@xopcai/xopc 0.0.265 → 0.0.267

package/dist/src/agent/embedded/run-for-session.js

@@ -1,8 +1,8 @@
 import { createLogger } from "../../utils/logger/index.js";
 import { init_logger } from "../../utils/logger.js";
 import { parseTurnOutcome } from "../../../packages/gateway-contract/src/turn-outcome.js";
-import { resolveEffectiveAgentProfileForSession } from "../../config/agent-profile.js";
 import { init_providers, resolveModel } from "../../providers/index.js";
+import { resolveEffectiveAgentProfileForSession } from "../../config/agent-profile.js";
 import { runWithEmbeddedExecutionSession } from "./execution-context.js";
 import { resolveAgentTurnTimeoutMs } from "../orchestration/run-agent-turn-with-timeout.js";
 import { resolvePromptCachePolicy } from "../../providers/prompt-cache-plan.js";

package/dist/src/agent/external-tools/endpoint-provider.js

@@ -1,4 +1,5 @@
 import { externalToolRef, parseExternalToolRef } from "./refs.js";
+import { BROWSER_CONTROL_ENDPOINT_TOOL_NAME } from "../../../packages/browser-control-contract/src/index.js";
 //#region src/agent/external-tools/endpoint-provider.ts
 function contentText(content) {
 	if (content.type === "text") return content.text;
@@ -13,7 +14,7 @@ var EndpointToolProvider = class {
 	async search(_query) {
 		const endpoint = this.currentEndpoint();
 		if (!endpoint) return [];
-		return endpoint.tools.map(({ descriptor }) => ({
+		return endpoint.tools.filter(({ descriptor }) => descriptor.name !== BROWSER_CONTROL_ENDPOINT_TOOL_NAME).map(({ descriptor }) => ({
 			toolRef: externalToolRef(this.source, endpoint.endpointId, descriptor.name),
 			source: this.source,
 			namespace: endpoint.endpointId,
@@ -86,6 +87,7 @@ var EndpointToolProvider = class {
 		const endpoint = this.currentEndpoint();
 		if (!endpoint || endpoint.endpointId !== parsed.namespace) return void 0;
 		const tool = this.deps.runtime.registry.getTool(endpoint.endpointId, parsed.toolName);
+		if (tool?.descriptor.name === "browser.control") return void 0;
 		return tool ? {
 			endpointId: endpoint.endpointId,
 			displayName: endpoint.displayName,

package/dist/src/agent/image/tool-model-config.js

@@ -1,7 +1,7 @@
 import { getAgentDefaultImageModelConfig, getAgentDefaultModelRef, init_schema, parseModelRef } from "../../config/schema.js";
 import { init_agent_scope, resolveDefaultAgentId } from "../agent-scope.js";
-import { resolveEffectiveAgentConfigForAgent } from "../../config/agent-profile.js";
 import { getDefaultModelSync, getModelsByProvider, init_providers, isProviderConfiguredSync, resolveModel } from "../../providers/index.js";
+import { resolveEffectiveAgentConfigForAgent } from "../../config/agent-profile.js";
 import { resolveAgentModelFallbackValues, resolveAgentModelPrimaryValue } from "../../config/model-input.js";
 import { buildCapabilityPlansForConfig } from "../../capabilities/readiness/from-config.js";
 import "../../capabilities/readiness/index.js";

package/dist/src/agent/mcp/oauth/mcp-oauth-store.js

@@ -1,5 +1,5 @@
-import { init_paths, resolveMcpOAuthPath } from "../../../config/paths.js";
 import { init_write_file_atomic, writeTextAtomic } from "../../../infra/write-file-atomic.js";
+import { init_paths, resolveMcpOAuthPath } from "../../../config/paths.js";
 import { createHash } from "node:crypto";
 import { readFile, rm } from "node:fs/promises";
 //#region src/agent/mcp/oauth/mcp-oauth-store.ts

package/dist/src/agent/service.js

@@ -2,10 +2,10 @@ import { createLogger } from "../utils/logger/index.js";
 import { init_logger } from "../utils/logger.js";
 import { parseNoteAttachmentTarget } from "../notes/attachment-ref.js";
 import { getAgentDefaultModelRef, init_schema } from "../config/schema.js";
-import { applyConfigOverrides } from "../config/runtime-overrides.js";
 import { init_agent_scope, resolveAgentHomeDir, resolveDefaultAgentId } from "./agent-scope.js";
-import { extractProfileAgentId } from "../config/agent-profile.js";
 import { init_providers, resolveModel } from "../providers/index.js";
+import { applyConfigOverrides } from "../config/runtime-overrides.js";
+import { extractProfileAgentId } from "../config/agent-profile.js";
 import { extractTextContent } from "./context/workspace.js";
 import { effectiveWorkspacePathForSession } from "../session/session-workspace.js";
 import { getProjectForSession } from "../projects/workspace.js";

