@xopcai/xopc 0.0.312 → 0.0.314

package/dist/src/gateway/hono/routes/workflows.js

@@ -3,10 +3,10 @@ import { resolveProjectAgentId } from "../../../projects/project-agent.js";
 import "../../../projects/index.js";
 import { messagesToClientHistory } from "../../../session/client-history.js";
 import { validateWorkflowDefinitionInput } from "../../../workflows/domain/validation.js";
+import { WorkflowDraftService } from "../../../workflows/draft/workflow-draft-service.js";
 import { WorkflowNameConflictError, WorkflowRevisionConflictError, createWorkflowCatalog } from "../../../agent/workflow/catalog.js";
 import "../../../workflows/domain/index.js";
 import { resolveWorkflowRunArtifactsDir } from "../../../workflows/store/paths.js";
-import { WorkflowDraftService } from "../../../workflows/draft/workflow-draft-service.js";
 import { WorkflowDraftConflictError, WorkflowDraftStore } from "../../../workflows/authoring/workflow-draft-store.js";
 import "../../../workflows/authoring/index.js";
 import "../../../workflows/draft/index.js";

package/dist/src/gateway/media-access.js

@@ -1,10 +1,11 @@
-import { TaskRepository } from "../tasks/task-repository.js";
+import { TaskRepository, init_task_repository } from "../tasks/task-repository.js";
 import { FileServiceError } from "../files/file-service.js";
 import { resolveMediaReference } from "../media/media-reference.js";
 import { pendingTranscriptReferencesMediaUri } from "../agent/inbound/attachment-pipeline.js";
 import { TaskContextRepository } from "../tasks/task-context-repository.js";
 import { messagesReferenceMediaUri } from "../media/session-references.js";
 //#region src/gateway/media-access.ts
+init_task_repository();
 /** Resolve media only when the supplied session or task references it. */
 async function resolveScopedMediaReference(service, uri, scope) {
 	const { conversationId, taskId } = scope;

package/dist/src/gateway/mobile-privacy.js

@@ -1,9 +1,9 @@
 import { getProviderRegistry, init_plugin_registry } from "../providers/plugin-registry.js";
 import { PROVIDER_META, getAvailableModels, init_providers } from "../providers/index.js";
-import { resolveSpeechProviderChain } from "../voice/tts/factory.js";
-import { mergeTtsConfigFromAppConfig } from "../voice/tts/merge-config.js";
 import { resolveSTTProviderChain } from "../voice/stt/factory.js";
 import { mergeSttConfigFromAppConfig } from "../voice/stt/config.js";
+import { resolveSpeechProviderChain } from "../voice/tts/factory.js";
+import { mergeTtsConfigFromAppConfig } from "../voice/tts/merge-config.js";
 import { getVoiceProviderMetadata } from "../voice/metadata/registry.js";
 import "../voice/metadata/index.js";
 import { getImageGenerationCatalog } from "./image-generation-setup.js";

