@xopcai/xopc 0.0.266 → 0.0.268

package/dist/src/gateway/service.js

@@ -12,16 +12,16 @@ import { getSessionConfig } from "../storage/sqlite/config-repository.js";
 import "../storage/sqlite/index.js";
 import { getAgentDefaultModelRef, init_schema } from "../config/schema.js";
 import { init_agent_scope, listAgentEntries, normalizeAgentId, resolveAgentWorkspaceDir, resolveDefaultAgentId } from "../agent/agent-scope.js";
+import { buildSessionKey, init_session_key, sanitizeSegment } from "../routing/session-key.js";
+import { getDefaultAgentId, init_resolve_route } from "../routing/resolve-route.js";
+import { resolveEffectiveAgentProfileForSession } from "../config/agent-profile.js";
 import { init_paths, resolveConfigPath, resolveExtensionsDir } from "../config/paths.js";
-import { prewarmModelRegistry } from "../providers/model-registry.js";
 import { areExtensionsGloballyDisabled } from "../extensions/discover-extensions.js";
 import { buildExtensionMetadataSnapshot } from "../extensions/extension-metadata-snapshot.js";
 import { buildChannelCatalogForConfig, buildChannelCatalogFromSnapshot, init_channel_catalog_service } from "../channels/catalog/channel-catalog-service.js";
 import { loadConfig, saveConfig } from "../config/loader.js";
-import { buildSessionKey, init_session_key, sanitizeSegment } from "../routing/session-key.js";
-import { getDefaultAgentId, init_resolve_route } from "../routing/resolve-route.js";
+import { prewarmModelRegistry } from "../providers/model-registry.js";
 import { init_providers, providers_exports } from "../providers/index.js";
-import { resolveEffectiveAgentProfileForSession } from "../config/agent-profile.js";
 import { TaskRepository } from "../tasks/task-repository.js";
 import { TaskConversationRepository } from "../tasks/task-conversation-repository.js";
 import { getEmbeddedExecutionSession } from "../agent/embedded/execution-context.js";
@@ -54,12 +54,6 @@ import { registerClarificationChannelRuntime } from "./clarify-runtime.js";
 import { ChannelManager } from "../channels/manager.js";
 import { getWorkspacePath } from "../config/workspace-path-helpers.js";
 import "../config/index.js";
-import { DiscussionService } from "../discussions/service.js";
-import { DiscussionOrganizer } from "../discussions/organizer.js";
-import { DiscussionLiveWorker } from "../discussions/live-worker.js";
-import { DiscussionOrganizerWorker } from "../discussions/organizer-worker.js";
-import { DiscussionSealer } from "../discussions/sealer.js";
-import "../discussions/index.js";
 import { ManagedComposioEventPoller } from "../connectors/composio-managed-events.js";
 import { startConnectedKnowledgeCoordinator } from "../knowledge/coordinator.js";
 import "../knowledge/index.js";
@@ -67,6 +61,12 @@ import { ConnectionRecoveryService } from "../connectors/connection-recovery-ser
 import { startConnectorLearningCoordinator } from "../connectors/learning-coordinator.js";
 import { ConnectedSourceChangePublisher } from "../connectors/source-change-publisher.js";
 import { startConnectorSupervisor } from "../connectors/supervisor.js";
+import { DiscussionService } from "../discussions/service.js";
+import { DiscussionOrganizer } from "../discussions/organizer.js";
+import { DiscussionLiveWorker } from "../discussions/live-worker.js";
+import { DiscussionOrganizerWorker } from "../discussions/organizer-worker.js";
+import { DiscussionSealer } from "../discussions/sealer.js";
+import "../discussions/index.js";
 import { EndpointToolRuntime } from "../endpoint-tools/runtime.js";
 import "../endpoint-tools/index.js";
 import { assertGatewayAuthConfigured, extractToken, resolveGatewayAuth, validateToken } from "./auth.js";
@@ -152,10 +152,6 @@ var GatewayService = class {
 	notesService;
 	extensionLoader = null;
 	extensionMetadataSnapshot = null;
-	browserExtensionProvider = null;
-	browserExtensionRelease = null;
-	/** `${host}:${port}` when the gateway holds the extension bridge listener. */
-	browserExtensionBindKey = null;
 	heartbeatService = null;
 	sessionIndex;
 	running = false;
@@ -249,6 +245,7 @@ var GatewayService = class {
 	get browserAutomations() {
 		if (!this.browserAutomationService) this.browserAutomationService = createRuntimeBrowserAutomationService({
 			getConfig: () => this.config,
+			endpointTools: this.endpointTools,
 			emit: (type, payload) => this.emit(type, payload)
