@xopcai/xopc 0.0.284 → 0.0.286

package/dist/src/gateway/hono/routes/browser.js

@@ -1,5 +1,6 @@
 import { deleteBrowserTabBinding, getBrowserTabBinding, setBrowserTabBinding } from "../../../storage/sqlite/browser-tab-binding-repository.js";
 import { browserTabBindingRequestSchema } from "../../../../packages/gateway-contract/src/browser-tab-binding.js";
+import { init_src } from "../../../../packages/gateway-contract/src/index.js";
 import { getDevice } from "../../../storage/sqlite/device-access-repository.js";
 import "../../../../packages/browser-control-contract/src/index.js";
 import { decideBrowserApproval, listBrowserApprovals } from "../../../browser/policy/approval-store.js";
@@ -10,6 +11,7 @@ import { getGatewayPrincipal } from "../../security/gateway-principal.js";
 import { getConnInfo } from "@hono/node-server/conninfo";
 //#region src/gateway/hono/routes/browser.ts
 /** Browser Control status, approvals, and driver diagnostics. */
+init_src();
 async function extensionStatus(service, includeLocalArtifacts) {
 	const endpoints = service.endpointTools.registry.list().filter((item) => item.kind === "browser" && item.tools.some((tool) => tool.descriptor.name === "browser.control")).sort((left, right) => right.lastHeartbeatAt - left.lastHeartbeatAt);
 	const endpoint = endpoints[0];
@@ -21,8 +23,8 @@ async function extensionStatus(service, includeLocalArtifacts) {
 		socketConnected: connected,
 		connected,
 		driverKind: "extension",
-		protocolVersion: connected ? 4 : null,
-		expectedProtocolVersion: 4,
+		protocolVersion: connected ? 5 : null,
+		expectedProtocolVersion: 5,
 		extensionVersion,
 		endpoints: endpoints.map((item) => ({
 			endpointId: item.endpointId,
@@ -67,16 +69,16 @@ function chromeDevicePrincipal(c) {
 	const device = getDevice(principal.deviceId);
 	return device?.platform === "chrome" && device.revokedAt === void 0 ? principal : void 0;
 }
-function canManageBrowserSession(c, service, sessionKey) {
+function canManageBrowserSession(c, service, conversationId) {
 	const principal = chromeDevicePrincipal(c);
-	if (principal) return getBrowserTabBinding(sessionKey)?.principalId === principal.deviceId;
+	if (principal) return getBrowserTabBinding(conversationId)?.principalId === principal.deviceId;
 	return isLocalOwnerRequest(c, service);
 }
 function registerBrowserRoutes(authenticated, deps) {
 	const { service, strictRateLimitMiddleware } = deps;
-	authenticated.get("/api/browser/tab-bindings/:sessionKey", (c) => {
-		const sessionKey = c.req.param("sessionKey").trim();
-		const binding = getBrowserTabBinding(sessionKey);
+	authenticated.get("/api/browser/tab-bindings/:conversationId", (c) => {
+		const conversationId = c.req.param("conversationId").trim();
+		const binding = getBrowserTabBinding(conversationId);
 		if (!binding) return c.json({
 			ok: false,
 			error: {
@@ -84,7 +86,7 @@ function registerBrowserRoutes(authenticated, deps) {
 				message: "Tab binding not found"
 			}
 		}, 404);
-		if (!canManageBrowserSession(c, service, sessionKey)) return c.json({
+		if (!canManageBrowserSession(c, service, conversationId)) return c.json({
 			ok: false,
 			error: {
 				code: "FORBIDDEN",
@@ -96,7 +98,7 @@ function registerBrowserRoutes(authenticated, deps) {
 			payload: binding
 		});
 	});
-	authenticated.put("/api/browser/tab-bindings/:sessionKey", async (c) => {
+	authenticated.put("/api/browser/tab-bindings/:conversationId", async (c) => {
 		const principal = chromeDevicePrincipal(c);
 		if (!principal?.deviceId) return c.json({
 			ok: false,
@@ -121,8 +123,8 @@ function registerBrowserRoutes(authenticated, deps) {
 				message: "Browser endpoint is not active"
 			}
 		}, 401);
-		const sessionKey = c.req.param("sessionKey").trim();
-		if (!sessionKey || !await service.sessions.getSession(sessionKey)) return c.json({
+		const conversationId = c.req.param("conversationId").trim();
+		if (!conversationId || !await service.sessions.getSession(conversationId)) return c.json({
 			ok: false,
 			error: {
 				code: "NOT_FOUND",
@@ -132,7 +134,7 @@ function registerBrowserRoutes(authenticated, deps) {
 		const { turnToken: _turnToken, ...bindingInput } = parsed.data;
 		const binding = setBrowserTabBinding({
 			...bindingInput,
-			sessionKey,
+			conversationId,
 			principalId: principal.deviceId
 		});
 		return c.json({
@@ -140,9 +142,9 @@ function registerBrowserRoutes(authenticated, deps) {
 			payload: binding
 		});
 	});
-	authenticated.delete("/api/browser/tab-bindings/:sessionKey", (c) => {
-		const sessionKey = c.req.param("sessionKey").trim();
-		if (!canManageBrowserSession(c, service, sessionKey)) return c.json({
+	authenticated.delete("/api/browser/tab-bindings/:conversationId", (c) => {
+		const conversationId = c.req.param("conversationId").trim();
+		if (!canManageBrowserSession(c, service, conversationId)) return c.json({
 			ok: false,
 			error: {
 				code: "FORBIDDEN",
@@ -151,7 +153,7 @@ function registerBrowserRoutes(authenticated, deps) {
 		}, 403);
 		return c.json({
 			ok: true,
-			payload: { removed: deleteBrowserTabBinding(sessionKey) }
+			payload: { removed: deleteBrowserTabBinding(conversationId) }
 		});
 	});
 	authenticated.get("/api/browser/extension-status", async (c) => {
@@ -295,20 +297,20 @@ function registerBrowserRoutes(authenticated, deps) {
 		}
 	});
 	authenticated.get("/api/browser/approvals", (c) => {
-		const sessionKey = c.req.query("sessionKey");
-		if (!isLocalOwnerRequest(c, service) && (!sessionKey || !canManageBrowserSession(c, service, sessionKey))) return c.json({
+		const conversationId = c.req.query("conversationId");
+		if (!isLocalOwnerRequest(c, service) && (!conversationId || !canManageBrowserSession(c, service, conversationId))) return c.json({
 			ok: false,
 			error: "Local owner access required."
 		}, 403);
 		return c.json({
 			ok: true,
-			approvals: listBrowserApprovals(sessionKey)
+			approvals: listBrowserApprovals(conversationId)
 		});
 	});
 	authenticated.post("/api/browser/approvals/respond", strictRateLimitMiddleware, async (c) => {
 		const body = await c.req.json().catch(() => null);
 		const approval = typeof body?.id === "string" ? listBrowserApprovals().find((candidate) => candidate.id === body.id) : void 0;
-		if (!isLocalOwnerRequest(c, service) && (!approval || !canManageBrowserSession(c, service, approval.sessionKey))) return c.json({
+		if (!isLocalOwnerRequest(c, service) && (!approval || !canManageBrowserSession(c, service, approval.conversationId))) return c.json({
 			ok: false,
 			error: "Local owner access required."
 		}, 403);

