlite/connector-repository.js";
+import { getConnectorAccount } from "../storage/sqlite/connector-account-repository.js";
 import { ComposioSessionsAdapter } from "./composio-sessions.js";
 import { getConfiguredComposioAuthConfigs, isComposioActionAllowedByCatalog, scopeForComposioAction } from "./composio.js";
 import { getConnectorDefinition } from "./catalog.js";
 import { capabilityActions, isToolInputSchema, missingConnectionCapabilities } from "./connection-capabilities.js";
 import { connectorPrincipalForSession } from "./principal.js";
 import { resolveConnectionCandidate } from "./connection-candidates.js";
-import { getConnectorInstance } from "./instances.js";
+import { listConnectorInstances } from "./instances.js";
 import { installConnector } from "./install.js";
 import { persistConfigMutation } from "../config/config-mutation.js";
 import { randomUUID } from "node:crypto";
@@ -79,7 +81,7 @@ var ConnectionRecoveryService = class {
 	}
 	view(wait, verifiedIds) {
 		const needs = wait.needs.map((need) => {
-			const instance = getConnectorInstance(this.deps.getConfig(), need.connectorId);
+			const instance = listConnectorInstances(this.deps.getConfig()).find((instance) => instance.connectorId === need.connectorId);
 			const installation = getConnectorInstallation(`${need.connectorId}-${wait.principalId}`);
 			const scopeBlocked = Math.max(1, ...need.capabilities.filter((capability) => /^[A-Z]+_/.test(capability)).map((capability) => SCOPE_ORDER[scopeForComposioAction(capability).scope])) > SCOPE_ORDER[installation?.maxScope ?? "read"];
 			const blocked = scopeBlocked || instance?.enabled === false || installation?.enabled === false || Boolean(installation?.allowedAgentIds.length && !installation.allowedAgentIds.includes(wait.agentId));
@@ -87,9 +89,17 @@ var ConnectionRecoveryService = class {
 				principalId: wait.principalId,
 				connectorId: need.connectorId
 			});
-			const active = all.filter((connection) => connection.status === "active" && (!verifiedIds || verifiedIds.has(connection.id)) && (!need.accountId || connection.accountId === need.accountId) && (!installation?.selectedConnectionIds.length || installation.selectedConnectionIds.includes(connection.id)));
+			const eligible = all.filter((connection) => connection.status === "active" && (!verifiedIds || verifiedIds.has(connection.id)) && (!need.accountId || connection.accountId === need.accountId) && (!installation?.selectedConnectionIds.length || installation.selectedConnectionIds.includes(connection.id)));
+			const byAccount = /* @__PURE__ */ new Map();
+			for (const connection of eligible) {
+				const key = connection.accountId ?? connection.id;
+				const previous = byAccount.get(key);
+				const preferredId = need.connectionId ?? eligible.find((item) => item.providerConnectionId === need.attempt?.connectionId)?.id ?? (connection.accountId ? getConnectorAccount(connection.accountId)?.currentConnectionId : void 0);
+				if (!previous || connection.id === preferredId || previous.id !== preferredId && connection.updatedAt > previous.updatedAt) byAccount.set(key, connection);
+			}
+			const active = [...byAccount.values()];
 			const selected = !verifiedIds && need.unavailable ? void 0 : need.attempt ? active.find((connection) => connection.providerConnectionId === need.attempt?.connectionId) : need.connectionId ? active.find((connection) => connection.id === need.connectionId) : active.length === 1 && !need.accountSelector ? active[0] : void 0;
-			const phase = blocked || selected && need.capabilityError ? "blocked" : selected && instance ? "ready" : active.length > 1 || need.accountSelector && active.length > 0 && !need.connectionId ? "choose_account" : need.attempt && need.attempt.expiresAt > Date.now() ? "authorizing" : need.unavailable || all.some((connection) => [
+			const phase = blocked || selected && need.capabilityError ? "blocked" : selected ? "ready" : active.length > 1 || need.accountSelector && active.length > 0 && !need.connectionId ? "choose_account" : need.attempt && need.attempt.expiresAt > Date.now() ? "authorizing" : need.unavailable || all.some((connection) => [
 				"expired",
 				"revoked",
 				"failed"
@@ -121,6 +131,28 @@ var ConnectionRecoveryService = class {
 			phase: wait.status === "queued" ? "queued" : ready ? review ? "review_scope" : "ready" : "needs_connection"
 		};
 	}
+	async ensureInstallation(wait, connectorId) {
+		const config = this.deps.getConfig();
+		const instance = listConnectorInstances(config).find((item) => item.connectorId === connectorId);
+		const installationId = `${connectorId}-${wait.principalId}`;
+		const installation = getConnectorInstallation(installationId);
+		if (instance?.enabled === false || installation?.enabled === false || installation?.allowedAgentIds.length && !installation.allowedAgentIds.includes(wait.agentId)) throw new Error("Connector policy blocks this connection.");
+		if (!instance) await persistConfigMutation({
+			config,
+			mutate: () => installConnector(config, connectorId, {}),
+			save: () => this.deps.saveConfig(config)
+		});
+		if (!installation) upsertConnectorInstallation({
+			id: installationId,
+			connectorId,
+			principalId: wait.principalId,
+			enabled: true,
+			allowedAgentIds: [],
+			maxScope: "read",
+			confirmationPolicy: "writes",
+			selectedConnectionIds: []
+		});
+	}
 	async checkCapabilities(wait, verified) {
 		const views = this.view({
 			...wait,
@@ -135,6 +167,7 @@ var ConnectionRecoveryService = class {
 				capabilityError: void 0
 			};
 			try {
+				if (!listConnectorInstances(this.deps.getConfig()).some((instance) => instance.connectorId === need.connectorId && instance.enabled)) throw new Error("Connector setup is unavailable");
 				const definition = getConnectorDefinition(need.connectorId);
 				if (definition?.runtime.type !== "composio" || definition.runtime.role !== "toolkit") throw new Error("Unsupported connector");
 				const toolkit = definition.runtime.toolkit;
@@ -261,22 +294,8 @@ var ConnectionRecoveryService = class {
 				}, wait.version);
 				publishConnectionWait(sessionKey);
 				const config = this.deps.getConfig();
-				if (!getConnectorInstance(config, need.connectorId)) await persistConfigMutation({
-					config,
-					mutate: () => installConnector(config, need.connectorId, {}),
-					save: () => this.deps.saveConfig(config)
-				});
+				await this.ensureInstallation(wait, need.connectorId);
 				const installationId = `${need.connectorId}-${wait.principalId}`;
-				if (!getConnectorInstallation(installationId)) upsertConnectorInstallation({
-					id: installationId,
-					connectorId: need.connectorId,
-					principalId: wait.principalId,
-					enabled: true,
-					allowedAgentIds: [],
-					maxScope: "read",
-					confirmationPolicy: "writes",
-					selectedConnectionIds: []
-				});
 				const auth = await this.adapter.authorize({
 					principalId: wait.principalId,
 					toolkit: definition.runtime.toolkit,
@@ -335,9 +354,14 @@ var ConnectionRecoveryService = class {
 						...item,
 						connectionId: connection.id,
 						accountId: connection.accountId,
-						unavailable: false
+						unavailable: false,
+						attempt: void 0
 					} : item);
 				}
+				for (const selected of this.view({
+					...wait,
+					needs
+				}, verified).needs) if (selected.phase === "ready" || selected.capabilityError && selected.connectionId) await this.ensureInstallation(wait, selected.connectorId);
 				needs = await this.checkCapabilities({
 					...wait,
 					needs

