@xopcai/xopc 0.0.302 → 0.0.306

package/dist/src/gateway/hono/routes/auth-registry-extensions.js

@@ -1,8 +1,8 @@
 import { getAllModels, getAvailableModels, init_providers } from "../../../providers/index.js";
 import { ActivationPlanner } from "../../../extensions/activation-planner.js";
 import { mergeActivationContext } from "../../../extensions/activation-context.js";
+import { validateExtensionConfig } from "../../../extensions/config-validation.js";
 import { fetchRegistry, listExtensions, searchExtensions } from "../../../extensions/marketplace.js";
-import { buildWhenContextSnapshot } from "../../../extensions/when-context.js";
 import { createOAuthAsyncHandler } from "../oauth-async.js";
 import { createOAuthHandler } from "../oauth.js";
 import { extensionAssetMimeType } from "../lib/extension-assets.js";
@@ -265,22 +265,59 @@ function registerAuthRegistryExtensionsRoutes(authenticated, deps) {
 	});
 	authenticated.get("/api/extensions/:id/config", async (c) => {
 		const extensionId = c.req.param("id");
-		return c.json(await loadExtensionStore(`__config__${extensionId}`));
+		const configured = service.currentConfig.extensions?.[extensionId];
+		const config = configured && typeof configured === "object" && !Array.isArray(configured) ? configured : {};
+		return c.json(config);
 	});
 	authenticated.patch("/api/extensions/:id/config", async (c) => {
 		const extensionId = c.req.param("id");
 		const patch = await c.req.json().catch(() => null);
 		if (!patch || typeof patch !== "object" || Array.isArray(patch)) return c.json({ error: "Request body must be a JSON object" }, 400);
-		const namespace = `__config__${extensionId}`;
-		const config = await loadExtensionStore(namespace);
-		Object.assign(config, patch);
-		await saveExtensionStore(namespace, config);
+		const loader = service.getExtensionLoader();
+		if (!loader) return c.json({ error: "Extensions unavailable" }, 503);
+		const extension = loader.discoverExtensions().find((entry) => entry.id === extensionId);
+		if (!extension) return c.json({ error: "Extension not found" }, 404);
+		const current = service.currentConfig.extensions?.[extensionId];
+		const config = {
+			...current && typeof current === "object" && !Array.isArray(current) ? current : {},
+			...patch
+		};
+		const validation = validateExtensionConfig(extension.manifest.configSchema, config);
+		if (validation.valid === false) return c.json({ error: `Invalid extension config: ${validation.reason}` }, 400);
+		const extensions = {
+			...service.currentConfig.extensions ?? {},
+			[extensionId]: config
+		};
+		const result = await service.updateConfig({ extensions });
+		if (!result.updated) return c.json({ error: result.error ?? "Failed to update config" }, 500);
 		return c.json({ ok: true });
 	});
-	authenticated.get("/api/context", (c) => {
-		const loader = service.getExtensionLoader();
-		const snapshot = buildWhenContextSnapshot(service.currentConfig, loader);
-		return c.json(snapshot);
+	authenticated.all("/api/extensions/:id/runtime/*", async (c) => {
+		const extensionId = c.req.param("id");
+		const prefix = `/api/extensions/${extensionId}/runtime`;
+		const path = c.req.path.slice(prefix.length) || "/";
+		const handler = service.getExtensionRegistry()?.getHttpRoute(extensionId, path);
+		if (!handler) return c.json({ error: "Extension route not found" }, 404);
+		const contentType = c.req.header("content-type") ?? "";
+		let body;
+		if (c.req.method !== "GET" && c.req.method !== "HEAD") body = contentType.includes("application/json") ? await c.req.json().catch(() => void 0) : await c.req.text().catch(() => void 0);
+		const response = await handler({
+			method: c.req.method,
+			url: c.req.url,
+			headers: c.req.header(),
+			body
+		});
+		const headers = new Headers(response.headers);
+		let responseBody = null;
+		if (response.body !== void 0) if (typeof response.body === "string" || response.body instanceof Uint8Array) responseBody = response.body;
+		else {
+			headers.set("Content-Type", headers.get("Content-Type") ?? "application/json; charset=utf-8");
+			responseBody = JSON.stringify(response.body);
+		}
+		return new Response(responseBody, {
+			status: response.status,
+			headers
+		});
 	});
 	authenticated.get("/api/marketplace", async (c) => {
 		const q = c.req.query("q");

