@xopcai/xopc 0.0.266 → 0.0.267

package/dist/src/gateway/hono/routes/browser.js

@@ -1,6 +1,7 @@
 import { deleteBrowserTabBinding, getBrowserTabBinding, setBrowserTabBinding } from "../../../storage/sqlite/browser-tab-binding-repository.js";
 import { browserTabBindingRequestSchema } from "../../../../packages/gateway-contract/src/browser-tab-binding.js";
 import { getDevice } from "../../../storage/sqlite/device-access-repository.js";
+import "../../../../packages/browser-control-contract/src/index.js";
 import { decideBrowserApproval, listBrowserApprovals } from "../../../browser/policy/approval-store.js";
 import { createBrowserDriver } from "../../../browser/drivers/create-driver.js";
 import { checkBrowserReadiness } from "../../../browser/readiness.js";
@@ -9,34 +10,19 @@ import { getGatewayPrincipal } from "../../security/gateway-principal.js";
 import { getConnInfo } from "@hono/node-server/conninfo";
 //#region src/gateway/hono/routes/browser.ts
 /** Browser Control status, approvals, and driver diagnostics. */
-const EXTENSION_ENDPOINT = "http://127.0.0.1:19820/";
-async function extensionStatus() {
-	const { getExtensionBrowserServerSnapshot } = await import("../../../browser/providers/extension-ws-acquire.js");
-	const snapshot = getExtensionBrowserServerSnapshot();
-	let running = snapshot.active;
-	let socketConnected = false;
-	let connected = false;
-	let protocolVersion = null;
-	let expectedProtocolVersion = null;
-	let extensionVersion = null;
-	try {
-		const payload = await (await fetch(EXTENSION_ENDPOINT, { signal: AbortSignal.timeout(2e3) })).json();
-		running ||= payload.ok === true;
-		socketConnected = payload.socketConnected ?? payload.connected === true;
-		connected = payload.connected === true;
-		protocolVersion = typeof payload.protocolVersion === "number" ? payload.protocolVersion : null;
-		expectedProtocolVersion = typeof payload.expectedProtocolVersion === "number" ? payload.expectedProtocolVersion : null;
-		extensionVersion = typeof payload.extensionVersion === "string" ? payload.extensionVersion : null;
-	} catch {}
+async function extensionStatus(service) {
+	const endpoint = service.endpointTools.registry.list().filter((item) => item.kind === "browser" && item.tools.some((tool) => tool.descriptor.name === "browser.control")).sort((left, right) => right.lastHeartbeatAt - left.lastHeartbeatAt)[0];
+	const connected = Boolean(endpoint);
+	const extensionVersion = endpoint?.appVersion ?? null;
 	const { browserExtDoctor } = await import("../../../browser/providers/browser-ext-install.js");
 	const doctor = await browserExtDoctor({ runtimeExtensionVersion: extensionVersion ?? void 0 });
 	return {
-		running,
-		socketConnected,
+		running: true,
+		socketConnected: connected,
 		connected,
 		driverKind: "extension",
-		protocolVersion,
-		expectedProtocolVersion,
+		protocolVersion: connected ? 4 : null,
+		expectedProtocolVersion: 4,
 		extensionVersion,
 		artifacts: {
 			installed: doctor.installed,
@@ -45,10 +31,12 @@ async function extensionStatus() {
 			xopcVersion: doctor.xopcVersion,
 			installedVersion: doctor.installedVersion,
 			needsRefresh: doctor.needsRefresh,
