@xopcai/xopc 0.0.264 → 0.0.266

package/dist/src/gateway/hono/routes/session-input-handler.d.ts

@@ -18,6 +18,12 @@ export declare function submitSessionInput(c: Context, deps: AuthenticatedRouteD
         code: string;
         message: string;
     };
+}, 403, "json">) | (Response & import("hono").TypedResponse<{
+    ok: false;
+    error: {
+        code: string;
+        message: string;
+    };
 }, 409, "json">) | (Response & import("hono").TypedResponse<{
     ok: false;
     error: {
@@ -63,9 +69,12 @@ export declare function submitSessionInput(c: Context, deps: AuthenticatedRouteD
                     title: string;
                     tokenEstimate?: number;
                     truncated?: boolean;
+                    url?: string;
+                    capturedAt?: number;
+                    documentId?: string;
                 }[];
                 contextSnapshots?: {
-                    kind: import("../../../agent/source-context/types.js").SessionSourceBinding["kind"];
+                    kind: import("../../../agent/source-context/types.js").SessionSourceBinding["kind"] | "browser_page";
                     sourceId: string;
                     version: string;
                     title: string;
@@ -77,6 +86,9 @@ export declare function submitSessionInput(c: Context, deps: AuthenticatedRouteD
                     }[];
                     tokenEstimate?: number;
                     truncated?: boolean;
+                    url?: string;
+                    capturedAt?: number;
+                    documentId?: string;
                 }[];
                 thinking?: string;
                 origin: {
@@ -163,9 +175,12 @@ export declare function replaceLatestSessionTurn(c: Context, deps: Authenticated
                     title: string;
                     tokenEstimate?: number;
                     truncated?: boolean;
+                    url?: string;
+                    capturedAt?: number;
+                    documentId?: string;
                 }[];
                 contextSnapshots?: {
-                    kind: import("../../../agent/source-context/types.js").SessionSourceBinding["kind"];
+                    kind: import("../../../agent/source-context/types.js").SessionSourceBinding["kind"] | "browser_page";
                     sourceId: string;
                     version: string;
                     title: string;
@@ -177,6 +192,9 @@ export declare function replaceLatestSessionTurn(c: Context, deps: Authenticated
                     }[];
                     tokenEstimate?: number;
                     truncated?: boolean;
+                    url?: string;
+                    capturedAt?: number;
+                    documentId?: string;
                 }[];
                 thinking?: string;
                 origin: {

package/dist/src/gateway/hono/routes/session-input-handler.js

@@ -1,9 +1,11 @@
+import { browserPageContextsInputSchema } from "../../../../packages/gateway-contract/src/browser-page-context.js";
 import { endpointTurnClaimSchema } from "../../../../packages/endpoint-tools-protocol/src/index.js";
 import { init_providers, resolveModel } from "../../../providers/index.js";
 import { parseTurnContextRefs } from "../../../agent/source-context/types.js";
 import { getModelThinking } from "../../../providers/model-thinking.js";
 import { validateWebchatAttachments, validateWebchatContent } from "../../chat-limits.js";
 import { withModelConfigLock } from "../../../session/model-config-lock.js";
+import { browserPageContextToAgentContext } from "../../../agent/source-context/browser-page.js";
 //#region src/gateway/hono/routes/session-input-handler.ts
 init_providers();
 const MAX_TURN_CONTEXTS = 5;
@@ -25,6 +27,14 @@ async function submitSessionInput(c, deps, sessionKey) {
 			message: `contextRefs must contain at most ${MAX_TURN_CONTEXTS} valid notes`
 		}
 	}, 400);
+	const browserContexts = browserPageContextsInputSchema.safeParse(body.browserContexts ?? []);
+	if (!browserContexts.success) return c.json({
+		ok: false,
+		error: {
+			code: "BAD_REQUEST",
+			message: "Invalid browser page context"
+		}
+	}, 400);
 	const content = typeof body.content === "string" ? body.content : "";
 	const contentError = validateWebchatContent(content);
 	if (contentError) return c.json({
@@ -65,6 +75,13 @@ async function submitSessionInput(c, deps, sessionKey) {
 			message: "Endpoint connection is not active"
 		}
 	}, 401);
+	if (browserContexts.data.length && deps.service.endpointTools.registry.get(origin.data.endpointId)?.kind !== "browser") return c.json({
+		ok: false,
+		error: {
+			code: "FORBIDDEN",
+			message: "Browser context requires a browser endpoint"
+		}
+	}, 403);
 	if (body.expectedSessionId !== void 0 && (typeof body.expectedSessionId !== "string" || !body.expectedSessionId || body.expectedSessionId.length > 128)) return c.json({
 		ok: false,
 		error: {
@@ -115,6 +132,7 @@ async function submitSessionInput(c, deps, sessionKey) {
 			content,
 			attachments,
 			contextRefs,
+			sourceContexts: browserContexts.data.map(browserPageContextToAgentContext),
 			thinking: selection?.thinkingLevel ?? (typeof body.thinking === "string" ? body.thinking : void 0),
 			origin: {
 				type: "endpoint",