 		});
 		return this.browserAutomationService;
@@ -520,7 +517,6 @@ var GatewayService = class {
 			getChannelManager: () => this.channelManager,
 			getHeartbeatService: () => this.heartbeatService,
 			getExtensionLoader: () => this.extensionLoader,
-			reconcileBrowserExtensionServer: () => this.reconcileBrowserExtensionServer(),
 			reconcileMemoryMaintenanceAutomations: () => this.reconcileMemoryMaintenanceAutomations(),
 			getChannelsStatus: () => this.getChannelsStatus(),
 			emit: (type, payload) => this.emit(type, payload)
@@ -1099,7 +1095,6 @@ var GatewayService = class {
 			workspaceId: this.currentWorkspacePath
 		}) });
 		import("../browser/providers/browser-ext-install.js").then(({ ensureBrowserExtensionOnStartup }) => ensureBrowserExtensionOnStartup(this.config)).catch((err) => log.warn({ err }, "Browser extension artifact ensure failed"));
-		await trace.measure("browser-extension.start", () => this.startBrowserExtensionServerIfNeeded());
 		this.agentService.start().catch((err) => {
 			log.error({ err }, "Agent service error");
 		});
@@ -1260,12 +1255,6 @@ var GatewayService = class {
 		this.connectedKnowledgeCoordinator?.stop();
 		this.connectedKnowledgeCoordinator = null;
 		await this.browserAutomationService?.shutdown();
-		if (this.browserExtensionRelease) {
-			await this.browserExtensionRelease();
-			this.browserExtensionRelease = null;
-		}
-		this.browserExtensionProvider = null;
-		this.browserExtensionBindKey = null;
 		registerClarificationChannelRuntime(null);
 		this.connectionRecovery.stop();
 		this.agentRunner.disposeClarifications();
@@ -1288,73 +1277,6 @@ var GatewayService = class {
 		closeXopcDatabase();
 		log.debug("Gateway service stopped");
 	}
-	/** Start the browser extension WebSocket server when its driver is active. */
-	async startBrowserExtensionServerIfNeeded() {
-		await this.reconcileBrowserExtensionServer();
-	}
-	/**
-	* Start/stop/rebind the Chrome extension bridge.
-	* PATCH saves update config in memory without re-running gateway startup, so this must run on save too.
-	*/
-	async reconcileBrowserExtensionServer() {
-		const driver = this.config.browser.driver;
-		const bridgeConfig = this.config.browser.enabled && driver.kind === "extension" ? {
-			host: "127.0.0.1",
-			port: 19820,
-			connectionTimeout: this.config.browser.limits.actionTimeoutMs,
-			commandTimeout: this.config.browser.limits.actionTimeoutMs
-		} : null;
-		if (!bridgeConfig) {
-			if (this.browserExtensionRelease) {
-				await this.browserExtensionRelease();
-				this.browserExtensionRelease = null;
-				this.browserExtensionProvider = null;
-				this.browserExtensionBindKey = null;
-				log.debug("Browser extension WebSocket server stopped because its driver is inactive");
-			}
-			return;
-		}
-		const { port, host, connectionTimeout, commandTimeout } = bridgeConfig;
-		const bindKey = `${host}:${port}`;
-		if (this.browserExtensionRelease && this.browserExtensionBindKey === bindKey) return;
-		if (this.browserExtensionRelease) {
-			await this.browserExtensionRelease();
-			this.browserExtensionRelease = null;
-			this.browserExtensionProvider = null;
-			this.browserExtensionBindKey = null;
-		}
-		try {
-			const { acquireExtensionBrowserServer } = await import("../browser/providers/extension-ws-acquire.js");
-			const { provider, release } = await acquireExtensionBrowserServer({
-				port,
-				host,
-				connectionTimeout,
-				commandTimeout
-			});
-			this.browserExtensionProvider = provider;
-			this.browserExtensionRelease = release;
-			this.browserExtensionBindKey = bindKey;
-			log.info({
-				port,
-				host
-			}, "Browser extension WS server started");
-		} catch (err) {
-			if ((err && typeof err === "object" && "code" in err ? err.code : void 0) === "EADDRINUSE") {
-				log.warn({
-					err,
-					phase: "browser_extension_ws",
-					bindPort: port,
-					bindHost: host,
-					hint: "Another process holds the browser extension bridge port 19820. Stop it before starting xopc."
-				}, `Browser extension WS server port is already in use: ${host}:${port}`);
-				return;
-			}
-			log.error({
-				err,
-				phase: "browser_extension_ws"
-			}, `Failed to start browser extension WS server: ${err instanceof Error ? err.message : String(err)}`);
-		}
-	}
 	/**
 	* Start processing outbound messages and send through channels
 	*/

