@xopcai/xopc 0.0.282 → 0.0.284

package/dist/src/gateway/hono/routes/workflows.js

@@ -7,10 +7,10 @@ import { WorkflowNameConflictError, WorkflowRevisionConflictError, createWorkflo
 import "../../../workflows/domain/index.js";
 import { resolveWorkflowRunArtifactsDir } from "../../../workflows/store/paths.js";
 import { WorkflowDraftService } from "../../../workflows/draft/workflow-draft-service.js";
-import "../../../workflows/draft/index.js";
-import { ProjectWorkflowPresetRepository } from "../../../workflows/project-presets/project-workflow-preset-repository.js";
 import { WorkflowDraftConflictError, WorkflowDraftStore } from "../../../workflows/authoring/workflow-draft-store.js";
 import "../../../workflows/authoring/index.js";
+import "../../../workflows/draft/index.js";
+import { ProjectWorkflowPresetRepository } from "../../../workflows/project-presets/project-workflow-preset-repository.js";
 import { basename, join } from "node:path";
 import { readFile, stat } from "node:fs/promises";
 //#region src/gateway/hono/routes/workflows.ts

package/dist/src/gateway/run-loop.js

@@ -1,6 +1,6 @@
 import { loadConfig } from "../config/loader.js";
-import "../config/index.js";
 import { isRestartEnabled } from "../config/commands.flags.js";
+import "../config/index.js";
 import { runBootstrapMigrationsSync } from "../migrations/runner.js";
 import { restartGatewayProcessWithFreshPid } from "./respawn.js";
 import { acquireGatewayLock } from "./lock.js";

package/dist/src/gateway/service/config-coordinator.js

@@ -1,7 +1,7 @@
 import { createLogger } from "../../utils/logger/index.js";
 import { init_logger } from "../../utils/logger.js";
-import { getModelRegistry } from "../../providers/model-registry.js";
 import { loadConfig, saveConfig } from "../../config/loader.js";
+import { getModelRegistry } from "../../providers/model-registry.js";
 import { init_providers } from "../../providers/index.js";
 import { disposeAllSessionMcpRuntimes } from "../../agent/mcp/bundle-mcp-runtime.js";
 import { reloadImageGenerationProviders } from "../../agent/image/generation/provider-registry.js";

package/dist/src/gateway/service.js

@@ -12,19 +12,16 @@ import { getSessionConfig } from "../storage/sqlite/config-repository.js";
 import "../storage/sqlite/index.js";
 import { getAgentDefaultModelRef, init_schema } from "../config/schema.js";
 import { init_agent_scope, listAgentEntries, normalizeAgentId, resolveAgentWorkspaceDir, resolveDefaultAgentId } from "../agent/agent-scope.js";
+import { buildSessionKey, init_session_key, sanitizeSegment } from "../routing/session-key.js";
+import { getDefaultAgentId, init_resolve_route } from "../routing/resolve-route.js";
+import { resolveEffectiveAgentProfileForSession } from "../config/agent-profile.js";
 import { init_paths, resolveConfigPath, resolveExtensionsDir } from "../config/paths.js";
-import { prewarmModelRegistry } from "../providers/model-registry.js";
 import { areExtensionsGloballyDisabled } from "../extensions/discover-extensions.js";
 import { buildExtensionMetadataSnapshot } from "../extensions/extension-metadata-snapshot.js";
 import { buildChannelCatalogForConfig, buildChannelCatalogFromSnapshot, init_channel_catalog_service } from "../channels/catalog/channel-catalog-service.js";
 import { loadConfig, saveConfig } from "../config/loader.js";
-import { buildSessionKey, init_session_key, sanitizeSegment } from "../routing/session-key.js";
-import { getDefaultAgentId, init_resolve_route } from "../routing/resolve-route.js";
+import { prewarmModelRegistry } from "../providers/model-registry.js";
 import { init_providers, providers_exports } from "../providers/index.js";
-import { AutomationService } from "../automations/service/automation-service.js";
-import { onAutomationProductEvent, publishAutomationProductEvent } from "../automations/product-events.js";
-import "../automations/index.js";
-import { resolveEffectiveAgentProfileForSession } from "../config/agent-profile.js";
 import { TaskRepository } from "../tasks/task-repository.js";
 import { TaskConversationRepository } from "../tasks/task-conversation-repository.js";
 import { getEmbeddedExecutionSession } from "../agent/embedded/execution-context.js";
@@ -38,6 +35,9 @@ import { ProactiveScenarioService } from "../proactive/scenarios/service.js";
 import { ProactiveEventService } from "../proactive/service.js";
 import { TaskApplicationService } from "../tasks/task-application-service.js";
 import { ProactiveInboxService } from "../proactive/inbox/service.js";
+import { AutomationService } from "../automations/service/automation-service.js";
+import { onAutomationProductEvent, publishAutomationProductEvent } from "../automations/product-events.js";
+import "../automations/index.js";
 import { TaskOutboxDispatcher } from "../tasks/task-outbox-dispatcher.js";
 import { TaskRunDispatcher } from "../tasks/task-run-dispatcher.js";
 import { TaskSignalService } from "../tasks/task-signal-service.js";
@@ -955,6 +955,8 @@ var GatewayService = class {
 		});
 		log.debug("Starting gateway service...");
 		openXopcDatabase();
+		const { recoverCapabilityImports } = await import("../imports/runtime.js");
+		await recoverCapabilityImports();
 		this.createNotificationService().start();
 		this.startTime = Date.now();
 		this.running = true;