package/dist/src/extensions/lockfile.js

@@ -1,7 +1,7 @@
 import { createLogger } from "../utils/logger/index.js";
 import { init_logger } from "../utils/logger.js";
-import { init_paths, resolveExtensionsDir, resolveExtensionsLockPath } from "../config/paths.js";
 import { init_write_file_atomic, writeTextAtomic } from "../infra/write-file-atomic.js";
+import { init_paths, resolveExtensionsDir, resolveExtensionsLockPath } from "../config/paths.js";
 import { dirname, join } from "path";
 import { existsSync } from "fs";
 import { mkdir, readFile } from "fs/promises";

package/dist/src/files/file-service.js

@@ -4,7 +4,7 @@ import "../projects/index.js";
 import { basename, dirname, isAbsolute, relative, resolve, sep } from "node:path";
 import { constants } from "node:fs";
 import { createHash } from "node:crypto";
-import { access, lstat, opendir, realpath, stat } from "node:fs/promises";
+import { access, lstat, open, opendir, realpath, stat } from "node:fs/promises";
 //#region src/files/file-service.ts
 init_agent_scope();
 const SKIPPED_NAMES = new Set([
@@ -12,26 +12,120 @@ const SKIPPED_NAMES = new Set([
 	".git",
 	"node_modules"
 ]);
+const TEXT_SNIFF_BYTES = 8 * 1024;
 const TEXT_EXTENSIONS = new Set([
+	"astro",
+	"bash",
+	"bat",
+	"c",
+	"cc",
+	"cfg",
+	"clj",
+	"cljs",
+	"cljc",
+	"cmd",
+	"conf",
+	"cpp",
+	"cs",
 	"css",
 	"csv",
-	"html",
+	"cts",
+	"cxx",
+	"dart",
+	"editorconfig",
+	"edn",
+	"env",
+	"erl",
+	"ex",
+	"exs",
+	"fish",
+	"fs",
+	"fsx",
+	"gitattributes",
+	"gitignore",
+	"go",
+	"gql",
+	"graphql",
+	"groovy",
+	"h",
+	"hh",
+	"hpp",
+	"hrl",
 	"htm",
+	"html",
+	"hxx",
+	"ini",
+	"java",
 	"js",
 	"json",
+	"json5",
+	"jsonc",
 	"jsx",
-	"md",
+	"kt",
+	"kts",
+	"less",
+	"lock",
+	"log",
+	"lua",
+	"m",
 	"markdown",
+	"md",
 	"mjs",
-	"cjs",
+	"mm",
+	"mts",
+	"nix",
+	"npmrc",
+	"php",
+	"pl",
+	"pm",
+	"properties",
+	"proto",
+	"ps1",
+	"py",
+	"pyw",
+	"r",
+	"rb",
+	"rs",
+	"sass",
+	"scala",
+	"scss",
+	"sh",
+	"sol",
+	"sql",
+	"svelte",
 	"svg",
+	"swift",
+	"tf",
+	"tfvars",
+	"toml",
 	"ts",
-	"tsx",
 	"tsv",
+	"tsx",
 	"txt",
+	"vue",
 	"xml",
+	"xsd",
+	"xsl",
 	"yaml",
-	"yml"
+	"yml",
+	"zsh"
+]);
+const TEXT_FILE_NAMES = new Set([
+	".dockerignore",
+	".eslintignore",
+	".prettierignore",
+	".stylelintignore",
+	"brewfile",
+	"changelog",
+	"codeowners",
+	"dockerfile",
+	"gemfile",
+	"jenkinsfile",
+	"license",
+	"makefile",
+	"procfile",
+	"rakefile",
+	"readme"
 ]);
 const MIME_TYPES = {
 	png: "image/png",
@@ -82,16 +176,49 @@ function normalizeRelativePath(input) {
 	if (normalized.includes("\0") || normalized.split("/").some((part) => part === "..")) throw new FileServiceError(400, "Invalid file path");
 	return normalized.split("/").filter((part) => part && part !== ".").join("/");
 }
-function mimeType(name, directory) {
+function fileExtension(name) {
+	return name.includes(".") ? name.split(".").pop().toLowerCase() : "";
+}
+function isTextFileName(name) {
+	const normalized = name.toLowerCase();
+	const extension = fileExtension(normalized);