package/dist/src/agent/session/session-inspector.js

@@ -1,8 +1,8 @@
 import { createLogger } from "../../utils/logger/index.js";
 import { init_logger } from "../../utils/logger.js";
 import { init_workspace_defaults, resolveDefaultAgentWorkspaceDir } from "../../config/workspace-defaults.js";
-import { resolveEffectiveAgentProfileForSession } from "../../config/agent-profile.js";
 import { init_providers, resolveModel } from "../../providers/index.js";
+import { resolveEffectiveAgentProfileForSession } from "../../config/agent-profile.js";
 import { getExecutionEnvironmentForSession } from "../../execution-environments/subject.js";
 import { effectiveWorkspacePathForSession, projectWorkspacePath } from "../../session/session-workspace.js";
 import { getProjectForSession } from "../../projects/workspace.js";

package/dist/src/agent/skills/hub-lock.js

@@ -1,5 +1,5 @@
-import { init_paths, resolveSkillsLockPath } from "../../config/paths.js";
 import { init_write_file_atomic, writeTextAtomicSync } from "../../infra/write-file-atomic.js";
+import { init_paths, resolveSkillsLockPath } from "../../config/paths.js";
 import { existsSync, readFileSync } from "node:fs";
 //#region src/agent/skills/hub-lock.ts
 /**

package/dist/src/agent/tasks/task-judge-service.js

@@ -1,15 +1,15 @@
 import { createLogger } from "../../utils/logger/index.js";
 import { init_logger } from "../../utils/logger.js";
 import { TaskRunRepository } from "../../tasks/task-run-repository.js";
+import { extractAssistantText, getAssistantMessageErrorReason, stripCodeFences } from "../../providers/model-response.js";
 import { getAgentDefaultModelRef, init_schema } from "../../config/schema.js";
-import { resolveEffectiveAgentProfileForSession } from "../../config/agent-profile.js";
 import { getApiKey, init_providers, resolveModel } from "../../providers/index.js";
+import { completeWithResolvedCredentials } from "../../providers/model-call.js";
+import { resolveEffectiveAgentProfileForSession } from "../../config/agent-profile.js";
 import { TaskRepository } from "../../tasks/task-repository.js";
 import { TaskConversationRepository } from "../../tasks/task-conversation-repository.js";
 import { readWorkspaceRevision } from "../coding/workspace-revision.js";
-import { completeWithResolvedCredentials } from "../../providers/model-call.js";
 import { TaskApplicationService } from "../../tasks/task-application-service.js";
-import { extractAssistantText, getAssistantMessageErrorReason, stripCodeFences } from "../../providers/model-response.js";
 //#region src/agent/tasks/task-judge-service.ts
 init_schema();
 init_providers();

package/dist/src/agent/tools/factory.js

@@ -140,7 +140,7 @@ var AgentToolsFactory = class AgentToolsFactory {
 			createDriver: async () => {
 				const config = this.deps.getConfig?.();
 				if (!config) throw new Error("Browser configuration is unavailable");
-				return createBrowserDriver(config.browser);
+				return createBrowserDriver(config.browser, this.deps.endpointTools);
 			},
 			allowedUploadRoots: [this.deps.workspace],
 			emit: this.deps.emitBrowserEvent,

package/dist/src/ai-assist/text-assist.js

@@ -1,9 +1,9 @@
 import { createLogger } from "../utils/logger/index.js";
 import { init_logger } from "../utils/logger.js";
+import { getAssistantMessageErrorReason, stripCodeFences } from "../providers/model-response.js";
 import { getDefaultModelSync, init_providers, resolveModel } from "../providers/index.js";
 import { createExtensionAwareStreamFn } from "../providers/extension-stream-bridge.js";
 import { isLocalModelBaseUrl, resolveModelCallApiKey, resolveModelCallOptions } from "../providers/model-call.js";
-import { getAssistantMessageErrorReason, stripCodeFences } from "../providers/model-response.js";
 //#region src/ai-assist/text-assist.ts
 init_providers();
 init_logger();

