@xopcai/xopc 0.0.306 → 0.0.308

package/dist/src/config/schema.d.ts

@@ -1378,6 +1378,8 @@ export declare const McpServerSchema: z.ZodObject<{
         xopcSecretRef: z.ZodObject<{
             provider: z.ZodString;
             fieldKey: z.ZodString;
+            prefix: z.ZodOptional<z.ZodString>;
+            suffix: z.ZodOptional<z.ZodString>;
         }, z.core.$strip>;
     }, z.core.$strip>]>>>;
     cwd: z.ZodOptional<z.ZodString>;
@@ -1391,6 +1393,8 @@ export declare const McpServerSchema: z.ZodObject<{
         xopcSecretRef: z.ZodObject<{
             provider: z.ZodString;
             fieldKey: z.ZodString;
+            prefix: z.ZodOptional<z.ZodString>;
+            suffix: z.ZodOptional<z.ZodString>;
         }, z.core.$strip>;
     }, z.core.$strip>]>>>;
     auth: z.ZodOptional<z.ZodObject<{
@@ -1408,6 +1412,8 @@ export declare const McpConfigSchema: z.ZodOptional<z.ZodObject<{
             xopcSecretRef: z.ZodObject<{
                 provider: z.ZodString;
                 fieldKey: z.ZodString;
+                prefix: z.ZodOptional<z.ZodString>;
+                suffix: z.ZodOptional<z.ZodString>;
             }, z.core.$strip>;
         }, z.core.$strip>]>>>;
         cwd: z.ZodOptional<z.ZodString>;
@@ -1421,6 +1427,8 @@ export declare const McpConfigSchema: z.ZodOptional<z.ZodObject<{
             xopcSecretRef: z.ZodObject<{
                 provider: z.ZodString;
                 fieldKey: z.ZodString;
+                prefix: z.ZodOptional<z.ZodString>;
+                suffix: z.ZodOptional<z.ZodString>;
             }, z.core.$strip>;
         }, z.core.$strip>]>>>;
         auth: z.ZodOptional<z.ZodObject<{
@@ -1457,7 +1465,6 @@ export declare const ConfigSchema: z.ZodDefault<z.ZodObject<{
             enabled: z.ZodDefault<z.ZodBoolean>;
             writePolicy: z.ZodDefault<z.ZodEnum<{
                 allow: "allow";
-                confirm: "confirm";
                 deny: "deny";
             }>>;
             sensitiveWritePolicy: z.ZodDefault<z.ZodEnum<{
@@ -1494,11 +1501,10 @@ export declare const ConfigSchema: z.ZodDefault<z.ZodObject<{
                 staleRetentionDays: z.ZodDefault<z.ZodNumber>;
             }, z.core.$strict>>;
         }, z.core.$strict>>;
-        knowledgeMemory: z.ZodDefault<z.ZodPreprocess<z.ZodObject<{
+        knowledgeMemory: z.ZodDefault<z.ZodObject<{
             enabled: z.ZodDefault<z.ZodBoolean>;
             writePolicy: z.ZodDefault<z.ZodEnum<{
                 allow: "allow";
-                confirm: "confirm";
                 deny: "deny";
             }>>;
             readScopes: z.ZodDefault<z.ZodArray<z.ZodEnum<{
@@ -1531,7 +1537,7 @@ export declare const ConfigSchema: z.ZodDefault<z.ZodObject<{
             allowExternalWrites: z.ZodDefault<z.ZodBoolean>;
             allowedProviderIds: z.ZodOptional<z.ZodArray<z.ZodString>>;
             autoWriteKinds: z.ZodOptional<z.ZodArray<z.ZodString>>;
-        }, z.core.$strict>>>;
+        }, z.core.$strict>>;
         contextPlanning: z.ZodDefault<z.ZodObject<{
             enabled: z.ZodDefault<z.ZodBoolean>;
             maxAssertions: z.ZodDefault<z.ZodNumber>;
@@ -2174,6 +2180,8 @@ export declare const ConfigSchema: z.ZodDefault<z.ZodObject<{
                 xopcSecretRef: z.ZodObject<{
                     provider: z.ZodString;
                     fieldKey: z.ZodString;
+                    prefix: z.ZodOptional<z.ZodString>;
+                    suffix: z.ZodOptional<z.ZodString>;
                 }, z.core.$strip>;
             }, z.core.$strip>]>>>;
             cwd: z.ZodOptional<z.ZodString>;
@@ -2187,6 +2195,8 @@ export declare const ConfigSchema: z.ZodDefault<z.ZodObject<{
                 xopcSecretRef: z.ZodObject<{
                     provider: z.ZodString;
                     fieldKey: z.ZodString;
+                    prefix: z.ZodOptional<z.ZodString>;
+                    suffix: z.ZodOptional<z.ZodString>;
                 }, z.core.$strip>;
             }, z.core.$strip>]>>>;
             auth: z.ZodOptional<z.ZodObject<{