+	return TEXT_EXTENSIONS.has(extension) || TEXT_FILE_NAMES.has(normalized) || normalized.startsWith(".env.") || normalized.startsWith("dockerfile.");
+}
+function bufferLooksText(buffer) {
+	if (buffer.length === 0) return true;
+	let controlBytes = 0;
+	for (const byte of buffer) {
+		if (byte === 0) return false;
+		if ((byte < 8 || byte > 13 && byte < 32) && byte !== 27) controlBytes += 1;
+	}
+	return controlBytes / buffer.length < .01;
+}
+async function isTextFile(name, absolutePath) {
+	if (isTextFileName(name)) return true;
+	if (MIME_TYPES[fileExtension(name)]) return false;
+	const handle = await open(absolutePath, "r").catch(() => null);
+	if (!handle) return false;
+	try {
+		const buffer = Buffer.allocUnsafe(TEXT_SNIFF_BYTES);
+		const { bytesRead } = await handle.read(buffer, 0, buffer.length, 0);
+		return bufferLooksText(buffer.subarray(0, bytesRead));
+	} finally {
+		await handle.close();
+	}
+}
+function mimeType(name, directory, textFile) {
 	if (directory) return "inode/directory";
-	return MIME_TYPES[name.includes(".") ? name.split(".").pop().toLowerCase() : ""] ?? "application/octet-stream";
+	return MIME_TYPES[fileExtension(name)] ?? (textFile ? "text/plain" : "application/octet-stream");
 }
-function capabilities(name, directory, writable) {
+function capabilities(name, directory, writable, textFile) {
 	if (directory) return writable ? ["share", "upload"] : ["share"];
-	const extension = name.includes(".") ? name.split(".").pop().toLowerCase() : "";
+	const extension = fileExtension(name);
 	const result = ["download", "share"];
-	if (MIME_TYPES[extension] || TEXT_EXTENSIONS.has(extension)) result.unshift("preview");
-	if (writable && TEXT_EXTENSIONS.has(extension)) result.push("edit");
+	if (MIME_TYPES[extension] || textFile) result.unshift("preview");
+	if (writable) {
+		if (textFile) result.push("edit");
+		result.push("delete");
+	}
 	return result;
 }
 function fileSpaceId(root) {
@@ -143,6 +270,7 @@ async function fileResourceFromPath(space, absolutePath, displayPath = absoluteP
 	const relativePath = relative(await realpath(space.root), displayPath).split(sep).join("/");
 	const name = basename(displayPath);
 	const directory = info.isDirectory();
+	const textFile = !directory && await isTextFile(name, absolutePath);
 	return {
 		id: fileResourceId(space.id, relativePath),
 		spaceId: space.id,
@@ -150,11 +278,11 @@ async function fileResourceFromPath(space, absolutePath, displayPath = absoluteP
 		relativePath,
 		parentPath: dirname(relativePath).split(sep).join("/").replace(/^\.$/, ""),
 		kind: directory ? "directory" : "file",
-		mimeType: mimeType(name, directory),
+		mimeType: mimeType(name, directory, textFile),
 		size: info.size,
 		modifiedAt: Math.max(0, Math.round(info.mtimeMs)),
 		revision: `${revisionInfo.mtimeNs}:${revisionInfo.ctimeNs}:${revisionInfo.ino}:${revisionInfo.size}`,
-		capabilities: capabilities(name, directory, space.writable)
+		capabilities: capabilities(name, directory, space.writable, textFile)
 	};
 }
 var FileSpaceService = class {

