@xopcai/xopc 0.0.303 → 0.0.307

package/dist/src/extensions/types/providers.d.ts

@@ -168,7 +168,7 @@ export interface ProviderResponse {
 }
 export interface ProviderRegistry {
     /** Register a provider */
-    register(provider: ProviderPlugin): void;
+    register(provider: ProviderPlugin): () => void;
     /** Get a provider by ID */
     get(id: string): ProviderPlugin | undefined;
     /** List all providers */

package/dist/src/extensions/types/registration.d.ts

@@ -37,15 +37,3 @@ export interface OAuthCredentials {
     refresh?: string;
     expiresAt?: number;
 }
-export interface FlagConfig {
-    type: 'boolean' | 'string';
-    default?: FlagValue;
-    description: string;
-    aliases?: string[];
-}
-export type FlagValue = boolean | string | undefined;
-export interface ShortcutConfig {
-    description: string;
-    handler: ShortcutHandler;
-}
-export type ShortcutHandler = (context: unknown) => void | Promise<void>;

package/dist/src/extensions/update.js

@@ -3,11 +3,12 @@ import { init_logger } from "../utils/logger.js";
 import { init_paths, resolveBundledExtensionsDir, resolveExtensionsDir } from "../config/paths.js";
 import { init_loader, loadConfig } from "../config/loader.js";
 import { downloadExtensionStoreZipBuffer, resolveExtensionZipDownloadUrl, resolveExtensionsStoreBaseUrl, verifyStoreArtifactSha256 } from "../agent/skills/marketplace/adapters/store/store-api-client.js";
-import { getExtensionLockfileManager } from "./lockfile.js";
-import { installExtensionFromStoreZip, installFromNpm } from "./install.js";
+import { computeExtensionDirectoryIntegrity, getExtensionLockfileManager } from "./lockfile.js";
+import { commitStagedExtensionInstall, finalizeStagedExtensionInstall, rollbackStagedExtensionInstall, stageExtensionNpm, stageExtensionStoreZip } from "./install-transaction.js";
 import { findExtension } from "./marketplace.js";
 import { join } from "node:path";
-import { existsSync, readFileSync, readdirSync, rmSync } from "node:fs";
+import { existsSync, readFileSync, readdirSync } from "node:fs";
+import { createHash } from "node:crypto";
 import semver from "semver";
 //#region src/extensions/update.ts
 /**
@@ -18,6 +19,35 @@ init_loader();
 init_logger();
 const log = createLogger("ExtensionUpdate");
 const MANIFEST = "xopc.extension.json";
+function readJsonObject(path) {
+	try {
+		const value = JSON.parse(readFileSync(path, "utf-8"));
+		return value && typeof value === "object" && !Array.isArray(value) ? value : void 0;
+	} catch {
+		return;
+	}
+}
+function installedSnapshots(targetDir, extensionId) {
+	const root = join(targetDir, extensionId);
+	return {
+		manifest: readJsonObject(join(root, MANIFEST)),
+		packageJson: readJsonObject(join(root, "package.json"))
+	};
+}
+async function commitStagedWithLock(transaction, lock, writeLock) {
+	const snapshot = await lock.load();
+	let lockWriteStarted = false;
+	try {
+		commitStagedExtensionInstall(transaction, true);
+		lockWriteStarted = true;
+		await writeLock();
+	} catch (error) {
+		rollbackStagedExtensionInstall(transaction);
+		if (lockWriteStarted) await lock.save(snapshot);
+		throw error;
+	}
+	finalizeStagedExtensionInstall(transaction);
+}
 function readInstalledExtensionVersion(targetDir, extensionId) {
 	const manifestPath = join(targetDir, extensionId, MANIFEST);
 	if (!existsSync(manifestPath)) return;
@@ -46,7 +76,9 @@ async function upsertNpmExtensionLock(lock, targetDir, result, spec) {
 		name: result.extensionId,
 		version: ver,
 		resolved,
-		source: "npm"
+		source: "npm",
+		installedIntegrity: computeExtensionDirectoryIntegrity(join(targetDir, result.extensionId)),
+		...installedSnapshots(targetDir, result.extensionId)
 	});
 }
 async function installExtensionFromStoreWithLock(params) {
@@ -54,20 +86,27 @@ async function installExtensionFromStoreWithLock(params) {
 		const { downloadUrl, version, sha256 } = await resolveExtensionZipDownloadUrl(params.storeBase, params.packageName, params.version);
