@xopcai/xopc 0.0.303 → 0.0.307

package/dist/src/migrations/knowledge-memory-read-policy-config.js

@@ -0,0 +1,48 @@
+import { init_config, normalizeKnowledgeMemoryConfigInput } from "../user-context/config.js";
+import { init_lock, isGatewayConfigLockedByAnotherProcessSync } from "../gateway/lock.js";
+import { existsSync, readFileSync } from "node:fs";
+//#region src/migrations/knowledge-memory-read-policy-config.ts
+init_lock();
+init_config();
+const id = "knowledge-memory-read-policy-config";
+function convertedConfig(ctx) {
+	if (!existsSync(ctx.configPath)) return null;
+	const config = JSON.parse(readFileSync(ctx.configPath, "utf8"));
+	const userContext = config.userContext;
+	if (!userContext || typeof userContext !== "object" || Array.isArray(userContext)) return null;
+	const knowledgeMemory = userContext.knowledgeMemory;
+	if (!knowledgeMemory || typeof knowledgeMemory !== "object" || Array.isArray(knowledgeMemory)) return null;
+	const memory = knowledgeMemory;
+	if (!Array.isArray(memory.sources)) return null;
+	userContext.knowledgeMemory = normalizeKnowledgeMemoryConfigInput(memory);
+	return config;
+}
+function item(status) {
+	return {
+		id,
+		title: "Knowledge memory read policy configuration",
+		kind: "config",
+		safety: "auto",
+		status,
+		message: "Split knowledge memory visibility scopes from content sources."
+	};
+}
+const knowledgeMemoryReadPolicyConfigMigration = {
+	id,
+	kind: "config",
+	safety: "auto",
+	detect: (ctx) => convertedConfig(ctx) ? item("planned") : null,
+	apply: (ctx) => {
+		if (isGatewayConfigLockedByAnotherProcessSync(ctx.configPath)) return {
+			...item("skipped"),
+			message: "Deferred knowledge memory config migration until the running gateway restarts."
+		};
+		const config = convertedConfig(ctx);
+		return config ? {
+			...item("applied"),
+			details: { config }
+		} : item("not_needed");
+	}
+};
+//#endregion
+export { knowledgeMemoryReadPolicyConfigMigration };

package/dist/src/migrations/runner.js

@@ -3,6 +3,7 @@ import { init_logger } from "../utils/logger.js";
 import { ConfigSchema, init_schema } from "../config/schema.js";
 import { listRegisteredMigrations } from "./registry.js";
 import { conversationRoutingConfigMigration } from "./conversation-routing-config.js";
+import { knowledgeMemoryReadPolicyConfigMigration } from "./knowledge-memory-read-policy-config.js";
 import { dirname, join } from "node:path";
 import { existsSync, mkdirSync, readFileSync, renameSync, writeFileSync } from "node:fs";
 //#region src/migrations/runner.ts
@@ -11,7 +12,7 @@ init_logger();
 const log = createLogger("Migrations");
 const MIGRATION_LEDGER_FILENAME = "migrations.json";
 const CONFIG_BACKUP_COUNT = 10;
-const CORE_MIGRATIONS = [conversationRoutingConfigMigration];
+const CORE_MIGRATIONS = [conversationRoutingConfigMigration, knowledgeMemoryReadPolicyConfigMigration];
 function listAllMigrations() {
 	return [...CORE_MIGRATIONS, ...listRegisteredMigrations().map((entry) => entry.migration)];
 }

