@xopcai/xopc 0.0.270 → 0.0.273

package/dist/src/storage/sqlite/device-pairing-repository.js

@@ -7,82 +7,30 @@ const PAIRING_ATTEMPTS = 5;
 function hashToken(token) {
 	return crypto.createHash("sha256").update(token).digest("hex");
 }
-function hashesMatch(left, right) {
-	return crypto.timingSafeEqual(Buffer.from(left, "hex"), Buffer.from(right, "hex"));
-}
-function tokenId(token) {
-	if (!token.startsWith(PAIRING_TOKEN_PREFIX)) return void 0;
-	const separator = token.indexOf("_", 10);
-	if (separator <= 10 || separator === token.length - 1) return void 0;
-	return token.slice(10, separator);
-}
-function createDevicePairingSetup(routes, now = Date.now(), protocolVersion = 2, options) {
-	if (routes.length === 0) throw new Error("No secure mobile route is available");
+function createDevicePairingSetup(routes, now = Date.now(), options) {
+	if (routes.length === 0) throw new Error("No secure device route is available");
 	const id = crypto.randomUUID();
 	const token = `${PAIRING_TOKEN_PREFIX}${id}_${crypto.randomBytes(32).toString("base64url")}`;
 	const expiresAt = now + (options?.ttlMs ?? PAIRING_TTL_MS);
 	runSqliteWriteTransaction((db) => {
-		db.prepare(`DELETE FROM device_pairing_sessions WHERE
-      (protocol_version = 2 AND (expires_at <= ? OR consumed_at IS NOT NULL)) OR
-      (protocol_version = 3 AND expires_at < ?)`).run(now, now - 1440 * 6e4);
+		db.prepare(`DELETE FROM device_pairing_sessions
+      WHERE expires_at < ?`).run(now - 1440 * 6e4);
 		db.prepare(`
       INSERT INTO device_pairing_sessions (
         pairing_id, secret_hash, routes_json, expires_at, attempts_remaining, created_at
-        , protocol_version, enrollment_issuer, enrollment_extension_id,
-        enrollment_public_key_thumbprint, enrollment_nonce
+        , enrollment_issuer, enrollment_extension_id,
+        enrollment_public_key_thumbprint, enrollment_nonce, target_kind
       ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
-    `).run(id, hashToken(token), JSON.stringify(routes), expiresAt, PAIRING_ATTEMPTS, now, protocolVersion, options?.enrollment?.issuer ?? null, options?.enrollment?.extensionId ?? null, options?.enrollment?.publicKeyThumbprint ?? null, options?.enrollment?.nonce ?? null);
+    `).run(id, hashToken(token), JSON.stringify(routes), expiresAt, PAIRING_ATTEMPTS, now, options?.enrollment?.issuer ?? null, options?.enrollment?.extensionId ?? null, options?.enrollment?.publicKeyThumbprint ?? null, options?.enrollment?.nonce ?? null, options.targetKind);
 	});
 	return {
 		id,
 		token,
 		routes: [...routes],
-		expiresAt
+		expiresAt,
+		targetKind: options.targetKind
 	};
 }
-function consumeDevicePairingToken(token, now = Date.now()) {
-	const id = tokenId(token);
-	if (!id) return {
-		ok: false,
-		reason: "invalid"
-	};
-	return runSqliteWriteTransaction((db) => {
-		const row = db.prepare("SELECT * FROM device_pairing_sessions WHERE pairing_id = ?").get(id);
-		if (!row || row.attempts_remaining <= 0) return {
-			ok: false,
-			reason: "invalid"
-		};
-		if (row.protocol_version !== 2) return {
-			ok: false,
-			reason: "invalid"
-		};
-		if (row.consumed_at !== null) return {
-			ok: false,
-			reason: "consumed"
-		};
-		if (row.expires_at <= now) return {
-			ok: false,
-			reason: "expired"
-		};
-		if (!hashesMatch(row.secret_hash, hashToken(token))) {
-			db.prepare(`
-        UPDATE device_pairing_sessions
-        SET attempts_remaining = attempts_remaining - 1
-        WHERE pairing_id = ? AND attempts_remaining > 0
-      `).run(id);
-			return {
-				ok: false,
-				reason: "invalid"
-			};
-		}
-		db.prepare("UPDATE device_pairing_sessions SET consumed_at = ? WHERE pairing_id = ?").run(now, id);
-		return {
-			ok: true,
-			pairingId: id,
-			routes: JSON.parse(row.routes_json)
-		};
-	});
-}
 function isDevicePairingSetupActive(pairingId, now = Date.now()) {
 	const row = getSqliteDatabase().prepare(`
     SELECT 1 FROM device_pairing_sessions
@@ -91,4 +39,4 @@ function isDevicePairingSetupActive(pairingId, now = Date.now()) {
 	return Boolean(row);
 }
 //#endregion
-export { consumeDevicePairingToken, createDevicePairingSetup, isDevicePairingSetupActive };
+export { createDevicePairingSetup, isDevicePairingSetupActive };