 		const buf = await downloadExtensionStoreZipBuffer(params.storeBase, downloadUrl);
 		verifyStoreArtifactSha256(buf, sha256);
-		const result = await installExtensionFromStoreZip(buf, params.targetDir);
-		if (!result.ok || !result.extensionId) return {
-			ok: false,
-			error: result.error ?? "install failed"
-		};
-		await params.lock.upsert(result.extensionId, {
-			name: result.extensionId,
+		const transaction = await stageExtensionStoreZip(buf, params.targetDir);
+		if (transaction.extensionId !== params.expectedExtensionId) {
+			rollbackStagedExtensionInstall(transaction);
+			return {
+				ok: false,
+				error: `Expected extension ${params.expectedExtensionId}, received ${transaction.extensionId}`
+			};
+		}
+		await commitStagedWithLock(transaction, params.lock, () => params.lock.upsert(transaction.extensionId, {
+			name: transaction.extensionId,
 			version,
 			resolved: params.packageName,
-			source: "store"
-		});
+			source: "store",
+			artifactUrl: downloadUrl,
+			integrity: `sha256-${createHash("sha256").update(buf).digest("base64")}`,
+			installedIntegrity: computeExtensionDirectoryIntegrity(transaction.targetDir),
+			...installedSnapshots(params.targetDir, transaction.extensionId)
+		}));
 		return {
 			ok: true,
-			extensionId: result.extensionId,
+			extensionId: transaction.extensionId,
 			version
 		};
 	} catch (err) {
@@ -112,14 +151,10 @@ async function updateSingleExtension(params) {
 	const { extensionId, entry, targetDir, storeBase, lock, timeoutMs, logger } = params;
 	const currentVersion = readInstalledExtensionVersion(targetDir, extensionId);
 	if (entry.source === "store") {
-		const pkgName = entry.resolved?.trim() || extensionId;
-		if (existsSync(join(targetDir, extensionId))) rmSync(join(targetDir, extensionId), {
-			recursive: true,
-			force: true
-		});
 		const result = await installExtensionFromStoreWithLock({
 			storeBase,
-			packageName: pkgName,
+			packageName: entry.resolved?.trim() || extensionId,
+			expectedExtensionId: extensionId,
 			targetDir,
 			lock
 		});
@@ -153,13 +188,20 @@ async function updateSingleExtension(params) {
 		status: "skipped",
 		message: `Skipping "${extensionId}" (could not resolve npm package).`
 	};
-	if (existsSync(join(targetDir, extensionId))) rmSync(join(targetDir, extensionId), {
-		recursive: true,
-		force: true
-	});
-	const installResult = await installFromNpm(spec, targetDir, timeoutMs);
-	if (!installResult.ok) {
-		const message = installResult.error ?? "npm install failed";
+	let transaction;
+	try {
+		transaction = await stageExtensionNpm(spec, targetDir, timeoutMs);
+		if (transaction.extensionId !== extensionId) {
+			rollbackStagedExtensionInstall(transaction);
+			throw new Error(`Expected extension ${extensionId}, received ${transaction.extensionId}`);
+		}
+		await commitStagedWithLock(transaction, lock, () => upsertNpmExtensionLock(lock, targetDir, {
+			ok: true,
+			extensionId: transaction.extensionId,
+			targetDir: transaction.targetDir
+		}, spec));
+	} catch (error) {
+		const message = error instanceof Error ? error.message : String(error);
 		logger.error?.(`Failed to update ${extensionId}: ${message}`);
 		return {
 			extensionId,
@@ -168,9 +210,8 @@ async function updateSingleExtension(params) {
 			currentVersion
 		};
 	}
-	await upsertNpmExtensionLock(lock, targetDir, installResult, spec);
-	const nextVersion = (installResult.extensionId ? readInstalledExtensionVersion(targetDir, installResult.extensionId) : void 0) ?? entry.version;
-	const resolvedId = installResult.extensionId ?? extensionId;
+	const nextVersion = readInstalledExtensionVersion(targetDir, transaction.extensionId) ?? entry.version;
+	const resolvedId = transaction.extensionId;
 	const status = currentVersion && nextVersion && currentVersion === nextVersion ? "unchanged" : "updated";
 	return {
 		extensionId: resolvedId,

