@xopcai/xopc 0.0.272 → 0.0.274

package/README.md

@@ -28,14 +28,10 @@
 
 <p align="center">
   <a href="https://xopcai.github.io/xopc/xopc-desktop.mp4">
-    <img src="docs/public/xopc-desktop-preview.gif" alt="xopc desktop onboarding demo" width="960">
+    <img src="docs/public/xopc-desktop-preview.gif" alt="xopc desktop app demo" width="960">
   </a>
 </p>
 
-<p align="center">
-  <a href="https://xopcai.github.io/xopc/xopc-desktop.mp4"><strong>Watch the full onboarding video (1:02) →</strong></a>
-</p>
-
 > After setup, try: **“One thing I want to move forward this week is ____. Help me find the smallest credible next step.”**
 
 <details>

package/README.zh-CN.md

@@ -28,14 +28,10 @@
 
 <p align="center">
   <a href="https://xopcai.github.io/xopc/xopc-desktop.mp4">
-    <img src="docs/public/xopc-desktop-preview.gif" alt="xopc 桌面端 onboarding 演示" width="960">
+    <img src="docs/public/xopc-desktop-preview.gif" alt="xopc 桌面应用演示" width="960">
   </a>
 </p>
 
-<p align="center">
-  <a href="https://xopcai.github.io/xopc/xopc-desktop.mp4"><strong>观看完整 onboarding 视频（1:02）→</strong></a>
-</p>
-
 > 安装后可以直接告诉它：**“这周我最想推进的一件事是 ____。帮我找到最小但可信的下一步。”**
 
 <details>

package/dist/browser-ext/dist/assets/{auth-C1QI-uMG.js → auth-O8RiOF3l.js}

@@ -5655,7 +5655,34 @@ class RealtimeClient {
   }
 }
 
-_enum(["mobile", "browser"]);
+const DEVICE_PAIRING_VERSION = 3;
+const BROWSER_PAIRING_INVITATION_VERSION = 1;
+const BROWSER_PAIRING_INVITATION_PREFIX = `XOPC-BROWSER-INVITE-V${BROWSER_PAIRING_INVITATION_VERSION}:`;
+const devicePairingTargetKindSchema = _enum(["mobile", "browser"]);
+const devicePairingRouteSchema = strictObject({
+  id: string().trim().min(1).max(80),
+  kind: _enum(["xopc-secure-link", "tailscale", "custom-https", "local-browser"]),
+  url: string().url()
+}).superRefine((route, context) => {
+  const url = new URL(route.url);
+  const isOrigin = !url.username && !url.password && url.pathname === "/" && !url.search && !url.hash;
+  const valid = route.kind === "local-browser" ? url.protocol === "http:" && url.hostname === "127.0.0.1" && isOrigin : url.protocol === "https:" && isOrigin;
+  if (!valid) context.addIssue({ code: "custom", path: ["url"], message: "Pairing route must be a secure origin" });
+});
+const devicePairingInvitationPayloadSchema = strictObject({
+  version: literal(DEVICE_PAIRING_VERSION),
+  targetKind: devicePairingTargetKindSchema,
+  pairingToken: string().regex(/^xopc_pair_[0-9a-f-]{36}_[A-Za-z0-9_-]{43}$/i),
+  gatewayId: string().uuid(),
+  gatewayName: string().trim().min(1).max(120),
+  gatewayPublicKey: string().regex(/^[A-Za-z0-9_-]{43}$/),
+  routes: array(devicePairingRouteSchema).min(1).max(8),
+  expiresAt: number().int().positive()
+}).superRefine((payload, context) => {
+  if (payload.targetKind === "mobile" && payload.routes.some((route) => route.kind === "local-browser")) {
+    context.addIssue({ code: "custom", path: ["routes"], message: "Mobile invitations require remote routes" });
+  }
+});
 const devicePairingKeySchema = strictObject({
   kty: literal("EC"),
   crv: literal("P-256"),
@@ -5691,6 +5718,18 @@ devicePairingProofSchema.extend({
   idempotencyKey: string().uuid(),
   initialRefreshToken: initialDeviceRefreshTokenSchema
 });
+function isRetryableDevicePairingHttpStatus(status) {
+  return status >= 500 || [404, 408, 425, 429].includes(status);
+}
+function readBrowserPairingInvitation(value) {
+  const invitation = value.trim();
+  if (!invitation.startsWith(BROWSER_PAIRING_INVITATION_PREFIX)) {
+    throw new Error("Browser pairing invitation is invalid");
+  }
+  const encodedPayload = invitation.slice(BROWSER_PAIRING_INVITATION_PREFIX.length);
+  if (!/^[A-Za-z0-9_-]+$/.test(encodedPayload)) throw new Error("Browser pairing invitation is invalid");
+  return encodedPayload;
+}
 function canonical(value) {
   if (Array.isArray(value)) return `[${value.map(canonical).join(",")}]`;
   if (value !== null && typeof value === "object") {
@@ -5977,12 +6016,13 @@ async function clearBrowserOutboxes() {
 }
 