package/dist/src/config/schema.js

@@ -1,7 +1,7 @@
 import { __esmMin } from "../../_virtual/_rolldown/runtime.js";
-import { ComputerConfigSchema, init_config } from "../computer/config.js";
 import { AgentModelsOverrideSchema, AgentsConfigSchema as AgentsConfigSchema$1, DEFAULT_AGENT_MODEL_REF, ImageGenerationRouteSchema, ModelRouteSchema } from "../agent-config/schema.js";
 import { init_agent_config } from "../agent-config/index.js";
+import { ComputerConfigSchema, init_config } from "../computer/config.js";
 import { DEFAULT_CONTEXT_COMPACTION_POLICY, UserContextConfigSchema, init_config as init_config$1 } from "../user-context/config.js";
 import { init_default_model } from "./default-model.js";
 import { init_public_url, validatePublicUrl } from "./public-url.js";
@@ -958,7 +958,9 @@ defaultAgent: z.string().min(1).optional() }).strict().default({});
 	}, "MCP server URL must use http or https");
 	ConnectorSecretReferenceSchema = z.object({ xopcSecretRef: z.object({
 		provider: z.string().min(1),
-		fieldKey: z.string().min(1)
+		fieldKey: z.string().min(1),
+		prefix: z.string().optional(),
+		suffix: z.string().optional()
 	}) });
 	McpConfigScalarSchema = z.union([
 		z.string(),
@@ -1052,7 +1054,7 @@ workDiscoveryOnboarding: z.boolean().default(true) }).strict().default({ workDis
 			preferences: { responseLanguage: "auto" },
 			userModel: {
 				enabled: true,
-				writePolicy: "confirm",
+				writePolicy: "allow",
 				sensitiveWritePolicy: "confirm",
 				processingPolicy: "remote_allowed",
 				extraction: {
@@ -1073,7 +1075,7 @@ workDiscoveryOnboarding: z.boolean().default(true) }).strict().default({ workDis
 			},
 			knowledgeMemory: {
 				enabled: true,
-				writePolicy: "confirm",
+				writePolicy: "allow",
 				readScopes: [
 					"global",
 					"agent",

package/dist/src/connectors/account-access.d.ts

@@ -0,0 +1,4 @@
+import type { ConnectorConnection, ConnectorInstallationPolicy } from './types.js';
+/** Account policy can only narrow the installation's permissions. */
+export declare function canAccessConnectorAccount(connection: ConnectorConnection, installation: ConnectorInstallationPolicy, agentId?: string): boolean;
+export declare function currentAccountConnections(connections: ConnectorConnection[]): ConnectorConnection[];

