@xopcai/xopc 0.0.312 → 0.0.314

package/dist/src/gateway/hono/routes/scenes.js

@@ -1,21 +1,31 @@
 import { createLogger } from "../../../utils/logger/index.js";
 import { init_logger } from "../../../utils/logger.js";
+import { ProductReadContracts } from "../../../../packages/gateway-contract/src/capabilities.js";
+import { init_src } from "../../../../packages/gateway-contract/src/index.js";
+import { CapabilityError } from "../../../capabilities/runtime/errors.js";
+import "../../../capabilities/runtime/dispatcher.js";
 import { SceneConflictError, SceneInputError, SceneNotFoundError } from "../../../scenes/repository.js";
 import { SceneSetupError } from "../../../scenes/service.js";
+import { createProductDispatcher } from "../../../capabilities/runtime/product.js";
 import { getGatewayPrincipal } from "../../security/gateway-principal.js";
+import { capabilityHttpContext, capabilityHttpError } from "../../../capabilities/adapters/http.js";
+import { randomUUID } from "node:crypto";
 import { z } from "zod";
 import { Hono } from "hono";
 //#region src/gateway/hono/routes/scenes.ts
+init_src();
 init_logger();
 const log = createLogger("Hono:Scenes");
 const requestIdentity = z.string().trim().min(1).max(200);
-const pageSchema = z.strictObject({
-	limit: z.coerce.number().int().min(1).max(100).default(50),
-	afterId: z.string().max(200).default("")
-});
 function registerSceneRoutes(authenticated, deps) {
 	const app = new Hono();
 	app.onError((error, c) => {
+		if (error instanceof CapabilityError && error.cause instanceof SceneSetupError) return c.json({
+			error: "scene_needs_setup",
+			message: error.cause.message,
+			missing: error.cause.missing
+		}, 422);
+		if (error instanceof CapabilityError) return capabilityHttpError(c, error);
 		if (error instanceof SceneNotFoundError) return c.json({ error: "scene_not_found" }, 404);
 		if (error instanceof SceneConflictError) return c.json({
 			error: "scene_changed",
@@ -41,99 +51,202 @@ function registerSceneRoutes(authenticated, deps) {
 		ownerId: getGatewayPrincipal(c).scopes.includes("gateway.admin") ? "local-owner" : getGatewayPrincipal(c).principalId,
 		workspaceId: deps.service.currentWorkspacePath
 	});
+	const capabilities = createProductDispatcher(void 0, { getSceneAccess: () => deps.scenes ? {
+		services: deps.scenes,
+		principal: {
+			ownerId: "local-owner",
+			workspaceId: deps.service.currentWorkspacePath
+		}
+	} : void 0 });
+	const read = async (c, operation, input) => ProductReadContracts[operation].output.parse(await capabilities.call(operation, input, capabilityHttpContext(c)));
+	const write = (c, operation, input) => {
+		const context = capabilityHttpContext(c);
+		return capabilities.call(operation, input, context, {
+			...capabilities.describe(operation, context),
+			idempotencyKey: c.req.header("Idempotency-Key") ?? randomUUID()
+		});
+	};
+	app.get("/source-providers", (c) => c.json({ providers: deps.scenes.followUps?.sources.list() ?? [] }));
+	app.get("/source-providers/:provider/accounts", (c) => c.json({ accounts: deps.scenes.followUps?.sources.get(c.req.param("provider")).listAccounts?.(principal(c)) ?? [] }));
+	app.post("/source-providers/:provider/resolve-link", deps.strictRateLimitMiddleware, async (c) => {
+		const input = z.strictObject({
+			accountId: z.string().min(1).max(200),
+			url: z.string().url().max(2e3)
+		}).parse(await c.req.json());
+		const source = deps.scenes.followUps?.sources.get(c.req.param("provider"));
+		if (!source?.resolveLink) return c.json({ error: "source_resolution_unavailable" }, 422);
+		const reference = await source.resolveLink(principal(c), input.accountId, input.url, AbortSignal.any([c.req.raw.signal, AbortSignal.timeout(3e4)]));
+		return c.json({ source: {
+			provider: source.id,
