@xopcai/xopc 0.0.291 → 0.0.293

package/dist/src/endpoint-tools/upload-service.js

@@ -1,19 +1,27 @@
 import { ENDPOINT_MAX_FILE_BYTES, init_src } from "../../packages/endpoint-tools-protocol/src/index.js";
+import { COMPUTER_FRAME_MAX_BYTES, COMPUTER_FRAME_MAX_PIXELS, init_src as init_src$1 } from "../../packages/computer-control-contract/src/index.js";
 import { join } from "node:path";
 import { mkdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";
 import crypto from "node:crypto";
 import sharp from "sharp";
 //#region src/endpoint-tools/upload-service.ts
+init_src$1();
 init_src();
 const GRANT_TTL_MS = 5 * 6e4;
 const ENDPOINT_UPLOAD_MAX_BYTES = ENDPOINT_MAX_FILE_BYTES;
 const DEFAULT_MAX_FILES = 8;
-var EndpointUploadError = class extends Error {};
+var EndpointUploadError = class extends Error {
+	constructor(message, code = "INVALID_UPLOAD_GRANT") {
+		super(message);
+		this.code = code;
+	}
+};
 var EndpointUploadService = class {
 	grants = /* @__PURE__ */ new Map();
 	files = /* @__PURE__ */ new Map();
 	frames = /* @__PURE__ */ new Map();
 	pruneTimer;
+	validatingFrames = /* @__PURE__ */ new Set();
 	constructor(rootDir) {
 		this.rootDir = rootDir;
 		mkdirSync(rootDir, {
@@ -31,7 +39,7 @@ var EndpointUploadService = class {
 			endpointId,
 			token,
 			expiresAt: now + GRANT_TTL_MS,
-			maxBytes: profile === "computer-frame" ? 5 * 1024 * 1024 : ENDPOINT_UPLOAD_MAX_BYTES,
+			maxBytes: profile === "computer-frame" ? COMPUTER_FRAME_MAX_BYTES : ENDPOINT_UPLOAD_MAX_BYTES,
 			maxFiles: profile === "computer-frame" ? 1 : DEFAULT_MAX_FILES,
 			uploadedFileIds: []
 		};
@@ -53,7 +61,7 @@ var EndpointUploadService = class {
 		if (grant.expiresAt <= now) throw new EndpointUploadError("Upload grant expired");
 		if (grant.profile === "computer-frame" && !params.validatedFrame) throw new EndpointUploadError("Computer frame requires image validation");
 		if (grant.uploadedFileIds.length >= grant.maxFiles) throw new EndpointUploadError("Upload grant file limit exceeded");
-		if (params.bytes.byteLength > grant.maxBytes) throw new EndpointUploadError("Uploaded file is too large");
+		if (params.bytes.byteLength > grant.maxBytes) throw new EndpointUploadError("Uploaded file is too large", "UPLOAD_TOO_LARGE");
 		if (!params.name || params.name.length > 255 || !params.mimeType || params.mimeType.length > 255) throw new EndpointUploadError("Uploaded file metadata is invalid");
 		const fileId = crypto.randomUUID();
 		const path = join(this.rootDir, fileId);
@@ -115,6 +123,7 @@ var EndpointUploadService = class {
 		const grant = this.grants.get(invocationId);
 		const actual = Buffer.from(token), expected = Buffer.from(grant?.token ?? "");
 		if (!grant || grant.endpointId !== endpointId || actual.length !== expected.length || !crypto.timingSafeEqual(actual, expected) || grant.expiresAt <= Date.now()) throw new EndpointUploadError("Upload grant is invalid or expired");
+		if (grant.uploadedFileIds.length >= grant.maxFiles) throw new EndpointUploadError("Upload grant file limit exceeded");
 		return {
 			maxBytes: grant.maxBytes,
 			profile: grant.profile
@@ -122,15 +131,24 @@ var EndpointUploadService = class {
 	}
 	async uploadValidated(params) {
 		const grant = this.getGrantLimits(params.invocationId, params.endpointId, params.token);
-		if (params.bytes.length > grant.maxBytes) throw new EndpointUploadError("Uploaded file is too large");
+		if (params.bytes.length > grant.maxBytes) throw new EndpointUploadError("Uploaded file is too large", "UPLOAD_TOO_LARGE");
 		if (grant.profile === "computer-frame") {
-			const metadata = await sharp(params.bytes, { limitInputPixels: 16e6 }).metadata();
-			const format = params.mimeType === "image/png" ? "png" : params.mimeType === "image/jpeg" ? "jpeg" : void 0;
-			if (!format || metadata.format !== format || !metadata.width || !metadata.height || metadata.width * metadata.height > 16e6 || (metadata.pages ?? 1) !== 1) throw new EndpointUploadError("Invalid computer frame image");
-			(await sharp(params.bytes, {
-				limitInputPixels: 16e6,
-				failOn: "warning"
-			}).raw().toBuffer()).fill(0);
+			if (this.validatingFrames.has(params.invocationId) || this.validatingFrames.size >= 2) throw new EndpointUploadError("Computer frame validation is busy", "UPLOAD_BUSY");
+			this.validatingFrames.add(params.invocationId);
+			try {
+				const metadata = await sharp(params.bytes, { limitInputPixels: COMPUTER_FRAME_MAX_PIXELS }).metadata();
+				const format = params.mimeType === "image/png" ? "png" : params.mimeType === "image/jpeg" ? "jpeg" : void 0;
+				if (!format || metadata.format !== format || !metadata.width || !metadata.height || metadata.width * metadata.height > 16e6 || (metadata.pages ?? 1) !== 1) throw new EndpointUploadError("Invalid computer frame image", "INVALID_COMPUTER_FRAME");
+				(await sharp(params.bytes, {
+					limitInputPixels: COMPUTER_FRAME_MAX_PIXELS,
+					failOn: "warning"
+				}).raw().toBuffer()).fill(0);
+			} catch (error) {
+				if (error instanceof EndpointUploadError) throw error;
+				throw new EndpointUploadError("Computer frame could not be decoded", "INVALID_COMPUTER_FRAME");
+			} finally {
+				this.validatingFrames.delete(params.invocationId);
+			}
 			return this.upload({
 				...params,
 				validatedFrame: true