package/dist/src/gateway/heartbeat/service.js

@@ -4,11 +4,11 @@ import { init_agent_scope, resolveDefaultAgentId } from "../../agent/agent-scope
 import { createConversation, init_conversation_repository, resolveRoutedConversation } from "../../storage/sqlite/conversation-repository.js";
 import { shouldSilence, stripHeartbeatToken } from "../../heartbeat/tokens.js";
 import { proactiveChecksAllowed, proactivePreferences } from "../../proactive/policy/service.js";
-import { beginHeartbeatCheck, completeHeartbeatCheck, deliverHeartbeatChecks, recentHeartbeatChecks, recoverHeartbeatChecks } from "./check-store.js";
-import { appendCronEventLines } from "../../heartbeat/event-prompt.js";
 import { isWithinActiveHours } from "../../heartbeat/active-hours.js";
 import { isHeartbeatContentEmpty } from "../../heartbeat/content-check.js";
+import { appendCronEventLines } from "../../heartbeat/event-prompt.js";
 import { createHeartbeatWake } from "../../heartbeat/wake.js";
+import { beginHeartbeatCheck, completeHeartbeatCheck, deliverHeartbeatChecks, recentHeartbeatChecks, recoverHeartbeatChecks } from "./check-store.js";
 import { resolveHeartbeatMdPath } from "../workspace-heartbeat-path.js";
 import { readFile } from "fs/promises";
 //#region src/gateway/heartbeat/service.ts

package/dist/src/gateway/hono/lib/config-payload.d.ts

@@ -245,8 +245,10 @@ export declare function buildSafeWebConfigPayload(service: GatewayService, optio
         knowledgeMemory: {
             enabled: boolean;
             writePolicy: "allow" | "confirm" | "deny";
-            sources: ("project" | "session" | "workspace" | "connector")[];
+            readScopes: ("project" | "session" | "agent" | "workspace" | "global")[];
+            contentSources: ("memory" | "connector" | "local_import")[];
             searchStrategy: "local-first" | "external-first" | "fanout" | "local-only" | "external-only";
+            searchTimeoutMs: number;
             writeStrategy: "local-first" | "external-first" | "local-only" | "external-only" | "write-through";
             allowExternalWrites: boolean;
             allowedProviderIds?: string[];