package/dist/src/gateway/scenes/host.js

@@ -2,8 +2,9 @@ import { createLogger } from "../../utils/logger/index.js";
 import { init_logger } from "../../utils/logger.js";
 import { assertSceneStorageReady, init_scenes_schema } from "../../storage/sqlite/scenes-schema.js";
 import { init_providers, isProviderConfiguredSync, resolveModel } from "../../providers/index.js";
-import { BrowserSubscriptionService } from "../../notifications/browserSubscriptions.js";
 import { SceneRepository } from "../../scenes/repository.js";
+import { SceneApplicationService } from "../../scenes/service.js";
+import { BrowserSubscriptionService } from "../../notifications/browserSubscriptions.js";
 import { ScenePreferenceService } from "../../scenes/preferences.js";
 import { SceneExecutionService } from "../../scenes/execution.js";
 import { SceneAgentExecutor } from "../../scenes/agentExecutor.js";
@@ -14,11 +15,13 @@ import { SceneMetrics } from "../../scenes/metrics.js";
 import { resolveSceneModelRef } from "../../scenes/model.js";
 import { SceneResultNotifications } from "../../scenes/resultNotifications.js";
 import { SceneRuntime } from "../../scenes/runtime.js";
-import { SceneApplicationService } from "../../scenes/service.js";
 import { familyPlanTemplate, mailFollowUpTemplate } from "../../scenes/templates.js";
 import { SceneUserNotesProvider } from "../../scenes/userNotes.js";
 import { createSceneBrowserDispatcher } from "./browserNotifications.js";
 import { GatewaySceneMailContext } from "./mailContext.js";
+import { SlackThreadSource } from "./slackThreadSource.js";
+import { TaskSourceRegistry } from "../../scenes/taskFollowUp/contracts.js";
+import { TaskFollowUpService } from "../../scenes/taskFollowUp/service.js";
 //#region src/gateway/scenes/host.ts
 init_providers();
 init_scenes_schema();
@@ -61,7 +64,13 @@ var GatewaySceneHost = class {
 		};
 		const grant = async (activation) => authorize(activation);
 		const executor = input.executor ?? new SceneAgentExecutor(() => resolveModel(resolveSceneModelRef(input.config())));
+		const slackThread = new SlackThreadSource(db);
+		const followUps = new TaskFollowUpService(db, {
+			config: input.config,
+			sources: new TaskSourceRegistry([slackThread])
+		});
 		this.http = {
+			followUps,
 			repository,
 			mail,
 			mailDiscovery: mail instanceof GatewaySceneMailContext ? mail : void 0,
@@ -90,6 +99,7 @@ var GatewaySceneHost = class {
 		assertSceneStorageReady(this.db);
 		this.runtime.start();
 		const poll = () => {
+			this.http.followUps?.tick().catch((err) => log.error({ err }, "Task follow-up check failed"));
 			try {
 				if (this.clock() >= this.nextMaintenanceAt) {
 					maintainSceneStorage(this.db, this.clock());
@@ -108,7 +118,7 @@ var GatewaySceneHost = class {
 	tick() {
 		if (this.stopped) return Promise.reject(/* @__PURE__ */ new Error("Scene host stopped"));
 		if (this.active) return this.active;
-		const work = this.runtime.tick().then(() => {
+		const work = Promise.all([this.runtime.tick(), this.http.followUps?.tick()]).then(() => {
 			if (!this.stopped) this.notifications.drain();
 		});
 		this.active = work.finally(() => {
@@ -121,6 +131,7 @@ var GatewaySceneHost = class {
 		this.stopped = true;
 		if (this.timer) clearInterval(this.timer);
 		this.timer = void 0;
+		await this.http.followUps?.stop();
 		await this.runtime.stop();
 		await this.browserDispatcher.stop();
 		await this.active?.catch(() => void 0);

package/dist/src/gateway/scenes/mailContext.js

@@ -1,9 +1,9 @@
 import { getConnectorConnection, getConnectorInstallation, init_connector_repository } from "../../storage/sqlite/connector-repository.js";
 import { ComposioSessionsAdapter } from "../../connectors/composio-sessions.js";
 import { getConnectorDefinition } from "../../connectors/catalog.js";
+import { sceneContentHash } from "../../scenes/contracts.js";
 import { normalizeConnectedSourceResult } from "../../connectors/connected-source-normalizers.js";
 import { sanitizeConnectedSourceValue } from "../../connectors/connected-source-sanitization.js";
-import { sceneContentHash } from "../../scenes/contracts.js";
 import { SceneSourceNotReady, sceneSourceFailureReason } from "../../scenes/readiness.js";
 import { SceneMailContextProvider } from "../../scenes/mailContext.js";
 import { createHash } from "node:crypto";