 const PROFILE_KEY = "xopc.browser.profile";
-const PENDING_PAIRING_LINK_KEY = "xopc.browser.pending-pairing-link";
+const PAIRING_JOURNAL_KEY = "xopc.browser.pairing";
 const AUTO_CONNECT_KEY = "xopc.browser.auto-connect";
 const KEY_DATABASE = "xopc-browser-identity";
 const KEY_STORE = "identity";
 const KEY_NAME = "device-key";
 const NATIVE_HOST_NAME = "ai.xopc.browser";
+const GATEWAY_REQUEST_TIMEOUT_MS = 8e3;
 let refreshTask;
 async function browserPublicKeyThumbprint(jwk) {
   const canonical = JSON.stringify({ crv: jwk.crv, kty: jwk.kty, x: jwk.x, y: jwk.y });
@@ -6014,13 +6054,13 @@ async function discoverLocalGateway(options) {
         nonce
       }
     );
-    if (response.ok !== true || typeof response.gatewayUrl !== "string" || typeof response.pairingLink !== "string" || typeof response.expiresAt !== "number") {
+    if (response.ok !== true || typeof response.gatewayUrl !== "string" || typeof response.invitation !== "string" || typeof response.expiresAt !== "number") {
       if (options?.force) throw new Error(response.error || "The local xopc enrollment host returned an invalid response");
       return void 0;
     }
     return {
       gatewayUrl: response.gatewayUrl,
-      pairingLink: response.pairingLink,
+      invitation: response.invitation,
       expiresAt: response.expiresAt
     };
   } catch (cause) {
@@ -6049,34 +6089,14 @@ function randomNonce(bytes = 24) {
 function createRefreshToken() {
   return `xopc_rt_${crypto.randomUUID()}_${randomNonce(32)}`;
 }
-function parseBrowserPairingLink(value) {
-  const url = new URL(value.trim());
-  if (url.protocol !== "https:" || url.hostname !== "link.xopc.ai" || url.pathname !== "/connect") {
-    throw new Error("Pairing link is not from xopc");
-  }
-  const encoded = new URLSearchParams(url.hash.slice(1)).get("p");
-  if (!encoded) throw new Error("Pairing link is invalid");
-  const payload = decodeJson(encoded);
-  if (payload.version !== 3 || payload.targetKind !== "browser" || !payload.gatewayId || !payload.pairingToken || !payload.gatewayPublicKey || !Array.isArray(payload.routes)) {
-    throw new Error("Pairing link version is not supported");
-  }
-  if (payload.expiresAt <= Date.now()) throw new Error("Pairing link has expired");
-  if (!payload.routes.length) throw new Error("Pairing link has no Gateway route");
-  for (const route of payload.routes) {
-    const routeUrl = new URL(route.url);
-    if (!route.id || !["http:", "https:"].includes(routeUrl.protocol)) {
-      throw new Error("Pairing link has an invalid Gateway route");
-    }
-  }
+function parseBrowserPairingInvitation(value, allowExpired = false) {
+  const encoded = readBrowserPairingInvitation(value);
+  const parsed = devicePairingInvitationPayloadSchema.safeParse(decodeJson(encoded));
+  if (!parsed.success || parsed.data.targetKind !== "browser") throw new Error("Pairing invitation version is not supported");
+  const payload = parsed.data;
+  if (!allowExpired && payload.expiresAt <= Date.now()) throw new Error("Pairing invitation has expired");
   return payload;
 }
-async function takePendingPairingLink() {
-  const stored = await chrome.storage.session.get(PENDING_PAIRING_LINK_KEY);
-  const link = stored[PENDING_PAIRING_LINK_KEY];
-  if (typeof link !== "string") return void 0;
-  await chrome.storage.session.remove(PENDING_PAIRING_LINK_KEY);
-  return link;
-}
 function openIdentityDatabase() {
   return new Promise((resolve, reject) => {
     const request = indexedDB.open(KEY_DATABASE, 1);
@@ -6153,13 +6173,18 @@ async function verifyGateway(publicKey, payload, signature) {
     return false;
   }
 }
-async function requestGatewayOriginPermission(origin) {
+function requestGatewayOriginPermissions(origins) {
+  const patterns = origins.filter((origin) => {
+    const url = new URL(origin);
+    return !(url.protocol === "http:" && ["127.0.0.1", "localhost"].includes(url.hostname));