package/dist/src/gateway/hono/routes/sessions.js

@@ -1,3 +1,4 @@
+import { deleteBrowserTabBinding } from "../../../storage/sqlite/browser-tab-binding-repository.js";
 import { buildSessionKey, init_session_key } from "../../../routing/session-key.js";
 import { resolveProjectAgentId } from "../../../projects/project-agent.js";
 import "../../../projects/index.js";
@@ -245,6 +246,7 @@ function registerSessionsRoutes(authenticated, deps) {
 				}, 400);
 			}
 		}
+		if (body.createdSurface === "browser_extension") await service.sessions.patch(sessionKey, { customData: { createdSurface: "browser_extension" } });
 		const session = await service.sessions.getSession(sessionKey);
 		const agentConfig = channel === "webchat" ? await service.sessions.getFixedAgentConfig(sessionKey) : void 0;
 		return c.json({
@@ -657,6 +659,7 @@ function registerSessionsRoutes(authenticated, deps) {
 			ok: false,
 			error: result.error
 		}, 404);
+		deleteBrowserTabBinding(key);
 		if (requestedProjectId !== void 0) try {
 			if (requestedProjectId) service.projects.attachSession(key, requestedProjectId);
 			else service.projects.detachSession(key);
@@ -832,12 +835,15 @@ function registerSessionsRoutes(authenticated, deps) {
 			error: "Stop the active session run before deleting its environment"
 		}, 409);
 		const result = await service.sessions.delete(key);
-		if (result.deleted) await environments.release(key).catch((error) => {
-			log.warn({
-				err: error,
-				sessionKey: key
-			}, "Session deleted but execution environment cleanup failed");
-		});
+		if (result.deleted) {
+			deleteBrowserTabBinding(key);
+			await environments.release(key).catch((error) => {
+				log.warn({
+					err: error,
+					sessionKey: key
+				}, "Session deleted but execution environment cleanup failed");
+			});
+		}
 		return c.json(result);
 	});
 	authenticated.post("/api/sessions/:key/archive", async (c) => {

package/dist/src/gateway/hono/routes/voice.js

@@ -133,12 +133,13 @@ function registerVoiceRoutes(authenticated, deps) {
 				enabled,
 				capabilities: {
 					dictation: availability(Boolean(stt)),
-					agent: availability(Boolean(stt && tts)),
-					omni: availability(Boolean(omni)),
+					assistant: availability(Boolean(stt && tts)),
+					natural: availability(Boolean(omni)),
 					languages: ["zh", "en"],
-					bargeIn: config.voice?.realtime?.bargeIn ?? true
+					bargeIn: config.voice?.realtime?.bargeIn ?? true,
+					mediaTransports: ["websocket-pcm"]
 				},
-				defaultEngine: config.voice?.realtime?.defaultEngine ?? "agent",
+				defaultMode: config.voice?.realtime?.defaultEngine === "omni" ? "natural" : "assistant",
 				omni: omni?.route ?? null,
 				stt: stt?.route ?? null,
 				tts: tts ? {

package/dist/src/gateway/security/gateway-scopes.d.ts

@@ -1,6 +1,7 @@
 export declare const GATEWAY_SCOPES: readonly ["gateway.status", "agents.read", "agents.run", "sessions.read", "sessions.write", "workspace.read", "workspace.write", "tasks.read", "tasks.write", "automations.read", "automations.write", "notifications.self", "device.self", "gateway.admin"];
 export type GatewayScope = typeof GATEWAY_SCOPES[number];
 export declare const DEFAULT_MOBILE_SCOPES: readonly GatewayScope[];
+export declare const DEFAULT_BROWSER_EXTENSION_SCOPES: readonly GatewayScope[];
 export declare function isGatewayScope(value: unknown): value is GatewayScope;
 export declare function parseGatewayScopes(value: string): GatewayScope[];
 export declare function requiredGatewayScope(method: string, path: string): GatewayScope;

