@xopcai/xopc 0.0.269 → 0.0.272

package/dist/src/agent/tool-manuals/xopc-use.d.ts

@@ -1 +1 @@
-export declare const xopcUseManual = "# XOPC Use Tool Manual\n\n## Purpose\n\n`xopc_use` operates first-class XOPC product objects without editing SQLite or product files directly.\nLoad this manual before a non-trivial mutation.\n\n```json\n{\n  \"mode\": \"project | automation | note | task | task_run | local_app | settings\",\n  \"command\": \"...\",\n  \"args\": {},\n  \"dryRun\": false\n}\n```\n\nSend one object command per call. Inspect the returned JSON `ok` field; a tool call can\ncomplete successfully while the product command returns `ok: false`.\n\n## Object routing\n\n| Object | Tool |\n| --- | --- |\n| Project, milestone, project update | `xopc_use` mode `project` |\n| Automation | `xopc_use` mode `automation` |\n| Task intent and lifecycle | `xopc_use` mode `task` |\n| Task execution attempt, receipt, events and waits | `xopc_use` mode `task_run` |\n| Note | `xopc_use` mode `note` |\n| Local app | `xopc_use` mode `local_app` |\n| Settings jump target | `xopc_use` mode `settings` |\n| Workflow run | dedicated `workflow` tool; pass `taskId` to link it to a Task |\n| Session, memory, skill, connected app or workspace file | its dedicated tool |\n\nDo not emulate Workflow APIs through `xopc_use`. A Task is durable intent;\na TaskRun is one execution attempt; a WorkflowRun is a procedure execution and may belong\nto a TaskRun. Never treat these three objects as interchangeable.\n\n## Reliable protocol\n\n1. Use `list` then `get` when an id is unknown.\n2. Read the current `version` before a Task mutation.\n3. Use `dryRun: true` for broad Project changes or uncertain mutations.\n4. Mutate once with the exact id and current concurrency token.\n5. Verify the returned object and preserve any \u201COpen in xopc\u201D delivery link.\n6. On a conflict, read again and reconsider the operation; do not blindly retry.\n\nTimestamps are Unix epoch milliseconds. Array fields are arrays of strings. Omission\npreserves a patchable field; an empty array intentionally clears it. Prefer explicit\n`projectId`, `taskId`, `runId`, `noteId`, and `localAppId` fields over `id`.\n\n## Projects\n\nCommands: `list`, `get`, `create`, `update`, `resolve_workspace`,\n`list_milestones`, `create_milestone`, `update_milestone`, `list_updates`,\nand `create_update`.\n\nProject statuses: `planned`, `active`, `paused`, `completed`, `cancelled`,\n`archived`. Health values: `unknown`, `on_track`, `at_risk`, `off_track`.\n\nA Project defines bounded shared context for related work. Its durable planning fields are `outcome`,\n`successCriteria`, `scope`, `nonGoals`, `ownerId`, `targetAt`, and `health`.\nUse `brief` for a concise description and `instructions` for durable operating guidance.\n\n### Create\n\n```json\n{\n  \"mode\": \"project\",\n  \"command\": \"create\",\n  \"args\": {\n    \"name\": \"AI Product Research\",\n    \"outcome\": \"Choose a validated product direction\",\n    \"successCriteria\": [\"Ten customer interviews\", \"Decision recorded\"],\n    \"scope\": { \"market\": \"developer tools\" },\n    \"nonGoals\": [\"Build the production product\"],\n    \"health\": \"on_track\",\n    \"targetAt\": 1760000000000,\n    \"workspaceRoot\": \"/path/to/repo\"\n  }\n}\n```\n\n### Update\n\n```json\n{\n  \"mode\": \"project\",\n  \"command\": \"update\",\n  \"args\": {\n    \"projectId\": \"project_id\",\n    \"status\": \"active\",\n    \"health\": \"at_risk\",\n    \"successCriteria\": [\"Ten interviews\", \"Evidence-backed decision\"]\n  }\n}\n```\n\n### Resolve a workspace\n\nUse `autoCreate: false` for lookup. Set it to true only when creating a Project is authorized.\n\n```json\n{ \"mode\": \"project\", \"command\": \"resolve_workspace\", \"args\": { \"workspacePath\": \"/path/to/repo\", \"autoCreate\": false } }\n```\n\n### Milestones\n\nMilestone statuses: `planned`, `active`, `completed`, `cancelled`.\n\n```json\n{\n  \"mode\": \"project\",\n  \"command\": \"create_milestone\",\n  \"args\": {\n    \"projectId\": \"project_id\",\n    \"title\": \"Finish discovery\",\n    \"status\": \"active\",\n    \"targetAt\": 1760000000000,\n    \"sortOrder\": 10\n  }\n}\n```\n\nUse `list_milestones` with `projectId`. Use `update_milestone` with both\n`projectId` and `milestoneId`. Milestone deletion is intentionally not exposed.\n\n### Immutable project updates\n\nProject updates are append-only progress snapshots. They also update Project health.\n\n```json\n{\n  \"mode\": \"project\",\n  \"command\": \"create_update\",\n  \"args\": {\n    \"projectId\": \"project_id\",\n    \"health\": \"on_track\",\n    \"summary\": \"Discovery is complete\",\n    \"progress\": [\"Interviewed ten users\"],\n    \"risks\": [\"Pricing remains unvalidated\"],\n    \"nextSteps\": [\"Run pricing tests\"]\n  }\n}\n```\n\nUse `list_updates` with `projectId` and optional `limit`. Updates cannot be edited.\n\n## Automations\n\nCommands: `list`, `get`, `create`, `update`, `delete`, `run`, `pause`,\n`resume`, and `history`.\n\nAutomation `create` automatically uses the current session Project when `projectId` is\nomitted. An explicit `projectId` takes precedence and is validated before mutation. Use an\nexplicit id when creating for a Project other than the current session Project.\n\n### Create in the current Project\n\n`trigger` and `action` use the same shapes as the Automation product API.\n\n```json\n{\n  \"mode\": \"automation\",\n  \"command\": \"create\",\n  \"args\": {\n    \"name\": \"Daily project review\",\n    \"trigger\": { \"kind\": \"schedule\", \"schedule\": { \"kind\": \"cron\", \"expr\": \"0 9 * * 1-5\", \"tz\": \"Asia/Shanghai\" } },\n    \"action\": { \"kind\": \"agent\", \"instruction\": \"Review the current project and summarize risks.\" }\n  }\n}\n```\n\nTo override the inherited Project, add `\"projectId\": \"project_id\"` to `args`.\nThe create payload may also be nested under `args.automation`; top-level `args.projectId`\nhas precedence.\n\n### List and history\n\n`list` and unqualified `history` inherit the current session Project. Pass an explicit\n`projectId` to query another Project. Pass `automationId` to `history` for one Automation.\n\n### Update and operate\n\nUse `automationId` for `get`, `update`, `delete`, `run`, `pause`, and `resume`.\nFor `update`, patch fields may be direct args or nested under `args.patch`. Supplying a new\n`projectId` reassigns the Automation after validating the target Project.\n\n## Tasks\n\nCommands: `list`, `get`, `create`, `update_dependencies`, `add_context`,\n`remove_context`, `command`, and `delete`.\n\nTask phases are `backlog`, `ready`, `active`, `review`, and `closed`.\nOperational state is projected separately as `idle`, `queued`, `running`, `waiting`,\n`verifying`, `succeeded`, `failed`, or `cancelled`. Never send either value as a\nfree-form status update.\n\n`task.get` returns the Task, its projected `model`, dependencies, dependents, context,\nauthority grants, TaskRuns, receipts, and waits.\nThe projected model is the correct source for current operational state and attention items.