@xopcai/xopc 0.0.312 → 0.0.314

package/dist/src/config/models-json.d.ts

@@ -29,8 +29,8 @@ export declare const OpenAICompletionsCompatSchema: z.ZodObject<{
     requiresThinkingAsText: z.ZodOptional<z.ZodBoolean>;
     requiresMistralToolIds: z.ZodOptional<z.ZodBoolean>;
     thinkingFormat: z.ZodOptional<z.ZodEnum<{
-        "ant-ling": "ant-ling";
         openai: "openai";
+        "ant-ling": "ant-ling";
         deepseek: "deepseek";
         openrouter: "openrouter";
         zai: "zai";
@@ -67,8 +67,8 @@ export declare const OpenAICompatSchema: z.ZodUnion<readonly [z.ZodObject<{
     requiresThinkingAsText: z.ZodOptional<z.ZodBoolean>;
     requiresMistralToolIds: z.ZodOptional<z.ZodBoolean>;
     thinkingFormat: z.ZodOptional<z.ZodEnum<{
-        "ant-ling": "ant-ling";
         openai: "openai";
+        "ant-ling": "ant-ling";
         deepseek: "deepseek";
         openrouter: "openrouter";
         zai: "zai";
@@ -266,6 +266,7 @@ export declare const CustomModelSchema: z.ZodObject<{
         profile: z.ZodEnum<{
             "gui-plus-2026-02-26": "gui-plus-2026-02-26";
             "structured-tools-v1": "structured-tools-v1";
+            "openai-responses-computer-v1": "openai-responses-computer-v1";
         }>;
     }, z.core.$strict>>;
     id: z.ZodString;
@@ -318,8 +319,8 @@ export declare const CustomModelSchema: z.ZodObject<{
         requiresThinkingAsText: z.ZodOptional<z.ZodBoolean>;
         requiresMistralToolIds: z.ZodOptional<z.ZodBoolean>;
         thinkingFormat: z.ZodOptional<z.ZodEnum<{
-            "ant-ling": "ant-ling";
             openai: "openai";
+            "ant-ling": "ant-ling";
             deepseek: "deepseek";
             openrouter: "openrouter";
             zai: "zai";
@@ -347,6 +348,7 @@ export declare const ModelOverrideSchema: z.ZodObject<{
         profile: z.ZodEnum<{
             "gui-plus-2026-02-26": "gui-plus-2026-02-26";
             "structured-tools-v1": "structured-tools-v1";
+            "openai-responses-computer-v1": "openai-responses-computer-v1";
         }>;
     }, z.core.$strict>>;
     name: z.ZodOptional<z.ZodString>;
@@ -387,8 +389,8 @@ export declare const ModelOverrideSchema: z.ZodObject<{
         requiresThinkingAsText: z.ZodOptional<z.ZodBoolean>;
         requiresMistralToolIds: z.ZodOptional<z.ZodBoolean>;
         thinkingFormat: z.ZodOptional<z.ZodEnum<{
-            "ant-ling": "ant-ling";
             openai: "openai";
+            "ant-ling": "ant-ling";
             deepseek: "deepseek";
             openrouter: "openrouter";
             zai: "zai";
@@ -432,6 +434,7 @@ export declare const ProviderConfigSchema: z.ZodObject<{
             profile: z.ZodEnum<{
                 "gui-plus-2026-02-26": "gui-plus-2026-02-26";
                 "structured-tools-v1": "structured-tools-v1";
+                "openai-responses-computer-v1": "openai-responses-computer-v1";
             }>;
         }, z.core.$strict>>;
         id: z.ZodString;
@@ -484,8 +487,8 @@ export declare const ProviderConfigSchema: z.ZodObject<{
             requiresThinkingAsText: z.ZodOptional<z.ZodBoolean>;
             requiresMistralToolIds: z.ZodOptional<z.ZodBoolean>;
             thinkingFormat: z.ZodOptional<z.ZodEnum<{
-                "ant-ling": "ant-ling";
                 openai: "openai";
+                "ant-ling": "ant-ling";
                 deepseek: "deepseek";
                 openrouter: "openrouter";
                 zai: "zai";
@@ -513,6 +516,7 @@ export declare const ProviderConfigSchema: z.ZodObject<{
             profile: z.ZodEnum<{
                 "gui-plus-2026-02-26": "gui-plus-2026-02-26";
                 "structured-tools-v1": "structured-tools-v1";
+                "openai-responses-computer-v1": "openai-responses-computer-v1";
             }>;
         }, z.core.$strict>>;
         name: z.ZodOptional<z.ZodString>;
@@ -553,8 +557,8 @@ export declare const ProviderConfigSchema: z.ZodObject<{
             requiresThinkingAsText: z.ZodOptional<z.ZodBoolean>;
             requiresMistralToolIds: z.ZodOptional<z.ZodBoolean>;
             thinkingFormat: z.ZodOptional<z.ZodEnum<{
-                "ant-ling": "ant-ling";
                 openai: "openai";
+                "ant-ling": "ant-ling";
                 deepseek: "deepseek";
                 openrouter: "openrouter";
                 zai: "zai";
@@ -679,6 +683,7 @@ export declare const ModelsJsonSchema: z.ZodObject<{
                 profile: z.ZodEnum<{
                     "gui-plus-2026-02-26": "gui-plus-2026-02-26";
                     "structured-tools-v1": "structured-tools-v1";
+                    "openai-responses-computer-v1": "openai-responses-computer-v1";
                 }>;
             }, z.core.$strict>>;
             id: z.ZodString;
@@ -731,8 +736,8 @@ export declare const ModelsJsonSchema: z.ZodObject<{
                 requiresThinkingAsText: z.ZodOptional<z.ZodBoolean>;
                 requiresMistralToolIds: z.ZodOptional<z.ZodBoolean>;
                 thinkingFormat: z.ZodOptional<z.ZodEnum<{
-                    "ant-ling": "ant-ling";
                     openai: "openai";
+                    "ant-ling": "ant-ling";
                     deepseek: "deepseek";
                     openrouter: "openrouter";
                     zai: "zai";
@@ -760,6 +765,7 @@ export declare const ModelsJsonSchema: z.ZodObject<{
                 profile: z.ZodEnum<{
                     "gui-plus-2026-02-26": "gui-plus-2026-02-26";
                     "structured-tools-v1": "structured-tools-v1";
+                    "openai-responses-computer-v1": "openai-responses-computer-v1";
                 }>;
             }, z.core.$strict>>;
             name: z.ZodOptional<z.ZodString>;
@@ -800,8 +806,8 @@ export declare const ModelsJsonSchema: z.ZodObject<{
                 requiresThinkingAsText: z.ZodOptional<z.ZodBoolean>;
                 requiresMistralToolIds: z.ZodOptional<z.ZodBoolean>;
                 thinkingFormat: z.ZodOptional<z.ZodEnum<{
-                    "ant-ling": "ant-ling";
                     openai: "openai";
+                    "ant-ling": "ant-ling";
                     deepseek: "deepseek";
                     openrouter: "openrouter";
                     zai: "zai";