+  }).map((origin) => `${new URL(origin).origin}/*`);
+  if (!patterns.length) return Promise.resolve(true);
+  return chrome.permissions.request({ origins: patterns });
+}
+async function hasGatewayOriginPermission(origin) {
   const url = new URL(origin);
-  const pattern = `${url.origin}/*`;
-  if (await chrome.permissions.contains({ origins: [pattern] })) return;
-  if (!await chrome.permissions.request({ origins: [pattern] })) {
-    throw new Error("Gateway site permission was not granted");
-  }
+  if (url.protocol === "http:" && ["127.0.0.1", "localhost"].includes(url.hostname)) return true;
+  return chrome.permissions.contains({ origins: [`${url.origin}/*`] });
 }
 class GatewayHttpError extends Error {
   constructor(message, status) {
@@ -6170,11 +6195,22 @@ class GatewayHttpError extends Error {
   status;
 }
 async function post(origin, path, body) {
-  const response = await fetch(`${origin}${path}`, {
-    method: "POST",
-    headers: { "Content-Type": "application/json" },
-    body: JSON.stringify(body)
-  });
+  const controller = new AbortController();
+  const timeout = setTimeout(() => controller.abort(), GATEWAY_REQUEST_TIMEOUT_MS);
+  let response;
+  try {
+    response = await fetch(`${origin}${path}`, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify(body),
+      signal: controller.signal
+    });
+  } catch (cause) {
+    if (controller.signal.aborted) throw new Error(`Gateway did not respond within ${GATEWAY_REQUEST_TIMEOUT_MS / 1e3} seconds`);
+    throw cause;
+  } finally {
+    clearTimeout(timeout);
+  }
   const json = await response.json().catch(() => ({}));
   if (!response.ok) {
     throw new GatewayHttpError(
@@ -6217,9 +6253,31 @@ async function signedPairingRequest(pair, payload, origin, requestId, action, co
   }
   return decoded;
 }
-async function refreshAccessToken(gatewayUrl, refreshToken, pair, gateway) {
-  const nextRefreshToken = createRefreshToken();
-  const requestId = crypto.randomUUID();
+function shouldTryNextRoute(cause) {
+  return !(cause instanceof GatewayHttpError) || isRetryableDevicePairingHttpStatus(cause.status);
+}
+function isRouteFailure(cause) {
+  if (cause instanceof GatewayHttpError) return isRetryableDevicePairingHttpStatus(cause.status);
+  const message = cause instanceof Error ? cause.message : String(cause);
+  return /network|fetch|respond|identity|route/i.test(message);
+}
+async function signedPairingRequestAcrossRoutes(pair, payload, origins, requestId, action, completion) {
+  let lastRouteError;
+  for (const origin of origins) {
+    try {
+      return { origin, result: await signedPairingRequest(pair, payload, origin, requestId, action, completion) };
+    } catch (cause) {
+      if (!shouldTryNextRoute(cause)) throw cause;
+      lastRouteError = cause;
+    }
+  }
+  throw lastRouteError instanceof Error ? lastRouteError : new Error("No Gateway route could be reached");
+}
+async function refreshAccessToken(gatewayUrls, refreshToken, pair, gateway, operation = {
+  requestId: crypto.randomUUID(),
+  nextRefreshToken: createRefreshToken()
+}) {
+  const { nextRefreshToken, requestId } = operation;
   const timestamp = Date.now();
   const nonce = randomNonce();
   const credentialId = refreshToken.slice("xopc_rt_".length).split("_")[0];
@@ -6230,14 +6288,30 @@ ${nonce}
 ${requestId}
 ${nextRefreshToken}`;
   const signature = await sign(pair, proof);
-  const response = await post(gatewayUrl, "/api/device-auth/refresh", {
+  const body = {
     refreshToken,
     nextRefreshToken,
     requestId,
     timestamp,
     nonce,
     signature
-  });
+  };
+  let gatewayUrl;
+  let response;
+  let lastRouteError;
+  for (const origin of gatewayUrls) {
+    try {
+      response = await post(origin, "/api/device-auth/refresh", body);
+      gatewayUrl = origin;
+      break;
+    } catch (cause) {
+      if (!shouldTryNextRoute(cause)) throw cause;
