@xopcai/xopc 0.0.272 → 0.0.274

package/dist/src/browser/native-messaging-host.js

@@ -1,4 +1,5 @@
 import { closeXopcDatabase, openXopcDatabase } from "../storage/sqlite/connection.js";
+import { devicePairingInvitationPayloadSchema, formatBrowserPairingInvitation } from "../../packages/gateway-contract/src/device-pairing.js";
 import { getGatewayIdentityPublicKeyRaw, getOrCreateGatewayIdentity } from "../storage/sqlite/gateway-identity-repository.js";
 import { createDevicePairingSetup } from "../storage/sqlite/device-pairing-repository.js";
 import { init_loader, loadConfig } from "../config/loader.js";
@@ -49,7 +50,7 @@ function createBrowserNativeBootstrap(configPath, request) {
 		return {
 			ok: true,
 			gatewayUrl,
-			pairingLink: `https://link.xopc.ai/connect#p=${Buffer.from(JSON.stringify({
+			invitation: formatBrowserPairingInvitation(Buffer.from(JSON.stringify(devicePairingInvitationPayloadSchema.parse({
 				version: 3,
 				pairingToken: setup.token,
 				gatewayId: identity.id,
@@ -58,7 +59,7 @@ function createBrowserNativeBootstrap(configPath, request) {
 				routes: [route],
 				targetKind: setup.targetKind,
 				expiresAt: setup.expiresAt
-			})).toString("base64url")}`,
+			}))).toString("base64url")),
 			expiresAt: setup.expiresAt
 		};
 	} finally {

package/dist/src/browser/providers/browser-ext-install.d.ts

@@ -33,6 +33,10 @@ export interface EnsureBrowserExtResult {
     xopcVersion: string;
     copied: boolean;
 }
+export interface BrowserExtensionArchive {
+    filename: string;
+    data: Buffer;
+}
 export interface BrowserNativeHostInstallResult {
     installed: boolean;
     manifestPaths: string[];
@@ -50,6 +54,8 @@ export declare function resolveBundledBrowserExtDir(): Promise<{
     dir: string;
     bundledFrom: BrowserExtBundledFrom;
 } | null>;
+/** Build a portable archive for installing the bundled extension on another computer. */
+export declare function createBrowserExtensionArchive(): Promise<BrowserExtensionArchive>;
 export declare function computeNeedsRefresh(params: {
     force?: boolean;
     bundledManifestVersion: string;

package/dist/src/browser/providers/browser-ext-install.js

@@ -14,6 +14,7 @@ import { fileURLToPath } from "node:url";
 import { spawn } from "node:child_process";
 import { createHash } from "node:crypto";
 import { readFile, readdir, rm } from "node:fs/promises";
+import AdmZip from "adm-zip";
 //#region src/browser/providers/browser-ext-install.ts
 /**
 * Install bundled Chrome extension artifacts into {resolveBinDir()}/browser-ext/.
@@ -134,6 +135,20 @@ async function resolveBundledBrowserExtDir() {
 	}
 	return null;
 }
+/** Build a portable archive for installing the bundled extension on another computer. */
+async function createBrowserExtensionArchive() {
+	const bundled = await resolveBundledBrowserExtDir();
+	if (!bundled) throw new Error("Bundled browser extension not found. Reinstall or rebuild xopc.");
+	const root = "xopc-browser-extension";
+	const zip = new AdmZip();
+	zip.addLocalFile(join(bundled.dir, "manifest.json"), root);
+	zip.addLocalFolder(join(bundled.dir, "dist"), `${root}/dist`);
+	zip.addLocalFolder(join(bundled.dir, "icons"), `${root}/icons`);
+	return {
+		filename: `xopc-browser-extension-${PACKAGE_VERSION}.zip`,
+		data: zip.toBuffer()
+	};
+}
 function computeNeedsRefresh(params) {
 	if (params.force) return true;
 	if (!params.installedPath || !validateBrowserExtLayout(params.installedPath)) return true;
@@ -471,4 +486,4 @@ async function openBrowserExtensionInstallUi(opts) {
 	};
 }
 //#endregion
-export { BROWSER_EXT_REQUIRED_FILES, browserExtContentHash, browserExtDoctor, browserNativeHostDoctor, browserNativeManifestDirectories, computeNeedsRefresh, ensureBrowserExtensionArtifacts, ensureBrowserExtensionOnStartup, installBrowserNativeMessagingHost, openBrowserExtensionInstallUi, readInstalledExtensionDir, resolveBundledBrowserExtDir, resolveInstalledExtensionPath, resolveWindowsExtensionManager, validateBrowserExtLayout };
+export { BROWSER_EXT_REQUIRED_FILES, browserExtContentHash, browserExtDoctor, browserNativeHostDoctor, browserNativeManifestDirectories, computeNeedsRefresh, createBrowserExtensionArchive, ensureBrowserExtensionArtifacts, ensureBrowserExtensionOnStartup, installBrowserNativeMessagingHost, openBrowserExtensionInstallUi, readInstalledExtensionDir, resolveBundledBrowserExtDir, resolveInstalledExtensionPath, resolveWindowsExtensionManager, validateBrowserExtLayout };