package/dist/src/gateway/hono/routes/devices.js

@@ -1,4 +1,4 @@
-import { devicePairingInvitationPayloadSchema, devicePairingTargetKindSchema, formatBrowserPairingInvitation } from "../../../../packages/gateway-contract/src/device-pairing.js";
+import { browserPairingInvitationPayloadSchema, devicePairingTargetKindSchema, formatBrowserPairingInvitation, formatMobilePairingInvitation } from "../../../../packages/gateway-contract/src/device-pairing.js";
 import { init_src } from "../../../../packages/gateway-contract/src/index.js";
 import { listDevices, revokeDevice, rotateDeviceRefreshToken } from "../../../storage/sqlite/device-access-repository.js";
 import { getGatewayIdentityPublicKeyRaw, getOrCreateGatewayIdentity, signGatewayPayload } from "../../../storage/sqlite/gateway-identity-repository.js";
@@ -23,9 +23,6 @@ const refreshRequestSchema = z.strictObject({
 });
 const pairingProbeSchema = z.strictObject({ pairingId: z.string().uuid() });
 const pairingSetupSchema = z.strictObject({ targetKind: devicePairingTargetKindSchema });
-function pairingPayload(input) {
-	return Buffer.from(JSON.stringify(devicePairingInvitationPayloadSchema.parse(input))).toString("base64url");
-}
 function registerDeviceAuthPublicRoutes(app, options) {
 	app.post("/api/gateway-identity/challenge", bodyLimit({ maxSize: 512 }), async (c) => {
 		const budget = buckets.identityChallenge().consume("gateway");
@@ -154,7 +151,14 @@ function registerDeviceRoutes(authenticated, deps) {
 		}, 409);
 		const setup = createDevicePairingSetup(routes, Date.now(), { targetKind: parsed.data.targetKind });
 		const identity = getOrCreateGatewayIdentity();
-		const encoded = pairingPayload({
+		const invitation = setup.targetKind === "mobile" ? { universalLink: formatMobilePairingInvitation({
+			version: 4,
+			pairingToken: setup.token,
+			gatewayId: identity.id,
+			gatewayPublicKey: getGatewayIdentityPublicKeyRaw(identity),
+			origins: routes.map((route) => route.url),
+			expiresAt: setup.expiresAt
+		}) } : { browserInvitation: formatBrowserPairingInvitation(Buffer.from(JSON.stringify(browserPairingInvitationPayloadSchema.parse({
 			version: 3,
 			pairingToken: setup.token,
 			gatewayId: identity.id,
@@ -163,8 +167,7 @@ function registerDeviceRoutes(authenticated, deps) {
 			routes,
 			targetKind: setup.targetKind,
 			expiresAt: setup.expiresAt
-		});
-		const invitation = setup.targetKind === "mobile" ? { universalLink: `https://link.xopc.ai/connect#p=${encoded}` } : { browserInvitation: formatBrowserPairingInvitation(encoded) };
+		}))).toString("base64url")) };
 		return c.json({
 			ok: true,
 			setup: {

package/dist/src/gateway/hono/routes/endpoint-compatibility.js

@@ -1,5 +1,6 @@
 import { init_src } from "../../../../packages/endpoint-tools-protocol/src/index.js";
 import { COMPUTER_DESCRIPTOR, COMPUTER_FRAME_MAX_BYTES, init_src as init_src$1 } from "../../../../packages/computer-control-contract/src/index.js";
+import { REALTIME_CAPABILITIES } from "../../../../packages/realtime-protocol/src/index.js";
 //#region src/gateway/hono/routes/endpoint-compatibility.ts
 init_src$1();
 init_src();
@@ -10,6 +11,11 @@ function registerEndpointCompatibilityRoutes(authenticated) {
 			ok: true,
 			payload: {
 				realtimeProtocolVersion: 2,
+				realtime: {
+					minVersion: 2,
+					maxVersion: 2,
+					capabilities: REALTIME_CAPABILITIES
+				},
 				endpointProtocolVersion: 2,
 				computerControl: COMPUTER_DESCRIPTOR,
 				computerFrameUploadMaxBytes: COMPUTER_FRAME_MAX_BYTES

package/dist/src/gateway/hono/routes/extension-gateway.js

@@ -1,39 +1,6 @@
 //#region src/gateway/hono/routes/extension-gateway.ts
 function registerExtensionGatewayRoutes(authenticated, deps) {
 	const { service } = deps;
-	const extensionRegistry = service.getExtensionRegistry?.();
-	if (extensionRegistry) {
-		const httpRoutes = extensionRegistry.httpRoutes;
-		for (const [path, handler] of httpRoutes) {
-			authenticated.post(path, async (c) => {
-				const response = await handler({
-					method: c.req.method,
-					url: c.req.url,
-					headers: c.req.header(),
-					body: await c.req.json().catch(() => ({}))
-				});
-				if (response) {
-					if (response.status) c.status(response.status);
-					if (response.headers) for (const [key, value] of Object.entries(response.headers)) c.header(key, String(value));
-					if (response.body !== void 0) return c.json(response.body);
-				}
-				return c.text("");
-			});
-			authenticated.get(path, async (c) => {
-				const response = await handler({
-					method: c.req.method,
-					url: c.req.url,
-					headers: c.req.header()
-				});
-				if (response) {
-					if (response.status) c.status(response.status);
-					if (response.headers) for (const [key, value] of Object.entries(response.headers)) c.header(key, String(value));
-					if (response.body !== void 0) return c.json(response.body);
-				}
-				return c.text("");
-			});
-		}
-	}
 	authenticated.post("/api/gateway/:method", async (c) => {
 		const method = c.req.param("method");
 		const params = await c.req.json().catch(() => ({}));