+      lastRouteError = cause;
+    }
+  }
+  if (!response || !gatewayUrl) {
+    throw lastRouteError instanceof Error ? lastRouteError : new Error("No Gateway route could be reached");
+  }
   if (typeof response.signedPayload !== "string" || typeof response.signature !== "string" || !await verifyGateway(gateway.gatewayPublicKey, response.signedPayload, response.signature)) throw new Error("Gateway identity could not be verified");
   const responseProof = decodeJson(response.signedPayload);
   if (responseProof.purpose !== "device-refresh-v3" || responseProof.gatewayId !== gateway.gatewayId || responseProof.requestId !== requestId || responseProof.nonce !== nonce || !(responseProof.expiresAt > Date.now()) || responseProof.expiresAt > Date.now() + 6e4) throw new Error("Gateway refresh response does not match this request");
@@ -6245,68 +6319,154 @@ ${nextRefreshToken}`;
   if (!payload?.accessToken || !payload.accessTokenExpiresAt || payload.refreshToken !== nextRefreshToken) {
     throw new Error("Gateway returned invalid browser credentials");
   }
-  return payload;
+  return { ...payload, gatewayUrl };
 }
 function wait(milliseconds) {
   return new Promise((resolve) => setTimeout(resolve, milliseconds));
 }
-async function pairGateway(link, onApproval) {
-  const payload = parseBrowserPairingLink(link);
+async function pairGateway(invitation, onApproval, requestedOrigin) {
+  const payload = parseBrowserPairingInvitation(invitation, true);
+  const origins = [...new Set(payload.routes.map((route) => new URL(route.url).origin))];
+  const selectedOrigin = requestedOrigin && origins.includes(requestedOrigin) ? requestedOrigin : origins[0];
+  const permissionTask = requestGatewayOriginPermissions([selectedOrigin]);
+  if (!await permissionTask) throw new Error("Gateway site permission was not granted");
+  const permittedOrigins = (await Promise.all(origins.map(async (origin) => ({
+    origin,
+    permitted: await hasGatewayOriginPermission(origin)
+  })))).filter((candidate) => candidate.permitted).map((candidate) => candidate.origin);
   const pair = await getOrCreateKeyPair();
-  const requestId = crypto.randomUUID();
-  const initialRefreshToken = createRefreshToken();
-  let origin;
-  let result;
-  let lastRouteError;
-  for (const candidate of [...new Set(payload.routes.map((route) => new URL(route.url).origin))]) {
-    await requestGatewayOriginPermission(candidate);
-    try {
-      result = await signedPairingRequest(pair, payload, candidate, requestId, "request");
-      origin = candidate;
-      break;
-    } catch (cause) {
-      if (cause instanceof GatewayHttpError && cause.status < 500 && ![404, 408, 425, 429].includes(cause.status)) {
-        throw cause;
-      }
-      lastRouteError = cause;
-    }
+  const stored = await chrome.storage.local.get(PAIRING_JOURNAL_KEY);
+  let journal = stored[PAIRING_JOURNAL_KEY];
+  if (journal && journal.payload.pairingToken !== payload.pairingToken) {
+    throw new Error("PAIRING_ALREADY_PENDING");
   }
-  if (!origin || !result) {
-    throw lastRouteError instanceof Error ? lastRouteError : new Error("No Gateway route could be reached");
-  }
-  if (result.request.status === "pending") onApproval(result.request.confirmationCode);
-  while (result.request.status === "pending") {
-    await wait(1500);
-    result = await signedPairingRequest(pair, payload, origin, requestId, "status");
+  if (!journal) {
+    if (payload.expiresAt <= Date.now()) throw new Error("Pairing invitation has expired");
+    journal = {
+      invitation: invitation.trim(),
+      payload,
+      requestId: crypto.randomUUID(),
+      idempotencyKey: crypto.randomUUID(),
+      initialRefreshToken: createRefreshToken()
+    };
+    await chrome.storage.local.set({ [PAIRING_JOURNAL_KEY]: journal });
   }
-  if (result.request.status !== "approved" && result.request.status !== "completed") {