package/dist/src/storage/sqlite/index.d.ts

@@ -9,7 +9,7 @@ export { deleteEndpointSessionBinding, getEndpointSessionBinding, setEndpointSes
 export { deleteBrowserTabBinding, deleteBrowserTabBindingsByEndpoint, deleteBrowserTabBindingsByPrincipal, getBrowserTabBinding, getBrowserTabBindingById, setBrowserTabBinding, } from './browser-tab-binding-repository.js';
 export { authenticateDeviceAccessToken, buildRefreshProofMessage, createDevice, getDevice, issueDeviceTokenPair, listDevices, revokeDevice, rotateDeviceRefreshToken, type DeviceAccessIdentity, type DevicePlatform, type DevicePublicKeyJwk, type DeviceRecord, type DeviceTokenPair, } from './device-access-repository.js';
 export { clearGatewayIdentityForTest, getOrCreateGatewayIdentity, signGatewayPayload, type GatewayIdentity, } from './gateway-identity-repository.js';
-export { consumeDevicePairingToken, createDevicePairingSetup, isDevicePairingSetupActive, type DevicePairingSetup, type DeviceRoute, type PairingConsumeResult, } from './device-pairing-repository.js';
+export { createDevicePairingSetup, isDevicePairingSetupActive, type DevicePairingSetup, type DeviceRoute, } from './device-pairing-repository.js';
 export { claimContextExtractionRun, finishContextExtractionRun, getContextExtractionRun, hasIndependentExtractionOutput, listContextExtractionOutputs, listContextExtractionRuns, type ContextExtractionOutput, type ContextExtractionRun, type ContextExtractionStatus, type ContextObjectType, } from './context-extraction-repository.js';
 export { closeTemporalAssertions, createTemporalAssertion, linkContextObjects, listContextObjectRelations, listTemporalAssertions, type ContextObjectRelation, type ContextTemporalAssertion, } from './context-relation-repository.js';
 export { createCollaborationRule, getCollaborationRule, listCollaborationRules, setCollaborationRuleStatus, type CollaborationRule, } from './collaboration-rule-repository.js';