package/dist/src/auth/credentials.js

@@ -1,10 +1,10 @@
 import { __esmMin } from "../../_virtual/_rolldown/runtime.js";
 import { createLogger } from "../utils/logger/index.js";
 import { init_logger } from "../utils/logger.js";
-import { init_paths, resolveAgentAuthProfilesPath, resolveAuthProfilesPath, resolveCredentialsDir, resolveOAuthPath } from "../config/paths.js";
 import { init_write_file_atomic, writeTextAtomic } from "../infra/write-file-atomic.js";
-import { getOAuthProviderDefinition, init_registry } from "./oauth/registry.js";
+import { init_paths, resolveAgentAuthProfilesPath, resolveAuthProfilesPath, resolveCredentialsDir, resolveOAuthPath } from "../config/paths.js";
 import { getApiKeyFromEnv, init_env_keys } from "../providers/env-keys.js";
+import { getOAuthProviderDefinition, init_registry } from "./oauth/registry.js";
 import { init_oauth_provider_lock, withOAuthProviderLock } from "./oauth-provider-lock.js";
 import { dirname, join } from "path";
 import { mkdir, readFile, readdir, rm } from "fs/promises";

package/dist/src/auth/oauth/xopc-cloud.js

@@ -1,6 +1,6 @@
 import { __esmMin } from "../../../_virtual/_rolldown/runtime.js";
-import { init_resolution, resolveConnectedPlatformEndpoint } from "../../platform/resolution.js";
 import { generatePKCE, init_pkce } from "./pkce.js";
+import { init_resolution, resolveConnectedPlatformEndpoint } from "../../platform/resolution.js";
 import { hostname } from "node:os";
 import { randomBytes } from "node:crypto";
 import http from "node:http";

package/dist/src/auth/profiles/store.js

@@ -1,5 +1,5 @@
-import { init_paths, resolveCredentialsDir } from "../../config/paths.js";
 import { init_write_file_atomic, writeTextAtomicSync } from "../../infra/write-file-atomic.js";
+import { init_paths, resolveCredentialsDir } from "../../config/paths.js";
 import path from "node:path";
 import { chmodSync, existsSync, mkdirSync, readFileSync } from "node:fs";
 //#region src/auth/profiles/store.ts

package/dist/src/auth/sync-provider-auth.js

@@ -1,8 +1,8 @@
 import { __esmMin } from "../../_virtual/_rolldown/runtime.js";
-import { getDefaultAgentId, init_resolve_route } from "../routing/resolve-route.js";
 import { init_paths, resolveAgentAuthProfilesPath, resolveAuthProfilesPath, resolveOAuthPath } from "../config/paths.js";
-import { init_loader, loadConfig } from "../config/loader.js";
 import { init_registry, isOAuthOnlyProvider } from "./oauth/registry.js";
+import { init_loader, loadConfig } from "../config/loader.js";
+import { getDefaultAgentId, init_resolve_route } from "../routing/resolve-route.js";
 import { existsSync, readFileSync } from "node:fs";
 //#region src/auth/sync-provider-auth.ts
 /**

package/dist/src/browser/automations/runtime-service.d.ts

@@ -1,6 +1,8 @@
 import type { Config } from '../../config/schema.js';
+import type { EndpointToolRuntime } from '../../endpoint-tools/index.js';
 import { BrowserAutomationService } from './service.js';
 export declare function createRuntimeBrowserAutomationService(deps: {
     getConfig: () => Config;
+    endpointTools?: EndpointToolRuntime;
     emit?: (type: string, payload: unknown) => void;
 }): BrowserAutomationService;

package/dist/src/browser/automations/runtime-service.js

@@ -6,7 +6,7 @@ import { BrowserAutomationService } from "./service.js";
 function createRuntimeBrowserAutomationService(deps) {
 	const runtime = new BrowserRuntime({
 		getConfig: () => deps.getConfig().browser,
-		createDriver: () => createBrowserDriver(deps.getConfig().browser),
+		createDriver: () => createBrowserDriver(deps.getConfig().browser, deps.endpointTools),
 		allowedUploadRoots: [process.cwd()],
 		emit: deps.emit
 	});

package/dist/src/browser/drivers/create-driver.d.ts

@@ -1,3 +1,4 @@
 import type { Config } from '../../config/schema.js';
+import type { EndpointToolRuntime } from '../../endpoint-tools/index.js';
 import type { BrowserDriver } from './browser-driver.js';
-export declare function createBrowserDriver(config: Config['browser']): Promise<BrowserDriver>;
+export declare function createBrowserDriver(config: Config['browser'], endpointTools: EndpointToolRuntime): Promise<BrowserDriver>;