package/dist/src/connectors/account-access.js

@@ -0,0 +1,23 @@
+import { getConnectorAccount, init_connector_account_repository } from "../storage/sqlite/connector-account-repository.js";
+//#region src/connectors/account-access.ts
+init_connector_account_repository();
+/** Account policy can only narrow the installation's permissions. */
+function canAccessConnectorAccount(connection, installation, agentId) {
+	if (!installation.enabled || connection.principalId !== installation.principalId || connection.connectorId !== installation.connectorId || !connection.accountId) return false;
+	if (installation.allowedAgentIds.length && (!agentId || !installation.allowedAgentIds.includes(agentId))) return false;
+	if (installation.selectedAccountIds !== null && !installation.selectedAccountIds.includes(connection.accountId)) return false;
+	const account = getConnectorAccount(connection.accountId);
+	return Boolean(account?.enabled && (account.allowedAgentIds === null || agentId && account.allowedAgentIds.includes(agentId)));
+}
+function currentAccountConnections(connections) {
+	const byAccount = /* @__PURE__ */ new Map();
+	for (const connection of connections) {
+		if (!connection.accountId || connection.status !== "active") continue;
+		const existing = byAccount.get(connection.accountId);
+		const currentId = getConnectorAccount(connection.accountId)?.currentConnectionId;
+		if (!existing || connection.id === currentId || existing.id !== currentId && connection.updatedAt > existing.updatedAt) byAccount.set(connection.accountId, connection);
+	}
+	return [...byAccount.values()];
+}
+//#endregion
+export { canAccessConnectorAccount, currentAccountConnections };

package/dist/src/connectors/approval-resume.d.ts

@@ -0,0 +1,4 @@
+import type { ConnectorApprovalRecord } from './types.js';
+import type { ConnectionRecoveryService } from './connection-recovery-service.js';
+/** Approval resumes only the exact suspended objective that requested it. */
+export declare function resumeApprovedConnectorAction(approval: ConnectorApprovalRecord, recovery: ConnectionRecoveryService): Promise<boolean>;

package/dist/src/connectors/approval-resume.js

@@ -0,0 +1,23 @@
+import { getActiveConnectionWait, init_connection_wait_repository } from "../storage/sqlite/connection-wait-repository.js";
+import { randomUUID } from "node:crypto";
+//#region src/connectors/approval-resume.ts
+init_connection_wait_repository();
+/** Approval resumes only the exact suspended objective that requested it. */
+async function resumeApprovedConnectorAction(approval, recovery) {
+	if (approval.status !== "approved" || !approval.waitId || !approval.conversationId) return false;
+	const wait = getActiveConnectionWait(approval.conversationId);
+	if (!wait || wait.id !== approval.waitId || wait.principalId !== approval.principalId || wait.agentId !== approval.agentId || wait.status !== "open") return false;
+	try {
+		return (await recovery.act(wait.conversationId, {
+			action: "continue",
+			waitId: wait.id,
+			expectedTranscriptId: wait.transcriptId,
+			expectedVersion: wait.version,
+			idempotencyKey: randomUUID()
+		})).snapshot.wait?.phase === "queued";
+	} catch {
+		return false;
+	}
+}
+//#endregion
+export { resumeApprovedConnectorAction };

package/dist/src/connectors/auth-provider-registry.d.ts

@@ -6,5 +6,6 @@ export type ConnectorAuthStartResult = {
     status: string;
     authorizationUrl?: string;
     connectionId?: string;
+    attemptId?: string;
 };
 export declare function startConnectorAuthorization(definition: ConnectorDefinition, config?: Config, instanceId?: string): Promise<ConnectorAuthStartResult>;

package/dist/src/connectors/auth-provider-registry.js

@@ -32,7 +32,8 @@ async function startConnectorAuthorization(definition, config, instanceId) {
 		provider: "composio",
 		status: "pending",
 		authorizationUrl: authorization.connectUrl,
-		connectionId: authorization.connectionId
+		connectionId: authorization.connectionId,
+		attemptId: authorization.attemptId
 	};
 }
 //#endregion

package/dist/src/connectors/authorization-attempts.d.ts

@@ -0,0 +1,21 @@
+export type AuthorizationAttempt = {
+    id: string;
+    principal_id: string;
+    connector_id: string;
+    backend_id: string | null;
+    connection_id: string;
+    expected_account_id: string | null;
+    authorization_url: string | null;
+    status: 'awaiting_user' | 'succeeded' | 'failed' | 'expired';
+    expires_at: number;
+    created_at: number;
+};
+export declare function saveAuthorizationAttempt(input: {
+    connectionId: string;
+    principalId: string;
+    connectorId: string;
+    backendId?: string;
+    expectedAccountId?: string;
+    url?: string;
+}): string;
+export declare function getAuthorizationAttempt(id: string, principalId: string): AuthorizationAttempt | undefined;