-    throw new Error(`Pairing ${result.request.status}`);
+  delete journal.nextOrigin;
+  await chrome.storage.local.set({ [PAIRING_JOURNAL_KEY]: journal });
+  const requestId = journal.requestId;
+  const availableOrigins = journal.origin && permittedOrigins.includes(journal.origin) ? [journal.origin, ...permittedOrigins.filter((candidate) => candidate !== journal.origin)] : [selectedOrigin, ...permittedOrigins.filter((candidate) => candidate !== selectedOrigin)];
+  try {
+    let { origin, result } = await signedPairingRequestAcrossRoutes(
+      pair,
+      journal.payload,
+      availableOrigins,
+      requestId,
+      "request"
+    );
+    journal.origin = origin;
+    await chrome.storage.local.set({ [PAIRING_JOURNAL_KEY]: journal });
+    if (result.request.status === "pending") onApproval(result.request.confirmationCode);
+    while (result.request.status === "pending") {
+      await wait(1500);
+      const response = await signedPairingRequestAcrossRoutes(
+        pair,
+        journal.payload,
+        [origin, ...permittedOrigins.filter((candidate) => candidate !== origin)],
+        requestId,
+        "status"
+      );
+      ({ origin, result } = response);
+      journal.origin = origin;
+      await chrome.storage.local.set({ [PAIRING_JOURNAL_KEY]: journal });
+    }
+    if (result.request.status !== "approved" && result.request.status !== "completed") {
+      await chrome.storage.local.remove(PAIRING_JOURNAL_KEY);
+      throw new Error(`Pairing ${result.request.status}`);
+    }
+    if (result.request.status !== "completed") {
+      const response = await signedPairingRequestAcrossRoutes(
+        pair,
+        journal.payload,
+        [origin, ...permittedOrigins.filter((candidate) => candidate !== origin)],
+        requestId,
+        "complete",
+        {
+          idempotencyKey: journal.idempotencyKey,
+          initialRefreshToken: journal.initialRefreshToken
+        }
+      );
+      ({ origin, result } = response);
+    }
+    if (!result.request.deviceId) throw new Error("Gateway did not register the browser");
+    journal.origin = origin;
+    journal.completed = { deviceId: result.request.deviceId, gatewayName: result.gateway.name };
+    journal.refresh ??= { requestId: crypto.randomUUID(), nextRefreshToken: createRefreshToken() };
+    await chrome.storage.local.set({ [PAIRING_JOURNAL_KEY]: journal });
+    const orderedOrigins = [origin, ...permittedOrigins.filter((candidate) => candidate !== origin)];
+    const tokens = await refreshAccessToken(
+      orderedOrigins,
+      journal.initialRefreshToken,
+      pair,
+      journal.payload,
+      journal.refresh
+    );
+    const profile = {
+      gatewayId: journal.payload.gatewayId,
+      gatewayName: journal.completed.gatewayName,
+      gatewayUrl: tokens.gatewayUrl,
+      gatewayUrls: [tokens.gatewayUrl, ...orderedOrigins.filter((candidate) => candidate !== tokens.gatewayUrl)],
+      gatewayPublicKey: journal.payload.gatewayPublicKey,
+      deviceId: journal.completed.deviceId,
+      refreshToken: tokens.refreshToken,
+      accessToken: tokens.accessToken,
+      accessTokenExpiresAt: tokens.accessTokenExpiresAt
+    };
+    await chrome.storage.local.set({ [PROFILE_KEY]: profile });
+    await chrome.storage.local.remove(PAIRING_JOURNAL_KEY);
+    return profile;
+  } catch (cause) {
+    const nextOrigin = origins.find((origin) => !permittedOrigins.includes(origin));
+    if (nextOrigin && isRouteFailure(cause)) {
+      journal.nextOrigin = nextOrigin;
+      await chrome.storage.local.set({ [PAIRING_JOURNAL_KEY]: journal });
+      throw new Error(`PAIRING_ROUTE_PERMISSION_REQUIRED:${nextOrigin}`);
+    }
+    throw cause;
   }
-  if (result.request.status !== "completed") {
-    result = await signedPairingRequest(pair, payload, origin, requestId, "complete", {