-			needsChromeReload: doctor.needsChromeReload || socketConnected && !connected
+			needsChromeReload: doctor.needsChromeReload,
+			nativeHost: doctor.nativeHost
 		},
-		bridgeHeld: snapshot.active,
-		refCount: snapshot.refCount
+		bridgeHeld: false,
+		refCount: connected ? 1 : 0,
+		transport: "gateway-realtime"
 	};
 }
 function isLocalOwnerRequest(c, service) {
@@ -156,7 +144,7 @@ function registerBrowserRoutes(authenticated, deps) {
 	});
 	authenticated.get("/api/browser/extension-status", async (c) => {
 		try {
-			return c.json(await extensionStatus());
+			return c.json(await extensionStatus(service));
 		} catch (error) {
 			return c.json({
 				running: false,
@@ -177,7 +165,7 @@ function registerBrowserRoutes(authenticated, deps) {
 			}
 		});
 		const readiness = await checkBrowserReadiness(service.currentConfig);
-		const driverStatus = config.driver.kind === "extension" ? await extensionStatus().catch((error) => ({ error: error instanceof Error ? error.message : String(error) })) : config.driver.kind === "playwright" ? await import("../../../browser/providers/playwright-doctor.js").then(({ playwrightChromiumDoctor }) => playwrightChromiumDoctor()) : void 0;
+		const driverStatus = config.driver.kind === "extension" ? await extensionStatus(service).catch((error) => ({ error: error instanceof Error ? error.message : String(error) })) : config.driver.kind === "playwright" ? await import("../../../browser/providers/playwright-doctor.js").then(({ playwrightChromiumDoctor }) => playwrightChromiumDoctor()) : void 0;
 		const extensionConnected = config.driver.kind === "extension" ? driverStatus.connected === true : true;
 		const extensionProtocolDetail = config.driver.kind === "extension" && "socketConnected" in driverStatus && driverStatus.socketConnected && !driverStatus.connected ? `Chrome extension protocol ${driverStatus.protocolVersion ?? "unknown"} does not match ${driverStatus.expectedProtocolVersion ?? "the gateway"}. Reload the extension in Chrome.` : void 0;
 		return c.json({
@@ -204,7 +192,7 @@ function registerBrowserRoutes(authenticated, deps) {
 		const startedAt = Date.now();
 		let driver;
 		try {
-			driver = await createBrowserDriver(service.currentConfig.browser);
+			driver = await createBrowserDriver(service.currentConfig.browser, service.endpointTools);
 			await driver.connect();
 			return c.json({
 				ok: true,
@@ -229,12 +217,14 @@ function registerBrowserRoutes(authenticated, deps) {
 		}, 403);
 		const body = await c.req.json().catch(() => ({}));
 		try {
-			const { browserExtDoctor, ensureBrowserExtensionArtifacts } = await import("../../../browser/providers/browser-ext-install.js");
+			const { browserExtDoctor, ensureBrowserExtensionArtifacts, installBrowserNativeMessagingHost } = await import("../../../browser/providers/browser-ext-install.js");
 			const result = await ensureBrowserExtensionArtifacts({ force: body.force === true });
+			const nativeHost = await installBrowserNativeMessagingHost({ configPath: service.getHealth().configPath });
 			return c.json({
 				ok: true,
 				payload: {
 					...result,
+					nativeHost,
 					doctor: await browserExtDoctor()
 				}
 			});