package/dist/src/cli/commands/gateway/run-foreground.js

@@ -69,10 +69,13 @@ async function runGatewayFromCliOptions(options, ctx) {
 	const { resolveGatewayAuth, assertGatewayAuthConfigured } = await import("../../../gateway/auth.js");
 	const { assertGatewayRuntimeConfig } = await import("../../../gateway/runtime-config.js");
 	let auth = resolveGatewayAuth({ authConfig: effectiveConfig.gateway?.auth });
-	if (typeof options.token === "string" && options.token.trim().length > 0) auth = {
-		mode: "token",
-		token: options.token.trim()
-	};
+	if (typeof options.token === "string" && options.token.trim().length > 0) {
+		auth = {
+			mode: "token",
+			token: options.token.trim()
+		};
+		process.env.XOPC_GATEWAY_TOKEN = auth.token;
+	}
 	try {
 		assertGatewayAuthConfigured(auth);
 		assertGatewayRuntimeConfig({
@@ -126,7 +129,7 @@ async function runGatewayFromCliOptions(options, ctx) {
 			});
 			await server.start();
 			const displayHost = bindHost === "0.0.0.0" ? "localhost" : bindHost;
-			const token = options.token || config?.gateway?.auth?.token;
+			const token = auth.mode === "token" ? auth.token : void 0;
 			console.log("✅ Gateway started");
 			console.log(`   URL: http://${displayHost}:${port}`);
 			if (token) console.log(`   Token: ${token.slice(0, 8)}...${token.slice(-8)}`);

package/dist/src/cli/commands/gateway/service.js

@@ -9,8 +9,9 @@ init_paths();
 * Create service install subcommand - actually installs the OS service
 */
 function createInstallCommand() {
-	return new Command("install").description("Install gateway as OS service (LaunchAgent / systemd / Task)").option("--port <port>", "Gateway port").option("--token <token>", "Gateway auth token").option("--force", "Force reinstall if already installed").option("--json", "Output JSON").action(async (options) => {
+	return new Command("install").description("Install gateway as OS service (LaunchAgent / systemd / Task)").option("--port <port>", "Gateway port").option("--token <token>", "Gateway auth token").option("--force", "Force reinstall if already installed").option("--json", "Output JSON").action(async (options, command) => {
 		const configPath = getContextWithOpts().configPath || resolveConfigPath();
+		const force = options.force === true || command.optsWithGlobals().force === true;
 		const [{ loadConfig }, { resolveGatewayService, isDaemonAvailableAsync, getPlatformName }, { buildGatewayInstallArgs }] = await Promise.all([
 			import("../../../config/index.js"),
 			import("../../../daemon/service.js"),
@@ -30,7 +31,7 @@ function createInstallCommand() {
 		}
 		const service = await resolveGatewayService();
 		const loaded = await service.isLoaded({ env: process.env });
-		if (loaded && !options.force) {
+		if (loaded && !force) {
 			if (options.json) console.log(JSON.stringify({
 				ok: true,
 				result: "already-installed"
@@ -38,7 +39,7 @@ function createInstallCommand() {
 			else console.log("ℹ️  Service already installed. Use --force to reinstall.");
 			return;
 		}
-		if (loaded && options.force) try {
+		if (loaded && force) try {
 			await service.uninstall({ env: process.env });
 		} catch {}
 		const installArgs = buildGatewayInstallArgs({