-      idempotencyKey: crypto.randomUUID(),
-      initialRefreshToken
-    });
+}
+async function readPendingBrowserPairing() {
+  const stored = await chrome.storage.local.get(PAIRING_JOURNAL_KEY);
+  const journal = stored[PAIRING_JOURNAL_KEY];
+  return journal ? { invitation: journal.invitation, ...journal.nextOrigin ? { nextOrigin: journal.nextOrigin } : {} } : void 0;
+}
+async function cancelPendingBrowserPairing() {
+  const stored = await chrome.storage.local.get(PAIRING_JOURNAL_KEY);
+  const journal = stored[PAIRING_JOURNAL_KEY];
+  if (!journal) return;
+  const origins = [...new Set(journal.payload.routes.map((route) => new URL(route.url).origin))];
+  const permittedOrigins = (await Promise.all(origins.map(async (origin) => ({
+    origin,
+    permitted: await hasGatewayOriginPermission(origin)
+  })))).filter((candidate) => candidate.permitted).map((candidate) => candidate.origin);
+  try {
+    await signedPairingRequestAcrossRoutes(
+      await getOrCreateKeyPair(),
+      journal.payload,
+      journal.origin && permittedOrigins.includes(journal.origin) ? [journal.origin, ...permittedOrigins.filter((candidate) => candidate !== journal.origin)] : permittedOrigins,
+      journal.requestId,
+      "cancel"
+    );
+  } catch (cause) {
+    if (!(cause instanceof GatewayHttpError) || !["PAIRING_NOT_FOUND", "PAIRING_EXPIRED", "PAIRING_CANCELLED"].includes(cause.message)) throw cause;
   }
-  if (!result.request.deviceId) throw new Error("Gateway did not register the browser");
-  const tokens = await refreshAccessToken(origin, initialRefreshToken, pair, payload);
-  const profile = {
-    gatewayId: payload.gatewayId,
-    gatewayName: result.gateway.name,
-    gatewayUrl: origin,
-    gatewayPublicKey: payload.gatewayPublicKey,
-    deviceId: result.request.deviceId,
-    refreshToken: tokens.refreshToken,
-    accessToken: tokens.accessToken,
-    accessTokenExpiresAt: tokens.accessTokenExpiresAt
-  };
-  await chrome.storage.local.set({ [PROFILE_KEY]: profile });
-  return profile;
+  await chrome.storage.local.remove(PAIRING_JOURNAL_KEY);
 }
 async function readProfile() {
-  const stored = await chrome.storage.local.get(PROFILE_KEY);
+  const stored = await chrome.storage.local.get([PROFILE_KEY, PAIRING_JOURNAL_KEY]);
   const profile = stored[PROFILE_KEY];
-  return profile?.gatewayId && profile.gatewayUrl && profile.refreshToken ? profile : void 0;
+  if (!profile?.gatewayId || !profile.gatewayUrl || !profile.refreshToken) return void 0;
+  if (stored[PAIRING_JOURNAL_KEY]) await chrome.storage.local.remove(PAIRING_JOURNAL_KEY);
+  return profile;
 }
 async function getAccessProfile() {
   const profile = await readProfile();
@@ -6314,8 +6474,13 @@ async function getAccessProfile() {
   if (profile.accessTokenExpiresAt > Date.now() + 3e4) return profile;
   if (refreshTask) return refreshTask;
   refreshTask = (async () => {
-    const tokens = await refreshAccessToken(profile.gatewayUrl, profile.refreshToken, await getOrCreateKeyPair(), profile);
-    const next = { ...profile, ...tokens };
+    const gatewayUrls = profile.gatewayUrls?.length ? profile.gatewayUrls : [profile.gatewayUrl];
+    const tokens = await refreshAccessToken(gatewayUrls, profile.refreshToken, await getOrCreateKeyPair(), profile);
+    const next = {
+      ...profile,
+      ...tokens,
+      gatewayUrls: [tokens.gatewayUrl, ...gatewayUrls.filter((candidate) => candidate !== tokens.gatewayUrl)]
+    };
     await chrome.storage.local.set({ [PROFILE_KEY]: next });
     return next;
   })();
@@ -6380,7 +6545,7 @@ async function createBrowserEndpointHello(tools = []) {
   };
 }
 async function forgetProfile() {
-  await chrome.storage.local.remove(PROFILE_KEY);
+  await chrome.storage.local.remove([PROFILE_KEY, PAIRING_JOURNAL_KEY]);
 }
 async function revokeAndForgetProfile() {
   try {
@@ -6403,4 +6568,4 @@ async function revokeAndForgetProfile() {
   }
 }
 
