@xopcai/xopc 0.0.303 → 0.0.307

package/dist/src/gateway/hono/routes/devices.js

@@ -1,4 +1,4 @@
-import { devicePairingInvitationPayloadSchema, devicePairingTargetKindSchema, formatBrowserPairingInvitation } from "../../../../packages/gateway-contract/src/device-pairing.js";
+import { browserPairingInvitationPayloadSchema, devicePairingTargetKindSchema, formatBrowserPairingInvitation, formatMobilePairingInvitation } from "../../../../packages/gateway-contract/src/device-pairing.js";
 import { init_src } from "../../../../packages/gateway-contract/src/index.js";
 import { listDevices, revokeDevice, rotateDeviceRefreshToken } from "../../../storage/sqlite/device-access-repository.js";
 import { getGatewayIdentityPublicKeyRaw, getOrCreateGatewayIdentity, signGatewayPayload } from "../../../storage/sqlite/gateway-identity-repository.js";
@@ -23,9 +23,6 @@ const refreshRequestSchema = z.strictObject({
 });
 const pairingProbeSchema = z.strictObject({ pairingId: z.string().uuid() });
 const pairingSetupSchema = z.strictObject({ targetKind: devicePairingTargetKindSchema });
-function pairingPayload(input) {
-	return Buffer.from(JSON.stringify(devicePairingInvitationPayloadSchema.parse(input))).toString("base64url");
-}
 function registerDeviceAuthPublicRoutes(app, options) {
 	app.post("/api/gateway-identity/challenge", bodyLimit({ maxSize: 512 }), async (c) => {
 		const budget = buckets.identityChallenge().consume("gateway");
@@ -154,7 +151,14 @@ function registerDeviceRoutes(authenticated, deps) {
 		}, 409);
 		const setup = createDevicePairingSetup(routes, Date.now(), { targetKind: parsed.data.targetKind });
 		const identity = getOrCreateGatewayIdentity();
-		const encoded = pairingPayload({
+		const invitation = setup.targetKind === "mobile" ? { universalLink: formatMobilePairingInvitation({
+			version: 4,
+			pairingToken: setup.token,
+			gatewayId: identity.id,
+			gatewayPublicKey: getGatewayIdentityPublicKeyRaw(identity),
+			origins: routes.map((route) => route.url),
+			expiresAt: setup.expiresAt
+		}) } : { browserInvitation: formatBrowserPairingInvitation(Buffer.from(JSON.stringify(browserPairingInvitationPayloadSchema.parse({
 			version: 3,
 			pairingToken: setup.token,
 			gatewayId: identity.id,
@@ -163,8 +167,7 @@ function registerDeviceRoutes(authenticated, deps) {
 			routes,
 			targetKind: setup.targetKind,
 			expiresAt: setup.expiresAt
-		});
-		const invitation = setup.targetKind === "mobile" ? { universalLink: `https://link.xopc.ai/connect#p=${encoded}` } : { browserInvitation: formatBrowserPairingInvitation(encoded) };
+		}))).toString("base64url")) };
 		return c.json({
 			ok: true,
 			setup: {

package/dist/src/gateway/hono/routes/endpoint-compatibility.js

@@ -1,5 +1,6 @@
 import { init_src } from "../../../../packages/endpoint-tools-protocol/src/index.js";
 import { COMPUTER_DESCRIPTOR, COMPUTER_FRAME_MAX_BYTES, init_src as init_src$1 } from "../../../../packages/computer-control-contract/src/index.js";
+import { REALTIME_CAPABILITIES } from "../../../../packages/realtime-protocol/src/index.js";
 //#region src/gateway/hono/routes/endpoint-compatibility.ts
 init_src$1();
 init_src();
@@ -10,6 +11,11 @@ function registerEndpointCompatibilityRoutes(authenticated) {
 			ok: true,
 			payload: {
 				realtimeProtocolVersion: 2,
+				realtime: {
+					minVersion: 2,
+					maxVersion: 2,
+					capabilities: REALTIME_CAPABILITIES
+				},
 				endpointProtocolVersion: 2,
 				computerControl: COMPUTER_DESCRIPTOR,
 				computerFrameUploadMaxBytes: COMPUTER_FRAME_MAX_BYTES