package/dist/src/gateway/security/gateway-scopes.js

@@ -31,6 +31,14 @@ const DEFAULT_MOBILE_SCOPES = [
 	"notifications.self",
 	"device.self"
 ];
+const DEFAULT_BROWSER_EXTENSION_SCOPES = [
+	"gateway.status",
+	"agents.read",
+	"agents.run",
+	"sessions.read",
+	"sessions.write",
+	"device.self"
+];
 function isGatewayScope(value) {
 	return typeof value === "string" && KNOWN_GATEWAY_SCOPES.has(value);
 }
@@ -48,6 +56,7 @@ function requiredGatewayScope(method, path) {
 	if (path === "/api/device-auth/refresh" || path === "/api/devices/me") return "device.self";
 	if (path.startsWith("/api/devices/me/push")) return "notifications.self";
 	if (path.startsWith("/api/endpoint-tools")) return "device.self";
+	if (path.startsWith("/api/browser/tab-bindings") || path.startsWith("/api/browser/approvals")) return methodScope(method, "sessions.read", "sessions.write");
 	if (method === "GET" && path === "/api/connectors/approvals") return "sessions.read";
 	if (method === "POST" && path === "/api/connectors/approvals/respond") return "sessions.write";
 	if (path === "/api/agent" || path.startsWith("/api/agent/")) return "agents.run";
@@ -66,4 +75,4 @@ function hasGatewayScope(granted, required) {
 	return granted.includes("gateway.admin") || granted.includes(required);
 }
 //#endregion
-export { DEFAULT_MOBILE_SCOPES, GATEWAY_SCOPES, hasGatewayScope, isGatewayScope, parseGatewayScopes, requiredGatewayScope };
+export { DEFAULT_BROWSER_EXTENSION_SCOPES, DEFAULT_MOBILE_SCOPES, GATEWAY_SCOPES, hasGatewayScope, isGatewayScope, parseGatewayScopes, requiredGatewayScope };

package/dist/src/gateway/security/origin-check.d.ts

@@ -11,6 +11,7 @@ type OriginCheckResult = {
     ok: false;
     reason: string;
 };
+export declare function isChromeExtensionOrigin(origin: string | undefined): boolean;
 export declare function checkBrowserOrigin(params: {
     requestHost?: string;
     origin?: string;

package/dist/src/gateway/security/origin-check.js

@@ -5,6 +5,10 @@ const LOOPBACK_HOSTNAMES = new Set([
 	"::1",
 	"[::1]"
 ]);
+const CHROME_EXTENSION_ORIGIN = /^chrome-extension:\/\/[a-p]{32}$/;
+function isChromeExtensionOrigin(origin) {
+	return CHROME_EXTENSION_ORIGIN.test((origin ?? "").trim().toLowerCase());
+}
 function isLoopbackHost(hostname) {
 	return LOOPBACK_HOSTNAMES.has(hostname.toLowerCase());
 }
@@ -55,4 +59,4 @@ function checkBrowserOrigin(params) {
 	};
 }
 //#endregion
-export { checkBrowserOrigin };
+export { checkBrowserOrigin, isChromeExtensionOrigin };

package/dist/src/gateway/service/agent-runner.js

@@ -50,7 +50,8 @@ var GatewayAgentRunner = class {
 				const generator = this.runAgent(input.content, "webchat", input.sessionKey, input.origin, input.attachments, input.thinking, {
 					runId: input.runId,
 					taskRunId: input.taskRunId,
-					sourceContexts: input.sourceContexts
+					sourceContexts: input.sourceContexts,
+					...input.origin.type === "channel" && input.origin.channel === "voice" ? { presentation: "voice" } : {}
 				});
 				let result;
 				while (true) {

package/dist/src/gateway/service/config-coordinator.js

@@ -1,7 +1,7 @@
 import { createLogger } from "../../utils/logger/index.js";
 import { init_logger } from "../../utils/logger.js";
-import { loadConfig, saveConfig } from "../../config/loader.js";
 import { getModelRegistry } from "../../providers/model-registry.js";
+import { loadConfig, saveConfig } from "../../config/loader.js";
 import { init_providers } from "../../providers/index.js";
 import { disposeAllSessionMcpRuntimes } from "../../agent/mcp/bundle-mcp-runtime.js";
 import { reloadImageGenerationProviders } from "../../agent/image/generation/provider-registry.js";