package/dist/src/proactive/follow-ups.js

@@ -1,6 +1,6 @@
 import { getSqliteDatabase, init_transaction, runSqliteWriteTransaction } from "../storage/sqlite/transaction.js";
+import { getConnectorConnection, init_connector_repository } from "../storage/sqlite/connector-repository.js";
 import { listKnowledgeSourceItems } from "../storage/sqlite/knowledge-repository.js";
-import { getConnectorConnection } from "../storage/sqlite/connector-repository.js";
 import { sourceFreshness } from "./source-freshness.js";
 import { emailFields, readMailThread } from "./mail-thread.js";
 import { authorizedConnectedSource } from "./execution/authorization.js";
@@ -12,6 +12,7 @@ import { ProactiveEventService } from "./service.js";
 import { randomUUID } from "node:crypto";
 import { z } from "zod";
 //#region src/proactive/follow-ups.ts
+init_connector_repository();
 init_transaction();
 const COMMUNICATION_SCENARIO = "communication_follow_up";
 const CreateSchema = z.object({

package/dist/src/process/bounded-output.d.ts

@@ -0,0 +1,10 @@
+export interface BoundedOutput {
+    readonly text: string;
+    readonly totalBytes: number;
+    readonly truncated: boolean;
+}
+/** Keeps the newest bytes so failures retain their most useful tail output. */
+export declare function createBoundedOutput(maxBytes: number): {
+    append(chunk: Buffer | string): void;
+    snapshot(): BoundedOutput;
+};

package/dist/src/process/bounded-output.js

@@ -0,0 +1,41 @@
+//#region src/process/bounded-output.ts
+/** Keeps the newest bytes so failures retain their most useful tail output. */
+function createBoundedOutput(maxBytes) {
+	const limit = Math.max(0, Math.floor(maxBytes));
+	let chunks = [];
+	let capturedBytes = 0;
+	let totalBytes = 0;
+	return {
+		append(chunk) {
+			const value = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
+			totalBytes += value.byteLength;
+			if (limit === 0) {
+				chunks = [];
+				capturedBytes = 0;
+				return;
+			}
+			chunks.push(value);
+			capturedBytes += value.byteLength;
+			while (capturedBytes > limit && chunks.length > 0) {
+				const excess = capturedBytes - limit;
+				const first = chunks[0];
+				if (first.byteLength <= excess) {
+					chunks.shift();
+					capturedBytes -= first.byteLength;
+				} else {
+					chunks[0] = first.subarray(excess);
+					capturedBytes -= excess;
+				}
+			}
+		},
+		snapshot() {
+			return {
+				text: Buffer.concat(chunks, capturedBytes).toString("utf8"),
+				totalBytes,
+				truncated: totalBytes > capturedBytes
+			};
+		}
+	};
+}
+//#endregion
+export { createBoundedOutput };

package/dist/src/process/kill-tree.d.ts

@@ -1,18 +1,7 @@
-/**
- * Best-effort process-tree termination with graceful shutdown.
- * - Windows: use taskkill /T to include descendants. Sends SIGTERM-equivalent
- *   first (without /F), then force-kills if process survives.
- * - Unix: send SIGTERM to process group first, wait grace period, then SIGKILL.
- *
- * This gives child processes a chance to clean up (close connections, remove
- * temp files, terminate their own children) before being hard-killed.
- *
- * When the child was spawned with `detached: false` (e.g. service-managed
- * runtime under launchd/systemd), pass `detached: false` to skip the Unix
- * `process.kill(-pid, ...)` group-kill — it would otherwise target the
- * gateway's own process group and SIGTERM the gateway itself. (#71662)
- */
-export declare function killProcessTree(pid: number, opts?: {
-    graceMs?: number;
+import { type ChildProcess } from 'node:child_process';
+/** Terminates a child and optionally its process tree, escalating after a grace period. */
+export declare function terminateProcess(child: ChildProcess, options?: {
+    tree?: boolean;
     detached?: boolean;
-}): void;
+    graceMs?: number;
+}): Promise<boolean>;