package/dist/src/browser/drivers/create-driver.js

@@ -3,22 +3,20 @@ import { init_logger } from "../../utils/logger.js";
 import { loadPlaywrightCoreModule } from "../providers/playwright-doctor.js";
 import { BrowserbaseProvider } from "../providers/browserbase.js";
 import { BrowserUseProvider } from "../providers/browser-use.js";
-import { acquireExtensionBrowserServer } from "../providers/extension-ws-acquire.js";
+import { RealtimeExtensionBrowserProvider } from "../providers/realtime-extension.js";
 import { ExtensionDriver } from "./extension-driver.js";
 import { PlaywrightDriver } from "./playwright-driver.js";
 //#region src/browser/drivers/create-driver.ts
 init_logger();
 const log = createLogger("BrowserDriverFactory");
-async function createBrowserDriver(config) {
+async function createBrowserDriver(config, endpointTools) {
 	const limits = config.limits;
 	if (config.driver.kind === "extension") {
-		const { provider, release } = await acquireExtensionBrowserServer({
-			host: "127.0.0.1",
-			port: 19820,
+		const provider = new RealtimeExtensionBrowserProvider(endpointTools, {
 			connectionTimeout: limits.actionTimeoutMs,
 			commandTimeout: limits.actionTimeoutMs
 		});
-		return new ExtensionDriver(provider, limits.actionTimeoutMs, config.observation.visualFallback, release);
+		return new ExtensionDriver(provider, limits.actionTimeoutMs, config.observation.visualFallback, () => provider.shutdown());
 	}
 	const driver = config.driver;
 	return new PlaywrightDriver({

package/dist/src/browser/drivers/extension-driver.d.ts

@@ -1,13 +1,17 @@
 import type { BrowserControlResult, BrowserNavigateInput, BrowserObservation, BrowserObserveInput, BrowserTabsInput } from '@xopcai/browser-control-contract';
-import type { ExtensionBrowserProvider } from '../providers/extension.js';
 import type { BrowserDriver, BrowserPrimitiveInput } from './browser-driver.js';
+type ExtensionProvider = {
+    start(): Promise<void>;
+    waitForConnection(timeoutMs?: number): Promise<void>;
+    send(input: import('@xopcai/browser-control-contract').BrowserActionInput, timeoutMs?: number, visualFallback?: boolean): Promise<import('@xopcai/browser-control-contract').BrowserWireResult>;
+};
 export declare class ExtensionDriver implements BrowserDriver {
     private readonly provider;
     private readonly timeoutMs;
     private readonly visualFallback;
     private readonly release;
     readonly kind: "extension";
-    constructor(provider: ExtensionBrowserProvider, timeoutMs: number, visualFallback: boolean, release: () => Promise<void>);
+    constructor(provider: ExtensionProvider, timeoutMs: number, visualFallback: boolean, release: () => Promise<void>);
     connect(): Promise<void>;
     disconnect(): Promise<void>;
     createSession(_sessionId: string): Promise<void>;
@@ -18,3 +22,4 @@ export declare class ExtensionDriver implements BrowserDriver {
     tabs(sessionId: string, input: BrowserTabsInput): Promise<BrowserControlResult>;
     private send;
 }
+export {};

package/dist/src/browser/enrollment.d.ts

@@ -0,0 +1,8 @@
+export type BrowserEnrollmentPublicKeyJwk = {
+    kty: 'EC';
+    crv: 'P-256';
+    x: string;
+    y: string;
+};
+export declare function parseBrowserEnrollmentPublicKeyJwk(value: unknown): BrowserEnrollmentPublicKeyJwk;
+export declare function browserEnrollmentPublicKeyThumbprint(value: unknown): string;

package/dist/src/browser/enrollment.js

@@ -0,0 +1,25 @@
+import crypto from "node:crypto";
+//#region src/browser/enrollment.ts
+function parseBrowserEnrollmentPublicKeyJwk(value) {
+	if (!value || typeof value !== "object") throw new Error("Browser enrollment public key is missing");
+	const key = value;
+	if (key.kty !== "EC" || key.crv !== "P-256" || typeof key.x !== "string" || !key.x || typeof key.y !== "string" || !key.y) throw new Error("Browser enrollment public key is invalid");
+	return {
+		kty: "EC",
+		crv: "P-256",
+		x: key.x,
+		y: key.y
+	};
+}
+function browserEnrollmentPublicKeyThumbprint(value) {
+	const key = parseBrowserEnrollmentPublicKeyJwk(value);
+	const canonical = JSON.stringify({
+		crv: key.crv,
+		kty: key.kty,
+		x: key.x,
+		y: key.y
+	});
+	return crypto.createHash("sha256").update(canonical).digest("base64url");
+}
+//#endregion
+export { browserEnrollmentPublicKeyThumbprint, parseBrowserEnrollmentPublicKeyJwk };