package/dist/src/heartbeat/index.js

@@ -1,6 +1,6 @@
 import { DEFAULT_ACK_MAX_CHARS, HEARTBEAT_OK, NO_REPLY, shouldSilence, stripHeartbeatToken } from "./tokens.js";
-import { appendCronEventLines } from "./event-prompt.js";
 import { isWithinActiveHours } from "./active-hours.js";
 import { isHeartbeatContentEmpty } from "./content-check.js";
+import { appendCronEventLines } from "./event-prompt.js";
 import { createHeartbeatWake } from "./wake.js";
 export { DEFAULT_ACK_MAX_CHARS, HEARTBEAT_OK, NO_REPLY, appendCronEventLines, createHeartbeatWake, isHeartbeatContentEmpty, isWithinActiveHours, shouldSilence, stripHeartbeatToken };

package/dist/src/providers/auth-runtime/resolve-auth.js

@@ -1,5 +1,5 @@
-import { getApiKeyFromEnv, init_env_keys } from "../env-keys.js";
 import { init_sync_provider_auth, resolveProviderApiKeyForAgentSync } from "../../auth/sync-provider-auth.js";
+import { getApiKeyFromEnv, init_env_keys } from "../env-keys.js";
 import { getDefaultAuthProfileStore } from "./auth-profile-store.js";
 //#region src/providers/auth-runtime/resolve-auth.ts
 init_env_keys();

package/dist/src/providers/index.js

@@ -1,11 +1,11 @@
 import { __esmMin, __exportAll } from "../../_virtual/_rolldown/runtime.js";
 import { getAgentDefaultModelRef, init_schema } from "../config/schema.js";
+import { getModelOAuthProviderIds, init_registry } from "../auth/oauth/registry.js";
+import { hasProviderAuthOnDiskSync, init_sync_provider_auth } from "../auth/sync-provider-auth.js";
 import { PROVIDER_ENV_MAP, getApiKeyFromEnv, init_env_keys } from "./env-keys.js";
 import { init_model_ref, splitProviderModelRef } from "./model-ref.js";
 import { ModelRegistry, getModelRegistry, init_model_registry, prewarmModelRegistry, resetModelRegistry } from "./model-registry.js";
-import { getModelOAuthProviderIds, init_registry } from "../auth/oauth/registry.js";
 import { CredentialResolver, hasCredentials, init_credentials } from "../auth/credentials.js";
-import { hasProviderAuthOnDiskSync, init_sync_provider_auth } from "../auth/sync-provider-auth.js";
 import { EXTENSION_PROVIDER_BASE_URL, init_constants } from "./constants.js";
 import { applyOfficialModelMetadataCorrections, getSupplementalModels, init_model_supplements } from "./model-supplements.js";
 import { getProviderRegistry, init_plugin_registry } from "./plugin-registry.js";

package/dist/src/providers/model-registry.js

@@ -1,8 +1,8 @@
 import { __esmMin } from "../../_virtual/_rolldown/runtime.js";
 import { createLogger } from "../utils/logger/index.js";
 import { init_logger } from "../utils/logger.js";
-import { init_resolve_config_value, resolveConfigValue, resolveHeaders } from "../config/resolve-config-value.js";
 import { resolveModelsJsonPath } from "../config/paths.js";
+import { init_resolve_config_value, resolveConfigValue, resolveHeaders } from "../config/resolve-config-value.js";
 import { getDefaultModelValues, init_models_json, validateModelsConfig } from "../config/models-json.js";
 import { getApiKeyFromEnv, init_env_keys } from "./env-keys.js";
 import { getModelCatalogStore, init_model_catalog_store } from "./model-catalog-store.js";