package/dist/src/gateway/service/session-input-coordinator.d.ts

@@ -11,6 +11,7 @@ export type SubmitSessionInput = {
     content: string;
     attachments?: UserTurnAttachment[];
     contextRefs?: TurnContextRef[];
+    sourceContexts?: AgentSourceContext[];
     thinking?: string;
     origin: TurnOrigin;
 };

package/dist/src/gateway/service/session-input-coordinator.js

@@ -7,6 +7,7 @@ import { cancelConnectionObjective, consumeConnectionResume, invalidateConnectio
 import "../../storage/sqlite/index.js";
 import { summarizeSourceContext } from "../../agent/source-context/types.js";
 import { deleteMediaUrisNoLongerReferenced } from "../../media/session-references.js";
+import { fitSourceContextsToBudget } from "../../agent/source-context/budget.js";
 import crypto from "node:crypto";
 //#region src/gateway/service/session-input-coordinator.ts
 init_logger();
@@ -70,7 +71,7 @@ var SessionInputCoordinator = class {
 			const clientMessageId = input.clientMessageId.trim();
 			const content = input.content.trim();
 			const targetTurnId = input.targetTurnId.trim();
-			if (!sessionKey || !clientMessageId || !targetTurnId || !content && !input.attachments?.length) return {
+			if (!sessionKey || !clientMessageId || !targetTurnId || !content && !input.attachments?.length && !input.sourceContexts?.length) return {
 				ok: false,
 				code: "BAD_REQUEST"
 			};
@@ -89,7 +90,7 @@ var SessionInputCoordinator = class {
 			const attachments = await this.deps.prepareAttachments(sessionKey, input.attachments);
 			let sourceContexts;
 			try {
-				sourceContexts = await this.deps.prepareContexts(input.contextRefs);
+				sourceContexts = fitSourceContextsToBudget([...await this.deps.prepareContexts(input.contextRefs) ?? [], ...input.sourceContexts ?? []]);
 			} catch (err) {
 				log.warn({
 					err,
@@ -137,7 +138,7 @@ var SessionInputCoordinator = class {
 		const sessionKey = input.sessionKey;
 		const clientMessageId = input.clientMessageId.trim();
 		const content = input.content.trim();
-		if (!sessionKey || !clientMessageId || !content && !input.attachments?.length) return {
+		if (!sessionKey || !clientMessageId || !content && !input.attachments?.length && !input.sourceContexts?.length) return {
 			ok: false,
 			code: "BAD_REQUEST"
 		};
@@ -158,7 +159,7 @@ var SessionInputCoordinator = class {
 		const attachments = await this.deps.prepareAttachments(sessionKey, input.attachments);
 		let sourceContexts;
 		try {
-			sourceContexts = await this.deps.prepareContexts(input.contextRefs);
+			sourceContexts = fitSourceContextsToBudget([...await this.deps.prepareContexts(input.contextRefs) ?? [], ...input.sourceContexts ?? []]);
 		} catch (err) {
 			log.warn({
 				err,