package/dist/src/gateway/security/origin-check.js

@@ -15,6 +15,11 @@ function isLoopbackHost(hostname) {
 function parseOriginHost(originRaw) {
 	const trimmed = (originRaw ?? "").trim();
 	if (!trimmed || trimmed === "null") return null;
+	if (isChromeExtensionOrigin(trimmed)) return {
+		origin: trimmed.toLowerCase(),
+		host: "",
+		hostname: ""
+	};
 	try {
 		const url = new URL(trimmed);
 		return {

package/dist/src/gateway/service/config-coordinator.d.ts

@@ -41,8 +41,6 @@ export interface GatewayConfigCoordinatorOptions {
     getChannelManager: () => ChannelManager;
     getHeartbeatService: () => HeartbeatService | null;
     getExtensionLoader: () => ExtensionLoader | null;
-    /** Re-evaluate browser-extension server attachment after agent defaults change. */
-    reconcileBrowserExtensionServer: () => Promise<void>;
     /** Sync deterministic user-model maintenance automations after config changes. */
     reconcileMemoryMaintenanceAutomations: () => Promise<void>;
     /** Latest channel status snapshot for the `channels.status` event. */

package/dist/src/gateway/service/config-coordinator.js

@@ -223,7 +223,6 @@ var GatewayConfigCoordinator = class {
 		log.debug("Reloading agent defaults...");
 		this.opts.setConfig(newConfig);
 		this.opts.getAgentService().applyAgentDefaultsFromConfig(newConfig);
-		this.opts.reconcileBrowserExtensionServer();
 		this.opts.reconcileMemoryMaintenanceAutomations().catch((err) => {
 			const em = err instanceof Error ? err.message : String(err);
 			log.warn({
@@ -350,7 +349,6 @@ var GatewayConfigCoordinator = class {
 		this.opts.setConfig(reloaded);
 		if (sanitizeTunnelConfig(reloaded)) await saveConfig(reloaded, this.opts.configPath);
 		this.opts.getAgentService().applyAgentDefaultsFromConfig(reloaded);
-		await this.opts.reconcileBrowserExtensionServer();
 		await this.opts.reconcileMemoryMaintenanceAutomations().catch((err) => {
 			const em = err instanceof Error ? err.message : String(err);
 			log.warn({

package/dist/src/gateway/service.d.ts

@@ -39,10 +39,6 @@ export declare class GatewayService {
     private notesService;
     private extensionLoader;
     private extensionMetadataSnapshot;
-    private browserExtensionProvider;
-    private browserExtensionRelease;
-    /** `${host}:${port}` when the gateway holds the extension bridge listener. */
-    private browserExtensionBindKey;
     private heartbeatService;
     private sessionIndex;
     private running;
@@ -198,13 +194,6 @@ export declare class GatewayService {
      */
     onHttpListening(): Promise<void>;
     stop(): Promise<void>;
-    /** Start the browser extension WebSocket server when its driver is active. */
-    private startBrowserExtensionServerIfNeeded;
-    /**
-     * Start/stop/rebind the Chrome extension bridge.
-     * PATCH saves update config in memory without re-running gateway startup, so this must run on save too.
-     */
-    reconcileBrowserExtensionServer(): Promise<void>;
     /**
      * Start processing outbound messages and send through channels
      */