package/dist/src/gateway/hono/routes/extension-gateway.js

@@ -1,39 +1,6 @@
 //#region src/gateway/hono/routes/extension-gateway.ts
 function registerExtensionGatewayRoutes(authenticated, deps) {
 	const { service } = deps;
-	const extensionRegistry = service.getExtensionRegistry?.();
-	if (extensionRegistry) {
-		const httpRoutes = extensionRegistry.httpRoutes;
-		for (const [path, handler] of httpRoutes) {
-			authenticated.post(path, async (c) => {
-				const response = await handler({
-					method: c.req.method,
-					url: c.req.url,
-					headers: c.req.header(),
-					body: await c.req.json().catch(() => ({}))
-				});
-				if (response) {
-					if (response.status) c.status(response.status);
-					if (response.headers) for (const [key, value] of Object.entries(response.headers)) c.header(key, String(value));
-					if (response.body !== void 0) return c.json(response.body);
-				}
-				return c.text("");
-			});
-			authenticated.get(path, async (c) => {
-				const response = await handler({
-					method: c.req.method,
-					url: c.req.url,
-					headers: c.req.header()
-				});
-				if (response) {
-					if (response.status) c.status(response.status);
-					if (response.headers) for (const [key, value] of Object.entries(response.headers)) c.header(key, String(value));
-					if (response.body !== void 0) return c.json(response.body);
-				}
-				return c.text("");
-			});
-		}
-	}
 	authenticated.post("/api/gateway/:method", async (c) => {
 		const method = c.req.param("method");
 		const params = await c.req.json().catch(() => ({}));

package/dist/src/gateway/hono/routes/home.js

@@ -3,6 +3,7 @@ import { decideConnectorApproval } from "../../../storage/sqlite/connector-repos
 import "../../../storage/sqlite/index.js";
 import { listGatewayAgents } from "../../agents-admin.js";
 import { HomeQueryService, buildHomeWorkbench, decisionFromTask } from "../../../tasks/home-query-service.js";
+import { resumeApprovedConnectorAction } from "../../../connectors/approval-resume.js";
 //#region src/gateway/hono/routes/home.ts
 /** Register the unified work-home read model and its decision actions. */
 function registerHomeRoutes(authenticated, deps) {
@@ -26,9 +27,11 @@ function registerHomeRoutes(authenticated, deps) {
 				ok: false,
 				error: `Approval is ${approval.status}`
 			}, 409);
+			const resumed = await resumeApprovedConnectorAction(approval, service.connectionRecovery);
 			return c.json({
 				ok: true,
-				status: approval.status
+				status: approval.status,
+				resumed
 			});
 		}
 		return c.json({

package/dist/src/gateway/hono/routes/lazy-bundles.js

@@ -182,7 +182,6 @@ const AUTHENTICATED_LAZY_ROUTE_BUNDLES = [
 			"/api/auth",
 			"/api/registry",
 			"/api/extensions",
-			"/api/context",
 			"/api/marketplace"
 		]),
 		load: async () => {

package/dist/src/gateway/hono/routes/mcp.js

@@ -1,6 +1,6 @@
+import { isManagedConnectorServer } from "../../../connectors/materialize.js";
 import { canonicalizeConfiguredMcpServer, normalizeConfiguredMcpServers } from "../../../config/mcp-config-normalize.js";
 import { loadMergedBundleMcpConfig } from "../../../agent/mcp/bundle-mcp-config.js";
-import { isManagedConnectorServer } from "../../../connectors/materialize.js";
 import { getWorkspacePath } from "../../../config/workspace-path-helpers.js";
 import { getMcpOAuthManager } from "../../../agent/mcp/oauth/mcp-oauth-manager.js";
 import { listBundleMcpServerCapabilitiesForGateway, listBundleMcpServerToolsForGateway } from "../../../agent/mcp/bundle-mcp-gateway.js";

package/dist/src/gateway/hono/routes/realtime.js

@@ -1,10 +1,11 @@
-import { realtimeClientKindSchema } from "../../../../packages/realtime-protocol/src/index.js";
+import { REALTIME_CAPABILITIES, realtimeClientKindSchema } from "../../../../packages/realtime-protocol/src/index.js";
 import { getGatewayPrincipal } from "../../security/gateway-principal.js";
 import { z } from "zod";
 //#region src/gateway/hono/routes/realtime.ts
 const ticketRequestSchema = z.strictObject({
 	clientId: z.string().min(1).max(160),
-	clientKind: realtimeClientKindSchema
+	clientKind: realtimeClientKindSchema,
+	protocolVersion: z.number().int().positive()
 });
 function registerRealtimeRoutes(authenticated, deps) {
 	authenticated.post("/api/realtime/tickets", async (c) => {
@@ -16,16 +17,37 @@ function registerRealtimeRoutes(authenticated, deps) {
 				message: "Invalid realtime ticket request"
 			}
 		}, 400);
+		if (parsed.data.protocolVersion !== 2) {
+			const clientIsOlder = parsed.data.protocolVersion < 2;
+			return c.json({
+				ok: false,
+				error: {
+					code: clientIsOlder ? "CLIENT_UPDATE_REQUIRED" : "GATEWAY_UPDATE_REQUIRED",
+					message: clientIsOlder ? "Update the client to connect to this Gateway." : "Update the Gateway to connect this client.",
+					retryable: false,
+					clientProtocolVersion: parsed.data.protocolVersion,
+					gatewayProtocolVersion: 2
+				}
+			}, 426);
+		}
 		try {
 			const principal = getGatewayPrincipal(c);
+			const ticket = deps.service.realtime.tickets.issue(parsed.data.clientId, parsed.data.clientKind, {
+				principalId: principal.principalId,
+				...principal.deviceId ? { deviceId: principal.deviceId } : {},
+				...principal.accessSessionId ? { accessSessionId: principal.accessSessionId } : {},
+				scopes: principal.scopes
+			});
 			return c.json({
 				ok: true,
-				payload: deps.service.realtime.tickets.issue(parsed.data.clientId, parsed.data.clientKind, {
-					principalId: principal.principalId,
-					...principal.deviceId ? { deviceId: principal.deviceId } : {},
-					...principal.accessSessionId ? { accessSessionId: principal.accessSessionId } : {},
-					scopes: principal.scopes
-				})
+				payload: {
+					...ticket,
+					realtime: {
+						minVersion: 2,
+						maxVersion: 2,
+						capabilities: REALTIME_CAPABILITIES
+					}
+				}
 			});
 		} catch (error) {
 			return c.json({