package/dist/src/providers/register-runtime-providers.js

@@ -1,6 +1,6 @@
 import { __esmMin } from "../../_virtual/_rolldown/runtime.js";
-import { getModelCatalogStore, init_model_catalog_store } from "./model-catalog-store.js";
 import { getOAuthProviderDefinition, init_registry } from "../auth/oauth/registry.js";
+import { getModelCatalogStore, init_model_catalog_store } from "./model-catalog-store.js";
 import { XOPC_CLOUD_PROVIDER_ID, init_xopc_cloud_config, resolveXopcModelRouterUrl } from "./xopc-cloud-config.js";
 //#region src/providers/register-runtime-providers.ts
 function registerRuntimeProvider(modelRuntime, source) {

package/dist/src/storage/sqlite/device-pairing-approval.js

@@ -3,6 +3,8 @@ import { buildDevicePairingProof, devicePairingCompleteSchema, devicePairingDevi
 import { DEFAULT_BROWSER_EXTENSION_SCOPES, DEFAULT_MOBILE_SCOPES } from "../../gateway/security/gateway-scopes.js";
 import { createDevice, getDevice, registerInitialDeviceRefreshToken, revokeDevice } from "./device-access-repository.js";
 import { getOrCreateGatewayIdentity } from "./gateway-identity-repository.js";
+import { browserEnrollmentPublicKeyThumbprint } from "../../browser/enrollment.js";
+import "../../browser/extension-identity.js";
 import crypto from "node:crypto";
 //#region src/storage/sqlite/device-pairing-approval.ts
 const PROOF_WINDOW_MS = 5 * 6e4;
@@ -20,6 +22,23 @@ const fail = (code, status) => {
 	throw new DevicePairingError(code, status);
 };
 const scopesForPlatform = (platform) => platform === "chrome" ? DEFAULT_BROWSER_EXTENSION_SCOPES : DEFAULT_MOBILE_SCOPES;
+function isTrustedLocalBrowserSetup(setup, deviceJson) {
+	const device = devicePairingDeviceSchema.parse(JSON.parse(deviceJson));
+	if (device.platform !== "chrome" || device.extensionId !== "gopbfhaojnnhiheiikblejnpgmfmkmgd" || setup.enrollment_issuer !== "browser-native-host" || setup.enrollment_extension_id !== device.extensionId || !setup.enrollment_public_key_thumbprint || browserEnrollmentPublicKeyThumbprint(device.publicKeyJwk) !== setup.enrollment_public_key_thumbprint || !setup.enrollment_nonce) return false;
+	const routes = JSON.parse(setup.routes_json);
+	if (routes.length !== 1 || routes[0]?.kind !== "local-browser") return false;
+	try {
+		const url = new URL(routes[0].url);
+		return url.protocol === "http:" && url.hostname === "127.0.0.1";
+	} catch {
+		return false;
+	}
+}
+function approveTrustedLocalBrowserRequest(setup, row, now) {
+	if (row.status !== "pending" || !isTrustedLocalBrowserSetup(setup, row.device_json)) return row;
+	getSqliteDatabase().prepare("UPDATE device_pairing_requests SET status = 'approved', revision = revision + 1 WHERE request_id = ? AND status = 'pending'").run(row.request_id);
+	return requestRow(row.request_id, now);
+}