package/dist/src/config/models-json.js

@@ -118,7 +118,7 @@ function validateModelsConfig(config) {
 				api: model.api ?? providerConfig.api
 			})) errors.push({
 				path: `providers.${providerName}.models[${i}].computerUse`,
-				message: "Computer Use requires image input and the openai-completions API",
+				message: "Computer Use requires image input and an API matching its protocol",
 				severity: "error"
 			});
 			if (!model.api && !providerConfig.api) errors.push({

package/dist/src/config/schema.d.ts

@@ -1562,6 +1562,10 @@ export declare const ConfigSchema: z.ZodDefault<z.ZodObject<{
                 summaryChunkTokens: z.ZodDefault<z.ZodNumber>;
                 summaryTimeoutMs: z.ZodDefault<z.ZodNumber>;
                 summaryRetries: z.ZodDefault<z.ZodNumber>;
+                reasoningLevel: z.ZodDefault<z.ZodEnum<{
+                    low: "low";
+                    off: "off";
+                }>>;
                 qualityGuard: z.ZodDefault<z.ZodBoolean>;
                 gapAudit: z.ZodDefault<z.ZodBoolean>;
                 model: z.ZodOptional<z.ZodString>;

package/dist/src/config/schema.js

@@ -1,6 +1,6 @@
 import { __esmMin } from "../../_virtual/_rolldown/runtime.js";
 import { ComputerConfigSchema, init_config } from "../computer/config.js";
-import { AgentModelsOverrideSchema, AgentsConfigSchema as AgentsConfigSchema$1, DEFAULT_AGENT_MODEL_REF, ImageGenerationRouteSchema, ModelRouteSchema } from "../agent-config/schema.js";
+import { AgentModelsOverrideSchema, AgentsConfigSchema as AgentsConfigSchema$1, DEFAULT_AGENT_MODEL_REF, DEFAULT_SKILL_POLICY, ImageGenerationRouteSchema, ModelRouteSchema } from "../agent-config/schema.js";
 import { init_agent_config } from "../agent-config/index.js";
 import { DEFAULT_CONTEXT_COMPACTION_POLICY, UserContextConfigSchema, init_config as init_config$1 } from "../user-context/config.js";
 import { init_default_model } from "./default-model.js";
@@ -61,10 +61,7 @@ var init_schema = __esmMin((() => {
 				},
 				intents: {}
 			},
-			skills: {
-				mode: "all-enabled",
-				exclude: []
-			},
+			skills: DEFAULT_SKILL_POLICY,
 			tools: {},
 			workflows: {},
 			runtime: {}
@@ -1107,10 +1104,7 @@ workDiscoveryOnboarding: z.boolean().default(true) }).strict().default({ workDis
 					},
 					intents: {}
 				},
-				skills: {
-					mode: "all-enabled",
-					exclude: []
-				},
+				skills: DEFAULT_SKILL_POLICY,
 				tools: {},
 				workflows: {},
 				runtime: {}

