@xopcai/xopc 0.0.308 → 0.0.311

package/dist/src/connectors/connection-recovery-service.js

@@ -8,12 +8,14 @@ import { getConnectorConnection, getConnectorInstallation, init_connector_reposi
 import { cancelConnectionObjective, getActiveConnectionWait, getConnectionWait, init_connection_wait_repository, listConnectionWaitsToCheck, publishConnectionWait, queueConnectionResolution, updateConnectionWait } from "../storage/sqlite/connection-wait-repository.js";
 import { init_session_repository } from "../storage/sqlite/session-repository.js";
 import { canAccessConnectorAccount, currentAccountConnections } from "./account-access.js";
+import { getCliAdapter } from "./cli/adapterRegistry.js";
 import { ComposioSessionsAdapter } from "./composio-sessions.js";
 import { getConfiguredComposioAuthConfigs, isComposioActionAllowedByCatalog, scopeForComposioAction } from "./composio.js";
 import { getConnectorDefinition } from "./catalog.js";
-import { listConnectorInstances } from "./instances.js";
-import { capabilityActions, isToolInputSchema, missingConnectionCapabilities } from "./connection-capabilities.js";
+import { getInstalledConnectorDefinition, listConnectorInstances } from "./instances.js";
+import { describeCliAction, verifyCliConnection } from "./cli/runtime.js";
 import { connectorPrincipalForSession } from "./principal.js";
+import { capabilityActions, isToolInputSchema, missingConnectionCapabilities } from "./connection-capabilities.js";
 import { resolveConnectionCandidate } from "./connection-candidates.js";
 import { installConnector } from "./install.js";
 import { persistConfigMutation } from "../config/config-mutation.js";
@@ -90,7 +92,8 @@ var ConnectionRecoveryService = class {
 		const needs = wait.needs.map((need) => {
 			const instance = listConnectorInstances(this.deps.getConfig()).find((instance) => instance.connectorId === need.connectorId);
 			const installation = getConnectorInstallation(`${need.connectorId}-${wait.principalId}`);
-			const scopeBlocked = Math.max(1, ...need.capabilities.filter((capability) => /^[A-Z]+_/.test(capability)).map((capability) => SCOPE_ORDER[scopeForComposioAction(capability).scope])) > SCOPE_ORDER[installation?.maxScope ?? "read"];
+			const cli = instance?.materialized.type === "cli" ? getCliAdapter(instance.materialized.adapterId) : void 0;
+			const scopeBlocked = Math.max(1, ...need.capabilities.filter((capability) => cli || /^[A-Z]+_/.test(capability)).map((capability) => SCOPE_ORDER[cli ? cli.curatedActions[capability] ?? "read" : scopeForComposioAction(capability).scope])) > SCOPE_ORDER[installation?.maxScope ?? "read"];
 			const all = listConnectorConnections({
 				principalId: wait.principalId,
 				connectorId: need.connectorId
@@ -176,8 +179,19 @@ var ConnectionRecoveryService = class {
 				capabilityError: void 0
 			};
 			try {
-				if (!listConnectorInstances(this.deps.getConfig()).some((instance) => instance.connectorId === need.connectorId && instance.enabled)) throw new Error("Connector setup is unavailable");
-				const definition = getConnectorDefinition(need.connectorId);
+				const instance = listConnectorInstances(this.deps.getConfig()).find((instance) => instance.connectorId === need.connectorId && instance.enabled);
+				if (!instance) throw new Error("Connector setup is unavailable");
+				const definition = getInstalledConnectorDefinition(this.deps.getConfig(), instance.instanceId) ?? getConnectorDefinition(need.connectorId);
+				if (definition?.runtime.type === "cli") {
+					const selected = views.find((view) => view.key === need.key);
+					const connection = selected?.connectionId ? getConnectorConnection(selected.connectionId) : void 0;
+					if (!connection || typeof connection.metadata.runtimeInstanceId !== "string") throw new Error("CLI account is unavailable.");
+					for (const capability of need.capabilities) await describeCliAction(this.deps.getConfig(), connection.metadata.runtimeInstanceId, connection, capability);
+					return {
+						...need,
+						capabilityError: void 0
+					};
+				}