 function requestRow(id, now) {
 	const db = getSqliteDatabase();
 	db.prepare(`UPDATE device_pairing_requests SET status = 'expired', revision = revision + 1
@@ -75,18 +94,19 @@ function submitDevicePairingRequest(body, now = Date.now()) {
 	const setup = verifiedSetup(String(body.pairingToken), now);
 	const device = devicePairingDeviceSchema.parse(body.device);
 	const deviceJson = JSON.stringify(device);
+	const autoApprove = isTrustedLocalBrowserSetup(setup, deviceJson);
 	verifyProof("request", body, deviceJson, now);
 	return runSqliteWriteTransaction((db) => {
 		const existing = db.prepare("SELECT request_id, device_json FROM device_pairing_requests WHERE pairing_id = ?").get(setup.pairing_id);
 		if (existing) {
 			if (existing.request_id !== body.requestId || existing.device_json !== deviceJson) return fail("PAIRING_BUSY");
-			return statusFromRow(requestRow(existing.request_id, now), now);
+			return statusFromRow(approveTrustedLocalBrowserRequest(setup, requestRow(existing.request_id, now), now), now);
 		}
 		if (setup.consumed_at !== null) return fail("PAIRING_CANCELLED");
 		if (setup.expires_at <= now) return fail("PAIRING_EXPIRED");
 		const expiresAt = Math.min(setup.expires_at, now + APPROVAL_WINDOW_MS);
 		db.prepare(`INSERT INTO device_pairing_requests (request_id, pairing_id, device_json, status,
-      confirmation_code, expires_at, recovery_until, created_at) VALUES (?, ?, ?, 'pending', ?, ?, ?, ?)`).run(String(body.requestId), setup.pairing_id, deviceJson, crypto.randomInt(0, 1e6).toString().padStart(6, "0"), expiresAt, setup.expires_at + RECOVERY_WINDOW_MS, now);
+      confirmation_code, expires_at, recovery_until, created_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?)`).run(String(body.requestId), setup.pairing_id, deviceJson, autoApprove ? "approved" : "pending", crypto.randomInt(0, 1e6).toString().padStart(6, "0"), expiresAt, setup.expires_at + RECOVERY_WINDOW_MS, now);
 		return statusFromRow(requestRow(String(body.requestId), now), now);
 	});
 }
@@ -115,9 +135,10 @@ function cancelDevicePairingSetup(id, now = Date.now()) {
 }
 function operateDevicePairingRequest(action, body, now = Date.now()) {
 	const setup = verifiedSetup(String(body.pairingToken), now);
-	const row = requestRow(String(body.requestId), now);
+	let row = requestRow(String(body.requestId), now);
 	if (row.pairing_id !== setup.pairing_id) return fail("PAIRING_DENIED", 401);
 	verifyProof(action, body, row.device_json, now);
+	if (action === "status") row = approveTrustedLocalBrowserRequest(setup, row, now);
 	if (action !== "cancel" && row.device_id && getDevice(row.device_id)?.revokedAt !== void 0) return fail("DEVICE_REVOKED", 401);
 	if (now >= row.recovery_until) return fail("PAIRING_EXPIRED");
 	if (action === "cancel") runSqliteWriteTransaction((db) => {