package/dist/src/gateway/agents-admin.js

@@ -1,6 +1,6 @@
 import { init_agent_scope, listAgentEntries, normalizeAgentId, resolveAgentDir, resolveAgentProfileDir, resolveAgentWorkspaceDir, resolveDefaultAgentId, resolveUserPath, validateAgentIdForNewAgent } from "../agent/agent-scope.js";
-import { resolveEffectiveAgentProfile } from "../config/agent-profile.js";
 import { WORKSPACE_FILES, init_paths } from "../config/paths.js";
+import { resolveEffectiveAgentProfile } from "../config/agent-profile.js";
 import { AGENT_PROFILE_MARKDOWN_SYSTEM_FILES, REQUIRED_AGENT_PROFILE_MARKDOWN_FILE_SET } from "../agent/context/workspace.js";
 import { isPathUnderWorkspace, resolveWorkspaceSafePath } from "./workspace-editor-path.js";
 import { seedAgentProfileMarkdownFiles } from "../agent/context/workspace-seed.js";

package/dist/src/gateway/file-path-classifier.js

@@ -1,7 +1,7 @@
 import { init_paths_state, resolveStateDir } from "../config/paths-state.js";
 import { init_agent_scope, resolveAgentProfileDir } from "../agent/agent-scope.js";
-import { extractProfileAgentId } from "../config/agent-profile.js";
 import { init_paths, resolveConfigPath, resolveSkillsDir } from "../config/paths.js";
+import { extractProfileAgentId } from "../config/agent-profile.js";
 import { isBareProfileMarkdownFileName, resolveProfileMarkdownPathIfBareName } from "../agent/tools/tool-paths.js";
 import { isPathUnderWorkspace, resolveWorkspaceSafePath } from "./workspace-editor-path.js";
 import { basename, isAbsolute, resolve } from "node:path";

package/dist/src/gateway/heartbeat/service.js

@@ -1,9 +1,9 @@
 import { createLogger } from "../../utils/logger/index.js";
 import { init_logger } from "../../utils/logger.js";
 import { shouldSilence, stripHeartbeatToken } from "../../heartbeat/tokens.js";
-import { appendCronEventLines } from "../../heartbeat/event-prompt.js";
 import { isWithinActiveHours } from "../../heartbeat/active-hours.js";
 import { isHeartbeatContentEmpty } from "../../heartbeat/content-check.js";
+import { appendCronEventLines } from "../../heartbeat/event-prompt.js";
 import { createHeartbeatWake } from "../../heartbeat/wake.js";
 import { resolveHeartbeatMdPath } from "../workspace-heartbeat-path.js";
 import { readFile } from "fs/promises";