\n\n`delete` permanently removes the Task and its contracts, waits, context links, TaskRuns,\nreceipts, and Task-owned execution records. It does not delete linked Sessions, workspace files,\nor external artifacts. Cancel an active TaskRun before deletion, and use `dryRun: true` when\nthe user's intent is ambiguous.\n\n```json\n{ \"mode\": \"task\", \"command\": \"delete\", \"args\": { \"taskId\": \"task_id\" }, \"dryRun\": true }\n```\n\n### Capture or start\n\n`createMode` defaults to `capture`, which creates a backlog Task without executing it.\nUse `start` only when immediate execution is intended.\n\n```json\n{\n  \"mode\": \"task\",\n  \"command\": \"create\",\n  \"args\": {\n    \"objective\": \"Complete the customer research report\",\n    \"projectId\": \"project_id\",\n    \"createMode\": \"capture\",\n    \"priority\": \"high\",\n    \"expectedOutputs\": [\"Research report\"],\n    \"acceptanceCriteria\": [\"Sources are cited\"],\n    \"constraints\": [\"Do not contact customers without approval\"],\n    \"dependsOnTaskIds\": []\n  }\n}\n```\n\n### Dependencies\n\n```json\n{\n  \"mode\": \"task\",\n  \"command\": \"update_dependencies\",\n  \"args\": {\n    \"taskId\": \"task_id\",\n    \"expectedVersion\": 3,\n    \"dependsOnTaskIds\": [\"dependency_task_id\"]\n  }\n}\n```\n\n### Context links\n\nUse `add_context` to link a document, file, URL, session, memory, Task, artifact, or source\nas `input`, `reference`, `constraint`, `deliverable`, or `evidence` context.\n\n```json\n{\n  \"mode\": \"task\",\n  \"command\": \"add_context\",\n  \"args\": {\n    \"taskId\": \"task_id\",\n    \"targetKind\": \"file\",\n    \"targetId\": \"/path/to/spec.md\",\n    \"role\": \"input\",\n    \"title\": \"Product specification\",\n    \"pinned\": true,\n    \"retrievalPolicy\": {},\n    \"metadata\": {}\n  }\n}\n```\n\nUse `remove_context` with `taskId` and the exact `edgeId` returned by `task.get`.\nDo not add authority grants through this tool; an Agent must not authorize itself.\n\n### Typed lifecycle commands\n\nEvery command requires `taskId`, the Task's current `expectedVersion`, a `type`, and\ntype-specific fields inside `commandArgs`.\n\nSupported command types:\n\n- `mark_ready`\n- `start`: `{ \"executor\": { \"kind\": \"agent\", \"agentId\": \"main\" } }`\n- `request_review`\n- `close`: `{ \"resolution\": \"done | cancelled | duplicate | wont_do\" }`\n- `reopen`: `{ \"phase\": \"ready | active\" }`\n- `add_wait`: `{ \"wait\": { \"kind\": \"dependency | approval | input | schedule | external | paused\", \"reason\": \"...\", \"condition\": {} } }`\n- `resolve_wait`: `{ \"waitId\": \"wait_id\", \"resolution\": {} }`\n- `delegate`: `{ \"agentId\": \"agent_id\" }`\n- `revise_contract`: `{ \"contract\": { ...complete contract... } }`\n\n```json\n{\n  \"mode\": \"task\",\n  \"command\": \"command\",\n  \"args\": {\n    \"taskId\": \"task_id\",\n    \"expectedVersion\": 3,\n    \"type\": \"start\",\n    \"commandArgs\": {\n      \"executor\": { \"kind\": \"agent\", \"agentId\": \"main\" }\n    }\n  }\n}\n```\n\nContract revision is replacement, not a patch. Read the Task and preserve all contract fields\nthe user did not ask to change. Resolve a wait through `resolve_wait`; do not directly mutate\na TaskRun or manufacture a phase transition.\n\n## TaskRuns\n\nTaskRun inspection is read-only except for explicit cancellation. Other execution state is\ncontrolled by Task commands and the runtime coordinator.\n\n### List attempts for a Task\n\n```json\n{ \"mode\": \"task_run\", \"command\": \"list\", \"args\": { \"taskId\": \"task_id\", \"limit\": 20 } }\n```\n\nThe result contains run attempts, finalized receipts, and active waits.\n\n### Inspect one attempt\n\n```json\n{ \"mode\": \"task_run\", \"command\": \"get\", \"args\": { \"runId\": \"run_id\" } }\n```\n\nThe result contains the TaskRun, its receipt when terminal, ordered events, and active Task waits.\n\n### Cancel an attempt\n\nRead the run first, then pass its current version. Cancellation creates a terminal receipt.\n\n```json\n{\n  \"mode\": \"task_run\",\n  \"command\": \"cancel\",\n  \"args\": { \"runId\": \"run_id\", \"expectedVersion\": 2, \"reason\": \"User cancelled execution\" }\n}\n```\n\nDo not guess commands such as retry, force-complete, heartbeat, or transition; they are not Agent APIs.\n\n## Notes\n\nCommands: `list`, `get`, `create`, `append`, `preview_edit`, `update`, and `delete`.\nUse Notes for durable prose and reference material, not as a Task substitute. Prefer `append`\nwhen preserving user content. Use `preview_edit` before a canonical rewrite.\n\n```json\n{ \"mode\": \"note\", \"command\": \"create\", \"args\": { \"title\": \"Decision\", \"markdown\": \"...\", \"projectId\": \"project_id\" } }\n```\n\n```json\n{ \"mode\": \"note\", \"command\": \"append\", \"args\": { \"noteId\": \"note_id\", \"heading\": \"AI synthesis\", \"content\": \"...\" } }\n```\n\nUse `update` with `status: \"trashed\"` for a recoverable removal. `delete` permanently\nremoves the Note and its stored snapshots and media; use `dryRun: true` first when the\nuser's intent is ambiguous.\n\n```json\n{ \"mode\": \"note\", \"command\": \"delete\", \"args\": { \"noteId\": \"note_id\" }, \"dryRun\": true }\n```\n\n## Local apps and settings\n\nLocal app commands are `list`, `get`, `create`, and `validate`. Installation,\nactivation, rollback, and uninstall remain product runtime operations.\n\nSettings supports only `open` and returns an exact product jump target without changing config.\n\n## Error recovery\n\n| Result | Recovery |\n| --- | --- |\n| service unavailable | Stop retrying and report the unavailable capability. |\n| not found | Re-list in the intended scope; do not invent another id. |\n| conflict | Read the current object and reassess using its latest version. |\n| waiting | Inspect the Task projection and TaskRun waits; resolve only the real blocker. |\n| invalid command or state | Read the object and use only a documented transition. |\n| unsupported operation | Use the dedicated tool or product UI; never write storage directly. |\n\n## Deliberate boundaries\n\n- Project deletion and milestone deletion are not Agent APIs.\n- TaskRun mutation is internal to execution coordination except for optimistic cancellation.\n- Project updates are immutable.\n- Workflow and Automation operations remain in their dedicated tools.\n- Only the documented Task and TaskRun commands are valid; do not infer hidden aliases.\n";