package/dist/src/storage/sqlite/device-pairing-repository.d.ts

@@ -9,6 +9,12 @@ export type DevicePairingSetup = {
     routes: DeviceRoute[];
     expiresAt: number;
 };
+export type DevicePairingEnrollment = {
+    issuer: 'browser-native-host';
+    extensionId: string;
+    publicKeyThumbprint: string;
+    nonce: string;
+};
 export type PairingConsumeResult = {
     ok: true;
     pairingId: string;
@@ -17,6 +23,9 @@ export type PairingConsumeResult = {
     ok: false;
     reason: 'invalid' | 'expired' | 'consumed';
 };
-export declare function createDevicePairingSetup(routes: readonly DeviceRoute[], now?: number, protocolVersion?: 2 | 3): DevicePairingSetup;
+export declare function createDevicePairingSetup(routes: readonly DeviceRoute[], now?: number, protocolVersion?: 2 | 3, options?: {
+    ttlMs?: number;
+    enrollment?: DevicePairingEnrollment;
+}): DevicePairingSetup;
 export declare function consumeDevicePairingToken(token: string, now?: number): PairingConsumeResult;
 export declare function isDevicePairingSetupActive(pairingId: string, now?: number): boolean;

package/dist/src/storage/sqlite/device-pairing-repository.js

@@ -16,11 +16,11 @@ function tokenId(token) {
 	if (separator <= 10 || separator === token.length - 1) return void 0;
 	return token.slice(10, separator);
 }
-function createDevicePairingSetup(routes, now = Date.now(), protocolVersion = 2) {
+function createDevicePairingSetup(routes, now = Date.now(), protocolVersion = 2, options) {
 	if (routes.length === 0) throw new Error("No secure mobile route is available");
 	const id = crypto.randomUUID();
 	const token = `${PAIRING_TOKEN_PREFIX}${id}_${crypto.randomBytes(32).toString("base64url")}`;
-	const expiresAt = now + PAIRING_TTL_MS;
+	const expiresAt = now + (options?.ttlMs ?? PAIRING_TTL_MS);
 	runSqliteWriteTransaction((db) => {
 		db.prepare(`DELETE FROM device_pairing_sessions WHERE
       (protocol_version = 2 AND (expires_at <= ? OR consumed_at IS NOT NULL)) OR
@@ -28,9 +28,10 @@ function createDevicePairingSetup(routes, now = Date.now(), protocolVersion = 2)
 		db.prepare(`
       INSERT INTO device_pairing_sessions (
         pairing_id, secret_hash, routes_json, expires_at, attempts_remaining, created_at
-        , protocol_version
-      ) VALUES (?, ?, ?, ?, ?, ?, ?)
-    `).run(id, hashToken(token), JSON.stringify(routes), expiresAt, PAIRING_ATTEMPTS, now, protocolVersion);
+        , protocol_version, enrollment_issuer, enrollment_extension_id,
+        enrollment_public_key_thumbprint, enrollment_nonce
+      ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+    `).run(id, hashToken(token), JSON.stringify(routes), expiresAt, PAIRING_ATTEMPTS, now, protocolVersion, options?.enrollment?.issuer ?? null, options?.enrollment?.extensionId ?? null, options?.enrollment?.publicKeyThumbprint ?? null, options?.enrollment?.nonce ?? null);
 	});
 	return {
 		id,

package/dist/src/storage/sqlite/migrations/157_browser_endpoint_principals.sql

@@ -0,0 +1,50 @@
+PRAGMA defer_foreign_keys = ON;
+
+-- Rebuild the related tables because SQLite rewrites the child foreign-key target
+-- when the parent table is renamed.
+ALTER TABLE endpoint_session_bindings RENAME TO endpoint_session_bindings_v156;
+ALTER TABLE endpoint_instance_bindings RENAME TO endpoint_instance_bindings_v156;
+ALTER TABLE endpoint_principals RENAME TO endpoint_principals_v156;
+
+DROP INDEX idx_endpoint_session_bindings_endpoint;
+DROP INDEX idx_endpoint_instance_bindings_principal;
+DROP INDEX idx_endpoint_principals_active;
+
+CREATE TABLE endpoint_principals (
+  id           TEXT PRIMARY KEY,
+  kind         TEXT NOT NULL CHECK(kind IN ('web', 'desktop', 'mobile', 'browser')),
+  display_name TEXT NOT NULL,
+  platform     TEXT NOT NULL,
+  public_key   TEXT NOT NULL,
+  created_at   INTEGER NOT NULL,
+  last_seen_at INTEGER,
+  revoked_at   INTEGER
+);
+
+CREATE TABLE endpoint_instance_bindings (
+  endpoint_id TEXT PRIMARY KEY,
+  principal_id TEXT NOT NULL REFERENCES endpoint_principals(id),
+  bound_at INTEGER NOT NULL
+);
+
+CREATE TABLE endpoint_session_bindings (
+  session_key TEXT PRIMARY KEY,
+  endpoint_id TEXT NOT NULL REFERENCES endpoint_instance_bindings(endpoint_id),
+  bound_at INTEGER NOT NULL
+);
+
+INSERT INTO endpoint_principals SELECT * FROM endpoint_principals_v156;
+INSERT INTO endpoint_instance_bindings SELECT * FROM endpoint_instance_bindings_v156;
+INSERT INTO endpoint_session_bindings SELECT * FROM endpoint_session_bindings_v156;
+
+DROP TABLE endpoint_session_bindings_v156;
+DROP TABLE endpoint_instance_bindings_v156;
+DROP TABLE endpoint_principals_v156;
+
+CREATE INDEX idx_endpoint_principals_active
+  ON endpoint_principals(kind, last_seen_at DESC)
+  WHERE revoked_at IS NULL;
+CREATE INDEX idx_endpoint_instance_bindings_principal
+  ON endpoint_instance_bindings(principal_id);
+CREATE INDEX idx_endpoint_session_bindings_endpoint
+  ON endpoint_session_bindings(endpoint_id);