package/dist/src/gateway/service.js

@@ -54,12 +54,6 @@ import { registerClarificationChannelRuntime } from "./clarify-runtime.js";
 import { ChannelManager } from "../channels/manager.js";
 import { getWorkspacePath } from "../config/workspace-path-helpers.js";
 import "../config/index.js";
-import { DiscussionService } from "../discussions/service.js";
-import { DiscussionOrganizer } from "../discussions/organizer.js";
-import { DiscussionLiveWorker } from "../discussions/live-worker.js";
-import { DiscussionOrganizerWorker } from "../discussions/organizer-worker.js";
-import { DiscussionSealer } from "../discussions/sealer.js";
-import "../discussions/index.js";
 import { ManagedComposioEventPoller } from "../connectors/composio-managed-events.js";
 import { startConnectedKnowledgeCoordinator } from "../knowledge/coordinator.js";
 import "../knowledge/index.js";
@@ -67,6 +61,12 @@ import { ConnectionRecoveryService } from "../connectors/connection-recovery-ser
 import { startConnectorLearningCoordinator } from "../connectors/learning-coordinator.js";
 import { ConnectedSourceChangePublisher } from "../connectors/source-change-publisher.js";
 import { startConnectorSupervisor } from "../connectors/supervisor.js";
+import { DiscussionService } from "../discussions/service.js";
+import { DiscussionOrganizer } from "../discussions/organizer.js";
+import { DiscussionLiveWorker } from "../discussions/live-worker.js";
+import { DiscussionOrganizerWorker } from "../discussions/organizer-worker.js";
+import { DiscussionSealer } from "../discussions/sealer.js";
+import "../discussions/index.js";
 import { EndpointToolRuntime } from "../endpoint-tools/runtime.js";
 import "../endpoint-tools/index.js";
 import { assertGatewayAuthConfigured, extractToken, resolveGatewayAuth, validateToken } from "./auth.js";
@@ -152,10 +152,6 @@ var GatewayService = class {
 	notesService;
 	extensionLoader = null;
 	extensionMetadataSnapshot = null;
-	browserExtensionProvider = null;
-	browserExtensionRelease = null;
-	/** `${host}:${port}` when the gateway holds the extension bridge listener. */
-	browserExtensionBindKey = null;
 	heartbeatService = null;
 	sessionIndex;
 	running = false;
@@ -249,6 +245,7 @@ var GatewayService = class {
 	get browserAutomations() {
 		if (!this.browserAutomationService) this.browserAutomationService = createRuntimeBrowserAutomationService({
 			getConfig: () => this.config,
+			endpointTools: this.endpointTools,
 			emit: (type, payload) => this.emit(type, payload)
 		});
 		return this.browserAutomationService;
@@ -520,7 +517,6 @@ var GatewayService = class {
 			getChannelManager: () => this.channelManager,
 			getHeartbeatService: () => this.heartbeatService,
 			getExtensionLoader: () => this.extensionLoader,
-			reconcileBrowserExtensionServer: () => this.reconcileBrowserExtensionServer(),
 			reconcileMemoryMaintenanceAutomations: () => this.reconcileMemoryMaintenanceAutomations(),
 			getChannelsStatus: () => this.getChannelsStatus(),
 			emit: (type, payload) => this.emit(type, payload)
@@ -1099,7 +1095,6 @@ var GatewayService = class {
 			workspaceId: this.currentWorkspacePath
 		}) });
 		import("../browser/providers/browser-ext-install.js").then(({ ensureBrowserExtensionOnStartup }) => ensureBrowserExtensionOnStartup(this.config)).catch((err) => log.warn({ err }, "Browser extension artifact ensure failed"));
