@xopcai/xopc 0.0.306 → 0.0.308

package/dist/src/connectors/types.d.ts

@@ -1,4 +1,4 @@
-export type ConnectorKind = 'mcp' | 'cli' | 'http' | 'channel' | 'browser' | 'extension' | 'builtin' | 'composio' | 'nativeTool' | 'memorySource';
+export type ConnectorKind = 'mcp' | 'cli' | 'http' | 'browser' | 'extension' | 'builtin' | 'composio' | 'memorySource';
 export type ConnectorCategory = 'code' | 'docs' | 'browser' | 'data' | 'automation' | 'custom';
 export type ConnectorCapability = 'tools' | 'resources' | 'prompts' | 'context' | 'channel' | 'events' | 'ui' | 'memory_source' | 'workflows' | 'auth.apiKey' | 'auth.oauth' | 'runtime.mcp.stdio' | 'runtime.mcp.sse' | 'runtime.mcp.streamableHttp';
 export type ConnectorAuthMode = 'none' | 'apiKey' | 'oauth';
@@ -17,7 +17,6 @@ export type ConnectorBenefit = 'understand' | 'act' | 'reach';
 export type ConnectorBranding = {
     logoUrl?: string;
     source?: 'builtin' | 'composio-catalog' | 'registry' | 'extension' | 'custom';
-    backgroundColor?: string;
     fetchedAt?: string;
 };
 export type ConnectorConfirmationPolicy = 'always' | 'writes' | 'admin' | 'never';
@@ -40,6 +39,8 @@ export type ConnectorSecretReference = {
     xopcSecretRef: {
         provider: string;
         fieldKey: string;
+        prefix?: string;
+        suffix?: string;
     };
 };
 export type ConnectorSecretField = {
@@ -48,6 +49,11 @@ export type ConnectorSecretField = {
     description?: string;
     required: boolean;
 };
+export type ConnectorSetupLink = {
+    label: string;
+    href: string;
+    external?: boolean;
+};
 export type ConnectorConfigField = {
     key: string;
     label: string;
@@ -66,17 +72,10 @@ export type ConnectorRuntimeDefinition = {
         name: string;
         version: string;
     };
-} | {
-    type: 'channel';
-    channelId: string;
-    pluginId: string;
 } | {
     type: 'composio';
     toolkit: string;
     role: 'credential' | 'toolkit';
-} | {
-    type: 'nativeTool';
-    toolsetId: string;
 } | {
     type: 'memorySource';
     sourceKind: string;
@@ -103,6 +102,7 @@ export type ConnectorDefinition = {
     setup: {
         secrets?: ConnectorSecretField[];
         config?: ConnectorConfigField[];
+        links?: ConnectorSetupLink[];
     };
     runtime: ConnectorRuntimeDefinition;
     permissions?: ConnectorPermissions;
@@ -120,7 +120,7 @@ export type ConnectorInstallationPolicy = {
     allowedAgentIds: string[];
     maxScope: ConnectorScope;
     confirmationPolicy: ConnectorConfirmationPolicy;
-    selectedConnectionIds: string[];
+    selectedAccountIds: string[] | null;
     createdAt: string;
     updatedAt: string;
 };
@@ -149,8 +149,12 @@ export type ConnectorAccount = {
     connectorId: string;
     principalId: string;
     identityKey?: string;
+    backendId?: string;
     identity: Record<string, unknown>;
     currentConnectionId?: string;
+    label?: string;
+    enabled: boolean;
+    allowedAgentIds: string[] | null;
     createdAt: string;
     updatedAt: string;
 };
@@ -184,6 +188,7 @@ export type ConnectorExecutionAuditRecord = {
 export type ConnectorApprovalStatus = 'pending' | 'approved' | 'denied' | 'expired' | 'consumed';
 export type ConnectorApprovalRecord = {
     id: string;
+    waitId?: string;
     principalId: string;
     connectorId: string;
     connectionId?: string;
@@ -240,7 +245,7 @@ export type ConnectorInstance = {
         toolkit: string;
         role: 'credential' | 'toolkit';
     } | {
-        type: 'channel' | 'nativeTool' | 'memorySource';
+        type: 'memorySource';
         id: string;
     };
     usage: ConnectorUsageRecord;