package/dist/src/connectors/composio-sessions.d.ts

@@ -52,8 +52,8 @@ export declare class ComposioSessionsAdapter {
         alias?: string;
         expectedAccountId?: string;
     }): Promise<ComposioAuthorizeResult>;
-    /** Verify a replacement credential without changing local authorizations. */
-    verifyConnections(connections: ConnectorConnection[]): Promise<void>;
+    /** Verify a project credential using read-only APIs without changing remote or local state. */
+    verifyProjectAccess(context: Pick<ComposioSessionContext, 'principalId' | 'installationScope'>, connections?: ConnectorConnection[]): Promise<void>;
     private listAllAccounts;
     syncConnections(context: Pick<ComposioSessionContext, 'principalId' | 'installationScope' | 'backendId'>): Promise<ConnectorConnection[]>;
     revokeConnection(connection: ConnectorConnection): Promise<void>;
@@ -68,6 +68,8 @@ export declare class ComposioSessionsAdapter {
         agentId?: string;
         conversationId?: string;
         confirmed?: boolean;
+        /** Recheck authorization immediately before sending an action after session setup. */
+        beforeExecute?: () => void;
     }): Promise<{
         decision: 'allowed';
         result: unknown;

package/dist/src/connectors/composio-sessions.js

@@ -255,16 +255,16 @@ var ComposioSessionsAdapter = class {
 			status: request.status
 		};
 	}
-	/** Verify a replacement credential without changing local authorizations. */
-	async verifyConnections(connections) {
+	/** Verify a project credential using read-only APIs without changing remote or local state. */
+	async verifyProjectAccess(context, connections = []) {
 		const client = await this.createClient();
-		const users = [...new Set(connections.map((connection) => connection.metadata.providerPrincipalId))];
-		for (const userId of users) {
-			if (typeof userId !== "string" || !userId) throw new Error("Refresh existing account identities before replacing this key.");
-			const rows = await this.listAllAccounts(client, [userId]);
-			const ids = new Set(rows.flatMap((row) => row && typeof row === "object" ? [readString(row, ["id", "connected_account_id"])] : []));
-			if (connections.some((connection) => connection.metadata.providerPrincipalId === userId && !ids.has(connection.providerConnectionId))) throw new Error("This key cannot access the existing accounts. Add it as a new project instead.");
-		}
+		const providerPrincipalId = createComposioPrincipalId(context.principalId, context.installationScope);
+		const storedUserIds = connections.map((connection) => connection.metadata.providerPrincipalId);
+		if (storedUserIds.some((userId) => typeof userId !== "string" || !userId)) throw new Error("Refresh existing account identities before replacing this key.");
+		const userIds = [...new Set([providerPrincipalId, ...storedUserIds])];
+		const rows = await this.listAllAccounts(client, userIds);
+		const ids = new Set(rows.flatMap((row) => row && typeof row === "object" ? [readString(row, ["id", "connected_account_id"])] : []));
+		if (connections.some((connection) => !ids.has(connection.providerConnectionId))) throw new Error("This key cannot access the existing accounts. Add it as a new project instead.");
 	}
 	async listAllAccounts(client, userIds) {
 		const rows = [];
@@ -439,6 +439,7 @@ var ComposioSessionsAdapter = class {
 				...typeof providerPrincipalId === "string" ? { providerPrincipalId } : {}
 			});
 			input.signal?.throwIfAborted();
+			input.beforeExecute?.();
 			const result = await session.execute(input.action.actionId, input.args ?? {}, input.connection ? { account: input.connection.providerConnectionId } : void 0);
 			input.signal?.throwIfAborted();
 			appendConnectorExecutionAudit({