+export declare const xopcUseManual = "# XOPC Use Tool Manual\n\n## Purpose\n\n`xopc_use` operates first-class XOPC product objects without editing SQLite or product files directly.\nLoad this manual before a non-trivial mutation.\n\n```json\n{\n  \"mode\": \"project | proactive | automation | note | task | task_run | local_app | settings\",\n  \"command\": \"...\",\n  \"args\": {},\n  \"dryRun\": false\n}\n```\n\nSend one object command per call. Inspect the returned JSON `ok` field; a tool call can\ncomplete successfully while the product command returns `ok: false`.\n\n## Proactive delegation\n\nUse mode proactive only for explicit user delegation. Inspect list before start; edit existing subscriptions instead of duplicating them.\nFor one email thread, call mail_sources, then follow_up with sourceItemId, instructions and dueAt (ISO timestamp).\nUse update_follow_up with the current expectedRevision to pause, resume, adjust the deadline or end the delegation.\nOn a communication card, continue_card with its id reads current work and binds this conversation to the delegation.\nUse the returned exact connectionId when retrieving or replying to the thread. Review current recipients and the full draft with the user and retain connector confirmation for sending. Never mark sent from an approval alone; require a successful provider receipt. The delegation continues watching synchronized replies until explicitly ended.\n\n## Object routing\n\n| Object | Tool |\n| --- | --- |\n| Project, milestone, project update | `xopc_use` mode `project` |\n| Automation | `xopc_use` mode `automation` |\n| Task intent and lifecycle | `xopc_use` mode `task` |\n| Task execution attempt, receipt, events and waits | `xopc_use` mode `task_run` |\n| Note | `xopc_use` mode `note` |\n| Local app | `xopc_use` mode `local_app` |\n| Settings jump target | `xopc_use` mode `settings` |\n| Workflow run | dedicated `workflow` tool; pass `taskId` to link it to a Task |\n| Session, memory, skill, connected app or workspace file | its dedicated tool |\n\nDo not emulate Workflow APIs through `xopc_use`. A Task is durable intent;\na TaskRun is one execution attempt; a WorkflowRun is a procedure execution and may belong\nto a TaskRun. Never treat these three objects as interchangeable.\n\n## Reliable protocol\n\n1. Use `list` then `get` when an id is unknown.\n2. Read the current `version` before a Task mutation.\n3. Use `dryRun: true` for broad Project changes or uncertain mutations.\n4. Mutate once with the exact id and current concurrency token.\n5. Verify the returned object and preserve any \u201COpen in xopc\u201D delivery link.\n6. On a conflict, read again and reconsider the operation; do not blindly retry.\n\nTimestamps are Unix epoch milliseconds. Array fields are arrays of strings. Omission\npreserves a patchable field; an empty array intentionally clears it. Prefer explicit\n`projectId`, `taskId`, `runId`, `noteId`, and `localAppId` fields over `id`.\n\n## Proactive delegated work\n\nUse mode `proactive` for work the user asks the assistant to keep following.\nUse `list` before starting; update existing delegations instead of duplicating them.\n- `start`: {scenarioKey: \"project_delivery_risk\" | \"meeting_preparation\" | \"discussion_follow_up\", projectId?: string, instructions: string}.\n- `update`: {id, expectedRevision, userInstructions?, enabled?, completedAt?}. Read the revision from list. completedAt is an ISO timestamp; ending work also sets enabled false.\n- `check`: {id}, for project checks.\n- `get_card`: {id}, reads the current authorized artifact and action state before discussing it.\nInstructions adjust what to watch; they never grant new action permissions. Distinguish a task being created from its work being completed. Do not claim a draft was sent.\n\n## Projects\n\nCommands: `list`, `get`, `create`, `update`, `resolve_workspace`,\n`list_milestones`, `create_milestone`, `update_milestone`, `list_updates`,\nand `create_update`.\n\nProject statuses: `planned`, `active`, `paused`, `completed`, `cancelled`,\n`archived`. Health values: `unknown`, `on_track`, `at_risk`, `off_track`.\n\nA Project defines bounded shared context for related work. Its durable planning fields are `outcome`,\n`successCriteria`, `scope`, `nonGoals`, `ownerId`, `targetAt`, and `health`.\nUse `brief` for a concise description and `instructions` for durable operating guidance.\n\n### Create\n\n```json\n{\n  \"mode\": \"project\",\n  \"command\": \"create\",\n  \"args\": {\n    \"name\": \"AI Product Research\",\n    \"outcome\": \"Choose a validated product direction\",\n    \"successCriteria\": [\"Ten customer interviews\", \"Decision recorded\"],\n    \"scope\": { \"market\": \"developer tools\" },\n    \"nonGoals\": [\"Build the production product\"],\n    \"health\": \"on_track\",\n    \"targetAt\": 1760000000000,\n    \"workspaceRoot\": \"/path/to/repo\"\n  }\n}\n```\n\n### Update\n\n```json\n{\n  \"mode\": \"project\",\n  \"command\": \"update\",\n  \"args\": {\n    \"projectId\": \"project_id\",\n    \"status\": \"active\",\n    \"health\": \"at_risk\",\n    \"successCriteria\": [\"Ten interviews\", \"Evidence-backed decision\"]\n  }\n}\n```\n\n### Resolve a workspace\n\nUse `autoCreate: false` for lookup. Set it to true only when creating a Project is authorized.\n\n```json\n{ \"mode\": \"project\", \"command\": \"resolve_workspace\", \"args\": { \"workspacePath\": \"/path/to/repo\", \"autoCreate\": false } }\n```\n\n### Milestones\n\nMilestone statuses: `planned`, `active`, `completed`, `cancelled`.\n\n```json\n{\n  \"mode\": \"project\",\n  \"command\": \"create_milestone\",\n  \"args\": {\n    \"projectId\": \"project_id\",\n    \"title\": \"Finish discovery\",\n    \"status\": \"active\",\n    \"targetAt\": 1760000000000,\n    \"sortOrder\": 10\n  }\n}\n```\n\nUse `list_milestones` with `projectId`. Use `update_milestone` with both\n`projectId` and `milestoneId`. Milestone deletion is intentionally not exposed.\n\n### Immutable project updates\n\nProject updates are append-only progress snapshots. They also update Project health.\n\n```json\n{\n  \"mode\": \"project\",\n  \"command\": \"create_update\",\n  \"args\": {\n    \"projectId\": \"project_id\",\n    \"health\": \"on_track\",\n    \"summary\": \"Discovery is complete\",\n    \"progress\": [\"Interviewed ten users\"],\n    \"risks\": [\"Pricing remains unvalidated\"],\n    \"nextSteps\": [\"Run pricing tests\"]\n  }\n}\n```\n\nUse `list_updates` with `projectId` and optional `limit`. Updates cannot be edited.\n\n## Automations\n\nCommands: `list`, `get`, `create`, `update`, `delete`, `run`, `pause`,\n`resume`, and `history`.\n\nAutomation `create` automatically uses the current session Project when `projectId` is\nomitted. An explicit `projectId` takes precedence and is validated before mutation. Use an\nexplicit id when creating for a Project other than the current session Project.\n\n### Create in the current Project\n\n`trigger` and `action` use the same shapes as the Automation product API.\n\n```json\n{\n  \"mode\": \"automation\",\n  \"command\": \"create\",\n  \"args\": {\n    \"name\": \"Daily project review\",\n    \"trigger\": { \"kind\": \"schedule\", \"schedule\": { \"kind\": \"cron\", \"expr\": \"0 9 * * 1-5\", \"tz\": \"Asia/Shanghai\" } },\n    \"action\": { \"kind\": \"agent\", \"instruction\": \"Review the current project and summarize risks.\" }\n  }\n}\n```\n\nTo override the inherited Project, add `\"projectId\": \"project_id\"` to `args`.\nThe create payload may also be nested under `args.automation`; top-level `args.projectId`\nhas precedence.\n\n### List and history\n\n`list` and unqualified `history` inherit the current session Project. Pass an explicit\n`projectId` to query another Project. Pass `automationId` to `history` for one Automation.\n\n### Update and operate\n\nUse `automationId` for `get`, `update`, `delete`, `run`, `pause`, and `resume`.