package/dist/src/browser/extension-identity.d.ts

@@ -0,0 +1,2 @@
+export declare const BROWSER_NATIVE_HOST_NAME = "ai.xopc.browser";
+export declare const BROWSER_EXTENSION_ID = "gopbfhaojnnhiheiikblejnpgmfmkmgd";

package/dist/src/browser/extension-identity.js

@@ -0,0 +1,5 @@
+//#region src/browser/extension-identity.ts
+const BROWSER_NATIVE_HOST_NAME = "ai.xopc.browser";
+const BROWSER_EXTENSION_ID = "gopbfhaojnnhiheiikblejnpgmfmkmgd";
+//#endregion
+export { BROWSER_EXTENSION_ID, BROWSER_NATIVE_HOST_NAME };

package/dist/src/browser/native-messaging-host.d.ts

@@ -1,7 +1,10 @@
-export declare const BROWSER_NATIVE_HOST_NAME = "ai.xopc.browser";
-export declare const BROWSER_EXTENSION_ID = "gopbfhaojnnhiheiikblejnpgmfmkmgd";
+export { BROWSER_EXTENSION_ID, BROWSER_NATIVE_HOST_NAME } from './extension-identity.js';
 export type BrowserNativeBootstrap = {
     type: 'bootstrap';
+    extensionId: string;
+    publicKeyJwk: unknown;
+    publicKeyThumbprint: string;
+    nonce: string;
 };
 export type BrowserNativeBootstrapResult = {
     ok: true;
@@ -11,5 +14,5 @@ export type BrowserNativeBootstrapResult = {
 };
 export declare function encodeNativeMessage(value: unknown): Buffer;
 export declare function decodeNativeMessage(buffer: Buffer): unknown;
-export declare function createBrowserNativeBootstrap(configPath: string): BrowserNativeBootstrapResult;
+export declare function createBrowserNativeBootstrap(configPath: string, request: Omit<BrowserNativeBootstrap, 'type'>): BrowserNativeBootstrapResult;
 export declare function runBrowserNativeMessagingHost(configPath: string): Promise<void>;

package/dist/src/browser/native-messaging-host.js

@@ -2,11 +2,11 @@ import { closeXopcDatabase, openXopcDatabase } from "../storage/sqlite/connectio
 import { getGatewayIdentityPublicKeyRaw, getOrCreateGatewayIdentity } from "../storage/sqlite/gateway-identity-repository.js";
 import { createDevicePairingSetup } from "../storage/sqlite/device-pairing-repository.js";
 import { init_loader, loadConfig } from "../config/loader.js";
+import { browserEnrollmentPublicKeyThumbprint } from "./enrollment.js";
+import { BROWSER_EXTENSION_ID, BROWSER_NATIVE_HOST_NAME } from "./extension-identity.js";
 import os from "node:os";
 //#region src/browser/native-messaging-host.ts
 init_loader();
-const BROWSER_NATIVE_HOST_NAME = "ai.xopc.browser";
-const BROWSER_EXTENSION_ID = "gopbfhaojnnhiheiikblejnpgmfmkmgd";
 function gatewayLoopbackUrl(port) {
 	return `http://127.0.0.1:${port}`;
 }
@@ -22,7 +22,11 @@ function decodeNativeMessage(buffer) {
 	if (length === 0 || length > 1024 * 1024 || buffer.length !== length + 4) throw new Error("Native message length is invalid");
 	return JSON.parse(buffer.subarray(4).toString("utf8"));
 }
-function createBrowserNativeBootstrap(configPath) {
+function createBrowserNativeBootstrap(configPath, request) {
+	if (request.extensionId !== "gopbfhaojnnhiheiikblejnpgmfmkmgd") throw new Error("Browser extension identity is not trusted");
+	if (!/^[A-Za-z0-9_-]{24,160}$/.test(request.nonce)) throw new Error("Browser enrollment nonce is invalid");
+	const publicKeyThumbprint = browserEnrollmentPublicKeyThumbprint(request.publicKeyJwk);
+	if (request.publicKeyThumbprint !== publicKeyThumbprint) throw new Error("Browser enrollment key does not match");
 	const gatewayUrl = gatewayLoopbackUrl(loadConfig(configPath).gateway.port ?? 18790);
 	openXopcDatabase();
 	try {
@@ -31,7 +35,15 @@ function createBrowserNativeBootstrap(configPath) {
 			kind: "local-browser",
 			url: gatewayUrl
 		};
-		const setup = createDevicePairingSetup([route], Date.now(), 3);
+		const setup = createDevicePairingSetup([route], Date.now(), 3, {
+			ttlMs: 6e4,
+			enrollment: {
+				issuer: "browser-native-host",
+				extensionId: request.extensionId,
+				publicKeyThumbprint,
+				nonce: request.nonce
+			}
+		});
 		const identity = getOrCreateGatewayIdentity();
 		return {
 			ok: true,
@@ -93,7 +105,13 @@ async function runBrowserNativeMessagingHost(configPath) {
 	try {
 		const request = decodeNativeMessage(await readOneNativeMessage(process.stdin));
 		if (!request || typeof request !== "object" || request.type !== "bootstrap") throw new Error("Unsupported native messaging request");
-		process.stdout.write(encodeNativeMessage(createBrowserNativeBootstrap(configPath)));
+		const bootstrap = request;
+		process.stdout.write(encodeNativeMessage(createBrowserNativeBootstrap(configPath, {
+			extensionId: bootstrap.extensionId,
+			publicKeyJwk: bootstrap.publicKeyJwk,
+			publicKeyThumbprint: bootstrap.publicKeyThumbprint,
+			nonce: bootstrap.nonce
+		})));
 	} catch (error) {
 		process.stdout.write(encodeNativeMessage({
 			ok: false,