package/dist/src/process/kill-tree.js

@@ -1,35 +1,7 @@
 import { spawn } from "node:child_process";
 //#region src/process/kill-tree.ts
 const DEFAULT_GRACE_MS = 3e3;
-const MAX_GRACE_MS = 6e4;
-/**
-* Best-effort process-tree termination with graceful shutdown.
-* - Windows: use taskkill /T to include descendants. Sends SIGTERM-equivalent
-*   first (without /F), then force-kills if process survives.
-* - Unix: send SIGTERM to process group first, wait grace period, then SIGKILL.
-*
-* This gives child processes a chance to clean up (close connections, remove
-* temp files, terminate their own children) before being hard-killed.
-*
-* When the child was spawned with `detached: false` (e.g. service-managed
-* runtime under launchd/systemd), pass `detached: false` to skip the Unix
-* `process.kill(-pid, ...)` group-kill — it would otherwise target the
-* gateway's own process group and SIGTERM the gateway itself. (#71662)
-*/
-function killProcessTree(pid, opts) {
-	if (!Number.isFinite(pid) || pid <= 0) return;
-	const graceMs = normalizeGraceMs(opts?.graceMs);
-	if (process.platform === "win32") {
-		killProcessTreeWindows(pid, graceMs);
-		return;
-	}
-	killProcessTreeUnix(pid, graceMs, opts?.detached !== false);
-}
-function normalizeGraceMs(value) {
-	if (typeof value !== "number" || !Number.isFinite(value)) return DEFAULT_GRACE_MS;
-	return Math.max(0, Math.min(MAX_GRACE_MS, Math.floor(value)));
-}
-function isProcessAlive(pid) {
+function processAlive(pid) {
 	try {
 		process.kill(pid, 0);
 		return true;
@@ -37,56 +9,52 @@ function isProcessAlive(pid) {
 		return false;
 	}
 }
-function killProcessTreeUnix(pid, graceMs, useGroupKill) {
-	if (useGroupKill) try {
-		process.kill(-pid, "SIGTERM");
-	} catch {
-		try {
-			process.kill(pid, "SIGTERM");
-		} catch {
-			return;
-		}
-	}
-	else try {
-		process.kill(pid, "SIGTERM");
-	} catch {
-		return;
-	}
-	setTimeout(() => {
-		if (useGroupKill && isProcessAlive(-pid)) try {
-			process.kill(-pid, "SIGKILL");
-			return;
-		} catch {}
-		if (!isProcessAlive(pid)) return;
-		try {
-			process.kill(pid, "SIGKILL");
-		} catch {}
-	}, graceMs).unref();
+function delay(ms) {
+	return new Promise((resolve) => {
+		setTimeout(resolve, ms).unref();
+	});
 }
-function runTaskkill(args) {
-	try {
-		spawn("taskkill", args, {
+function taskkill(pid, force) {
+	return new Promise((resolve) => {
+		const child = spawn("taskkill", [
+			...force ? ["/F"] : [],
+			"/T",
+			"/PID",
+			String(pid)
+		], {
 			stdio: "ignore",
-			detached: true,
 			windowsHide: true
 		});
-	} catch {}
+		child.once("error", () => resolve());
+		child.once("close", () => resolve());
+	});
 }
-function killProcessTreeWindows(pid, graceMs) {
-	runTaskkill([
-		"/T",
-		"/PID",
-		String(pid)
-	]);
-	setTimeout(() => {
-		if (!isProcessAlive(pid)) return;
-		runTaskkill([
-			"/F",
-			"/T",
-			"/PID",
-			String(pid)
-		]);
-	}, graceMs).unref();
+/** Terminates a child and optionally its process tree, escalating after a grace period. */
+async function terminateProcess(child, options = {}) {
+	const pid = child.pid;
+	if (!pid || child.exitCode !== null || child.signalCode !== null) return true;
+	const graceMs = Math.max(0, Math.min(6e4, Math.floor(options.graceMs ?? DEFAULT_GRACE_MS)));
+	if (process.platform === "win32" && options.tree) {
+		await taskkill(pid, false);
+		if (graceMs > 0 && processAlive(pid)) await delay(graceMs);
+		if (processAlive(pid)) await taskkill(pid, true);
+		return !processAlive(pid);
+	}
+	const target = options.tree && options.detached ? -pid : pid;
+	try {
+		process.kill(target, "SIGTERM");
+	} catch {
+		return true;
+	}
+	if (graceMs > 0 && processAlive(pid)) await delay(graceMs);
+	if (processAlive(pid)) try {
+		process.kill(target, "SIGKILL");
+	} catch {
+		try {
+			child.kill("SIGKILL");
+		} catch {}
+	}
+	return !processAlive(pid);
 }
 //#endregion
-export { killProcessTree };
+export { terminateProcess };