package/dist/src/connectors/composio.js

@@ -320,15 +320,17 @@ async function configureComposioApiKey(apiKey, resolver = new CredentialResolver
 	if (!normalized) throw new Error("Composio API key is required.");
 	if (normalized.length > 4096) throw new Error("Composio API key is too long.");
 	const adapter = new ComposioSessionsAdapter({ apiKey: normalized });
-	await adapter.listToolkitCatalog({ principalId: LOCAL_OWNER_PRINCIPAL });
-	await ensureComposioBackend(resolver);
+	const replacement = replaceBackendId ? getComposioBackend(replaceBackendId) : void 0;
 	if (replaceBackendId) {
-		const backend = getComposioBackend(replaceBackendId);
-		if (!backend || backend.mode !== "byok" || !backend.credential_ref) throw new Error("Unknown Composio project.");
-		if (backend.credential_source === "environment") throw new Error("Update this key in the gateway environment, or add a locally stored project.");
-		await adapter.verifyConnections(listConnectorConnections({ principalId: LOCAL_OWNER_PRINCIPAL }).filter((connection) => getConnectorAccount(connection.accountId)?.backendId === backend.id && connection.status !== "revoked"));
-		await resolver.saveApiKey(backend.credential_ref, normalized, { profileName: "default" });
-		markComposioBackendVerified(backend.id);
+		if (!replacement || replacement.mode !== "byok" || !replacement.credential_ref) throw new Error("Unknown Composio project.");
+		if (replacement.credential_source === "environment") throw new Error("Update this key in the gateway environment, or add a locally stored project.");
+	}
+	const existingConnections = replacement ? listConnectorConnections({ principalId: LOCAL_OWNER_PRINCIPAL }).filter((connection) => getConnectorAccount(connection.accountId)?.backendId === replacement.id && connection.status !== "revoked") : [];
+	await adapter.verifyProjectAccess({ principalId: LOCAL_OWNER_PRINCIPAL }, existingConnections);
+	await ensureComposioBackend(resolver);
+	if (replacement) {
+		await resolver.saveApiKey(replacement.credential_ref, normalized, { profileName: "default" });
+		markComposioBackendVerified(replacement.id);
 		return;
 	}
 	for (const backend of listComposioBackends()) if (backend.mode === "byok" && await resolveBackendKey(backend, resolver) === normalized) {

package/dist/src/discussions/action-tasks.js

@@ -1,7 +1,7 @@
 import { getSqliteDatabase, init_transaction, runSqliteWriteTransaction } from "../storage/sqlite/transaction.js";
 import { TaskCreateRequestSchema } from "../../packages/gateway-contract/src/tasks.js";
 import { init_src } from "../../packages/gateway-contract/src/index.js";
-import { TaskRepository } from "../tasks/task-repository.js";
+import { TaskRepository, init_task_repository } from "../tasks/task-repository.js";
 import { TaskApplicationService } from "../tasks/task-application-service.js";
 import { DiscussionServiceError } from "./errors.js";
 import { getDiscussionCapture, getLatestDiscussionOrganization } from "./repository.js";
@@ -9,6 +9,7 @@ import { readTranscriptRevision } from "./revisions.js";
 //#region src/discussions/action-tasks.ts
 init_src();
 init_transaction();
+init_task_repository();
 function meetingActionTasks(id) {
 	const rows = getSqliteDatabase().prepare("SELECT action_id, task_id FROM discussion_action_tasks WHERE discussion_id=?").all(id);
 	const tasks = new TaskRepository();

package/dist/src/discussions/recording.js

@@ -3,9 +3,9 @@ import { DISCUSSION_MAX_DURATION_MS } from "../../packages/gateway-contract/src/
 import { init_src } from "../../packages/gateway-contract/src/index.js";
 import { decodeWavToMonoFloat32 } from "../voice/local/wav.js";
 import { forEachNormalizedAudioSegment } from "../voice/audio/normalize.js";
+import { resolveNoteMediaDir } from "../notes/paths.js";
 import { DiscussionServiceError } from "./errors.js";
 import { getDiscussionCapture, updateDiscussionCapture } from "./repository.js";
-import { resolveNoteMediaDir } from "../notes/paths.js";
 import { join } from "node:path";
 import { createReadStream } from "node:fs";
 import { createHash, randomUUID } from "node:crypto";

package/dist/src/execution-environments/local-worktree-manager.d.ts

@@ -5,6 +5,7 @@ export interface ProvisionManagedWorktreeInput {
     repositoryPath: string;
     baseRef?: string;
     environmentId?: string;
+    branchRef?: string;
 }
 export interface LocalWorktreeInspection {
     healthy: boolean;

package/dist/src/execution-environments/local-worktree-manager.js

@@ -82,6 +82,14 @@ var LocalWorktreeManager = class {
 		if (repository.dirty) throw new ExecutionEnvironmentConflictError(`Repository has uncommitted changes: ${repository.repositoryRoot}`);
 		const baseRef = input.baseRef?.trim() || "HEAD";
 		const baseSha = await resolveGitCommit(repository.repositoryRoot, baseRef);
+		if (input.branchRef) {
+			if (!/^xopc\/task-[a-f0-9-]{36}$/.test(input.branchRef)) throw new Error("Invalid task branch name");
+			await runGit(repository.repositoryRoot, [
+				"check-ref-format",
+				"--branch",
+				input.branchRef
+			]);
+		}
 		const environmentId = input.environmentId?.trim() || randomUUID();
 		const rootPath = resolveManagedWorktreePath(input.projectId, environmentId, this.stateDir);
 		assertManagedWorktreePath(rootPath, this.stateDir, repository.repositoryRoot);
@@ -94,7 +102,8 @@ var LocalWorktreeManager = class {
 			repositoryRoot: repository.repositoryRoot,
 			gitCommonDir: repository.gitCommonDir,
 			baseRef,
-			baseSha
+			baseSha,
+			...input.branchRef ? { branchRef: input.branchRef } : {}
 		});
 		const provisioning = this.store.transition({
 			environmentId: environment.id,
@@ -112,9 +121,11 @@ var LocalWorktreeManager = class {
 				await mkdir(rootPath, { mode: 448 });
 				createdDirectory = await readDirectoryIdentity(rootPath);
 				await runGit(repository.repositoryRoot, [
+					"-c",
+					"core.hooksPath=/dev/null",
 					"worktree",
 					"add",
-					"--detach",
+					...input.branchRef ? ["-b", input.branchRef] : ["--detach"],
 					"--lock",
 					rootPath,
 					baseSha