package/dist/src/gateway/service.js

@@ -6,22 +6,22 @@ import { getRuntimeLogStats } from "../utils/logger/stats.js";
 import { createLogger } from "../utils/logger/index.js";
 import { init_logger } from "../utils/logger.js";
 import { closeXopcDatabase, openXopcDatabase } from "../storage/sqlite/connection.js";
-import { insertSessionInput } from "../storage/sqlite/session-input-repository.js";
+import { findSessionInput, insertSessionInput } from "../storage/sqlite/session-input-repository.js";
 import { notifyUserContextChange } from "../user-context/changes.js";
 import { getSessionConfig } from "../storage/sqlite/config-repository.js";
 import "../storage/sqlite/index.js";
 import { getAgentDefaultModelRef, init_schema } from "../config/schema.js";
 import { init_agent_scope, listAgentEntries, normalizeAgentId, resolveAgentWorkspaceDir, resolveDefaultAgentId } from "../agent/agent-scope.js";
-import { buildSessionKey, init_session_key, sanitizeSegment } from "../routing/session-key.js";
-import { getDefaultAgentId, init_resolve_route } from "../routing/resolve-route.js";
-import { resolveEffectiveAgentProfileForSession } from "../config/agent-profile.js";
 import { init_paths, resolveConfigPath, resolveExtensionsDir } from "../config/paths.js";
+import { prewarmModelRegistry } from "../providers/model-registry.js";
 import { areExtensionsGloballyDisabled } from "../extensions/discover-extensions.js";
 import { buildExtensionMetadataSnapshot } from "../extensions/extension-metadata-snapshot.js";
 import { buildChannelCatalogForConfig, buildChannelCatalogFromSnapshot, init_channel_catalog_service } from "../channels/catalog/channel-catalog-service.js";
 import { loadConfig, saveConfig } from "../config/loader.js";
-import { prewarmModelRegistry } from "../providers/model-registry.js";
+import { buildSessionKey, init_session_key, sanitizeSegment } from "../routing/session-key.js";
+import { getDefaultAgentId, init_resolve_route } from "../routing/resolve-route.js";
 import { init_providers, providers_exports } from "../providers/index.js";
+import { resolveEffectiveAgentProfileForSession } from "../config/agent-profile.js";
 import { TaskRepository } from "../tasks/task-repository.js";
 import { TaskConversationRepository } from "../tasks/task-conversation-repository.js";
 import { getEmbeddedExecutionSession } from "../agent/embedded/execution-context.js";
@@ -54,6 +54,12 @@ import { registerClarificationChannelRuntime } from "./clarify-runtime.js";
 import { ChannelManager } from "../channels/manager.js";
 import { getWorkspacePath } from "../config/workspace-path-helpers.js";
 import "../config/index.js";
+import { DiscussionService } from "../discussions/service.js";
+import { DiscussionOrganizer } from "../discussions/organizer.js";
+import { DiscussionLiveWorker } from "../discussions/live-worker.js";
+import { DiscussionOrganizerWorker } from "../discussions/organizer-worker.js";
+import { DiscussionSealer } from "../discussions/sealer.js";
+import "../discussions/index.js";
 import { ManagedComposioEventPoller } from "../connectors/composio-managed-events.js";
 import { startConnectedKnowledgeCoordinator } from "../knowledge/coordinator.js";
 import "../knowledge/index.js";
@@ -61,12 +67,6 @@ import { ConnectionRecoveryService } from "../connectors/connection-recovery-ser
 import { startConnectorLearningCoordinator } from "../connectors/learning-coordinator.js";
 import { ConnectedSourceChangePublisher } from "../connectors/source-change-publisher.js";
 import { startConnectorSupervisor } from "../connectors/supervisor.js";
-import { DiscussionService } from "../discussions/service.js";
-import { DiscussionOrganizer } from "../discussions/organizer.js";
-import { DiscussionLiveWorker } from "../discussions/live-worker.js";
-import { DiscussionOrganizerWorker } from "../discussions/organizer-worker.js";
-import { DiscussionSealer } from "../discussions/sealer.js";
-import "../discussions/index.js";
 import { EndpointToolRuntime } from "../endpoint-tools/runtime.js";
 import "../endpoint-tools/index.js";
 import { assertGatewayAuthConfigured, extractToken, resolveGatewayAuth, validateToken } from "./auth.js";
@@ -123,6 +123,7 @@ import { GatewayConfigCoordinator } from "./service/config-coordinator.js";
 import { GatewayAgentRunner } from "./service/agent-runner.js";
 import { RealtimeRuntime } from "../realtime/runtime.js";
 import { VoiceRealtimeRuntime } from "../voice/realtime/runtime.js";
+import { DurableVoiceAgentBroker } from "../voice/realtime/agentBroker.js";
 import { reconcileMemoryMaintenanceAutomations } from "./memory-maintenance-automation-reconciler.js";
 import { GatewayReadiness } from "./startup-readiness.js";
 import { createGatewayStartupTrace } from "./startup-trace.js";
@@ -228,16 +229,16 @@ var GatewayService = class {
 				interruptedDuring: entry.interruptedDuring
 			}
 		}),
-		runAgent: (text, sessionKey, signal) => {
-			if (this.agentRunner.hasActiveRun(sessionKey)) throw new Error("Conversation session already has an active response");
-			return this.agentRunner.runAgent(text, "webchat", sessionKey, {
-				type: "channel",
-				channel: "webchat"
-			}, void 0, void 0, {
-				signal,
-				presentation: "voice"
-			});
-		}
+		agentBroker: new DurableVoiceAgentBroker({
+			submit: (input) => this.agentRunner.submitSessionInput(input),
+			find: findSessionInput,
+			snapshot: (sessionKey) => this.agentRunner.inputs.snapshot(sessionKey),
+			currentSequence: (topic) => this.realtime.broker.currentSequence(topic),
+			subscribe: (topic, afterSeq, listener) => this.realtime.broker.subscribe(topic, afterSeq, listener),
+			cancelRun: async (runId) => {
+				await this.agentRunner.abortAgentRun(runId);
+			}
+		})
 	});
 	getConfig() {
 		return this.config;

