@xopcai/xopc 0.0.306 → 0.0.308

package/dist/src/connectors/connected-source-ingestion.js

@@ -2,6 +2,7 @@ import { createLogger } from "../utils/logger/index.js";
 import { init_logger } from "../utils/logger.js";
 import { getConnectorInstallation, listConnectorConnections } from "../storage/sqlite/connector-repository.js";
 import "../storage/sqlite/index.js";
+import { canAccessConnectorAccount, currentAccountConnections } from "./account-access.js";
 import { ComposioSessionsAdapter } from "./composio-sessions.js";
 import { decodeConnectedSourceCursor, encodeConnectedSourceCursor } from "./connected-source-cursor.js";
 import { scopeForComposioAction } from "./composio.js";
@@ -288,11 +289,11 @@ async function ingestComposioConnectedSource(input) {
 	const installation = getConnectorInstallation(`${connectorId}-local-owner`);
 	if (!installation?.enabled) throw new Error("Connector installation is not enabled.");
 	if (installation.allowedAgentIds.length && !installation.allowedAgentIds.includes(input.agentId)) throw new Error("This agent is not allowed to sync from the connector.");
-	const activeConnections = listConnectorConnections({
+	const activeConnections = currentAccountConnections(listConnectorConnections({
 		principalId: "local-owner",
 		connectorId
-	}).filter((connection) => connection.status === "active");
-	const connection = input.connectionId ? activeConnections.find((candidate) => candidate.id === input.connectionId) : activeConnections.find((candidate) => candidate.isDefault) ?? activeConnections[0];
+	}).filter((connection) => canAccessConnectorAccount(connection, installation, input.agentId)));
+	const connection = input.connectionId ? activeConnections.find((candidate) => candidate.id === input.connectionId) : activeConnections.length === 1 ? activeConnections[0] : void 0;
 	if (!connection) throw new Error("No active connector account is available for connected source ingestion.");
 	if (!connection.accountId) throw new Error("The connector authorization is not assigned to an account.");
 	const adapter = input.adapter ?? new ComposioSessionsAdapter();

package/dist/src/connectors/connected-source-understanding.d.ts

@@ -10,6 +10,7 @@ export declare function deriveConnectedSourceUnderstanding(input: {
     sourceRunId: string;
     processingPolicy: 'local_only' | 'remote_allowed';
     analyze?: typeof analyzeUnderstandingSources;
+    assertAuthorized?: () => void;
 }): Promise<{
     created: number;
     knowledgeCount: number;

package/dist/src/connectors/connected-source-understanding.js

@@ -95,6 +95,7 @@ async function deriveConnectedSourceUnderstanding(input) {
 			config: input.config,
 			items
 		});
+		input.assertAuthorized?.();
 		const byRef = new Map(items.map((item) => [item.evidenceRef, item]));
 		let created = 0;
 		for (const candidate of analysis.profileCandidates.filter(isPortraitCandidate)) {