package/dist/src/storage/sqlite/index.js

@@ -10,7 +10,7 @@ import { deleteEndpointSessionBinding, getEndpointSessionBinding, setEndpointSes
 import { deleteBrowserTabBinding, deleteBrowserTabBindingsByEndpoint, deleteBrowserTabBindingsByPrincipal, getBrowserTabBinding, getBrowserTabBindingById, setBrowserTabBinding } from "./browser-tab-binding-repository.js";
 import { authenticateDeviceAccessToken, buildRefreshProofMessage, createDevice, getDevice, issueDeviceTokenPair, listDevices, revokeDevice, rotateDeviceRefreshToken } from "./device-access-repository.js";
 import { clearGatewayIdentityForTest, getOrCreateGatewayIdentity, signGatewayPayload } from "./gateway-identity-repository.js";
-import { consumeDevicePairingToken, createDevicePairingSetup, isDevicePairingSetupActive } from "./device-pairing-repository.js";
+import { createDevicePairingSetup, isDevicePairingSetupActive } from "./device-pairing-repository.js";
 import { claimContextExtractionRun, finishContextExtractionRun, getContextExtractionRun, hasIndependentExtractionOutput, listContextExtractionOutputs, listContextExtractionRuns } from "./context-extraction-repository.js";
 import { closeTemporalAssertions, createTemporalAssertion, linkContextObjects, listContextObjectRelations, listTemporalAssertions } from "./context-relation-repository.js";
 import { createCollaborationRule, getCollaborationRule, listCollaborationRules, setCollaborationRuleStatus } from "./collaboration-rule-repository.js";
@@ -40,4 +40,4 @@ import { appendConnectorExecutionAudit, claimConnectorWebhookDelivery, completeC
 import { getConnectorAccount, listConnectorAccounts, reconcileConnectorAccount, refreshConnectorAccountCurrent } from "./connector-account-repository.js";
 import { getConnectorSyncPolicy, getConnectorSyncPolicyForConnection, listConnectorSyncPolicies, upsertConnectorSyncPolicy } from "./connector-sync-policy-repository.js";
 import { getUserTrustPolicy, setUserTrustPolicy } from "./user-trust-repository.js";
-export { COMPOSER_INPUT_HISTORY_LIMIT, DatabaseSchemaMigrationGapError, DatabaseSchemaTooNewError, SCHEMA_META_SCHEMA_VERSION_KEY, XOPC_DB_BASELINE_SCHEMA_VERSION, XOPC_DB_FILENAME, XOPC_DB_SCHEMA_VERSION, acknowledgeHomeAttention, appendCompactionBoundaryIfUnchanged, appendComposerInputHistory, appendConnectorExecutionAudit, appendTranscriptEntry, applyPendingMigrations, authenticateDeviceAccessToken, bindEndpointPrincipal, buildDefaultSessionMetadata, buildGlobalSessionStats, buildRefreshProofMessage, buildRelationshipPrompt, cancelQueuedSessionInput, claimConnectorWebhookDelivery, claimContextExtractionRun, claimKnowledgeSourceItems, claimNextConnectorLearningJob, claimNextSessionInput, classifyStoredRow, clearComposerInputHistory, clearGatewayIdentityForTest, closeTemporalAssertions, closeXopcDatabase, completeConnectorWebhookDelivery, completeKnowledgeSourceItemSynthesis, consumeClarificationApproval, consumeClarificationResume, consumeConnectorApproval, consumeDevicePairingToken, countKnowledgeSourceItems, createClarificationWait, createCollaborationRule, createConnectorApproval, createContextEvidence, createDevice, createDevicePairingSetup, createEndpointPrincipal, createObjectLinkRecord, createTemporalAssertion, decideConnectorApproval, deleteBrowserTabBinding, deleteBrowserTabBindingsByEndpoint, deleteBrowserTabBindingsByPrincipal, deleteConnectorConnection, deleteConnectorInstallation, deleteEndpointSessionBinding, deleteKnowledgeSourceItems, deleteNoteAgentContextRecord, deleteNoteRecord, deleteObjectLinkRecord, deleteSessionConfig, deleteSessionRecord, discoverSqlMigrations, enqueueConnectorLearningJob, ensureSessionRecord, ensureXopcDatabaseSchema, estimateTokensFromMessages, extractFtsContent, findSessionInput, findSessionKeyBySessionId, finishContextExtractionRun, finishEndpointToolInvocationAudit, finishKnowledgeSyncRun, finishSessionInputRun, getActiveClarification, getActivityEventRecord, getBrowserTabBinding, getBrowserTabBindingById, getCachedConnectorCatalogEntry, getClarification, getClarificationResumeInput, getClarificationSnapshot, getCollaborationRule, getConnectorAccount, getConnectorApproval, getConnectorConnection, getConnectorInstallation, getConnectorSyncPolicy, getConnectorSyncPolicyForConnection, getContextExtractionRun, getCurrentSessionId, getDevice, getEndpointPrincipal, getEndpointSessionBinding, getGlobalSessionStats, getInteractionState, getKnowledgeConsumerWatermark, getKnowledgeSourceCursor, getKnowledgeSourceItem, getNoteAgentContextRecord, getNoteRecord, getOrCreateGatewayIdentity, getRelationshipSettings, getSessionConfig, getSessionInputById, getSessionInputState, getSessionMetadata, getSessionPersistedLevels, getSessionTaskPlan, getSqliteDatabase, getUserPeopleIndexState, getUserPerson, getUserTrustPolicy, getXopcDatabase, hasIndependentExtractionOutput, hasSessionConfig, incrementSessionStatsOnAppend, insertSessionInput, inspectSchemaMigrationStatus, isClarificationSuspended, isDevicePairingSetupActive, isHomeAttentionAcknowledged, isProactiveSupportAllowed, isXopcDatabaseOpen, issueDeviceTokenPair, linkContextObjects, listActiveSessionInputRuns, listActivityRecords, listCachedConnectorCatalogEntries, listCollaborationRules, listCompactionBoundaries, listComposerInputHistory, listConnectorAccounts, listConnectorActionMetadata, listConnectorApprovals, listConnectorConnections, listConnectorExecutionAudit, listConnectorInstallations, listConnectorLearningJobs, listConnectorSyncPolicies, listContextExtractionOutputs, listContextExtractionRuns, listContextObjectRelations, listDevices, listEndpointPrincipals, listEndpointToolInvocationAudits, listKnowledgeSourceChanges, listKnowledgeSourceItems, listKnowledgeSyncRuns, listNoteRecords, listObjectActivityRecords, listObjectLinkRecords, listProjectActivityRecords, listRegisteredMigrationTargets, listSessionMetadata, listSessionsByAgent, listTemporalAssertions, listUserPeople, loadCompactionSourceSnapshot, loadLlmMessagesForSession, loadTranscriptHistoryRowsForSession, loadTranscriptRows, loadTranscriptRowsForSession, mergeUserPeople, metadataToSessionInsert, mutateQueuedSessionInput, openXopcDatabase, paginateTranscriptMessages, patchSessionMetadata, pruneBoundedKnowledgeSourceItems, readSchemaVersion, readSchemaVersionForTest, reconcileConnectorAccount, recordActivityEvent, recoverSessionInputState, recoverStaleConnectorLearningJobs, refreshConnectorAccountCurrent, releaseConnectorWebhookDelivery, replaceConnectorCatalogEntries, replaceLatestSessionTurnAndQueueInput, replaceTranscriptRows, replaceUserPeopleIndex, requireXopcDatabase, resetSessionRecord, resetXopcDatabaseSingletonForTest, resolveClarification, resolveMigrationsDir, resolveSessionAgentId, resolveXopcDatabasePath, restoreBeforeCompactionBoundary, revokeDevice, revokeEndpointPrincipal, rotateDeviceRefreshToken, runSqliteWriteTransaction, searchSessionTranscript, sessionConfigRowToConfig, sessionRowToMetadata, setBrowserTabBinding, setCollaborationRuleStatus, setConnectorLearningPaused, setEndpointSessionBinding, setInteractionState, setKnowledgeConsumerWatermark, setKnowledgeSourceCursor, setKnowledgeSourceItemSynthesisStatus, setSessionConfig, setSessionInputStatus, setSessionTaskPlan, setUserTrustPolicy, signGatewayPayload, startEndpointToolInvocationAudit, startKnowledgeSyncRun, summarizeUserPeople, supersedeActiveClarification, touchEndpointPrincipal, transcriptEntryRowToStoredRow, updateConnectorLearningJob, updateInteractionStateFromMessage, updateRelationshipSettings, updateSessionConfig, updateSessionStats, updateUserPerson, upsertConnectorActionMetadata, upsertConnectorCatalogEntry, upsertConnectorConnection, upsertConnectorInstallation, upsertConnectorSyncPolicy, upsertKnowledgeSourceItems, upsertNoteAgentContextRecord, upsertNoteRecord, validateLatestSessionTurnTarget };