 				if (definition?.runtime.type !== "composio" || definition.runtime.role !== "toolkit") throw new Error("Unsupported connector");
 				const toolkit = definition.runtime.toolkit;
 				const selected = views.find((view) => view.key === need.key);
@@ -217,13 +231,29 @@ var ConnectionRecoveryService = class {
 			}
 		}));
 	}
+	async syncConnections(wait) {
+		const config = this.deps.getConfig();
+		const instances = listConnectorInstances(config);
+		const cliIds = new Set(instances.filter((item) => item.materialized.type === "cli").map((item) => item.connectorId));
+		const fresh = wait.needs.some((need) => !cliIds.has(need.connectorId)) ? await this.adapter.syncConnections({ principalId: wait.principalId }) : [];
+		for (const connection of currentAccountConnections(listConnectorConnections({ principalId: wait.principalId }))) {
+			if (connection.provider !== "cli" || !wait.needs.some((need) => need.connectorId === connection.connectorId)) continue;
+			const policy = getConnectorInstallation(`${connection.connectorId}-${wait.principalId}`);
+			if (!policy || !canAccessConnectorAccount(connection, policy, wait.agentId)) continue;
+			const instanceId = connection.metadata.runtimeInstanceId;
+			if (typeof instanceId !== "string" || !instances.some((item) => item.instanceId === instanceId && item.enabled)) continue;
+			await verifyCliConnection(config, instanceId, connection);
+			fresh.push(connection);
+		}
+		return fresh;
+	}
 	async preflight(input) {
 		if (input.kind !== "connection_resume") return true;
 		const wait = input.payload ? getConnectionWait(input.payload.waitId) : void 0;
 		if (!wait || wait.status !== "queued" || wait.queuedInputId !== input.id || wait.transcriptId !== readCurrentTranscriptId(getSqliteDatabase(), input.conversationId)) return false;
 		if (wait.resolution === "skipped") return true;
 		try {
-			const fresh = await this.adapter.syncConnections({ principalId: wait.principalId });
+			const fresh = await this.syncConnections(wait);
 			const verified = new Set(fresh.filter((item) => item.status === "active").map((item) => item.id));
 			wait.needs = await this.checkCapabilities(wait, verified);
 			const ready = this.view(wait, verified).needs.every((need) => need.phase === "ready");
@@ -289,7 +319,22 @@ var ConnectionRecoveryService = class {
 				const need = wait.needs.find((need) => need.key === action.needKey);
 				if (!need) throw new Error("Unknown connection requirement.");
 				if (this.view(wait).needs.find((item) => item.key === need.key)?.phase === "blocked") throw new Error("Connector policy blocks this connection.");
-				const definition = getConnectorDefinition(need.connectorId);
+				const instance = listConnectorInstances(this.deps.getConfig()).find((item) => item.connectorId === need.connectorId);
+				const definition = (instance ? getInstalledConnectorDefinition(this.deps.getConfig(), instance.instanceId) : void 0) ?? getConnectorDefinition(need.connectorId);
+				if (definition?.runtime.type === "cli") {
+					updateConnectionWait({
+						...wait,
+						intent: {
+							objectiveRevision: wait.objectiveRevision,
+							validUntil: Date.now() + INTENT_TTL
+						}
+					}, wait.version);
+					publishConnectionWait(conversationId);
+					return {
+						snapshot: this.snapshot(conversationId),
+						authorizationUrl: `/#/connectors?connector=${encodeURIComponent(need.connectorId)}`
+					};
+				}
 				if (definition?.runtime.type !== "composio" || definition.runtime.role !== "toolkit") throw new Error("Unsupported connector.");
 				const attemptId = randomUUID();
 				wait = updateConnectionWait({
@@ -343,7 +388,7 @@ var ConnectionRecoveryService = class {
 					authorizationUrl: auth.connectUrl
 				};
 			} else {
-				const fresh = await this.adapter.syncConnections({ principalId: wait.principalId });
+				const fresh = await this.syncConnections(wait);
 				const verified = new Set(fresh.filter((item) => item.status === "active").map((item) => item.id));
 				const latest = getConnectionWait(wait.id);
 				if (!latest || latest.version !== wait.version || latest.status !== "open") throw new Error("WAIT_CHANGED");