package/dist/src/connectors/connection-recovery-service.js

@@ -3,17 +3,18 @@ import { init_logger } from "../utils/logger.js";
 import { getSqliteDatabase, init_transaction } from "../storage/sqlite/transaction.js";
 import { readCurrentTranscriptId } from "../storage/sqlite/session-instance-repository.js";
 import { getSessionInputState, init_session_input_repository } from "../storage/sqlite/session-input-repository.js";
+import { getConnectorAccount, init_connector_account_repository } from "../storage/sqlite/connector-account-repository.js";
+import { getConnectorConnection, getConnectorInstallation, init_connector_repository, listConnectorConnections, upsertConnectorInstallation } from "../storage/sqlite/connector-repository.js";
 import { cancelConnectionObjective, getActiveConnectionWait, getConnectionWait, init_connection_wait_repository, listConnectionWaitsToCheck, publishConnectionWait, queueConnectionResolution, updateConnectionWait } from "../storage/sqlite/connection-wait-repository.js";
 import { init_session_repository } from "../storage/sqlite/session-repository.js";
-import { getConnectorInstallation, listConnectorConnections, upsertConnectorInstallation } from "../storage/sqlite/connector-repository.js";
-import { getConnectorAccount } from "../storage/sqlite/connector-account-repository.js";
+import { canAccessConnectorAccount, currentAccountConnections } from "./account-access.js";
 import { ComposioSessionsAdapter } from "./composio-sessions.js";
 import { getConfiguredComposioAuthConfigs, isComposioActionAllowedByCatalog, scopeForComposioAction } from "./composio.js";
 import { getConnectorDefinition } from "./catalog.js";
+import { listConnectorInstances } from "./instances.js";
 import { capabilityActions, isToolInputSchema, missingConnectionCapabilities } from "./connection-capabilities.js";
 import { connectorPrincipalForSession } from "./principal.js";
 import { resolveConnectionCandidate } from "./connection-candidates.js";
-import { listConnectorInstances } from "./instances.js";
 import { installConnector } from "./install.js";
 import { persistConfigMutation } from "../config/config-mutation.js";
 import { randomUUID } from "node:crypto";
@@ -22,6 +23,8 @@ init_transaction();
 init_session_repository();
 init_session_input_repository();
 init_connection_wait_repository();
+init_connector_repository();
+init_connector_account_repository();
 init_logger();
 const log = createLogger("Connectors:Recovery");
 const SCOPE_ORDER = {
@@ -88,12 +91,13 @@ var ConnectionRecoveryService = class {
 			const instance = listConnectorInstances(this.deps.getConfig()).find((instance) => instance.connectorId === need.connectorId);
 			const installation = getConnectorInstallation(`${need.connectorId}-${wait.principalId}`);
 			const scopeBlocked = Math.max(1, ...need.capabilities.filter((capability) => /^[A-Z]+_/.test(capability)).map((capability) => SCOPE_ORDER[scopeForComposioAction(capability).scope])) > SCOPE_ORDER[installation?.maxScope ?? "read"];
-			const blocked = scopeBlocked || instance?.enabled === false || installation?.enabled === false || Boolean(installation?.allowedAgentIds.length && !installation.allowedAgentIds.includes(wait.agentId));
 			const all = listConnectorConnections({
 				principalId: wait.principalId,
 				connectorId: need.connectorId
 			});
-			const eligible = all.filter((connection) => connection.status === "active" && (!verifiedIds || verifiedIds.has(connection.id)) && (!need.accountId || connection.accountId === need.accountId) && (!installation?.selectedConnectionIds.length || installation.selectedConnectionIds.includes(connection.id)));
+			const requested = need.accountId ? all.find((connection) => connection.accountId === need.accountId) : void 0;
+			const blocked = scopeBlocked || instance?.enabled === false || installation?.enabled === false || installation?.selectedAccountIds?.length === 0 || Boolean(installation && requested && !canAccessConnectorAccount(requested, installation, wait.agentId)) || Boolean(installation?.allowedAgentIds.length && !installation.allowedAgentIds.includes(wait.agentId));
+			const eligible = all.filter((connection) => connection.status === "active" && (!installation || canAccessConnectorAccount(connection, installation, wait.agentId)) && (!verifiedIds || verifiedIds.has(connection.id)) && (!need.accountId || connection.accountId === need.accountId) && (installation?.selectedAccountIds == null || Boolean(connection.accountId && installation.selectedAccountIds.includes(connection.accountId))));
 			const byAccount = /* @__PURE__ */ new Map();
 			for (const connection of eligible) {
 				const key = connection.accountId ?? connection.id;
@@ -102,7 +106,7 @@ var ConnectionRecoveryService = class {
 				if (!previous || connection.id === preferredId || previous.id !== preferredId && connection.updatedAt > previous.updatedAt) byAccount.set(key, connection);
 			}
 			const active = [...byAccount.values()];
-			const selected = !verifiedIds && need.unavailable ? void 0 : need.attempt ? active.find((connection) => connection.providerConnectionId === need.attempt?.connectionId) : need.connectionId ? active.find((connection) => connection.id === need.connectionId) : active.length === 1 && !need.accountSelector ? active[0] : void 0;