-export { ENDPOINT_PROTOCOL_VERSION as E, PENDING_CONTEXT_KEY as P, RealtimeClient as R, TAB_BINDING_PREFIX as T, PENDING_PAIRING_LINK_KEY as a, activeTabId as b, canonicalJson as c, captureTabWithPermission as d, createBrowserEndpointHello as e, currentTabDescriptor as f, deleteBrowserOutbox as g, discoverLocalGateway as h, endpointToolContentSchema as i, gatewayFetch as j, getAccessProfile as k, parseBrowserPairingLink as l, readProfile as m, registerBrowserEndpoint as n, revokeAndForgetProfile as o, pairGateway as p, runWithTabSiteAccess as q, readBrowserOutbox as r, setAutoConnectEnabled as s, takePendingPairingLink as t, writeBrowserOutbox as w };
+export { ENDPOINT_PROTOCOL_VERSION as E, PENDING_CONTEXT_KEY as P, RealtimeClient as R, TAB_BINDING_PREFIX as T, activeTabId as a, canonicalJson as b, cancelPendingBrowserPairing as c, captureTabWithPermission as d, createBrowserEndpointHello as e, currentTabDescriptor as f, deleteBrowserOutbox as g, discoverLocalGateway as h, endpointToolContentSchema as i, gatewayFetch as j, getAccessProfile as k, readPendingBrowserPairing as l, readProfile as m, registerBrowserEndpoint as n, revokeAndForgetProfile as o, pairGateway as p, runWithTabSiteAccess as q, readBrowserOutbox as r, setAutoConnectEnabled as s, writeBrowserOutbox as w };