package/dist/src/gateway/hono/routes/chat-model-config.d.ts

@@ -1,6 +1,6 @@
 import type { Context } from 'hono';
 import type { AuthenticatedRouteDeps } from './deps.js';
-export declare function patchChatModelConfig(c: Context, service: AuthenticatedRouteDeps['service'], sessionKey: string, body: Record<string, unknown>): Promise<(Response & import("hono").TypedResponse<{
+export declare function patchChatModelConfig(c: Context, service: AuthenticatedRouteDeps['service'], conversationId: string, body: Record<string, unknown>): Promise<(Response & import("hono").TypedResponse<{
     ok: false;
     error: string;
     code: string;

package/dist/src/gateway/hono/routes/chat-model-config.js

@@ -1,11 +1,11 @@
 import { withModelConfigLock } from "../../../session/model-config-lock.js";
 //#region src/gateway/hono/routes/chat-model-config.ts
-async function patchChatModelConfig(c, service, sessionKey, body) {
-	return withModelConfigLock(sessionKey, async () => {
+async function patchChatModelConfig(c, service, conversationId, body) {
+	return withModelConfigLock(conversationId, async () => {
 		const changesModel = body.model !== void 0 || body.thinkingLevel !== void 0;
 		if (changesModel) {
-			const state = service.getSessionInputState(sessionKey);
-			if (service.sessions.getActiveRun(sessionKey).active || state.activeRunId || state.inputs.length > 0) return c.json({
+			const state = service.getSessionInputState(conversationId);
+			if (service.sessions.getActiveRun(conversationId).active || state.activeRunId || state.inputs.length > 0) return c.json({
 				ok: false,
 				error: "Wait for the current reply and pending inputs to finish",
 				code: "SESSION_BUSY"
@@ -23,7 +23,7 @@ async function patchChatModelConfig(c, service, sessionKey, body) {
 				error: "Select a specific model"
 			}, 400);
 		}
-		const result = await service.sessions.patchAgentConfig(sessionKey, {
+		const result = await service.sessions.patchAgentConfig(conversationId, {
 			...body,
 			...changesModel ? { fixedModel: true } : {}
 		});
@@ -34,7 +34,7 @@ async function patchChatModelConfig(c, service, sessionKey, body) {
 		}, result.code === "CONFIG_CHANGED" ? 409 : 400);
 		return c.json({
 			ok: true,
-			payload: await service.sessions.getAgentConfig(sessionKey)
+			payload: await service.sessions.getAgentConfig(conversationId)
 		});
 	});
 }