package/dist/src/gateway/hono/routes/auth-registry-extensions.js

@@ -1,8 +1,8 @@
 import { getAllModels, getAvailableModels, init_providers } from "../../../providers/index.js";
 import { ActivationPlanner } from "../../../extensions/activation-planner.js";
 import { mergeActivationContext } from "../../../extensions/activation-context.js";
+import { validateExtensionConfig } from "../../../extensions/config-validation.js";
 import { fetchRegistry, listExtensions, searchExtensions } from "../../../extensions/marketplace.js";
-import { buildWhenContextSnapshot } from "../../../extensions/when-context.js";
 import { createOAuthAsyncHandler } from "../oauth-async.js";
 import { createOAuthHandler } from "../oauth.js";
 import { extensionAssetMimeType } from "../lib/extension-assets.js";
@@ -265,22 +265,59 @@ function registerAuthRegistryExtensionsRoutes(authenticated, deps) {
 	});
 	authenticated.get("/api/extensions/:id/config", async (c) => {
 		const extensionId = c.req.param("id");
-		return c.json(await loadExtensionStore(`__config__${extensionId}`));
+		const configured = service.currentConfig.extensions?.[extensionId];
+		const config = configured && typeof configured === "object" && !Array.isArray(configured) ? configured : {};
+		return c.json(config);
 	});
 	authenticated.patch("/api/extensions/:id/config", async (c) => {
 		const extensionId = c.req.param("id");
 		const patch = await c.req.json().catch(() => null);
 		if (!patch || typeof patch !== "object" || Array.isArray(patch)) return c.json({ error: "Request body must be a JSON object" }, 400);
-		const namespace = `__config__${extensionId}`;
-		const config = await loadExtensionStore(namespace);
-		Object.assign(config, patch);
-		await saveExtensionStore(namespace, config);
+		const loader = service.getExtensionLoader();
+		if (!loader) return c.json({ error: "Extensions unavailable" }, 503);
+		const extension = loader.discoverExtensions().find((entry) => entry.id === extensionId);
+		if (!extension) return c.json({ error: "Extension not found" }, 404);
+		const current = service.currentConfig.extensions?.[extensionId];
+		const config = {
+			...current && typeof current === "object" && !Array.isArray(current) ? current : {},
+			...patch
+		};
+		const validation = validateExtensionConfig(extension.manifest.configSchema, config);
+		if (validation.valid === false) return c.json({ error: `Invalid extension config: ${validation.reason}` }, 400);
+		const extensions = {
+			...service.currentConfig.extensions ?? {},
+			[extensionId]: config
+		};
+		const result = await service.updateConfig({ extensions });
+		if (!result.updated) return c.json({ error: result.error ?? "Failed to update config" }, 500);
 		return c.json({ ok: true });
 	});
-	authenticated.get("/api/context", (c) => {
-		const loader = service.getExtensionLoader();
-		const snapshot = buildWhenContextSnapshot(service.currentConfig, loader);
-		return c.json(snapshot);
+	authenticated.all("/api/extensions/:id/runtime/*", async (c) => {
+		const extensionId = c.req.param("id");
+		const prefix = `/api/extensions/${extensionId}/runtime`;
+		const path = c.req.path.slice(prefix.length) || "/";
+		const handler = service.getExtensionRegistry()?.getHttpRoute(extensionId, path);
+		if (!handler) return c.json({ error: "Extension route not found" }, 404);
+		const contentType = c.req.header("content-type") ?? "";
+		let body;
+		if (c.req.method !== "GET" && c.req.method !== "HEAD") body = contentType.includes("application/json") ? await c.req.json().catch(() => void 0) : await c.req.text().catch(() => void 0);
+		const response = await handler({
+			method: c.req.method,
+			url: c.req.url,
+			headers: c.req.header(),
+			body
+		});
+		const headers = new Headers(response.headers);
+		let responseBody = null;
+		if (response.body !== void 0) if (typeof response.body === "string" || response.body instanceof Uint8Array) responseBody = response.body;
+		else {
+			headers.set("Content-Type", headers.get("Content-Type") ?? "application/json; charset=utf-8");
+			responseBody = JSON.stringify(response.body);
+		}
+		return new Response(responseBody, {
+			status: response.status,
+			headers
+		});
 	});
 	authenticated.get("/api/marketplace", async (c) => {
 		const q = c.req.query("q");