+			reference
+		} });
+	});
+	app.get("/task-follow-ups", (c) => c.json({ items: deps.scenes.followUps?.list(principal(c)) ?? [] }));
+	app.get("/task-follow-ups/projects/:projectId/branches", async (c) => {
+		if (!deps.scenes.followUps) return c.json({ error: "task_follow_up_unavailable" }, 503);
+		return c.json(await deps.scenes.followUps.branches.list(principal(c), c.req.param("projectId")));
+	});
+	app.post("/task-follow-ups/branch-links", deps.strictRateLimitMiddleware, async (c) => {
+		const input = z.strictObject({
+			projectId: z.string().min(1).max(200),
+			taskId: z.string().uuid(),
+			branchRef: z.string().startsWith("refs/heads/").max(300),
+			expectedSha: z.string().regex(/^[a-f0-9]{40,64}$/)
+		}).parse(await c.req.json());
+		if (!deps.scenes.followUps) return c.json({ error: "task_follow_up_unavailable" }, 503);
+		return c.json(await deps.scenes.followUps.branches.associate(principal(c), input));
+	});
+	app.post("/task-follow-ups/preflight", deps.strictRateLimitMiddleware, async (c) => {
+		if (!deps.scenes.followUps) return c.json({ error: "task_follow_up_unavailable" }, 503);
+		return c.json(await deps.scenes.followUps.preflight(principal(c), await c.req.json()));
+	});
+	app.post("/task-follow-ups", deps.strictRateLimitMiddleware, async (c) => {
+		if (!deps.scenes.followUps) return c.json({ error: "task_follow_up_unavailable" }, 503);
+		return c.json(await deps.scenes.followUps.create(principal(c), await c.req.json()), 201);
+	});
+	app.get("/task-follow-ups/:id", (c) => {
+		if (!deps.scenes.followUps) return c.json({ error: "task_follow_up_unavailable" }, 503);
+		return c.json(deps.scenes.followUps.get(principal(c), c.req.param("id")));
+	});
+	app.patch("/task-follow-ups/:id", deps.strictRateLimitMiddleware, async (c) => {
+		const input = z.union([z.strictObject({
+			expectedRevision: z.number().int().positive(),
+			status: z.enum([
+				"active",
+				"paused",
+				"archived"
+			])
+		}), z.strictObject({
+			expectedRevision: z.number().int().positive(),
+			configuration: z.unknown()
+		})]).parse(await c.req.json());
+		if (!deps.scenes.followUps) return c.json({ error: "task_follow_up_unavailable" }, 503);
+		if ("configuration" in input) return c.json(await deps.scenes.followUps.configure(principal(c), c.req.param("id"), input.expectedRevision, input.configuration));
+		return c.json(await deps.scenes.followUps.transition(principal(c), c.req.param("id"), input.expectedRevision, input.status));
+	});
 	app.post("/browser/prepare", deps.strictRateLimitMiddleware, (c) => c.json(deps.scenes.browser.prepare()));
 	app.post("/browser/subscriptions", deps.strictRateLimitMiddleware, async (c) => c.json(deps.scenes.browser.register(principal(c), await c.req.json()), 201));
 	app.delete("/browser/subscriptions/:id", deps.strictRateLimitMiddleware, (c) => {
 		deps.scenes.browser.remove(principal(c), c.req.param("id"));
 		return c.json({ ok: true });
 	});
-	app.get("/preferences", (c) => c.json(deps.scenes.preferences.get(principal(c))));
-	app.patch("/preferences", deps.strictRateLimitMiddleware, async (c) => c.json(deps.scenes.preferences.update(principal(c), await c.req.json())));
+	app.get("/preferences", async (c) => c.json(await read(c, "xopc.scenes.get_preferences", {})));
+	app.patch("/preferences", deps.strictRateLimitMiddleware, async (c) => c.json(await write(c, "xopc.scenes.set_preferences", await c.req.json())));
 	app.post("/presence", deps.strictRateLimitMiddleware, async (c) => {
 		deps.scenes.preferences.recordPresence(principal(c), await c.req.json());
 		return c.json({ ok: true });
 	});
-	app.get("/templates", (c) => c.json({ templates: deps.scenes.repository.listTemplates() }));
-	app.get("/diagnostics", (c) => c.json(deps.scenes.metrics.diagnostics(principal(c))));