package/dist/src/gateway/hono/routes/commands-skills.js

@@ -58,9 +58,9 @@ function registerCommandsSkillsRoutes(authenticated, deps) {
 		});
 	});
 	authenticated.get("/api/review/context", async (c) => {
-		const sessionKey = c.req.query("sessionKey")?.trim() || "agent:main:main";
+		const conversationId = c.req.query("conversationId")?.trim();
 		try {
-			const payload = await buildReviewContext(await resolveGitRoot(effectiveWorkspacePathForSession(service.getConfig(), sessionKey, null, getProjectForSession(sessionKey))));
+			const payload = await buildReviewContext(await resolveGitRoot(effectiveWorkspacePathForSession(service.getConfig(), conversationId, null, getProjectForSession(conversationId))));
 			return c.json({
 				ok: true,
 				payload
@@ -76,21 +76,21 @@ function registerCommandsSkillsRoutes(authenticated, deps) {
 		}
 	});
 	authenticated.get("/api/chat/skills", async (c) => {
-		const sessionKey = c.req.query("sessionKey")?.trim();
+		const conversationId = c.req.query("conversationId")?.trim();
 		const agentId = c.req.query("agentId")?.trim() || service.getConfig().agents?.default || "main";
-		const payload = sessionKey ? await service.marketplace.getSessionSkillsApi(sessionKey) : service.marketplace.getAgentSkillsApi(agentId);
+		const payload = conversationId ? await service.marketplace.getSessionSkillsApi(conversationId) : service.marketplace.getAgentSkillsApi(agentId);
 		return c.json({
 			ok: true,
 			payload
 		});
 	});
 	authenticated.get("/api/chat/workspace-trust", async (c) => {
-		const sessionKey = c.req.query("sessionKey")?.trim();
-		if (!sessionKey) return c.json({
+		const conversationId = c.req.query("conversationId")?.trim();
+		if (!conversationId) return c.json({
 			ok: false,
-			error: "Missing sessionKey"
+			error: "Missing conversationId"
 		}, 400);
-		const payload = await service.marketplace.getSessionWorkspaceTrustApi(sessionKey);
+		const payload = await service.marketplace.getSessionWorkspaceTrustApi(conversationId);
 		return c.json({
 			ok: true,
 			payload
@@ -106,19 +106,19 @@ function registerCommandsSkillsRoutes(authenticated, deps) {
 				error: "Invalid JSON"
 			}, 400);
 		}
-		const sessionKey = typeof body.sessionKey === "string" ? body.sessionKey.trim() : "";
-		if (!sessionKey || typeof body.trusted !== "boolean") return c.json({
+		const conversationId = typeof body.conversationId === "string" ? body.conversationId.trim() : "";
+		if (!conversationId || typeof body.trusted !== "boolean") return c.json({
 			ok: false,
-			error: "Expected { sessionKey: string, trusted: boolean }"
+			error: "Expected { conversationId: string, trusted: boolean }"
 		}, 400);
-		const payload = await service.marketplace.setSessionWorkspaceTrustApi(sessionKey, body.trusted);
+		const payload = await service.marketplace.setSessionWorkspaceTrustApi(conversationId, body.trusted);
 		return c.json({
 			ok: true,
 			payload
 		});
 	});
 	authenticated.get("/api/chat/capabilities", (c) => {
-		const payload = service.agentService.getCapabilityCatalog(c.req.query("sessionKey")?.trim());
+		const payload = service.agentService.getCapabilityCatalog(c.req.query("conversationId")?.trim());
 		return c.json({
 			ok: true,
 			payload