package/dist/src/extensions/lockfile.js

@@ -1,7 +1,7 @@
 import { createLogger } from "../utils/logger/index.js";
 import { init_logger } from "../utils/logger.js";
-import { init_write_file_atomic, writeTextAtomic } from "../infra/write-file-atomic.js";
 import { init_paths, resolveExtensionsDir, resolveExtensionsLockPath } from "../config/paths.js";
+import { init_write_file_atomic, writeTextAtomic } from "../infra/write-file-atomic.js";
 import { dirname, join } from "path";
 import { existsSync } from "fs";
 import { mkdir, readFile } from "fs/promises";

package/dist/src/gateway/agents-admin.js

@@ -1,6 +1,6 @@
 import { init_agent_scope, listAgentEntries, normalizeAgentId, resolveAgentDir, resolveAgentProfileDir, resolveAgentWorkspaceDir, resolveDefaultAgentId, resolveUserPath, validateAgentIdForNewAgent } from "../agent/agent-scope.js";
-import { WORKSPACE_FILES, init_paths } from "../config/paths.js";
 import { resolveEffectiveAgentProfile } from "../config/agent-profile.js";
+import { WORKSPACE_FILES, init_paths } from "../config/paths.js";
 import { AGENT_PROFILE_MARKDOWN_SYSTEM_FILES, REQUIRED_AGENT_PROFILE_MARKDOWN_FILE_SET } from "../agent/context/workspace.js";
 import { isPathUnderWorkspace, resolveWorkspaceSafePath } from "./workspace-editor-path.js";
 import { seedAgentProfileMarkdownFiles } from "../agent/context/workspace-seed.js";

package/dist/src/gateway/file-path-classifier.js

@@ -1,7 +1,7 @@
 import { init_paths_state, resolveStateDir } from "../config/paths-state.js";
 import { init_agent_scope, resolveAgentProfileDir } from "../agent/agent-scope.js";
-import { init_paths, resolveConfigPath, resolveSkillsDir } from "../config/paths.js";
 import { extractProfileAgentId } from "../config/agent-profile.js";
+import { init_paths, resolveConfigPath, resolveSkillsDir } from "../config/paths.js";
 import { isBareProfileMarkdownFileName, resolveProfileMarkdownPathIfBareName } from "../agent/tools/tool-paths.js";
 import { isPathUnderWorkspace, resolveWorkspaceSafePath } from "./workspace-editor-path.js";
 import { basename, isAbsolute, resolve } from "node:path";