-		await trace.measure("browser-extension.start", () => this.startBrowserExtensionServerIfNeeded());
 		this.agentService.start().catch((err) => {
 			log.error({ err }, "Agent service error");
 		});
@@ -1260,12 +1255,6 @@ var GatewayService = class {
 		this.connectedKnowledgeCoordinator?.stop();
 		this.connectedKnowledgeCoordinator = null;
 		await this.browserAutomationService?.shutdown();
-		if (this.browserExtensionRelease) {
-			await this.browserExtensionRelease();
-			this.browserExtensionRelease = null;
-		}
-		this.browserExtensionProvider = null;
-		this.browserExtensionBindKey = null;
 		registerClarificationChannelRuntime(null);
 		this.connectionRecovery.stop();
 		this.agentRunner.disposeClarifications();
@@ -1288,73 +1277,6 @@ var GatewayService = class {
 		closeXopcDatabase();
 		log.debug("Gateway service stopped");
 	}
-	/** Start the browser extension WebSocket server when its driver is active. */
-	async startBrowserExtensionServerIfNeeded() {
-		await this.reconcileBrowserExtensionServer();
-	}
-	/**
-	* Start/stop/rebind the Chrome extension bridge.
-	* PATCH saves update config in memory without re-running gateway startup, so this must run on save too.
-	*/
-	async reconcileBrowserExtensionServer() {
-		const driver = this.config.browser.driver;
-		const bridgeConfig = this.config.browser.enabled && driver.kind === "extension" ? {
-			host: "127.0.0.1",
-			port: 19820,
-			connectionTimeout: this.config.browser.limits.actionTimeoutMs,
-			commandTimeout: this.config.browser.limits.actionTimeoutMs
-		} : null;
-		if (!bridgeConfig) {
-			if (this.browserExtensionRelease) {
-				await this.browserExtensionRelease();
-				this.browserExtensionRelease = null;
-				this.browserExtensionProvider = null;
-				this.browserExtensionBindKey = null;
-				log.debug("Browser extension WebSocket server stopped because its driver is inactive");
-			}
-			return;
-		}
-		const { port, host, connectionTimeout, commandTimeout } = bridgeConfig;
-		const bindKey = `${host}:${port}`;
-		if (this.browserExtensionRelease && this.browserExtensionBindKey === bindKey) return;
-		if (this.browserExtensionRelease) {
-			await this.browserExtensionRelease();
-			this.browserExtensionRelease = null;
-			this.browserExtensionProvider = null;
-			this.browserExtensionBindKey = null;
-		}
-		try {
-			const { acquireExtensionBrowserServer } = await import("../browser/providers/extension-ws-acquire.js");
-			const { provider, release } = await acquireExtensionBrowserServer({
-				port,
-				host,
-				connectionTimeout,
-				commandTimeout
-			});
-			this.browserExtensionProvider = provider;
-			this.browserExtensionRelease = release;
-			this.browserExtensionBindKey = bindKey;
-			log.info({
-				port,
-				host
-			}, "Browser extension WS server started");
-		} catch (err) {
-			if ((err && typeof err === "object" && "code" in err ? err.code : void 0) === "EADDRINUSE") {
-				log.warn({
-					err,
-					phase: "browser_extension_ws",
-					bindPort: port,
-					bindHost: host,
-					hint: "Another process holds the browser extension bridge port 19820. Stop it before starting xopc."
-				}, `Browser extension WS server port is already in use: ${host}:${port}`);
-				return;
-			}
-			log.error({
-				err,
-				phase: "browser_extension_ws"
-			}, `Failed to start browser extension WS server: ${err instanceof Error ? err.message : String(err)}`);
-		}
-	}
 	/**
 	* Start processing outbound messages and send through channels
 	*/