package/dist/src/gateway/hono/routes/imports.js

@@ -1,10 +1,10 @@
-import { getGatewayPrincipal } from "../../security/gateway-principal.js";
 import { ImportError } from "../../../imports/types.js";
 import { isImportSource } from "../../../imports/sources.js";
 import { ImportSelectionRepository } from "../../../storage/sqlite/import-selection-repository.js";
 import { getLiveInventory, previewInventoryItem, publicInventory, scanProduct } from "../../../imports/inventory.js";
 import { importSelection, listImportSources } from "../../../imports/productImport.js";
 import { createRuntimeImportService } from "../../../imports/runtime.js";
+import { getGatewayPrincipal } from "../../security/gateway-principal.js";
 import { z } from "zod";
 //#region src/gateway/hono/routes/imports.ts
 const selectionSchema = z.object({

package/dist/src/gateway/hono/routes/lazy-bundles.js

@@ -182,7 +182,6 @@ const AUTHENTICATED_LAZY_ROUTE_BUNDLES = [
 			"/api/auth",
 			"/api/registry",
 			"/api/extensions",
-			"/api/context",
 			"/api/marketplace"
 		]),
 		load: async () => {

package/dist/src/gateway/hono/routes/local-apps.js

@@ -1,6 +1,6 @@
 import { readLocalAppAcceptanceConfig } from "../../../local-apps/acceptance.js";
-import { extensionAssetMimeType } from "../lib/extension-assets.js";
 import { LOCAL_APP_RUNTIME_BRIDGE_HASH, injectLocalAppRuntimeBridge } from "../../../local-apps/preview-runtime-bridge.js";
+import { extensionAssetMimeType } from "../lib/extension-assets.js";
 import { relative, resolve } from "node:path";
 import { existsSync, readFileSync, statSync } from "node:fs";
 //#region src/gateway/hono/routes/local-apps.ts

package/dist/src/gateway/hono/routes/realtime.js

@@ -1,10 +1,11 @@
-import { realtimeClientKindSchema } from "../../../../packages/realtime-protocol/src/index.js";
+import { REALTIME_CAPABILITIES, realtimeClientKindSchema } from "../../../../packages/realtime-protocol/src/index.js";
 import { getGatewayPrincipal } from "../../security/gateway-principal.js";
 import { z } from "zod";
 //#region src/gateway/hono/routes/realtime.ts
 const ticketRequestSchema = z.strictObject({
 	clientId: z.string().min(1).max(160),
-	clientKind: realtimeClientKindSchema
+	clientKind: realtimeClientKindSchema,
+	protocolVersion: z.number().int().positive()
 });
 function registerRealtimeRoutes(authenticated, deps) {
 	authenticated.post("/api/realtime/tickets", async (c) => {
@@ -16,16 +17,37 @@ function registerRealtimeRoutes(authenticated, deps) {
 				message: "Invalid realtime ticket request"
 			}
 		}, 400);
+		if (parsed.data.protocolVersion !== 2) {
+			const clientIsOlder = parsed.data.protocolVersion < 2;
+			return c.json({
+				ok: false,
+				error: {
+					code: clientIsOlder ? "CLIENT_UPDATE_REQUIRED" : "GATEWAY_UPDATE_REQUIRED",
+					message: clientIsOlder ? "Update the client to connect to this Gateway." : "Update the Gateway to connect this client.",
+					retryable: false,
+					clientProtocolVersion: parsed.data.protocolVersion,
+					gatewayProtocolVersion: 2
+				}
+			}, 426);
+		}
 		try {
 			const principal = getGatewayPrincipal(c);
+			const ticket = deps.service.realtime.tickets.issue(parsed.data.clientId, parsed.data.clientKind, {
+				principalId: principal.principalId,
+				...principal.deviceId ? { deviceId: principal.deviceId } : {},
+				...principal.accessSessionId ? { accessSessionId: principal.accessSessionId } : {},
+				scopes: principal.scopes
+			});
 			return c.json({
 				ok: true,
-				payload: deps.service.realtime.tickets.issue(parsed.data.clientId, parsed.data.clientKind, {
-					principalId: principal.principalId,
-					...principal.deviceId ? { deviceId: principal.deviceId } : {},
-					...principal.accessSessionId ? { accessSessionId: principal.accessSessionId } : {},
-					scopes: principal.scopes
-				})
+				payload: {
+					...ticket,
+					realtime: {
+						minVersion: 2,
+						maxVersion: 2,
+						capabilities: REALTIME_CAPABILITIES
+					}
+				}
 			});
 		} catch (error) {
 			return c.json({