package/dist/src/cli/commands/gateway/token.js

@@ -4,6 +4,17 @@ import crypto from "crypto";
 import { Command } from "commander";
 //#region src/cli/commands/gateway/token.ts
 init_paths();
+async function readInstalledServiceToken() {
+	try {
+		const { isDaemonAvailableAsync, resolveGatewayService } = await import("../../../daemon/service.js");
+		if (!await isDaemonAvailableAsync()) return void 0;
+		const service = await resolveGatewayService();
+		if (!await service.isLoaded({ env: process.env })) return void 0;
+		return (await service.readCommand(process.env))?.environment?.XOPC_GATEWAY_TOKEN?.trim() || void 0;
+	} catch {
+		return;
+	}
+}
 /**
 * Create the token subcommand for managing gateway authentication token.
 */
@@ -14,6 +25,7 @@ function createTokenCommand() {
 		const log = createLogger("GatewayTokenCommand");
 		try {
 			const config = loadConfig(configPath);
+			const installedServiceToken = await readInstalledServiceToken();
 			if (options.generate) {
 				const newToken = crypto.randomBytes(24).toString("hex");
 				config.gateway = config.gateway || {};
@@ -31,9 +43,16 @@ function createTokenCommand() {
 				console.log("");
 				console.log("Or set environment variable:");
 				console.log(`   export XOPC_GATEWAY_TOKEN=${newToken}`);
+				if (installedServiceToken && installedServiceToken !== newToken) {
+					console.log("");
+					console.log("⚠️  The installed gateway service still uses its previous token.");
+					console.log("   Run `xopc gateway service install --force`, then restart the service.");
+				}
 				process.exit(0);
 			} else {
-				const currentToken = config.gateway?.auth?.token;
+				const configToken = config.gateway?.auth?.token?.trim();
+				const environmentToken = process.env.XOPC_GATEWAY_TOKEN?.trim();
+				const currentToken = installedServiceToken || environmentToken || configToken;
 				if ((config.gateway?.auth?.mode || "token") === "none") {
 					console.log("⚠️  Gateway authentication is disabled (mode: none)");
 					console.log("");
@@ -46,6 +65,14 @@ function createTokenCommand() {
 					console.log(`   ${currentToken}`);
 					console.log("");
 					console.log(`Preview: ${tokenPreview}`);
+					if (installedServiceToken) console.log("Source: installed gateway service");
+					else if (environmentToken) console.log("Source: XOPC_GATEWAY_TOKEN");
+					else console.log(`Source: ${configPath}`);
+					if (installedServiceToken && configToken && installedServiceToken !== configToken) {
+						console.log("");
+						console.log("⚠️  Token drift detected: the installed service token overrides the config token.");
+						console.log("   Run `xopc gateway service install --force`, then restart the service to sync.");
+					}
 					console.log("");
 					console.log("Usage:");
 					console.log(`   xopc gateway --token ${currentToken}`);

package/dist/src/gateway/device-routes.js

@@ -19,9 +19,6 @@ function routeId(kind, url) {
 function resolveSecureDeviceRoutes(config) {
 	const tunnelStatus = getTunnelService().getStatus();
 	const candidates = [{
-		kind: "custom-https",
-		url: secureUrl(resolveReverseProxyPublicUrl(config))
-	}, {
 		kind: "xopc-secure-link",
 		url: tunnelStatus.state === "connected" ? secureUrl(tunnelStatus.publicUrl) : null
 	}];
@@ -30,6 +27,10 @@ function resolveSecureDeviceRoutes(config) {
 		kind: "tailscale",
 		url: secureUrl(`https://${tailscale.hostname}`)
 	});
+	candidates.push({
+		kind: "custom-https",
+		url: secureUrl(resolveReverseProxyPublicUrl(config))
+	});
 	const seen = /* @__PURE__ */ new Set();
 	const routes = [];
 	for (const candidate of candidates) {