package/dist/src/connectors/workflow-preflight.d.ts

@@ -1,6 +1,6 @@
 import type { Config } from '../config/schema.js';
 import type { WorkflowDefinition } from '../workflows/domain/definition.js';
-export type ConnectorPreflightIssueCode = 'not_installed' | 'disabled' | 'agent_not_allowed' | 'scope_too_narrow' | 'connection_missing' | 'reauthorization_required';
+export type ConnectorPreflightIssueCode = 'not_installed' | 'disabled' | 'agent_not_allowed' | 'scope_too_narrow' | 'connection_missing' | 'account_selection_required' | 'reauthorization_required';
 export type ConnectorPreflightIssue = {
     connectorId: string;
     code: ConnectorPreflightIssueCode;
@@ -9,6 +9,7 @@ export type ConnectorPreflightIssue = {
 };
 export type ConnectorPreflightResult = {
     ok: boolean;
+    accounts: Record<string, string[]>;
     issues: ConnectorPreflightIssue[];
     optionalIssues: ConnectorPreflightIssue[];
 };

package/dist/src/connectors/workflow-preflight.js

@@ -1,8 +1,10 @@
-import { getConnectorInstallation, listConnectorConnections } from "../storage/sqlite/connector-repository.js";
+import { getConnectorInstallation, init_connector_repository, listConnectorConnections } from "../storage/sqlite/connector-repository.js";
+import { canAccessConnectorAccount, currentAccountConnections } from "./account-access.js";
 import { getComposioToolkitScope } from "./composio.js";
 import { getConnectorDefinition } from "./catalog.js";
 import { listConnectorInstances } from "./instances.js";
 //#region src/connectors/workflow-preflight.ts
+init_connector_repository();
 const SCOPE_ORDER = {
 	read: 1,
 	write: 2,
@@ -20,6 +22,7 @@ function preflightWorkflowConnectors(input) {
 	const principalId = input.principalId ?? "local-owner";
 	const instances = listConnectorInstances(input.config);
 	const issues = [];
+	const accounts = {};
 	const optionalIssues = [];
 	const add = (requirement, value) => {
 		(requirement.optional ? optionalIssues : issues).push(value);
@@ -53,13 +56,27 @@ function preflightWorkflowConnectors(input) {
 			principalId,
 			connectorId: requirement.connectorId
 		});
-		const selected = installation?.selectedConnectionIds.length ? connections.filter((connection) => installation.selectedConnectionIds.includes(connection.id)) : connections;
-		if (selected.some((connection) => connection.status === "active")) continue;
+		const selected = installation && installation.selectedAccountIds !== null ? connections.filter((connection) => connection.accountId && installation.selectedAccountIds.includes(connection.accountId)) : connections;
+		const active = currentAccountConnections(selected.filter((connection) => installation && canAccessConnectorAccount(connection, installation, input.agentId)));
+		if (requirement.accountIds) {
+			if (!requirement.accountIds.length || requirement.accountIds.some((id) => !active.some((connection) => connection.accountId === id))) add(requirement, issue(requirement, "connection_missing", `${requirement.connectorId} has an unavailable selected account. Reconnect or update its permissions; no other account will be substituted.`));
+			else accounts[requirement.connectorId] = [...requirement.accountIds];
+			continue;
+		}
+		if (active.length > 1) {
+			add(requirement, issue(requirement, "account_selection_required", `${requirement.connectorId} has multiple available accounts. Select the intended account before unattended execution.`));
+			continue;
+		}
+		if (active.length === 1) {
+			accounts[requirement.connectorId] = [active[0].accountId];
+			continue;
+		}
 		const needsAuthorization = selected.some((connection) => connection.status === "expired" || connection.status === "failed");
 		add(requirement, issue(requirement, needsAuthorization ? "reauthorization_required" : "connection_missing", needsAuthorization ? `${requirement.connectorId} needs to be reconnected.` : `${requirement.connectorId} has no active account connection.`));
 	}
 	return {
 		ok: issues.length === 0,
+		accounts,
 		issues,
 		optionalIssues
 	};