package/dist/src/storage/sqlite/device-pairing-approval.js

@@ -3,6 +3,8 @@ import { buildDevicePairingProof, devicePairingCompleteSchema, devicePairingDevi
 import { DEFAULT_BROWSER_EXTENSION_SCOPES, DEFAULT_MOBILE_SCOPES } from "../../gateway/security/gateway-scopes.js";
 import { createDevice, getDevice, registerInitialDeviceRefreshToken, revokeDevice } from "./device-access-repository.js";
 import { getOrCreateGatewayIdentity } from "./gateway-identity-repository.js";
+import { browserEnrollmentPublicKeyThumbprint } from "../../browser/enrollment.js";
+import "../../browser/extension-identity.js";
 import crypto from "node:crypto";
 //#region src/storage/sqlite/device-pairing-approval.ts
 const PROOF_WINDOW_MS = 5 * 6e4;
@@ -20,6 +22,23 @@ const fail = (code, status) => {
 	throw new DevicePairingError(code, status);
 };
 const scopesForPlatform = (platform) => platform === "chrome" ? DEFAULT_BROWSER_EXTENSION_SCOPES : DEFAULT_MOBILE_SCOPES;
+function isTrustedLocalBrowserSetup(setup, deviceJson) {
+	const device = devicePairingDeviceSchema.parse(JSON.parse(deviceJson));
+	if (device.platform !== "chrome" || device.extensionId !== "gopbfhaojnnhiheiikblejnpgmfmkmgd" || setup.enrollment_issuer !== "browser-native-host" || setup.enrollment_extension_id !== device.extensionId || !setup.enrollment_public_key_thumbprint || browserEnrollmentPublicKeyThumbprint(device.publicKeyJwk) !== setup.enrollment_public_key_thumbprint || !setup.enrollment_nonce) return false;
+	const routes = JSON.parse(setup.routes_json);
+	if (routes.length !== 1 || routes[0]?.kind !== "local-browser") return false;
+	try {
+		const url = new URL(routes[0].url);
+		return url.protocol === "http:" && url.hostname === "127.0.0.1";
+	} catch {
+		return false;
+	}
+}
+function approveTrustedLocalBrowserRequest(setup, row, now) {
+	if (row.status !== "pending" || !isTrustedLocalBrowserSetup(setup, row.device_json)) return row;
+	getSqliteDatabase().prepare("UPDATE device_pairing_requests SET status = 'approved', revision = revision + 1 WHERE request_id = ? AND status = 'pending'").run(row.request_id);
+	return requestRow(row.request_id, now);
+}
 function requestRow(id, now) {
 	const db = getSqliteDatabase();
 	db.prepare(`UPDATE device_pairing_requests SET status = 'expired', revision = revision + 1
@@ -75,18 +94,19 @@ function submitDevicePairingRequest(body, now = Date.now()) {
 	const setup = verifiedSetup(String(body.pairingToken), now);
 	const device = devicePairingDeviceSchema.parse(body.device);
 	const deviceJson = JSON.stringify(device);
+	const autoApprove = isTrustedLocalBrowserSetup(setup, deviceJson);
 	verifyProof("request", body, deviceJson, now);
 	return runSqliteWriteTransaction((db) => {
 		const existing = db.prepare("SELECT request_id, device_json FROM device_pairing_requests WHERE pairing_id = ?").get(setup.pairing_id);
 		if (existing) {
 			if (existing.request_id !== body.requestId || existing.device_json !== deviceJson) return fail("PAIRING_BUSY");
-			return statusFromRow(requestRow(existing.request_id, now), now);
+			return statusFromRow(approveTrustedLocalBrowserRequest(setup, requestRow(existing.request_id, now), now), now);
 		}
 		if (setup.consumed_at !== null) return fail("PAIRING_CANCELLED");
 		if (setup.expires_at <= now) return fail("PAIRING_EXPIRED");
 		const expiresAt = Math.min(setup.expires_at, now + APPROVAL_WINDOW_MS);
 		db.prepare(`INSERT INTO device_pairing_requests (request_id, pairing_id, device_json, status,
-      confirmation_code, expires_at, recovery_until, created_at) VALUES (?, ?, ?, 'pending', ?, ?, ?, ?)`).run(String(body.requestId), setup.pairing_id, deviceJson, crypto.randomInt(0, 1e6).toString().padStart(6, "0"), expiresAt, setup.expires_at + RECOVERY_WINDOW_MS, now);
+      confirmation_code, expires_at, recovery_until, created_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?)`).run(String(body.requestId), setup.pairing_id, deviceJson, autoApprove ? "approved" : "pending", crypto.randomInt(0, 1e6).toString().padStart(6, "0"), expiresAt, setup.expires_at + RECOVERY_WINDOW_MS, now);
 		return statusFromRow(requestRow(String(body.requestId), now), now);
 	});
 }
@@ -115,9 +135,10 @@ function cancelDevicePairingSetup(id, now = Date.now()) {
 }
 function operateDevicePairingRequest(action, body, now = Date.now()) {
 	const setup = verifiedSetup(String(body.pairingToken), now);
-	const row = requestRow(String(body.requestId), now);
+	let row = requestRow(String(body.requestId), now);
 	if (row.pairing_id !== setup.pairing_id) return fail("PAIRING_DENIED", 401);
 	verifyProof(action, body, row.device_json, now);
+	if (action === "status") row = approveTrustedLocalBrowserRequest(setup, row, now);
 	if (action !== "cancel" && row.device_id && getDevice(row.device_id)?.revokedAt !== void 0) return fail("DEVICE_REVOKED", 401);
 	if (now >= row.recovery_until) return fail("PAIRING_EXPIRED");
 	if (action === "cancel") runSqliteWriteTransaction((db) => {