package/dist/src/gateway/hono/routes/user-model.js

@@ -1,5 +1,5 @@
 import { createCollaborationRule, getCollaborationRule, listCollaborationRules, setCollaborationRuleStatus } from "../../../storage/sqlite/collaboration-rule-repository.js";
-import { getKnowledgeItem, listKnowledgeItems, searchKnowledgeItems, setKnowledgeStatus } from "../../../knowledge-memory/repository.js";
+import { KnowledgeReviewConflictError, getKnowledgeItem, listKnowledgeItems, reviewKnowledgeItem, searchKnowledgeItems } from "../../../knowledge-memory/repository.js";
 import "../../../knowledge-memory/index.js";
 import { createPriorityWindow, createUserGoal, listPriorityWindows, listUserGoals, setUserGoalStatus } from "../../../user-model/goals.js";
 import { getAssertionSlot, getUserAssertion, listUserAssertionSources, listUserAssertions, reconcileAssertion, setAssertionStatus } from "../../../user-model/repository.js";
@@ -83,6 +83,12 @@ const GOAL_STATUSES = new Set([
 	"achieved",
 	"abandoned"
 ]);
+const KNOWLEDGE_REVIEW_ACTIONS = new Set([
+	"approve",
+	"edit_and_approve",
+	"reject",
+	"archive"
+]);
 const KNOWLEDGE_STATUSES = new Set([
 	"candidate",
 	"active",
@@ -399,12 +405,25 @@ function registerUserModelRoutes(authenticated, deps) {
 		const item = getKnowledgeItem(c.req.param("id"));
 		return item ? c.json({ item }) : c.json({ error: "Knowledge item not found" }, 404);
 	});
-	authenticated.patch("/api/knowledge-memory/:id/status", write, async (c) => {
+	authenticated.post("/api/knowledge-memory/:id/review", write, async (c) => {
 		const input = await body(c);
-		const status = String(input?.status ?? "");
-		if (!KNOWLEDGE_STATUSES.has(status)) return c.json({ error: "Invalid knowledge status" }, 400);
-		const item = setKnowledgeStatus(c.req.param("id"), status);
-		return item ? c.json({ item }) : c.json({ error: "Knowledge item not found" }, 404);
+		const action = String(input?.action ?? "");
+		if (!KNOWLEDGE_REVIEW_ACTIONS.has(action)) return c.json({ error: "Invalid knowledge review action" }, 400);
+		if (input?.expectedStatus !== void 0 && !KNOWLEDGE_STATUSES.has(String(input.expectedStatus))) return c.json({ error: "Invalid expected knowledge status" }, 400);
+		if (input?.content !== void 0 && action !== "edit_and_approve") return c.json({ error: "Content can only be changed while editing and approving knowledge" }, 400);
+		try {
+			const item = reviewKnowledgeItem({
+				id: c.req.param("id"),
+				action,
+				actor: "user",
+				reason: typeof input?.reason === "string" && input.reason.trim() ? input.reason : `Knowledge ${action} by user.`,
+				...typeof input?.expectedStatus === "string" ? { expectedStatus: input.expectedStatus } : {},
+				...typeof input?.content === "string" ? { content: input.content } : {}
+			});
+			return item ? c.json({ item }) : c.json({ error: "Knowledge item not found" }, 404);
+		} catch (error) {
+			return c.json({ error: errorMessage(error) }, error instanceof KnowledgeReviewConflictError ? 409 : 400);
+		}
 	});
 	authenticated.get("/api/memory-maintenance/runs", (c) => c.json({ runs: listMemoryMaintenanceRuns(Math.max(1, Math.min(100, Number(c.req.query("limit") ?? 20)))) }));
 	authenticated.get("/api/turns/:turnId/execution-context", (c) => {