package/dist/src/gateway/hono/lib/config-payload.d.ts

@@ -222,7 +222,7 @@ export declare function buildSafeWebConfigPayload(service: GatewayService, optio
         };
         userModel: {
             enabled: boolean;
-            writePolicy: "allow" | "confirm" | "deny";
+            writePolicy: "allow" | "deny";
             sensitiveWritePolicy: "allow" | "confirm" | "deny";
             processingPolicy: "local_only" | "remote_allowed";
             extraction: {
@@ -244,7 +244,7 @@ export declare function buildSafeWebConfigPayload(service: GatewayService, optio
         };
         knowledgeMemory: {
             enabled: boolean;
-            writePolicy: "allow" | "confirm" | "deny";
+            writePolicy: "allow" | "deny";
             readScopes: ("project" | "session" | "agent" | "workspace" | "global")[];
             contentSources: ("memory" | "connector" | "local_import")[];
             searchStrategy: "local-first" | "external-first" | "fanout" | "local-only" | "external-only";

package/dist/src/gateway/hono/routes/connectors.js

@@ -1,21 +1,26 @@
+import { createLogger } from "../../../utils/logger/index.js";
+import { init_logger } from "../../../utils/logger.js";
 import { hasGatewayScope } from "../../security/gateway-scopes.js";
 import { listConnectorLearningJobs } from "../../../storage/sqlite/connector-learning-repository.js";
+import { getConnectorAccount, init_connector_account_repository, updateConnectorAccount } from "../../../storage/sqlite/connector-account-repository.js";
 import { decideConnectorApproval, getConnectorApproval, listConnectorApprovals, listConnectorConnections } from "../../../storage/sqlite/connector-repository.js";
-import { getConnectorAccount } from "../../../storage/sqlite/connector-account-repository.js";
 import { getConnectorSyncPolicy, upsertConnectorSyncPolicy } from "../../../storage/sqlite/connector-sync-policy-repository.js";
 import "../../../storage/sqlite/index.js";
 import { init_agent_scope, resolveDefaultAgentId } from "../../../agent/agent-scope.js";
-import { resolveComposioApiKey } from "../../../connectors/composio-sessions.js";
+import { activateComposioBackend, addComposioBackend, ensureComposioBackend, getComposioBackend, listComposioBackends, removeComposioBackend } from "../../../connectors/composio-backends.js";
+import { getAuthorizationAttempt } from "../../../connectors/authorization-attempts.js";
+import { ComposioSessionsAdapter, resolveComposioApiKey } from "../../../connectors/composio-sessions.js";
 import { getConnectorLearningPlan } from "../../../connectors/learning-recipes.js";
 import { listComposioConnectorCatalog } from "../../../connectors/composio-catalog.js";
-import { createConnectorSetupSecretRequest, submitConnectorSetupSecret } from "../../../connectors/setup-secrets.js";
 import { configureComposioApiKey, executeComposioTool, getComposioInstallationPolicy, getComposioToolkitAuthState, getComposioToolkitScope, inspectComposioConnectorHealth, listComposioConnections, listComposioTools, refreshComposioConnection, revokeComposioConnection, setComposioToolkitScope, updateComposioConnection, updateComposioInstallationPolicy } from "../../../connectors/composio.js";
 import { listConnectorProviders } from "../../../connectors/providers.js";
 import { getConnectorDefinition, listConnectorCatalog } from "../../../connectors/catalog.js";
+import { createConnectorSetupSecretRequest, submitConnectorSetupSecret } from "../../../connectors/setup-secrets.js";
 import { recordConnectorHealthUsage } from "../../../connectors/usage.js";
 import { getConnectorInstance, getInstalledConnectorDefinition, listConnectorInstances } from "../../../connectors/instances.js";
 import { installConnector, installConnectorDefinition, uninstallConnector, updateConnectorConfig } from "../../../connectors/install.js";
 import { ConfigPersistenceError, persistConfigMutation } from "../../../config/config-mutation.js";
+import { resumeApprovedConnectorAction } from "../../../connectors/approval-resume.js";
 import { getMcpOAuthManager } from "../../../agent/mcp/oauth/mcp-oauth-manager.js";
 import { startConnectorAuthorization } from "../../../connectors/auth-provider-registry.js";
 import { composioLogoResponse } from "../../../connectors/composio-logo.js";