package/dist/src/process/process-spec.d.ts

@@ -0,0 +1,39 @@
+import type { ChildProcess, SpawnOptions } from 'node:child_process';
+export interface ProcessSpec {
+    program: string;
+    args?: readonly string[];
+    cwd?: string;
+    env?: NodeJS.ProcessEnv;
+    input?: string | Buffer;
+    keepStdinOpen?: boolean;
+    timeoutMs?: number | null;
+    maxOutputBytes?: number;
+    signal?: AbortSignal;
+    detached?: boolean;
+    windowsHide?: boolean;
+    shell?: SpawnOptions['shell'];
+    terminationPolicy?: 'root' | 'tree';
+    onOutput?: (stream: 'stdout' | 'stderr', chunk: Buffer) => void;
+}
+export interface ProcessResult {
+    exitCode: number | null;
+    spawnErrorCode?: string;
+    signal: NodeJS.Signals | null;
+    stdout: string;
+    stderr: string;
+    timedOut: boolean;
+    aborted: boolean;
+    outputTruncated: boolean;
+    terminationVerified: boolean;
+}
+export interface ProcessHandle {
+    readonly child: ChildProcess;
+    readonly completion: Promise<ProcessResult>;
+    terminate(reason?: 'cancelled' | 'timed_out'): void;
+}
+export declare class ProcessExitError extends Error {
+    readonly spec: ProcessSpec;
+    readonly result: ProcessResult;
+    readonly code: number | string | null;
+    constructor(spec: ProcessSpec, result: ProcessResult);
+}

package/dist/src/process/process-spec.js

@@ -0,0 +1,13 @@
+//#region src/process/process-spec.ts
+var ProcessExitError = class extends Error {
+	code;
+	constructor(spec, result) {
+		super(result.stderr.trim() || `Process exited with code ${String(result.exitCode)}`);
+		this.spec = spec;
+		this.result = result;
+		this.name = "ProcessExitError";
+		this.code = result.spawnErrorCode ?? result.exitCode;
+	}
+};
+//#endregion
+export { ProcessExitError };

package/dist/src/process/run-process.d.ts

@@ -0,0 +1,4 @@
+import { type ProcessHandle, type ProcessResult, type ProcessSpec } from './process-spec.js';
+export declare function spawnProcess(spec: ProcessSpec): ProcessHandle;
+export declare function runProcess(spec: ProcessSpec): Promise<ProcessResult>;
+export declare function runProcessChecked(spec: ProcessSpec): Promise<ProcessResult>;