package/dist/src/storage/sqlite/migrations/158_browser_native_enrollment.sql

@@ -0,0 +1,4 @@
+ALTER TABLE device_pairing_sessions ADD COLUMN enrollment_issuer TEXT;
+ALTER TABLE device_pairing_sessions ADD COLUMN enrollment_extension_id TEXT;
+ALTER TABLE device_pairing_sessions ADD COLUMN enrollment_public_key_thumbprint TEXT;
+ALTER TABLE device_pairing_sessions ADD COLUMN enrollment_nonce TEXT;

package/dist/src/storage/sqlite/migrations/runner.d.ts

@@ -3,7 +3,7 @@ import type { ApplyMigrationsOptions } from './types.js';
 /** Baseline schema version applied from schema.sql on first open. */
 export declare const XOPC_DB_BASELINE_SCHEMA_VERSION = 11;
 /** Latest schema version this release supports (increment when adding migrations). */
-export declare const XOPC_DB_SCHEMA_VERSION = 156;
+export declare const XOPC_DB_SCHEMA_VERSION = 158;
 export declare function resolveMigrationsDir(override?: string): string;
 /**
  * Apply sequential SQL migrations from (currentVersion + 1) through targetVersion.

package/dist/src/storage/sqlite/migrations/runner.js

@@ -12,7 +12,7 @@ const log = createLogger("Sqlite:Migrations");
 /** Baseline schema version applied from schema.sql on first open. */
 const XOPC_DB_BASELINE_SCHEMA_VERSION = 11;
 /** Latest schema version this release supports (increment when adding migrations). */
-const XOPC_DB_SCHEMA_VERSION = 156;
+const XOPC_DB_SCHEMA_VERSION = 158;
 const MODULE_DIR = dirname(fileURLToPath(import.meta.url));
 function backupBeforeTaskCutover(db, databasePath) {
 	db.exec("PRAGMA wal_checkpoint(FULL)");
@@ -57,7 +57,7 @@ function applySingleMigration(db, migration) {
 * Each step runs in its own transaction and updates schema_meta on success.
 */
 function applyPendingMigrations(db, options = {}) {
-	const targetVersion = options.targetVersion ?? 156;
+	const targetVersion = options.targetVersion ?? 158;
 	let currentVersion = readSchemaVersion(db);
 	if (currentVersion > targetVersion) throw new DatabaseSchemaTooNewError(currentVersion, targetVersion);
 	if (currentVersion >= targetVersion) return currentVersion;
@@ -94,7 +94,7 @@ function applyPendingMigrations(db, options = {}) {
 }
 /** Inspect schema version without mutating the database. */
 function inspectSchemaMigrationStatus(db, options = {}) {
-	const appVersion = options.targetVersion ?? 156;
+	const appVersion = options.targetVersion ?? 158;
 	const dbVersion = readSchemaVersion(db);
 	if (dbVersion > appVersion) return {
 		dbVersion,

package/dist/src/storage/sqlite/migrations/runner.ts

@@ -19,7 +19,7 @@ const log = createLogger('Sqlite:Migrations');
 export const XOPC_DB_BASELINE_SCHEMA_VERSION = 11;
 
 /** Latest schema version this release supports (increment when adding migrations). */
-export const XOPC_DB_SCHEMA_VERSION = 156;
+export const XOPC_DB_SCHEMA_VERSION = 158;
 
 const MODULE_DIR = dirname(fileURLToPath(import.meta.url));
 

package/dist/src/storage/sqlite/schema.js

@@ -32,7 +32,7 @@ function ensureXopcDatabaseSchema(db, options = {}) {
 		currentVersion = 11;
 	}
 	applyPendingMigrations(db, {
-		targetVersion: 156,
+		targetVersion: 158,
 		databasePath: options.databasePath
 	});
 }

package/dist/src/tui/tui-startup-resources.js

@@ -1,6 +1,6 @@
 import { resolveStateDir } from "../config/paths-state.js";
-import { init_paths, resolveAgentProfileDir, resolveBundledSkillsDir } from "../config/paths.js";
 import { resolveEffectiveAgentProfileForSession } from "../config/agent-profile.js";
+import { init_paths, resolveAgentProfileDir, resolveBundledSkillsDir } from "../config/paths.js";
 import { resolveBootstrapFilesSync } from "../agent/bootstrap/bootstrap-files.js";
 import { createSkillConfigManager, isSkillEnabled } from "../agent/skills/config.js";
 import { loadSkills } from "../agent/skills/index.js";