package/dist/src/gateway/hono/routes/update.js

@@ -1,11 +1,11 @@
 import { PACKAGE_VERSION, init_package_version } from "../../../package-version.js";
 import { loadConfig } from "../../../config/loader.js";
 import "../../../config/index.js";
-import { acquireUpdateLock } from "../../../infra/update-lock.js";
 import { normalizeUpdateChannel } from "../../../infra/update-channels.js";
+import { acquireUpdateLock } from "../../../infra/update-lock.js";
+import { formatUpdateApiResult, runGatewayUpdateWithPostSteps } from "../../../infra/update-runner.js";
 import { getUpdateAvailable, runGatewayUpdateCheck } from "../../../infra/update-startup.js";
 import { createGatewayRouteLogger } from "../lib/route-logger.js";
-import { formatUpdateApiResult, runGatewayUpdateWithPostSteps } from "../../../infra/update-runner.js";
 import { streamSSE } from "hono/streaming";
 //#region src/gateway/hono/routes/update.ts
 init_package_version();

package/dist/src/gateway/hono/routes/user-model.js

@@ -1,5 +1,5 @@
 import { createCollaborationRule, getCollaborationRule, listCollaborationRules, setCollaborationRuleStatus } from "../../../storage/sqlite/collaboration-rule-repository.js";
-import { getKnowledgeItem, listKnowledgeItems, searchKnowledgeItems, setKnowledgeStatus } from "../../../knowledge-memory/repository.js";
+import { KnowledgeReviewConflictError, getKnowledgeItem, listKnowledgeItems, reviewKnowledgeItem, searchKnowledgeItems } from "../../../knowledge-memory/repository.js";
 import "../../../knowledge-memory/index.js";
 import { createPriorityWindow, createUserGoal, listPriorityWindows, listUserGoals, setUserGoalStatus } from "../../../user-model/goals.js";
 import { getAssertionSlot, getUserAssertion, listUserAssertionSources, listUserAssertions, reconcileAssertion, setAssertionStatus } from "../../../user-model/repository.js";
@@ -83,6 +83,12 @@ const GOAL_STATUSES = new Set([
 	"achieved",
 	"abandoned"
 ]);
+const KNOWLEDGE_REVIEW_ACTIONS = new Set([
+	"approve",
+	"edit_and_approve",
+	"reject",
+	"archive"
+]);
 const KNOWLEDGE_STATUSES = new Set([
 	"candidate",
 	"active",
@@ -399,12 +405,25 @@ function registerUserModelRoutes(authenticated, deps) {
 		const item = getKnowledgeItem(c.req.param("id"));
 		return item ? c.json({ item }) : c.json({ error: "Knowledge item not found" }, 404);
 	});
-	authenticated.patch("/api/knowledge-memory/:id/status", write, async (c) => {
+	authenticated.post("/api/knowledge-memory/:id/review", write, async (c) => {
 		const input = await body(c);
-		const status = String(input?.status ?? "");
-		if (!KNOWLEDGE_STATUSES.has(status)) return c.json({ error: "Invalid knowledge status" }, 400);
-		const item = setKnowledgeStatus(c.req.param("id"), status);
-		return item ? c.json({ item }) : c.json({ error: "Knowledge item not found" }, 404);
+		const action = String(input?.action ?? "");
+		if (!KNOWLEDGE_REVIEW_ACTIONS.has(action)) return c.json({ error: "Invalid knowledge review action" }, 400);
+		if (input?.expectedStatus !== void 0 && !KNOWLEDGE_STATUSES.has(String(input.expectedStatus))) return c.json({ error: "Invalid expected knowledge status" }, 400);
+		if (input?.content !== void 0 && action !== "edit_and_approve") return c.json({ error: "Content can only be changed while editing and approving knowledge" }, 400);
+		try {
+			const item = reviewKnowledgeItem({
+				id: c.req.param("id"),
+				action,
+				actor: "user",
+				reason: typeof input?.reason === "string" && input.reason.trim() ? input.reason : `Knowledge ${action} by user.`,
+				...typeof input?.expectedStatus === "string" ? { expectedStatus: input.expectedStatus } : {},
+				...typeof input?.content === "string" ? { content: input.content } : {}
+			});
+			return item ? c.json({ item }) : c.json({ error: "Knowledge item not found" }, 404);
+		} catch (error) {
+			return c.json({ error: errorMessage(error) }, error instanceof KnowledgeReviewConflictError ? 409 : 400);
+		}
 	});
 	authenticated.get("/api/memory-maintenance/runs", (c) => c.json({ runs: listMemoryMaintenanceRuns(Math.max(1, Math.min(100, Number(c.req.query("limit") ?? 20)))) }));
 	authenticated.get("/api/turns/:turnId/execution-context", (c) => {