package/dist/src/gateway/hono/routes/connectors.js

@@ -1,27 +1,32 @@
+import { createLogger } from "../../../utils/logger/index.js";
+import { init_logger } from "../../../utils/logger.js";
 import { hasGatewayScope } from "../../security/gateway-scopes.js";
 import { listConnectorLearningJobs } from "../../../storage/sqlite/connector-learning-repository.js";
+import { getConnectorAccount, init_connector_account_repository, updateConnectorAccount } from "../../../storage/sqlite/connector-account-repository.js";
 import { decideConnectorApproval, getConnectorApproval, listConnectorApprovals, listConnectorConnections } from "../../../storage/sqlite/connector-repository.js";
-import { getConnectorAccount } from "../../../storage/sqlite/connector-account-repository.js";
 import { getConnectorSyncPolicy, upsertConnectorSyncPolicy } from "../../../storage/sqlite/connector-sync-policy-repository.js";
 import "../../../storage/sqlite/index.js";
 import { init_agent_scope, resolveDefaultAgentId } from "../../../agent/agent-scope.js";
-import { resolveComposioApiKey } from "../../../connectors/composio-sessions.js";
+import { activateComposioBackend, addComposioBackend, ensureComposioBackend, getComposioBackend, listComposioBackends, removeComposioBackend } from "../../../connectors/composio-backends.js";
+import { getAuthorizationAttempt } from "../../../connectors/authorization-attempts.js";
+import { ComposioSessionsAdapter, resolveComposioApiKey } from "../../../connectors/composio-sessions.js";
 import { getConnectorLearningPlan } from "../../../connectors/learning-recipes.js";
 import { listComposioConnectorCatalog } from "../../../connectors/composio-catalog.js";
-import { createConnectorSetupSecretRequest, submitConnectorSetupSecret } from "../../../connectors/setup-secrets.js";
 import { configureComposioApiKey, executeComposioTool, getComposioInstallationPolicy, getComposioToolkitAuthState, getComposioToolkitScope, inspectComposioConnectorHealth, listComposioConnections, listComposioTools, refreshComposioConnection, revokeComposioConnection, setComposioToolkitScope, updateComposioConnection, updateComposioInstallationPolicy } from "../../../connectors/composio.js";
 import { listConnectorProviders } from "../../../connectors/providers.js";
 import { getConnectorDefinition, listConnectorCatalog } from "../../../connectors/catalog.js";
+import { createConnectorSetupSecretRequest, submitConnectorSetupSecret } from "../../../connectors/setup-secrets.js";
 import { recordConnectorHealthUsage } from "../../../connectors/usage.js";
 import { getConnectorInstance, getInstalledConnectorDefinition, listConnectorInstances } from "../../../connectors/instances.js";
 import { installConnector, installConnectorDefinition, uninstallConnector, updateConnectorConfig } from "../../../connectors/install.js";
-import { ConfigPersistenceError, persistConfigMutation } from "../../../config/config-mutation.js";
+import { resumeApprovedConnectorAction } from "../../../connectors/approval-resume.js";
 import { getMcpOAuthManager } from "../../../agent/mcp/oauth/mcp-oauth-manager.js";
 import { startConnectorAuthorization } from "../../../connectors/auth-provider-registry.js";
 import { composioLogoResponse } from "../../../connectors/composio-logo.js";
 import { inspectManagedComposioStatus } from "../../../connectors/composio-managed-client.js";
 import { appendComposioTriggerEvent, listComposioTriggerEvents } from "../../../connectors/composio-triggers.js";
 import { ingestLocalFolderSource } from "../../../connectors/connected-source-ingestion.js";
+import { ConfigPersistenceError, persistConfigMutation } from "../../../config/config-mutation.js";
 import { previewConnectorDefinition, testConnectorInstance } from "../../../connectors/health.js";
 import { listUnderstandingSourceGrants, revokeUnderstandingSourceGrant } from "../../../user-context/sources/repository.js";
 import { setConnectorEnabled } from "../../../connectors/lifecycle.js";
@@ -29,7 +34,9 @@ import { projectComposioConnectionStatus } from "../../../connectors/runtime-sta
 import { getGatewayPrincipal } from "../../security/gateway-principal.js";
 import { markContextSourceAssertionsForReview } from "./context-sources.js";
 //#region src/gateway/hono/routes/connectors.ts
+init_logger();
 init_agent_scope();
+init_connector_account_repository();
 function errorMessage(error) {