\nFor `update`, patch fields may be direct args or nested under `args.patch`. Supplying a new\n`projectId` reassigns the Automation after validating the target Project.\n\n## Tasks\n\nCommands: `list`, `get`, `create`, `update_dependencies`, `add_context`,\n`remove_context`, `command`, and `delete`.\n\nTask phases are `backlog`, `ready`, `active`, `review`, and `closed`.\nOperational state is projected separately as `idle`, `queued`, `running`, `waiting`,\n`verifying`, `succeeded`, `failed`, or `cancelled`. Never send either value as a\nfree-form status update.\n\n`task.get` returns the Task, its projected `model`, dependencies, dependents, context,\nauthority grants, TaskRuns, receipts, and waits.\nThe projected model is the correct source for current operational state and attention items.\n\n`delete` permanently removes the Task and its contracts, waits, context links, TaskRuns,\nreceipts, and Task-owned execution records. It does not delete linked Sessions, workspace files,\nor external artifacts. Cancel an active TaskRun before deletion, and use `dryRun: true` when\nthe user's intent is ambiguous.\n\n```json\n{ \"mode\": \"task\", \"command\": \"delete\", \"args\": { \"taskId\": \"task_id\" }, \"dryRun\": true }\n```\n\n### Capture or start\n\n`createMode` defaults to `capture`, which creates a backlog Task without executing it.\nUse `start` only when immediate execution is intended.\n\n```json\n{\n  \"mode\": \"task\",\n  \"command\": \"create\",\n  \"args\": {\n    \"objective\": \"Complete the customer research report\",\n    \"projectId\": \"project_id\",\n    \"createMode\": \"capture\",\n    \"priority\": \"high\",\n    \"expectedOutputs\": [\"Research report\"],\n    \"acceptanceCriteria\": [\"Sources are cited\"],\n    \"constraints\": [\"Do not contact customers without approval\"],\n    \"dependsOnTaskIds\": []\n  }\n}\n```\n\n### Dependencies\n\n```json\n{\n  \"mode\": \"task\",\n  \"command\": \"update_dependencies\",\n  \"args\": {\n    \"taskId\": \"task_id\",\n    \"expectedVersion\": 3,\n    \"dependsOnTaskIds\": [\"dependency_task_id\"]\n  }\n}\n```\n\n### Context links\n\nUse `add_context` to link a document, file, URL, session, memory, Task, artifact, or source\nas `input`, `reference`, `constraint`, `deliverable`, or `evidence` context.\n\n```json\n{\n  \"mode\": \"task\",\n  \"command\": \"add_context\",\n  \"args\": {\n    \"taskId\": \"task_id\",\n    \"targetKind\": \"file\",\n    \"targetId\": \"/path/to/spec.md\",\n    \"role\": \"input\",\n    \"title\": \"Product specification\",\n    \"pinned\": true,\n    \"retrievalPolicy\": {},\n    \"metadata\": {}\n  }\n}\n```\n\nUse `remove_context` with `taskId` and the exact `edgeId` returned by `task.get`.\nDo not add authority grants through this tool; an Agent must not authorize itself.\n\n### Typed lifecycle commands\n\nEvery command requires `taskId`, the Task's current `expectedVersion`, a `type`, and\ntype-specific fields inside `commandArgs`.\n\nSupported command types:\n\n- `mark_ready`\n- `start`: `{ \"executor\": { \"kind\": \"agent\", \"agentId\": \"main\" } }`\n- `request_review`\n- `close`: `{ \"resolution\": \"done | cancelled | duplicate | wont_do\" }`\n- `reopen`: `{ \"phase\": \"ready | active\" }`\n- `add_wait`: `{ \"wait\": { \"kind\": \"dependency | approval | input | schedule | external | paused\", \"reason\": \"...\", \"condition\": {} } }`\n- `resolve_wait`: `{ \"waitId\": \"wait_id\", \"resolution\": {} }`\n- `delegate`: `{ \"agentId\": \"agent_id\" }`\n- `revise_contract`: `{ \"contract\": { ...complete contract... } }`\n\n```json\n{\n  \"mode\": \"task\",\n  \"command\": \"command\",\n  \"args\": {\n    \"taskId\": \"task_id\",\n    \"expectedVersion\": 3,\n    \"type\": \"start\",\n    \"commandArgs\": {\n      \"executor\": { \"kind\": \"agent\", \"agentId\": \"main\" }\n    }\n  }\n}\n```\n\nContract revision is replacement, not a patch. Read the Task and preserve all contract fields\nthe user did not ask to change. Resolve a wait through `resolve_wait`; do not directly mutate\na TaskRun or manufacture a phase transition.\n\n## TaskRuns\n\nTaskRun inspection is read-only except for explicit cancellation. Other execution state is\ncontrolled by Task commands and the runtime coordinator.\n\n### List attempts for a Task\n\n```json\n{ \"mode\": \"task_run\", \"command\": \"list\", \"args\": { \"taskId\": \"task_id\", \"limit\": 20 } }\n```\n\nThe result contains run attempts, finalized receipts, and active waits.\n\n### Inspect one attempt\n\n```json\n{ \"mode\": \"task_run\", \"command\": \"get\", \"args\": { \"runId\": \"run_id\" } }\n```\n\nThe result contains the TaskRun, its receipt when terminal, ordered events, and active Task waits.\n\n### Cancel an attempt\n\nRead the run first, then pass its current version. Cancellation creates a terminal receipt.\n\n```json\n{\n  \"mode\": \"task_run\",\n  \"command\": \"cancel\",\n  \"args\": { \"runId\": \"run_id\", \"expectedVersion\": 2, \"reason\": \"User cancelled execution\" }\n}\n```\n\nDo not guess commands such as retry, force-complete, heartbeat, or transition; they are not Agent APIs.\n\n## Notes\n\nCommands: `list`, `get`, `create`, `append`, `preview_edit`, `update`, and `delete`.\nUse Notes for durable prose and reference material, not as a Task substitute. Prefer `append`\nwhen preserving user content. Use `preview_edit` before a canonical rewrite.\n\n```json\n{ \"mode\": \"note\", \"command\": \"create\", \"args\": { \"title\": \"Decision\", \"markdown\": \"...\", \"projectId\": \"project_id\" } }\n```\n\n```json\n{ \"mode\": \"note\", \"command\": \"append\", \"args\": { \"noteId\": \"note_id\", \"heading\": \"AI synthesis\", \"content\": \"...\" } }\n```\n\nUse `update` with `status: \"trashed\"` for a recoverable removal. `delete` permanently\nremoves the Note and its stored snapshots and media; use `dryRun: true` first when the\nuser's intent is ambiguous.\n\n```json\n{ \"mode\": \"note\", \"command\": \"delete\", \"args\": { \"noteId\": \"note_id\" }, \"dryRun\": true }\n```\n\n## Local apps and settings\n\nLocal app commands are `list`, `get`, `create`, and `validate`. Installation,\nactivation, rollback, and uninstall remain product runtime operations.\n\nSettings supports only `open` and returns an exact product jump target without changing config.\n\n## Error recovery\n\n| Result | Recovery |\n| --- | --- |\n| service unavailable | Stop retrying and report the unavailable capability. |\n| not found | Re-list in the intended scope; do not invent another id. |\n| conflict | Read the current object and reassess using its latest version. |\n| waiting | Inspect the Task projection and TaskRun waits; resolve only the real blocker. |\n| invalid command or state | Read the object and use only a documented transition. |\n| unsupported operation | Use the dedicated tool or product UI; never write storage directly. |\n\n## Deliberate boundaries\n\n- Project deletion and milestone deletion are not Agent APIs.\n- TaskRun mutation is internal to execution coordination except for optimistic cancellation.\n- Project updates are immutable.\n- Workflow and Automation operations remain in their dedicated tools.\n- Only the documented Task and TaskRun commands are valid; do not infer hidden aliases.\n";