package/dist/src/gateway/hono/app.js

@@ -1,6 +1,7 @@
 import { createLogger } from "../../utils/logger/index.js";
 import { init_logger } from "../../utils/logger.js";
 import { listDevices } from "../../storage/sqlite/device-access-repository.js";
+import { ENDPOINT_MAX_FILE_BYTES, init_src } from "../../../packages/endpoint-tools-protocol/src/index.js";
 import { resolveAllowedBrowserOrigins, resolveGatewayServiceListenPort } from "../host.js";
 import { resolveGatewayEffectiveHost } from "../../config/gateway-bind.js";
 import { loadTunnelState } from "../../tunnel/tunnel-state.js";
@@ -31,6 +32,7 @@ import { createMiddleware } from "hono/factory";
 import { bodyLimit } from "hono/body-limit";
 import { getConnInfo } from "@hono/node-server/conninfo";
 //#region src/gateway/hono/app.ts
+init_src();
 init_logger();
 const log = createLogger("Gateway:App");
 /**
@@ -200,7 +202,8 @@ function createHonoApp(config) {
 	}));
 	app.use("/api/*", async (c, next) => {
 		const contentType = c.req.header("content-type");
-		const maxSize = c.req.method === "POST" && c.req.path === "/api/tasks" || c.req.method === "POST" && /^\/api\/sessions\/[^/]+\/inputs$/.test(c.req.path) || c.req.method === "POST" && /^\/api\/tasks\/[^/]+\/inputs$/.test(c.req.path) || c.req.method === "PATCH" && /^\/api\/sessions\/[^/]+\/inputs\/[^/]+$/.test(c.req.path) ? SESSION_INPUT_BODY_MAX : c.req.path === "/api/skills/upload" ? SKILL_UPLOAD_BODY_MAX : c.req.path === "/api/voice/transcriptions" ? VOICE_TRANSCRIBE_BODY_MAX : c.req.path === "/api/media" && c.req.method === "POST" ? MEDIA_UPLOAD_BODY_MAX : isNoteMediaUploadRequest(c.req.path, c.req.method, contentType) ? NOTE_MEDIA_BODY_MAX : isFileUploadRequest(c.req.path, c.req.method, contentType) ? NOTE_MEDIA_BODY_MAX : discussionUploadBodyMax(c.req.path, c.req.method, contentType) ?? DEFAULT_API_BODY_MAX;
+		const isAttachmentInputRequest = c.req.method === "POST" && c.req.path === "/api/tasks" || c.req.method === "POST" && /^\/api\/sessions\/[^/]+\/inputs$/.test(c.req.path) || c.req.method === "POST" && /^\/api\/tasks\/[^/]+\/inputs$/.test(c.req.path) || c.req.method === "PATCH" && /^\/api\/sessions\/[^/]+\/inputs\/[^/]+$/.test(c.req.path);
+		const maxSize = c.req.method === "POST" && /^\/api\/endpoint-tools\/invocations\/[^/]+\/files$/.test(c.req.path) ? ENDPOINT_MAX_FILE_BYTES : isAttachmentInputRequest ? SESSION_INPUT_BODY_MAX : c.req.path === "/api/skills/upload" ? SKILL_UPLOAD_BODY_MAX : c.req.path === "/api/voice/transcriptions" ? VOICE_TRANSCRIBE_BODY_MAX : c.req.path === "/api/media" && c.req.method === "POST" ? MEDIA_UPLOAD_BODY_MAX : isNoteMediaUploadRequest(c.req.path, c.req.method, contentType) ? NOTE_MEDIA_BODY_MAX : isFileUploadRequest(c.req.path, c.req.method, contentType) ? NOTE_MEDIA_BODY_MAX : discussionUploadBodyMax(c.req.path, c.req.method, contentType) ?? DEFAULT_API_BODY_MAX;
 		const maxSizeMb = Math.ceil(maxSize / (1024 * 1024));
 		return bodyLimit({
 			maxSize,

package/dist/src/gateway/hono/lib/config-payload.js

@@ -1,9 +1,9 @@
 import { ContextPlanningConfigSchema, KnowledgeMemoryConfigSchema, UserModelConfigSchema, init_config } from "../../../user-context/config.js";
 import { init_agent_scope, listAgentEntries, normalizeAgentId, resolveDefaultAgentId } from "../../../agent/agent-scope.js";
 import { resolveModelsJsonPath } from "../../../config/paths.js";
+import { buildChannelCatalogForConfig, buildChannelCatalogFromSnapshot, getChannelSetupStatus, init_channel_catalog_service } from "../../../channels/catalog/channel-catalog-service.js";
 import { init_models_json, loadModelsJson } from "../../../config/models-json.js";
 import { CredentialResolver, init_credentials } from "../../../auth/credentials.js";
-import { buildChannelCatalogForConfig, buildChannelCatalogFromSnapshot, getChannelSetupStatus, init_channel_catalog_service } from "../../../channels/catalog/channel-catalog-service.js";
 import { getProviderRegistry, init_plugin_registry } from "../../../providers/plugin-registry.js";
 import { getAllProviders, init_providers, isProviderConfigured } from "../../../providers/index.js";
 import { normalizeConfiguredMcpServers } from "../../../config/mcp-config-normalize.js";