package/dist/src/gateway/index.js

@@ -1,5 +1,7 @@
+import { GatewayLockError, acquireGatewayLock, init_lock } from "./lock.js";
 import { buildDefaultCorsOrigins, isAllInterfacesHost, isLoopbackHost, resolveEffectiveGatewayPort, resolveGatewayServiceListenPort } from "./host.js";
 import { defaultGatewayBindMode, isContainerEnvironment, resolveGatewayBindHost, resolveGatewayBindHostSync, resolveGatewayBindMode, resolveGatewayEffectiveHost } from "../config/gateway-bind.js";
+import { checkPortAvailable, forceFreePortAndWait, listPortListeners, parseLsofOutput } from "./ports.js";
 import { assertGatewayAuthConfigured, extractToken, resolveGatewayAuth, validateToken } from "./auth.js";
 import { resolveGatewayListenHost, resolveGatewayListenPlan } from "./listen.js";
 import { buckets } from "./rate-limit/buckets.js";
@@ -10,10 +12,11 @@ import { restartGatewayProcessWithFreshPid } from "./respawn.js";
 import { GatewayService } from "./service.js";
 import { createHonoApp } from "./hono/app.js";
 import { GatewayServer } from "./server.js";
-import { GatewayLockError, acquireGatewayLock } from "./lock.js";
 import { runGatewayLoop } from "./run-loop.js";
-import { checkPortAvailable, forceFreePortAndWait, listPortListeners, parseLsofOutput } from "./ports.js";
 import { apiError, apiOk } from "./protocol.js";
 import "./hono/index.js";
 import { assertSecureGatewayHttpUrl, assertSecureWebSocketUrl, isInsecurePrivateWsAllowed, isSecureWebSocketUrl } from "./ws-security.js";
+//#region src/gateway/index.ts
+init_lock();
+//#endregion
 export { GatewayLockError, GatewayServer, GatewayService, acquireGatewayLock, apiError, apiOk, assertGatewayAuthConfigured, assertGatewayRuntimeConfig, assertSecureGatewayHttpUrl, assertSecureWebSocketUrl, buckets, buildDefaultCorsOrigins, checkPortAvailable, createHonoApp, defaultGatewayBindMode, extractToken, forceFreePortAndWait, isAllInterfacesHost, isContainerEnvironment, isGatewayStrictSecurityEnabled, isInsecurePrivateWsAllowed, isLoopbackHost, isSecureWebSocketUrl, listPortListeners, parseLsofOutput, resolveEffectiveGatewayPort, resolveGatewayAuth, resolveGatewayBindHost, resolveGatewayBindHostSync, resolveGatewayBindMode, resolveGatewayEffectiveHost, resolveGatewayListenHost, resolveGatewayListenPlan, resolveGatewayServiceListenPort, restartGatewayProcessWithFreshPid, runGatewayLoop, validateToken };

package/dist/src/gateway/lock.d.ts

@@ -16,4 +16,6 @@ export declare class GatewayLockError extends Error {
     readonly cause?: unknown;
     constructor(message: string, cause?: unknown);
 }
+export declare function resolveGatewayLockPath(configPath: string): string;
+export declare function isGatewayConfigLockedByAnotherProcessSync(configPath: string, currentPid?: number): boolean;
 export declare function acquireGatewayLock(configPath: string, opts?: GatewayLockOptions): Promise<GatewayLockHandle>;