-	app.get("/metrics", (c) => {
-		const { days } = z.strictObject({ days: z.coerce.number().int().min(1).max(90).default(7) }).parse(c.req.query());
-		return c.json(deps.scenes.metrics.forUser(principal(c), days));
+	app.get("/templates", async (c) => c.json(await read(c, "xopc.scenes.templates", {})));
+	app.get("/diagnostics", async (c) => c.json(await read(c, "xopc.scenes.diagnostics", {})));
+	app.get("/metrics", async (c) => {
+		return c.json(await read(c, "xopc.scenes.metrics", {
+			...c.req.query(),
+			...c.req.query("days") === void 0 ? {} : { days: Number(c.req.query("days")) }
+		}));
 	});
-	app.get("/sources/mail/accounts", (c) => c.json({ accounts: deps.scenes.mailDiscovery?.listAccounts(principal(c)) ?? [] }));
+	app.get("/sources/mail/accounts", async (c) => c.json(await read(c, "xopc.scenes.mail_accounts", {})));
 	app.post("/sources/mail/search", deps.strictRateLimitMiddleware, async (c) => {
 		if (!deps.scenes.mailDiscovery) return c.json({ error: "mail_search_unavailable" }, 503);
 		const signal = AbortSignal.any([c.req.raw.signal, AbortSignal.timeout(15e3)]);
 		return c.json({ sources: await deps.scenes.mailDiscovery.searchSources(principal(c), await c.req.json(), signal) });
 	});
-	app.get("/sources/mail", (c) => {
-		const { limit, afterId } = pageSchema.parse(c.req.query());
-		const sources = deps.scenes.mail.listSources(principal(c), limit, afterId);
-		return c.json({
-			sources,
-			nextCursor: sources.length === limit ? sources.at(-1).id : null
-		});
-	});
-	app.get("/templates/:key/versions/:version", (c) => c.json({ template: deps.scenes.repository.getTemplate(c.req.param("key"), c.req.param("version")) }));
-	app.post("/preflight", deps.strictRateLimitMiddleware, async (c) => c.json(await deps.scenes.application.preflight(principal(c), await c.req.json())));
-	app.get("/activations", (c) => {
-		const { limit, afterId } = pageSchema.parse(c.req.query());
-		const activations = deps.scenes.repository.listActivations(principal(c), limit, afterId);
-		return c.json({
-			activations,
-			nextCursor: activations.length === limit ? activations.at(-1).id : null
-		});
+	app.get("/sources/mail", async (c) => {
+		return c.json(await read(c, "xopc.scenes.mail_sources", {
+			...c.req.query(),
+			...c.req.query("limit") === void 0 ? {} : { limit: Number(c.req.query("limit")) }
+		}));
+	});
+	app.get("/templates/:key/versions/:version", async (c) => c.json(await read(c, "xopc.scenes.get_template", {
+		key: c.req.param("key"),
+		version: c.req.param("version")
+	})));
+	app.post("/preflight", deps.strictRateLimitMiddleware, async (c) => c.json(await read(c, "xopc.scenes.preflight", await c.req.json())));
+	app.get("/activations", async (c) => {
+		return c.json(await read(c, "xopc.scenes.list", {
+			...c.req.query(),
+			...c.req.query("limit") === void 0 ? {} : { limit: Number(c.req.query("limit")) }
+		}));
 	});
 	app.post("/activations", deps.strictRateLimitMiddleware, async (c) => {
-		const requestId = requestIdentity.parse(c.req.header("Idempotency-Key"));
-		return c.json({ activation: await deps.scenes.application.start(principal(c), await c.req.json(), requestId) }, 201);
+		requestIdentity.parse(c.req.header("Idempotency-Key"));
+		return c.json(await write(c, "xopc.scenes.start", await c.req.json()), 201);
 	});
-	app.get("/activations/:id", (c) => c.json({ activation: deps.scenes.repository.getActivation(principal(c), c.req.param("id")) }));
-	app.patch("/activations/:id", deps.strictRateLimitMiddleware, async (c) => {
-		const body = await c.req.json();
-		const activation = typeof body === "object" && body !== null && Object.hasOwn(body, "status") ? await deps.scenes.application.transition(principal(c), c.req.param("id"), body) : deps.scenes.application.configure(principal(c), c.req.param("id"), body);