package/dist/browser-ext/dist/background.js

@@ -1,4 +1,4 @@
-import { i as endpointToolContentSchema, E as ENDPOINT_PROTOCOL_VERSION, c as canonicalJson, T as TAB_BINDING_PREFIX, d as captureTabWithPermission, P as PENDING_CONTEXT_KEY, l as parseBrowserPairingLink, a as PENDING_PAIRING_LINK_KEY, m as readProfile, n as registerBrowserEndpoint, k as getAccessProfile, R as RealtimeClient, e as createBrowserEndpointHello, j as gatewayFetch } from './assets/auth-C1QI-uMG.js';
+import { i as endpointToolContentSchema, E as ENDPOINT_PROTOCOL_VERSION, b as canonicalJson, T as TAB_BINDING_PREFIX, d as captureTabWithPermission, P as PENDING_CONTEXT_KEY, m as readProfile, n as registerBrowserEndpoint, k as getAccessProfile, R as RealtimeClient, e as createBrowserEndpointHello, j as gatewayFetch } from './assets/auth-O8RiOF3l.js';
 
 const BROWSER_EXTENSION_PROTOCOL_VERSION = 4;
 const BROWSER_CONTROL_ENDPOINT_TOOL_NAME = "browser.control";
@@ -1253,22 +1253,6 @@ function connectWithLogging() {
     if (generation !== connectionGeneration && !realtime) connectWithLogging();
   });
 }
-async function stagePairingInvite(message, sender) {
-  if (typeof message.pairingLink !== "string" || !sender.url || !sender.tab?.id) {
-    throw new Error("Pairing handoff is missing its source tab");
-  }
-  const source = new URL(sender.url);
-  const invitation = new URL(message.pairingLink);
-  if (source.href !== invitation.href || source.protocol !== "https:" || source.hostname !== "link.xopc.ai" || source.pathname !== "/connect") {
-    throw new Error("Pairing handoff source is not trusted");
-  }
-  parseBrowserPairingLink(invitation.href);
-  const tasks = [
-    chrome.storage.session.set({ [PENDING_PAIRING_LINK_KEY]: invitation.href })
-  ];
-  if (message.open) tasks.push(chrome.sidePanel.open({ tabId: sender.tab.id }));
-  await Promise.all(tasks);
-}
 chrome.runtime.onMessage.addListener((message, sender, sendResponse) => {
   if (message.type === "browser/get-status") {
     sendResponse({ connected: Boolean(endpointClaim), transport: "gateway-realtime", error: lastConnectionError });
@@ -1278,11 +1262,6 @@ chrome.runtime.onMessage.addListener((message, sender, sendResponse) => {
     disconnect();
     connectWithLogging();
     sendResponse({ ok: true });
-  } else if (message.type === "browser/stage-pairing-invite") {
-    void stagePairingInvite(message, sender).then(() => sendResponse({ ok: true })).catch((cause) => sendResponse({
-      ok: false,
-      error: cause instanceof Error ? cause.message : String(cause)
-    }));
   } else {
     sendResponse({ ok: false, error: `Unknown message: ${message.type}` });
   }

package/dist/browser-ext/dist/sidepanel.html

@@ -5,7 +5,7 @@
     <meta name="viewport" content="width=device-width, initial-scale=1.0" />
     <title>xopc</title>
     <script type="module" crossorigin src="./sidepanel.js"></script>
-    <link rel="modulepreload" crossorigin href="./assets/auth-C1QI-uMG.js">
+    <link rel="modulepreload" crossorigin href="./assets/auth-O8RiOF3l.js">
     <link rel="stylesheet" crossorigin href="./assets/sidepanel-C86O7q5Y.css">
   </head>
   <body>