package/dist/src/gateway/hono/routes/connection-waits.js

@@ -2,7 +2,7 @@ import { z } from "zod";
 //#region src/gateway/hono/routes/connection-waits.ts
 const actionSchema = z.object({
 	waitId: z.string().min(1),
-	expectedSessionId: z.string().min(1),
+	expectedTranscriptId: z.string().min(1),
 	expectedVersion: z.number().int().positive(),
 	idempotencyKey: z.string().min(1).max(200),
 	action: z.enum([
@@ -20,11 +20,11 @@ const actionSchema = z.object({
 	accountId: z.string().optional()
 }).strict();
 function registerConnectionWaitRoutes(app, { service, strictRateLimitMiddleware }) {
-	app.get("/api/sessions/:sessionKey/connection-wait", (c) => {
+	app.get("/api/sessions/:conversationId/connection-wait", (c) => {
 		try {
 			return c.json({
 				ok: true,
-				payload: service.connectionRecovery.snapshot(c.req.param("sessionKey"))
+				payload: service.connectionRecovery.snapshot(c.req.param("conversationId"))
 			});
 		} catch {
 			return c.json({
@@ -33,14 +33,14 @@ function registerConnectionWaitRoutes(app, { service, strictRateLimitMiddleware
 			}, 404);
 		}
 	});
-	app.post("/api/sessions/:sessionKey/connection-wait/actions", strictRateLimitMiddleware, async (c) => {
+	app.post("/api/sessions/:conversationId/connection-wait/actions", strictRateLimitMiddleware, async (c) => {
 		const parsed = actionSchema.safeParse(await c.req.json().catch(() => null));
 		if (!parsed.success) return c.json({
 			ok: false,
 			error: "Invalid connection action"
 		}, 400);
 		try {
-			const payload = await service.connectionRecovery.act(c.req.param("sessionKey"), parsed.data);
+			const payload = await service.connectionRecovery.act(c.req.param("conversationId"), parsed.data);
 			return c.json({
 				ok: true,
 				payload

package/dist/src/gateway/hono/routes/connectors.js

@@ -470,14 +470,14 @@ function registerConnectorRoutes(authenticated, deps) {
 			error: "Invalid approval status."
 		}, 400);
 		const principalId = c.req.query("principalId")?.trim() || "local-owner";
-		const sessionKey = c.req.query("sessionKey")?.trim() || void 0;
-		if (!hasGatewayScope(getGatewayPrincipal(c).scopes, "gateway.admin") && (!sessionKey || principalId !== "local-owner")) return c.json({
+		const conversationId = c.req.query("conversationId")?.trim() || void 0;
+		if (!hasGatewayScope(getGatewayPrincipal(c).scopes, "gateway.admin") && (!conversationId || principalId !== "local-owner")) return c.json({
 			ok: false,
 			error: "A local-owner session is required to read confirmations."
 		}, 403);
 		const approvals = listConnectorApprovals({
 			principalId,
-			sessionKey,
+			conversationId,
 			status,
 			limit: Number(c.req.query("limit") ?? "100")
 		});
@@ -595,8 +595,8 @@ function registerConnectorRoutes(authenticated, deps) {
 			ok: false,
 			error: "Connector approval not found."
 		}, 404);
-		const sessionKey = typeof record.sessionKey === "string" ? record.sessionKey.trim() : "";
-		if (!hasGatewayScope(getGatewayPrincipal(c).scopes, "gateway.admin") && (!sessionKey || current.sessionKey !== sessionKey || current.principalId !== "local-owner")) return c.json({
+		const conversationId = typeof record.conversationId === "string" ? record.conversationId.trim() : "";
+		if (!hasGatewayScope(getGatewayPrincipal(c).scopes, "gateway.admin") && (!conversationId || current.conversationId !== conversationId || current.principalId !== "local-owner")) return c.json({
 			ok: false,
 			error: "Confirmation does not belong to the requested local-owner session."
 		}, 403);

package/dist/src/gateway/hono/routes/context-sources.js

@@ -1,4 +1,4 @@
-import { getSqliteDatabase } from "../../../storage/sqlite/transaction.js";
+import { getSqliteDatabase, init_transaction } from "../../../storage/sqlite/transaction.js";
 import { countKnowledgeSourceItems, deleteKnowledgeSourceItems } from "../../../storage/sqlite/knowledge-repository.js";
 import { getConnectorAccount } from "../../../storage/sqlite/connector-account-repository.js";
 import "../../../storage/sqlite/index.js";
@@ -11,6 +11,7 @@ import { listUnderstandingSourceDefinitions } from "../../../user-context/source
 import { randomUUID } from "node:crypto";
 //#region src/gateway/hono/routes/context-sources.ts
 init_agent_scope();
+init_transaction();
 function stringField(value, field) {
 	if (!value || typeof value !== "object") return "";
 	const fieldValue = value[field];