package/dist/src/gateway/hono/routes/endpoint-compatibility.d.ts

@@ -0,0 +1,2 @@
+import type { Hono } from 'hono';
+export declare function registerEndpointCompatibilityRoutes(authenticated: Hono): void;

package/dist/src/gateway/hono/routes/endpoint-compatibility.js

@@ -0,0 +1,21 @@
+import { init_src } from "../../../../packages/endpoint-tools-protocol/src/index.js";
+import { COMPUTER_DESCRIPTOR, COMPUTER_FRAME_MAX_BYTES, init_src as init_src$1 } from "../../../../packages/computer-control-contract/src/index.js";
+//#region src/gateway/hono/routes/endpoint-compatibility.ts
+init_src$1();
+init_src();
+function registerEndpointCompatibilityRoutes(authenticated) {
+	authenticated.get("/api/endpoint-tools/compatibility", (c) => {
+		c.header("Cache-Control", "no-store");
+		return c.json({
+			ok: true,
+			payload: {
+				realtimeProtocolVersion: 2,
+				endpointProtocolVersion: 2,
+				computerControl: COMPUTER_DESCRIPTOR,
+				computerFrameUploadMaxBytes: COMPUTER_FRAME_MAX_BYTES
+			}
+		});
+	});
+}
+//#endregion
+export { registerEndpointCompatibilityRoutes };

package/dist/src/gateway/hono/routes/endpoint-tools.js

@@ -1,3 +1,5 @@
+import { createLogger } from "../../../utils/logger/index.js";
+import { init_logger } from "../../../utils/logger.js";
 import { getDevice } from "../../../storage/sqlite/device-access-repository.js";
 import { endpointPrincipalRegistrationSchema, endpointSessionBindingRequestSchema, init_src } from "../../../../packages/endpoint-tools-protocol/src/index.js";
 import { createEndpointPrincipal, getEndpointPrincipal, listEndpointPrincipals, revokeEndpointPrincipal } from "../../../storage/sqlite/endpoint-principal-repository.js";
@@ -8,6 +10,8 @@ import { ENDPOINT_UPLOAD_MAX_BYTES, EndpointUploadError } from "../../../endpoin
 import { getGatewayPrincipal } from "../../security/gateway-principal.js";
 //#region src/gateway/hono/routes/endpoint-tools.ts
 init_src();
+init_logger();
+const log = createLogger("EndpointUpload");
 async function readBoundedBody(body, maxBytes) {
 	if (!body) return new Uint8Array();
 	const reader = body.getReader();
@@ -18,19 +22,24 @@ async function readBoundedBody(body, maxBytes) {
 			const { done, value } = await reader.read();
 			if (done) break;
 			size += value.byteLength;
-			if (size > maxBytes) throw new EndpointUploadError("Uploaded file is too large");
+			if (size > maxBytes) {
+				value.fill(0);
+				throw new EndpointUploadError("Uploaded file is too large", "UPLOAD_TOO_LARGE");
+			}
 			chunks.push(value);
 		}
+		const bytes = new Uint8Array(size);
+		let offset = 0;
+		for (const chunk of chunks) {
+			bytes.set(chunk, offset);
+			offset += chunk.byteLength;
+		}
+		return bytes;
 	} finally {
+		await reader.cancel().catch(() => {});
+		for (const chunk of chunks) chunk.fill(0);
 		reader.releaseLock();
 	}
-	const bytes = new Uint8Array(size);
-	let offset = 0;
-	for (const chunk of chunks) {
-		bytes.set(chunk, offset);
-		offset += chunk.byteLength;
-	}
-	return bytes;
 }
 function registerEndpointToolRoutes(authenticated, deps) {
 	authenticated.get("/api/endpoint-tools/principals", (c) => {
@@ -228,16 +237,19 @@ function registerEndpointToolRoutes(authenticated, deps) {
 		const token = c.req.header("x-endpoint-upload-token") ?? "";
 		const name = c.req.query("name") ?? "";
 		const mimeType = c.req.header("content-type")?.split(";", 1)[0]?.trim() ?? "";
-		if (Number(c.req.header("content-length") ?? 0) > ENDPOINT_UPLOAD_MAX_BYTES) return c.json({
+		const declaredLength = Number(c.req.header("content-length") ?? 0);
+		if (declaredLength > ENDPOINT_UPLOAD_MAX_BYTES) return c.json({
 			ok: false,
 			error: {
 				code: "RESULT_TOO_LARGE",
 				message: "Uploaded file is too large"
 			}
 		}, 413);
+		let bytes;
 		try {
 			const limits = deps.service.endpointTools.uploads.getGrantLimits(invocationId, endpointId, token);
-			const bytes = await readBoundedBody(c.req.raw.body, limits.maxBytes);
+			if (declaredLength > limits.maxBytes) throw new EndpointUploadError("Uploaded file is too large", "UPLOAD_TOO_LARGE");
+			bytes = await readBoundedBody(c.req.raw.body, limits.maxBytes);
 			const file = await deps.service.endpointTools.uploads.uploadValidated({
 				invocationId,
 				endpointId,
@@ -258,14 +270,25 @@ function registerEndpointToolRoutes(authenticated, deps) {
 				}
 			}, 201);
 		} catch (error) {
-			const message = error instanceof Error ? error.message : String(error);
+			const code = error instanceof EndpointUploadError ? error.code : "UPLOAD_FAILED";
+			const status = code === "UPLOAD_TOO_LARGE" ? 413 : code === "UPLOAD_BUSY" ? 429 : 400;
+			log.warn({
+				invocationId,
+				endpointId,
+				phase: "frame_upload",
+				errorCode: code,
+				httpStatus: status,
+				size: bytes?.byteLength ?? declaredLength
+			}, `Endpoint upload rejected: ${code}`);
 			return c.json({
 				ok: false,
 				error: {
-					code: error instanceof EndpointUploadError ? "INVALID_UPLOAD_GRANT" : "UPLOAD_FAILED",
-					message
+					code,
+					message: error instanceof EndpointUploadError ? error.message : "Endpoint upload failed"
 				}
-			}, 400);
+			}, status);
+		} finally {
+			bytes?.fill(0);
 		}
 	});
 	authenticated.get("/api/endpoint-tools/files/:fileId", (c) => {