package/dist/src/connectors/health.js

@@ -1,8 +1,12 @@
+import { init_connector_repository, listConnectorConnections } from "../storage/sqlite/connector-repository.js";
+import { currentAccountConnections } from "./account-access.js";
 import { materializeConnectorMcpServer } from "./materialize.js";
 import { getConnectorInstance } from "./instances.js";
+import { describeCliAction, verifyCliConnection } from "./cli/runtime.js";
 import { getWorkspacePath } from "../config/workspace-path-helpers.js";
 import { listBundleMcpServerCapabilitiesForGateway } from "../agent/mcp/bundle-mcp-gateway.js";
 //#region src/connectors/health.ts
+init_connector_repository();
 function classifyConnectorHealthError(error) {
 	const message = error instanceof Error ? error.message : String(error);
 	if (/timed out|timeout/i.test(message)) return "timeout";
@@ -45,6 +49,54 @@ async function testConnectorInstance(config, serverId) {
 		prompts: [],
 		action: "Enable the connector before running a health check."
 	};
+	if (instance.materialized.type === "cli") {
+		const base = {
+			serverId,
+			toolCount: 0,
+			resourceCount: 0,
+			promptCount: 0,
+			tools: [],
+			resources: [],
+			prompts: []
+		};
+		try {
+			const connections = currentAccountConnections(listConnectorConnections({
+				principalId: "local-owner",
+				connectorId: instance.connectorId
+			})).filter((connection) => connection.provider === "cli" && connection.status === "active" && connection.metadata.runtimeInstanceId === serverId);
+			if (!connections.length) return {
+				...base,
+				ok: false,
+				status: "unauthorized",
+				action: "Connect an account."
+			};
+			const tools = [];
+			for (const connection of connections) {
+				const { adapter } = await verifyCliConnection(config, serverId, connection);
+				for (const id of Object.keys(adapter.curatedActions)) {
+					const action = await describeCliAction(config, serverId, connection, id);
+					if (!tools.some((tool) => tool.name === id)) tools.push({
+						name: id,
+						description: action.description
+					});
+				}
+			}
+			return {
+				...base,
+				ok: true,
+				status: "ok",
+				tools,
+				toolCount: tools.length
+			};
+		} catch (error) {
+			return {
+				...base,
+				ok: false,
+				status: classifyConnectorHealthError(error),
+				error: error instanceof Error ? error.message : String(error)
+			};
+		}
+	}
 	const workspaceDir = getWorkspacePath(config) || "./workspace";
 	try {
 		const capabilities = await listBundleMcpServerCapabilitiesForGateway({

package/dist/src/connectors/instances.js

@@ -27,7 +27,7 @@ function connectorInstanceFromRecord(instanceId, record) {
 	const definition = connectorDefinitionFromManagedMarker(markerRecord) ?? getConnectorDefinition(connectorId);
 	const runtime = record.runtime && typeof record.runtime === "object" && !Array.isArray(record.runtime) ? record.runtime : {};
 	const runtimeType = runtime.type;
-	if (runtimeType !== "composio" && runtimeType !== "memorySource") return [];
+	if (runtimeType !== "cli" && runtimeType !== "composio" && runtimeType !== "memorySource") return [];
 	if (runtimeType === "composio" && (typeof runtime.toolkit !== "string" || runtime.role !== "credential" && runtime.role !== "toolkit")) return [];
 	const enabled = markerRecord.enabled !== false;
 	return [{
@@ -47,6 +47,10 @@ function connectorInstanceFromRecord(instanceId, record) {
 			id: instanceId,
 			toolkit: runtime.toolkit,
 			role: runtime.role
+		} : runtimeType === "cli" ? {
+			type: "cli",
+			id: instanceId,
+			adapterId: String(runtime.adapterId)
 		} : {
 			type: "memorySource",
 			id: instanceId