package/dist/src/agent/tool-manuals/xopc-use.js

@@ -8,7 +8,7 @@ Load this manual before a non-trivial mutation.
 
 \`\`\`json
 {
-  "mode": "project | automation | note | task | task_run | local_app | settings",
+  "mode": "project | proactive | automation | note | task | task_run | local_app | settings",
   "command": "...",
   "args": {},
   "dryRun": false
@@ -18,6 +18,14 @@ Load this manual before a non-trivial mutation.
 Send one object command per call. Inspect the returned JSON \`ok\` field; a tool call can
 complete successfully while the product command returns \`ok: false\`.
 
+## Proactive delegation
+
+Use mode proactive only for explicit user delegation. Inspect list before start; edit existing subscriptions instead of duplicating them.
+For one email thread, call mail_sources, then follow_up with sourceItemId, instructions and dueAt (ISO timestamp).
+Use update_follow_up with the current expectedRevision to pause, resume, adjust the deadline or end the delegation.
+On a communication card, continue_card with its id reads current work and binds this conversation to the delegation.
+Use the returned exact connectionId when retrieving or replying to the thread. Review current recipients and the full draft with the user and retain connector confirmation for sending. Never mark sent from an approval alone; require a successful provider receipt. The delegation continues watching synchronized replies until explicitly ended.
+
 ## Object routing
 
 | Object | Tool |
@@ -49,6 +57,16 @@ Timestamps are Unix epoch milliseconds. Array fields are arrays of strings. Omis
 preserves a patchable field; an empty array intentionally clears it. Prefer explicit
 \`projectId\`, \`taskId\`, \`runId\`, \`noteId\`, and \`localAppId\` fields over \`id\`.
 
+## Proactive delegated work
+
+Use mode \`proactive\` for work the user asks the assistant to keep following.
+Use \`list\` before starting; update existing delegations instead of duplicating them.
+- \`start\`: {scenarioKey: "project_delivery_risk" | "meeting_preparation" | "discussion_follow_up", projectId?: string, instructions: string}.
+- \`update\`: {id, expectedRevision, userInstructions?, enabled?, completedAt?}. Read the revision from list. completedAt is an ISO timestamp; ending work also sets enabled false.
+- \`check\`: {id}, for project checks.
+- \`get_card\`: {id}, reads the current authorized artifact and action state before discussing it.
+Instructions adjust what to watch; they never grant new action permissions. Distinguish a task being created from its work being completed. Do not claim a draft was sent.
+
 ## Projects
 
 Commands: \`list\`, \`get\`, \`create\`, \`update\`, \`resolve_workspace\`,

package/dist/src/agent/tools/factory.js

@@ -388,6 +388,7 @@ var AgentToolsFactory = class AgentToolsFactory {
 			...this.deps.getAutomationService ? [createAutomationTool({ getAutomationService: this.deps.getAutomationService })] : [],
 			...browserEnabled && this.deps.getBrowserAutomationService ? [createBrowserAutomationTool({ getBrowserAutomationService: this.deps.getBrowserAutomationService })] : [],
 			...this.deps.getAutomationService || this.deps.getProjectService || this.deps.getNotesService || this.deps.getLocalAppService || this.deps.dispatchTaskEvents || this.deps.dispatchTaskRuns ? [createXopcUseTool({
+				getWorkspace: () => this.deps.workspace,
 				getConfig: () => this.deps.getConfig?.(),
 				getCurrentAgentId: () => options.agentId,
 				getCurrentSessionKey: () => this.deps.getCurrentContext()?.sessionKey,

package/dist/src/agent/tools/xopc-use-tool.d.ts

@@ -6,12 +6,12 @@ import type { NotesService } from '../../notes/index.js';
 import { type ProjectService } from '../../projects/index.js';
 import type { LocalAppService } from '../../local-apps/index.js';
 declare const XopcUseToolSchema: import("@sinclair/typebox").TObject<{
-    mode: import("@sinclair/typebox").TUnion<[import("@sinclair/typebox").TLiteral<"project">, import("@sinclair/typebox").TLiteral<"automation">, import("@sinclair/typebox").TLiteral<"note">, import("@sinclair/typebox").TLiteral<"task">, import("@sinclair/typebox").TLiteral<"task_run">, import("@sinclair/typebox").TLiteral<"local_app">, import("@sinclair/typebox").TLiteral<"settings">]>;
+    mode: import("@sinclair/typebox").TUnion<[import("@sinclair/typebox").TLiteral<"proactive">, import("@sinclair/typebox").TLiteral<"project">, import("@sinclair/typebox").TLiteral<"automation">, import("@sinclair/typebox").TLiteral<"note">, import("@sinclair/typebox").TLiteral<"task">, import("@sinclair/typebox").TLiteral<"task_run">, import("@sinclair/typebox").TLiteral<"local_app">, import("@sinclair/typebox").TLiteral<"settings">]>;
     command: import("@sinclair/typebox").TString;
     args: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TRecord<import("@sinclair/typebox").TString, import("@sinclair/typebox").TAny>>;
     dryRun: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TBoolean>;
 }>;
-export type XopcUseMode = 'project' | 'automation' | 'note' | 'task' | 'task_run' | 'local_app' | 'settings';
+export type XopcUseMode = 'proactive' | 'project' | 'automation' | 'note' | 'task' | 'task_run' | 'local_app' | 'settings';
 export interface XopcUseToolInput {
     mode: XopcUseMode;
     command: string;
@@ -19,6 +19,7 @@ export interface XopcUseToolInput {
     dryRun?: boolean;
 }
 export interface XopcUseToolDeps {
+    getWorkspace?: () => string;
     getConfig?: () => Config | undefined;
     getCurrentAgentId?: () => string | undefined;
     getCurrentSessionKey?: () => string | undefined;