package/dist/src/gateway/lock.js

@@ -1,3 +1,4 @@
+import { __esmMin } from "../../_virtual/_rolldown/runtime.js";
 import path from "node:path";
 import fs from "node:fs";
 import { createHash } from "node:crypto";
@@ -8,24 +9,25 @@ import { homedir } from "os";
 /**
 * Gateway Lock - Prevents multiple gateway instances from running simultaneously
 */
-const DEFAULT_TIMEOUT_MS = 5e3;
-const DEFAULT_POLL_INTERVAL_MS = 100;
-const DEFAULT_STALE_MS = 3e4;
-const DEFAULT_PORT_PROBE_TIMEOUT_MS = 1e3;
-var GatewayLockError = class extends Error {
-	constructor(message, cause) {
-		super(message);
-		this.cause = cause;
-		this.name = "GatewayLockError";
-	}
-};
 function resolveLockDir() {
 	return path.join(homedir(), ".xopc", "locks");
 }
-function resolveLockPath(configPath) {
+function resolveGatewayLockPath(configPath) {
 	const hash = createHash("sha256").update(configPath).digest("hex").slice(0, 8);
 	return path.join(resolveLockDir(), `gateway.${hash}.lock`);
 }
+function isGatewayConfigLockedByAnotherProcessSync(configPath, currentPid = process.pid) {
+	const lockPath = resolveGatewayLockPath(configPath);
+	try {
+		const parsed = JSON.parse(fs.readFileSync(lockPath, "utf8"));
+		if (typeof parsed.pid !== "number" || parsed.pid === currentPid || parsed.configPath !== configPath) return false;
+		if (!isPidAlive(parsed.pid)) return false;
+		if (process.platform !== "linux" || !Number.isFinite(parsed.startTime)) return true;
+		return readLinuxStartTime(parsed.pid) === parsed.startTime;
+	} catch {
+		return false;
+	}
+}
 async function checkPortFree(port, host = "127.0.0.1") {
 	return new Promise((resolve) => {
 		const socket = net.createConnection({
@@ -104,7 +106,7 @@ async function acquireGatewayLock(configPath, opts = {}) {
 	const pollIntervalMs = opts.pollIntervalMs ?? DEFAULT_POLL_INTERVAL_MS;
 	const staleMs = opts.staleMs ?? DEFAULT_STALE_MS;
 	const port = opts.port;
-	const lockPath = resolveLockPath(configPath);
+	const lockPath = resolveGatewayLockPath(configPath);
 	await fs$1.mkdir(path.dirname(lockPath), { recursive: true });
 	const startedAt = Date.now();
 	let lastPayload = null;
@@ -160,5 +162,20 @@ async function acquireGatewayLock(configPath, opts = {}) {
 	}
 	throw new GatewayLockError(`Gateway already running${lastPayload?.pid ? ` (pid ${lastPayload.pid})` : ""}; lock timeout after ${timeoutMs}ms`);
 }
+var DEFAULT_TIMEOUT_MS, DEFAULT_POLL_INTERVAL_MS, DEFAULT_STALE_MS, DEFAULT_PORT_PROBE_TIMEOUT_MS, GatewayLockError;
+var init_lock = __esmMin((() => {
+	DEFAULT_TIMEOUT_MS = 5e3;
+	DEFAULT_POLL_INTERVAL_MS = 100;
+	DEFAULT_STALE_MS = 3e4;
+	DEFAULT_PORT_PROBE_TIMEOUT_MS = 1e3;
+	GatewayLockError = class extends Error {
+		constructor(message, cause) {
+			super(message);
+			this.cause = cause;
+			this.name = "GatewayLockError";
+		}
+	};
+}));
 //#endregion
-export { GatewayLockError, acquireGatewayLock };
+init_lock();
+export { GatewayLockError, acquireGatewayLock, init_lock, isGatewayConfigLockedByAnotherProcessSync, resolveGatewayLockPath };

package/dist/src/gateway/run-loop.js

@@ -1,14 +1,15 @@
+import { acquireGatewayLock, init_lock } from "./lock.js";
 import { loadConfig } from "../config/loader.js";
 import "../config/index.js";
 import { isRestartEnabled } from "../config/commands.flags.js";
+import { consumeGatewayRestartIntentSync, consumeGatewaySigusr1RestartAuthorization, isGatewaySigusr1RestartExternallyAllowed, resetGatewayRestartStateForInProcessRestart, scheduleGatewaySigusr1Restart, setGatewaySigusr1RestartPolicy } from "../infra/restart.js";
 import { runBootstrapMigrationsSync } from "../migrations/runner.js";
 import { restartGatewayProcessWithFreshPid } from "./respawn.js";
-import { acquireGatewayLock } from "./lock.js";
-import { consumeGatewayRestartIntentSync, consumeGatewaySigusr1RestartAuthorization, isGatewaySigusr1RestartExternallyAllowed, resetGatewayRestartStateForInProcessRestart, scheduleGatewaySigusr1Restart, setGatewaySigusr1RestartPolicy } from "../infra/restart.js";
 //#region src/gateway/run-loop.ts
 /**
 * Gateway Run Loop - Core run loop for gateway process management
 */
+init_lock();
 async function runGatewayLoop(opts) {
 	runBootstrapMigrationsSync(opts.configPath);
 	setGatewaySigusr1RestartPolicy({ allowExternal: isRestartEnabled(loadConfig(opts.configPath)) });

package/dist/src/gateway/security/gateway-scopes.d.ts

@@ -1,8 +1,5 @@
-export declare const GATEWAY_SCOPES: readonly ["voice.configure", "gateway.status", "agents.read", "agents.run", "sessions.read", "sessions.write", "workspace.read", "workspace.write", "tasks.read", "tasks.write", "automations.read", "automations.write", "notifications.self", "device.self", "gateway.admin"];
-export type GatewayScope = typeof GATEWAY_SCOPES[number];
-export declare const DEFAULT_MOBILE_SCOPES: readonly GatewayScope[];
-export declare const DEFAULT_BROWSER_EXTENSION_SCOPES: readonly GatewayScope[];
-export declare function isGatewayScope(value: unknown): value is GatewayScope;
+import { DEFAULT_BROWSER_EXTENSION_SCOPES, DEFAULT_MOBILE_SCOPES, GATEWAY_SCOPES, isGatewayScope, type GatewayScope } from '@xopcai/gateway-contract';
+export { DEFAULT_BROWSER_EXTENSION_SCOPES, DEFAULT_MOBILE_SCOPES, GATEWAY_SCOPES, isGatewayScope, type GatewayScope, };
 export declare function parseGatewayScopes(value: string): GatewayScope[];
 export declare function requiredGatewayScope(method: string, path: string): GatewayScope;
 export declare function hasGatewayScope(granted: readonly GatewayScope[], required: GatewayScope): boolean;