package/dist/src/gateway/hono/routes/device-pairing-approval.js

@@ -1,4 +1,5 @@
 import { devicePairingCompleteSchema, devicePairingProofSchema, devicePairingRequestSchema } from "../../../../packages/gateway-contract/src/device-pairing.js";
+import { init_src } from "../../../../packages/gateway-contract/src/index.js";
 import { getOrCreateGatewayIdentity, signGatewayPayload } from "../../../storage/sqlite/gateway-identity-repository.js";
 import { resolveClientIpFromRequest } from "../../client-ip.js";
 import { buckets } from "../../rate-limit/buckets.js";
@@ -9,6 +10,7 @@ import { z } from "zod";
 import { bodyLimit } from "hono/body-limit";
 import { getConnInfo } from "@hono/node-server/conninfo";
 //#region src/gateway/hono/routes/device-pairing-approval.ts
+init_src();
 function pairingClientKey(c, options) {
 	let remoteAddress;
 	try {

package/dist/src/gateway/hono/routes/devices.js

@@ -1,4 +1,5 @@
 import { devicePairingInvitationPayloadSchema, devicePairingTargetKindSchema, formatBrowserPairingInvitation } from "../../../../packages/gateway-contract/src/device-pairing.js";
+import { init_src } from "../../../../packages/gateway-contract/src/index.js";
 import { listDevices, revokeDevice, rotateDeviceRefreshToken } from "../../../storage/sqlite/device-access-repository.js";
 import { getGatewayIdentityPublicKeyRaw, getOrCreateGatewayIdentity, signGatewayPayload } from "../../../storage/sqlite/gateway-identity-repository.js";
 import { createDevicePairingSetup, isDevicePairingSetupActive } from "../../../storage/sqlite/device-pairing-repository.js";
@@ -11,6 +12,7 @@ import os from "node:os";
 import { z } from "zod";
 import { bodyLimit } from "hono/body-limit";
 //#region src/gateway/hono/routes/devices.ts
+init_src();
 const refreshRequestSchema = z.strictObject({
 	refreshToken: z.string().min(1).max(256),
 	timestamp: z.number().int().positive(),

package/dist/src/gateway/hono/routes/endpoint-tools.js

@@ -1,5 +1,5 @@
 import { getDevice } from "../../../storage/sqlite/device-access-repository.js";
-import { endpointPrincipalRegistrationSchema, endpointSessionBindingRequestSchema } from "../../../../packages/endpoint-tools-protocol/src/index.js";
+import { endpointPrincipalRegistrationSchema, endpointSessionBindingRequestSchema, init_src } from "../../../../packages/endpoint-tools-protocol/src/index.js";
 import { createEndpointPrincipal, getEndpointPrincipal, listEndpointPrincipals, revokeEndpointPrincipal } from "../../../storage/sqlite/endpoint-principal-repository.js";
 import { listEndpointToolInvocationAudits } from "../../../storage/sqlite/endpoint-tool-invocation-repository.js";
 import "../../../storage/sqlite/index.js";
@@ -7,6 +7,7 @@ import { parseEndpointPublicKey } from "../../../endpoint-tools/auth.js";
 import { ENDPOINT_UPLOAD_MAX_BYTES, EndpointUploadError } from "../../../endpoint-tools/upload-service.js";
 import { getGatewayPrincipal } from "../../security/gateway-principal.js";
 //#region src/gateway/hono/routes/endpoint-tools.ts
+init_src();
 async function readBoundedBody(body, maxBytes) {
 	if (!body) return new Uint8Array();
 	const reader = body.getReader();
@@ -145,9 +146,9 @@ function registerEndpointToolRoutes(authenticated, deps) {
 			payload: listEndpointToolInvocationAudits(Number.isFinite(limit) ? limit : 100)
 		});
 	});
-	authenticated.get("/api/endpoint-tools/bindings/:sessionKey", (c) => {
+	authenticated.get("/api/endpoint-tools/bindings/:conversationId", (c) => {
 		try {
-			const binding = deps.service.endpointTools.bindings.get(c.req.param("sessionKey"));
+			const binding = deps.service.endpointTools.bindings.get(c.req.param("conversationId"));
 			return binding ? c.json({
 				ok: true,
 				payload: binding
@@ -168,7 +169,7 @@ function registerEndpointToolRoutes(authenticated, deps) {
 			}, 400);
 		}
 	});
-	authenticated.put("/api/endpoint-tools/bindings/:sessionKey", async (c) => {
+	authenticated.put("/api/endpoint-tools/bindings/:conversationId", async (c) => {
 		const parsed = endpointSessionBindingRequestSchema.safeParse(await c.req.json().catch(() => null));
 		if (!parsed.success) return c.json({
 			ok: false,
@@ -187,7 +188,7 @@ function registerEndpointToolRoutes(authenticated, deps) {
 			}
 		}, 403);
 		try {
-			const binding = deps.service.endpointTools.bindings.bind(c.req.param("sessionKey"), parsed.data.endpointId);
+			const binding = deps.service.endpointTools.bindings.bind(c.req.param("conversationId"), parsed.data.endpointId);
 			return c.json({
 				ok: true,
 				payload: binding
@@ -204,9 +205,9 @@ function registerEndpointToolRoutes(authenticated, deps) {
 			}, status);
 		}
 	});
-	authenticated.delete("/api/endpoint-tools/bindings/:sessionKey", (c) => {
+	authenticated.delete("/api/endpoint-tools/bindings/:conversationId", (c) => {
 		try {
-			const removed = deps.service.endpointTools.bindings.unbind(c.req.param("sessionKey"));
+			const removed = deps.service.endpointTools.bindings.unbind(c.req.param("conversationId"));
 			return c.json({
 				ok: true,
 				payload: { removed }