package/dist/src/imports/compatibility.d.ts

@@ -0,0 +1,7 @@
+import type { ImportCandidate, ImportFile } from './types.js';
+export declare function parseSkill(raw: string): {
+    metadata: Record<string, unknown>;
+    body: string;
+};
+export declare function inspectSkill(base: Pick<ImportCandidate, 'id' | 'source' | 'scope' | 'location' | 'shared'>, files: ImportFile[]): ImportCandidate;
+export declare function inspectMcp(base: Pick<ImportCandidate, 'id' | 'source' | 'scope' | 'location' | 'shared'>, name: string, raw: unknown): ImportCandidate;

package/dist/src/imports/compatibility.js

@@ -0,0 +1,174 @@
+import { McpServerSchema, init_schema } from "../config/schema.js";
+import { isValidSkillId } from "../agent/skills/managed-store.js";
+import { containsSecret, isCredentialPath } from "./secrets.js";
+import { digest, fileHash } from "./files.js";
+import yaml from "js-yaml";
+//#region src/imports/compatibility.ts
+init_schema();
+function parseSkill(raw) {
+	const match = /^---\r?\n([\s\S]*?)\r?\n---(?:\r?\n|$)([\s\S]*)$/.exec(raw);
+	if (!match || match[1].length > 64 * 1024) throw new Error("A valid YAML header is required");
+	if (/(?:^|\s)[&*][\w-]+/.test(match[1])) throw new Error("YAML aliases are not supported");
+	let metadata;
+	try {
+		metadata = yaml.load(match[1], { schema: yaml.JSON_SCHEMA });
+	} catch {
+		throw new Error("Invalid YAML header");
+	}
+	if (!metadata || typeof metadata !== "object" || Array.isArray(metadata)) throw new Error("Invalid skill metadata");
+	return {
+		metadata,
+		body: match[2]
+	};
+}
+function inspectSkill(base, files) {
+	const item = {
+		...base,
+		kind: "skill",
+		name: base.id,
+		description: "",
+		files,
+		hash: fileHash(files),
+		compatibility: "compatible",
+		findings: [],
+		requiredEnv: []
+	};
+	try {
+		if (files.reduce((n, f) => n + Buffer.byteLength(f.data, "base64"), 0) > 15 * 1024 * 1024) throw new Error("Skill exceeds 15 MiB");
+		if (files.some((f) => f.path.endsWith("/SKILL.md"))) throw new Error("Nested skill scopes need separate imports");
+		const primary = files.find((f) => f.path === "SKILL.md");
+		if (!primary || Buffer.byteLength(primary.data, "base64") > 1024 * 1024) throw new Error("SKILL.md is missing or exceeds 1 MiB");
+		const { metadata, body } = parseSkill(Buffer.from(primary.data, "base64").toString("utf8"));
+		if (typeof metadata.name !== "string" || !isValidSkillId(metadata.name)) throw new Error("Skill name must be a portable identifier");
+		item.name = metadata.name;
+		if (typeof metadata.description !== "string" || !metadata.description.trim() || metadata.description.length > 1024) throw new Error("Skill description must contain 1–1024 characters");
+		item.description = metadata.description;
+		const supported = new Set([
+			"name",
+			"description",
+			"license",
+			"compatibility",
+			"metadata",
+			"disable-model-invocation",
+			"allowed-tools"
+		]);
+		for (const key of Object.keys(metadata)) if (!supported.has(key)) item.findings.push(`Unsupported skill field: ${key}`);
+		if (metadata["disable-model-invocation"] !== void 0 && typeof metadata["disable-model-invocation"] !== "boolean") item.findings.push("disable-model-invocation must be boolean");
+		if (/\$ARGUMENTS|\$\{?(?:CLAUDE_|CODEX_)|!`/.test(body)) item.findings.push("Product-specific variables or command expansion require adaptation");
+		const meta = metadata.metadata;
+		if (meta && (typeof meta !== "object" || Array.isArray(meta))) item.findings.push("Invalid metadata");
+		if (meta && Object.keys(meta).some((k) => ![
+			"author",
+			"version",
+			"short-description",
+			"short_description",
+			"category",
+			"tags",
+			"license",
+			"homepage"
+		].includes(k))) item.findings.push("Extended metadata needs manual compatibility review");