package/dist/src/gateway/hono/lib/config-payload.js

@@ -1,9 +1,9 @@
 import { ContextPlanningConfigSchema, KnowledgeMemoryConfigSchema, UserModelConfigSchema, init_config } from "../../../user-context/config.js";
 import { init_agent_scope, listAgentEntries, normalizeAgentId, resolveDefaultAgentId } from "../../../agent/agent-scope.js";
 import { resolveModelsJsonPath } from "../../../config/paths.js";
-import { buildChannelCatalogForConfig, buildChannelCatalogFromSnapshot, getChannelSetupStatus, init_channel_catalog_service } from "../../../channels/catalog/channel-catalog-service.js";
 import { init_models_json, loadModelsJson } from "../../../config/models-json.js";
 import { CredentialResolver, init_credentials } from "../../../auth/credentials.js";
+import { buildChannelCatalogForConfig, buildChannelCatalogFromSnapshot, getChannelSetupStatus, init_channel_catalog_service } from "../../../channels/catalog/channel-catalog-service.js";
 import { getProviderRegistry, init_plugin_registry } from "../../../providers/plugin-registry.js";
 import { getAllProviders, init_providers, isProviderConfigured } from "../../../providers/index.js";
 import { normalizeConfiguredMcpServers } from "../../../config/mcp-config-normalize.js";

package/dist/src/gateway/hono/routes/connectors.js

@@ -1,3 +1,4 @@
+import { hasGatewayScope } from "../../security/gateway-scopes.js";
 import { listConnectorLearningJobs } from "../../../storage/sqlite/connector-learning-repository.js";
 import { decideConnectorApproval, getConnectorApproval, listConnectorApprovals, listConnectorConnections } from "../../../storage/sqlite/connector-repository.js";
 import { getConnectorAccount } from "../../../storage/sqlite/connector-account-repository.js";
@@ -25,6 +26,7 @@ import { previewConnectorDefinition, testConnectorInstance } from "../../../conn
 import { listUnderstandingSourceGrants, revokeUnderstandingSourceGrant } from "../../../user-context/sources/repository.js";
 import { setConnectorEnabled } from "../../../connectors/lifecycle.js";
 import { projectComposioConnectionStatus } from "../../../connectors/runtime-status.js";
+import { getGatewayPrincipal } from "../../security/gateway-principal.js";
 import { markContextSourceAssertionsForReview } from "./context-sources.js";
 //#region src/gateway/hono/routes/connectors.ts
 init_agent_scope();
@@ -467,9 +469,15 @@ function registerConnectorRoutes(authenticated, deps) {
 			ok: false,
 			error: "Invalid approval status."
 		}, 400);
+		const principalId = c.req.query("principalId")?.trim() || "local-owner";
+		const sessionKey = c.req.query("sessionKey")?.trim() || void 0;
+		if (!hasGatewayScope(getGatewayPrincipal(c).scopes, "gateway.admin") && (!sessionKey || principalId !== "local-owner")) return c.json({
+			ok: false,
+			error: "A local-owner session is required to read confirmations."
+		}, 403);
 		const approvals = listConnectorApprovals({
-			principalId: c.req.query("principalId")?.trim() || "local-owner",
-			sessionKey: c.req.query("sessionKey")?.trim() || void 0,
+			principalId,
+			sessionKey,
 			status,
 			limit: Number(c.req.query("limit") ?? "100")
 		});
@@ -582,10 +590,16 @@ function registerConnectorRoutes(authenticated, deps) {
 			ok: false,
 			error: "Approval id and an approved or denied decision are required."
 		}, 400);
-		if (!getConnectorApproval(id)) return c.json({
+		const current = getConnectorApproval(id);
+		if (!current) return c.json({
 			ok: false,
 			error: "Connector approval not found."
 		}, 404);
+		const sessionKey = typeof record.sessionKey === "string" ? record.sessionKey.trim() : "";
+		if (!hasGatewayScope(getGatewayPrincipal(c).scopes, "gateway.admin") && (!sessionKey || current.sessionKey !== sessionKey || current.principalId !== "local-owner")) return c.json({
+			ok: false,
+			error: "Confirmation does not belong to the requested local-owner session."
+		}, 403);
 		const approval = decideConnectorApproval(id, decision);
 		if (!approval || approval.status !== decision) return c.json({
 			ok: false,