package/dist/src/gateway/index.js

@@ -1,3 +1,4 @@
+import { GatewayLockError, acquireGatewayLock, init_lock } from "./lock.js";
 import { buildDefaultCorsOrigins, isAllInterfacesHost, isLoopbackHost, resolveEffectiveGatewayPort, resolveGatewayServiceListenPort } from "./host.js";
 import { defaultGatewayBindMode, isContainerEnvironment, resolveGatewayBindHost, resolveGatewayBindHostSync, resolveGatewayBindMode, resolveGatewayEffectiveHost } from "../config/gateway-bind.js";
 import { assertGatewayAuthConfigured, extractToken, resolveGatewayAuth, validateToken } from "./auth.js";
@@ -10,10 +11,12 @@ import { restartGatewayProcessWithFreshPid } from "./respawn.js";
 import { GatewayService } from "./service.js";
 import { createHonoApp } from "./hono/app.js";
 import { GatewayServer } from "./server.js";
-import { GatewayLockError, acquireGatewayLock } from "./lock.js";
 import { runGatewayLoop } from "./run-loop.js";
 import { checkPortAvailable, forceFreePortAndWait, listPortListeners, parseLsofOutput } from "./ports.js";
 import { apiError, apiOk } from "./protocol.js";
 import "./hono/index.js";
 import { assertSecureGatewayHttpUrl, assertSecureWebSocketUrl, isInsecurePrivateWsAllowed, isSecureWebSocketUrl } from "./ws-security.js";
+//#region src/gateway/index.ts
+init_lock();
+//#endregion
 export { GatewayLockError, GatewayServer, GatewayService, acquireGatewayLock, apiError, apiOk, assertGatewayAuthConfigured, assertGatewayRuntimeConfig, assertSecureGatewayHttpUrl, assertSecureWebSocketUrl, buckets, buildDefaultCorsOrigins, checkPortAvailable, createHonoApp, defaultGatewayBindMode, extractToken, forceFreePortAndWait, isAllInterfacesHost, isContainerEnvironment, isGatewayStrictSecurityEnabled, isInsecurePrivateWsAllowed, isLoopbackHost, isSecureWebSocketUrl, listPortListeners, parseLsofOutput, resolveEffectiveGatewayPort, resolveGatewayAuth, resolveGatewayBindHost, resolveGatewayBindHostSync, resolveGatewayBindMode, resolveGatewayEffectiveHost, resolveGatewayListenHost, resolveGatewayListenPlan, resolveGatewayServiceListenPort, restartGatewayProcessWithFreshPid, runGatewayLoop, validateToken };

package/dist/src/gateway/lock.d.ts

@@ -16,4 +16,6 @@ export declare class GatewayLockError extends Error {
     readonly cause?: unknown;
     constructor(message: string, cause?: unknown);
 }
+export declare function resolveGatewayLockPath(configPath: string): string;
+export declare function isGatewayConfigLockedByAnotherProcessSync(configPath: string, currentPid?: number): boolean;
 export declare function acquireGatewayLock(configPath: string, opts?: GatewayLockOptions): Promise<GatewayLockHandle>;