package/dist/src/browser/providers/browser-ext-install.d.ts

@@ -26,6 +26,7 @@ export interface BrowserExtDoctor {
     needsChromeReload?: boolean;
     bundledFrom?: BrowserExtBundledFrom;
     runtimeExtensionVersion?: string;
+    nativeHost: BrowserNativeHostInstallResult;
 }
 export interface EnsureBrowserExtResult {
     extensionDir: string;
@@ -65,17 +66,19 @@ export declare function ensureBrowserExtensionArtifacts(opts?: {
     cacheDir?: string;
 }): Promise<EnsureBrowserExtResult>;
 export declare function browserNativeManifestDirectories(platform?: NodeJS.Platform, home?: string): string[];
+export declare function browserNativeHostDoctor(platform?: NodeJS.Platform, home?: string): BrowserNativeHostInstallResult;
 /** Install the local-only bootstrap host used to discover and pair with a Gateway. */
 export declare function installBrowserNativeMessagingHost(opts?: {
     cacheDir?: string;
     cliPath?: string;
     nodePath?: string;
+    tsxCliPath?: string;
     platform?: NodeJS.Platform;
     home?: string;
     configPath?: string;
     stateDir?: string;
 }): Promise<BrowserNativeHostInstallResult>;
-/** Gateway startup hook: ensure artifacts only while the extension driver is active. */
+/** Gateway startup hook: install/repair extension artifacts and its local enrollment host. */
 export declare function ensureBrowserExtensionOnStartup(config: Config | undefined): Promise<void>;
 export declare function readInstalledExtensionDir(cacheDir?: string): Promise<string | null>;
 export type BrowserExtensionOpenAction = 'chrome' | 'folder' | 'both';