+export { COMPOSER_INPUT_HISTORY_LIMIT, DatabaseSchemaMigrationGapError, DatabaseSchemaTooNewError, SCHEMA_META_SCHEMA_VERSION_KEY, XOPC_DB_BASELINE_SCHEMA_VERSION, XOPC_DB_FILENAME, XOPC_DB_SCHEMA_VERSION, acknowledgeHomeAttention, appendCompactionBoundaryIfUnchanged, appendComposerInputHistory, appendConnectorExecutionAudit, appendTranscriptEntry, applyPendingMigrations, authenticateDeviceAccessToken, bindEndpointPrincipal, buildDefaultSessionMetadata, buildGlobalSessionStats, buildRefreshProofMessage, buildRelationshipPrompt, cancelQueuedSessionInput, claimConnectorWebhookDelivery, claimContextExtractionRun, claimKnowledgeSourceItems, claimNextConnectorLearningJob, claimNextSessionInput, classifyStoredRow, clearComposerInputHistory, clearGatewayIdentityForTest, closeTemporalAssertions, closeXopcDatabase, completeConnectorWebhookDelivery, completeKnowledgeSourceItemSynthesis, consumeClarificationApproval, consumeClarificationResume, consumeConnectorApproval, countKnowledgeSourceItems, createClarificationWait, createCollaborationRule, createConnectorApproval, createContextEvidence, createDevice, createDevicePairingSetup, createEndpointPrincipal, createObjectLinkRecord, createTemporalAssertion, decideConnectorApproval, deleteBrowserTabBinding, deleteBrowserTabBindingsByEndpoint, deleteBrowserTabBindingsByPrincipal, deleteConnectorConnection, deleteConnectorInstallation, deleteEndpointSessionBinding, deleteKnowledgeSourceItems, deleteNoteAgentContextRecord, deleteNoteRecord, deleteObjectLinkRecord, deleteSessionConfig, deleteSessionRecord, discoverSqlMigrations, enqueueConnectorLearningJob, ensureSessionRecord, ensureXopcDatabaseSchema, estimateTokensFromMessages, extractFtsContent, findSessionInput, findSessionKeyBySessionId, finishContextExtractionRun, finishEndpointToolInvocationAudit, finishKnowledgeSyncRun, finishSessionInputRun, getActiveClarification, getActivityEventRecord, getBrowserTabBinding, getBrowserTabBindingById, getCachedConnectorCatalogEntry, getClarification, getClarificationResumeInput, getClarificationSnapshot, getCollaborationRule, getConnectorAccount, getConnectorApproval, getConnectorConnection, getConnectorInstallation, getConnectorSyncPolicy, getConnectorSyncPolicyForConnection, getContextExtractionRun, getCurrentSessionId, getDevice, getEndpointPrincipal, getEndpointSessionBinding, getGlobalSessionStats, getInteractionState, getKnowledgeConsumerWatermark, getKnowledgeSourceCursor, getKnowledgeSourceItem, getNoteAgentContextRecord, getNoteRecord, getOrCreateGatewayIdentity, getRelationshipSettings, getSessionConfig, getSessionInputById, getSessionInputState, getSessionMetadata, getSessionPersistedLevels, getSessionTaskPlan, getSqliteDatabase, getUserPeopleIndexState, getUserPerson, getUserTrustPolicy, getXopcDatabase, hasIndependentExtractionOutput, hasSessionConfig, incrementSessionStatsOnAppend, insertSessionInput, inspectSchemaMigrationStatus, isClarificationSuspended, isDevicePairingSetupActive, isHomeAttentionAcknowledged, isProactiveSupportAllowed, isXopcDatabaseOpen, issueDeviceTokenPair, linkContextObjects, listActiveSessionInputRuns, listActivityRecords, listCachedConnectorCatalogEntries, listCollaborationRules, listCompactionBoundaries, listComposerInputHistory, listConnectorAccounts, listConnectorActionMetadata, listConnectorApprovals, listConnectorConnections, listConnectorExecutionAudit, listConnectorInstallations, listConnectorLearningJobs, listConnectorSyncPolicies, listContextExtractionOutputs, listContextExtractionRuns, listContextObjectRelations, listDevices, listEndpointPrincipals, listEndpointToolInvocationAudits, listKnowledgeSourceChanges, listKnowledgeSourceItems, listKnowledgeSyncRuns, listNoteRecords, listObjectActivityRecords, listObjectLinkRecords, listProjectActivityRecords, listRegisteredMigrationTargets, listSessionMetadata, listSessionsByAgent, listTemporalAssertions, listUserPeople, loadCompactionSourceSnapshot, loadLlmMessagesForSession, loadTranscriptHistoryRowsForSession, loadTranscriptRows, loadTranscriptRowsForSession, mergeUserPeople, metadataToSessionInsert, mutateQueuedSessionInput, openXopcDatabase, paginateTranscriptMessages, patchSessionMetadata, pruneBoundedKnowledgeSourceItems, readSchemaVersion, readSchemaVersionForTest, reconcileConnectorAccount, recordActivityEvent, recoverSessionInputState, recoverStaleConnectorLearningJobs, refreshConnectorAccountCurrent, releaseConnectorWebhookDelivery, replaceConnectorCatalogEntries, replaceLatestSessionTurnAndQueueInput, replaceTranscriptRows, replaceUserPeopleIndex, requireXopcDatabase, resetSessionRecord, resetXopcDatabaseSingletonForTest, resolveClarification, resolveMigrationsDir, resolveSessionAgentId, resolveXopcDatabasePath, restoreBeforeCompactionBoundary, revokeDevice, revokeEndpointPrincipal, rotateDeviceRefreshToken, runSqliteWriteTransaction, searchSessionTranscript, sessionConfigRowToConfig, sessionRowToMetadata, setBrowserTabBinding, setCollaborationRuleStatus, setConnectorLearningPaused, setEndpointSessionBinding, setInteractionState, setKnowledgeConsumerWatermark, setKnowledgeSourceCursor, setKnowledgeSourceItemSynthesisStatus, setSessionConfig, setSessionInputStatus, setSessionTaskPlan, setUserTrustPolicy, signGatewayPayload, startEndpointToolInvocationAudit, startKnowledgeSyncRun, summarizeUserPeople, supersedeActiveClarification, touchEndpointPrincipal, transcriptEntryRowToStoredRow, updateConnectorLearningJob, updateInteractionStateFromMessage, updateRelationshipSettings, updateSessionConfig, updateSessionStats, updateUserPerson, upsertConnectorActionMetadata, upsertConnectorCatalogEntry, upsertConnectorConnection, upsertConnectorInstallation, upsertConnectorSyncPolicy, upsertKnowledgeSourceItems, upsertNoteAgentContextRecord, upsertNoteRecord, validateLatestSessionTurnTarget };