package/dist/src/gateway/hono/routes/execution-environments.js

@@ -54,8 +54,8 @@ function registerExecutionEnvironmentRoutes(authenticated, deps) {
 			})
 		});
 	});
-	authenticated.get("/api/sessions/:sessionKey/environment", (c) => {
-		const environment = sessions.get(c.req.param("sessionKey"));
+	authenticated.get("/api/sessions/:conversationId/environment", (c) => {
+		const environment = sessions.get(c.req.param("conversationId"));
 		return environment ? c.json({
 			ok: true,
 			environment
@@ -64,13 +64,13 @@ function registerExecutionEnvironmentRoutes(authenticated, deps) {
 			error: "Execution environment not found"
 		}, 404);
 	});
-	authenticated.post("/api/sessions/:sessionKey/environment", async (c) => {
-		const sessionKey = c.req.param("sessionKey");
-		if (deps.service.getActiveWebchatRunId(sessionKey)) return c.json({
+	authenticated.post("/api/sessions/:conversationId/environment", async (c) => {
+		const conversationId = c.req.param("conversationId");
+		if (deps.service.getActiveWebchatRunId(conversationId)) return c.json({
 			ok: false,
 			error: "Stop the active session run before changing its environment"
 		}, 409);
-		const session = await deps.service.sessions.getSession(sessionKey);
+		const session = await deps.service.sessions.getSession(conversationId);
 		if (!session) return c.json({
 			ok: false,
 			error: "Session not found"
@@ -89,7 +89,7 @@ function registerExecutionEnvironmentRoutes(authenticated, deps) {
 		}, 400);
 		try {
 			const environment = await sessions.attach({
-				sessionKey,
+				conversationId,
 				project,
 				mode,
 				baseRef: typeof body.baseRef === "string" ? body.baseRef : void 0
@@ -102,14 +102,14 @@ function registerExecutionEnvironmentRoutes(authenticated, deps) {
 			return c.json(errorResponse(error), 409);
 		}
 	});
-	authenticated.delete("/api/sessions/:sessionKey/environment", async (c) => {
-		const sessionKey = c.req.param("sessionKey");
-		if (deps.service.getActiveWebchatRunId(sessionKey)) return c.json({
+	authenticated.delete("/api/sessions/:conversationId/environment", async (c) => {
+		const conversationId = c.req.param("conversationId");
+		if (deps.service.getActiveWebchatRunId(conversationId)) return c.json({
 			ok: false,
 			error: "Stop the active session run before releasing its environment"
 		}, 409);
 		try {
-			const environment = await sessions.release(sessionKey, c.req.query("keepManaged") !== "true");
+			const environment = await sessions.release(conversationId, c.req.query("keepManaged") !== "true");
 			return c.json({
 				ok: true,
 				environment