package/dist/src/extensions/activation-context.js

@@ -1,11 +1,11 @@
 import { PROVIDER_ENV_MAP, init_env_keys } from "../providers/env-keys.js";
 import { init_providers, isProviderConfiguredSync } from "../providers/index.js";
-import { collectTtsProviderConfigEntries } from "../voice/tts/config-slice.js";
-import { isProviderConfigured } from "../voice/tts/factory.js";
-import { mergeTtsConfigFromAppConfig } from "../voice/tts/merge-config.js";
 import { collectSttProviderConfigEntries } from "../voice/stt/config-slice.js";
 import { mergeSttConfigFromAppConfig } from "../voice/stt/config.js";
 import "../voice/stt/index.js";
+import { collectTtsProviderConfigEntries } from "../voice/tts/config-slice.js";
+import { isProviderConfigured } from "../voice/tts/factory.js";
+import { mergeTtsConfigFromAppConfig } from "../voice/tts/merge-config.js";
 import { isSttProviderConfigured } from "../voice/stt/list-providers.js";
 //#region src/extensions/activation-context.ts
 init_providers();

package/dist/src/extensions/api.js

@@ -2,12 +2,12 @@ import { createLogger } from "../utils/logger/index.js";
 import { init_logger } from "../utils/logger.js";
 import { getProviderRegistry, init_plugin_registry } from "../providers/plugin-registry.js";
 import { registerMarketplaceAdapter, unregisterMarketplaceAdapter } from "../agent/skills/marketplace/registry.js";
+import { registerMediaUnderstandingProvider } from "../media-understanding/registry.js";
 import { registerSpeechProvider } from "../voice/tts/speech-registry.js";
 import { HOOK_EXECUTION_MODES } from "./types/hooks.js";
 import { commandRegistry } from "../chat-commands/registry.js";
 import { TypedEventBus } from "./typed-event-bus.js";
 import { ExtensionRegistryImpl } from "./extension-registry-impl.js";
-import { registerMediaUnderstandingProvider } from "../media-understanding/registry.js";
 import { registerMigration } from "../migrations/registry.js";
 import { isAbsolute, resolve } from "path";
 import { EventEmitter } from "events";

package/dist/src/extensions/normalize-manifest.js

@@ -1,4 +1,6 @@
 import { __esmMin } from "../../_virtual/_rolldown/runtime.js";
+import { ExtensionCapabilityBindingsSchema } from "../../packages/gateway-contract/src/extension-capabilities.js";
+import { init_src } from "../../packages/gateway-contract/src/index.js";
 //#region src/extensions/normalize-manifest.ts
 function isRecord(x) {
 	return typeof x === "object" && x !== null && !Array.isArray(x);
@@ -162,8 +164,10 @@ function normalizeUiManifest(raw) {
 		permissions = p.length ? p : void 0;
 	}
 	const contributions = normalizeUiContributions(raw.contributions);
-	if (!main && !icon && !permissions && !contributions) return void 0;
+	const capabilities = raw.capabilities === void 0 ? void 0 : ExtensionCapabilityBindingsSchema.parse(raw.capabilities);
+	if (!main && !icon && !permissions && !contributions && !capabilities) return void 0;
 	return {
+		...capabilities !== void 0 ? { capabilities } : {},
 		...main !== void 0 ? { main } : {},
 		...icon !== void 0 ? { icon } : {},
 		...permissions !== void 0 ? { permissions } : {},
@@ -380,6 +384,7 @@ function normalizeSetup(raw) {
 }
 var VALID_UI_PERMISSIONS;
 var init_normalize_manifest = __esmMin((() => {
+	init_src();
 	VALID_UI_PERMISSIONS = new Set([
 		"agent.send",
 		"agent.subscribe",