@@ -29,7 +34,9 @@ import { projectComposioConnectionStatus } from "../../../connectors/runtime-sta
 import { getGatewayPrincipal } from "../../security/gateway-principal.js";
 import { markContextSourceAssertionsForReview } from "./context-sources.js";
 //#region src/gateway/hono/routes/connectors.ts
+init_logger();
 init_agent_scope();
+init_connector_account_repository();
 function errorMessage(error) {
 	return error instanceof Error ? error.message : String(error);
 }
@@ -38,6 +45,7 @@ function defaultConnectorSyncInterval(connectorId) {
 	return definition?.runtime.type === "composio" && definition.runtime.role === "toolkit" ? getConnectorLearningPlan(definition.runtime.toolkit)?.intervalMinutes ?? 30 : 30;
 }
 function registerConnectorRoutes(authenticated, deps) {
+	const log = createLogger("Connectors:Routes");
 	const { service, strictRateLimitMiddleware } = deps;
 	authenticated.get("/api/connectors/catalog", (c) => {
 		return c.json({
@@ -128,12 +136,93 @@ function registerConnectorRoutes(authenticated, deps) {
 			}, 400);
 		}
 	});
+	authenticated.patch("/api/connectors/composio/accounts/:id", strictRateLimitMiddleware, async (c) => {
+		const account = getConnectorAccount(c.req.param("id"));
+		if (!account || account.principalId !== "local-owner") return c.json({
+			ok: false,
+			error: "Account not found."
+		}, 404);
+		const body = await c.req.json().catch(() => null);
+		if (!body || typeof body !== "object" || Array.isArray(body) || body.label !== void 0 && (typeof body.label !== "string" || body.label.length > 120) || body.enabled !== void 0 && typeof body.enabled !== "boolean" || body.allowedAgentIds !== void 0 && body.allowedAgentIds !== null && (!Array.isArray(body.allowedAgentIds) || body.allowedAgentIds.some((id) => typeof id !== "string"))) return c.json({
+			ok: false,
+			error: "Invalid account settings."
+		}, 400);
+		return c.json({
+			ok: true,
+			payload: { account: updateConnectorAccount(account.id, body) }
+		});
+	});
 	authenticated.get("/api/connectors/learning", (c) => {
 		return c.json({
 			ok: true,
 			payload: { jobs: listConnectorLearningJobs({ limit: 100 }) }
 		});
 	});
+	authenticated.get("/api/connectors/composio/authorizations/:id", async (c) => {
+		let attempt = getAuthorizationAttempt(c.req.param("id"), "local-owner");
+		if (!attempt) return c.json({
+			ok: false,
+			error: "Authorization attempt not found."
+		}, 404);
+		try {
+			if (attempt.status === "awaiting_user") {
+				await new ComposioSessionsAdapter().syncConnections({
+					principalId: "local-owner",
+					backendId: attempt.backend_id ?? void 0
+				});
+				attempt = getAuthorizationAttempt(attempt.id, "local-owner");
+			}
+			const connection = listConnectorConnections({
+				principalId: "local-owner",
+				connectorId: attempt.connector_id
+			}).find((item) => item.id === attempt.connection_id);
+			return c.json({
+				ok: true,
+				payload: { attempt: {
+					id: attempt.id,
+					status: attempt.status,
+					authorizationUrl: attempt.authorization_url,
+					expiresAt: attempt.expires_at,
+					accountId: connection?.accountId
+				} }
+			});
+		} catch (err) {
+			log.warn({
+				err,
+				phase: "authorization_status",
+				backendId: attempt.backend_id,
+				connectorId: attempt.connector_id
+			}, "Could not synchronize authorization status");
+			const localConflict = /constraint failed/i.test(errorMessage(err));
+			return c.json({
+				ok: false,
+				error: localConflict ? "Local connection records could not be synchronized. Update and restart the gateway; do not delete or reauthorize your accounts." : "The connection service is temporarily unavailable. Retry checking this authorization."
+			}, localConflict ? 500 : 503);
+		}
+	});
+	authenticated.delete("/api/connectors/composio/accounts/:id", strictRateLimitMiddleware, async (c) => {
+		const account = getConnectorAccount(c.req.param("id"));
+		if (!account || account.principalId !== "local-owner") return c.json({
+			ok: false,
+			error: "Account not found."
+		}, 404);
+		updateConnectorAccount(account.id, { enabled: false });
+		try {
+			for (const connection of listConnectorConnections({
+				principalId: account.principalId,
+				connectorId: account.connectorId