package/dist/src/gateway/hono/routes/lazy-bundles.js

@@ -3,6 +3,14 @@ function startsWithAny(path, prefixes) {
 	return prefixes.some((prefix) => path === prefix || path.startsWith(`${prefix}/`));
 }
 const AUTHENTICATED_LAZY_ROUTE_BUNDLES = [
+	{
+		id: "endpoint-compatibility",
+		match: (path) => path === "/api/endpoint-tools/compatibility",
+		load: async () => {
+			const { registerEndpointCompatibilityRoutes } = await import("./endpoint-compatibility.js");
+			return { register: registerEndpointCompatibilityRoutes };
+		}
+	},
 	{
 		id: "imports",
 		match: (path) => startsWithAny(path, ["/api/imports"]),

package/dist/src/gateway/hono/routes/models.js

@@ -1,5 +1,5 @@
-import { init_resolve_config_value, testApiKeyResolution } from "../../../config/resolve-config-value.js";
 import { resolveModelsJsonPath } from "../../../config/paths.js";
+import { init_resolve_config_value, testApiKeyResolution } from "../../../config/resolve-config-value.js";
 import { computerModelProfile, init_model_policy } from "../../../computer/model-policy.js";
 import { init_models_json, loadModelsJson, saveModelsJson, validateModelsConfig } from "../../../config/models-json.js";
 import { getModelCatalogStore, init_model_catalog_store } from "../../../providers/model-catalog-store.js";

package/dist/src/gateway/service/config-coordinator.js

@@ -1,7 +1,7 @@
 import { createLogger } from "../../utils/logger/index.js";
 import { init_logger } from "../../utils/logger.js";
-import { getModelRegistry } from "../../providers/model-registry.js";
 import { loadConfig, saveConfig } from "../../config/loader.js";
+import { getModelRegistry } from "../../providers/model-registry.js";
 import { init_providers } from "../../providers/index.js";
 import { disposeAllSessionMcpRuntimes } from "../../agent/mcp/bundle-mcp-runtime.js";
 import { reloadImageGenerationProviders } from "../../agent/image/generation/provider-registry.js";