+	app.get("/activations/:id", async (c) => {
+		const { activation } = ProductReadContracts["xopc.scenes.get"].output.parse(await read(c, "xopc.scenes.get", { id: c.req.param("id") }));
 		return c.json({ activation });
 	});
-	app.post("/activations/:id/checks", deps.strictRateLimitMiddleware, (c) => c.json({ intentId: deps.scenes.application.check(principal(c), c.req.param("id"), requestIdentity.parse(c.req.header("Idempotency-Key"))) }, 202));
-	app.get("/activations/:id/runs", (c) => {
-		const { limit, afterId } = pageSchema.parse(c.req.query());
-		const runs = deps.scenes.repository.listRuns(principal(c), c.req.param("id"), limit, afterId);
-		return c.json({
-			runs,
-			nextCursor: runs.length === limit ? runs.at(-1).id : null
-		});
-	});
-	app.patch("/activations/:id/notes", deps.strictRateLimitMiddleware, async (c) => c.json({ revision: deps.scenes.application.writeNotes(principal(c), c.req.param("id"), await c.req.json()) }));
-	app.get("/activations/:id/notes", (c) => c.json({ notes: deps.scenes.repository.readNotes(principal(c), c.req.param("id")) }));
-	app.get("/activations/:id/work-items", (c) => {
-		const { limit, afterId } = pageSchema.parse(c.req.query());
-		const workItems = deps.scenes.repository.listWorkItems(principal(c), c.req.param("id"), limit, afterId);
-		return c.json({
-			workItems,
-			nextCursor: workItems.length === limit ? workItems.at(-1).id : null
-		});
-	});
-	app.post("/activations/:id/work-items", deps.strictRateLimitMiddleware, async (c) => c.json({ workItem: deps.scenes.application.createWorkItem(principal(c), c.req.param("id"), await c.req.json()) }, 201));
-	app.get("/activations/:id/schedules", (c) => c.json({ schedules: deps.scenes.repository.listSchedules(principal(c), c.req.param("id")) }));
-	app.patch("/activations/:id/schedules/:triggerKey", deps.strictRateLimitMiddleware, async (c) => c.json({ revision: deps.scenes.application.setSchedule(principal(c), c.req.param("id"), c.req.param("triggerKey"), await c.req.json()) }));
-	app.patch("/work-items/:id", deps.strictRateLimitMiddleware, async (c) => c.json({ workItem: deps.scenes.application.updateWorkItem(principal(c), c.req.param("id"), await c.req.json()) }));
-	app.get("/outcomes", (c) => {
-		const { limit, afterId, activationId } = pageSchema.extend({ activationId: requestIdentity.optional() }).parse(c.req.query());
-		const outcomes = deps.scenes.repository.listInbox(principal(c), limit, afterId, activationId ?? null);
-		return c.json({
-			outcomes,
-			nextCursor: outcomes.length === limit ? outcomes.at(-1).id : null
-		});
-	});
-	app.get("/digests/:id", (c) => {
-		const { limit, afterId } = pageSchema.parse(c.req.query());
-		return c.json(deps.scenes.repository.listDigestResults(principal(c), c.req.param("id"), limit, afterId));
-	});
-	app.get("/presentations/:id/feedback", (c) => c.json({ feedback: deps.scenes.inbox.getFeedback(principal(c), c.req.param("id")) }));
-	app.get("/presentations/:id", (c) => c.json({ outcome: deps.scenes.repository.getPresentation(principal(c), c.req.param("id")) }));
-	app.post("/presentations/:id/feedback", deps.strictRateLimitMiddleware, async (c) => c.json({ revision: deps.scenes.inbox.feedback(principal(c), c.req.param("id"), await c.req.json()) }));
+	app.patch("/activations/:id", deps.strictRateLimitMiddleware, async (c) => {
+		const body = await c.req.json();
+		if (!(typeof body === "object" && body !== null && Object.hasOwn(body, "status"))) return c.json(await write(c, "xopc.scenes.configure", {
+			...body,
+			id: c.req.param("id")
+		}));
+		return c.json(await write(c, "xopc.scenes.transition", {
+			...body,
+			id: c.req.param("id")
+		}));
+	});
+	app.post("/activations/:id/checks", deps.strictRateLimitMiddleware, async (c) => {