package/dist/src/process/run-process.js

@@ -0,0 +1,97 @@
+import { createBoundedOutput } from "./bounded-output.js";
+import { terminateProcess } from "./kill-tree.js";
+import { ProcessExitError } from "./process-spec.js";
+import { spawn } from "node:child_process";
+//#region src/process/run-process.ts
+const DEFAULT_MAX_OUTPUT_BYTES = 1024 * 1024;
+function spawnProcess(spec) {
+	spec.signal?.throwIfAborted();
+	const detached = spec.detached ?? (spec.terminationPolicy === "tree" && process.platform !== "win32");
+	const child = spawn(spec.program, [...spec.args ?? []], {
+		cwd: spec.cwd,
+		env: spec.env ?? process.env,
+		stdio: [
+			"pipe",
+			"pipe",
+			"pipe"
+		],
+		detached,
+		windowsHide: spec.windowsHide ?? true,
+		shell: spec.shell ?? false
+	});
+	const stdout = createBoundedOutput(spec.maxOutputBytes ?? DEFAULT_MAX_OUTPUT_BYTES);
+	const stderr = createBoundedOutput(spec.maxOutputBytes ?? DEFAULT_MAX_OUTPUT_BYTES);
+	let timedOut = false;
+	let aborted = false;
+	let terminationRequested = false;
+	let settled = false;
+	let timer;
+	const terminate = (reason = "cancelled") => {
+		if (settled || terminationRequested) return;
+		terminationRequested = true;
+		timedOut = reason === "timed_out";
+		aborted = reason === "cancelled";
+		terminateProcess(child, {
+			tree: spec.terminationPolicy === "tree",
+			detached
+		});
+	};
+	const abort = () => terminate("cancelled");
+	spec.signal?.addEventListener("abort", abort, { once: true });
+	if (spec.signal?.aborted) abort();
+	if (spec.timeoutMs != null && spec.timeoutMs > 0) {
+		timer = setTimeout(() => terminate("timed_out"), spec.timeoutMs);
+		timer.unref();
+	}
+	child.stdout?.on("data", (chunk) => {
+		stdout.append(chunk);
+		spec.onOutput?.("stdout", chunk);
+	});
+	child.stderr?.on("data", (chunk) => {
+		stderr.append(chunk);
+		spec.onOutput?.("stderr", chunk);
+	});
+	child.stdin?.on("error", (error) => stderr.append(error.message));
+	if (spec.input !== void 0) child.stdin?.end(spec.input);
+	else if (!spec.keepStdinOpen) child.stdin?.end();
+	return {
+		child,
+		completion: new Promise((resolve) => {
+			let spawnError;
+			child.once("error", (error) => {
+				spawnError = error;
+			});
+			child.once("close", (exitCode, signal) => {
+				if (settled) return;
+				settled = true;
+				if (timer) clearTimeout(timer);
+				spec.signal?.removeEventListener("abort", abort);
+				if (spawnError && stderr.snapshot().totalBytes === 0) stderr.append(spawnError.message);
+				const out = stdout.snapshot();
+				const err = stderr.snapshot();
+				resolve({
+					exitCode: spawnError ? null : exitCode,
+					...spawnError && spawnError.code ? { spawnErrorCode: spawnError.code } : {},
+					signal,
+					stdout: out.text,
+					stderr: err.text,
+					timedOut,
+					aborted,
+					outputTruncated: out.truncated || err.truncated,
+					terminationVerified: !terminationRequested || child.exitCode !== null || child.signalCode !== null
+				});
+			});
+		}),
+		terminate
+	};
+}
+function runProcess(spec) {
+	return spawnProcess(spec).completion;
+}
+async function runProcessChecked(spec) {
+	const result = await runProcess(spec);
+	if (result.exitCode !== 0) throw new ProcessExitError(spec, result);
+	return result;
+}
+//#endregion
+export { runProcess, runProcessChecked, spawnProcess };

package/dist/src/providers/plugin-registry.d.ts

@@ -9,7 +9,7 @@ export declare class ProviderPluginRegistry implements ProviderRegistry {
     /**
      * Register a new provider
      */
-    register(provider: ProviderPlugin): void;
+    register(provider: ProviderPlugin): () => void;
     /**
      * Get a provider by ID
      */

package/dist/src/providers/plugin-registry.js

@@ -23,8 +23,14 @@ var init_plugin_registry = __esmMin((() => {
 			if (!provider.id) throw new Error("Provider must have an id");
 			if (!provider.name) throw new Error("Provider must have a name");
 			if (!provider.createStream || typeof provider.createStream !== "function") throw new Error("Provider must implement createStream method");
+			const previous = this.providers.get(provider.id);
 			this.providers.set(provider.id, provider);
 			log.info(`Registered provider: ${provider.name} (${provider.id})`);
+			return () => {
+				if (this.providers.get(provider.id) !== provider) return;
+				if (previous) this.providers.set(provider.id, previous);
+				else this.providers.delete(provider.id);
+			};
 		}
 		/**
 		* Get a provider by ID