package/dist/src/gateway/hono/routes/file-references.js

@@ -1,5 +1,5 @@
 import { FileServiceError } from "../../../files/file-service.js";
-import { buildFilePathClassifierContext, classifyFileLocation, displayNameForPath, fileRefSessionKeysMatch, resolveFileReferenceCandidate } from "../../file-path-classifier.js";
+import { buildFilePathClassifierContext, classifyFileLocation, displayNameForPath, fileRefConversationIdsMatch, resolveFileReferenceCandidate } from "../../file-path-classifier.js";
 import { classifyFileReferenceFsError } from "../../file-reference-errors.js";
 import { FileReferenceRegistry } from "../../file-reference-registry.js";
 import { getGatewayFileSpaceService } from "../../file-space-service.js";
@@ -14,10 +14,10 @@ function registerFileReferenceRoutes(app, deps) {
 		if (!body.spaceId || !body.path?.trim()) return c.json({ error: { message: "spaceId and path are required" } }, 400);
 		try {
 			const space = await files.get(body.spaceId);
-			const sessionKey = body.sessionKey?.trim();
+			const conversationId = body.conversationId?.trim();
 			const agentId = space.bindings.find((binding) => binding.kind === "agent")?.id;
 			const ctx = {
-				...buildFilePathClassifierContext(deps.service.currentConfig, sessionKey || (agentId ? `agent:${agentId}:main` : void 0)),
+				...buildFilePathClassifierContext(deps.service.currentConfig, conversationId, conversationId ? void 0 : agentId),
 				workspaceRoot: space.root
 			};
 			const inputPath = body.path.trim();
@@ -56,7 +56,7 @@ function registerFileReferenceRoutes(app, deps) {
 			] : ["copyPath"];
 			const ref = refs.register({
 				absolutePath,
-				sessionKey,
+				conversationId,
 				...classified,
 				capabilities
 			});
@@ -79,7 +79,7 @@ function registerFileReferenceRoutes(app, deps) {
 		const ref = refs.resolve(c.req.param("id"));
 		if (!ref) return c.json({ error: { message: "File reference expired" } }, 404);
 		const body = await c.req.json();
-		if (!fileRefSessionKeysMatch(ref.sessionKey, body.sessionKey)) return c.json({ error: { message: "File reference forbidden" } }, 403);
+		if (!fileRefConversationIdsMatch(ref.conversationId, body.conversationId)) return c.json({ error: { message: "File reference forbidden" } }, 403);
 		if (body.action !== "openExternal" && body.action !== "revealInFolder" || !ref.capabilities.includes(body.action)) return c.json({ error: { message: "Action not allowed" } }, 403);
 		try {
 			if (await realpath(ref.absolutePath) !== ref.absolutePath) return c.json({ error: { message: "File reference changed" } }, 409);

package/dist/src/gateway/hono/routes/home.js

@@ -85,7 +85,7 @@ function registerHomeRoutes(authenticated, deps) {
 		return c.json({
 			ok: true,
 			runId: result.runId,
-			sessionKey: result.sessionKey
+			conversationId: result.conversationId
 		}, 202);
 	});
 }

package/dist/src/gateway/hono/routes/imports.js

@@ -1,12 +1,20 @@
 import { getGatewayPrincipal } from "../../security/gateway-principal.js";
 import { ImportError } from "../../../imports/types.js";
 import { isImportSource } from "../../../imports/sources.js";
+import { ImportSelectionRepository } from "../../../storage/sqlite/import-selection-repository.js";
+import { getLiveInventory, previewInventoryItem, publicInventory, scanProduct } from "../../../imports/inventory.js";
+import { importSelection, listImportSources } from "../../../imports/productImport.js";
 import { createRuntimeImportService } from "../../../imports/runtime.js";
-import { importProduct, listImportSources } from "../../../imports/productImport.js";
 import { z } from "zod";
 //#region src/gateway/hono/routes/imports.ts
-const requestSchema = z.object({ requestId: z.string().uuid() }).strict();
+const selectionSchema = z.object({
+	inventoryId: z.string().uuid(),
+	candidateIds: z.array(z.string().uuid()).min(1).max(5e3),
+	requestId: z.string().uuid(),
+	retryOf: z.string().uuid().optional()
+}).strict();
 function registerImportRoutes(app, deps) {
+	const service = () => createRuntimeImportService("gateway-owner", () => deps.service.agentService.refreshSkillsAfterDiskChange(), (root) => deps.service.agentService.getWorkspaceTrust(root).trusted);
 	const respond = async (c, run) => {
 		try {
 			if (getGatewayPrincipal(c).kind !== "owner") throw new ImportError("owner_required", "Only the Gateway owner can import local capabilities", 403);
@@ -28,17 +36,21 @@ function registerImportRoutes(app, deps) {
 			return c.json({
 				ok: false,
 				code: "import_failed",
-				error: "Import could not finish. Try again; existing content is preserved."
+				error: "Import could not finish. Existing content is preserved."
 			}, 400);
 		}
 	};
 	app.get("/api/imports/sources", (c) => respond(c, () => ({ sources: listImportSources("gateway-owner") })));
-	app.post("/api/imports/sources/:source/import", deps.strictRateLimitMiddleware, (c) => respond(c, async () => {
+	app.post("/api/imports/sources/:source/scan", deps.strictRateLimitMiddleware, (c) => respond(c, async () => {
 		const source = c.req.param("source");
 		if (!isImportSource(source)) throw new ImportError("unsupported_source", "Unsupported source");
-		const { requestId } = requestSchema.parse(await c.req.json());
-		return importProduct(createRuntimeImportService("gateway-owner", () => deps.service.agentService.refreshSkillsAfterDiskChange(), (root) => deps.service.agentService.getWorkspaceTrust(root).trusted), source, requestId);
+		z.object({}).strict().parse(await c.req.json());
+		return scanProduct(service(), source);
 	}));
+	app.get("/api/imports/inventories/:id", (c) => respond(c, () => publicInventory(getLiveInventory("gateway-owner", c.req.param("id")))));
+	app.get("/api/imports/inventories/:id/items/:itemId/preview", (c) => respond(c, () => previewInventoryItem(service(), "gateway-owner", c.req.param("id"), c.req.param("itemId"))));
+	app.post("/api/imports/runs", deps.strictRateLimitMiddleware, (c) => respond(c, async () => importSelection(service(), selectionSchema.parse(await c.req.json()))));
+	app.get("/api/imports/runs/:id", (c) => respond(c, () => new ImportSelectionRepository("gateway-owner").get("run", c.req.param("id"))));
 }
 //#endregion
 export { registerImportRoutes };