package/dist/src/providers/auth-runtime/resolve-auth.js

@@ -1,5 +1,5 @@
-import { init_sync_provider_auth, resolveProviderApiKeyForAgentSync } from "../../auth/sync-provider-auth.js";
 import { getApiKeyFromEnv, init_env_keys } from "../env-keys.js";
+import { init_sync_provider_auth, resolveProviderApiKeyForAgentSync } from "../../auth/sync-provider-auth.js";
 import { getDefaultAuthProfileStore } from "./auth-profile-store.js";
 //#region src/providers/auth-runtime/resolve-auth.ts
 init_env_keys();

package/dist/src/providers/index.js

@@ -1,11 +1,11 @@
 import { __esmMin, __exportAll } from "../../_virtual/_rolldown/runtime.js";
 import { getAgentDefaultModelRef, init_schema } from "../config/schema.js";
-import { getModelOAuthProviderIds, init_registry } from "../auth/oauth/registry.js";
-import { hasProviderAuthOnDiskSync, init_sync_provider_auth } from "../auth/sync-provider-auth.js";
 import { PROVIDER_ENV_MAP, getApiKeyFromEnv, init_env_keys } from "./env-keys.js";
 import { init_model_ref, splitProviderModelRef } from "./model-ref.js";
 import { ModelRegistry, getModelRegistry, init_model_registry, prewarmModelRegistry, resetModelRegistry } from "./model-registry.js";
+import { getModelOAuthProviderIds, init_registry } from "../auth/oauth/registry.js";
 import { CredentialResolver, hasCredentials, init_credentials } from "../auth/credentials.js";
+import { hasProviderAuthOnDiskSync, init_sync_provider_auth } from "../auth/sync-provider-auth.js";
 import { EXTENSION_PROVIDER_BASE_URL, init_constants } from "./constants.js";
 import { applyOfficialModelMetadataCorrections, getSupplementalModels, init_model_supplements } from "./model-supplements.js";
 import { getProviderRegistry, init_plugin_registry } from "./plugin-registry.js";

package/dist/src/providers/model-registry.js

@@ -1,8 +1,8 @@
 import { __esmMin } from "../../_virtual/_rolldown/runtime.js";
 import { createLogger } from "../utils/logger/index.js";
 import { init_logger } from "../utils/logger.js";
-import { resolveModelsJsonPath } from "../config/paths.js";
 import { init_resolve_config_value, resolveConfigValue, resolveHeaders } from "../config/resolve-config-value.js";
+import { resolveModelsJsonPath } from "../config/paths.js";
 import { getDefaultModelValues, init_models_json, validateModelsConfig } from "../config/models-json.js";
 import { getApiKeyFromEnv, init_env_keys } from "./env-keys.js";
 import { getModelCatalogStore, init_model_catalog_store } from "./model-catalog-store.js";

package/dist/src/providers/register-runtime-providers.js

@@ -1,6 +1,6 @@
 import { __esmMin } from "../../_virtual/_rolldown/runtime.js";
-import { getOAuthProviderDefinition, init_registry } from "../auth/oauth/registry.js";
 import { getModelCatalogStore, init_model_catalog_store } from "./model-catalog-store.js";
+import { getOAuthProviderDefinition, init_registry } from "../auth/oauth/registry.js";
 import { XOPC_CLOUD_PROVIDER_ID, init_xopc_cloud_config, resolveXopcModelRouterUrl } from "./xopc-cloud-config.js";
 //#region src/providers/register-runtime-providers.ts
 function registerRuntimeProvider(modelRuntime, source) {

package/dist/src/realtime/runtime.js

@@ -194,7 +194,8 @@ var RealtimeRuntime = class {
 				connectionId = crypto.randomUUID();
 				let endpointReady;
 				if (message.payload.endpoint) {
-					if (!this.endpointTools || message.payload.endpoint.kind !== message.payload.clientKind) {
+					const endpointKindMatches = message.payload.endpoint.kind === message.payload.clientKind || message.payload.clientKind === "browser_extension" && message.payload.endpoint.kind === "browser";
+					if (!this.endpointTools || !endpointKindMatches) {
 						socket.close(4401, "Realtime endpoint identity is invalid");
 						return;
 					}