package/dist/src/gateway/lock.js

@@ -1,3 +1,4 @@
+import { __esmMin } from "../../_virtual/_rolldown/runtime.js";
 import path from "node:path";
 import fs from "node:fs";
 import { createHash } from "node:crypto";
@@ -8,24 +9,25 @@ import { homedir } from "os";
 /**
 * Gateway Lock - Prevents multiple gateway instances from running simultaneously
 */
-const DEFAULT_TIMEOUT_MS = 5e3;
-const DEFAULT_POLL_INTERVAL_MS = 100;
-const DEFAULT_STALE_MS = 3e4;
-const DEFAULT_PORT_PROBE_TIMEOUT_MS = 1e3;
-var GatewayLockError = class extends Error {
-	constructor(message, cause) {
-		super(message);
-		this.cause = cause;
-		this.name = "GatewayLockError";
-	}
-};
 function resolveLockDir() {
 	return path.join(homedir(), ".xopc", "locks");
 }
-function resolveLockPath(configPath) {
+function resolveGatewayLockPath(configPath) {
 	const hash = createHash("sha256").update(configPath).digest("hex").slice(0, 8);
 	return path.join(resolveLockDir(), `gateway.${hash}.lock`);
 }
+function isGatewayConfigLockedByAnotherProcessSync(configPath, currentPid = process.pid) {
+	const lockPath = resolveGatewayLockPath(configPath);
+	try {
+		const parsed = JSON.parse(fs.readFileSync(lockPath, "utf8"));
+		if (typeof parsed.pid !== "number" || parsed.pid === currentPid || parsed.configPath !== configPath) return false;
+		if (!isPidAlive(parsed.pid)) return false;
+		if (process.platform !== "linux" || !Number.isFinite(parsed.startTime)) return true;
+		return readLinuxStartTime(parsed.pid) === parsed.startTime;
+	} catch {
+		return false;
+	}
+}
 async function checkPortFree(port, host = "127.0.0.1") {
 	return new Promise((resolve) => {
 		const socket = net.createConnection({
@@ -104,7 +106,7 @@ async function acquireGatewayLock(configPath, opts = {}) {
 	const pollIntervalMs = opts.pollIntervalMs ?? DEFAULT_POLL_INTERVAL_MS;
 	const staleMs = opts.staleMs ?? DEFAULT_STALE_MS;
 	const port = opts.port;
-	const lockPath = resolveLockPath(configPath);
+	const lockPath = resolveGatewayLockPath(configPath);
 	await fs$1.mkdir(path.dirname(lockPath), { recursive: true });
 	const startedAt = Date.now();
 	let lastPayload = null;
@@ -160,5 +162,20 @@ async function acquireGatewayLock(configPath, opts = {}) {
 	}
 	throw new GatewayLockError(`Gateway already running${lastPayload?.pid ? ` (pid ${lastPayload.pid})` : ""}; lock timeout after ${timeoutMs}ms`);
 }
+var DEFAULT_TIMEOUT_MS, DEFAULT_POLL_INTERVAL_MS, DEFAULT_STALE_MS, DEFAULT_PORT_PROBE_TIMEOUT_MS, GatewayLockError;
+var init_lock = __esmMin((() => {
+	DEFAULT_TIMEOUT_MS = 5e3;
+	DEFAULT_POLL_INTERVAL_MS = 100;
+	DEFAULT_STALE_MS = 3e4;
+	DEFAULT_PORT_PROBE_TIMEOUT_MS = 1e3;
+	GatewayLockError = class extends Error {
+		constructor(message, cause) {
+			super(message);
+			this.cause = cause;
+			this.name = "GatewayLockError";
+		}
+	};
+}));
 //#endregion
-export { GatewayLockError, acquireGatewayLock };
+init_lock();
+export { GatewayLockError, acquireGatewayLock, init_lock, isGatewayConfigLockedByAnotherProcessSync, resolveGatewayLockPath };

package/dist/src/gateway/run-loop.js

@@ -1,14 +1,15 @@
+import { acquireGatewayLock, init_lock } from "./lock.js";
 import { loadConfig } from "../config/loader.js";
 import "../config/index.js";
 import { isRestartEnabled } from "../config/commands.flags.js";
 import { runBootstrapMigrationsSync } from "../migrations/runner.js";
 import { restartGatewayProcessWithFreshPid } from "./respawn.js";
-import { acquireGatewayLock } from "./lock.js";
 import { consumeGatewayRestartIntentSync, consumeGatewaySigusr1RestartAuthorization, isGatewaySigusr1RestartExternallyAllowed, resetGatewayRestartStateForInProcessRestart, scheduleGatewaySigusr1Restart, setGatewaySigusr1RestartPolicy } from "../infra/restart.js";
 //#region src/gateway/run-loop.ts
 /**
 * Gateway Run Loop - Core run loop for gateway process management
 */
+init_lock();
 async function runGatewayLoop(opts) {
 	runBootstrapMigrationsSync(opts.configPath);
 	setGatewaySigusr1RestartPolicy({ allowExternal: isRestartEnabled(loadConfig(opts.configPath)) });

package/dist/src/gateway/security/gateway-scopes.d.ts

@@ -1,8 +1,5 @@
-export declare const GATEWAY_SCOPES: readonly ["voice.configure", "gateway.status", "agents.read", "agents.run", "sessions.read", "sessions.write", "workspace.read", "workspace.write", "tasks.read", "tasks.write", "automations.read", "automations.write", "notifications.self", "device.self", "gateway.admin"];
-export type GatewayScope = typeof GATEWAY_SCOPES[number];
-export declare const DEFAULT_MOBILE_SCOPES: readonly GatewayScope[];
-export declare const DEFAULT_BROWSER_EXTENSION_SCOPES: readonly GatewayScope[];
-export declare function isGatewayScope(value: unknown): value is GatewayScope;
+import { DEFAULT_BROWSER_EXTENSION_SCOPES, DEFAULT_MOBILE_SCOPES, GATEWAY_SCOPES, isGatewayScope, type GatewayScope } from '@xopcai/gateway-contract';
+export { DEFAULT_BROWSER_EXTENSION_SCOPES, DEFAULT_MOBILE_SCOPES, GATEWAY_SCOPES, isGatewayScope, type GatewayScope, };
 export declare function parseGatewayScopes(value: string): GatewayScope[];
 export declare function requiredGatewayScope(method: string, path: string): GatewayScope;
 export declare function hasGatewayScope(granted: readonly GatewayScope[], required: GatewayScope): boolean;