package/dist/src/connectors/lifecycle.js

@@ -1,5 +1,6 @@
 import { isManagedConnectorServer } from "./materialize.js";
 import { getConnectorInstance } from "./instances.js";
+import { stopCliInstance } from "./cli/lifecycle.js";
 //#region src/connectors/lifecycle.ts
 function setConnectorEnabled(config, instanceId, enabled) {
 	const server = config.mcp?.servers?.[instanceId];
@@ -15,6 +16,7 @@ function setConnectorEnabled(config, instanceId, enabled) {
 	}
 	const instance = getConnectorInstance(config, instanceId);
 	if (!instance) throw new Error(`Connector instance not found: ${instanceId}`);
+	if (!enabled && instance.materialized.type === "cli") stopCliInstance(instanceId);
 	return instance;
 }
 //#endregion

package/dist/src/connectors/principal.js

@@ -1,4 +1,5 @@
-import { getSessionMetadata, init_session_repository } from "../storage/sqlite/session-repository.js";
+import { getSessionMetadata } from "../storage/sqlite/session-read-repository.js";
+import { init_session_repository } from "../storage/sqlite/session-repository.js";
 import { getConversationRouting } from "../storage/sqlite/conversation-repository.js";
 import { init_session_key } from "../routing/session-key.js";
 //#region src/connectors/principal.ts

package/dist/src/connectors/runtime-adapter-registry.js

@@ -1,11 +1,14 @@
 import { isXopcDatabaseOpen } from "../storage/sqlite/connection.js";
 import { deleteConnectorInstallation, getConnectorInstallation, upsertConnectorInstallation } from "../storage/sqlite/connector-repository.js";
 import "../storage/sqlite/index.js";
+import { getCliAdapter } from "./cli/adapterRegistry.js";
 import { assertComposioAccessConfigured } from "./composio-sessions.js";
 import { saveConnectorSecrets } from "./secret-store.js";
 import { isManagedConnectorServer, materializeConnectorMcpServer } from "./materialize.js";
 import { appendConnectorAuditRecord } from "./usage.js";
 import { listConnectorInstances } from "./instances.js";
+import { installCli } from "./cli/installer.js";
+import { stopCliInstance } from "./cli/lifecycle.js";
 //#region src/connectors/runtime-adapter-registry.ts
 const adapters = /* @__PURE__ */ new Map();
 function registerConnectorRuntimeAdapter(adapter) {
@@ -49,6 +52,34 @@ function uninstallRecord(config, instanceId) {
 		instances: nextInstances
 	};
 }
+registerConnectorRuntimeAdapter({
+	type: "cli",
+	async install({ config, definition }) {
+		if (definition.runtime.type !== "cli") throw new Error("Invalid CLI runtime.");
+		const adapter = getCliAdapter(definition.runtime.adapterId);
+		if (definition.runtime.binaryVersion !== adapter.binaryVersion || definition.runtime.adapterVersion !== adapter.version) throw new Error("CLI version does not match its registered adapter.");
+		await installCli(adapter);
+		const instance = installRecord(config, definition);
+		if (isXopcDatabaseOpen()) {
+			const id = `${definition.id}-local-owner`;
+			if (!getConnectorInstallation(id)) upsertConnectorInstallation({
+				id,
+				connectorId: definition.id,
+				principalId: "local-owner",
+				enabled: true,
+				allowedAgentIds: [],
+				maxScope: "read",
+				confirmationPolicy: "writes",
+				selectedAccountIds: null
+			});
+		}
+		return instance;
+	},
+	uninstall({ config, instance }) {
+		stopCliInstance(instance.instanceId, true);
+		uninstallRecord(config, instance.instanceId);
+	}
+});
 registerConnectorRuntimeAdapter({
 	type: "mcp",
 	async install({ config, definition, input, resolver }) {