package/dist/src/storage/sqlite/device-pairing-repository.d.ts

@@ -9,6 +9,12 @@ export type DevicePairingSetup = {
     routes: DeviceRoute[];
     expiresAt: number;
 };
+export type DevicePairingEnrollment = {
+    issuer: 'browser-native-host';
+    extensionId: string;
+    publicKeyThumbprint: string;
+    nonce: string;
+};
 export type PairingConsumeResult = {
     ok: true;
     pairingId: string;
@@ -17,6 +23,9 @@ export type PairingConsumeResult = {
     ok: false;
     reason: 'invalid' | 'expired' | 'consumed';
 };
-export declare function createDevicePairingSetup(routes: readonly DeviceRoute[], now?: number, protocolVersion?: 2 | 3): DevicePairingSetup;
+export declare function createDevicePairingSetup(routes: readonly DeviceRoute[], now?: number, protocolVersion?: 2 | 3, options?: {
+    ttlMs?: number;
+    enrollment?: DevicePairingEnrollment;
+}): DevicePairingSetup;
 export declare function consumeDevicePairingToken(token: string, now?: number): PairingConsumeResult;
 export declare function isDevicePairingSetupActive(pairingId: string, now?: number): boolean;

package/dist/src/storage/sqlite/device-pairing-repository.js

@@ -16,11 +16,11 @@ function tokenId(token) {
 	if (separator <= 10 || separator === token.length - 1) return void 0;
 	return token.slice(10, separator);
 }
-function createDevicePairingSetup(routes, now = Date.now(), protocolVersion = 2) {
+function createDevicePairingSetup(routes, now = Date.now(), protocolVersion = 2, options) {
 	if (routes.length === 0) throw new Error("No secure mobile route is available");
 	const id = crypto.randomUUID();
 	const token = `${PAIRING_TOKEN_PREFIX}${id}_${crypto.randomBytes(32).toString("base64url")}`;
-	const expiresAt = now + PAIRING_TTL_MS;
+	const expiresAt = now + (options?.ttlMs ?? PAIRING_TTL_MS);
 	runSqliteWriteTransaction((db) => {
 		db.prepare(`DELETE FROM device_pairing_sessions WHERE
       (protocol_version = 2 AND (expires_at <= ? OR consumed_at IS NOT NULL)) OR
@@ -28,9 +28,10 @@ function createDevicePairingSetup(routes, now = Date.now(), protocolVersion = 2)
 		db.prepare(`
       INSERT INTO device_pairing_sessions (
         pairing_id, secret_hash, routes_json, expires_at, attempts_remaining, created_at
-        , protocol_version
-      ) VALUES (?, ?, ?, ?, ?, ?, ?)
-    `).run(id, hashToken(token), JSON.stringify(routes), expiresAt, PAIRING_ATTEMPTS, now, protocolVersion);
+        , protocol_version, enrollment_issuer, enrollment_extension_id,
+        enrollment_public_key_thumbprint, enrollment_nonce
+      ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+    `).run(id, hashToken(token), JSON.stringify(routes), expiresAt, PAIRING_ATTEMPTS, now, protocolVersion, options?.enrollment?.issuer ?? null, options?.enrollment?.extensionId ?? null, options?.enrollment?.publicKeyThumbprint ?? null, options?.enrollment?.nonce ?? null);
 	});
 	return {
 		id,

package/dist/src/storage/sqlite/migrations/157_browser_endpoint_principals.sql

@@ -0,0 +1,50 @@
+PRAGMA defer_foreign_keys = ON;
+
+-- Rebuild the related tables because SQLite rewrites the child foreign-key target
+-- when the parent table is renamed.
+ALTER TABLE endpoint_session_bindings RENAME TO endpoint_session_bindings_v156;
+ALTER TABLE endpoint_instance_bindings RENAME TO endpoint_instance_bindings_v156;
+ALTER TABLE endpoint_principals RENAME TO endpoint_principals_v156;
+
+DROP INDEX idx_endpoint_session_bindings_endpoint;
+DROP INDEX idx_endpoint_instance_bindings_principal;
+DROP INDEX idx_endpoint_principals_active;
+
+CREATE TABLE endpoint_principals (
+  id           TEXT PRIMARY KEY,
+  kind         TEXT NOT NULL CHECK(kind IN ('web', 'desktop', 'mobile', 'browser')),
+  display_name TEXT NOT NULL,
+  platform     TEXT NOT NULL,
+  public_key   TEXT NOT NULL,
+  created_at   INTEGER NOT NULL,
+  last_seen_at INTEGER,
+  revoked_at   INTEGER
+);
+
+CREATE TABLE endpoint_instance_bindings (
+  endpoint_id TEXT PRIMARY KEY,
+  principal_id TEXT NOT NULL REFERENCES endpoint_principals(id),
+  bound_at INTEGER NOT NULL
+);
+
+CREATE TABLE endpoint_session_bindings (
+  session_key TEXT PRIMARY KEY,
+  endpoint_id TEXT NOT NULL REFERENCES endpoint_instance_bindings(endpoint_id),
+  bound_at INTEGER NOT NULL
+);
+
+INSERT INTO endpoint_principals SELECT * FROM endpoint_principals_v156;
+INSERT INTO endpoint_instance_bindings SELECT * FROM endpoint_instance_bindings_v156;
+INSERT INTO endpoint_session_bindings SELECT * FROM endpoint_session_bindings_v156;
+
+DROP TABLE endpoint_session_bindings_v156;
+DROP TABLE endpoint_instance_bindings_v156;
+DROP TABLE endpoint_principals_v156;
+
+CREATE INDEX idx_endpoint_principals_active
+  ON endpoint_principals(kind, last_seen_at DESC)
+  WHERE revoked_at IS NULL;
+CREATE INDEX idx_endpoint_instance_bindings_principal
+  ON endpoint_instance_bindings(principal_id);
+CREATE INDEX idx_endpoint_session_bindings_endpoint
+  ON endpoint_session_bindings(endpoint_id);

package/dist/src/storage/sqlite/migrations/158_browser_native_enrollment.sql

@@ -0,0 +1,4 @@
+ALTER TABLE device_pairing_sessions ADD COLUMN enrollment_issuer TEXT;
+ALTER TABLE device_pairing_sessions ADD COLUMN enrollment_extension_id TEXT;
+ALTER TABLE device_pairing_sessions ADD COLUMN enrollment_public_key_thumbprint TEXT;
+ALTER TABLE device_pairing_sessions ADD COLUMN enrollment_nonce TEXT;