+			})) if (connection.accountId === account.id && connection.status !== "revoked") await revokeComposioConnection(connection.id);
+			return c.json({
+				ok: true,
+				payload: { disconnected: true }
+			});
+		} catch (error) {
+			return c.json({
+				ok: false,
+				error: `Account paused; some authorizations could not be revoked. Retry disconnecting. ${errorMessage(error)}`
+			}, 400);
+		}
+	});
 	authenticated.get("/api/connectors/composio/accounts/:id/sync-policy", (c) => {
 		const account = getConnectorAccount(c.req.param("id"));
 		if (!account || account.principalId !== "local-owner") return c.json({
@@ -142,7 +231,7 @@ function registerConnectorRoutes(authenticated, deps) {
 		}, 404);
 		const policy = getConnectorSyncPolicy(account.id) ?? {
 			accountId: account.id,
-			scanEnabled: true,
+			scanEnabled: false,
 			proactiveEnabled: false,
 			intervalMinutes: defaultConnectorSyncInterval(account.connectorId),
 			allowedScenarioKeys: [],
@@ -256,10 +345,7 @@ function registerConnectorRoutes(authenticated, deps) {
 		const body = await c.req.json().catch(() => ({}));
 		const row = body && typeof body === "object" && !Array.isArray(body) ? body : {};
 		try {
-			const connection = updateComposioConnection(c.req.param("id"), {
-				alias: typeof row.alias === "string" ? row.alias : void 0,
-				isDefault: typeof row.isDefault === "boolean" ? row.isDefault : void 0
-			});
+			const connection = updateComposioConnection(c.req.param("id"), { alias: typeof row.alias === "string" ? row.alias : void 0 });
 			return c.json({
 				ok: true,
 				payload: { connection }
@@ -416,6 +502,7 @@ function registerConnectorRoutes(authenticated, deps) {
 				payload: { result: await executeComposioTool({
 					slug,
 					arguments: args,
+					accountId: typeof body?.accountId === "string" ? body.accountId : void 0,
 					config: service.currentConfig
 				}) }
 			});
@@ -563,11 +650,22 @@ function registerConnectorRoutes(authenticated, deps) {
 		}, 400);
 		const confirmationPolicy = rawConfirmationPolicy === "never" || rawConfirmationPolicy === "writes" || rawConfirmationPolicy === "always" ? rawConfirmationPolicy : void 0;
 		const allowedAgentIds = Array.isArray(row.allowedAgentIds) ? [...new Set(row.allowedAgentIds.filter((value) => typeof value === "string").map((value) => value.trim()).filter(Boolean))] : void 0;
-		const selectedConnectionIds = Array.isArray(row.selectedConnectionIds) ? [...new Set(row.selectedConnectionIds.filter((value) => typeof value === "string").map((value) => value.trim()).filter(Boolean))] : void 0;
+		if (row.selectedAccountIds !== void 0 && row.selectedAccountIds !== null && !Array.isArray(row.selectedAccountIds)) return c.json({
+			ok: false,
+			error: "selectedAccountIds must be null or an array of account IDs."
+		}, 400);
+		const selectedAccountIds = row.selectedAccountIds === null ? null : Array.isArray(row.selectedAccountIds) ? [...new Set(row.selectedAccountIds.filter((value) => typeof value === "string").map((value) => value.trim()).filter(Boolean))] : void 0;
+		if (Array.isArray(row.selectedAccountIds) && (selectedAccountIds?.length !== row.selectedAccountIds.length || selectedAccountIds.some((id) => {
+			const account = getConnectorAccount(id);
+			return !account || account.principalId !== "local-owner" || account.connectorId !== `composio-${c.req.param("toolkit")}`;
+		}))) return c.json({
+			ok: false,
+			error: "Select accounts belonging to this application."
+		}, 400);
 		try {
 			const policy = updateComposioInstallationPolicy(service.currentConfig, c.req.param("toolkit"), {
 				allowedAgentIds,
-				selectedConnectionIds,
+				selectedAccountIds,
 				confirmationPolicy
 			});
 			return c.json({
@@ -606,9 +704,13 @@ function registerConnectorRoutes(authenticated, deps) {
 			error: `Connector approval is ${approval?.status ?? "unavailable"}.`,
 			payload: { approval }
 		}, 409);
+		const resumed = await resumeApprovedConnectorAction(approval, service.connectionRecovery);
 		return c.json({
 			ok: true,
-			payload: { approval }
+			payload: {
+				approval,
+				resumed
+			}
 		});
 	});
 	authenticated.post("/api/connectors/:id/auth/start", strictRateLimitMiddleware, async (c) => {
@@ -621,7 +723,34 @@ function registerConnectorRoutes(authenticated, deps) {
 			error: `Unknown connector: ${connectorOrInstanceId}`