package/dist/src/agent/tools/xopc-use-tool.js

@@ -13,11 +13,15 @@ import { TaskRepository } from "../../tasks/task-repository.js";
 import { TaskReadModelProjector } from "../../tasks/task-read-model-projector.js";
 import { isValidProjectAgentId, normalizeProjectAgentId, resolveProjectAgentId } from "../../projects/project-agent.js";
 import "../../projects/index.js";
-import { CreateAutomationSchema, UpdateAutomationSchema } from "../../automations/domain/validation.js";
-import "../../automations/index.js";
+import { updateControlledSubscription } from "../../proactive/scenarios/control.js";
+import { continueMailFollowUp, mailFollowUpSources, startMailFollowUp, updateMailFollowUp } from "../../proactive/follow-ups.js";
 import { TaskContextRepository } from "../../tasks/task-context-repository.js";
 import { TaskDependencyError, TaskDependencyService } from "../../tasks/task-dependency-service.js";
 import { TaskApplicationService } from "../../tasks/task-application-service.js";
+import { getCard } from "../../proactive/inbox/cards.js";
+import { checkDelegation, delegationOverview, startDelegation } from "../../proactive/experience.js";
+import { CreateAutomationSchema, UpdateAutomationSchema } from "../../automations/domain/validation.js";
+import "../../automations/index.js";
 import { defineTaskContract } from "../../tasks/task-contract-definition.js";
 import { TaskDeletionService } from "../../tasks/task-deletion-service.js";
 import "../../tasks/index.js";
@@ -27,6 +31,7 @@ import { Type } from "@sinclair/typebox";
 init_resolve_route();
 const XopcUseToolSchema = Type.Object({
 	mode: Type.Union([
+		Type.Literal("proactive"),
 		Type.Literal("project"),
 		Type.Literal("automation"),
 		Type.Literal("note"),
@@ -35,7 +40,7 @@ const XopcUseToolSchema = Type.Object({
 		Type.Literal("local_app"),
 		Type.Literal("settings")
 	]),
-	command: Type.String({ description: "Object command. Supports project list/get/create/update/resolve_workspace/list_milestones/create_milestone/update_milestone/list_updates/create_update, automation list/get/create/update/delete/run/pause/resume/history, note list/get/create/append/update/preview_edit/delete, task list/get/create/update_dependencies/add_context/remove_context/command/delete, task_run list/get/cancel, local_app list/get/create/validate, and settings open." }),
+	command: Type.String({ description: "Object command. Proactive commands: list, get_card {id}, start {scenarioKey: project_delivery_risk|meeting_preparation|discussion_follow_up, projectId?: string, instructions: string}, update {id, expectedRevision, userInstructions?, enabled?, completedAt?}, check {id}. Also supports mail_sources, follow_up {sourceItemId, instructions, dueAt: ISO timestamp}, update_follow_up {id, expectedRevision, instructions?, dueAt?, status?: watching|paused|completed}, continue_card {id}. continue_card binds the current conversation and returns the exact email account; review the full draft and use connector confirmation before sending. Use proactive only for work the user explicitly delegates; inspect list first and update existing work instead of duplicating it. Supports project list/get/create/update/resolve_workspace/list_milestones/create_milestone/update_milestone/list_updates/create_update, automation list/get/create/update/delete/run/pause/resume/history, note list/get/create/append/update/preview_edit/delete, task list/get/create/update_dependencies/add_context/remove_context/command/delete, task_run list/get/cancel, local_app list/get/create/validate, and settings open." }),
 	args: Type.Optional(Type.Record(Type.String(), Type.Any())),
 	dryRun: Type.Optional(Type.Boolean({ description: "Validate and preview the action without mutating xopc state." }))
 });
@@ -1793,7 +1798,7 @@ function createXopcUseTool(deps) {
 						kind: "xopc_use",
 						toolCallId
 					}
-				}, async () => mode === "project" ? await handleProject(command, args, deps, dryRun) : mode === "automation" ? await handleAutomation(command, args, deps, dryRun) : mode === "note" ? await handleNote(command, args, deps, dryRun) : mode === "task" ? await handleTask(command, args, deps, dryRun) : mode === "task_run" ? await handleTaskRun(command, args, dryRun, deps) : mode === "local_app" ? await handleLocalApp(command, args, deps, dryRun) : mode === "settings" ? handleSettings(command, args) : {
+				}, async () => mode === "proactive" ? handleProactive(command, args, deps, dryRun) : mode === "project" ? await handleProject(command, args, deps, dryRun) : mode === "automation" ? await handleAutomation(command, args, deps, dryRun) : mode === "note" ? await handleNote(command, args, deps, dryRun) : mode === "task" ? await handleTask(command, args, deps, dryRun) : mode === "task_run" ? await handleTaskRun(command, args, dryRun, deps) : mode === "local_app" ? await handleLocalApp(command, args, deps, dryRun) : mode === "settings" ? handleSettings(command, args) : {
 					ok: false,
 					error: `Unsupported mode: ${String(mode)}`
 				});
@@ -1808,5 +1813,44 @@ function createXopcUseTool(deps) {
 		}
 	};
 }
+function handleProactive(command, args, deps, dryRun) {
+	const workspace = deps.getWorkspace?.();
+	if (!workspace) throw new Error("Proactive workspace is unavailable");
+	if (command === "list") return delegationOverview(workspace);
+	if (command === "mail_sources") return { sources: mailFollowUpSources(workspace) };
+	if (command === "get_card") return { card: getCard(String(args.id ?? ""), workspace) };
+	if (dryRun) return {
+		requiresConfirmation: true,
+		command,
+		args,
+		scope: workspace
+	};
+	if (command === "follow_up") return startMailFollowUp(workspace, args);
+	if (command === "update_follow_up") {
+		const { id, ...patch } = args;
+		return updateMailFollowUp(workspace, String(id ?? ""), patch);
+	}
+	if (command === "continue_card") {
+		const card = getCard(String(args.id ?? ""), workspace);
+		if (!card.communication || [
+			"withdrawn",
+			"expired",
+			"resolved"
+		].includes(card.status)) throw new Error("Open a current communication card");
+		const sessionKey = deps.getCurrentSessionKey?.();
+		if (!sessionKey) throw new Error("A conversation is required");
+		return {
+			card,
+			...continueMailFollowUp(workspace, card.communication.id, sessionKey)
+		};
+	}
+	if (command === "start") return startDelegation(workspace, args);
+	if (command === "update") {
+		const { id, ...patch } = args;
+		return updateControlledSubscription(workspace, String(id ?? ""), patch);
+	}
+	if (command === "check") return checkDelegation(workspace, String(args.id ?? ""));
+	throw new Error("Unsupported proactive command");
+}
 //#endregion
 export { createXopcUseTool };

package/dist/src/browser/automations/schema.d.ts

@@ -6,9 +6,9 @@ export declare const BrowserAutomationDefinitionSchema: z.ZodObject<{
     allowedDomains: z.ZodArray<z.ZodString>;
     risk: z.ZodEnum<{
         read: "read";
+        draft: "draft";
         sensitive: "sensitive";
         destructive: "destructive";
-        draft: "draft";
         external_effect: "external_effect";
     }>;
     inputs: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodObject<{

package/dist/src/browser/automations/service.d.ts

@@ -25,7 +25,7 @@ export declare class BrowserAutomationService {
         id: string;
         name: string;
         allowedDomains: string[];
-        risk: "read" | "sensitive" | "destructive" | "draft" | "external_effect";
+        risk: "read" | "draft" | "sensitive" | "destructive" | "external_effect";
         inputs: Record<string, {
             type: "string" | "number" | "boolean";
             required?: boolean;

package/dist/src/browser/native-messaging-host.js

@@ -35,7 +35,8 @@ function createBrowserNativeBootstrap(configPath, request) {
 			kind: "local-browser",
 			url: gatewayUrl
 		};
-		const setup = createDevicePairingSetup([route], Date.now(), 3, {
+		const setup = createDevicePairingSetup([route], Date.now(), {
+			targetKind: "browser",
 			ttlMs: 6e4,
 			enrollment: {
 				issuer: "browser-native-host",
@@ -55,6 +56,7 @@ function createBrowserNativeBootstrap(configPath, request) {
 				gatewayName: os.hostname(),
 				gatewayPublicKey: getGatewayIdentityPublicKeyRaw(identity),
 				routes: [route],
+				targetKind: setup.targetKind,
 				expiresAt: setup.expiresAt
 			})).toString("base64url")}`,
 			expiresAt: setup.expiresAt

package/dist/src/cli/commands/connectors.js

@@ -1,6 +1,6 @@
 import { init_loader, loadConfig, saveConfig } from "../../config/loader.js";
-import { register } from "../registry.js";
 import { getStoreConnectorInstallPlan, installStoreConnector, listStoreConnectors } from "../../capabilities/store-connector.js";
+import { register } from "../registry.js";
 import { confirm } from "@inquirer/prompts";
 import { Command } from "commander";
 //#region src/cli/commands/connectors.ts

package/dist/src/cli/commands/doctor/checks/database-schema.js

@@ -52,7 +52,7 @@ async function checkDatabaseSchema(ctx) {
 		id: "database-schema",
 		label: "Database schema",
 		status: "pass",
-		message: `SQLite schema v${status.dbVersion} (current release v161).`,
+		message: `SQLite schema v${status.dbVersion} (current release v165).`,
 		hints: []
 	};
 }