package/dist/src/connectors/authorization-attempts.js

@@ -0,0 +1,33 @@
+import { getSqliteDatabase, init_transaction } from "../storage/sqlite/transaction.js";
+import { getConnectorConnection, init_connector_repository } from "../storage/sqlite/connector-repository.js";
+//#region src/connectors/authorization-attempts.ts
+init_connector_repository();
+init_transaction();
+function saveAuthorizationAttempt(input) {
+	const now = Date.now();
+	getSqliteDatabase().prepare(`INSERT INTO connector_authorization_attempts
+    (id, principal_id, connector_id, backend_id, connection_id, expected_account_id, authorization_url, status, expires_at, created_at)
+    VALUES(?,?,?,?,?,?,?,'awaiting_user',?,?)
+    ON CONFLICT(id) DO UPDATE SET expected_account_id = excluded.expected_account_id,
+      authorization_url = excluded.authorization_url, status = 'awaiting_user',
+      expires_at = excluded.expires_at, created_at = excluded.created_at`).run(input.connectionId, input.principalId, input.connectorId, input.backendId ?? null, input.connectionId, input.expectedAccountId ?? null, input.url ?? null, now + 10 * 6e4, now);
+	return input.connectionId;
+}
+function getAuthorizationAttempt(id, principalId) {
+	const db = getSqliteDatabase();
+	const row = db.prepare("SELECT * FROM connector_authorization_attempts WHERE id = ? AND principal_id = ?").get(id, principalId);
+	if (!row || row.status !== "awaiting_user") return row;
+	const connection = getConnectorConnection(row.connection_id);
+	const status = row.expires_at <= Date.now() ? "expired" : connection?.status === "active" ? row.expected_account_id && row.expected_account_id !== connection.accountId ? "failed" : "succeeded" : connection && ["failed", "revoked"].includes(connection.status) ? "failed" : "awaiting_user";
+	if (status !== row.status) {
+		db.prepare("UPDATE connector_authorization_attempts SET status = ?, authorization_url = NULL WHERE id = ?").run(status, id);
+		return {
+			...row,
+			status,
+			authorization_url: null
+		};
+	}
+	return row;
+}
+//#endregion
+export { getAuthorizationAttempt, saveAuthorizationAttempt };

package/dist/src/connectors/builtin-catalog.js

@@ -1,10 +1,8 @@
 //#region src/connectors/builtin-catalog.ts
-const BUILTIN_CONNECTOR_BACKGROUNDS = { filesystem: "#FFF7E6" };
 function builtinBranding(id) {
 	return {
 		logoUrl: `/connector-icons/${id}.svg`,
-		source: "builtin",
-		backgroundColor: BUILTIN_CONNECTOR_BACKGROUNDS[id] ?? "#FFFFFF"
+		source: "builtin"
 	};
 }
 const BUILTIN_CONNECTORS = [{

package/dist/src/connectors/catalog.js

@@ -1,7 +1,8 @@
 import { init_connection, isXopcDatabaseOpen } from "../storage/sqlite/connection.js";
-import { getCachedConnectorCatalogEntry } from "../storage/sqlite/connector-repository.js";
+import { getCachedConnectorCatalogEntry, init_connector_repository } from "../storage/sqlite/connector-repository.js";
 import { listConnectorProviderDefinitions, listConnectorProviders } from "./providers.js";
 //#region src/connectors/catalog.ts
+init_connector_repository();
 init_connection();
 const CONNECTOR_BY_ID = new Map(listConnectorProviderDefinitions().map((connector) => [connector.id, connector]));
 function listConnectorCatalog() {

package/dist/src/connectors/china-catalog.d.ts

@@ -0,0 +1,2 @@
+import type { ConnectorDefinition } from './types.js';
+export declare const CHINA_CONNECTORS: readonly ConnectorDefinition[];