package/dist/src/extensions/sdk/index.js

@@ -7,8 +7,8 @@ import { DEFAULT_SECURITY_CONFIG, checkExtensionDirSafety, checkExtensionPathSaf
 import { SlotRegistry, getSlotRegistry, registerSlotType } from "../slots.js";
 import { ExtensionDiagnostics, ExtensionLoaderCacheImpl, getExtensionCache, getExtensionDiagnostics } from "../diagnostics.js";
 import { ExtensionHookRunner, createHookContext, isHookEvent } from "../hooks.js";
-import { defineChannelPluginEntry } from "./channel-entry.js";
 import { registerExtensionCliProgram } from "./channel-helpers.js";
+import { defineChannelPluginEntry } from "./channel-entry.js";
 import { lazyFunction, lazyModule } from "./lazy.js";
 import { createMockExtensionApi, createTestGateway } from "./testing.js";
 //#region src/extensions/sdk/index.ts

package/dist/src/extensions/sdk/media.js

@@ -1,7 +1,7 @@
+import { getMediaUnderstandingProvider, listMediaUnderstandingProviders, registerMediaUnderstandingProvider } from "../../media-understanding/registry.js";
 import { ProviderHttpError, assertOkOrThrowHttpError } from "../../media-shared/http/provider-http-errors.js";
 import { SsrfBlockedError, assertSafeUrl } from "../../media-shared/http/ssrf-guard.js";
 import { fetchWithTimeoutGuarded, normalizeBaseUrl, postMultipartRequest } from "../../media-shared/http/provider-http.js";
 import "../../media-shared/http/index.js";
-import { getMediaUnderstandingProvider, listMediaUnderstandingProviders, registerMediaUnderstandingProvider } from "../../media-understanding/registry.js";
 import { buildAudioTranscriptionFormData, createOpenAiCompatibleAudioProvider, registerOpenAiCompatibleAudioProvider, resolveAudioTranscriptionUploadFileName, transcribeOpenAiCompatibleAudio } from "../../media-understanding/openai-compatible-audio.js";
 export { ProviderHttpError, SsrfBlockedError, assertOkOrThrowHttpError, assertSafeUrl, buildAudioTranscriptionFormData, createOpenAiCompatibleAudioProvider, fetchWithTimeoutGuarded, getMediaUnderstandingProvider, listMediaUnderstandingProviders, normalizeBaseUrl, postMultipartRequest, registerMediaUnderstandingProvider, registerOpenAiCompatibleAudioProvider, resolveAudioTranscriptionUploadFileName, transcribeOpenAiCompatibleAudio };

package/dist/src/extensions/types/manifest.d.ts

@@ -2,6 +2,7 @@
  * Extension manifest — control-plane metadata (readable without loading extension code).
  */
 import type { ExtensionKind } from './core.js';
+import type { ExtensionCapabilityBinding } from '@xopcai/gateway-contract';
 /** Declared in `engines` in the extension manifest (e.g. VSCode-style). */
 export interface EnginesDeclaration {
     /** Semver range string for the running xopc CLI / gateway, e.g. `">=0.0.20"`. */
@@ -121,6 +122,8 @@ export interface ExtensionManifestCommand {
 }
 /** Top-level UI declaration within an extension manifest. */
 export interface ExtensionUiManifest {
+    /** Exact host-owned read contracts requested by this UI release. */
+    capabilities?: ExtensionCapabilityBinding[];
     /** Frontend entry HTML (relative to extension root). */
     main?: string;
     /** Extension icon path (relative to extension root; SVG recommended). */

package/dist/src/gateway/agent-builtin-tools.d.ts

@@ -277,4 +277,4 @@ export declare const GATEWAY_BUILTIN_TOOLS: readonly [{
         readonly zh: "使用已验证的参数执行选定的外部工具。";
     };
 }];
-export declare const GATEWAY_BUILTIN_TOOL_IDS: ("automation" | "workflow" | "find" | "image" | "knowledge_search" | "knowledge_get" | "knowledge_write" | "user_context_search" | "user_context_get" | "user_context_update" | "web_search" | "web_fetch" | "browser_use" | "grep" | "session_search" | "read_file" | "list_dir" | "write_file" | "apply_patch" | "exec_command" | "update_plan" | "todo" | "clarify" | "xopc_tool_execute" | "web_extract" | "image_generate" | "skills_list" | "skill_view" | "skill_manage" | "skills_marketplace_search" | "xopc_tool_search" | "xopc_tool_describe" | "send_message" | "send_media" | "read_media" | "create_share" | "session_status" | "memory_maintenance" | "computer_use" | "tool_manual" | "delegate_task" | "skill_install" | "text_to_speech" | "execute_code" | "create_desktop_pet")[];
+export declare const GATEWAY_BUILTIN_TOOL_IDS: ("automation" | "workflow" | "find" | "image" | "knowledge_search" | "knowledge_get" | "knowledge_write" | "user_context_search" | "user_context_get" | "user_context_update" | "web_search" | "web_fetch" | "browser_use" | "grep" | "session_search" | "read_file" | "list_dir" | "write_file" | "apply_patch" | "exec_command" | "update_plan" | "todo" | "clarify" | "xopc_tool_execute" | "computer_use" | "tool_manual" | "web_extract" | "image_generate" | "skills_list" | "skill_view" | "skill_manage" | "skills_marketplace_search" | "session_status" | "send_message" | "send_media" | "delegate_task" | "skill_install" | "text_to_speech" | "create_share" | "xopc_tool_search" | "xopc_tool_describe" | "read_media" | "memory_maintenance" | "execute_code" | "create_desktop_pet")[];