package/dist/src/gateway/security/gateway-scopes.js

@@ -1,49 +1,7 @@
+import { DEFAULT_BROWSER_EXTENSION_SCOPES, DEFAULT_MOBILE_SCOPES, GATEWAY_SCOPES, isGatewayScope } from "../../../packages/gateway-contract/src/gateway-scopes.js";
+import { init_src } from "../../../packages/gateway-contract/src/index.js";
 //#region src/gateway/security/gateway-scopes.ts
-const GATEWAY_SCOPES = [
-	"voice.configure",
-	"gateway.status",
-	"agents.read",
-	"agents.run",
-	"sessions.read",
-	"sessions.write",
-	"workspace.read",
-	"workspace.write",
-	"tasks.read",
-	"tasks.write",
-	"automations.read",
-	"automations.write",
-	"notifications.self",
-	"device.self",
-	"gateway.admin"
-];
-const KNOWN_GATEWAY_SCOPES = new Set(GATEWAY_SCOPES);
-const DEFAULT_MOBILE_SCOPES = [
-	"voice.configure",
-	"gateway.status",
-	"agents.read",
-	"agents.run",
-	"sessions.read",
-	"sessions.write",
-	"workspace.read",
-	"workspace.write",
-	"tasks.read",
-	"tasks.write",
-	"automations.read",
-	"automations.write",
-	"notifications.self",
-	"device.self"
-];
-const DEFAULT_BROWSER_EXTENSION_SCOPES = [
-	"gateway.status",
-	"agents.read",
-	"agents.run",
-	"sessions.read",
-	"sessions.write",
-	"device.self"
-];
-function isGatewayScope(value) {
-	return typeof value === "string" && KNOWN_GATEWAY_SCOPES.has(value);
-}
+init_src();
 function parseGatewayScopes(value) {
 	const parsed = JSON.parse(value);
 	if (!Array.isArray(parsed) || !parsed.every(isGatewayScope)) throw new Error("Stored device scopes are invalid");

package/dist/src/gateway/security/index.js

@@ -1,4 +1,5 @@
-import { DEFAULT_MOBILE_SCOPES, GATEWAY_SCOPES, hasGatewayScope, isGatewayScope, parseGatewayScopes, requiredGatewayScope } from "./gateway-scopes.js";
+import { DEFAULT_MOBILE_SCOPES, GATEWAY_SCOPES, isGatewayScope } from "../../../packages/gateway-contract/src/gateway-scopes.js";
+import { hasGatewayScope, parseGatewayScopes, requiredGatewayScope } from "./gateway-scopes.js";
 import { safeEqualSecret } from "./secret-equal.js";
 import { KNOWN_WEAK_GATEWAY_TOKEN_PLACEHOLDERS, assertGatewayAuthNotKnownWeak } from "./known-weak-secrets.js";
 import { auditGatewayConfig, collectGatewayConfigFindings, collectGatewaySecurityFindings, collectGatewayStartupGuardFindings } from "./audit.js";