package/dist/src/browser/providers/browser-ext-install.js

@@ -2,13 +2,14 @@ import { PACKAGE_VERSION, init_package_version } from "../../package-version.js"
 import { resolveStateDir } from "../../config/paths-state.js";
 import { createLogger } from "../../utils/logger/index.js";
 import { init_logger } from "../../utils/logger.js";
-import { init_paths, resolveBinDir, resolveConfigPath } from "../../config/paths.js";
 import { init_write_file_atomic, writeTextAtomic } from "../../infra/write-file-atomic.js";
+import { init_paths, resolveBinDir, resolveConfigPath } from "../../config/paths.js";
 import { assertCacheDir } from "../cache-dir-policy.js";
-import { BROWSER_EXTENSION_ID, BROWSER_NATIVE_HOST_NAME } from "../native-messaging-host.js";
+import { BROWSER_EXTENSION_ID, BROWSER_NATIVE_HOST_NAME } from "../extension-identity.js";
+import "../native-messaging-host.js";
 import { resolvePackageRoot } from "../../infra/update-check.js";
 import { dirname, join } from "node:path";
-import { chmodSync, existsSync, mkdirSync, readFileSync, readdirSync, renameSync, rmSync, statSync, writeFileSync } from "node:fs";
+import { chmodSync, existsSync, mkdirSync, readFileSync, readdirSync, realpathSync, renameSync, rmSync, statSync, writeFileSync } from "node:fs";
 import { fileURLToPath } from "node:url";
 import { spawn } from "node:child_process";
 import { createHash } from "node:crypto";
@@ -240,7 +241,8 @@ async function browserExtDoctor(opts) {
 		needsRefresh,
 		needsChromeReload,
 		bundledFrom: bundled?.bundledFrom,
-		runtimeExtensionVersion: runtimeVer
+		runtimeExtensionVersion: runtimeVer,
+		nativeHost: browserNativeHostDoctor()
 	};
 }
 async function ensureBrowserExtensionArtifacts(opts) {
@@ -302,33 +304,68 @@ function browserNativeManifestDirectories(platform = process.platform, home = pr
 	if (!home) return [];
 	if (platform === "darwin") return [
 		join(home, "Library/Application Support/Google/Chrome/NativeMessagingHosts"),
+		join(home, "Library/Application Support/Google/ChromeForTesting/NativeMessagingHosts"),
 		join(home, "Library/Application Support/Chromium/NativeMessagingHosts"),
 		join(home, "Library/Application Support/Microsoft Edge/NativeMessagingHosts"),
 		join(home, "Library/Application Support/BraveSoftware/Brave-Browser/NativeMessagingHosts")
 	];
 	if (platform === "linux") return [
 		join(home, ".config/google-chrome/NativeMessagingHosts"),
+		join(home, ".config/google-chrome-for-testing/NativeMessagingHosts"),
 		join(home, ".config/chromium/NativeMessagingHosts"),
 		join(home, ".config/microsoft-edge/NativeMessagingHosts"),
 		join(home, ".config/BraveSoftware/Brave-Browser/NativeMessagingHosts")
 	];
 	return [];
 }
+function browserNativeHostDoctor(platform = process.platform, home = process.env.HOME || process.env.USERPROFILE || "") {
+	const directories = browserNativeManifestDirectories(platform, home);
+	if (directories.length === 0) return {
+		installed: false,
+		manifestPaths: [],
+		reason: "Automatic local Gateway discovery is supported on macOS and Linux"
+	};
+	const manifestPaths = directories.map((directory) => join(directory, `${BROWSER_NATIVE_HOST_NAME}.json`)).filter((manifestPath) => {
+		try {
+			const manifest = JSON.parse(readFileSync(manifestPath, "utf8"));
+			return manifest.name === "ai.xopc.browser" && typeof manifest.path === "string" && existsSync(manifest.path) && Array.isArray(manifest.allowed_origins) && manifest.allowed_origins.includes(`chrome-extension://gopbfhaojnnhiheiikblejnpgmfmkmgd/`);
+		} catch {
+			return false;
+		}
+	});
+	return {
+		installed: manifestPaths.length > 0,
+		manifestPaths,
+		...manifestPaths.length === 0 ? { reason: "Browser native enrollment host is not installed" } : {}
+	};
+}
 /** Install the local-only bootstrap host used to discover and pair with a Gateway. */
 async function installBrowserNativeMessagingHost(opts) {
 	const directories = browserNativeManifestDirectories(opts?.platform ?? process.platform, opts?.home);
 	if (directories.length === 0) return {
 		installed: false,
 		manifestPaths: [],
-		reason: "Native bootstrap installation is supported on macOS and Linux"
+		reason: "Automatic local Gateway discovery is supported on macOS and Linux"
 	};
 	const cliPath = opts?.cliPath ?? process.argv[1];
 	if (!cliPath) throw new Error("Unable to resolve the xopc CLI entry point");
+	const executablePath = opts?.nodePath ?? process.execPath;
+	let executableArgs = [
+		cliPath,
+		"browser",
+		"extension",
+		"native-host"
+	];
+	if (cliPath.endsWith(".ts")) {
+		const tsxPath = opts?.tsxCliPath ?? join(process.cwd(), "node_modules", "tsx", "dist", "cli.mjs");
+		if (!existsSync(tsxPath)) throw new Error("Unable to install the browser native host in development: the tsx CLI entry was not found");
+		executableArgs = [realpathSync(tsxPath), ...executableArgs];
+	}
 	const hostPath = join((opts?.cacheDir?.trim() ? assertCacheDir(opts.cacheDir) : resolveBinDir()) || resolveBinDir(), "browser-native-host");
 	mkdirSync(dirname(hostPath), { recursive: true });
 	const stateDir = opts?.stateDir ?? resolveStateDir();
 	const configPath = opts?.configPath ?? resolveConfigPath();
-	await writeTextAtomic(hostPath, `#!/bin/sh\nexec env XOPC_STATE_DIR=${shellQuote(stateDir)} XOPC_CONFIG_PATH=${shellQuote(configPath)} XOPC_LOG_CONSOLE=false ${shellQuote(opts?.nodePath ?? process.execPath)} ${shellQuote(cliPath)} browser extension native-host\n`);
+	await writeTextAtomic(hostPath, `#!/bin/sh\nexec env ELECTRON_RUN_AS_NODE=1 XOPC_STATE_DIR=${shellQuote(stateDir)} XOPC_CONFIG_PATH=${shellQuote(configPath)} XOPC_LOG_CONSOLE=false ${shellQuote(executablePath)} ${executableArgs.map(shellQuote).join(" ")}\n`);
 	chmodSync(hostPath, 493);
 	const manifest = JSON.stringify({
 		name: BROWSER_NATIVE_HOST_NAME,
@@ -349,10 +386,12 @@ async function installBrowserNativeMessagingHost(opts) {
 		manifestPaths
 	};
 }
-/** Gateway startup hook: ensure artifacts only while the extension driver is active. */
+/** Gateway startup hook: install/repair extension artifacts and its local enrollment host. */
 async function ensureBrowserExtensionOnStartup(config) {
 	if (config?.browser.enabled === false || config?.browser.driver.kind !== "extension") return;
 	await ensureBrowserExtensionArtifacts();
+	const nativeHost = await installBrowserNativeMessagingHost();
+	if (!nativeHost.installed) log.warn({ reason: nativeHost.reason }, "Browser native enrollment host was not installed");
 }
 async function readInstalledExtensionDir(cacheDir) {
 	const resolved = (cacheDir?.trim() ? assertCacheDir(cacheDir) : resolveBinDir()) || resolveBinDir();
@@ -432,4 +471,4 @@ async function openBrowserExtensionInstallUi(opts) {
 	};
 }
 //#endregion
-export { BROWSER_EXT_REQUIRED_FILES, browserExtContentHash, browserExtDoctor, browserNativeManifestDirectories, computeNeedsRefresh, ensureBrowserExtensionArtifacts, ensureBrowserExtensionOnStartup, installBrowserNativeMessagingHost, openBrowserExtensionInstallUi, readInstalledExtensionDir, resolveBundledBrowserExtDir, resolveInstalledExtensionPath, resolveWindowsExtensionManager, validateBrowserExtLayout };
+export { BROWSER_EXT_REQUIRED_FILES, browserExtContentHash, browserExtDoctor, browserNativeHostDoctor, browserNativeManifestDirectories, computeNeedsRefresh, ensureBrowserExtensionArtifacts, ensureBrowserExtensionOnStartup, installBrowserNativeMessagingHost, openBrowserExtensionInstallUi, readInstalledExtensionDir, resolveBundledBrowserExtDir, resolveInstalledExtensionPath, resolveWindowsExtensionManager, validateBrowserExtLayout };