+		requestIdentity.parse(c.req.header("Idempotency-Key"));
+		return c.json(await write(c, "xopc.scenes.check", { id: c.req.param("id") }), 202);
+	});
+	app.get("/activations/:id/runs", async (c) => {
+		return c.json(await read(c, "xopc.scenes.list_runs", {
+			...c.req.query(),
+			id: c.req.param("id"),
+			...c.req.query("limit") === void 0 ? {} : { limit: Number(c.req.query("limit")) }
+		}));
+	});
+	app.patch("/activations/:id/notes", deps.strictRateLimitMiddleware, async (c) => c.json(await write(c, "xopc.scenes.notes", {
+		...await c.req.json(),
+		id: c.req.param("id")
+	})));
+	app.get("/activations/:id/notes", async (c) => c.json(await read(c, "xopc.scenes.read_notes", { id: c.req.param("id") })));
+	app.get("/activations/:id/work-items", async (c) => {
+		return c.json(await read(c, "xopc.scenes.list_work_items", {
+			...c.req.query(),
+			id: c.req.param("id"),
+			...c.req.query("limit") === void 0 ? {} : { limit: Number(c.req.query("limit")) }
+		}));
+	});
+	app.post("/activations/:id/work-items", deps.strictRateLimitMiddleware, async (c) => c.json(await write(c, "xopc.scenes.work_item", {
+		...await c.req.json(),
+		id: c.req.param("id")
+	}), 201));
+	app.get("/activations/:id/schedules", async (c) => c.json(await read(c, "xopc.scenes.list_schedules", { id: c.req.param("id") })));
+	app.patch("/activations/:id/schedules/:triggerKey", deps.strictRateLimitMiddleware, async (c) => c.json(await write(c, "xopc.scenes.schedule", {
+		...await c.req.json(),
+		id: c.req.param("id"),
+		triggerKey: c.req.param("triggerKey")
+	})));
+	app.patch("/work-items/:id", deps.strictRateLimitMiddleware, async (c) => c.json(await write(c, "xopc.scenes.update_work_item", {
+		...await c.req.json(),
+		id: c.req.param("id")
+	})));
+	app.get("/outcomes", async (c) => {
+		return c.json(await read(c, "xopc.scenes.results", {
+			...c.req.query(),
+			...c.req.query("limit") === void 0 ? {} : { limit: Number(c.req.query("limit")) }
+		}));
+	});
+	app.get("/digests/:id", async (c) => {
+		return c.json(await read(c, "xopc.scenes.digest_results", {
+			...c.req.query(),
+			id: c.req.param("id"),
+			...c.req.query("limit") === void 0 ? {} : { limit: Number(c.req.query("limit")) }
+		}));
+	});
+	app.get("/presentations/:id/feedback", async (c) => c.json(await read(c, "xopc.scenes.get_feedback", { id: c.req.param("id") })));
+	app.get("/presentations/:id", async (c) => c.json(await read(c, "xopc.scenes.get_presentation", { id: c.req.param("id") })));
+	app.post("/presentations/:id/feedback", deps.strictRateLimitMiddleware, async (c) => c.json(await write(c, "xopc.scenes.feedback", {
+		...await c.req.json(),
+		id: c.req.param("id")
+	})));
 	app.patch("/presentations/:id", deps.strictRateLimitMiddleware, async (c) => {
-		const { read } = z.strictObject({ read: z.boolean() }).parse(await c.req.json());
-		deps.scenes.inbox.setRead(principal(c), c.req.param("id"), read);
+		await write(c, "xopc.scenes.mark_read", {
+			...await c.req.json(),
+			id: c.req.param("id")
+		});
 		return c.json({ ok: true });
 	});
 	authenticated.route("/api/scenes", app);

package/dist/src/gateway/hono/routes/session-input-handler.d.ts

@@ -8,31 +8,19 @@ export declare function submitSessionInput(c: Context, deps: AuthenticatedRouteD
         code: string;
         message: string;
     };
-}, 400, "json">) | (Response & import("hono").TypedResponse<{
-    ok: false;
-    error: {
-        code: string;
-        message: string;
-    };
 }, 401, "json">) | (Response & import("hono").TypedResponse<{
     ok: false;
     error: {
         code: string;
         message: string;
     };
-}, 403, "json">) | (Response & import("hono").TypedResponse<{
+}, 503, "json">) | (Response & import("hono").TypedResponse<{
     ok: false;
     error: {
         code: string;