package/dist/src/gateway/service.js

@@ -51,6 +51,7 @@ import { ExtensionLoader } from "../extensions/loader.js";
 import "../extensions/index.js";
 import { MessageBus, MessageBusShutdownError } from "../infra/bus/queue.js";
 import "../infra/bus/index.js";
+import { collectMediaUrisFromMessages, deleteMediaUris } from "../media/session-references.js";
 import { AgentService } from "../agent/service.js";
 import { ensureStarterAgentsInitialized } from "../agent/starter-agents.js";
 import { setPairingBroadcastSink } from "../channels/pairing/pairing-events.js";
@@ -58,6 +59,12 @@ import { registerClarificationChannelRuntime } from "./clarify-runtime.js";
 import { ChannelManager } from "../channels/manager.js";
 import { getWorkspacePath } from "../config/workspace-path-helpers.js";
 import "../config/index.js";
+import { DiscussionService } from "../discussions/service.js";
+import { DiscussionOrganizer } from "../discussions/organizer.js";
+import { DiscussionLiveWorker } from "../discussions/live-worker.js";
+import { DiscussionOrganizerWorker } from "../discussions/organizer-worker.js";
+import { DiscussionSealer } from "../discussions/sealer.js";
+import "../discussions/index.js";
 import { ManagedComposioEventPoller } from "../connectors/composio-managed-events.js";
 import { startConnectedKnowledgeCoordinator } from "../knowledge/coordinator.js";
 import "../knowledge/index.js";
@@ -65,12 +72,6 @@ import { ConnectionRecoveryService } from "../connectors/connection-recovery-ser
 import { startConnectorLearningCoordinator } from "../connectors/learning-coordinator.js";
 import { ConnectedSourceChangePublisher } from "../connectors/source-change-publisher.js";
 import { startConnectorSupervisor } from "../connectors/supervisor.js";
-import { DiscussionService } from "../discussions/service.js";
-import { DiscussionOrganizer } from "../discussions/organizer.js";
-import { DiscussionLiveWorker } from "../discussions/live-worker.js";
-import { DiscussionOrganizerWorker } from "../discussions/organizer-worker.js";
-import { DiscussionSealer } from "../discussions/sealer.js";
-import "../discussions/index.js";
 import { EndpointToolRuntime } from "../endpoint-tools/runtime.js";
 import "../endpoint-tools/index.js";
 import { assertGatewayAuthConfigured, extractToken, resolveGatewayAuth, validateToken } from "./auth.js";
@@ -106,7 +107,6 @@ import { assertGatewayRuntimeConfig } from "./runtime-config.js";
 import { auditGatewayConfig } from "./security/audit.js";
 import { getXopcCloudCatalogCoordinator } from "../providers/xopc-cloud-catalog-coordinator.js";
 import { ModelCatalogSyncService } from "../providers/model-catalog-sync-service.js";
-import { collectMediaUrisFromMessages, deleteMediaUris } from "../media/session-references.js";
 import { runBootstrapMigrationsSync } from "../migrations/runner.js";
 import { NotificationService } from "../notifications/service.js";
 import { LocalAppService } from "../local-apps/service.js";
@@ -882,6 +882,7 @@ var GatewayService = class {
 		if (!this.extensionLoader) return;
 		try {
 			await this.extensionLoader.loadByActivationPlan({ phase: "startup" });
+			await this.extensionLoader.startServices();
 			this.registerExtensionChannelPlugins();
 			const reg = this.extensionLoader.getRegistry();
 			log.debug({
@@ -915,6 +916,7 @@ var GatewayService = class {
 			config: {}
 		};
 		await this.extensionLoader.loadExtension(extensionConfig);
+		await this.extensionLoader.startServices();
 		this.registerExtensionChannelPlugins();
 		if (!this.channelManager.getPlugin(channelId)) return;
 		await this.channelManager.initializeChannel(channelId);
@@ -924,6 +926,7 @@ var GatewayService = class {
 		if (!this.extensionLoader) return;
 		try {
 			await this.extensionLoader.loadByActivationPlan({ phase: "deferred" });
+			await this.extensionLoader.startServices();
 			this.registerExtensionChannelPlugins();
 			log.debug("Deferred-phase extensions loaded");
 		} catch (err) {
@@ -1311,6 +1314,7 @@ var GatewayService = class {
 		this.lastChannelConnectDeferMode = "auto";
 		this.lastChannelConnectDeferSource = "off";
 		await this.channelManager.stop();
+		await this.extensionLoader?.shutdown();
 		await this.automationService.stop();
 		this.stopAutomationProductEventBridge?.();
 		this.stopAutomationProductEventBridge = null;

package/dist/src/heartbeat/index.js

@@ -1,6 +1,6 @@
 import { DEFAULT_ACK_MAX_CHARS, HEARTBEAT_OK, NO_REPLY, shouldSilence, stripHeartbeatToken } from "./tokens.js";
-import { appendCronEventLines } from "./event-prompt.js";
 import { isWithinActiveHours } from "./active-hours.js";
 import { isHeartbeatContentEmpty } from "./content-check.js";
+import { appendCronEventLines } from "./event-prompt.js";
 import { createHeartbeatWake } from "./wake.js";
 export { DEFAULT_ACK_MAX_CHARS, HEARTBEAT_OK, NO_REPLY, appendCronEventLines, createHeartbeatWake, isHeartbeatContentEmpty, isWithinActiveHours, shouldSilence, stripHeartbeatToken };

package/dist/src/imports/importService.d.ts

@@ -23,7 +23,7 @@ export declare class ImportService {
     }>): import("./types.js").ImportPlan;
     describeSkills(scan: ImportScan, target: ImportTarget): {
         candidate: import("./types.js").ImportCandidate;
-        status: import("./types.js").InventoryStatus;
+        status: "ready" | "blocked" | "conflict" | "existing";
         reason: string;
         targetName: string;
     }[];

package/dist/src/imports/inventory.js

@@ -93,7 +93,21 @@ async function scanProduct(service, source, owner = "gateway-owner") {
 		});
 		for (const candidate of relevant.candidates) {
 			if (candidate.kind === "mcp") {
-				inventory.notices.push(`${candidate.name}: reconnect this tool in Connections.`);
+				inventory.candidates.push({
+					id: candidate.id,
+					kind: "connection",
+					parentId: parent?.id,
+					name: candidate.name,
+					description: candidate.description,
+					displayPath: candidate.location,
+					location: candidate.location,
+					scope: candidate.scope,
+					status: candidate.compatibility === "needs_setup" ? "requires_setup" : "blocked",
+					reason: candidate.findings.join("; ") || void 0,
+					suggested: false,
+					candidate,
+					scanId: scan.id
+				});
 				continue;
 			}
 			const item = {
@@ -192,7 +206,7 @@ function previewInventoryItem(service, owner, inventoryId, itemId) {
 		text: item.reason ?? "",
 		truncated: false
 	};
-	const text = item.kind === "context" ? item.candidate?.content ?? "" : item.kind === "skill" ? Buffer.from(service.readSnapshot(item.scanId, item.id).find((f) => f.path === "SKILL.md").data, "base64").toString("utf8") : item.displayPath;
+	const text = item.kind === "context" ? item.candidate?.content ?? "" : item.kind === "skill" ? Buffer.from(service.readSnapshot(item.scanId, item.id).find((f) => f.path === "SKILL.md").data, "base64").toString("utf8") : item.kind === "connection" ? JSON.stringify(item.candidate?.mcp ?? {}, null, 2) : item.displayPath;
 	return {
 		text: text.slice(0, 2e4),
 		truncated: text.length > 2e4