 		}, 404);
 		try {
-			const authorization = await startConnectorAuthorization(connector, config, instance?.instanceId);
+			const body = await c.req.json().catch(() => ({}));
+			let authorization;
+			if (typeof body?.accountId === "string") {
+				const account = getConnectorAccount(body.accountId);
+				if (!account || account.principalId !== "local-owner" || account.connectorId !== connector.id || !account.backendId || connector.runtime.type !== "composio") return c.json({
+					ok: false,
+					error: "Account connection service is unavailable. Refresh accounts first."
+				}, 400);
+				const current = listConnectorConnections({
+					principalId: "local-owner",
+					connectorId: connector.id
+				}).find((connection) => connection.id === account.currentConnectionId);
+				const result = await new ComposioSessionsAdapter().authorize({
+					principalId: "local-owner",
+					expectedAccountId: account.id,
+					toolkit: connector.runtime.toolkit,
+					backendId: account.backendId,
+					authConfigId: typeof current?.metadata.authConfigId === "string" ? current.metadata.authConfigId : void 0
+				});
+				authorization = {
+					connectorId: connector.id,
+					provider: "composio",
+					status: "pending",
+					authorizationUrl: result.connectUrl,
+					connectionId: result.connectionId,
+					attemptId: result.attemptId
+				};
+			} else authorization = await startConnectorAuthorization(connector, config, instance?.instanceId);
 			return c.json({
 				ok: true,
 				payload: { authorization }
@@ -634,20 +763,82 @@ function registerConnectorRoutes(authenticated, deps) {
 		}
 	});
 	authenticated.get("/api/connectors/composio/setup-status", async (c) => {
-		const status = Boolean(await resolveComposioApiKey()) ? {
-			configured: true,
+		const backend = await ensureComposioBackend();
+		const status = backend.mode === "byok" ? {
+			configured: Boolean(await resolveComposioApiKey()),
 			mode: "byok"
 		} : await inspectManagedComposioStatus();
 		return c.json({
 			ok: true,
-			payload: status
+			payload: {
+				...status,
+				backendId: backend.id,
+				backends: listComposioBackends().map(({ id, label, mode, credential_source, verified_at }) => ({
+					id,
+					label,
+					mode,
+					credentialSource: credential_source,
+					verifiedAt: verified_at
+				}))
+			}
 		});
 	});
+	authenticated.delete("/api/connectors/composio/backends/:id", strictRateLimitMiddleware, async (c) => {
+		try {
+			await removeComposioBackend(c.req.param("id"));
+			return c.json({
+				ok: true,
+				payload: { removed: true }
+			});
+		} catch (error) {
+			return c.json({
+				ok: false,
+				error: errorMessage(error)
+			}, 400);
+		}
+	});
 	authenticated.post("/api/connectors/composio/setup", strictRateLimitMiddleware, async (c) => {
 		const body = await c.req.json().catch(() => ({}));
 		const apiKey = body && typeof body === "object" && !Array.isArray(body) ? String(body.apiKey ?? "") : "";
 		try {
-			await configureComposioApiKey(apiKey);
+			if (!body || typeof body !== "object" || Array.isArray(body)) return c.json({
+				ok: false,
+				error: "Invalid setup request."
+			}, 400);
+			if (body.mode === "managed") {
+				const status = await inspectManagedComposioStatus();
+				if (!status.configured) return c.json({
+					ok: false,
+					error: status.reason ?? "Cloud unavailable."
+				}, 400);
+				activateComposioBackend((listComposioBackends().find((item) => item.mode === "managed") ?? addComposioBackend({
+					mode: "managed",
+					label: "XOPC Cloud"
+				})).id);
+				return c.json({
+					ok: true,
+					payload: {
+						configured: true,
+						mode: "managed"
+					}
+				});
+			}
+			if (typeof body.backendId === "string") {
+				if (!getComposioBackend(body.backendId)) return c.json({
+					ok: false,
+					error: "Unknown connection service."
+				}, 404);
+				await new ComposioSessionsAdapter().listToolkitCatalog({
+					principalId: "local-owner",
+					backendId: body.backendId
+				});
+				activateComposioBackend(body.backendId);
+				return c.json({
+					ok: true,
+					payload: { configured: true }
+				});
+			}
+			await configureComposioApiKey(apiKey, void 0, typeof body.replaceBackendId === "string" ? body.replaceBackendId : void 0);
 			return c.json({
 				ok: true,
 				payload: {