+			const selected = !verifiedIds && need.unavailable ? void 0 : need.attempt ? active.find((connection) => connection.providerConnectionId === need.attempt?.connectionId) : need.accountId ? active.find((connection) => connection.accountId === need.accountId) : need.connectionId ? active.find((connection) => connection.id === need.connectionId) : active.length === 1 && !need.accountSelector ? active[0] : void 0;
 			const phase = blocked || selected && need.capabilityError ? "blocked" : selected ? "ready" : active.length > 1 || need.accountSelector && active.length > 0 && !need.connectionId ? "choose_account" : need.attempt && need.attempt.expiresAt > Date.now() ? "authorizing" : need.unavailable || all.some((connection) => [
 				"expired",
 				"revoked",
@@ -115,11 +119,12 @@ var ConnectionRecoveryService = class {
 			return {
 				...need,
 				alternatives,
+				accountId: selected?.accountId ?? need.accountId,
 				connectionId: selected?.id ?? need.connectionId,
 				phase,
 				accounts: active.map((connection) => ({
-					id: connection.id,
-					label: connection.alias ?? String(connection.identity.email ?? connection.identity.name ?? connection.id)
+					id: connection.accountId,
+					label: [getConnectorAccount(connection.accountId)?.label, connection.identity.email ?? connection.identity.name ?? connection.accountId].filter(Boolean).join(" · ")
 				})),
 				...need.capabilityError && selected ? { reason: need.capabilityError } : {},
 				...blocked ? { reason: scopeBlocked ? "This action needs broader permissions. Review connector permissions in settings." : "This app is disabled or unavailable to the current agent. Review connector settings." } : {}
@@ -154,7 +159,7 @@ var ConnectionRecoveryService = class {
 			allowedAgentIds: [],
 			maxScope: "read",
 			confirmationPolicy: "writes",
-			selectedConnectionIds: []
+			selectedAccountIds: null
 		});
 	}
 	async checkCapabilities(wait, verified) {
@@ -175,10 +180,15 @@ var ConnectionRecoveryService = class {
 				const definition = getConnectorDefinition(need.connectorId);
 				if (definition?.runtime.type !== "composio" || definition.runtime.role !== "toolkit") throw new Error("Unsupported connector");
 				const toolkit = definition.runtime.toolkit;
+				const selected = views.find((view) => view.key === need.key);
+				const connection = selected?.connectionId ? getConnectorConnection(selected.connectionId) : void 0;
 				const result = await (await this.adapter.createSession({
 					principalId: wait.principalId,
 					toolkits: [toolkit],
-					authConfigs: getConfiguredComposioAuthConfigs(this.deps.getConfig(), [toolkit])
+					backendId: selected?.accountId ? getConnectorAccount(selected.accountId)?.backendId : void 0,
+					...typeof connection?.metadata.providerPrincipalId === "string" ? { providerPrincipalId: connection.metadata.providerPrincipalId } : {},
+					...connection ? { connectedAccounts: { [toolkit]: [connection.providerConnectionId] } } : {},
+					authConfigs: typeof connection?.metadata.authConfigId === "string" ? { [toolkit]: connection.metadata.authConfigId } : void 0
 				})).search({
 					query: `${toolkit} ${need.capabilities.join(" ")} ${capabilityActions(need).flat().join(" ")}`,
 					toolkits: [toolkit]
@@ -303,6 +313,8 @@ var ConnectionRecoveryService = class {
 				const auth = await this.adapter.authorize({
 					principalId: wait.principalId,
 					toolkit: definition.runtime.toolkit,
+					expectedAccountId: need.accountId,
+					backendId: need.accountId ? getConnectorAccount(need.accountId)?.backendId : void 0,
 					installationId,
 					authConfigId: getConfiguredComposioAuthConfigs(config, [definition.runtime.toolkit])?.[definition.runtime.toolkit]
 				});
@@ -336,7 +348,7 @@ var ConnectionRecoveryService = class {
 				const latest = getConnectionWait(wait.id);
 				if (!latest || latest.version !== wait.version || latest.status !== "open") throw new Error("WAIT_CHANGED");
 				let needs = wait.needs.map((need) => {
-					const authorized = fresh.find((item) => item.providerConnectionId === need.attempt?.connectionId && item.status === "active");
+					const authorized = fresh.find((item) => item.providerConnectionId === need.attempt?.connectionId && item.status === "active" && item.connectorId === need.connectorId && (!need.accountId || item.accountId === need.accountId));
 					return authorized ? {
 						...need,
 						unavailable: false,
@@ -352,8 +364,8 @@ var ConnectionRecoveryService = class {
 				});
 				if (action.action === "select_account") {
 					const need = needs.find((item) => item.key === action.needKey);
-					const connection = fresh.find((item) => item.id === action.accountId && item.connectorId === need?.connectorId && item.status === "active");
-					if (!need || !connection || !this.view(wait, verified).needs.find((item) => item.key === need.key)?.accounts.some((item) => item.id === connection.id)) throw new Error("Account is unavailable.");
+					const connection = currentAccountConnections(fresh).find((item) => item.accountId === action.accountId && item.connectorId === need?.connectorId);
+					if (!need || !connection || !this.view(wait, verified).needs.find((item) => item.key === need.key)?.accounts.some((item) => item.id === connection.accountId)) throw new Error("Account is unavailable.");
 					needs = needs.map((item) => item.key === need.key ? {
 						...item,
 						connectionId: connection.id,