package/dist/src/tui/tui.js

@@ -2,10 +2,10 @@ import { version } from "../../package.js";
 import { resolveStateDir, resolveXopcDatabasePath } from "../config/paths-state.js";
 import { parseAgentSessionKey } from "../routing/session-key-utils.js";
 import { init_agent_session_key, normalizeAgentId } from "../routing/agent-session-key.js";
+import { resolveEffectiveAgentProfileForSession } from "../config/agent-profile.js";
 import { init_paths } from "../config/paths.js";
 import { loadConfig } from "../config/loader.js";
 import { getAllModels, getAllProviders, getApiKey, init_providers, isProviderConfiguredSync } from "../providers/index.js";
-import { resolveEffectiveAgentProfileForSession } from "../config/agent-profile.js";
 import { ProjectTrustStore, hasTrustRequiringProjectResources } from "../project-trust/trust-store.js";
 import { renderWorkflowFinalSummary, renderWorkflowPanel } from "../agent/workflow/snapshot.js";
 import { ensureStarterAgentsInitialized } from "../agent/starter-agents.js";

package/dist/src/work-discovery/service.js

@@ -6,12 +6,12 @@ import { getAgentDefaultModelRef, init_schema } from "../config/schema.js";
 import { buildSessionKey, init_session_key } from "../routing/session-key.js";
 import { getDefaultAgentId, init_resolve_route } from "../routing/resolve-route.js";
 import { init_providers, resolveModel } from "../providers/index.js";
-import { isLocalModelBaseUrl } from "../providers/model-call.js";
 import { writeKnowledgeItem } from "../knowledge-memory/repository.js";
 import "../knowledge-memory/index.js";
 import { createPriorityWindow, createUserGoal } from "../user-model/goals.js";
 import { getAssertionSlot, getUserAssertion, linkAssertionEvidence, reconcileAssertion, setAssertionStatus } from "../user-model/repository.js";
 import "../user-model/index.js";
+import { isLocalModelBaseUrl } from "../providers/model-call.js";
 import { allowsRemoteSourceProcessing } from "../user-context/sources/processing-policy.js";
 import { analyzeUnderstandingSources, analyzeWorkContext, workDiscoveryResultMarkdown } from "./analyzer.js";
 import { createUnderstandingSourceRun, getUnderstandingSourceRun, updateUnderstandingSourceGrantCheckpoint, updateUnderstandingSourceGrantPolicies, updateUnderstandingSourceRun, upsertUnderstandingSourceGrant } from "../user-context/sources/repository.js";

package/dist/src/workflows/service/workflow-run-service.js

@@ -1,7 +1,7 @@
 import { TaskRunRepository } from "../../tasks/task-run-repository.js";
 import { getDefaultAgentId, init_resolve_route } from "../../routing/resolve-route.js";
-import { init_providers, resolveModel } from "../../providers/index.js";
 import { extractProfileAgentId, resolveEffectiveAgentProfileForSession } from "../../config/agent-profile.js";
+import { init_providers, resolveModel } from "../../providers/index.js";
 import { TaskRepository } from "../../tasks/task-repository.js";
 import { TaskConversationRepository } from "../../tasks/task-conversation-repository.js";
 import { getProjectWorkspacePathForSession } from "../../projects/workspace.js";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@xopcai/xopc",
-  "version": "0.0.266",
+  "version": "0.0.268",
   "description": "Local-first personal AI assistant with reviewable user understanding, durable tasks, workflows, automations, and local or cloud models.",
   "type": "module",
   "main": "dist/src/index.js",
@@ -164,10 +164,10 @@
     "vitest": "4.1.5",
     "vue": "^3.5.35",
     "@xopcai/browser-control-contract": "0.1.0",
+    "@xopcai/gateway-contract": "0.0.0",
     "@xopcai/endpoint-tools-protocol": "0.0.0",
-    "@xopcai/realtime-client": "0.0.0",
     "@xopcai/realtime-protocol": "0.0.0",
-    "@xopcai/gateway-contract": "0.0.0"
+    "@xopcai/realtime-client": "0.0.0"
   },
   "scripts": {
     "assets:brand": "node scripts/generate-brand-assets.mjs",