package/dist/src/gateway/security/gateway-scopes.js

@@ -1,49 +1,7 @@
+import { DEFAULT_BROWSER_EXTENSION_SCOPES, DEFAULT_MOBILE_SCOPES, GATEWAY_SCOPES, isGatewayScope } from "../../../packages/gateway-contract/src/gateway-scopes.js";
+import { init_src } from "../../../packages/gateway-contract/src/index.js";
 //#region src/gateway/security/gateway-scopes.ts
-const GATEWAY_SCOPES = [
-	"voice.configure",
-	"gateway.status",
-	"agents.read",
-	"agents.run",
-	"sessions.read",
-	"sessions.write",
-	"workspace.read",
-	"workspace.write",
-	"tasks.read",
-	"tasks.write",
-	"automations.read",
-	"automations.write",
-	"notifications.self",
-	"device.self",
-	"gateway.admin"
-];
-const KNOWN_GATEWAY_SCOPES = new Set(GATEWAY_SCOPES);
-const DEFAULT_MOBILE_SCOPES = [
-	"voice.configure",
-	"gateway.status",
-	"agents.read",
-	"agents.run",
-	"sessions.read",
-	"sessions.write",
-	"workspace.read",
-	"workspace.write",
-	"tasks.read",
-	"tasks.write",
-	"automations.read",
-	"automations.write",
-	"notifications.self",
-	"device.self"
-];
-const DEFAULT_BROWSER_EXTENSION_SCOPES = [
-	"gateway.status",
-	"agents.read",
-	"agents.run",
-	"sessions.read",
-	"sessions.write",
-	"device.self"
-];
-function isGatewayScope(value) {
-	return typeof value === "string" && KNOWN_GATEWAY_SCOPES.has(value);
-}
+init_src();
 function parseGatewayScopes(value) {
 	const parsed = JSON.parse(value);
 	if (!Array.isArray(parsed) || !parsed.every(isGatewayScope)) throw new Error("Stored device scopes are invalid");

package/dist/src/gateway/security/index.js

@@ -1,4 +1,5 @@
-import { DEFAULT_MOBILE_SCOPES, GATEWAY_SCOPES, hasGatewayScope, isGatewayScope, parseGatewayScopes, requiredGatewayScope } from "./gateway-scopes.js";
+import { DEFAULT_MOBILE_SCOPES, GATEWAY_SCOPES, isGatewayScope } from "../../../packages/gateway-contract/src/gateway-scopes.js";
+import { hasGatewayScope, parseGatewayScopes, requiredGatewayScope } from "./gateway-scopes.js";
 import { safeEqualSecret } from "./secret-equal.js";
 import { KNOWN_WEAK_GATEWAY_TOKEN_PLACEHOLDERS, assertGatewayAuthNotKnownWeak } from "./known-weak-secrets.js";
 import { auditGatewayConfig, collectGatewayConfigFindings, collectGatewaySecurityFindings, collectGatewayStartupGuardFindings } from "./audit.js";

package/dist/src/gateway/service/config-coordinator.js

@@ -6,9 +6,9 @@ import { init_providers } from "../../providers/index.js";
 import { disposeAllSessionMcpRuntimes } from "../../agent/mcp/bundle-mcp-runtime.js";
 import { reloadImageGenerationProviders } from "../../agent/image/generation/provider-registry.js";
 import "../../agent/mcp/bundle-mcp-tools.js";
-import { validateComputerModelChanges } from "../../computer/model-config.js";
 import { ConfigHotReloader } from "../../config/reload.js";
 import "../../config/index.js";
+import { validateComputerModelChanges } from "../../computer/model-config.js";
 import { computeBundledExtensionExtensionsPatch } from "../../extensions/bundled-extension-activation.js";
 import { sanitizeTunnelConfig } from "../../tunnel/tunnel-config.js";
 //#region src/gateway/service/config-coordinator.ts