package/dist/src/storage/sqlite/migrations/runner.d.ts

@@ -3,7 +3,7 @@ import type { ApplyMigrationsOptions } from './types.js';
 /** Baseline schema version applied from schema.sql on first open. */
 export declare const XOPC_DB_BASELINE_SCHEMA_VERSION = 11;
 /** Latest schema version this release supports (increment when adding migrations). */
-export declare const XOPC_DB_SCHEMA_VERSION = 156;
+export declare const XOPC_DB_SCHEMA_VERSION = 158;
 export declare function resolveMigrationsDir(override?: string): string;
 /**
  * Apply sequential SQL migrations from (currentVersion + 1) through targetVersion.

package/dist/src/storage/sqlite/migrations/runner.js

@@ -12,7 +12,7 @@ const log = createLogger("Sqlite:Migrations");
 /** Baseline schema version applied from schema.sql on first open. */
 const XOPC_DB_BASELINE_SCHEMA_VERSION = 11;
 /** Latest schema version this release supports (increment when adding migrations). */
-const XOPC_DB_SCHEMA_VERSION = 156;
+const XOPC_DB_SCHEMA_VERSION = 158;
 const MODULE_DIR = dirname(fileURLToPath(import.meta.url));
 function backupBeforeTaskCutover(db, databasePath) {
 	db.exec("PRAGMA wal_checkpoint(FULL)");
@@ -57,7 +57,7 @@ function applySingleMigration(db, migration) {
 * Each step runs in its own transaction and updates schema_meta on success.
 */
 function applyPendingMigrations(db, options = {}) {
-	const targetVersion = options.targetVersion ?? 156;
+	const targetVersion = options.targetVersion ?? 158;
 	let currentVersion = readSchemaVersion(db);
 	if (currentVersion > targetVersion) throw new DatabaseSchemaTooNewError(currentVersion, targetVersion);
 	if (currentVersion >= targetVersion) return currentVersion;
@@ -94,7 +94,7 @@ function applyPendingMigrations(db, options = {}) {
 }
 /** Inspect schema version without mutating the database. */
 function inspectSchemaMigrationStatus(db, options = {}) {
-	const appVersion = options.targetVersion ?? 156;
+	const appVersion = options.targetVersion ?? 158;
 	const dbVersion = readSchemaVersion(db);
 	if (dbVersion > appVersion) return {
 		dbVersion,

package/dist/src/storage/sqlite/migrations/runner.ts

@@ -19,7 +19,7 @@ const log = createLogger('Sqlite:Migrations');
 export const XOPC_DB_BASELINE_SCHEMA_VERSION = 11;
 
 /** Latest schema version this release supports (increment when adding migrations). */
-export const XOPC_DB_SCHEMA_VERSION = 156;
+export const XOPC_DB_SCHEMA_VERSION = 158;
 
 const MODULE_DIR = dirname(fileURLToPath(import.meta.url));
 

package/dist/src/storage/sqlite/schema.js

@@ -32,7 +32,7 @@ function ensureXopcDatabaseSchema(db, options = {}) {
 		currentVersion = 11;
 	}
 	applyPendingMigrations(db, {
-		targetVersion: 156,
+		targetVersion: 158,
 		databasePath: options.databasePath
 	});
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@xopcai/xopc",
-  "version": "0.0.266",
+  "version": "0.0.267",
   "description": "Local-first personal AI assistant with reviewable user understanding, durable tasks, workflows, automations, and local or cloud models.",
   "type": "module",
   "main": "dist/src/index.js",
@@ -165,9 +165,9 @@
     "vue": "^3.5.35",
     "@xopcai/browser-control-contract": "0.1.0",
     "@xopcai/endpoint-tools-protocol": "0.0.0",
+    "@xopcai/gateway-contract": "0.0.0",
     "@xopcai/realtime-client": "0.0.0",
-    "@xopcai/realtime-protocol": "0.0.0",
-    "@xopcai/gateway-contract": "0.0.0"
+    "@xopcai/realtime-protocol": "0.0.0"
   },
   "scripts": {
     "assets:brand": "node scripts/generate-brand-assets.mjs",