package/dist/src/session/client-history.d.ts

@@ -15,12 +15,15 @@ export interface ClientHistoryMessage {
     /** Whitelisted display metadata; never includes source snapshot text. */
     metadata?: {
         sourceContexts?: Array<{
-            kind: 'note';
+            kind: 'note' | 'browser_page';
             sourceId: string;
             version: string;
             title: string;
             tokenEstimate?: number;
             truncated?: boolean;
+            url?: string;
+            capturedAt?: number;
+            documentId?: string;
         }>;
         turnOutcome?: TurnOutcome;
     };

package/dist/src/session/client-history.js

@@ -9,14 +9,17 @@ function sourceContextDisplayMetadata(metadata) {
 	const sourceContexts = rows.flatMap((value) => {
 		if (!value || typeof value !== "object" || Array.isArray(value)) return [];
 		const row = value;
-		if (row.kind !== "note" || typeof row.sourceId !== "string" || typeof row.version !== "string" || typeof row.title !== "string") return [];
+		if (row.kind !== "note" && row.kind !== "browser_page" || typeof row.sourceId !== "string" || typeof row.version !== "string" || typeof row.title !== "string") return [];
 		return [{
-			kind: "note",
+			kind: row.kind,
 			sourceId: row.sourceId,
 			version: row.version,
 			title: row.title,
 			...typeof row.tokenEstimate === "number" ? { tokenEstimate: row.tokenEstimate } : {},
-			...row.truncated === true ? { truncated: true } : {}
+			...row.truncated === true ? { truncated: true } : {},
+			...typeof row.url === "string" ? { url: row.url } : {},
+			...typeof row.capturedAt === "number" ? { capturedAt: row.capturedAt } : {},
+			...typeof row.documentId === "string" ? { documentId: row.documentId } : {}
 		}];
 	});
 	return sourceContexts.length ? { sourceContexts } : void 0;

package/dist/src/storage/sqlite/browser-tab-binding-repository.d.ts

@@ -0,0 +1,7 @@
+import type { BrowserTabBinding } from '@xopcai/gateway-contract';
+export declare function getBrowserTabBinding(sessionKey: string, now?: number): BrowserTabBinding | undefined;
+export declare function getBrowserTabBindingById(bindingId: string, now?: number): BrowserTabBinding | undefined;
+export declare function setBrowserTabBinding(input: Omit<BrowserTabBinding, 'id' | 'createdAt' | 'expiresAt'>, now?: number): BrowserTabBinding;
+export declare function deleteBrowserTabBinding(sessionKey: string): boolean;
+export declare function deleteBrowserTabBindingsByEndpoint(endpointId: string): number;
+export declare function deleteBrowserTabBindingsByPrincipal(principalId: string): number;