package/dist/src/gateway/service.js

@@ -51,6 +51,7 @@ import { ExtensionLoader } from "../extensions/loader.js";
 import "../extensions/index.js";
 import { MessageBus, MessageBusShutdownError } from "../infra/bus/queue.js";
 import "../infra/bus/index.js";
+import { collectMediaUrisFromMessages, deleteMediaUris } from "../media/session-references.js";
 import { AgentService } from "../agent/service.js";
 import { ensureStarterAgentsInitialized } from "../agent/starter-agents.js";
 import { setPairingBroadcastSink } from "../channels/pairing/pairing-events.js";
@@ -65,18 +66,21 @@ import { ConnectionRecoveryService } from "../connectors/connection-recovery-ser
 import { startConnectorLearningCoordinator } from "../connectors/learning-coordinator.js";
 import { ConnectedSourceChangePublisher } from "../connectors/source-change-publisher.js";
 import { startConnectorSupervisor } from "../connectors/supervisor.js";
+import { EndpointToolRuntime } from "../endpoint-tools/runtime.js";
+import "../endpoint-tools/index.js";
 import { DiscussionService } from "../discussions/service.js";
 import { DiscussionOrganizer } from "../discussions/organizer.js";
 import { DiscussionLiveWorker } from "../discussions/live-worker.js";
 import { DiscussionOrganizerWorker } from "../discussions/organizer-worker.js";
 import { DiscussionSealer } from "../discussions/sealer.js";
 import "../discussions/index.js";
-import { EndpointToolRuntime } from "../endpoint-tools/runtime.js";
-import "../endpoint-tools/index.js";
+import { createBackgroundTask } from "../infra/background-task.js";
+import { scheduleGatewayUpdateCheck } from "../infra/update-startup.js";
+import { LocalAppService } from "../local-apps/service.js";
+import "../local-apps/index.js";
 import { assertGatewayAuthConfigured, extractToken, resolveGatewayAuth, validateToken } from "./auth.js";
 import { prepareAutomationAgentSession } from "./automation-agent-session.js";
 import { stopTailscaleExposure } from "./tailscale-lifecycle.js";
-import { createBackgroundTask } from "../infra/background-task.js";
 import { buildTaskAgentContext } from "../agent/source-context/task-context.js";
 import { deliverProactiveCard } from "../proactive/inbox/delivery.js";
 import { WorkDiscoveryService } from "../work-discovery/service.js";
@@ -106,11 +110,8 @@ import { assertGatewayRuntimeConfig } from "./runtime-config.js";
 import { auditGatewayConfig } from "./security/audit.js";
 import { getXopcCloudCatalogCoordinator } from "../providers/xopc-cloud-catalog-coordinator.js";
 import { ModelCatalogSyncService } from "../providers/model-catalog-sync-service.js";
-import { collectMediaUrisFromMessages, deleteMediaUris } from "../media/session-references.js";
 import { runBootstrapMigrationsSync } from "../migrations/runner.js";
 import { NotificationService } from "../notifications/service.js";
-import { LocalAppService } from "../local-apps/service.js";
-import "../local-apps/index.js";
 import { createRuntimeBrowserAutomationService } from "../browser/automations/runtime-service.js";
 import "../browser/automations/index.js";
 import { mapProductEventToProactive } from "../proactive/events/product-event-bridge.js";
@@ -120,7 +121,6 @@ import { ProactiveWorker } from "../proactive/execution/worker.js";
 import { ProactiveTemporalWorker } from "../proactive/temporal/worker.js";
 import { ProactiveInboxWorker } from "../proactive/inbox/worker.js";
 import "../proactive/index.js";
-import { scheduleGatewayUpdateCheck } from "../infra/update-startup.js";
 import { resolveChannelConnectDeferSet } from "./resolve-channel-connect-defer.js";
 import { restartGatewayProcessWithFreshPid } from "./respawn.js";
 import { GatewaySessionsApi } from "./service/sessions-api.js";
@@ -882,6 +882,7 @@ var GatewayService = class {
 		if (!this.extensionLoader) return;
 		try {
 			await this.extensionLoader.loadByActivationPlan({ phase: "startup" });
+			await this.extensionLoader.startServices();
 			this.registerExtensionChannelPlugins();
 			const reg = this.extensionLoader.getRegistry();
 			log.debug({
@@ -915,6 +916,7 @@ var GatewayService = class {
 			config: {}
 		};
 		await this.extensionLoader.loadExtension(extensionConfig);
+		await this.extensionLoader.startServices();
 		this.registerExtensionChannelPlugins();
 		if (!this.channelManager.getPlugin(channelId)) return;
 		await this.channelManager.initializeChannel(channelId);
@@ -924,6 +926,7 @@ var GatewayService = class {
 		if (!this.extensionLoader) return;
 		try {
 			await this.extensionLoader.loadByActivationPlan({ phase: "deferred" });
+			await this.extensionLoader.startServices();
 			this.registerExtensionChannelPlugins();
 			log.debug("Deferred-phase extensions loaded");
 		} catch (err) {
@@ -1311,6 +1314,7 @@ var GatewayService = class {
 		this.lastChannelConnectDeferMode = "auto";
 		this.lastChannelConnectDeferSource = "off";
 		await this.channelManager.stop();
+		await this.extensionLoader?.shutdown();
 		await this.automationService.stop();
 		this.stopAutomationProductEventBridge?.();
 		this.stopAutomationProductEventBridge = null;