package/dist/src/storage/sqlite/migrations/164_browser_sessions.sql

@@ -0,0 +1,8 @@
+CREATE TABLE browser_sessions (
+  session_id TEXT PRIMARY KEY,
+  token_hash TEXT NOT NULL UNIQUE,
+  auth_fingerprint TEXT NOT NULL,
+  created_at INTEGER NOT NULL,
+  expires_at INTEGER NOT NULL
+);
+CREATE INDEX idx_browser_sessions_expiry ON browser_sessions(expires_at);

package/dist/src/storage/sqlite/migrations/165_device_pairing_target.sql

@@ -0,0 +1,40 @@
+-- Pairing state is short-lived, so replace the tables instead of carrying the
+-- retired protocol discriminator into the device-targeted flow.
+DROP TABLE device_pairing_requests;
+DROP TABLE device_pairing_sessions;
+
+CREATE TABLE device_pairing_sessions (
+  pairing_id TEXT PRIMARY KEY,
+  secret_hash TEXT NOT NULL,
+  routes_json TEXT NOT NULL,
+  expires_at INTEGER NOT NULL,
+  attempts_remaining INTEGER NOT NULL CHECK (attempts_remaining >= 0),
+  created_at INTEGER NOT NULL,
+  consumed_at INTEGER,
+  enrollment_issuer TEXT,
+  enrollment_extension_id TEXT,
+  enrollment_public_key_thumbprint TEXT,
+  enrollment_nonce TEXT,
+  target_kind TEXT NOT NULL CHECK (target_kind IN ('mobile', 'browser'))
+);
+
+CREATE INDEX idx_device_pairing_sessions_expiry
+  ON device_pairing_sessions(expires_at);
+
+CREATE TABLE device_pairing_requests (
+  request_id TEXT PRIMARY KEY,
+  pairing_id TEXT NOT NULL UNIQUE REFERENCES device_pairing_sessions(pairing_id) ON DELETE CASCADE,
+  device_json TEXT NOT NULL,
+  status TEXT NOT NULL CHECK (status IN ('pending', 'approved', 'completed', 'rejected', 'cancelled', 'expired')),
+  revision INTEGER NOT NULL DEFAULT 1,
+  confirmation_code TEXT NOT NULL,
+  expires_at INTEGER NOT NULL,
+  recovery_until INTEGER NOT NULL,
+  completion_key TEXT,
+  initial_token_hash TEXT,
+  device_id TEXT REFERENCES devices(device_id),
+  created_at INTEGER NOT NULL
+);
+
+CREATE INDEX idx_device_pairing_requests_expiry
+  ON device_pairing_requests(recovery_until);

package/dist/src/storage/sqlite/migrations/runner.d.ts

@@ -3,7 +3,7 @@ import type { ApplyMigrationsOptions } from './types.js';
 /** Baseline schema version applied from schema.sql on first open. */
 export declare const XOPC_DB_BASELINE_SCHEMA_VERSION = 11;
 /** Latest schema version this release supports (increment when adding migrations). */
-export declare const XOPC_DB_SCHEMA_VERSION = 163;
+export declare const XOPC_DB_SCHEMA_VERSION = 165;
 export declare function resolveMigrationsDir(override?: string): string;
 /**
  * Apply sequential SQL migrations from (currentVersion + 1) through targetVersion.

package/dist/src/storage/sqlite/migrations/runner.js

@@ -12,7 +12,7 @@ const log = createLogger("Sqlite:Migrations");
 /** Baseline schema version applied from schema.sql on first open. */
 const XOPC_DB_BASELINE_SCHEMA_VERSION = 11;
 /** Latest schema version this release supports (increment when adding migrations). */
-const XOPC_DB_SCHEMA_VERSION = 163;
+const XOPC_DB_SCHEMA_VERSION = 165;
 const MODULE_DIR = dirname(fileURLToPath(import.meta.url));
 function backupBeforeTaskCutover(db, databasePath) {
 	db.exec("PRAGMA wal_checkpoint(FULL)");
@@ -57,7 +57,7 @@ function applySingleMigration(db, migration) {
 * Each step runs in its own transaction and updates schema_meta on success.
 */
 function applyPendingMigrations(db, options = {}) {
-	const targetVersion = options.targetVersion ?? 163;
+	const targetVersion = options.targetVersion ?? 165;
 	let currentVersion = readSchemaVersion(db);
 	if (currentVersion > targetVersion) throw new DatabaseSchemaTooNewError(currentVersion, targetVersion);
 	if (currentVersion >= targetVersion) return currentVersion;
@@ -94,7 +94,7 @@ function applyPendingMigrations(db, options = {}) {
 }
 /** Inspect schema version without mutating the database. */
 function inspectSchemaMigrationStatus(db, options = {}) {
-	const appVersion = options.targetVersion ?? 163;
+	const appVersion = options.targetVersion ?? 165;
 	const dbVersion = readSchemaVersion(db);
 	if (dbVersion > appVersion) return {
 		dbVersion,

package/dist/src/storage/sqlite/migrations/runner.ts

@@ -19,7 +19,7 @@ const log = createLogger('Sqlite:Migrations');
 export const XOPC_DB_BASELINE_SCHEMA_VERSION = 11;
 