         message: string;
     };
-}, 409, "json">) | (Response & import("hono").TypedResponse<{
-    ok: false;
-    error: {
-        code: "SESSION_CHANGED" | "BAD_REQUEST" | "QUEUE_FULL" | "CONTEXT_UNAVAILABLE";
-        message: string;
-    };
-}, 400 | 409, "json">) | (Response & import("hono").TypedResponse<{
+}, 403 | 400 | 409, "json">) | (Response & import("hono").TypedResponse<{
     ok: true;
     payload: {
         conversationId: string;
@@ -76,7 +64,7 @@ export declare function submitSessionInput(c: Context, deps: AuthenticatedRouteD
                     documentId?: string;
                 }[];
                 contextSnapshots?: {
-                    kind: import("../../../agent/source-context/types.js").SessionSourceBinding["kind"] | "task" | "browser_page";
+                    kind: import("../../../agent/source-context/types.js").SessionSourceBinding["kind"] | "task" | "browser_page" | "app_context";
                     sourceId: string;
                     version: string;
                     title: string;
@@ -91,6 +79,34 @@ export declare function submitSessionInput(c: Context, deps: AuthenticatedRouteD
                     url?: string;
                     capturedAt?: number;
                     documentId?: string;
+                    appContext?: {
+                        version: 1;
+                        clientInstanceId: string;
+                        tabId: string;
+                        sequence: number;
+                        surface: "electron" | "web" | "mobile";
+                        resourceRefs: {
+                            kind: "project" | "note" | "task" | "scene" | "local_app";
+                            id: string;
+                            revision: string;
+                        }[];
+                        capturedAt: number;
+                        selection?: {
+                            text: string;
+                            draft: boolean;
+                        };
+                    };
+                    appContextGrant?: {
+                        principal: {
+                            kind: "owner" | "device" | "trusted-proxy";
+                            principalId: string;
+                            deviceId?: string;
+                            accessSessionId?: string;
+                            browserSessionId?: string;
+                            scopes: readonly import("@xopcai/gateway-contract").GatewayScope[];
+                        };
+                        authRevision: string;
+                    };
                 }[];
                 thinking?: string;
                 origin: {
@@ -182,7 +198,7 @@ export declare function replaceLatestSessionTurn(c: Context, deps: Authenticated
                     documentId?: string;
                 }[];
                 contextSnapshots?: {
-                    kind: import("../../../agent/source-context/types.js").SessionSourceBinding["kind"] | "task" | "browser_page";
+                    kind: import("../../../agent/source-context/types.js").SessionSourceBinding["kind"] | "task" | "browser_page" | "app_context";
                     sourceId: string;
                     version: string;
                     title: string;
@@ -197,6 +213,34 @@ export declare function replaceLatestSessionTurn(c: Context, deps: Authenticated
                     url?: string;
                     capturedAt?: number;
                     documentId?: string;
+                    appContext?: {
+                        version: 1;
+                        clientInstanceId: string;
+                        tabId: string;
+                        sequence: number;
+                        surface: "electron" | "web" | "mobile";
+                        resourceRefs: {