package/dist/src/gateway/service.js

@@ -13,17 +13,17 @@ import { getSessionConfig } from "../storage/sqlite/config-repository.js";
 import "../storage/sqlite/index.js";
 import { getAgentDefaultModelRef, init_schema } from "../config/schema.js";
 import { init_agent_scope, listAgentEntries, normalizeAgentId, resolveAgentWorkspaceDir, resolveDefaultAgentId } from "../agent/agent-scope.js";
+import { init_agent_session_key, resolveAgentMainConversationId } from "../routing/agent-session-key.js";
+import { init_session_key, resolveConversationId, sanitizeSegment } from "../routing/session-key.js";
+import { getDefaultAgentId, init_resolve_route } from "../routing/resolve-route.js";
+import { resolveEffectiveAgentProfileForSession } from "../config/agent-profile.js";
 import { init_paths, resolveConfigPath, resolveExtensionsDir } from "../config/paths.js";
-import { prewarmModelRegistry } from "../providers/model-registry.js";
 import { areExtensionsGloballyDisabled } from "../extensions/discover-extensions.js";
 import { buildExtensionMetadataSnapshot } from "../extensions/extension-metadata-snapshot.js";
 import { buildChannelCatalogForConfig, buildChannelCatalogFromSnapshot, init_channel_catalog_service } from "../channels/catalog/channel-catalog-service.js";
 import { loadConfig, saveConfig } from "../config/loader.js";
-import { init_agent_session_key, resolveAgentMainConversationId } from "../routing/agent-session-key.js";
-import { init_session_key, resolveConversationId, sanitizeSegment } from "../routing/session-key.js";
-import { getDefaultAgentId, init_resolve_route } from "../routing/resolve-route.js";
+import { prewarmModelRegistry } from "../providers/model-registry.js";
 import { init_providers, providers_exports } from "../providers/index.js";
-import { resolveEffectiveAgentProfileForSession } from "../config/agent-profile.js";
 import { TaskRepository } from "../tasks/task-repository.js";
 import { TaskConversationRepository } from "../tasks/task-conversation-repository.js";
 import { getEmbeddedExecutionSession } from "../agent/embedded/execution-context.js";

package/dist/src/providers/auth-runtime/resolve-auth.js

@@ -1,5 +1,5 @@
-import { getApiKeyFromEnv, init_env_keys } from "../env-keys.js";
 import { init_sync_provider_auth, resolveProviderApiKeyForAgentSync } from "../../auth/sync-provider-auth.js";
+import { getApiKeyFromEnv, init_env_keys } from "../env-keys.js";
 import { getDefaultAuthProfileStore } from "./auth-profile-store.js";
 //#region src/providers/auth-runtime/resolve-auth.ts
 init_env_keys();

package/dist/src/providers/index.js

@@ -1,11 +1,11 @@
 import { __esmMin, __exportAll } from "../../_virtual/_rolldown/runtime.js";
 import { getAgentDefaultModelRef, init_schema } from "../config/schema.js";
+import { getModelOAuthProviderIds, init_registry } from "../auth/oauth/registry.js";
+import { hasProviderAuthOnDiskSync, init_sync_provider_auth } from "../auth/sync-provider-auth.js";
 import { PROVIDER_ENV_MAP, getApiKeyFromEnv, init_env_keys } from "./env-keys.js";
 import { init_model_ref, splitProviderModelRef } from "./model-ref.js";
 import { ModelRegistry, getModelRegistry, init_model_registry, prewarmModelRegistry, resetModelRegistry } from "./model-registry.js";
-import { getModelOAuthProviderIds, init_registry } from "../auth/oauth/registry.js";
 import { CredentialResolver, hasCredentials, init_credentials } from "../auth/credentials.js";
-import { hasProviderAuthOnDiskSync, init_sync_provider_auth } from "../auth/sync-provider-auth.js";
 import { EXTENSION_PROVIDER_BASE_URL, init_constants } from "./constants.js";
 import { applyOfficialModelMetadataCorrections, getSupplementalModels, init_model_supplements } from "./model-supplements.js";
 import { getProviderRegistry, init_plugin_registry } from "./plugin-registry.js";

package/dist/src/providers/model-catalog-persistence.js

@@ -1,7 +1,7 @@
 import { __esmMin } from "../../_virtual/_rolldown/runtime.js";
 import { init_paths_state, resolveXopcCloudCatalogCachePath } from "../config/paths-state.js";
-import { ComputerProfileSchema, init_src } from "../../packages/computer-control-contract/src/index.js";
 import { init_write_file_atomic, writeTextAtomic } from "../infra/write-file-atomic.js";
+import { ComputerProfileSchema, init_src } from "../../packages/computer-control-contract/src/index.js";
 import { voiceManifestSchema } from "../../packages/realtime-protocol/src/voice-catalog.js";
 import { init_voice } from "../../packages/realtime-protocol/src/voice.js";
 import { readFileSync, rmSync } from "node:fs";

package/dist/src/providers/model-registry.js

@@ -1,8 +1,8 @@
 import { __esmMin } from "../../_virtual/_rolldown/runtime.js";
 import { createLogger } from "../utils/logger/index.js";
 import { init_logger } from "../utils/logger.js";
-import { init_resolve_config_value, resolveConfigValue, resolveHeaders } from "../config/resolve-config-value.js";
 import { resolveModelsJsonPath } from "../config/paths.js";
+import { init_resolve_config_value, resolveConfigValue, resolveHeaders } from "../config/resolve-config-value.js";
 import { getDefaultModelValues, init_models_json, validateModelsConfig } from "../config/models-json.js";
 import { getApiKeyFromEnv, init_env_keys } from "./env-keys.js";
 import { getModelCatalogStore, init_model_catalog_store } from "./model-catalog-store.js";