package/dist/src/realtime/runtime.js

@@ -2,7 +2,7 @@ import { createLogger } from "../utils/logger/index.js";
 import { init_logger } from "../utils/logger.js";
 import { hasGatewayScope } from "../gateway/security/gateway-scopes.js";
 import { EndpointToolPolicyError } from "../endpoint-tools/policy.js";
-import { REALTIME_HEARTBEAT_INTERVAL_MS, REALTIME_HEARTBEAT_TIMEOUT_MS, REALTIME_HELLO_TIMEOUT_MS, REALTIME_MAX_CLIENT_FRAME_BYTES, parseClientRealtimeJsonFrame, parseClientRealtimeMessage } from "../../packages/realtime-protocol/src/index.js";
+import { REALTIME_CAPABILITIES, REALTIME_HEARTBEAT_INTERVAL_MS, REALTIME_HEARTBEAT_TIMEOUT_MS, REALTIME_HELLO_TIMEOUT_MS, REALTIME_MAX_CLIENT_FRAME_BYTES, parseClientRealtimeJsonFrame, parseClientRealtimeMessage } from "../../packages/realtime-protocol/src/index.js";
 import { createPreauthConnectionBudget } from "../gateway/security/preauth-connection-budget.js";
 import { RealtimeBroker } from "./broker.js";
 import { RealtimeTicketStore } from "./tickets.js";
@@ -265,10 +265,12 @@ var RealtimeRuntime = class {
 				}
 				clearTimeout(helloTimer);
 				releaseBudget();
+				const negotiatedCapabilities = message.payload.capabilities ? [...new Set(message.payload.capabilities.filter((capability) => REALTIME_CAPABILITIES.includes(capability)))] : void 0;
 				writer.enqueue(serverMessage("realtime.ready", {
 					connectionId,
 					heartbeatIntervalMs: REALTIME_HEARTBEAT_INTERVAL_MS,
 					heartbeatTimeoutMs: REALTIME_HEARTBEAT_TIMEOUT_MS,
+					...message.payload.capabilities ? { negotiatedCapabilities } : {},
 					...endpointReady ? { endpoint: endpointReady } : {}
 				}), "critical");
 				subscribe(message.payload.subscriptions);

package/dist/src/session/store.js

@@ -502,7 +502,7 @@ var SessionStore = class {
 					handover: result.handover,
 					audit: result.audit,
 					sourceEntries: expectedSnapshot.entries,
-					writePolicy: access.knowledge && this.options.config.userContext.knowledgeMemory.sources.includes("session") ? this.options.config.userContext.knowledgeMemory.writePolicy : "deny"
+					writePolicy: access.knowledge && access.knowledgePolicy.scopes.includes("session") && access.knowledgePolicy.contentSources.includes("memory") ? this.options.config.userContext.knowledgeMemory.writePolicy : "deny"
 				});
 				log.info({
 					conversationId: key,

package/dist/src/storage/sqlite/connection-wait-repository.d.ts

@@ -21,6 +21,9 @@ export declare function requireSessionConnection(input: {
 export declare function queueConnectionResolution(wait: ConnectionWait, resolution: 'continued' | 'skipped'): ConnectionWait;
 export declare function consumeConnectionResume(input: SessionInput): boolean;
 export declare function connectionBindings(conversationId: string): ConnectionNeed[];
+/** Changes to the objective or transcript invalidate an outstanding action approval. */
+export declare function connectorObjectiveScope(conversationId: string): string | undefined;
+export declare function bindObjectiveAccount(conversationId: string, connectorId: string, accountId: string): void;
 export declare function connectionBinding(conversationId: string, connectorId: string): string | undefined;
 /** New input wins over an outstanding auto-resume intent, including an already queued resume. */
 export declare function invalidateConnectionResumeIntent(conversationId: string): void;