package/dist/src/connectors/connector-identity.d.ts

@@ -1,4 +1,6 @@
 import type { ConnectorConnection } from './types.js';
+/** Only verified display fields may enter model context or account summaries. */
+export declare function connectorIdentitySummary(identity: Record<string, unknown>): Record<string, string>;
 export declare function normalizeConnectorIdentity(toolkit: string, result: unknown): ConnectorConnection['identity'];
 export declare function connectorIdentityKey(toolkit: string, identity: Record<string, unknown>): string | undefined;
 export declare function mergeConnectorIdentity(toolkit: string, current: Record<string, unknown>, incoming: Record<string, unknown>): Record<string, unknown>;

package/dist/src/connectors/connector-identity.js

@@ -1,4 +1,17 @@
 //#region src/connectors/connector-identity.ts
+/** Only verified display fields may enter model context or account summaries. */
+function connectorIdentitySummary(identity) {
+	return Object.fromEntries([
+		"email",
+		"username",
+		"displayName",
+		"workspace",
+		"workspaceId",
+		"userId",
+		"enterpriseId",
+		"botUserId"
+	].flatMap((key) => typeof identity[key] === "string" && identity[key].trim() ? [[key, identity[key].slice(0, 320)]] : []));
+}
 function object(value) {
 	if (!value || typeof value !== "object" || Array.isArray(value)) return {};
 	return value;
@@ -85,16 +98,16 @@ function mergeConnectorIdentity(toolkit, current, incoming) {
 		"googledrive",
 		"github",
 		"slack"
-	].includes(normalizedToolkit)) return {
+	].includes(normalizedToolkit)) return connectorIdentitySummary({
 		...current,
 		...incoming
-	};
+	});
 	const normalized = Object.fromEntries(Object.entries(normalizeConnectorIdentity(normalizedToolkit, incoming)).filter(([, value]) => value !== void 0 && value !== null && value !== ""));
-	return {
+	return connectorIdentitySummary({
 		...current,
 		...incoming,
 		...normalized
-	};
+	});
 }
 //#endregion
-export { connectorIdentityKey, mergeConnectorIdentity, normalizeConnectorIdentity };
+export { connectorIdentityKey, connectorIdentitySummary, mergeConnectorIdentity, normalizeConnectorIdentity };

package/dist/src/connectors/content-enrichment.js

@@ -1,5 +1,5 @@
-import { getKnowledgeSourceItem, listKnowledgeSourceItems, upsertKnowledgeSourceItems } from "../storage/sqlite/knowledge-repository.js";
 import { getConnectorConnection, getConnectorInstallation } from "../storage/sqlite/connector-repository.js";
+import { getKnowledgeSourceItem, listKnowledgeSourceItems, upsertKnowledgeSourceItems } from "../storage/sqlite/knowledge-repository.js";
 import "../storage/sqlite/index.js";
 import { ComposioSessionsAdapter } from "./composio-sessions.js";
 import { ConnectedKnowledgePipeline } from "../knowledge/connected-knowledge-pipeline.js";

package/dist/src/connectors/instances.js

@@ -27,7 +27,7 @@ function connectorInstanceFromRecord(instanceId, record) {
 	const definition = connectorDefinitionFromManagedMarker(markerRecord) ?? getConnectorDefinition(connectorId);
 	const runtime = record.runtime && typeof record.runtime === "object" && !Array.isArray(record.runtime) ? record.runtime : {};
 	const runtimeType = runtime.type;
-	if (runtimeType !== "composio" && runtimeType !== "channel" && runtimeType !== "nativeTool" && runtimeType !== "memorySource") return [];
+	if (runtimeType !== "composio" && runtimeType !== "memorySource") return [];
 	if (runtimeType === "composio" && (typeof runtime.toolkit !== "string" || runtime.role !== "credential" && runtime.role !== "toolkit")) return [];
 	const enabled = markerRecord.enabled !== false;
 	return [{
@@ -47,12 +47,6 @@ function connectorInstanceFromRecord(instanceId, record) {
 			id: instanceId,
 			toolkit: runtime.toolkit,
 			role: runtime.role
-		} : runtimeType === "channel" ? {
-			type: "channel",
-			id: instanceId
-		} : runtimeType === "nativeTool" ? {
-			type: "nativeTool",
-			id: instanceId
 		} : {
 			type: "memorySource",
 			id: instanceId