package/dist/src/gateway/hono/lib/config-payload.d.ts

@@ -260,6 +260,7 @@ export declare function buildSafeWebConfigPayload(service: GatewayService, optio
                 summaryChunkTokens: number;
                 summaryTimeoutMs: number;
                 summaryRetries: number;
+                reasoningLevel: "low" | "off";
                 qualityGuard: boolean;
                 gapAudit: boolean;
                 minToolResultKeepChars: number;

package/dist/src/gateway/hono/middleware/scopes.js

@@ -11,7 +11,7 @@ function gatewayScopes() {
 	return createMiddleware(async (c, next) => {
 		const principal = getGatewayPrincipal(c);
 		const requiredScope = requiredGatewayScope(c.req.method, c.req.path);
-		if (!hasGatewayScope(principal.scopes, requiredScope)) {
+		if (requiredScope && !hasGatewayScope(principal.scopes, requiredScope)) {
 			log.warn({
 				path: c.req.path,
 				method: c.req.method,

package/dist/src/gateway/hono/routes/auth-registry-extensions.js

@@ -231,8 +231,11 @@ function registerAuthRegistryExtensionsRoutes(authenticated, deps) {
 	authenticated.get("/api/extensions/:id/ui-grant", (c) => {
 		return c.json({ grant: service.localApps.getUiGrant(c.req.param("id")) });
 	});
-	authenticated.post("/api/extensions/:id/ui-grant", (c) => {
-		return c.json({ grant: service.localApps.grantUiPermissions(c.req.param("id")) });
+	authenticated.post("/api/extensions/:id/ui-grant", async (c) => {
+		const body = await c.req.json().catch(() => null);
+		if (!body || typeof body.manifestDigest !== "string" || !/^[a-f0-9]{64}$/.test(body.manifestDigest)) return c.json({ error: "The reviewed manifestDigest is required" }, 400);
+		if (service.localApps.getUiGrant(c.req.param("id")).manifestDigest !== body.manifestDigest) return c.json({ error: "Extension release changed; review permissions again" }, 409);
+		return c.json({ grant: service.localApps.grantUiPermissions(c.req.param("id"), body.manifestDigest) });
 	});
 	authenticated.get("/api/extensions/:id/storage", async (c) => {
 		const store = await loadExtensionStore(c.req.param("id"));

package/dist/src/gateway/hono/routes/capability-operations.d.ts

@@ -0,0 +1,3 @@
+import type { Hono } from 'hono';
+import type { AuthenticatedRouteDeps } from './deps.js';
+export declare function registerCapabilityOperationRoutes(app: Hono, deps: AuthenticatedRouteDeps): void;

package/dist/src/gateway/hono/routes/capability-operations.js

@@ -0,0 +1,52 @@
+import { CapabilityCallSchema } from "../../../../packages/gateway-contract/src/capabilities.js";
+import { init_src } from "../../../../packages/gateway-contract/src/index.js";
+import { CapabilityError } from "../../../capabilities/runtime/errors.js";
+import "../../../capabilities/runtime/dispatcher.js";
+import { createProductDispatcher } from "../../../capabilities/runtime/product.js";
+import { capabilityHttpContext, capabilityHttpError } from "../../../capabilities/adapters/http.js";
+//#region src/gateway/hono/routes/capability-operations.ts
+init_src();
+function registerCapabilityOperationRoutes(app, deps) {
+	const dispatcher = createProductDispatcher(() => deps.service.notesServiceInstance, {
+		getConfig: () => deps.service.currentConfig,
+		getProjects: () => deps.service.projects,
+		getAutomations: () => deps.service.automationServiceInstance,
+		getWorkDiscovery: () => deps.service.workDiscovery,
+		getLocalApps: () => deps.service.localApps,
+		...deps.scenes ? { getSceneAccess: () => ({
+			services: deps.scenes,
+			principal: {
+				ownerId: "local-owner",
+				workspaceId: deps.service.currentWorkspacePath
+			}
+		}) } : {},
+		wake: (runId) => runId ? deps.service.dispatchTaskRuns() : deps.service.dispatchTaskEvents(),
+		abortConversation: async (conversationId) => {
+			const liveRunId = deps.service.getActiveWebchatRunId(conversationId);
+			if (liveRunId) await deps.service.abortAgentRun(liveRunId);
+		}
+	});
+	app.get("/api/capabilities/operations", (c) => c.json({ capabilities: dispatcher.list(capabilityHttpContext(c)) }));
+	app.get("/api/capabilities/operations/:id", (c) => {
+		try {
+			return c.json(dispatcher.describe(c.req.param("id"), capabilityHttpContext(c)));
+		} catch (error) {
+			return capabilityHttpError(c, error);
+		}
+	});
+	app.post("/api/capabilities/operations/:id/invocations", deps.strictRateLimitMiddleware, async (c) => {
+		try {
+			const parsed = CapabilityCallSchema.safeParse(await c.req.json().catch(() => null));
+			if (!parsed.success) throw new CapabilityError("INVALID_INPUT", "Invalid capability request");
+			const result = await dispatcher.call(c.req.param("id"), parsed.data.input, capabilityHttpContext(c), parsed.data);
+			return c.json({
+				status: "succeeded",
+				data: result
+			});
+		} catch (error) {
+			return capabilityHttpError(c, error);
+		}
+	});
+}
+//#endregion
+export { registerCapabilityOperationRoutes };