+		for (const match of body.matchAll(/\[[^\]]*\]\(([^)\s]+)\)/g)) {
+			const ref = match[1].split("#")[0];
+			if (ref && !/^(?:[a-z]+:|#)/i.test(ref) && !files.some((f) => f.path === ref.replace(/^\.\//, ""))) item.findings.push("A referenced local file is missing or outside the skill");
+		}
+		if (item.findings.length) item.compatibility = "blocked";
+		if (metadata["allowed-tools"]) item.findings.push("Source tool pre-approvals are not transferred; xopc permissions apply");
+		for (const file of files) if (isCredentialPath(file.path) || containsSecret(Buffer.from(file.data, "base64").toString("utf8"))) {
+			item.compatibility = "blocked";
+			item.findings.push("Possible credentials found; remove them from the source and scan again");
+			item.files = [];
+			item.description = "";
+			break;
+		}
+	} catch (error) {
+		item.compatibility = "blocked";
+		item.findings.push(error instanceof Error ? error.message : "Invalid skill");
+	}
+	if (files.some((f) => containsSecret(Buffer.from(f.data, "base64").toString("utf8")))) {
+		item.files = [];
+		item.description = "";
+		item.compatibility = "blocked";
+		item.findings = ["Possible credentials found; remove them and scan again"];
+	}
+	return item;
+}
+function inspectMcp(base, name, raw) {
+	const item = {
+		...base,
+		kind: "mcp",
+		name,
+		description: "MCP connection draft",
+		files: [],
+		hash: "",
+		compatibility: "needs_setup",
+		findings: [],
+		requiredEnv: []
+	};
+	const value = raw && typeof raw === "object" && !Array.isArray(raw) ? raw : {};
+	const draft = {};
+	const supported = new Set([
+		"command",
+		"args",
+		"cwd",
+		"url",
+		"type",
+		"env",
+		"headers",
+		"http_headers",
+		"startup_timeout_sec",
+		"tool_timeout_sec"
+	]);
+	for (const [key, v] of Object.entries(value)) {
+		if (!supported.has(key)) {
+			item.compatibility = "blocked";
+			item.findings.push(`Unsupported MCP field: ${key}`);
+			continue;
+		}
+		if ([
+			"env",
+			"headers",
+			"http_headers"
+		].includes(key)) {
+			if (v && typeof v === "object") item.requiredEnv.push(...Object.keys(v));
+			item.findings.push(`${key} values omitted; configure them in xopc`);
+		} else if (key === "type") {
+			if (v === "http") draft.transport = "streamable-http";
+			else if (v === "sse") draft.transport = "sse";
+			else if (v !== "stdio") {
+				item.compatibility = "blocked";
+				item.findings.push("Unsupported MCP transport");
+			}
+		} else if (key === "startup_timeout_sec" || key === "tool_timeout_sec") if (typeof v === "number") draft[key === "startup_timeout_sec" ? "connectionTimeoutMs" : "requestTimeoutMs"] = v * 1e3;
+		else {
+			item.compatibility = "blocked";
+			item.findings.push("Invalid MCP timeout");
+		}
+		else draft[key] = v;
+	}
+	if (typeof draft.url === "string") try {
+		const url = new URL(draft.url);
+		if (url.username || url.password || url.search || url.hash) {
+			delete draft.url;
+			item.findings.push("URL credentials or query parameters omitted; enter a clean endpoint");
+		}
+	} catch {
+		delete draft.url;
+	}
+	if (containsSecret(JSON.stringify(draft)) || /--?[a-z-]*(?:token|password|secret|api-key|authorization)(?:[=\s\"]|$)/i.test(JSON.stringify(draft))) {
+		Object.keys(draft).forEach((k) => delete draft[k]);
+		item.findings.push("Possible credentials omitted from connection fields");
+	}
+	if (!McpServerSchema.safeParse(draft).success || !draft.command && !draft.url) {
+		item.compatibility = "blocked";
+		item.findings.push("A valid command or URL is required");
+	}
+	if (base.scope === "project") {
+		item.compatibility = "blocked";
+		item.findings.push("Project-scoped MCP activation is not supported");
+	}
+	item.mcp = draft;
+	item.hash = digest(draft);
+	return item;
+}
+//#endregion
+export { inspectMcp, inspectSkill, parseSkill };