package/dist/src/connectors/learning-coordinator.js

@@ -1,8 +1,8 @@
 import { createLogger } from "../utils/logger/index.js";
 import { init_logger } from "../utils/logger.js";
 import { claimNextConnectorLearningJob, enqueueConnectorLearningJob, listConnectorLearningJobs, recoverStaleConnectorLearningJobs, setConnectorLearningPaused, updateConnectorLearningJob } from "../storage/sqlite/connector-learning-repository.js";
-import { getConnectorInstallation, listConnectorConnections, upsertConnectorConnection } from "../storage/sqlite/connector-repository.js";
 import { getConnectorAccount, reconcileConnectorAccount } from "../storage/sqlite/connector-account-repository.js";
+import { getConnectorInstallation, listConnectorConnections, upsertConnectorConnection } from "../storage/sqlite/connector-repository.js";
 import { getConnectorSyncPolicyForConnection } from "../storage/sqlite/connector-sync-policy-repository.js";
 import "../storage/sqlite/index.js";
 import { connectorIdentityKey, normalizeConnectorIdentity } from "./connector-identity.js";
@@ -15,7 +15,7 @@ import "../knowledge/index.js";
 import { ingestComposioConnectedSource } from "./connected-source-ingestion.js";
 import { deriveConnectedSourceUnderstanding } from "./connected-source-understanding.js";
 import { listConnectedContentCandidates, readConnectedContent } from "./content-enrichment.js";
-import { createUnderstandingSourceRun, getUnderstandingSourceGrant, listUnderstandingSourceRuns, updateUnderstandingSourceGrantCheckpoint, updateUnderstandingSourceRun, upsertUnderstandingSourceGrant } from "../user-context/sources/repository.js";
+import { createUnderstandingSourceRun, getUnderstandingSourceGrant, listUnderstandingSourceGrants, listUnderstandingSourceRuns, updateUnderstandingSourceGrantCheckpoint, updateUnderstandingSourceRun, upsertUnderstandingSourceGrant } from "../user-context/sources/repository.js";
 //#region src/connectors/learning-coordinator.ts
 init_logger();
 const log = createLogger("ConnectorLearning");
@@ -33,7 +33,9 @@ function connectorSourceCategory(toolkit) {
 	return "files";
 }
 function ensureUnderstandingSourceRun(job, toolkit, displayName) {
-	const grant = upsertUnderstandingSourceGrant({
+	const existing = listUnderstandingSourceGrants({ includeRevoked: true }).find((grant) => grant.sourceKey === `connector-account:${job.accountId}`);
+	if (existing?.status === "revoked") throw new Error("Source authorization was revoked.");
+	const grant = existing ?? upsertUnderstandingSourceGrant({
 		sourceKey: `connector-account:${job.accountId}`,
 		adapterId: `connector:${job.connectorId}`,
 		category: connectorSourceCategory(toolkit),
@@ -74,8 +76,17 @@ function startConnectorLearningCoordinator(options) {
 		const connection = listConnectorConnections().find((item) => item.id === connectionId && item.status === "active");
 		if (!connection) return null;
 		if (!connection.accountId) throw new Error(`Connector account is missing for connection ${connection.id}.`);
+		if (!getConnectorAccount(connection.accountId)?.enabled) return null;
+		if (listUnderstandingSourceGrants({ includeRevoked: true }).some((grant) => grant.sourceKey === `connector-account:${connection.accountId}` && grant.status === "revoked")) return null;
+		if (request.reason === "manual") {
+			const active = listConnectorLearningJobs({
+				accountId: connection.accountId,
+				limit: 100
+			}).find((job) => job.status === "running" || job.status === "queued" && (!job.nextRunAt || Date.parse(job.nextRunAt) <= Date.now()));
+			if (active) return active;
+		}
 		const syncPolicy = getConnectorSyncPolicyForConnection(connection.id);
-		if (request.reason !== "manual" && syncPolicy?.scanEnabled === false) return null;
+		if (request.reason !== "manual" && syncPolicy?.scanEnabled !== true) return null;
 		const definition = getConnectorDefinition(connection.connectorId);
 		if (definition?.runtime.type !== "composio" || definition.runtime.role !== "toolkit") return null;
 		if (!getConnectorLearningPlan(definition.runtime.toolkit)) return null;
@@ -212,13 +223,21 @@ function startConnectorLearningCoordinator(options) {
 			knowledgeCount: 0,
 			status: "completed"
 		};
+		const sourceGrantPolicy = getUnderstandingSourceGrant(sourceRun.grantId)?.processingPolicy;
 		try {
 			semantic = await deriveConnectedSourceUnderstanding({
 				config: options.getConfig(),
 				agentId: job.agentId,
 				sourceInstanceId: job.sourceInstanceId,
 				sourceRunId: sourceRun.id,
-				processingPolicy: getUnderstandingSourceGrant(sourceRun.grantId)?.processingPolicy ?? "local_only"
+				processingPolicy: getUnderstandingSourceGrant(sourceRun.grantId)?.processingPolicy ?? "local_only",
+				assertAuthorized: () => {
+					const grant = getUnderstandingSourceGrant(sourceRun.grantId);
+					if (grant?.status !== "active" || !getConnectorAccount(job.accountId)?.enabled || grant.processingPolicy !== sourceGrantPolicy || !learningEnabled(options.getConfig()) || listConnectorLearningJobs({
+						accountId: job.accountId,
+						limit: 100
+					}).find((item) => item.id === job.id)?.status !== "running") throw new Error("Source authorization changed during analysis.");
+				}
 			});
 		} catch (error) {
 			const errorMessage = error instanceof Error ? error.message : String(error);
@@ -275,7 +294,7 @@ function startConnectorLearningCoordinator(options) {
 			...retention
 		}, "Connected source retention pruned");
 		const syncPolicy = getConnectorSyncPolicyForConnection(job.connectionId);
-		if (syncPolicy?.scanEnabled === false) return;
+		if (syncPolicy?.scanEnabled !== true) return;
 		const intervalMinutes = syncPolicy?.intervalMinutes ?? plan.intervalMinutes;
 		const nextRunAt = Date.now() + intervalMinutes * 6e4;
 		enqueueConnection(getConnectorAccount(job.accountId)?.currentConnectionId ?? job.connectionId, {
@@ -296,7 +315,7 @@ function startConnectorLearningCoordinator(options) {
 					await execute(job);
 				} catch (err) {
 					const errorMessage = err instanceof Error ? err.message : String(err);
-					const exhausted = job.attemptCount >= 5;
+					const exhausted = job.attemptCount >= 5 || job.idempotencyKey.startsWith("understanding-refresh:");
 					publish(updateConnectorLearningJob(job.id, {
 						status: exhausted ? "paused" : "failed",
 						error: learningFailureCode(err),
@@ -304,11 +323,15 @@ function startConnectorLearningCoordinator(options) {
 						finished: true
 					}));
 					const definition = getConnectorDefinition(job.connectorId);
-					if (definition?.runtime.type === "composio" && definition.runtime.role === "toolkit") updateUnderstandingSourceRun(ensureUnderstandingSourceRun(job, definition.runtime.toolkit, definition.displayName).id, {
-						status: "failed",
-						errorMessage: learningFailureCode(err),
-						completed: true
-					});
+					if (definition?.runtime.type === "composio" && definition.runtime.role === "toolkit") {
+						const grant = listUnderstandingSourceGrants({ includeRevoked: true }).find((item) => item.sourceKey === `connector-account:${job.accountId}`);
+						const sourceRun = grant && listUnderstandingSourceRuns(grant.id, 100).find((item) => item.metadata.connectorLearningJobId === job.id);
+						if (sourceRun) updateUnderstandingSourceRun(sourceRun.id, {
+							status: "failed",
+							errorMessage: learningFailureCode(err),
+							completed: true
+						});
+					}
 					log.warn({
 						err,
 						jobId: job.id,