package/dist/src/gateway/hono/app.js

@@ -5,8 +5,8 @@ import { resolveAllowedBrowserOrigins, resolveGatewayServiceListenPort } from ".
 import { resolveGatewayEffectiveHost } from "../../config/gateway-bind.js";
 import { loadTunnelState } from "../../tunnel/tunnel-state.js";
 import { resolveReverseProxyPublicUrl } from "../public-url.js";
-import { BROWSER_EXTENSION_ID } from "../../browser/extension-identity.js";
 import { maxSessionInputRequestBodyBytes } from "../chat-limits.js";
+import { BROWSER_EXTENSION_ID } from "../../browser/extension-identity.js";
 import { isLoopbackIpAddress, isTrustedProxyAddress } from "../client-ip.js";
 import { buildGatewayConsoleCspHeader } from "../security/csp.js";
 import { checkBrowserOrigin, isChromeExtensionOrigin } from "../security/origin-check.js";
@@ -217,7 +217,10 @@ function createHonoApp(config) {
 	});
 	registerPublicGatewayRoutes(app, service);
 	registerPublicHtmlPreviewRoute(app);
-	registerDeviceAuthPublicRoutes(app);
+	registerDeviceAuthPublicRoutes(app, { getTrustedProxyContext: () => ({
+		trustedProxies: service.currentConfig.gateway?.trustedProxies,
+		allowRealIpFallback: service.currentConfig.gateway?.allowRealIpFallback === true
+	}) });
 	registerPublicExtensionAssetRoutes(app, service);
 	registerPublicLocalAppPreviewRoutes(app, service);
 	const authenticated = new Hono();

package/dist/src/gateway/hono/routes/agent-stream.js

@@ -1,5 +1,5 @@
-import { parseTurnContextRefs } from "../../../agent/source-context/types.js";
 import { validateWebchatAttachments, validateWebchatContent } from "../../chat-limits.js";
+import { parseTurnContextRefs } from "../../../agent/source-context/types.js";
 import { replaceLatestSessionTurn, submitSessionInput } from "./session-input-handler.js";
 //#region src/gateway/hono/routes/agent-stream.ts
 function registerAgentStreamRoutes(authenticated, deps) {

package/dist/src/gateway/hono/routes/browser.js

@@ -49,6 +49,10 @@ function isLocalOwnerRequest(c, service) {
 		return false;
 	}
 }
+function isOwnerRequest(c) {
+	const principal = getGatewayPrincipal(c);
+	return principal.kind === "owner" || principal.kind === "trusted-proxy";
+}
 function chromeDevicePrincipal(c) {
 	const principal = getGatewayPrincipal(c);
 	if (principal.kind !== "device" || !principal.deviceId) return void 0;
@@ -235,6 +239,28 @@ function registerBrowserRoutes(authenticated, deps) {
 			}, 500);
 		}
 	});
+	authenticated.get("/api/browser/extension/archive", strictRateLimitMiddleware, async (c) => {
+		if (!isOwnerRequest(c)) return c.json({
+			ok: false,
+			error: "Owner access required."
+		}, 403);
+		try {
+			const { createBrowserExtensionArchive } = await import("../../../browser/providers/browser-ext-install.js");
+			const archive = await createBrowserExtensionArchive();
+			const body = new Uint8Array(archive.data.byteLength);
+			body.set(archive.data);
+			return c.body(body, 200, {
+				"Content-Type": "application/zip",
+				"Content-Disposition": `attachment; filename="${archive.filename}"`,
+				"Cache-Control": "private, no-store"
+			});
+		} catch (error) {
+			return c.json({
+				ok: false,
+				error: error instanceof Error ? error.message : String(error)
+			}, 500);
+		}
+	});
 	authenticated.post("/api/browser/extension/open", strictRateLimitMiddleware, async (c) => {
 		if (!isLocalOwnerRequest(c, service)) return c.json({
 			ok: false,

package/dist/src/gateway/hono/routes/device-pairing-approval.d.ts

@@ -1,3 +1,10 @@
-import type { Hono } from 'hono';
-export declare function registerPairingApprovalPublicRoutes(app: Hono): void;
+import type { Context, Hono } from 'hono';
+export type PairingPublicRouteOptions = {
+    getTrustedProxyContext?: () => {
+        trustedProxies?: string[];
+        allowRealIpFallback?: boolean;
+    };
+};
+export declare function pairingClientKey(c: Context, options?: PairingPublicRouteOptions): string;
+export declare function registerPairingApprovalPublicRoutes(app: Hono, options?: PairingPublicRouteOptions): void;
 export declare function registerPairingApprovalAdminRoutes(app: Hono): void;