+                            kind: "project" | "note" | "task" | "scene" | "local_app";
+                            id: string;
+                            revision: string;
+                        }[];
+                        capturedAt: number;
+                        selection?: {
+                            text: string;
+                            draft: boolean;
+                        };
+                    };
+                    appContextGrant?: {
+                        principal: {
+                            kind: "owner" | "device" | "trusted-proxy";
+                            principalId: string;
+                            deviceId?: string;
+                            accessSessionId?: string;
+                            browserSessionId?: string;
+                            scopes: readonly import("@xopcai/gateway-contract").GatewayScope[];
+                        };
+                        authRevision: string;
+                    };
                 }[];
                 thinking?: string;
                 origin: {

package/dist/src/gateway/hono/routes/session-input-handler.js

@@ -1,7 +1,11 @@
+import { createLogger } from "../../../utils/logger/index.js";
+import { init_logger } from "../../../utils/logger.js";
 import { browserPageContextsInputSchema } from "../../../../packages/gateway-contract/src/browser-page-context.js";
 import { init_src } from "../../../../packages/gateway-contract/src/index.js";
 import { endpointTurnClaimSchema, init_src as init_src$1 } from "../../../../packages/endpoint-tools-protocol/src/index.js";
 import { init_providers, resolveModel } from "../../../providers/index.js";
+import { CapabilityError } from "../../../capabilities/runtime/errors.js";
+import "../../../capabilities/runtime/dispatcher.js";
 import { validateWebchatAttachments, validateWebchatContent } from "../../chat-limits.js";
 import { isTaskDestructiveCommand } from "../../../session/reset-triggers.js";
 import { parseSlashCommand } from "../../../chat-commands/command-parse.js";
@@ -11,12 +15,15 @@ import { isVoiceLikeAttachment } from "../../../channels/attachments/voice-stt-w
 import { parseTurnContextRefs } from "../../../agent/source-context/types.js";
 import { getModelThinking } from "../../../providers/model-thinking.js";
 import { withModelConfigLock } from "../../../session/model-config-lock.js";
+import { getGatewayPrincipal } from "../../security/gateway-principal.js";
 import { browserPageContextToAgentContext } from "../../../agent/source-context/browser-page.js";
 //#region src/gateway/hono/routes/session-input-handler.ts
 init_src();
 init_src$1();
 init_providers();
+init_logger();
 const MAX_TURN_CONTEXTS = 5;
+const log = createLogger("Gateway:SessionInput");
 async function submitSessionInput(c, deps, conversationId, options) {
 	const body = await c.req.json().catch(() => null);
 	if (!body || !conversationId) return c.json({
@@ -147,6 +154,34 @@ async function submitSessionInput(c, deps, conversationId, options) {
 				}, 409);
 			}
 		}
+		const sourceContexts = browserContexts.data.map(browserPageContextToAgentContext);
+		if (body.appContext !== void 0) try {
+			sourceContexts.push(await deps.service.prepareSessionAppContext(body.appContext, getGatewayPrincipal(c), conversationId, typeof body.clientMessageId === "string" ? body.clientMessageId.trim() : ""));
+		} catch (error) {
+			if (!(error instanceof CapabilityError) || ["INTERNAL", "UNAVAILABLE"].includes(error.code)) {
+				log.warn({
+					err: error,
+					conversationId,
+					phase: "prepare_app_context"
+				}, "Application context preparation failed");
+				return c.json({
+					ok: false,
+					error: {
+						code: "UNAVAILABLE",
+						message: "Application context preparation failed. Retry the same input."