package/dist/src/browser/providers/extension.js

@@ -2,8 +2,8 @@ import { createLogger } from "../../utils/logger/index.js";
 import { init_logger } from "../../utils/logger.js";
 import { deleteBrowserTabBindingsByPrincipal, getBrowserTabBindingById } from "../../storage/sqlite/browser-tab-binding-repository.js";
 import { getDevice } from "../../storage/sqlite/device-access-repository.js";
-import { isChromeExtensionOrigin } from "../../gateway/security/origin-check.js";
 import { browserWireAuthenticationPayload } from "../../../packages/browser-control-contract/src/index.js";
+import { isChromeExtensionOrigin } from "../../gateway/security/origin-check.js";
 import crypto from "node:crypto";
 //#region src/browser/providers/extension.ts
 /**

package/dist/src/browser/providers/realtime-extension.d.ts

@@ -0,0 +1,29 @@
+import { type BrowserActionInput, type BrowserWireResult } from '@xopcai/browser-control-contract';
+import type { EndpointToolRuntime } from '../../endpoint-tools/index.js';
+export interface RealtimeExtensionProviderConfig {
+    connectionTimeout?: number;
+    commandTimeout?: number;
+}
+export declare class RealtimeExtensionBrowserProvider {
+    private readonly runtime;
+    readonly name = "extension";
+    private readonly connectionTimeout;
+    private readonly commandTimeout;
+    constructor(runtime: EndpointToolRuntime, config?: RealtimeExtensionProviderConfig);
+    start(): Promise<void>;
+    waitForConnection(timeoutMs?: number): Promise<void>;
+    send(input: BrowserActionInput, timeoutMs?: number, visualFallback?: boolean): Promise<BrowserWireResult>;
+    isConnected(): boolean;
+    getConnectionStatus(): {
+        socketConnected: boolean;
+        connected: boolean;
+        protocolVersion: number;
+        expectedProtocolVersion: number;
+        extensionVersion: string;
+        principalId: string;
+        transport: "gateway-realtime";
+    };
+    shutdown(): Promise<void>;
+    private endpointForInput;
+    private currentEndpoint;
+}