package/dist/src/gateway/hono/routes/device-pairing-approval.js

@@ -1,9 +1,41 @@
 import { devicePairingCompleteSchema, devicePairingProofSchema, devicePairingRequestSchema } from "../../../../packages/gateway-contract/src/device-pairing.js";
 import { getOrCreateGatewayIdentity, signGatewayPayload } from "../../../storage/sqlite/gateway-identity-repository.js";
+import { resolveClientIpFromRequest } from "../../client-ip.js";
+import { buckets } from "../../rate-limit/buckets.js";
+import "../../rate-limit/index.js";
 import { DevicePairingError, cancelDevicePairingSetup, decideDevicePairingRequest, operateDevicePairingRequest, readDevicePairingSetup, submitDevicePairingRequest } from "../../../storage/sqlite/device-pairing-approval.js";
 import os from "node:os";
 import { z } from "zod";
+import { bodyLimit } from "hono/body-limit";
+import { getConnInfo } from "@hono/node-server/conninfo";
 //#region src/gateway/hono/routes/device-pairing-approval.ts
+function pairingClientKey(c, options) {
+	let remoteAddress;
+	try {
+		remoteAddress = getConnInfo(c).remote.address;
+	} catch {
+		remoteAddress = void 0;
+	}
+	const proxy = options?.getTrustedProxyContext?.();
+	return resolveClientIpFromRequest({
+		remoteAddress,
+		getHeader: (name) => c.req.header(name),
+		trustedProxies: proxy?.trustedProxies,
+		allowRealIpFallback: proxy?.allowRealIpFallback
+	});
+}
+function pairingBlocked(c, key) {
+	const blocked = buckets.pairingExchange().check(key);
+	if (!blocked.blocked) return void 0;
+	c.header("Retry-After", String(blocked.retryAfterSec));
+	return c.json({
+		ok: false,
+		error: {
+			code: "PAIRING_RATE_LIMITED",
+			message: "Too many failed pairing attempts"
+		}
+	}, 429);
+}
 function pairingError(c, error) {
 	if (error instanceof DevicePairingError) return c.json({
 		ok: false,
@@ -20,7 +52,7 @@ function pairingError(c, error) {
 		}
 	}, 500);
 }
-function registerPairingApprovalPublicRoutes(app) {
+function registerPairingApprovalPublicRoutes(app, options) {
 	for (const action of [
 		"request",
 		"status",
@@ -28,15 +60,21 @@ function registerPairingApprovalPublicRoutes(app) {
 		"cancel"
 	]) {
 		const path = action === "request" ? "/api/device-pairing/requests" : `/api/device-pairing/requests/:id/${action}`;
-		app.post(path, async (c) => {
+		app.post(path, bodyLimit({ maxSize: 4 * 1024 }), async (c) => {
+			const clientKey = pairingClientKey(c, options);
+			const blocked = pairingBlocked(c, clientKey);
+			if (blocked) return blocked;
 			const parsed = (action === "request" ? devicePairingRequestSchema : action === "complete" ? devicePairingCompleteSchema : devicePairingProofSchema).safeParse(await c.req.json().catch(() => null));
-			if (!parsed.success || action !== "request" && parsed.data.requestId !== c.req.param("id")) return c.json({
-				ok: false,
-				error: {
-					code: "BAD_REQUEST",
-					message: "Invalid pairing request"
-				}
-			}, 400);
+			if (!parsed.success || action !== "request" && parsed.data.requestId !== c.req.param("id")) {
+				buckets.pairingExchange().fail(clientKey);
+				return c.json({
+					ok: false,
+					error: {
+						code: "BAD_REQUEST",
+						message: "Invalid pairing request"
+					}
+				}, 400);
+			}
 			try {
 				const result = action === "request" ? { request: submitDevicePairingRequest(parsed.data) } : operateDevicePairingRequest(action, parsed.data);
 				const signedPayload = Buffer.from(JSON.stringify({
@@ -48,12 +86,14 @@ function registerPairingApprovalPublicRoutes(app) {
 					nonce: parsed.data.nonce,
 					issuedAt: Date.now()
 				})).toString("base64url");
+				buckets.pairingExchange().succeed(clientKey);
 				return c.json({
 					ok: true,
 					signedPayload,
 					signature: signGatewayPayload(signedPayload)
 				});
 			} catch (error) {
+				buckets.pairingExchange().fail(clientKey);
 				return pairingError(c, error);
 			}
 		});
@@ -97,4 +137,4 @@ function registerPairingApprovalAdminRoutes(app) {
 	});
 }
 //#endregion
-export { registerPairingApprovalAdminRoutes, registerPairingApprovalPublicRoutes };
+export { pairingClientKey, registerPairingApprovalAdminRoutes, registerPairingApprovalPublicRoutes };