 /** Latest schema version this release supports (increment when adding migrations). */
-export const XOPC_DB_SCHEMA_VERSION = 163;
+export const XOPC_DB_SCHEMA_VERSION = 165;
 
 const MODULE_DIR = dirname(fileURLToPath(import.meta.url));
 

package/dist/src/storage/sqlite/schema.js

@@ -32,7 +32,7 @@ function ensureXopcDatabaseSchema(db, options = {}) {
 		currentVersion = 11;
 	}
 	applyPendingMigrations(db, {
-		targetVersion: 163,
+		targetVersion: 165,
 		databasePath: options.databasePath
 	});
 }

package/dist/src/storage/sqlite/session-identity-sql.d.ts

@@ -0,0 +1,2 @@
+export declare const SESSION_SOURCE_SQL: string;
+export declare const SESSION_PURPOSE_SQL: string;

package/dist/src/storage/sqlite/session-identity-sql.js

@@ -0,0 +1,18 @@
+import { SESSION_SOURCE_CHANNELS } from "../../../packages/gateway-contract/src/session-identity.js";
+//#region src/storage/sqlite/session-identity-sql.ts
+const custom = (key) => `json_extract(CASE WHEN json_valid(s.custom_data_json) THEN s.custom_data_json ELSE '{}' END, '$.${key}')`;
+const channel = "LOWER(TRIM(s.source_channel))";
+const SESSION_SOURCE_SQL = `(CASE
+  WHEN s.session_type = 'heartbeat' THEN 'system'
+  WHEN ${custom("origin")} = 'automation' OR ${custom("triggerSource")} = 'automation' OR s.session_type = 'cron' THEN 'automation'
+  WHEN ${custom("createdSurface")} = 'browser_extension' THEN 'browser'
+  ${Object.entries(SESSION_SOURCE_CHANNELS).map(([name, aliases]) => `WHEN ${channel} IN (${aliases.map((alias) => `'${alias}'`).join(",")}) THEN '${name}'`).join("\n  ")}
+  ELSE 'other' END)`;
+const SESSION_PURPOSE_SQL = `(CASE
+  WHEN ${SESSION_SOURCE_SQL} = 'system' THEN 'system'
+  WHEN s.session_type = 'workflow-subagent' THEN 'subagent'
+  WHEN s.session_type = 'workflow-run' THEN 'workflow'
+  WHEN ${SESSION_SOURCE_SQL} = 'automation' THEN 'automation'
+  ELSE 'chat' END)`;
+//#endregion
+export { SESSION_PURPOSE_SQL, SESSION_SOURCE_SQL };

package/dist/src/storage/sqlite/session-repository.js

@@ -5,6 +5,7 @@ import { buildGlobalSessionStats, metadataToSessionInsert, sessionRowToMetadata
 import { cancelConnectionObjective } from "./connection-wait-repository.js";
 import { notifyUserContextChange } from "../../user-context/changes.js";
 import { validateSessionId } from "../../session/session-id.js";
+import { SESSION_PURPOSE_SQL, SESSION_SOURCE_SQL } from "./session-identity-sql.js";
 import { buildFts5SearchQuery } from "./fts.js";
 import { randomUUID } from "node:crypto";
 //#region src/storage/sqlite/session-repository.ts
@@ -81,7 +82,7 @@ function listSessionMetadata(query = {}) {
 	if (query.sessionTypes?.length) {
 		conditions.push(`s.session_type IN (${query.sessionTypes.map(() => "?").join(", ")})`);
 		params.push(...query.sessionTypes);
-	} else if (!query.includeHidden) {
+	} else if (!query.includeHidden && !query.purposes?.length && !query.activity && !query.sources?.length) {
 		conditions.push(`s.session_type = ?`);
 		params.push("chat");
 	}
@@ -90,6 +91,21 @@ function listSessionMetadata(query = {}) {
 		conditions.push(`s.status IN (${statuses.map(() => "?").join(", ")})`);
 		params.push(...statuses);
 	}
+	if (query.excludeArchived) conditions.push(`s.status != 'archived'`);
+	if (query.sources?.length) {
+		conditions.push(`${SESSION_SOURCE_SQL} IN (${query.sources.map(() => "?").join(",")})`);
+		params.push(...query.sources);
+	}
+	if (query.purposes?.length) {
+		conditions.push(`${SESSION_PURPOSE_SQL} IN (${query.purposes.map(() => "?").join(",")})`);
+		params.push(...query.purposes);
+	}
+	if (query.activity === "automatic") conditions.push(`${SESSION_SOURCE_SQL} IN ('automation', 'system')`);
+	if (query.activity === "manual") conditions.push(`${SESSION_PURPOSE_SQL} = 'chat' AND ${SESSION_SOURCE_SQL} NOT IN ('automation', 'system')`);
+	if (query.agentId) {
+		conditions.push("s.agent_id = ?");
+		params.push(query.agentId);
+	}
 	if (query.projectId) {
 		conditions.push(`s.project_id = ?`);
 		params.push(query.projectId);
@@ -126,29 +142,17 @@ function listSessionMetadata(query = {}) {
 		conditions.push(`s.tags_json LIKE ?`);
 		params.push(`%"${tag}"%`);
 	}
-	let searchKeys = null;
 	if (query.search?.trim()) {
 		const rawSearch = query.search.trim();
-		const ftsQuery = buildFts5SearchQuery(rawSearch);
-		const ftsRows = db.prepare(`SELECT DISTINCT session_key FROM transcript_fts WHERE transcript_fts MATCH ? LIMIT 500`).all(ftsQuery);
-		const ftsKeys = new Set(ftsRows.map((r) => r.session_key));
 		const like = `%${rawSearch.toLowerCase()}%`;
-		const metaRows = db.prepare(`SELECT session_key FROM sessions
-         WHERE LOWER(session_key) LIKE ?
-            OR LOWER(COALESCE(name, '')) LIKE ?
-            OR LOWER(source_channel) LIKE ?
-            OR LOWER(source_chat_id) LIKE ?
-            OR LOWER(tags_json) LIKE ?`).all(like, like, like, like, like);
-		searchKeys = [...new Set([...ftsKeys, ...metaRows.map((r) => r.session_key)])];
-		if (searchKeys.length === 0) return {
-			items: [],
-			total: 0,
-			limit: query.limit ?? 50,
-			offset: query.offset ?? 0,
-			hasMore: false
-		};
-		conditions.push(`s.session_key IN (${searchKeys.map(() => "?").join(", ")})`);
-		params.push(...searchKeys);
+		conditions.push(`(s.session_key IN (
+      SELECT session_key FROM transcript_fts WHERE transcript_fts MATCH ?
+    ) OR LOWER(s.session_key) LIKE ?
+      OR LOWER(COALESCE(s.name, '')) LIKE ?
+      OR LOWER(s.source_channel) LIKE ?
+      OR LOWER(s.source_chat_id) LIKE ?
+      OR LOWER(s.tags_json) LIKE ?)`);
+		params.push(buildFts5SearchQuery(rawSearch), like, like, like, like, like);
 	}
 	const where = conditions.length > 0 ? `WHERE ${conditions.join(" AND ")}` : "";
 	const sortColumn = sessionSortColumn(query.sortBy);
@@ -158,7 +162,7 @@ function listSessionMetadata(query = {}) {
 	const offset = query.offset ?? 0;
 	return {
 		items: db.prepare(`SELECT ${SESSION_COLUMNS} ${SESSION_FROM_JOIN} ${where}
-       ORDER BY ${sortColumn} ${sortOrder}
+       ORDER BY ${sortColumn} ${sortOrder}, s.session_key ASC
        LIMIT ? OFFSET ?`).all(...params, limit, offset).map((row) => sessionRowToMetadata(row.session_key, row)),
 		total,
 		limit,