package/dist/src/gateway/hono/routes/lazy-bundles.js

@@ -3,6 +3,22 @@ function startsWithAny(path, prefixes) {
 	return prefixes.some((prefix) => path === prefix || path.startsWith(`${prefix}/`));
 }
 const AUTHENTICATED_LAZY_ROUTE_BUNDLES = [
+	{
+		id: "local-app-capabilities",
+		match: (path) => /^\/api\/local-app-capabilities\/[^/]+(?:\/[^/]+\/invocations)?$/.test(path),
+		load: async () => {
+			const { registerLocalAppCapabilityRoutes } = await import("./local-app-capabilities.js");
+			return { register: registerLocalAppCapabilityRoutes };
+		}
+	},
+	{
+		id: "capability-operations",
+		match: (path) => startsWithAny(path, ["/api/capabilities/operations"]),
+		load: async () => {
+			const { registerCapabilityOperationRoutes } = await import("./capability-operations.js");
+			return { register: registerCapabilityOperationRoutes };
+		}
+	},
 	{
 		id: "endpoint-compatibility",
 		match: (path) => path === "/api/endpoint-tools/compatibility",

package/dist/src/gateway/hono/routes/local-app-capabilities.d.ts

@@ -0,0 +1,4 @@
+import type { Hono } from 'hono';
+import type { AuthenticatedRouteDeps } from './deps.js';
+/** Authenticated host API. Iframes must not receive Gateway credentials. */
+export declare function registerLocalAppCapabilityRoutes(app: Hono, deps: AuthenticatedRouteDeps): void;

package/dist/src/gateway/hono/routes/local-app-capabilities.js

@@ -0,0 +1,41 @@
+import { CapabilityCallSchema } from "../../../../packages/gateway-contract/src/capabilities.js";
+import { init_src } from "../../../../packages/gateway-contract/src/index.js";
+import { CapabilityError } from "../../../capabilities/runtime/errors.js";
+import { createProductDispatcher } from "../../../capabilities/runtime/product.js";
+import { localAppCapabilities } from "../../../local-apps/capabilities/runtime.js";
+import { capabilityHttpContext, capabilityHttpError } from "../../../capabilities/adapters/http.js";
+import { z } from "zod";
+//#region src/gateway/hono/routes/local-app-capabilities.ts
+init_src();
+const Digest = z.string().regex(/^[a-f0-9]{64}$/);
+const Invocation = z.strictObject({
+	manifestDigest: Digest,
+	call: CapabilityCallSchema
+});
+/** Authenticated host API. Iframes must not receive Gateway credentials. */
+function registerLocalAppCapabilityRoutes(app, deps) {
+	const dispatcher = createProductDispatcher(() => deps.service.notesServiceInstance, { getProjects: () => deps.service.projects });
+	const path = "/api/local-app-capabilities/:extensionId";
+	app.get(path, (c) => {
+		try {
+			const digest = Digest.parse(c.req.query("manifestDigest"));
+			return c.json(localAppCapabilities(deps.service.localApps, dispatcher, c.req.param("extensionId"), digest, capabilityHttpContext(c)).list());
+		} catch (error) {
+			return capabilityHttpError(c, error instanceof z.ZodError ? new CapabilityError("INVALID_INPUT", "Invalid manifest digest") : error);
+		}
+	});
+	app.post(`${path}/:id/invocations`, deps.strictRateLimitMiddleware, async (c) => {
+		try {
+			const parsed = Invocation.safeParse(await c.req.json().catch(() => null));
+			if (!parsed.success) throw new CapabilityError("INVALID_INPUT", "Invalid local app invocation");
+			const { manifestDigest, call } = parsed.data;
+			const extensionId = c.req.param("extensionId");
+			const id = c.req.param("id");
+			return c.json(await localAppCapabilities(deps.service.localApps, dispatcher, extensionId, manifestDigest, capabilityHttpContext(c)).call(id, call));
+		} catch (error) {
+			return capabilityHttpError(c, error);
+		}
+	});
+}
+//#endregion
+export { registerLocalAppCapabilityRoutes };