package/dist/src/gateway/hono/routes/interaction-state.js

@@ -10,9 +10,9 @@ const SUPPORT_NEEDS = new Set([
 ]);
 function registerInteractionStateRoutes(authenticated, deps) {
 	authenticated.get("/api/interaction-state", (c) => {
-		const sessionKey = c.req.query("sessionKey")?.trim() ?? "";
-		if (!sessionKey) return c.json({ error: "sessionKey is required" }, 400);
-		const state = getInteractionState(sessionKey);
+		const conversationId = c.req.query("conversationId")?.trim() ?? "";
+		if (!conversationId) return c.json({ error: "conversationId is required" }, 400);
+		const state = getInteractionState(conversationId);
 		return state ? c.json({
 			ok: true,
 			state
@@ -23,11 +23,11 @@ function registerInteractionStateRoutes(authenticated, deps) {
 	});
 	authenticated.patch("/api/interaction-state", deps.strictRateLimitMiddleware, async (c) => {
 		const body = await c.req.json().catch(() => null);
-		const sessionKey = body && typeof body === "object" && typeof body.sessionKey === "string" ? body.sessionKey.trim() : "";
+		const conversationId = body && typeof body === "object" && typeof body.conversationId === "string" ? body.conversationId.trim() : "";
 		const supportNeed = body && typeof body === "object" && SUPPORT_NEEDS.has(body.supportNeed) ? body.supportNeed : void 0;
-		if (!sessionKey || !supportNeed) return c.json({ error: "sessionKey and a valid supportNeed are required" }, 400);
+		if (!conversationId || !supportNeed) return c.json({ error: "conversationId and a valid supportNeed are required" }, 400);
 		const state = setInteractionState({
-			sessionKey,
+			conversationId,
 			signal: {
 				supportNeed,
 				confidence: 1,

package/dist/src/gateway/hono/routes/logs.js

@@ -12,8 +12,8 @@ function registerLogsRoutes(authenticated, _deps) {
 			q: query.q,
 			module: query.module,
 			requestId: query.requestId,
-			sessionKey: query.sessionKey,
-			sessionId: query.sessionId,
+			conversationId: query.conversationId,
+			transcriptId: query.transcriptId,
 			limit: query.limit ? parseInt(query.limit) : 100,
 			offset: query.offset ? parseInt(query.offset) : 0
 		});

package/dist/src/gateway/hono/routes/media.js

@@ -63,15 +63,15 @@ function registerMediaRoutes(authenticated, deps) {
 			ok: false,
 			error: { message: "Missing uri" }
 		}, 400);
-		const sessionKey = c.req.query("sessionKey");
+		const conversationId = c.req.query("conversationId");
 		const taskId = c.req.query("taskId");
-		if (!sessionKey && !taskId) return c.json({
+		if (!conversationId && !taskId) return c.json({
 			ok: false,
 			error: { message: "Missing media scope" }
 		}, 400);
 		try {
 			const { buffer, path } = await readMediaReference((await resolveScopedMediaReference(deps.service, uriRaw.trim(), {
-				sessionKey,
+				conversationId,
 				taskId
 			})).uri, MAX_WEBCHAT_ATTACHMENT_FILE_BYTES);
 			const contentType = mimeTypeFromMediaPath(path);