package/dist/src/connectors/types.d.ts

@@ -1,8 +1,10 @@
 export type ConnectorKind = 'mcp' | 'cli' | 'http' | 'browser' | 'extension' | 'builtin' | 'composio' | 'memorySource';
 export type ConnectorCategory = 'code' | 'docs' | 'browser' | 'data' | 'automation' | 'custom';
 export type ConnectorCapability = 'tools' | 'resources' | 'prompts' | 'context' | 'channel' | 'events' | 'ui' | 'memory_source' | 'workflows' | 'auth.apiKey' | 'auth.oauth' | 'runtime.mcp.stdio' | 'runtime.mcp.sse' | 'runtime.mcp.streamableHttp';
-export type ConnectorAuthMode = 'none' | 'apiKey' | 'oauth';
+export type ConnectorAuthMode = 'none' | 'apiKey' | 'oauth' | 'cli';
 export type ConnectorAuthDefinition = {
+    mode: 'cli';
+} | {
     mode: 'none';
 } | {
     mode: 'apiKey';
@@ -64,6 +66,11 @@ export type ConnectorConfigField = {
     description?: string;
 };
 export type ConnectorRuntimeDefinition = {
+    type: 'cli';
+    adapterId: string;
+    adapterVersion: string;
+    binaryVersion: string;
+} | {
     type: 'mcp';
     serverId: string;
     serverTemplate: Record<string, unknown>;
@@ -149,6 +156,7 @@ export type ConnectorAccount = {
     connectorId: string;
     principalId: string;
     identityKey?: string;
+    runtimeInstanceId?: string;
     backendId?: string;
     identity: Record<string, unknown>;
     currentConnectionId?: string;
@@ -244,6 +252,10 @@ export type ConnectorInstance = {
         id: string;
         toolkit: string;
         role: 'credential' | 'toolkit';
+    } | {
+        type: 'cli';
+        id: string;
+        adapterId: string;
     } | {
         type: 'memorySource';
         id: string;

package/dist/src/connectors/usage.js

@@ -2,7 +2,7 @@ import { isManagedConnectorServer } from "./materialize.js";
 //#region src/connectors/usage.ts
 const MAX_AUDIT_RECORDS = 50;
 function getManagedConnectorMarker(config, instanceId) {
-	const server = config.mcp?.servers?.[instanceId];
+	const server = config.mcp?.servers?.[instanceId] ?? config.connectors?.instances?.[instanceId];
 	if (!isManagedConnectorServer(server)) return;
 	return server.xopcConnector;
 }

package/dist/src/connectors/workflow-preflight.js

@@ -38,14 +38,18 @@ function preflightWorkflowConnectors(input) {
 			continue;
 		}
 		const definition = getConnectorDefinition(requirement.connectorId);
-		if (definition?.runtime.type !== "composio" || definition.runtime.role !== "toolkit") continue;
-		const toolkit = definition.runtime.toolkit;
+		if (definition?.runtime.type !== "cli" && (definition?.runtime.type !== "composio" || definition.runtime.role !== "toolkit")) continue;
+		const toolkit = definition.runtime.type === "composio" ? definition.runtime.toolkit : void 0;
 		const installation = getConnectorInstallation(`${requirement.connectorId}-${principalId}`);
+		if (definition.runtime.type === "cli" && (!installation || !installation.enabled)) {
+			add(requirement, issue(requirement, "disabled", `${requirement.connectorId} policy is disabled or missing.`));
+			continue;
+		}
 		if (installation?.allowedAgentIds.length && !installation.allowedAgentIds.includes(input.agentId)) {
 			add(requirement, issue(requirement, "agent_not_allowed", `${input.agentId} is not allowed to use ${requirement.connectorId}.`));
 			continue;
 		}
-		const allowedScope = installation?.maxScope ?? getComposioToolkitScope(input.config, toolkit);
+		const allowedScope = installation?.maxScope ?? (toolkit ? getComposioToolkitScope(input.config, toolkit) : "read");
 		const requiredScope = requirement.scope ?? "read";
 		if (SCOPE_ORDER[allowedScope] < SCOPE_ORDER[requiredScope]) {
 			add(requirement, issue(requirement, "scope_too_narrow", `${requirement.connectorId} requires ${requiredScope} scope but allows ${allowedScope}.`));
@@ -55,7 +59,7 @@ function preflightWorkflowConnectors(input) {
 		const connections = listConnectorConnections({
 			principalId,
 			connectorId: requirement.connectorId
-		});
+		}).filter((connection) => definition.runtime.type !== "cli" || connection.provider === "cli" && connection.metadata.runtimeInstanceId === instance.instanceId);
 		const selected = installation && installation.selectedAccountIds !== null ? connections.filter((connection) => connection.accountId && installation.selectedAccountIds.includes(connection.accountId)) : connections;
 		const active = currentAccountConnections(selected.filter((connection) => installation && canAccessConnectorAccount(connection, installation, input.agentId)));
 		if (requirement.accountIds) {