package/dist/src/gateway/hono/routes/devices.d.ts

@@ -1,4 +1,5 @@
 import type { Hono } from 'hono';
 import type { AuthenticatedRouteDeps } from './deps.js';
-export declare function registerDeviceAuthPublicRoutes(app: Hono): void;
+import { type PairingPublicRouteOptions } from './device-pairing-approval.js';
+export declare function registerDeviceAuthPublicRoutes(app: Hono, options?: PairingPublicRouteOptions): void;
 export declare function registerDeviceRoutes(authenticated: Hono, deps: AuthenticatedRouteDeps): void;

package/dist/src/gateway/hono/routes/devices.js

@@ -1,4 +1,4 @@
-import { devicePairingTargetKindSchema } from "../../../../packages/gateway-contract/src/device-pairing.js";
+import { devicePairingInvitationPayloadSchema, devicePairingTargetKindSchema, formatBrowserPairingInvitation } from "../../../../packages/gateway-contract/src/device-pairing.js";
 import { listDevices, revokeDevice, rotateDeviceRefreshToken } from "../../../storage/sqlite/device-access-repository.js";
 import { getGatewayIdentityPublicKeyRaw, getOrCreateGatewayIdentity, signGatewayPayload } from "../../../storage/sqlite/gateway-identity-repository.js";
 import { createDevicePairingSetup, isDevicePairingSetupActive } from "../../../storage/sqlite/device-pairing-repository.js";
@@ -6,7 +6,7 @@ import { resolveSecureDeviceRoutes } from "../../device-routes.js";
 import { buckets } from "../../rate-limit/buckets.js";
 import "../../rate-limit/index.js";
 import { getGatewayPrincipal } from "../../security/gateway-principal.js";
-import { registerPairingApprovalAdminRoutes, registerPairingApprovalPublicRoutes } from "./device-pairing-approval.js";
+import { pairingClientKey, registerPairingApprovalAdminRoutes, registerPairingApprovalPublicRoutes } from "./device-pairing-approval.js";
 import os from "node:os";
 import { z } from "zod";
 import { bodyLimit } from "hono/body-limit";
@@ -21,10 +21,10 @@ const refreshRequestSchema = z.strictObject({
 });
 const pairingProbeSchema = z.strictObject({ pairingId: z.string().uuid() });
 const pairingSetupSchema = z.strictObject({ targetKind: devicePairingTargetKindSchema });
-function pairingLinkPayload(input) {
-	return Buffer.from(JSON.stringify(input)).toString("base64url");
+function pairingPayload(input) {
+	return Buffer.from(JSON.stringify(devicePairingInvitationPayloadSchema.parse(input))).toString("base64url");
 }
-function registerDeviceAuthPublicRoutes(app) {
+function registerDeviceAuthPublicRoutes(app, options) {
 	app.post("/api/gateway-identity/challenge", bodyLimit({ maxSize: 512 }), async (c) => {
 		const budget = buckets.identityChallenge().consume("gateway");
 		if (!budget.allowed) {
@@ -46,7 +46,7 @@ function registerDeviceAuthPublicRoutes(app) {
 			signature: signGatewayPayload(signedPayload)
 		});
 	});
-	registerPairingApprovalPublicRoutes(app);
+	registerPairingApprovalPublicRoutes(app, options);
 	app.post("/api/device-auth/refresh", async (c) => {
 		const parsed = refreshRequestSchema.safeParse(await c.req.json().catch(() => null));
 		if (!parsed.success) return c.json({
@@ -81,21 +81,37 @@ function registerDeviceAuthPublicRoutes(app) {
 			}, 401);
 		}
 	});
-	app.post("/api/device-pairing/probe", async (c) => {
+	app.post("/api/device-pairing/probe", bodyLimit({ maxSize: 512 }), async (c) => {
+		const clientKey = pairingClientKey(c, options);
+		const blocked = buckets.pairingExchange().check(clientKey);
+		if (blocked.blocked) {
+			c.header("Retry-After", String(blocked.retryAfterSec));
+			return c.json({
+				ok: false,
+				error: {
+					code: "PAIRING_RATE_LIMITED",
+					message: "Too many failed pairing attempts"
+				}
+			}, 429);
+		}
 		const parsed = pairingProbeSchema.safeParse(await c.req.json().catch(() => null));
-		if (!parsed.success || !isDevicePairingSetupActive(parsed.data.pairingId)) return c.json({
-			ok: false,
-			error: {
-				code: "PAIRING_NOT_FOUND",
-				message: "Pairing setup not found"
-			}
-		}, 404);
+		if (!parsed.success || !isDevicePairingSetupActive(parsed.data.pairingId)) {
+			buckets.pairingExchange().fail(clientKey);
+			return c.json({
+				ok: false,
+				error: {
+					code: "PAIRING_NOT_FOUND",
+					message: "Pairing setup not found"
+				}
+			}, 404);
+		}
 		const identity = getOrCreateGatewayIdentity();
 		const payload = Buffer.from(JSON.stringify({
 			gatewayId: identity.id,
 			pairingId: parsed.data.pairingId,
 			issuedAt: Date.now()
 		})).toString("base64url");
+		buckets.pairingExchange().succeed(clientKey);
 		return c.json({
 			ok: true,
 			signedPayload: payload,
@@ -136,7 +152,7 @@ function registerDeviceRoutes(authenticated, deps) {
 		}, 409);
 		const setup = createDevicePairingSetup(routes, Date.now(), { targetKind: parsed.data.targetKind });
 		const identity = getOrCreateGatewayIdentity();
-		const encoded = pairingLinkPayload({
+		const encoded = pairingPayload({
 			version: 3,
 			pairingToken: setup.token,
 			gatewayId: identity.id,
@@ -146,11 +162,12 @@ function registerDeviceRoutes(authenticated, deps) {
 			targetKind: setup.targetKind,
 			expiresAt: setup.expiresAt
 		});
+		const invitation = setup.targetKind === "mobile" ? { universalLink: `https://link.xopc.ai/connect#p=${encoded}` } : { browserInvitation: formatBrowserPairingInvitation(encoded) };
 		return c.json({
 			ok: true,
 			setup: {
 				id: setup.id,
-				universalLink: `https://link.xopc.ai/connect#p=${encoded}`,
+				...invitation,
 				expiresAt: setup.expiresAt,
 				routes,
 				protocolVersion: 3,