package/dist/src/gateway/hono/routes/files.js

@@ -1,9 +1,9 @@
-import { FileServiceError, fileResourceFromPath, resolveFilePath } from "../../../files/file-service.js";
+import { FileServiceError, fileResourceFromPath, parseFileResourceId, resolveFilePath } from "../../../files/file-service.js";
 import { getGatewayFileSpaceService } from "../../file-space-service.js";
 import { fuzzySearchWorkspaceFiles, fuzzySubsequenceScore } from "../../workspace-file-search.js";
 import { registerFileReferenceRoutes } from "./file-references.js";
 import { basename, join } from "node:path";
-import { readFile, writeFile } from "node:fs/promises";
+import { readFile, unlink, writeFile } from "node:fs/promises";
 //#region src/gateway/hono/routes/files.ts
 const mutationLocks = /* @__PURE__ */ new Map();
 async function withMutationLock(key, action) {
@@ -185,6 +185,27 @@ function registerFilesRoutes(authenticated, deps) {
 			return errorResponse(c, error);
 		}
 	});
+	authenticated.delete("/api/files/:id", async (c) => {
+		try {
+			const id = c.req.param("id");
+			const initial = await files.resource(id);
+			if (!initial.space.writable) throw new FileServiceError(403, "File space is read-only");
+			if (initial.resource.kind !== "file") throw new FileServiceError(400, "Resource is not a file");
+			await withMutationLock(initial.absolutePath, async () => {
+				const current = await files.resource(id);
+				if (current.absolutePath !== initial.absolutePath) throw new FileServiceError(409, "File has changed");
+				if (current.resource.kind !== "file") throw new FileServiceError(400, "Resource is not a file");
+				const { relativePath } = parseFileResourceId(id);
+				await unlink(await resolveFilePath(current.space.root, relativePath, false)).catch((error) => {
+					if (error.code === "ENOENT") throw new FileServiceError(404, "File not found");
+					throw error;
+				});
+			});
+			return c.json({ ok: true });
+		} catch (error) {
+			return errorResponse(c, error);
+		}
+	});
 	authenticated.post("/api/files/spaces/:id/upload", async (c) => {
 		try {
 			const space = await files.get(c.req.param("id"));

package/dist/src/gateway/hono/routes/models.js

@@ -1,5 +1,5 @@
-import { resolveModelsJsonPath } from "../../../config/paths.js";
 import { init_resolve_config_value, testApiKeyResolution } from "../../../config/resolve-config-value.js";
+import { resolveModelsJsonPath } from "../../../config/paths.js";
 import { init_models_json, loadModelsJson, saveModelsJson, validateModelsConfig } from "../../../config/models-json.js";
 import { getModelCatalogStore, init_model_catalog_store } from "../../../providers/model-catalog-store.js";
 import { getModelRegistry } from "../../../providers/model-registry.js";

package/dist/src/gateway/hono/routes/tasks.js

@@ -25,7 +25,7 @@ function registerTaskRoutes(authenticated, deps) {
 	const taskRateLimit = deps.taskRateLimitMiddleware ?? deps.strictRateLimitMiddleware;
 	const application = new TaskApplicationService();
 	const operatingViews = new ProjectOperatingViewService(deps.service.projects);
-	const monitoring = new ProjectMonitoringService();
+	const monitoring = new ProjectMonitoringService(deps.service.currentWorkspacePath);
 	const metrics = new TaskValueMetricsService();
 	const tasks = new TaskRepository();
 	const runs = new TaskRunRepository();

package/dist/src/gateway/security/gateway-scopes.js

@@ -48,6 +48,8 @@ function requiredGatewayScope(method, path) {
 	if (path === "/api/device-auth/refresh" || path === "/api/devices/me") return "device.self";
 	if (path.startsWith("/api/devices/me/push")) return "notifications.self";
 	if (path.startsWith("/api/endpoint-tools")) return "device.self";
+	if (method === "GET" && path === "/api/connectors/approvals") return "sessions.read";
+	if (method === "POST" && path === "/api/connectors/approvals/respond") return "sessions.write";
 	if (path === "/api/agent" || path.startsWith("/api/agent/")) return "agents.run";
 	if (path.startsWith("/api/agents") || path.startsWith("/api/models")) return methodScope(method, "agents.read", "gateway.admin");
 	if (path.startsWith("/api/sessions") || path.startsWith("/api/side-chats")) return methodScope(method, "sessions.read", "sessions.write");

package/dist/src/gateway/service/agent-runner.js

@@ -1,7 +1,7 @@
 import { createLogger } from "../../utils/logger/index.js";
 import { init_logger } from "../../utils/logger.js";
-import { onConnectionWaitChanged } from "../../storage/sqlite/connection-wait-repository.js";
 import { listActiveSessionInputRuns } from "../../storage/sqlite/session-input-repository.js";
+import { onConnectionWaitChanged } from "../../storage/sqlite/connection-wait-repository.js";
 import "../../storage/sqlite/index.js";
 import { ClarifyBridge } from "../clarify-bridge.js";
 import { runGatewayAgent } from "./run-gateway-agent.js";