package/dist/src/extensions/install.js

@@ -6,9 +6,9 @@ import { MAX_EXTENSION_STORE_ZIP_BYTES } from "./store-zip-limits.js";
 import { checkEngineCompatibility } from "./engine-check.js";
 import { EXTENSION_API_VERSION, EXTENSION_UI_API_VERSION, checkExtensionApiCompatibility } from "./api-version.js";
 import { collectExtensionPackageDependencyIssues } from "./package-contract.js";
-import { execFileSync } from "node:child_process";
 import { dirname, isAbsolute, join, resolve, sep } from "path";
 import { cpSync, existsSync, mkdirSync, mkdtempSync, readFileSync, readdirSync, rmSync, writeFileSync } from "fs";
+import { execFileSync } from "node:child_process";
 import semver from "semver";
 import { tmpdir } from "os";
 import AdmZip from "adm-zip";

package/dist/src/gateway/agent-builtin-tools.d.ts

@@ -277,4 +277,4 @@ export declare const GATEWAY_BUILTIN_TOOLS: readonly [{
         readonly zh: "使用已验证的参数执行选定的外部工具。";
     };
 }];
-export declare const GATEWAY_BUILTIN_TOOL_IDS: ("automation" | "workflow" | "find" | "image" | "knowledge_search" | "knowledge_get" | "knowledge_write" | "user_context_search" | "user_context_get" | "user_context_update" | "web_search" | "web_fetch" | "browser_use" | "grep" | "session_search" | "read_file" | "list_dir" | "write_file" | "apply_patch" | "exec_command" | "update_plan" | "todo" | "clarify" | "web_extract" | "image_generate" | "skills_list" | "skill_view" | "skill_manage" | "skills_marketplace_search" | "xopc_tool_search" | "xopc_tool_describe" | "xopc_tool_execute" | "send_message" | "send_media" | "read_media" | "create_share" | "session_status" | "memory_maintenance" | "computer_use" | "tool_manual" | "delegate_task" | "skill_install" | "text_to_speech" | "execute_code" | "create_desktop_pet")[];
+export declare const GATEWAY_BUILTIN_TOOL_IDS: ("automation" | "workflow" | "find" | "image" | "knowledge_search" | "knowledge_get" | "knowledge_write" | "user_context_search" | "user_context_get" | "user_context_update" | "web_search" | "web_fetch" | "browser_use" | "grep" | "session_search" | "read_file" | "list_dir" | "write_file" | "apply_patch" | "exec_command" | "update_plan" | "todo" | "clarify" | "xopc_tool_execute" | "web_extract" | "image_generate" | "skills_list" | "skill_view" | "skill_manage" | "skills_marketplace_search" | "xopc_tool_search" | "xopc_tool_describe" | "send_message" | "send_media" | "read_media" | "create_share" | "session_status" | "memory_maintenance" | "computer_use" | "tool_manual" | "delegate_task" | "skill_install" | "text_to_speech" | "execute_code" | "create_desktop_pet")[];

package/dist/src/gateway/hono/app.d.ts

@@ -1,9 +1,11 @@
 import { Hono } from 'hono';
 import type { GatewayService } from '../service.js';
+import type { SceneHttpServices } from '../../scenes/httpServices.js';
 export interface HonoAppConfig {
     service: GatewayService;
     /** Actual host selected for this process; bind config changes take effect after restart. */
     listenHost?: string;
+    scenes?: SceneHttpServices;
 }
 /**
  * Extension sandbox HTML under `/api/extensions/:id/assets/*` ships its own CSP