+					}
+				}, 503);
+			}
+			const forbidden = error instanceof CapabilityError && error.code === "FORBIDDEN";
+			const invalid = error.code === "INVALID_INPUT";
+			return c.json({
+				ok: false,
+				error: {
+					code: forbidden ? "FORBIDDEN" : invalid ? "BAD_REQUEST" : "CONTEXT_UNAVAILABLE",
+					message: "Application context is invalid, changed, or no longer accessible. Capture it again."
+				}
+			}, forbidden ? 403 : invalid ? 400 : 409);
+		}
 		const result = await deps.service.submitSessionInput({
 			expectedTranscriptId: body.expectedTranscriptId,
 			conversationId,
@@ -155,7 +190,7 @@ async function submitSessionInput(c, deps, conversationId, options) {
 			content,
 			attachments,
 			contextRefs,
-			sourceContexts: browserContexts.data.map(browserPageContextToAgentContext),
+			sourceContexts,
 			thinking: selection?.thinkingLevel ?? (typeof body.thinking === "string" ? body.thinking : void 0),
 			origin: {
 				type: "endpoint",
@@ -187,6 +222,13 @@ async function replaceLatestSessionTurn(c, deps, conversationId, targetTurnId) {
 			message: "Invalid request"
 		}
 	}, 400);
+	if (body.appContext !== void 0) return c.json({
+		ok: false,
+		error: {
+			code: "BAD_REQUEST",
+			message: "Send application context in a new input; turn replacement does not support it."
+		}
+	}, 400);
 	const attachments = Array.isArray(body.attachments) ? body.attachments : void 0;
 	const contextRefs = parseTurnContextRefs(body.contextRefs, MAX_TURN_CONTEXTS);
 	if (contextRefs === null) return c.json({

package/dist/src/gateway/hono/routes/sessions.js

@@ -578,6 +578,23 @@ function registerSessionsRoutes(authenticated, deps) {
 			items
 		});
 	});
+	authenticated.get("/api/sessions/:key/find", async (c) => {
+		const blocked = ensureGatewayReadyForSessions(c, service, "sessions.history");
+		if (blocked) return blocked;
+		const query = c.req.query("q")?.trim() ?? "";
+		if (!query || query.length > 256) return c.json({
+			ok: false,
+			error: "q must contain 1 to 256 characters"
+		}, 400);
+		const result = await service.sessions.findMessages(c.req.param("key"), query, parsePositiveInt(c.req.query("limit"), 1e3, 1e3));
+		return result ? c.json({
+			ok: true,
+			...result
+		}) : c.json({
+			ok: false,
+			error: "Session not found"
+		}, 404);
+	});
 	authenticated.get("/api/sessions/:key/transcript/window", async (c) => {
 		const blocked = ensureGatewayReadyForSessions(c, service, "sessions.history");
 		if (blocked) return blocked;

package/dist/src/gateway/hono/routes/status.js

@@ -1,8 +1,8 @@
 import { getDefaultModelSync, init_providers, resolveModel } from "../../../providers/index.js";
-import { getGatewayAgentEffectiveConfig } from "../../agents-admin.js";
 import { isSTTAvailable } from "../../../voice/stt/availability.js";
 import { mergeSttConfigFromAppConfig } from "../../../voice/stt/config.js";
 import "../../../voice/stt/index.js";
+import { getGatewayAgentEffectiveConfig } from "../../agents-admin.js";
 import { createHash } from "node:crypto";
 //#region src/gateway/hono/routes/status.ts
 init_providers();