package/dist/src/connectors/materialize.js

@@ -4,6 +4,7 @@ import { createConnectorSecretReference } from "./secret-store.js";
 init_schema();
 const SERVER_ID_PATTERN = /^[a-z][a-z0-9_-]{0,63}$/;
 const TEMPLATE_PATTERN = /^\{\{(secrets|config)\.([A-Za-z0-9_.-]+)\}\}$/;
+const EMBEDDED_SECRET_PATTERN = /\{\{secrets\.([A-Za-z0-9_.-]+)\}\}/g;
 function assertValidConnectorServerId(serverId) {
 	if (!SERVER_ID_PATTERN.test(serverId)) throw new Error("Connector server name must start with a lowercase letter and only contain lowercase letters, numbers, dashes, and underscores.");
 }
@@ -14,7 +15,19 @@ function readInputValue(definition, input, scope, key) {
 function resolveTemplateValue(value, definition, input) {
 	if (typeof value !== "string") return value;
 	const match = TEMPLATE_PATTERN.exec(value.trim());
-	if (!match) return value;
+	if (!match) {
+		const matches = [...value.matchAll(EMBEDDED_SECRET_PATTERN)];
+		if (matches.length === 0) return value;
+		if (matches.length > 1) throw new Error("Connector template values may contain at most one embedded secret.");
+		const embedded = matches[0];
+		const token = embedded[0];
+		const fieldKey = embedded[1];
+		const offset = embedded.index ?? 0;
+		return createConnectorSecretReference(definition.id, fieldKey, {
+			prefix: value.slice(0, offset),
+			suffix: value.slice(offset + token.length)
+		});
+	}
 	return readInputValue(definition, input, match[1], match[2]);
 }
 function materializeTemplate(value, definition, input) {

package/dist/src/connectors/policy.d.ts

@@ -8,6 +8,6 @@ export declare function evaluateConnectorExecutionPolicy(input: {
     installation: ConnectorInstallationPolicy;
     action: Pick<ConnectorActionMetadata, 'scope' | 'curated'>;
     agentId?: string;
-    connectionId?: string;
+    accountId?: string;
     confirmed?: boolean;
 }): ConnectorPolicyEvaluation;

package/dist/src/connectors/policy.js

@@ -21,7 +21,7 @@ function evaluateConnectorExecutionPolicy(input) {
 		decision: "denied",
 		reason: "Agent is not allowed to use this connector."
 	};
-	if (installation.selectedConnectionIds.length > 0 && (!input.connectionId || !installation.selectedConnectionIds.includes(input.connectionId))) return {
+	if (installation.selectedAccountIds !== null && (!input.accountId || !installation.selectedAccountIds.includes(input.accountId))) return {
 		decision: "denied",
 		reason: "Connection is not allowed by this connector policy."
 	};