 	return error instanceof Error ? error.message : String(error);
 }
@@ -38,6 +45,7 @@ function defaultConnectorSyncInterval(connectorId) {
 	return definition?.runtime.type === "composio" && definition.runtime.role === "toolkit" ? getConnectorLearningPlan(definition.runtime.toolkit)?.intervalMinutes ?? 30 : 30;
 }
 function registerConnectorRoutes(authenticated, deps) {
+	const log = createLogger("Connectors:Routes");
 	const { service, strictRateLimitMiddleware } = deps;
 	authenticated.get("/api/connectors/catalog", (c) => {
 		return c.json({
@@ -128,12 +136,93 @@ function registerConnectorRoutes(authenticated, deps) {
 			}, 400);
 		}
 	});
+	authenticated.patch("/api/connectors/composio/accounts/:id", strictRateLimitMiddleware, async (c) => {
+		const account = getConnectorAccount(c.req.param("id"));
+		if (!account || account.principalId !== "local-owner") return c.json({
+			ok: false,
+			error: "Account not found."
+		}, 404);
+		const body = await c.req.json().catch(() => null);
+		if (!body || typeof body !== "object" || Array.isArray(body) || body.label !== void 0 && (typeof body.label !== "string" || body.label.length > 120) || body.enabled !== void 0 && typeof body.enabled !== "boolean" || body.allowedAgentIds !== void 0 && body.allowedAgentIds !== null && (!Array.isArray(body.allowedAgentIds) || body.allowedAgentIds.some((id) => typeof id !== "string"))) return c.json({
+			ok: false,
+			error: "Invalid account settings."
+		}, 400);
+		return c.json({
+			ok: true,
+			payload: { account: updateConnectorAccount(account.id, body) }
+		});
+	});
 	authenticated.get("/api/connectors/learning", (c) => {
 		return c.json({
 			ok: true,
 			payload: { jobs: listConnectorLearningJobs({ limit: 100 }) }
 		});
 	});
+	authenticated.get("/api/connectors/composio/authorizations/:id", async (c) => {
+		let attempt = getAuthorizationAttempt(c.req.param("id"), "local-owner");
+		if (!attempt) return c.json({
+			ok: false,
+			error: "Authorization attempt not found."
+		}, 404);
+		try {
+			if (attempt.status === "awaiting_user") {
+				await new ComposioSessionsAdapter().syncConnections({
+					principalId: "local-owner",
+					backendId: attempt.backend_id ?? void 0
+				});
+				attempt = getAuthorizationAttempt(attempt.id, "local-owner");
+			}
+			const connection = listConnectorConnections({
+				principalId: "local-owner",
+				connectorId: attempt.connector_id
+			}).find((item) => item.id === attempt.connection_id);
+			return c.json({
+				ok: true,
+				payload: { attempt: {
+					id: attempt.id,
+					status: attempt.status,
+					authorizationUrl: attempt.authorization_url,
+					expiresAt: attempt.expires_at,
+					accountId: connection?.accountId
+				} }
+			});
+		} catch (err) {
+			log.warn({
+				err,
+				phase: "authorization_status",
+				backendId: attempt.backend_id,
+				connectorId: attempt.connector_id
+			}, "Could not synchronize authorization status");
+			const localConflict = /constraint failed/i.test(errorMessage(err));
+			return c.json({
+				ok: false,
+				error: localConflict ? "Local connection records could not be synchronized. Update and restart the gateway; do not delete or reauthorize your accounts." : "The connection service is temporarily unavailable. Retry checking this authorization."
+			}, localConflict ? 500 : 503);
+		}
+	});
+	authenticated.delete("/api/connectors/composio/accounts/:id", strictRateLimitMiddleware, async (c) => {
+		const account = getConnectorAccount(c.req.param("id"));
+		if (!account || account.principalId !== "local-owner") return c.json({
+			ok: false,
+			error: "Account not found."
+		}, 404);
+		updateConnectorAccount(account.id, { enabled: false });
+		try {
+			for (const connection of listConnectorConnections({
+				principalId: account.principalId,
+				connectorId: account.connectorId
+			})) if (connection.accountId === account.id && connection.status !== "revoked") await revokeComposioConnection(connection.id);
+			return c.json({
+				ok: true,
+				payload: { disconnected: true }
+			});
+		} catch (error) {
+			return c.json({
+				ok: false,
+				error: `Account paused; some authorizations could not be revoked. Retry disconnecting. ${errorMessage(error)}`
+			}, 400);
+		}
+	});
 	authenticated.get("/api/connectors/composio/accounts/:id/sync-policy", (c) => {
 		const account = getConnectorAccount(c.req.param("id"));