package/dist/src/gateway/service/config-coordinator.js

@@ -1,7 +1,7 @@
 import { createLogger } from "../../utils/logger/index.js";
 import { init_logger } from "../../utils/logger.js";
-import { loadConfig, saveConfig } from "../../config/loader.js";
 import { getModelRegistry } from "../../providers/model-registry.js";
+import { loadConfig, saveConfig } from "../../config/loader.js";
 import { init_providers } from "../../providers/index.js";
 import { disposeAllSessionMcpRuntimes } from "../../agent/mcp/bundle-mcp-runtime.js";
 import { reloadImageGenerationProviders } from "../../agent/image/generation/provider-registry.js";

package/dist/src/gateway/service/run-gateway-agent.js

@@ -1,8 +1,8 @@
 import { inboundCorrelationMetadataFromAsyncLogContext, updateAsyncLogContext } from "../../utils/logger/context.js";
 import { createLogger } from "../../utils/logger/index.js";
 import { init_logger } from "../../utils/logger.js";
-import { getConnectionResumeInput, isConnectionSuspended } from "../../storage/sqlite/connection-wait-repository.js";
 import { updateInteractionStateFromMessage } from "../../storage/sqlite/interaction-state-repository.js";
+import { getConnectionResumeInput, isConnectionSuspended } from "../../storage/sqlite/connection-wait-repository.js";
 import "../../storage/sqlite/index.js";
 import { init_session_key, parseSessionKey } from "../../routing/session-key.js";
 import { resolveExecutionContext } from "../../tasks/execution-context.js";

package/dist/src/gateway/service/session-input-coordinator.js

@@ -1,8 +1,8 @@
 import { createLogger } from "../../utils/logger/index.js";
 import { init_logger } from "../../utils/logger.js";
-import { cancelConnectionObjective, consumeConnectionResume, invalidateConnectionResumeIntent, publishConnectionWait } from "../../storage/sqlite/connection-wait-repository.js";
 import { SessionInstanceChangedError, cancelQueuedSessionInput, claimNextSessionInput, findSessionInput, finishSessionInputRun, getSessionInputById, getSessionInputState, insertSessionInput, mutateQueuedSessionInput, recoverSessionInputState, setSessionInputStatus } from "../../storage/sqlite/session-input-repository.js";
 import { replaceLatestSessionTurnAndQueueInput, validateLatestSessionTurnTarget } from "../../storage/sqlite/session-turn-replace-repository.js";
+import { cancelConnectionObjective, consumeConnectionResume, invalidateConnectionResumeIntent, publishConnectionWait } from "../../storage/sqlite/connection-wait-repository.js";
 import "../../storage/sqlite/index.js";
 import { summarizeSourceContext } from "../../agent/source-context/types.js";
 import { deleteMediaUrisNoLongerReferenced } from "../../media/session-references.js";