package/dist/src/connectors/principal.js

@@ -1,17 +1,38 @@
+import { getSessionMetadata, init_session_repository } from "../storage/sqlite/session-repository.js";
 import { getConversationRouting } from "../storage/sqlite/conversation-repository.js";
 import { init_session_key } from "../routing/session-key.js";
 //#region src/connectors/principal.ts
 init_session_key();
+init_session_repository();
 function connectorPrincipalForSession(conversationId) {
-	const parsed = getConversationRouting(conversationId);
+	let parsed = getConversationRouting(conversationId);
+	const agentId = parsed?.agentId;
+	const visited = /* @__PURE__ */ new Set();
+	while (conversationId && parsed?.source === "workflow" && !visited.has(conversationId) && visited.size < 8) {
+		visited.add(conversationId);
+		const metadata = getSessionMetadata(conversationId);
+		const parent = metadata?.parentConversationId ?? metadata?.customData?.parentConversationId;
+		if (typeof parent !== "string") {
+			if (metadata?.sessionType === "workflow-run") return {
+				principalId: "local-owner",
+				agentId,
+				isLocalOwner: true
+			};
+			break;
+		}
+		const parentRouting = getConversationRouting(parent);
+		if (!parentRouting) break;
+		conversationId = parent;
+		parsed = parentRouting;
+	}
 	if (!parsed || parsed.source === "cli" || parsed.source === "webchat") return {
 		principalId: "local-owner",
-		agentId: parsed?.agentId,
+		agentId,
 		isLocalOwner: true
 	};
 	return {
 		principalId: `channel:${parsed.source}:${parsed.accountId}:${parsed.peerKind}:${parsed.peerId}`,
-		agentId: parsed.agentId,
+		agentId,
 		isLocalOwner: false
 	};
 }

package/dist/src/connectors/providers.d.ts

@@ -6,5 +6,6 @@ export type ConnectorProvider = {
 };
 export declare const builtinConnectorProvider: ConnectorProvider;
 export declare const composioConnectorProvider: ConnectorProvider;
+export declare const chinaConnectorProvider: ConnectorProvider;
 export declare function listConnectorProviders(): ConnectorProvider[];
 export declare function listConnectorProviderDefinitions(): ConnectorDefinition[];

package/dist/src/connectors/providers.js

@@ -1,4 +1,5 @@
 import { BUILTIN_CONNECTORS } from "./builtin-catalog.js";
+import { CHINA_CONNECTORS } from "./china-catalog.js";
 import { COMPOSIO_CONNECTORS } from "./composio.js";
 //#region src/connectors/providers.ts
 const builtinConnectorProvider = {
@@ -15,7 +16,18 @@ const composioConnectorProvider = {
 		return COMPOSIO_CONNECTORS;
 	}
 };
-const CONNECTOR_PROVIDERS = [builtinConnectorProvider, composioConnectorProvider];
+const chinaConnectorProvider = {
+	id: "china",
+	displayName: "China connectors",
+	listConnectors() {
+		return CHINA_CONNECTORS;
+	}
+};
+const CONNECTOR_PROVIDERS = [
+	builtinConnectorProvider,
+	chinaConnectorProvider,
+	composioConnectorProvider
+];
 function listConnectorProviders() {
 	return [...CONNECTOR_PROVIDERS];
 }
@@ -23,4 +35,4 @@ function listConnectorProviderDefinitions() {
 	return CONNECTOR_PROVIDERS.flatMap((provider) => provider.listConnectors());
 }
 //#endregion
-export { builtinConnectorProvider, composioConnectorProvider, listConnectorProviderDefinitions, listConnectorProviders };
+export { builtinConnectorProvider, chinaConnectorProvider, composioConnectorProvider, listConnectorProviderDefinitions, listConnectorProviders };

package/dist/src/connectors/runtime-adapter-registry.js

@@ -2,7 +2,6 @@ import { isXopcDatabaseOpen } from "../storage/sqlite/connection.js";
 import { deleteConnectorInstallation, getConnectorInstallation, upsertConnectorInstallation } from "../storage/sqlite/connector-repository.js";
 import "../storage/sqlite/index.js";
 import { assertComposioAccessConfigured } from "./composio-sessions.js";
-import { saveComposioApiKey } from "./composio.js";
 import { saveConnectorSecrets } from "./secret-store.js";
 import { isManagedConnectorServer, materializeConnectorMcpServer } from "./materialize.js";
 import { appendConnectorAuditRecord } from "./usage.js";
@@ -106,7 +105,7 @@ registerConnectorRuntimeAdapter({
 	type: "composio",
 	async install({ config, definition, input, resolver }) {
 		if (definition.runtime.type !== "composio") throw new Error(`Invalid Composio connector definition: ${definition.id}`);
-		if (definition.runtime.role === "credential") await saveComposioApiKey(input, resolver);
+		if (definition.runtime.role !== "toolkit") throw new Error("Configure Composio in connection service settings.");
 		if (definition.runtime.role === "toolkit") await assertComposioAccessConfigured(resolver);
 		const instance = installRecord(config, definition, definition.runtime.role === "toolkit" ? { scope: "read" } : {}, definition.runtime.role === "toolkit" ? { config: input.config ?? {} } : {});
 		if (definition.runtime.role === "toolkit" && isXopcDatabaseOpen()) {
@@ -120,7 +119,7 @@ registerConnectorRuntimeAdapter({
 				allowedAgentIds: existing?.allowedAgentIds ?? [],
 				maxScope: "read",
 				confirmationPolicy: existing?.confirmationPolicy ?? "writes",
-				selectedConnectionIds: existing?.selectedConnectionIds ?? [],
+				selectedAccountIds: existing?.selectedAccountIds ?? null,
 				createdAt: existing?.createdAt
 			});
 		}
@@ -145,12 +144,8 @@ registerConnectorRuntimeAdapter({
 		return installedInstance(config, instanceId, definition.id);
 	}
 });
-for (const type of [
-	"channel",
-	"nativeTool",
-	"memorySource"
-]) registerConnectorRuntimeAdapter({
-	type,
+registerConnectorRuntimeAdapter({
+	type: "memorySource",
 	async install({ config, definition, input }) {
 		return installRecord(config, definition, {}, { config: input.config ?? {} });
 	},