package/dist/src/gateway/hono/app.js

@@ -124,7 +124,8 @@ function createHonoApp(config) {
 			"Authorization",
 			"Accept",
 			"X-Session-Id",
-			"Last-Event-ID"
+			"Last-Event-ID",
+			"Idempotency-Key"
 		],
 		credentials: true,
 		maxAge: 86400
@@ -269,7 +270,8 @@ function createHonoApp(config) {
 			trustedProxies: service.currentConfig.gateway?.trustedProxies,
 			allowRealIpFallback: service.currentConfig.gateway?.allowRealIpFallback === true
 		}) }),
-		channelRateLimitMiddleware
+		channelRateLimitMiddleware,
+		scenes: config.scenes ?? service.sceneAccess?.services
 	});
 	const prewarm = prewarmStaticUiCache();
 	if (prewarm.loaded > 0) log.debug({

package/dist/src/gateway/hono/lib/config-payload.d.ts

@@ -49,6 +49,7 @@ export declare function buildSafeWebConfigPayload(service: GatewayService, optio
             };
             tools: Record<string, {
                 mode: "allow" | "deny" | "ask";
+                readOnly?: boolean;
                 maxCallsPerTurn?: number;
                 timeoutMs?: number;
             }>;
@@ -99,6 +100,7 @@ export declare function buildSafeWebConfigPayload(service: GatewayService, optio
             };
             tools: Record<string, {
                 mode: "allow" | "deny" | "ask";
+                readOnly?: boolean;
                 maxCallsPerTurn?: number;
                 timeoutMs?: number;
             }>;
@@ -174,21 +176,6 @@ export declare function buildSafeWebConfigPayload(service: GatewayService, optio
                 exemptLoopback: boolean;
             };
         };
-        heartbeat: {
-            enabled: boolean;
-            intervalMs: number;
-            includeSystemPromptSection: boolean;
-            target: string;
-            targetChatId: string;
-            prompt: string;
-            ackMaxChars: number;
-            isolatedSession: boolean;
-            activeHours: {
-                start: string;
-                end: string;
-                timezone?: string;
-            };
-        };
         webchat: {
             activityDetailDefault: "stream" | "on" | "off";
         };

package/dist/src/gateway/hono/lib/config-payload.js

@@ -124,17 +124,6 @@ async function buildSafeWebConfigPayload(service, options = {}) {
 					exemptLoopback: config.gateway?.auth?.rateLimit?.exemptLoopback !== false
 				}
 			},
-			heartbeat: {
-				enabled: config.gateway?.heartbeat?.enabled,
-				intervalMs: config.gateway?.heartbeat?.intervalMs,
-				includeSystemPromptSection: config.gateway?.heartbeat?.includeSystemPromptSection === true,
-				target: config.gateway?.heartbeat?.target,
-				targetChatId: config.gateway?.heartbeat?.targetChatId,
-				prompt: config.gateway?.heartbeat?.prompt,
-				ackMaxChars: config.gateway?.heartbeat?.ackMaxChars,
-				isolatedSession: config.gateway?.heartbeat?.isolatedSession,
-				activeHours: config.gateway?.heartbeat?.activeHours
-			},
 			webchat: { activityDetailDefault: config.gateway?.webchat?.activityDetailDefault ?? "on" },
 			channelConnectDeferMode: config.gateway?.channelConnectDeferMode ?? "auto",
 			channelConnectDeferIds: Array.isArray(config.gateway?.channelConnectDeferIds) ? config.gateway.channelConnectDeferIds : [],

package/dist/src/gateway/hono/routes/cli-connectors.d.ts

@@ -0,0 +1,3 @@
+import type { Hono } from 'hono';
+import type { AuthenticatedRouteDeps } from './deps.js';
+export declare function registerCliConnectorRoutes(app: Hono, deps: AuthenticatedRouteDeps): void;