package/dist/src/gateway/service.js

@@ -6,22 +6,22 @@ import { getRuntimeLogStats } from "../utils/logger/stats.js";
 import { createLogger } from "../utils/logger/index.js";
 import { init_logger } from "../utils/logger.js";
 import { closeXopcDatabase, openXopcDatabase } from "../storage/sqlite/connection.js";
-import { notifyUserContextChange } from "../user-context/changes.js";
 import { insertSessionInput } from "../storage/sqlite/session-input-repository.js";
+import { notifyUserContextChange } from "../user-context/changes.js";
 import { getSessionConfig } from "../storage/sqlite/config-repository.js";
 import "../storage/sqlite/index.js";
 import { getAgentDefaultModelRef, init_schema } from "../config/schema.js";
 import { init_agent_scope, listAgentEntries, normalizeAgentId, resolveAgentWorkspaceDir, resolveDefaultAgentId } from "../agent/agent-scope.js";
-import { buildSessionKey, init_session_key, sanitizeSegment } from "../routing/session-key.js";
-import { getDefaultAgentId, init_resolve_route } from "../routing/resolve-route.js";
-import { resolveEffectiveAgentProfileForSession } from "../config/agent-profile.js";
 import { init_paths, resolveConfigPath, resolveExtensionsDir } from "../config/paths.js";
+import { prewarmModelRegistry } from "../providers/model-registry.js";
 import { areExtensionsGloballyDisabled } from "../extensions/discover-extensions.js";
 import { buildExtensionMetadataSnapshot } from "../extensions/extension-metadata-snapshot.js";
 import { buildChannelCatalogForConfig, buildChannelCatalogFromSnapshot, init_channel_catalog_service } from "../channels/catalog/channel-catalog-service.js";
 import { loadConfig, saveConfig } from "../config/loader.js";
-import { prewarmModelRegistry } from "../providers/model-registry.js";
+import { buildSessionKey, init_session_key, sanitizeSegment } from "../routing/session-key.js";
+import { getDefaultAgentId, init_resolve_route } from "../routing/resolve-route.js";
 import { init_providers, providers_exports } from "../providers/index.js";
+import { resolveEffectiveAgentProfileForSession } from "../config/agent-profile.js";
 import { TaskRepository } from "../tasks/task-repository.js";
 import { TaskConversationRepository } from "../tasks/task-conversation-repository.js";
 import { getEmbeddedExecutionSession } from "../agent/embedded/execution-context.js";
@@ -366,9 +366,9 @@ var GatewayService = class {
 		this.workspacePath = getWorkspacePath(this.config) || "./workspace";
 		this.initializeExtensionLoader();
 		this.sessionIndex = new SessionIndex({ config: this.config });
-		this.automationService = new AutomationService(this.proactive);
+		this.automationService = new AutomationService(this.proactive, this.workspacePath);
 		this.notesService = new NotesService(new NotesStore());
-		this.projects = new ProjectService(void 0, this.proactive);
+		this.projects = new ProjectService(void 0, this.proactive, this.workspacePath);
 		const emitDiscussion = (capture) => {
 			this.emit("discussion.updated", capture);
 		};
@@ -1096,7 +1096,11 @@ var GatewayService = class {
 		log.debug("Gateway service started");
 	}
 	ensureDefaultProactiveScenarioSubscriptions() {
-		for (const scenarioKey of ["meeting_preparation", "discussion_follow_up"]) {
+		for (const scenarioKey of [
+			"automation_failure_impact",
+			"meeting_preparation",
+			"discussion_follow_up"
+		]) {
 			if (this.proactiveScenarios.subscriptions(scenarioKey).some((subscription) => subscription.workspaceId === this.currentWorkspacePath)) continue;
 			this.proactiveScenarios.subscribe({
 				scenarioKey,

package/dist/src/heartbeat/index.js

@@ -1,6 +1,6 @@
 import { DEFAULT_ACK_MAX_CHARS, HEARTBEAT_OK, NO_REPLY, shouldSilence, stripHeartbeatToken } from "./tokens.js";
-import { appendCronEventLines } from "./event-prompt.js";
 import { isWithinActiveHours } from "./active-hours.js";
 import { isHeartbeatContentEmpty } from "./content-check.js";
+import { appendCronEventLines } from "./event-prompt.js";
 import { createHeartbeatWake } from "./wake.js";
 export { DEFAULT_ACK_MAX_CHARS, HEARTBEAT_OK, NO_REPLY, appendCronEventLines, createHeartbeatWake, isHeartbeatContentEmpty, isWithinActiveHours, shouldSilence, stripHeartbeatToken };

package/dist/src/knowledge-memory/domain.d.ts

@@ -3,6 +3,7 @@ export type KnowledgeKind = 'project_fact' | 'workspace_fact' | 'decision' | 'ta
 export type KnowledgeStatus = 'candidate' | 'active' | 'needs_review' | 'stale' | 'archived' | 'rejected';
 export type KnowledgeOriginClass = 'owner' | 'agent' | 'system' | 'untrusted';
 export type KnowledgeRecordClass = 'memory' | 'source_index';
+export type KnowledgeSource = 'session' | 'workspace' | 'project' | 'connector';
 export interface KnowledgeItem {
     id: string;
     principalId: string;

package/dist/src/knowledge-memory/index.js

@@ -1,2 +1,2 @@
-import { getKnowledgeItem, listKnowledgeItems, searchKnowledgeItems, setKnowledgeStatus, writeKnowledgeItem } from "./repository.js";
-export { getKnowledgeItem, listKnowledgeItems, searchKnowledgeItems, setKnowledgeStatus, writeKnowledgeItem };
+import { getKnowledgeItem, knowledgeSourceAllowed, listKnowledgeItems, searchKnowledgeItems, setKnowledgeStatus, writeKnowledgeItem } from "./repository.js";
+export { getKnowledgeItem, knowledgeSourceAllowed, listKnowledgeItems, searchKnowledgeItems, setKnowledgeStatus, writeKnowledgeItem };