package/dist/src/connectors/secret-store.d.ts

@@ -1,7 +1,10 @@
 import { CredentialResolver } from '../auth/credentials.js';
 import type { ConnectorDefinition, ConnectorInstallInput, ConnectorSecretReference } from './types.js';
 export declare function connectorSecretProviderId(connectorId: string, fieldKey: string): string;
-export declare function createConnectorSecretReference(connectorId: string, fieldKey: string): ConnectorSecretReference;
+export declare function createConnectorSecretReference(connectorId: string, fieldKey: string, affixes?: {
+    prefix?: string;
+    suffix?: string;
+}): ConnectorSecretReference;
 export declare function isConnectorSecretReference(value: unknown): value is ConnectorSecretReference;
 export declare function saveConnectorSecrets(definition: ConnectorDefinition, input: ConnectorInstallInput, resolver?: CredentialResolver): Promise<void>;
 export declare function resolveConnectorSecretReferences(value: unknown, resolver?: CredentialResolver): Promise<unknown>;

package/dist/src/connectors/secret-store.js

@@ -8,10 +8,12 @@ function normalizeSecretSegment(value) {
 function connectorSecretProviderId(connectorId, fieldKey) {
 	return `connector-${normalizeSecretSegment(connectorId)}-${normalizeSecretSegment(fieldKey)}`;
 }
-function createConnectorSecretReference(connectorId, fieldKey) {
+function createConnectorSecretReference(connectorId, fieldKey, affixes = {}) {
 	return { xopcSecretRef: {
 		provider: connectorSecretProviderId(connectorId, fieldKey),
-		fieldKey
+		fieldKey,
+		...affixes.prefix ? { prefix: affixes.prefix } : {},
+		...affixes.suffix ? { suffix: affixes.suffix } : {}
 	} };
 }
 function isConnectorSecretReference(value) {
@@ -28,7 +30,9 @@ async function saveConnectorSecrets(definition, input, resolver = new Credential
 	}
 }
 async function resolveSecretReference(reference, resolver) {
-	return await resolver.resolveApiKey(reference.xopcSecretRef.provider) ?? void 0;
+	const value = await resolver.resolveApiKey(reference.xopcSecretRef.provider);
+	if (!value) return void 0;
+	return `${reference.xopcSecretRef.prefix ?? ""}${value}${reference.xopcSecretRef.suffix ?? ""}`;
 }
 async function resolveConnectorSecretReferences(value, resolver = new CredentialResolver()) {
 	if (isConnectorSecretReference(value)) return resolveSecretReference(value, resolver);

package/dist/src/connectors/source-change-publisher.js

@@ -1,10 +1,12 @@
 import { createLogger } from "../utils/logger/index.js";
 import { init_logger } from "../utils/logger.js";
+import { getConnectorAccount, init_connector_account_repository } from "../storage/sqlite/connector-account-repository.js";
+import { init_connector_repository, listConnectorConnections } from "../storage/sqlite/connector-repository.js";
 import { getKnowledgeConsumerWatermark, getKnowledgeSourceItem, listKnowledgeSourceChanges, setKnowledgeConsumerWatermark } from "../storage/sqlite/knowledge-repository.js";
-import { listConnectorConnections } from "../storage/sqlite/connector-repository.js";
-import { getConnectorAccount } from "../storage/sqlite/connector-account-repository.js";
 import { getConnectorSyncPolicyForConnection } from "../storage/sqlite/connector-sync-policy-repository.js";
 //#region src/connectors/source-change-publisher.ts
+init_connector_account_repository();
+init_connector_repository();
 init_logger();
 const log = createLogger("Connector:SourceChanges");
 const CONSUMER_ID = "proactive-connected-source-v1";