package/dist/src/gateway/hono/routes/context-sources.js

@@ -1,6 +1,6 @@
 import { getSqliteDatabase, init_transaction } from "../../../storage/sqlite/transaction.js";
-import { countKnowledgeSourceItems, deleteKnowledgeSourceItems } from "../../../storage/sqlite/knowledge-repository.js";
 import { getConnectorAccount } from "../../../storage/sqlite/connector-account-repository.js";
+import { countKnowledgeSourceItems, deleteKnowledgeSourceItems } from "../../../storage/sqlite/knowledge-repository.js";
 import "../../../storage/sqlite/index.js";
 import { init_agent_scope, resolveDefaultAgentId } from "../../../agent/agent-scope.js";
 import { setAssertionStatus } from "../../../user-model/repository.js";
@@ -8,7 +8,6 @@ import "../../../user-model/index.js";
 import { listConnectedContentCandidates, readConnectedContent } from "../../../connectors/content-enrichment.js";
 import { getUnderstandingSourceGrant, listUnderstandingSourceGrants, listUnderstandingSourceRuns, revokeUnderstandingSourceGrant, updateUnderstandingSourceGrantPolicies } from "../../../user-context/sources/repository.js";
 import { listUnderstandingSourceDefinitions } from "../../../user-context/sources/catalog.js";
-import { randomUUID } from "node:crypto";
 //#region src/gateway/hono/routes/context-sources.ts
 init_agent_scope();
 init_transaction();
@@ -103,28 +102,6 @@ function registerContextSourceRoutes(authenticated, deps) {
 			return c.json({ error: error instanceof Error ? error.message : String(error) }, 400);
 		}
 	});
-	authenticated.post("/api/context-sources/grants/:grantId/refresh", limited, async (c) => {
-		const grant = getUnderstandingSourceGrant(c.req.param("grantId"));
-		if (!grant || grant.status !== "active") return c.json({ error: "Active context source not found" }, 404);
-		try {
-			if (grant.adapterId === "local-work-folders") {
-				const result = await service.refreshDirectorySourceIfChanged({
-					id: grant.id,
-					idempotencyKey: randomUUID()
-				});
-				return c.json({ result }, result.changed ? 202 : 200);
-			}
-			const accountId = typeof grant.config.accountId === "string" ? grant.config.accountId : "";
-			const connectionId = accountId ? getConnectorAccount(accountId)?.currentConnectionId : void 0;
-			const job = connectionId ? deps.service.requestConnectorLearning(connectionId, {
-				mode: "incremental",
-				reason: "manual"
-			}) : null;
-			return job ? c.json({ job }, 202) : c.json({ error: "Context source cannot be refreshed here" }, 409);
-		} catch (error) {
-			return c.json({ error: error instanceof Error ? error.message : String(error) }, 400);
-		}
-	});
 	authenticated.get("/api/context-sources/work-folders", (c) => c.json({ sources: service.listDirectorySources() }));
 	authenticated.post("/api/context-sources/work-folders", limited, async (c) => {
 		const input = await c.req.json().catch(() => null);

package/dist/src/gateway/hono/routes/home.js

@@ -3,6 +3,7 @@ import { decideConnectorApproval } from "../../../storage/sqlite/connector-repos
 import "../../../storage/sqlite/index.js";
 import { listGatewayAgents } from "../../agents-admin.js";
 import { HomeQueryService, buildHomeWorkbench, decisionFromTask } from "../../../tasks/home-query-service.js";
+import { resumeApprovedConnectorAction } from "../../../connectors/approval-resume.js";
 //#region src/gateway/hono/routes/home.ts
 /** Register the unified work-home read model and its decision actions. */
 function registerHomeRoutes(authenticated, deps) {
@@ -26,9 +27,11 @@ function registerHomeRoutes(authenticated, deps) {
 				ok: false,
 				error: `Approval is ${approval.status}`
 			}, 409);
+			const resumed = await resumeApprovedConnectorAction(approval, service.connectionRecovery);
 			return c.json({
 				ok: true,
-				status: approval.status
+				status: approval.status,
+				resumed
 			});
 		}
 		return c.json({