package/dist/src/storage/sqlite/connection-wait-repository.js

@@ -6,6 +6,9 @@ import { getSqliteDatabase, init_transaction, runSqliteWriteTransaction } from "
 import { init_session_instance_repository, readCurrentTranscriptId } from "./session-instance-repository.js";
 import { bumpSessionInputRevision, getSessionInputById, getSessionInputState, init_session_input_repository, insertSessionInput, setSessionInputStatus } from "./session-input-repository.js";
 import { TaskRunRepository, init_task_run_repository } from "../../tasks/task-run-repository.js";
+import { getConnectorAccount, init_connector_account_repository } from "./connector-account-repository.js";
+import { getConnectorConnection, init_connector_repository } from "./connector-repository.js";
+import { getSessionMetadata, init_session_repository } from "./session-repository.js";
 import { randomUUID } from "node:crypto";
 import { EventEmitter } from "node:events";
 //#region src/storage/sqlite/connection-wait-repository.ts
@@ -222,9 +225,64 @@ function consumeConnectionResume(input) {
 }
 function connectionBindings(conversationId) {
 	if (!isXopcDatabaseOpen()) return [];
+	let metadata = getSessionMetadata(conversationId);
+	if (metadata?.sessionType === "workflow-subagent" && metadata.parentConversationId) metadata = getSessionMetadata(metadata.parentConversationId);
+	const workflowAccounts = metadata?.sessionType === "workflow-run" ? metadata.customData?.connectorAccounts : void 0;
+	if (workflowAccounts && typeof workflowAccounts === "object" && !Array.isArray(workflowAccounts)) return Object.entries(workflowAccounts).flatMap(([connectorId, ids]) => Array.isArray(ids) ? ids.flatMap((id) => {
+		if (typeof id !== "string") return [];
+		const account = getConnectorAccount(id);
+		return [{
+			key: `${connectorId}:${id}`,
+			connectorId,
+			accountId: id,
+			connectionId: account?.currentConnectionId,
+			label: account?.label ?? connectorId,
+			capabilities: []
+		}];
+	}) : []);
 	const state = getSessionInputState(conversationId);
 	const input = state.activeInputId ? getSessionInputById(conversationId, state.activeInputId) : void 0;
-	return input?.payload ? getConnectionWait(input.payload.waitId)?.needs ?? [] : [];
+	if (!input) return [];
+	const wait = input.payload ? getConnectionWait(input.payload.waitId) : void 0;
+	const stored = getSqliteDatabase().prepare(`SELECT connector_id, account_id FROM connector_objective_accounts
+    WHERE conversation_id = ? AND transcript_id = ? AND objective_id = ?`).all(conversationId, readCurrentTranscriptId(getSqliteDatabase(), conversationId) ?? "", wait?.objectiveId ?? input.id);
+	return (wait?.needs ?? stored.map((row) => ({
+		key: `${row.connector_id}:${row.account_id}`,
+		connectorId: row.connector_id,
+		accountId: row.account_id,
+		label: getConnectorAccount(row.account_id)?.label ?? row.connector_id,
+		capabilities: []
+	}))).map((need) => {
+		const accountId = need.accountId ?? (need.connectionId ? getConnectorConnection(need.connectionId)?.accountId : void 0);
+		const account = accountId ? getConnectorAccount(accountId) : void 0;
+		return {
+			...need,
+			accountId,
+			connectionId: account?.currentConnectionId ?? need.connectionId
+		};
+	});
+}
+/** Changes to the objective or transcript invalidate an outstanding action approval. */
+function connectorObjectiveScope(conversationId) {
+	const state = getSessionInputState(conversationId);
+	const input = state.activeInputId ? getSessionInputById(conversationId, state.activeInputId) : void 0;
+	if (!input) return void 0;