package/dist/src/gateway/hono/routes/session-input-handler.d.ts

@@ -136,7 +136,7 @@ export declare function replaceLatestSessionTurn(c: Context, deps: Authenticated
         code: "TARGET_NOT_FOUND" | "NOT_LATEST" | "SESSION_BUSY" | "BAD_REQUEST" | "CONTEXT_UNAVAILABLE";
         message: string;
     };
-}, 400 | 404 | 409, "json">) | (Response & import("hono").TypedResponse<{
+}, 404 | 400 | 409, "json">) | (Response & import("hono").TypedResponse<{
     ok: true;
     payload: {
         sessionKey: string;

package/dist/src/gateway/hono/routes/session-input-handler.js

@@ -1,9 +1,9 @@
 import { browserPageContextsInputSchema } from "../../../../packages/gateway-contract/src/browser-page-context.js";
 import { endpointTurnClaimSchema } from "../../../../packages/endpoint-tools-protocol/src/index.js";
 import { init_providers, resolveModel } from "../../../providers/index.js";
+import { validateWebchatAttachments, validateWebchatContent } from "../../chat-limits.js";
 import { parseTurnContextRefs } from "../../../agent/source-context/types.js";
 import { getModelThinking } from "../../../providers/model-thinking.js";
-import { validateWebchatAttachments, validateWebchatContent } from "../../chat-limits.js";
 import { withModelConfigLock } from "../../../session/model-config-lock.js";
 import { browserPageContextToAgentContext } from "../../../agent/source-context/browser-page.js";
 //#region src/gateway/hono/routes/session-input-handler.ts

package/dist/src/gateway/hono/routes/side-chats.js

@@ -1,7 +1,7 @@
 import { chooseModelThinking } from "../../../../packages/gateway-contract/src/model-selection.js";
 import { init_providers, resolveModel } from "../../../providers/index.js";
-import { getModelThinking } from "../../../providers/model-thinking.js";
 import { validateWebchatAttachments, validateWebchatContent } from "../../chat-limits.js";
+import { getModelThinking } from "../../../providers/model-thinking.js";
 import { validateSideChatSelections } from "../../side-chat/context-snapshot.js";
 import { SideChatError, parseThinkingLevel } from "../../side-chat/manager.js";
 import "../../side-chat/index.js";