package/dist/src/tunnel/auth-policy.d.ts

@@ -0,0 +1,3 @@
+import type { ResolvedGatewayAuth } from '../gateway/auth.js';
+/** A public FRP ingress cannot trust local sockets or proxy identity headers. */
+export declare function requireTunnelGatewayToken(auth: ResolvedGatewayAuth): string;

package/dist/src/tunnel/auth-policy.js

@@ -0,0 +1,8 @@
+//#region src/tunnel/auth-policy.ts
+/** A public FRP ingress cannot trust local sockets or proxy identity headers. */
+function requireTunnelGatewayToken(auth) {
+	if (auth.mode !== "token" || !auth.token?.trim()) throw new Error("Public remote access requires gateway token authentication.");
+	return auth.token;
+}
+//#endregion
+export { requireTunnelGatewayToken };

package/dist/src/tunnel/broker-client.d.ts

@@ -4,9 +4,13 @@ export type BrokerRegisterInput = {
     registrationSecret: string;
     gatewayVersion: string;
     platform: string;
-    gatewayTokenHash: string;
+    recoveryToken?: string;
     preferredSubdomain?: string;
 };
+export declare class TunnelBrokerError extends Error {
+    readonly status: number;
+    constructor(status: number, message: string);
+}
 export declare class TunnelBrokerClient {
     private readonly baseUrl;
     constructor(baseUrl: string);
@@ -14,19 +18,5 @@ export declare class TunnelBrokerClient {
     register(input: BrokerRegisterInput): Promise<TunnelRegistration>;
     heartbeat(tunnelId: string, tunnelToken: string): Promise<void>;
     deregister(tunnelId: string, tunnelToken: string): Promise<void>;
-    setDnsChallenge(input: {
-        tunnelId: string;
-        tunnelToken: string;
-        subdomain: string;
-        txtValue: string;
-    }): Promise<{
-        recordId: string;
-        fqdn: string;
-    }>;
-    cleanupDnsChallenge(input: {
-        tunnelId: string;
-        tunnelToken: string;
-        recordId: string;
-    }): Promise<void>;
 }
 export declare function resolveBrokerApiBase(brokerUrl: string): string;