+	const active = getActiveConnectionWait(conversationId);
+	const wait = input.payload ? getConnectionWait(input.payload.waitId) : active?.originInputId === input.id ? active : void 0;
+	return JSON.stringify([
+		readCurrentTranscriptId(getSqliteDatabase(), conversationId),
+		wait?.objectiveId ?? input.id,
+		wait?.objectiveRevision ?? 0
+	]);
+}
+function bindObjectiveAccount(conversationId, connectorId, accountId) {
+	const db = getSqliteDatabase();
+	const state = getSessionInputState(conversationId);
+	const input = state.activeInputId ? getSessionInputById(conversationId, state.activeInputId) : void 0;
+	if (!input) return;
+	const wait = input.payload ? getConnectionWait(input.payload.waitId) : void 0;
+	db.prepare(`INSERT OR IGNORE INTO connector_objective_accounts
+    (conversation_id, transcript_id, objective_id, connector_id, account_id) VALUES (?, ?, ?, ?, ?)`).run(conversationId, readCurrentTranscriptId(db, conversationId) ?? "", wait?.objectiveId ?? input.id, connectorId, accountId);
 }
 function connectionBinding(conversationId, connectorId) {
 	const matches = connectionBindings(conversationId).filter((need) => need.connectorId === connectorId);
@@ -334,15 +392,18 @@ function listConnectionWaitsToCheck() {
 }
 var log, events;
 var init_connection_wait_repository = __esmMin((() => {
+	init_connector_account_repository();
+	init_connector_repository();
 	init_logger();
 	init_task_run_repository();
 	init_connection();
 	init_transaction();
 	init_session_instance_repository();
+	init_session_repository();
 	init_session_input_repository();
 	log = createLogger("Connectors:Wait");
 	events = new EventEmitter();
 }));
 //#endregion
 init_connection_wait_repository();
-export { cancelConnectionObjective, connectionBinding, connectionBindings, consumeConnectionResume, getActiveConnectionWait, getConnectionResumeInput, getConnectionWait, init_connection_wait_repository, invalidateConnectionResumeIntent, isConnectionSuspended, listConnectionWaitsToCheck, onConnectionWaitChanged, publishConnectionWait, queueConnectionResolution, requireSessionConnection, reviseCurrentConnectionObjective, updateConnectionWait };
+export { bindObjectiveAccount, cancelConnectionObjective, connectionBinding, connectionBindings, connectorObjectiveScope, consumeConnectionResume, getActiveConnectionWait, getConnectionResumeInput, getConnectionWait, init_connection_wait_repository, invalidateConnectionResumeIntent, isConnectionSuspended, listConnectionWaitsToCheck, onConnectionWaitChanged, publishConnectionWait, queueConnectionResolution, requireSessionConnection, reviseCurrentConnectionObjective, updateConnectionWait };

package/dist/src/storage/sqlite/connector-account-repository.d.ts

@@ -1,5 +1,10 @@
 import type { ConnectorAccount } from '../../connectors/types.js';
 export declare function getConnectorAccount(id: string): ConnectorAccount | undefined;
+export declare function updateConnectorAccount(id: string, patch: {
+    label?: string;
+    enabled?: boolean;
+    allowedAgentIds?: string[] | null;
+}): ConnectorAccount;
 export declare function listConnectorAccounts(options?: {
     principalId?: string;
     connectorId?: string;
@@ -7,6 +12,7 @@ export declare function listConnectorAccounts(options?: {
 export declare function refreshConnectorAccountCurrent(accountId: string): ConnectorAccount | undefined;
 export declare function reconcileConnectorAccount(input: {
     connectionId: string;
+    backendId?: string;
     identityKey: string;
     identity: Record<string, unknown>;
 }): ConnectorAccount;