package/dist/src/gateway/hono/routes/tunnel.js

@@ -1,3 +1,5 @@
+import { createLogger } from "../../../utils/logger/index.js";
+import { init_logger } from "../../../utils/logger.js";
 import { init_public_url, validatePublicUrl } from "../../../config/public-url.js";
 import { TUNNEL_REGISTRATION_SECRET_REQUIRED_CODE, TunnelRegistrationSecretError, getTunnelRegistrationSecretMeta, readTunnelRegistrationSecretFromConfigOnly, resolveTunnelBrokerUrl } from "../../../tunnel/env.js";
 import { logTunnelAudit } from "../../../tunnel/tunnel-audit.js";
@@ -9,9 +11,11 @@ import { applyTunnelConsentToConfig, mergeTunnelConfigPatch, setTunnelEnabledInC
 import { getGatewayPrincipal } from "../../security/gateway-principal.js";
 import { consumeTunnelMutationLimit } from "../../../tunnel/tunnel-rate-limit.js";
 import "../../../tunnel/index.js";
-import { provisionTunnelRegistrationKey } from "../../../tunnel/xopc-cloud-registration.js";
+import { TunnelRegistrationProvisionError, provisionTunnelRegistrationKey } from "../../../tunnel/xopc-cloud-registration.js";
 //#region src/gateway/hono/routes/tunnel.ts
+init_logger();
 init_public_url();
+const log = createLogger("Gateway:Tunnel");
 async function configureTunnelFromService(deps, opts) {
 	await configureTunnelFromGatewayConfig(deps.service.currentConfig, opts);
 }
@@ -161,6 +165,10 @@ function registerTunnelRoutes(authenticated, deps) {
 	});
 	authenticated.post("/api/tunnel/registration-key", tunnelMutationLimit, async (c) => {
 		const config = deps.service.currentConfig;
+		if (readTunnelRegistrationSecretFromConfigOnly(config)) return c.json({
+			ok: true,
+			reused: true
+		});
 		try {
 			const merged = mergeTunnelConfigPatch(config, { registrationSecret: await provisionTunnelRegistrationKey() });
 			if (merged.ok === false) return c.json({
@@ -176,9 +184,33 @@ function registerTunnelRoutes(authenticated, deps) {
 			return c.json({ ok: true });
 		} catch (error) {
 			const message = error instanceof Error ? error.message : String(error);
+			if (error instanceof TunnelRegistrationProvisionError) {
+				const status = error.code === "tunnel_key_limit_reached" ? 409 : error.code === "tunnel_oauth_required" ? 403 : 502;
+				log.warn({
+					err: error,
+					code: error.code,
+					upstreamStatus: error.status,
+					phase: "registration_key"
+				}, `Tunnel registration key failed: ${message}`);
+				return c.json({
+					ok: false,
+					error: {
+						code: error.code,
+						message
+					}
+				}, status);
+			}
+			log.warn({
+				err: error,
+				errorMessage: message,
+				phase: "registration_key"
+			}, `Tunnel registration key failed: ${message}`);
 			return c.json({
 				ok: false,
-				error: message
+				error: {
+					code: "tunnel_registration_failed",
+					message
+				}
 			}, 502);
 		}
 	});

package/dist/src/gateway/rate-limit/buckets.js

@@ -144,7 +144,8 @@ var BucketRegistry = class {
 		if (!this.pairingExchangeLimiter) this.pairingExchangeLimiter = new FailureLimiter({
 			maxFailures: 30,
 			windowMs: 5 * 6e4,
-			blockDurationMs: 5 * 6e4
+			blockDurationMs: 5 * 6e4,
+			burstCoalesceMs: 0
 		});
 		return this.pairingExchangeLimiter;
 	}

package/dist/src/gateway/service/run-gateway-agent.js

@@ -9,8 +9,8 @@ import { init_session_key, parseSessionKey } from "../../routing/session-key.js"
 import { resolveExecutionContext } from "../../tasks/execution-context.js";
 import { TaskRunCoordinator } from "../../tasks/task-run-coordinator.js";
 import { formatAgentRunErrorForClient } from "../../agent/client-error-format.js";
-import { prependEnvelopeTimestamp } from "../../channels/envelope-timestamp.js";
 import "../chat-limits.js";
+import { prependEnvelopeTimestamp } from "../../channels/envelope-timestamp.js";
 import { ChatStreamMapper } from "../chat-stream/mapper.js";
 import { resolveWebchatSessionKey } from "../resolve-webchat-session-key.js";
 import { recordExplicitRelationshipFollowUp } from "../../user-context/relationship-continuity.js";