 		if (!account || account.principalId !== "local-owner") return c.json({
@@ -142,7 +231,7 @@ function registerConnectorRoutes(authenticated, deps) {
 		}, 404);
 		const policy = getConnectorSyncPolicy(account.id) ?? {
 			accountId: account.id,
-			scanEnabled: true,
+			scanEnabled: false,
 			proactiveEnabled: false,
 			intervalMinutes: defaultConnectorSyncInterval(account.connectorId),
 			allowedScenarioKeys: [],
@@ -256,10 +345,7 @@ function registerConnectorRoutes(authenticated, deps) {
 		const body = await c.req.json().catch(() => ({}));
 		const row = body && typeof body === "object" && !Array.isArray(body) ? body : {};
 		try {
-			const connection = updateComposioConnection(c.req.param("id"), {
-				alias: typeof row.alias === "string" ? row.alias : void 0,
-				isDefault: typeof row.isDefault === "boolean" ? row.isDefault : void 0
-			});
+			const connection = updateComposioConnection(c.req.param("id"), { alias: typeof row.alias === "string" ? row.alias : void 0 });
 			return c.json({
 				ok: true,
 				payload: { connection }
@@ -416,6 +502,7 @@ function registerConnectorRoutes(authenticated, deps) {
 				payload: { result: await executeComposioTool({
 					slug,
 					arguments: args,
+					accountId: typeof body?.accountId === "string" ? body.accountId : void 0,
 					config: service.currentConfig
 				}) }
 			});
@@ -563,11 +650,22 @@ function registerConnectorRoutes(authenticated, deps) {
 		}, 400);
 		const confirmationPolicy = rawConfirmationPolicy === "never" || rawConfirmationPolicy === "writes" || rawConfirmationPolicy === "always" ? rawConfirmationPolicy : void 0;
 		const allowedAgentIds = Array.isArray(row.allowedAgentIds) ? [...new Set(row.allowedAgentIds.filter((value) => typeof value === "string").map((value) => value.trim()).filter(Boolean))] : void 0;
-		const selectedConnectionIds = Array.isArray(row.selectedConnectionIds) ? [...new Set(row.selectedConnectionIds.filter((value) => typeof value === "string").map((value) => value.trim()).filter(Boolean))] : void 0;
+		if (row.selectedAccountIds !== void 0 && row.selectedAccountIds !== null && !Array.isArray(row.selectedAccountIds)) return c.json({
+			ok: false,
+			error: "selectedAccountIds must be null or an array of account IDs."
+		}, 400);
+		const selectedAccountIds = row.selectedAccountIds === null ? null : Array.isArray(row.selectedAccountIds) ? [...new Set(row.selectedAccountIds.filter((value) => typeof value === "string").map((value) => value.trim()).filter(Boolean))] : void 0;
+		if (Array.isArray(row.selectedAccountIds) && (selectedAccountIds?.length !== row.selectedAccountIds.length || selectedAccountIds.some((id) => {
+			const account = getConnectorAccount(id);
+			return !account || account.principalId !== "local-owner" || account.connectorId !== `composio-${c.req.param("toolkit")}`;
+		}))) return c.json({
+			ok: false,
+			error: "Select accounts belonging to this application."
+		}, 400);
 		try {
 			const policy = updateComposioInstallationPolicy(service.currentConfig, c.req.param("toolkit"), {
 				allowedAgentIds,
-				selectedConnectionIds,
+				selectedAccountIds,
 				confirmationPolicy
 			});
 			return c.json({
@@ -606,9 +704,13 @@ function registerConnectorRoutes(authenticated, deps) {
 			error: `Connector approval is ${approval?.status ?? "unavailable"}.`,
 			payload: { approval }
 		}, 409);
+		const resumed = await resumeApprovedConnectorAction(approval, service.connectionRecovery);
 		return c.json({
 			ok: true,
-			payload: { approval }
+			payload: {
+				approval,
+				resumed
+			}
 		});
 	});
 	authenticated.post("/api/connectors/:id/auth/start", strictRateLimitMiddleware, async (c) => {
@@ -621,7 +723,34 @@ function registerConnectorRoutes(authenticated, deps) {
 			error: `Unknown connector: ${connectorOrInstanceId}`
 		}, 404);
 		try {
-			const authorization = await startConnectorAuthorization(connector, config, instance?.instanceId);
+			const body = await c.req.json().catch(() => ({}));
+			let authorization;
+			if (typeof body?.accountId === "string") {
+				const account = getConnectorAccount(body.accountId);
+				if (!account || account.principalId !== "local-owner" || account.connectorId !== connector.id || !account.backendId || connector.runtime.type !== "composio") return c.json({
+					ok: false,
+					error: "Account connection service is unavailable. Refresh accounts first."
+				}, 400);