package/dist/src/providers/register-runtime-providers.js

@@ -1,6 +1,6 @@
 import { __esmMin } from "../../_virtual/_rolldown/runtime.js";
-import { getModelCatalogStore, init_model_catalog_store } from "./model-catalog-store.js";
 import { getOAuthProviderDefinition, init_registry } from "../auth/oauth/registry.js";
+import { getModelCatalogStore, init_model_catalog_store } from "./model-catalog-store.js";
 import { XOPC_CLOUD_PROVIDER_ID, init_xopc_cloud_config, resolveXopcModelRouterUrl } from "./xopc-cloud-config.js";
 //#region src/providers/register-runtime-providers.ts
 function registerRuntimeProvider(modelRuntime, source) {

package/dist/src/realtime/runtime.js

@@ -1,6 +1,7 @@
 import { createLogger } from "../utils/logger/index.js";
 import { init_logger } from "../utils/logger.js";
 import { hasGatewayScope } from "../gateway/security/gateway-scopes.js";
+import { EndpointToolPolicyError } from "../endpoint-tools/policy.js";
 import { REALTIME_HEARTBEAT_INTERVAL_MS, REALTIME_HEARTBEAT_TIMEOUT_MS, REALTIME_HELLO_TIMEOUT_MS, REALTIME_MAX_CLIENT_FRAME_BYTES, parseClientRealtimeJsonFrame, parseClientRealtimeMessage } from "../../packages/realtime-protocol/src/index.js";
 import { createPreauthConnectionBudget } from "../gateway/security/preauth-connection-budget.js";
 import { RealtimeBroker } from "./broker.js";
@@ -246,6 +247,14 @@ var RealtimeRuntime = class {
 							turnToken: registration.turnToken
 						};
 					} catch (error) {
+						if (error instanceof EndpointToolPolicyError) {
+							log.warn({
+								err: error,
+								principalId: message.payload.endpoint.principalId
+							}, "Realtime endpoint contract is incompatible");
+							socket.close(4409, "GATEWAY_PROTOCOL_INCOMPATIBLE");
+							return;
+						}
 						log.warn({
 							err: error,
 							principalId: message.payload.endpoint.principalId

package/dist/src/tui/backends/embedded-backend.js

@@ -6,9 +6,9 @@ import { getSessionMetadata } from "../../storage/sqlite/session-repository.js";
 import "../../storage/sqlite/index.js";
 import { getAgentDefaultModelRef, init_schema } from "../../config/schema.js";
 import { init_agent_scope, listAgentEntries, normalizeAgentId } from "../../agent/agent-scope.js";
-import { loadConfig, saveConfig } from "../../config/loader.js";
 import { createConversation, init_conversation_repository } from "../../storage/sqlite/conversation-repository.js";
 import { init_agent_session_key, resolveAgentIdFromConversationId } from "../../routing/agent-session-key.js";
+import { loadConfig, saveConfig } from "../../config/loader.js";
 import { effectiveWorkspacePathForSession } from "../../session/session-workspace.js";
 import { ProjectService } from "../../projects/project-service.js";
 import { inferSuggestedProjectDefaultAgentId } from "../../projects/project-agent-suggestion.js";

package/dist/src/tui/tui-commands.js

@@ -1,9 +1,9 @@
 import { closeXopcDatabase, isXopcDatabaseOpen, openXopcDatabase } from "../storage/sqlite/connection.js";
 import { getSessionMetadata } from "../storage/sqlite/session-repository.js";
 import "../storage/sqlite/index.js";
+import { init_agent_session_key, isValidAgentId, normalizeAgentId } from "../routing/agent-session-key.js";
 import { resolveConfigPath } from "../config/paths.js";
 import { loadConfig } from "../config/loader.js";
-import { init_agent_session_key, isValidAgentId, normalizeAgentId } from "../routing/agent-session-key.js";
 import { init_providers, providerSupportsOAuth } from "../providers/index.js";
 import { TaskRepository } from "../tasks/task-repository.js";
 import { ProjectService } from "../projects/project-service.js";