package/dist/src/imports/contextImport.d.ts

@@ -0,0 +1,3 @@
+import type { ImportCandidate } from './types.js';
+/** Small source records fit the existing retrieval budget without injecting entire documents. */
+export declare function importContextDocument(item: ImportCandidate, projectId?: string): 'created' | 'unchanged' | 'kept';

package/dist/src/imports/contextImport.js

@@ -0,0 +1,56 @@
+import { runSqliteWriteTransaction } from "../storage/sqlite/transaction.js";
+import { listKnowledgeItems, writeKnowledgeItem } from "../knowledge-memory/repository.js";
+import "../knowledge-memory/index.js";
+import { digest } from "./files.js";
+//#region src/imports/contextImport.ts
+/** Small source records fit the existing retrieval budget without injecting entire documents. */
+function importContextDocument(item, projectId) {
+	const content = item.content?.trim();
+	if (!content) throw new Error("Missing context");
+	const scope = projectId ? {
+		type: "project",
+		id: projectId
+	} : { type: "global" };
+	const canonicalKey = `product-import:${item.source}:${digest(item.location)}`;
+	return runSqliteWriteTransaction(() => {
+		const existing = listKnowledgeItems({
+			canonicalKey,
+			scope,
+			statuses: [
+				"active",
+				"candidate",
+				"needs_review",
+				"stale",
+				"archived",
+				"rejected"
+			]
+		})[0];
+		if (existing) return existing.source.hash === item.hash ? "unchanged" : "kept";
+		for (let offset = 0, part = 0; offset < content.length; offset += 2e3, part++) {
+			const chunk = content.slice(offset, offset + 2e3).trim();
+			if (!chunk) continue;
+			writeKnowledgeItem({
+				kind: "note",
+				scope,
+				content: chunk,
+				canonicalKey: part === 0 ? canonicalKey : `${canonicalKey}:part:${part}`,
+				recordClass: "source_index",
+				status: "active",
+				confidence: .7,
+				importance: .7,
+				originClass: "system",
+				source: {
+					kind: "product_import",
+					product: item.source,
+					path: item.location,
+					hash: item.hash,
+					part,
+					importedAt: Date.now()
+				}
+			});
+		}
+		return "created";
+	});
+}
+//#endregion
+export { importContextDocument };

package/dist/src/imports/files.d.ts

@@ -0,0 +1,13 @@
+import { type ImportFile } from './types.js';
+export declare const IMPORT_LIMITS: {
+    file: number;
+    total: number;
+    count: number;
+    depth: number;
+};
+export declare function digest(value: unknown): string;
+export declare function fileHash(files: ImportFile[]): string;
+export declare function inside(root: string, path: string): boolean;
+export declare function safePath(path: string): boolean;
+export declare function readRegularFile(path: string, limit?: number): Buffer;
+export declare function readTree(rootPath: string): ImportFile[];