package/dist/src/imports/productImport.js

@@ -30,7 +30,7 @@ function selectedItems(inventory, ids) {
 	if (!ids.length || new Set(ids).size !== ids.length) throw new ImportError("invalid_selection", "Select at least one item; duplicate selections are not allowed");
 	return ids.map((id) => {
 		const item = inventory.candidates.find((c) => c.id === id);
-		if (!item || item.status === "blocked" || item.status === "existing" && item.kind !== "project") throw new ImportError("invalid_selection", "Select available items from this list");
+		if (!item || item.kind === "connection" || item.status === "blocked" || item.status === "requires_setup" || item.status === "existing" && item.kind !== "project") throw new ImportError("invalid_selection", "Select available items from this list");
 		if (item.parentId && !ids.includes(item.parentId)) throw new ImportError("missing_parent", "Select the project entry along with its contents");
 		return item;
 	}).sort((a, b) => Number(b.kind === "project") - Number(a.kind === "project"));
@@ -55,7 +55,7 @@ async function preflight(service, inventory, items, retry) {
 				if (digest(readRegularFile(item.location, 128 * 1024).toString("utf8").trim()) !== candidate.hash) stale();
 				const projectId = parent ? projects.findByWorkspaceRoot(parent.location)?.id : void 0;
 				if ((!parent || projectId) && existingContext(candidate, projectId)) stale();
-			} else {
+			} else if (item.kind === "skill") {
 				if (parent && !service.isWorkspaceTrusted(parent.location)) stale();
 				if (fileHash(readTree(item.location)) !== candidate.hash) stale();
 				service.readSnapshot(item.scanId, candidate.id);
@@ -69,7 +69,7 @@ async function preflight(service, inventory, items, retry) {
 					projectId: parent?.projectId
 				});
 				if ([...existing.flatMap((e) => [e.name, e.directory]), ...reserved].some((n) => n.toLowerCase() === item.targetName.toLowerCase())) stale();
-			}
+			} else throw new ImportError("invalid_selection", "Connections must be configured separately");
 		} catch (error) {
 			if (error instanceof ImportError && error.code === "inventory_stale") throw error;
 			stale();
@@ -115,7 +115,7 @@ async function execute(service, repo, inventory, run) {
 				entry.status = status === "created" ? "imported" : "existing";
 				persist();
 			});
-			else {
+			else if (item.kind === "skill") {
 				const key = `${run.id}:${item.id}`;
 				let job = service.jobByKey(key);
 				if (!job) {
@@ -143,7 +143,7 @@ async function execute(service, repo, inventory, run) {
 				if (!["active", "skipped"].includes(published.status)) throw new ImportError("publish_failed", published.error ?? "Could not publish the skill. Retry this item.");
 				entry.targetId = join(item.targetRoot, item.targetName);
 				entry.status = published.status === "active" ? "imported" : "existing";
-			}
+			} else throw new ImportError("invalid_selection", "Connections must be configured separately");
 		} catch (error) {
 			entry.status = "failed";
 			delete entry.targetId;

package/dist/src/imports/types.d.ts

@@ -70,10 +70,10 @@ export declare class ImportError extends Error {
     readonly status: 400 | 403 | 404 | 409 | 413;
     constructor(code: string, message: string, status?: 400 | 403 | 404 | 409 | 413);
 }
-export type InventoryStatus = 'ready' | 'existing' | 'conflict' | 'blocked';
+export type InventoryStatus = 'ready' | 'existing' | 'conflict' | 'requires_setup' | 'blocked';
 export interface InventoryItem {
     id: string;
-    kind: 'skill' | 'context' | 'project';
+    kind: 'skill' | 'context' | 'project' | 'connection';
     parentId?: string;
     name: string;
     description: string;
@@ -112,7 +112,7 @@ export interface ImportSelection {
 }
 export interface ImportRunItem {
     candidateId: string;
-    kind: InventoryItem['kind'];
+    kind: Exclude<InventoryItem['kind'], 'connection'>;
     name: string;
     status: 'pending' | 'imported' | 'existing' | 'failed';
     targetId?: string;