package/dist/src/tui/tui-startup-resources.js

@@ -1,6 +1,6 @@
 import { resolveStateDir } from "../config/paths-state.js";
-import { init_paths, resolveAgentProfileDir, resolveBundledSkillsDir } from "../config/paths.js";
 import { resolveEffectiveAgentProfileForSession } from "../config/agent-profile.js";
+import { init_paths, resolveAgentProfileDir, resolveBundledSkillsDir } from "../config/paths.js";
 import { resolveBootstrapFilesSync } from "../agent/bootstrap/bootstrap-files.js";
 import { createSkillConfigManager, isSkillEnabled } from "../agent/skills/config.js";
 import { loadSkills } from "../agent/skills/index.js";

package/dist/src/tui/tui.js

@@ -1,10 +1,10 @@
 import { version } from "../../package.js";
 import { resolveStateDir, resolveXopcDatabasePath } from "../config/paths-state.js";
+import { init_agent_session_key, normalizeAgentId } from "../routing/agent-session-key.js";
+import { resolveEffectiveAgentProfileForSession } from "../config/agent-profile.js";
 import { init_paths } from "../config/paths.js";
 import { loadConfig } from "../config/loader.js";
-import { init_agent_session_key, normalizeAgentId } from "../routing/agent-session-key.js";
 import { getAllModels, getAllProviders, getApiKey, init_providers, isProviderConfiguredSync } from "../providers/index.js";
-import { resolveEffectiveAgentProfileForSession } from "../config/agent-profile.js";
 import { ProjectTrustStore, hasTrustRequiringProjectResources } from "../project-trust/trust-store.js";
 import { MAX_WEBCHAT_ATTACHMENT_FILE_BYTES } from "../gateway/chat-limits.js";
 import { renderWorkflowFinalSummary, renderWorkflowPanel } from "../agent/workflow/snapshot.js";

package/dist/src/work-discovery/service.js

@@ -7,14 +7,14 @@ import { ActivityService } from "../activity/service.js";
 import { getAgentDefaultModelRef, init_schema } from "../config/schema.js";
 import { init_session_key, resolveConversationId } from "../routing/session-key.js";
 import { getDefaultAgentId, init_resolve_route } from "../routing/resolve-route.js";
-import { init_providers, resolveModel } from "../providers/index.js";
-import { isLocalModelBaseUrl } from "../providers/model-call.js";
 import { resolveEffectiveAgentProfile } from "../config/agent-profile.js";
+import { init_providers, resolveModel } from "../providers/index.js";
 import { writeKnowledgeItem } from "../knowledge-memory/repository.js";
 import "../knowledge-memory/index.js";
 import { createPriorityWindow, createUserGoal } from "../user-model/goals.js";
 import { getAssertionSlot, getUserAssertion, linkAssertionEvidence, reconcileAssertion, setAssertionStatus } from "../user-model/repository.js";
 import "../user-model/index.js";
+import { isLocalModelBaseUrl } from "../providers/model-call.js";
 import { allowsRemoteSourceProcessing } from "../user-context/sources/processing-policy.js";
 import { analyzeUnderstandingSources, analyzeWorkContext, workDiscoveryResultMarkdown } from "./analyzer.js";
 import { createUnderstandingSourceRun, getUnderstandingSourceRun, updateUnderstandingSourceGrantCheckpoint, updateUnderstandingSourceGrantPolicies, updateUnderstandingSourceRun, upsertUnderstandingSourceGrant } from "../user-context/sources/repository.js";

package/dist/src/workflows/service/workflow-run-service.js

@@ -1,8 +1,8 @@
 import { TaskRunRepository, init_task_run_repository } from "../../tasks/task-run-repository.js";
 import { init_conversation_repository, resolveRoutedConversation } from "../../storage/sqlite/conversation-repository.js";
 import { getDefaultAgentId, init_resolve_route } from "../../routing/resolve-route.js";
-import { init_providers, resolveModel } from "../../providers/index.js";
 import { extractProfileAgentId, resolveEffectiveAgentProfile, resolveEffectiveAgentProfileForSession } from "../../config/agent-profile.js";
+import { init_providers, resolveModel } from "../../providers/index.js";
 import { TaskRepository } from "../../tasks/task-repository.js";
 import { TaskConversationRepository } from "../../tasks/task-conversation-repository.js";
 import { getProjectWorkspacePathForSession } from "../../projects/workspace.js";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@xopcai/xopc",
-  "version": "0.0.291",
+  "version": "0.0.293",
   "description": "Local-first personal AI assistant with reviewable user understanding, durable tasks, workflows, automations, and local or cloud models.",
   "type": "module",
   "main": "dist/src/index.js",

package/dist/gateway/static/root/assets/settings-advanced-gate-DuzZqQMn.js

@@ -1 +0,0 @@
-import{xn as e}from"./index-B7EieIE4.js";function t(t){let{children:n,fallback:r}=t,i=r===void 0?null:r;return e()?n:i}export{t};