package/dist/src/imports/files.js

@@ -0,0 +1,77 @@
+import { ImportError } from "./types.js";
+import { isAbsolute, join, relative } from "node:path";
+import { closeSync, constants, fstatSync, lstatSync, openSync, readFileSync, readdirSync, realpathSync } from "node:fs";
+import { createHash } from "node:crypto";
+//#region src/imports/files.ts
+const IMPORT_LIMITS = {
+	file: 15 * 1024 * 1024,
+	total: 100 * 1024 * 1024,
+	count: 5e3,
+	depth: 16
+};
+function digest(value) {
+	return createHash("sha256").update(JSON.stringify(value)).digest("hex");
+}
+function fileHash(files) {
+	return digest([...files].sort((a, b) => a.path.localeCompare(b.path, "en")));
+}
+function inside(root, path) {
+	const rel = relative(root, path);
+	return rel === "" || !isAbsolute(rel) && rel !== ".." && !rel.startsWith("../") && !rel.startsWith("..\\");
+}
+function safePath(path) {
+	return !!path && !path.includes("\\") && !path.includes("\0") && !path.startsWith("/") && path.split("/").every((p) => !!p && p !== "." && p !== ".." && !/[<>:"|?*]/.test(p) && !/[. ]$/.test(p) && !/^(con|prn|aux|nul|com[1-9]|lpt[1-9])(?:\.|$)/i.test(p));
+}
+function readRegularFile(path, limit = IMPORT_LIMITS.file) {
+	if (!lstatSync(path).isFile()) throw new ImportError("unsafe_file", "Only regular files are supported");
+	const fd = openSync(path, constants.O_RDONLY | (constants.O_NOFOLLOW ?? 0));
+	try {
+		const before = fstatSync(fd);
+		if (!before.isFile() || before.size > limit) throw new ImportError("limit_exceeded", "File exceeds import limit", 413);
+		const data = readFileSync(fd);
+		const after = fstatSync(fd);
+		if (data.length > limit || before.size !== after.size || before.mtimeMs !== after.mtimeMs) throw new ImportError("source_changed", "Source changed while reading", 409);
+		return data;
+	} finally {
+		closeSync(fd);
+	}
+}
+function readTree(rootPath) {
+	const root = realpathSync(rootPath);
+	const files = [];
+	let total = 0;
+	const names = /* @__PURE__ */ new Set();
+	function walk(dir, prefix, depth) {
+		if (depth > IMPORT_LIMITS.depth) throw new ImportError("limit_exceeded", "Directory is too deep", 413);
+		for (const entry of readdirSync(dir, { withFileTypes: true }).sort((a, b) => a.name.localeCompare(b.name))) {
+			if ([
+				".git",
+				".DS_Store",
+				"__MACOSX"
+			].includes(entry.name)) continue;
+			const rel = prefix + entry.name;
+			if (!safePath(rel)) throw new ImportError("unsafe_file", "Unsupported file name");
+			const key = rel.normalize("NFC").toLowerCase();
+			if (names.has(key)) throw new ImportError("conflict", "File names collide on the target filesystem", 409);
+			names.add(key);
+			if (names.size > IMPORT_LIMITS.count) throw new ImportError("limit_exceeded", "Too many files", 413);
+			const path = join(dir, entry.name);
+			if (entry.isSymbolicLink() || !inside(root, realpathSync(path))) throw new ImportError("unsafe_file", "Symbolic links must be replaced with local files before importing");
+			if (entry.isDirectory()) walk(path, rel + "/", depth + 1);
+			else {
+				const data = readRegularFile(path);
+				total += data.length;
+				if (total > IMPORT_LIMITS.total) throw new ImportError("limit_exceeded", "Import is too large", 413);
+				files.push({
+					path: rel,
+					data: data.toString("base64"),
+					executable: (lstatSync(path).mode & 73) !== 0
+				});
+			}
+		}
+	}
+	walk(root, "", 0);
+	return files;
+}
+//#endregion
+export { IMPORT_LIMITS, digest, fileHash, inside, readRegularFile, readTree, safePath };

package/dist/src/imports/importService.d.ts

@@ -0,0 +1,45 @@
+import { type ScanInput } from './scanner.js';
+import { type ImportAction, type ImportJob, type ImportScan, type ImportTarget } from './types.js';
+export interface ImportServiceOptions {
+    stateDir: string;
+    owner: string;
+    validateTarget?: (target: ImportTarget) => void;
+    isConnected?: (candidate: ImportScan['candidates'][number]) => boolean;
+    reservedNames?: (target: ImportTarget) => string[];
+    refreshSkills?: () => void | Promise<void>;
+}
+export declare class ImportService {
+    private readonly options;
+    private readonly repo;
+    private readonly root;
+    constructor(options: ImportServiceOptions);
+    scan(input: ScanInput): ImportScan;
+    getScan(id: string): ImportScan;
+    private storeScan;
+    plan(scanId: string, target: ImportTarget, choices: Array<Pick<ImportAction, 'candidateId' | 'operation'> & {
+        name?: string;
+    }>): import("./types.js").ImportPlan;
+    importSkills(scan: ImportScan, target: ImportTarget): Promise<{
+        imported: number;
+        skipped: number;
+        issues: Array<{
+            name: string;
+            reason: string;
+        }>;
+    }>;
+    getPlan(id: string): import("./types.js").ImportPlan;
+    apply(planId: string, key: string): ImportJob;
+    private renameSkill;
+    getJob(id: string): ImportJob;
+    recoverAndClean(): Promise<void>;
+    history(): ImportJob[];
+    activate(id: string, candidateIds: string[]): Promise<ImportJob>;
+    private publish;
+    rollback(id: string, candidateIds: string[]): Promise<ImportJob>;
+    private trashPath;
+    private recover;
+    private targetHash;
+    private assertLive;
+    private checkSelection;
+    private lock;
+}