package/dist/src/gateway/hono/routes/imports.js

@@ -1,10 +1,10 @@
+import { getGatewayPrincipal } from "../../security/gateway-principal.js";
 import { ImportError } from "../../../imports/types.js";
 import { isImportSource } from "../../../imports/sources.js";
 import { ImportSelectionRepository } from "../../../storage/sqlite/import-selection-repository.js";
 import { getLiveInventory, previewInventoryItem, publicInventory, scanProduct } from "../../../imports/inventory.js";
 import { importSelection, listImportSources } from "../../../imports/productImport.js";
 import { createRuntimeImportService } from "../../../imports/runtime.js";
-import { getGatewayPrincipal } from "../../security/gateway-principal.js";
 import { z } from "zod";
 //#region src/gateway/hono/routes/imports.ts
 const selectionSchema = z.object({

package/dist/src/gateway/hono/routes/lazy-bundles.js

@@ -329,6 +329,14 @@ const AUTHENTICATED_LAZY_ROUTE_BUNDLES = [
 			return { register: registerVoiceRoutes };
 		}
 	},
+	{
+		id: "user-model-refresh",
+		match: (pathname) => pathname === "/api/user-model/refresh" || pathname.startsWith("/api/user-model/refresh/"),
+		load: async () => {
+			const { registerUserModelRefreshRoutes } = await import("./user-model-refresh.js");
+			return { register: registerUserModelRefreshRoutes };
+		}
+	},
 	{
 		id: "user-model",
 		match: (path) => startsWithAny(path, [

package/dist/src/gateway/hono/routes/local-apps.js

@@ -1,6 +1,6 @@
 import { readLocalAppAcceptanceConfig } from "../../../local-apps/acceptance.js";
-import { LOCAL_APP_RUNTIME_BRIDGE_HASH, injectLocalAppRuntimeBridge } from "../../../local-apps/preview-runtime-bridge.js";
 import { extensionAssetMimeType } from "../lib/extension-assets.js";
+import { LOCAL_APP_RUNTIME_BRIDGE_HASH, injectLocalAppRuntimeBridge } from "../../../local-apps/preview-runtime-bridge.js";
 import { relative, resolve } from "node:path";
 import { existsSync, readFileSync, statSync } from "node:fs";
 //#region src/gateway/hono/routes/local-apps.ts

package/dist/src/gateway/hono/routes/mcp.js

@@ -1,6 +1,6 @@
+import { isManagedConnectorServer } from "../../../connectors/materialize.js";
 import { canonicalizeConfiguredMcpServer, normalizeConfiguredMcpServers } from "../../../config/mcp-config-normalize.js";
 import { loadMergedBundleMcpConfig } from "../../../agent/mcp/bundle-mcp-config.js";
-import { isManagedConnectorServer } from "../../../connectors/materialize.js";
 import { getWorkspacePath } from "../../../config/workspace-path-helpers.js";
 import { getMcpOAuthManager } from "../../../agent/mcp/oauth/mcp-oauth-manager.js";
 import { listBundleMcpServerCapabilitiesForGateway, listBundleMcpServerToolsForGateway } from "../../../agent/mcp/bundle-mcp-gateway.js";

package/dist/src/gateway/hono/routes/projects.js

@@ -405,6 +405,10 @@ function registerProjectsRoutes(authenticated, deps) {
 			originClass: "system",
 			replaceExisting: true
 		});
+		if (!record.item) return c.json({
+			ok: false,
+			error: "This memory was deleted and automatic recreation is disabled."
+		}, 409);
 		return c.json({
 			ok: true,
 			knowledge: record.item
@@ -804,6 +808,10 @@ function registerProjectsRoutes(authenticated, deps) {
 			originClass: "agent",
 			replaceExisting: true
 		});
+		if (!record.item) return c.json({
+			ok: false,
+			error: "This memory was deleted and automatic recreation is disabled."
+		}, 409);
 		return c.json({
 			ok: true,
 			knowledge: record.item