package/dist/src/tunnel/broker-client.js

@@ -1,8 +1,31 @@
 import { createLogger } from "../utils/logger/index.js";
 import { init_logger } from "../utils/logger.js";
+import { createTunnelRegistrationProof } from "./registration-proof.js";
+import { z } from "zod";
 //#region src/tunnel/broker-client.ts
 init_logger();
 const log = createLogger("TunnelBroker");
+var TunnelBrokerError = class extends Error {
+	constructor(status, message) {
+		super(message);
+		this.status = status;
+	}
+};
+const registrationResponseSchema = z.object({
+	tunnelId: z.string().regex(/^[a-zA-Z0-9_-]{1,128}$/),
+	tunnelToken: z.string().min(1).max(256),
+	subdomain: z.string().regex(/^[a-z0-9]{4,16}$/),
+	publicUrl: z.url(),
+	frpc: z.object({
+		serverAddr: z.string().min(1).max(253),
+		serverPort: z.number().int().min(1).max(65535),
+		authToken: z.string().min(1).max(256),
+		proxyName: z.string().regex(/^[a-zA-Z0-9_-]{1,128}$/),
+		subdomain: z.string().regex(/^[a-z0-9]{4,16}$/)
+	}),
+	expiresAt: z.iso.datetime(),
+	heartbeatIntervalMs: z.number().int().min(5e3).max(6e4)
+});
 var TunnelBrokerClient = class {
 	constructor(baseUrl) {
 		this.baseUrl = baseUrl;
@@ -13,39 +36,40 @@ var TunnelBrokerClient = class {
 	async register(input) {
 		const url = this.apiUrl("/tunnels/register");
 		const res = await fetch(url, {
+			redirect: "error",
+			signal: AbortSignal.timeout(15e3),
 			method: "POST",
 			headers: {
 				"Content-Type": "application/json",
 				"X-Registration-Secret": input.registrationSecret
 			},
-			body: JSON.stringify({
-				gatewayVersion: input.gatewayVersion,
-				platform: input.platform,
-				gatewayTokenHash: input.gatewayTokenHash,
-				preferredSubdomain: input.preferredSubdomain
-			})
+			body: JSON.stringify(createTunnelRegistrationProof(input))
 		});
 		if (!res.ok) {
-			const body = await res.text().catch(() => "");
 			log.error({
 				status: res.status,
-				url,
-				bodyPreview: body.slice(0, 200)
+				url
 			}, "Tunnel register failed");
-			throw new Error(`Tunnel register failed: ${res.status} ${res.statusText}`);
+			throw new TunnelBrokerError(res.status, `Tunnel register failed: ${res.status}`);
 		}
-		return await res.json();
+		const registration = registrationResponseSchema.parse(await res.json());
+		if (new URL(registration.publicUrl).protocol !== "https:") throw new Error("Tunnel requires HTTPS");
+		return registration;
 	}
 	async heartbeat(tunnelId, tunnelToken) {
 		const res = await fetch(this.apiUrl(`/tunnels/${encodeURIComponent(tunnelId)}/heartbeat`), {
+			redirect: "error",
+			signal: AbortSignal.timeout(15e3),
 			method: "POST",
 			headers: { "X-Tunnel-Token": tunnelToken }
 		});
-		if (res.status === 401 || res.status === 410) throw new Error(`Tunnel heartbeat rejected: ${res.status}`);
+		if (res.status === 401 || res.status === 403 || res.status === 410) throw new TunnelBrokerError(res.status, `Tunnel heartbeat rejected: ${res.status}`);
 		if (!res.ok) throw new Error(`Tunnel heartbeat failed: ${res.status}`);
 	}
 	async deregister(tunnelId, tunnelToken) {
 		const res = await fetch(this.apiUrl(`/tunnels/${encodeURIComponent(tunnelId)}`), {
+			redirect: "error",
+			signal: AbortSignal.timeout(15e3),
 			method: "DELETE",
 			headers: { "X-Tunnel-Token": tunnelToken }
 		});
@@ -54,42 +78,6 @@ var TunnelBrokerClient = class {
 			status: res.status
 		}, "Tunnel deregister returned non-OK");
 	}
-	async setDnsChallenge(input) {
-		const res = await fetch(this.apiUrl("/dns/challenge"), {
-			method: "POST",
-			headers: {
-				"Content-Type": "application/json",
-				"X-Tunnel-Token": input.tunnelToken
-			},
-			body: JSON.stringify({
-				tunnelId: input.tunnelId,
-				subdomain: input.subdomain,
-				txtValue: input.txtValue
-			})
-		});
-		if (!res.ok) {
-			const body = await res.text().catch(() => "");
-			throw new Error(`Broker DNS challenge failed: ${res.status} ${body.slice(0, 200)}`);
-		}
-		return await res.json();
-	}
-	async cleanupDnsChallenge(input) {
-		const res = await fetch(this.apiUrl("/dns/cleanup"), {
-			method: "POST",
-			headers: {
-				"Content-Type": "application/json",
-				"X-Tunnel-Token": input.tunnelToken
-			},
-			body: JSON.stringify({
-				tunnelId: input.tunnelId,
-				recordId: input.recordId
-			})
-		});
-		if (!res.ok && res.status !== 404) log.warn({
-			recordId: input.recordId,
-			status: res.status
-		}, "Broker DNS cleanup returned non-OK");
-	}
 };
 function resolveBrokerApiBase(brokerUrl) {
 	const trimmed = brokerUrl.replace(/\/+$/, "");
@@ -97,4 +85,4 @@ function resolveBrokerApiBase(brokerUrl) {
 	return `${trimmed}/api`;
 }
 //#endregion
-export { TunnelBrokerClient, resolveBrokerApiBase };
+export { TunnelBrokerClient, TunnelBrokerError, resolveBrokerApiBase };

package/dist/src/tunnel/frpc-binary.d.ts

@@ -1,14 +1,16 @@
 import { type FrpcReleasePlatform } from './frpc-extract.js';
+import { FRPC_VERSION } from './frpc-release.js';
 import type { FrpcDownloadProgress } from './tunnel-types.js';
-export declare const FRPC_VERSION = "0.62.1";
+export { FRPC_VERSION };
 export type { FrpcDownloadProgress };
 export type EnsureFrpcBinaryOptions = {
     onProgress?: (progress: FrpcDownloadProgress) => void;
+    platform?: FrpcReleasePlatform;
+    arch?: string;
 };
-export declare function buildFrpcReleaseBasename(frpPlatform: FrpcReleasePlatform, arch: string, version?: string): string;
-export declare function frpcDownloadUrlsForTarget(frpPlatform: FrpcReleasePlatform, arch: string, version?: string): string[];
-/** Set after a successful tunnel start so subprocesses can resolve the same binary. */
-export declare function publishFrpcPathForProcess(binPath: string): void;
-/** Clear runtime frpc path when the tunnel stops (no bundled Electron binary). */
+export declare function buildFrpcReleaseBasename(platform: FrpcReleasePlatform, arch: string, version?: string): string;
+export declare function frpcDownloadUrlsForTarget(platform: FrpcReleasePlatform, arch: string, version?: string): string[];
+export declare function verifyFrpcDigest(path: string, expected: string): Promise<void>;
+export declare function publishFrpcPathForProcess(path: string): void;
 export declare function clearFrpcPathForProcess(): void;
 export declare function ensureFrpcBinary(opts?: EnsureFrpcBinaryOptions): Promise<string>;