+				const current = listConnectorConnections({
+					principalId: "local-owner",
+					connectorId: connector.id
+				}).find((connection) => connection.id === account.currentConnectionId);
+				const result = await new ComposioSessionsAdapter().authorize({
+					principalId: "local-owner",
+					expectedAccountId: account.id,
+					toolkit: connector.runtime.toolkit,
+					backendId: account.backendId,
+					authConfigId: typeof current?.metadata.authConfigId === "string" ? current.metadata.authConfigId : void 0
+				});
+				authorization = {
+					connectorId: connector.id,
+					provider: "composio",
+					status: "pending",
+					authorizationUrl: result.connectUrl,
+					connectionId: result.connectionId,
+					attemptId: result.attemptId
+				};
+			} else authorization = await startConnectorAuthorization(connector, config, instance?.instanceId);
 			return c.json({
 				ok: true,
 				payload: { authorization }
@@ -634,20 +763,82 @@ function registerConnectorRoutes(authenticated, deps) {
 		}
 	});
 	authenticated.get("/api/connectors/composio/setup-status", async (c) => {
-		const status = Boolean(await resolveComposioApiKey()) ? {
-			configured: true,
+		const backend = await ensureComposioBackend();
+		const status = backend.mode === "byok" ? {
+			configured: Boolean(await resolveComposioApiKey()),
 			mode: "byok"
 		} : await inspectManagedComposioStatus();
 		return c.json({
 			ok: true,
-			payload: status
+			payload: {
+				...status,
+				backendId: backend.id,
+				backends: listComposioBackends().map(({ id, label, mode, credential_source, verified_at }) => ({
+					id,
+					label,
+					mode,
+					credentialSource: credential_source,
+					verifiedAt: verified_at
+				}))
+			}
 		});
 	});
+	authenticated.delete("/api/connectors/composio/backends/:id", strictRateLimitMiddleware, async (c) => {
+		try {
+			await removeComposioBackend(c.req.param("id"));
+			return c.json({
+				ok: true,
+				payload: { removed: true }
+			});
+		} catch (error) {
+			return c.json({
+				ok: false,
+				error: errorMessage(error)
+			}, 400);
+		}
+	});
 	authenticated.post("/api/connectors/composio/setup", strictRateLimitMiddleware, async (c) => {
 		const body = await c.req.json().catch(() => ({}));
 		const apiKey = body && typeof body === "object" && !Array.isArray(body) ? String(body.apiKey ?? "") : "";
 		try {
-			await configureComposioApiKey(apiKey);
+			if (!body || typeof body !== "object" || Array.isArray(body)) return c.json({
+				ok: false,
+				error: "Invalid setup request."
+			}, 400);
+			if (body.mode === "managed") {
+				const status = await inspectManagedComposioStatus();
+				if (!status.configured) return c.json({
+					ok: false,
+					error: status.reason ?? "Cloud unavailable."
+				}, 400);
+				activateComposioBackend((listComposioBackends().find((item) => item.mode === "managed") ?? addComposioBackend({
+					mode: "managed",
+					label: "XOPC Cloud"
+				})).id);
+				return c.json({
+					ok: true,
+					payload: {
+						configured: true,
+						mode: "managed"
+					}
+				});
+			}
+			if (typeof body.backendId === "string") {
+				if (!getComposioBackend(body.backendId)) return c.json({
+					ok: false,
+					error: "Unknown connection service."
+				}, 404);
+				await new ComposioSessionsAdapter().listToolkitCatalog({
+					principalId: "local-owner",
+					backendId: body.backendId
+				});
+				activateComposioBackend(body.backendId);
+				return c.json({
+					ok: true,
+					payload: { configured: true }
+				});
+			}
+			await configureComposioApiKey(apiKey, void 0, typeof body.replaceBackendId === "string" ? body.replaceBackendId : void 0);
 			return c.json({
 				ok: true,
 				payload: {

package/dist/src/gateway/hono/routes/context-sources.js

@@ -1,6 +1,6 @@
 import { getSqliteDatabase, init_transaction } from "../../../storage/sqlite/transaction.js";
-import { countKnowledgeSourceItems, deleteKnowledgeSourceItems } from "../../../storage/sqlite/knowledge-repository.js";
 import { getConnectorAccount } from "../../../storage/sqlite/connector-account-repository.js";
+import { countKnowledgeSourceItems, deleteKnowledgeSourceItems } from "../../../storage/sqlite/knowledge-repository.js";
 import "../../../storage/sqlite/index.js";
 import { init_agent_scope, resolveDefaultAgentId } from "../../../agent/agent-scope.js";
 import { setAssertionStatus } from "../../../user-model/repository.js";