package/dist/src/cli/commands/tunnel.js

@@ -1,5 +1,6 @@
 import { createLogger } from "../../utils/logger/index.js";
 import { init_logger } from "../../utils/logger.js";
+import { isXopcDatabaseOpen, openXopcDatabase } from "../../storage/sqlite/connection.js";
 import { loadConfig, saveConfig } from "../../config/loader.js";
 import { resolveGatewayEffectiveHost } from "../../config/gateway-bind.js";
 import { ensureFrpcBinary } from "../../tunnel/frpc-binary.js";
@@ -8,6 +9,8 @@ import { loadTunnelState } from "../../tunnel/tunnel-state.js";
 import { getTunnelService } from "../../tunnel/tunnel-service.js";
 import { formatExamples, register } from "../registry.js";
 import "../../config/index.js";
+import { resolveGatewayAuth } from "../../gateway/auth.js";
+import { requireTunnelGatewayToken } from "../../tunnel/auth-policy.js";
 import { TUNNEL_RISK_SUMMARY_LINES, TunnelConsentError, assertTunnelMayStart, hasValidTunnelConsent } from "../../tunnel/consent.js";
 import { resolveFrpSubdomainHost } from "../../tunnel/frp-subdomain-host.js";
 import { applyTunnelConsentToConfig, mergeTunnelConfigPatch, setTunnelEnabledInConfig } from "../../tunnel/tunnel-config.js";
@@ -26,6 +29,7 @@ function resolveGatewayPortHost(config) {
 	};
 }
 function resolveGatewayToken(config) {
+	requireTunnelGatewayToken(resolveGatewayAuth({ authConfig: config.gateway.auth }));
 	const fromEnv = process.env.XOPC_GATEWAY_TOKEN?.trim();
 	if (fromEnv) return fromEnv;
 	const token = config.gateway.auth?.token?.trim();
@@ -155,6 +159,7 @@ function createTunnelCommand(ctx) {
 		});
 		const config = loadConfig(ctx.configPath);
 		assertTunnelMayStart(config);
+		if (!isXopcDatabaseOpen()) openXopcDatabase();
 		const { port, host } = resolveGatewayPortHost(config);
 		const token = resolveGatewayToken(config);
 		const tunnel = getTunnelService();

package/dist/src/connectors/connected-source-ingestion.js

@@ -6,8 +6,8 @@ import { ComposioSessionsAdapter } from "./composio-sessions.js";
 import { decodeConnectedSourceCursor, encodeConnectedSourceCursor } from "./connected-source-cursor.js";
 import { scopeForComposioAction } from "./composio.js";
 import { getConnectorDefinition } from "./catalog.js";
-import { getWorkspacePath } from "../config/workspace-path-helpers.js";
 import { getConnectorInstance } from "./instances.js";
+import { getWorkspacePath } from "../config/workspace-path-helpers.js";
 import { KnowledgeIngestionService } from "../knowledge/ingestion-service.js";
 import { ConnectedKnowledgePipeline } from "../knowledge/connected-knowledge-pipeline.js";
 import { LocalFolderKnowledgeSourceAdapter } from "../knowledge/local-folder-adapter.js";

package/dist/src/connectors/connected-source-normalizers.js

@@ -122,6 +122,9 @@ function normalizeCalendar(result) {
 			value: compact({
 				id: externalId,
 				title: text(event, "summary", "title", "name"),
+				description: text(event, "description"),
+				location: text(event, "location"),
+				allDay: Boolean(event.start && typeof event.start === "object" && "date" in event.start),
 				start: occurredAt,
 				end: time(event.end ?? event.endTime ?? event.end_time),
 				organizer: event.organizer,

package/dist/src/connectors/connection-recovery-service.js

@@ -13,9 +13,9 @@ import { getConnectorDefinition } from "./catalog.js";
 import { capabilityActions, isToolInputSchema, missingConnectionCapabilities } from "./connection-capabilities.js";
 import { connectorPrincipalForSession } from "./principal.js";
 import { resolveConnectionCandidate } from "./connection-candidates.js";
-import { persistConfigMutation } from "../config/config-mutation.js";
 import { listConnectorInstances } from "./instances.js";
 import { installConnector } from "./install.js";
+import { persistConfigMutation } from "../config/config-mutation.js";
 import { randomUUID } from "node:crypto";
 //#region src/connectors/connection-recovery-service.ts
 init_logger();

package/dist/src/connectors/health.js

@@ -1,6 +1,6 @@
-import { getWorkspacePath } from "../config/workspace-path-helpers.js";
 import { materializeConnectorMcpServer } from "./materialize.js";
 import { getConnectorInstance } from "./instances.js";
+import { getWorkspacePath } from "../config/workspace-path-helpers.js";
 import { listBundleMcpServerCapabilitiesForGateway } from "../agent/mcp/bundle-mcp-gateway.js";
 //#region src/connectors/health.ts
 function classifyConnectorHealthError(error) {

package/dist/src/gateway/heartbeat/service.js

@@ -1,9 +1,9 @@
 import { createLogger } from "../../utils/logger/index.js";
 import { init_logger } from "../../utils/logger.js";
 import { shouldSilence, stripHeartbeatToken } from "../../heartbeat/tokens.js";
+import { appendCronEventLines } from "../../heartbeat/event-prompt.js";
 import { isWithinActiveHours } from "../../heartbeat/active-hours.js";
 import { isHeartbeatContentEmpty } from "../../heartbeat/content-check.js";
-import { appendCronEventLines } from "../../heartbeat/event-prompt.js";
 import { createHeartbeatWake } from "../../heartbeat/wake.js";
 import { resolveHeartbeatMdPath } from "../workspace-heartbeat-path.js";
 import { readFile } from "fs/promises";

package/dist/src/gateway/hono/app.js

@@ -225,6 +225,7 @@ function createHonoApp(config) {
 	authenticated.use(auth({
 		getGatewayAuth: () => service.currentConfig.gateway?.auth,
 		getResolvedAuth: () => service.getResolvedAuth(),
+		isPublicTunnelEnabled: () => service.currentConfig.tunnel?.enabled === true,
 		getTrustedProxyContext: () => ({
 			trustedProxies: service.currentConfig.gateway?.trustedProxies,
 			allowRealIpFallback: service.currentConfig.gateway?.allowRealIpFallback === true

package/dist/src/gateway/hono/middleware/auth.d.ts

@@ -4,13 +4,12 @@ export interface AuthConfig {
     /** Current gateway auth from config (for rate-limit settings); optional. */
     getGatewayAuth?: () => GatewayAuthConfig | undefined;
     getResolvedAuth?: () => ResolvedGatewayAuth;
+    isPublicTunnelEnabled?: () => boolean;
     getTrustedProxyContext?: () => {
         trustedProxies?: string[];
         allowRealIpFallback?: boolean;
     };
 }
-/** Exported for gateway security tests. */
-export declare function isQueryTokenAllowedPath(path: string, method: string): boolean;
 export declare function auth(config?: AuthConfig): import("hono").MiddlewareHandler<any, string, {}, (Response & import("hono").TypedResponse<{
     error: string;
     code: string;