package/dist/src/storage/sqlite/browser-tab-binding-repository.js

@@ -0,0 +1,60 @@
+import { getSqliteDatabase } from "./transaction.js";
+import { randomUUID } from "node:crypto";
+//#region src/storage/sqlite/browser-tab-binding-repository.ts
+function bindingFromRow(row) {
+	return {
+		id: row.binding_id,
+		sessionKey: row.session_key,
+		principalId: row.principal_id,
+		endpointId: row.endpoint_id,
+		tabId: row.tab_id,
+		windowId: row.window_id,
+		documentId: row.document_id,
+		urlOrigin: row.url_origin,
+		mode: row.mode,
+		createdAt: row.created_at,
+		expiresAt: row.expires_at
+	};
+}
+function getBrowserTabBinding(sessionKey, now = Date.now()) {
+	const db = getSqliteDatabase();
+	db.prepare("DELETE FROM browser_tab_bindings WHERE expires_at <= ?").run(now);
+	const row = db.prepare(`SELECT * FROM browser_tab_bindings WHERE session_key = ?`).get(sessionKey);
+	return row ? bindingFromRow(row) : void 0;
+}
+function getBrowserTabBindingById(bindingId, now = Date.now()) {
+	const db = getSqliteDatabase();
+	db.prepare("DELETE FROM browser_tab_bindings WHERE expires_at <= ?").run(now);
+	const row = db.prepare(`SELECT * FROM browser_tab_bindings WHERE binding_id = ?`).get(bindingId);
+	return row ? bindingFromRow(row) : void 0;
+}
+function setBrowserTabBinding(input, now = Date.now()) {
+	const binding = {
+		...input,
+		id: randomUUID(),
+		createdAt: now,
+		expiresAt: now + 480 * 60 * 1e3
+	};
+	getSqliteDatabase().prepare(`INSERT INTO browser_tab_bindings (
+    binding_id, session_key, principal_id, endpoint_id, tab_id, window_id,
+    document_id, url_origin, mode, created_at, expires_at
+  ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+  ON CONFLICT(session_key) DO UPDATE SET
+    binding_id = excluded.binding_id, principal_id = excluded.principal_id,
+    endpoint_id = excluded.endpoint_id, tab_id = excluded.tab_id,
+    window_id = excluded.window_id, document_id = excluded.document_id,
+    url_origin = excluded.url_origin, mode = excluded.mode,
+    created_at = excluded.created_at, expires_at = excluded.expires_at`).run(binding.id, binding.sessionKey, binding.principalId, binding.endpointId, binding.tabId, binding.windowId, binding.documentId, binding.urlOrigin, binding.mode, binding.createdAt, binding.expiresAt);
+	return binding;
+}
+function deleteBrowserTabBinding(sessionKey) {
+	return getSqliteDatabase().prepare("DELETE FROM browser_tab_bindings WHERE session_key = ?").run(sessionKey).changes > 0;
+}
+function deleteBrowserTabBindingsByEndpoint(endpointId) {
+	return Number(getSqliteDatabase().prepare("DELETE FROM browser_tab_bindings WHERE endpoint_id = ?").run(endpointId).changes);
+}
+function deleteBrowserTabBindingsByPrincipal(principalId) {
+	return Number(getSqliteDatabase().prepare("DELETE FROM browser_tab_bindings WHERE principal_id = ?").run(principalId).changes);
+}
+//#endregion
+export { deleteBrowserTabBinding, deleteBrowserTabBindingsByEndpoint, deleteBrowserTabBindingsByPrincipal, getBrowserTabBinding, getBrowserTabBindingById, setBrowserTabBinding };

package/dist/src/storage/sqlite/device-access-repository.d.ts

@@ -1,11 +1,12 @@
 import crypto from 'node:crypto';
 import type { GatewayScope } from '../../gateway/security/gateway-scopes.js';
-export type DevicePlatform = 'ios' | 'android';
+export type DevicePlatform = 'ios' | 'android' | 'chrome';
 export type DevicePublicKeyJwk = crypto.webcrypto.JsonWebKey;
 export type DeviceRecord = {
     id: string;
     displayName: string;
     platform: DevicePlatform;
+    extensionId?: string;
     publicKeyJwk: DevicePublicKeyJwk;
     scopes: GatewayScope[];
     createdAt: number;
@@ -28,6 +29,7 @@ export declare function createDevice(input: {
     displayName: string;
     platform: DevicePlatform;
     publicKeyJwk: DevicePublicKeyJwk;
+    extensionId?: string;
     scopes: readonly GatewayScope[];
     now?: number;
 }): DeviceRecord;

package/dist/src/storage/sqlite/device-access-repository.js

@@ -26,6 +26,7 @@ function deviceFromRow(row) {
 		displayName: row.display_name,
 		platform: row.platform,
 		publicKeyJwk: JSON.parse(row.public_key_jwk),
+		...row.extension_id ? { extensionId: row.extension_id } : {},
 		scopes: parseGatewayScopes(row.scopes_json),
 		createdAt: row.created_at,
 		...row.last_seen_at === null ? {} : { lastSeenAt: row.last_seen_at },
@@ -37,9 +38,9 @@ function createDevice(input) {
 	const createdAt = input.now ?? Date.now();
 	getSqliteDatabase().prepare(`
     INSERT INTO devices (
-      device_id, display_name, platform, public_key_jwk, scopes_json, created_at
-    ) VALUES (?, ?, ?, ?, ?, ?)
-  `).run(id, input.displayName, input.platform, JSON.stringify(input.publicKeyJwk), JSON.stringify([...new Set(input.scopes)]), createdAt);
+      device_id, display_name, platform, extension_id, public_key_jwk, scopes_json, created_at
+    ) VALUES (?, ?, ?, ?, ?, ?, ?)
+  `).run(id, input.displayName, input.platform, input.extensionId ?? null, JSON.stringify(input.publicKeyJwk), JSON.stringify([...new Set(input.scopes)]), createdAt);
 	return getDevice(id);
 }
 function getDevice(deviceId) {