package/dist/src/gateway/hono/middleware/auth.js

@@ -5,11 +5,12 @@ import { authenticateDeviceAccessToken, getDevice } from "../../../storage/sqlit
 import { safeEqualSecret } from "../../security/secret-equal.js";
 import { resolveClientIpFromRequest } from "../../client-ip.js";
 import { authPolicyConfig, buckets, resolveAuthRateLimit } from "../../rate-limit/buckets.js";
-import { getClientIpFromHeaders } from "../../security/loopback.js";
 import { resolveAuthTracking } from "../../rate-limit/auth-policy.js";
 import { isAuthRateLimitGloballyDisabled } from "../../rate-limit/env-flags.js";
 import "../../rate-limit/index.js";
+import { authenticateBrowserSession } from "../../../storage/sqlite/browser-session-repository.js";
 import { isChromeExtensionOrigin } from "../../security/origin-check.js";
+import { browserCookieRequestAllowed, readBrowserSessionCookie, writeBrowserSessionCookie } from "../../security/browser-session.js";
 import { authorizeTrustedProxy } from "../../trusted-proxy.js";
 import { setGatewayPrincipal } from "../../security/gateway-principal.js";
 import { createMiddleware } from "hono/factory";
@@ -30,21 +31,6 @@ function extractTokenFromHeader(authHeader) {
 	if (parts.length === 2 && parts[0].toLowerCase() === "bearer") return parts[1];
 	return authHeader;
 }
-/**
-* SECURITY: query-string tokens leak into server logs, Referer headers, and
-* browser history. We accept them only for avatar `<img>` loads, where an
-* Authorization header cannot be set. Realtime WebSocket authentication uses a
-* one-time ticket acquired over authenticated HTTP.
-*/
-function extractTokenFromQuery(url) {
-	return new URL(url).searchParams.get("token");
-}
-const AGENT_AVATAR_GET_PATH = /^\/api\/agents\/[^/]+\/avatar$/;
-/** Exported for gateway security tests. */
-function isQueryTokenAllowedPath(path, method) {
-	if (method === "GET" && AGENT_AVATAR_GET_PATH.test(path)) return true;
-	return false;
-}
 function resolveRemoteAddress(c) {
 	try {
 		return getConnInfo(c).remote.address;
@@ -53,17 +39,16 @@ function resolveRemoteAddress(c) {
 	}
 }
 function resolveMiddlewareClientIp(c, trustedProxies, allowRealIpFallback) {
-	if (trustedProxies?.length) return resolveClientIpFromRequest({
+	return resolveClientIpFromRequest({
 		remoteAddress: resolveRemoteAddress(c),
 		getHeader: (name) => c.req.header(name),
 		trustedProxies,
 		allowRealIpFallback
 	});
-	return getClientIpFromHeaders({ get: (name) => c.req.header(name) ?? void 0 });
 }
-function buildRateLimitContext(getGatewayAuth, clientIp, origin) {
+function buildRateLimitContext(getGatewayAuth, clientIp, origin, enforce = false) {
 	const cfg = resolveAuthRateLimit(getGatewayAuth?.()?.rateLimit);
-	if (!(cfg.enabled && !isAuthRateLimitGloballyDisabled())) return {
+	if (!(cfg.enabled && (enforce || !isAuthRateLimitGloballyDisabled()))) return {
 		active: false,
 		cfg,
 		trackingKey: void 0
@@ -101,7 +86,18 @@ function blockedResponse(c, retryAfterSec) {
 	}, 429);
 }
 function auth(config) {
-	const { getGatewayAuth, getResolvedAuth, getTrustedProxyContext } = config || {};
+	const { getGatewayAuth: readGatewayAuth, getResolvedAuth, getTrustedProxyContext, isPublicTunnelEnabled } = config || {};
+	const getGatewayAuth = () => {
+		const current = readGatewayAuth?.();
+		return isPublicTunnelEnabled?.() ? {
+			...current,
+			rateLimit: {
+				...current?.rateLimit,
+				enabled: true,
+				exemptLoopback: false
+			}
+		} : current;
+	};
 	return createMiddleware(async (c, next) => {
 		const resolvedAuth = getResolvedAuth?.();
 		if (!resolvedAuth) {
@@ -115,13 +111,17 @@ function auth(config) {
 			}, 401);
 		}
 		const authMode = resolvedAuth.mode;
+		if (isPublicTunnelEnabled?.() && authMode !== "token") return c.json({
+			error: "Unauthorized",
+			code: "unsafe_tunnel_auth"
+		}, 401);
 		if (authMode === "trusted-proxy") {
 			const proxyContext = getTrustedProxyContext?.();
 			const trustedProxies = proxyContext?.trustedProxies;
 			const trustedProxyConfig = resolvedAuth?.trustedProxy;
 			const clientIp = resolveMiddlewareClientIp(c, trustedProxies, proxyContext?.allowRealIpFallback);
 			const origin = c.req.header("origin");
-			const rl = buildRateLimitContext(getGatewayAuth, clientIp, origin);
+			const rl = buildRateLimitContext(getGatewayAuth, clientIp, origin, isPublicTunnelEnabled?.());
 			if (!trustedProxyConfig) {
 				log.warn({
 					path: c.req.path,
@@ -199,16 +199,34 @@ function auth(config) {
 		const proxyContext = getTrustedProxyContext?.();
 		const clientIp = resolveMiddlewareClientIp(c, proxyContext?.trustedProxies, proxyContext?.allowRealIpFallback);
 		const origin = c.req.header("origin");
-		const rl = buildRateLimitContext(getGatewayAuth, clientIp, origin);
+		const rl = buildRateLimitContext(getGatewayAuth, clientIp, origin, isPublicTunnelEnabled?.());
 		const authHeader = extractTokenFromHeader(c.req.header("authorization"));
+		const browserCookie = readBrowserSessionCookie(c);
+		if (!authHeader && browserCookie) {
+			if (!browserCookieRequestAllowed(c)) return c.json({
+				error: "Forbidden",
+				code: "csrf_rejected"
+			}, 403);
+			const session = authenticateBrowserSession(browserCookie, resolvedAuth);
+			if (!session) {
+				recordFailure(rl);
+				return c.json({
+					error: "Unauthorized",
+					code: "browser_session_expired"
+				}, 401);
+			}
+			if (session.renewed) writeBrowserSessionCookie(c, browserCookie, session.expiresAt);
+			setGatewayPrincipal(c, {
+				kind: "owner",
+				principalId: `browser:${session.sessionId}`,
+				browserSessionId: session.sessionId,
+				scopes: ["gateway.admin"]
+			});
+			recordSuccess(rl);
+			return next();
+		}
 		const requestPath = new URL(c.req.url).pathname;
-		const queryToken = authMode === "token" && isQueryTokenAllowedPath(requestPath, c.req.method) ? extractTokenFromQuery(c.req.url) : null;
-		if (!authHeader && queryToken === null && new URL(c.req.url).searchParams.has("token")) log.warn({
-			path: requestPath,
-			method: c.req.method,
-			clientIp
-		}, "Credential in query string rejected: use Authorization header for this endpoint");
-		const providedCredential = authHeader || queryToken;
+		const providedCredential = authHeader;
 		const browserExtensionOrigin = isChromeExtensionOrigin(origin) ? origin.toLowerCase() : void 0;
 		if (providedCredential && validateCredential(providedCredential, expectedCredential)) {
 			if (browserExtensionOrigin) return c.json({
@@ -294,4 +312,4 @@ function auth(config) {
 	});
 }
 //#endregion
-export { auth, isQueryTokenAllowedPath };
+export { auth };

package/dist/src/gateway/hono/middleware/strict-rate-limit.js

@@ -2,7 +2,6 @@ import { createLogger } from "../../../utils/logger/index.js";
 import { init_logger } from "../../../utils/logger.js";
 import { resolveClientIpFromRequest } from "../../client-ip.js";
 import { buckets } from "../../rate-limit/buckets.js";
-import { getClientIpFromHeaders } from "../../security/loopback.js";
 import "../../rate-limit/index.js";
 import { createMiddleware } from "hono/factory";
 import { getConnInfo } from "@hono/node-server/conninfo";
@@ -15,21 +14,18 @@ init_logger();
 const log = createLogger("Hono:StrictRateLimit");
 function resolveClientIp(c, deps) {
 	const { trustedProxies, allowRealIpFallback } = deps.getTrustedProxyContext();
-	if (trustedProxies?.length) {
-		let remoteAddress;
-		try {
-			remoteAddress = getConnInfo(c).remote.address;
-		} catch {
-			remoteAddress = void 0;
-		}
-		return resolveClientIpFromRequest({
-			remoteAddress,
-			getHeader: (name) => c.req.header(name),
-			trustedProxies,
-			allowRealIpFallback
-		});
+	let remoteAddress;
+	try {
+		remoteAddress = getConnInfo(c).remote.address;
+	} catch {
+		remoteAddress = void 0;
 	}
-	return getClientIpFromHeaders({ get: (name) => c.req.header(name) ?? void 0 });
+	return resolveClientIpFromRequest({
+		remoteAddress,
+		getHeader: (name) => c.req.header(name),
+		trustedProxies,
+		allowRealIpFallback
+	});
 }
 function createClientRateLimitMiddleware(deps, options) {
 	return createMiddleware(async (c, next) => {

package/dist/src/gateway/hono/routes/browser-session.d.ts

@@ -0,0 +1,3 @@
+import type { Hono } from 'hono';
+import type { AuthenticatedRouteDeps } from './deps.js';
+export declare function registerBrowserSessionRoutes(app: Hono, deps: AuthenticatedRouteDeps): void;