package/dist/src/gateway/scenes/slackThreadSource.d.ts

@@ -0,0 +1,41 @@
+import type { DatabaseSync } from 'node:sqlite';
+import { z } from 'zod';
+import { ComposioSessionsAdapter } from '../../connectors/composio-sessions.js';
+import { type ScenePrincipal } from '../../scenes/contracts.js';
+import type { TaskSourceAdapter, SourceSnapshot } from '../../scenes/taskFollowUp/contracts.js';
+export declare const slackThreadSchema: z.ZodObject<{
+    accountId: z.ZodString;
+    teamId: z.ZodString;
+    channelId: z.ZodString;
+    threadTs: z.ZodString;
+}, z.core.$strict>;
+export type SlackThread = z.infer<typeof slackThreadSchema>;
+/** Parse locally; never fetch a user-supplied URL. Reply links resolve to their root. */
+export declare function parseSlackThreadUrl(value: string): {
+    channelId: string;
+    threadTs: string;
+};
+/** Read-only connector adapter. Account policy is rechecked before and after every page. */
+export declare class SlackThreadSource implements TaskSourceAdapter {
+    private readonly db;
+    private readonly adapter;
+    readonly id = "slack_thread";
+    readonly label = "Slack thread";
+    normalize(reference: Record<string, string>): {
+        accountId: string;
+        teamId: string;
+        channelId: string;
+        threadTs: string;
+    };
+    accountIds(reference: Record<string, string>): string[];
+    authorized(principal: ScenePrincipal, reference: Record<string, string>): boolean;
+    constructor(db: DatabaseSync, adapter?: Pick<ComposioSessionsAdapter, 'executeWithPolicy'>);
+    listAccounts(principal: ScenePrincipal): Array<{
+        id: string;
+        label: string;
+    }>;
+    private connection;
+    private call;
+    resolveLink(principal: ScenePrincipal, accountId: string, url: string, signal: AbortSignal): Promise<SlackThread>;
+    read(principal: ScenePrincipal, reference: Record<string, string>, signal: AbortSignal): Promise<SourceSnapshot>;
+}

package/dist/src/gateway/scenes/slackThreadSource.js

@@ -0,0 +1,168 @@
+import { getConnectorConnection, getConnectorInstallation, init_connector_repository } from "../../storage/sqlite/connector-repository.js";
+import { ComposioSessionsAdapter } from "../../connectors/composio-sessions.js";
+import { getConnectorDefinition } from "../../connectors/catalog.js";
+import { sceneContentHash } from "../../scenes/contracts.js";
+import { sanitizeConnectedSourceValue } from "../../connectors/connected-source-sanitization.js";
+import { z } from "zod";
+//#region src/gateway/scenes/slackThreadSource.ts
+init_connector_repository();
+const slackThreadSchema = z.strictObject({
+	accountId: z.string().min(1).max(200),
+	teamId: z.string().regex(/^T[A-Z0-9]+$/),
+	channelId: z.string().regex(/^[CDG][A-Z0-9]+$/),
+	threadTs: z.string().regex(/^\d{10,}\.\d{6}$/)
+});
+/** Parse locally; never fetch a user-supplied URL. Reply links resolve to their root. */
+function parseSlackThreadUrl(value) {
+	const url = new URL(value);
+	if (url.protocol !== "https:" || !/^[a-z0-9-]+\.slack\.com$/.test(url.hostname) || url.username || url.password || url.port) throw new Error("Expected a Slack message link");
+	const match = /^\/archives\/([CDG][A-Z0-9]+)\/p(\d{16,})$/.exec(url.pathname);
+	if (!match) throw new Error("Expected a Slack message link");
+	const threadTs = url.searchParams.get("thread_ts") ?? `${match[2].slice(0, -6)}.${match[2].slice(-6)}`;
+	if (!/^\d{10,}\.\d{6}$/.test(threadTs)) throw new Error("Invalid Slack thread timestamp");
+	return {
+		channelId: match[1],
+		threadTs
+	};
+}
+const object = (value) => value && typeof value === "object" && !Array.isArray(value) ? value : {};
+/** Read-only connector adapter. Account policy is rechecked before and after every page. */
+var SlackThreadSource = class {
+	id = "slack_thread";
+	label = "Slack thread";
+	normalize(reference) {
+		return slackThreadSchema.parse(reference);
+	}
+	accountIds(reference) {
+		return [this.normalize(reference).accountId];
+	}
+	authorized(principal, reference) {
+		return this.listAccounts(principal).some((account) => account.id === this.normalize(reference).accountId);
+	}
+	constructor(db, adapter = new ComposioSessionsAdapter()) {
+		this.db = db;
+		this.adapter = adapter;
+	}
+	listAccounts(principal) {
+		return this.db.prepare(`SELECT a.id, a.label, c.connector_id FROM connector_accounts a
+      JOIN connector_connections c ON c.id = a.current_connection_id AND c.account_id = a.id
+        AND c.principal_id = a.principal_id AND c.connector_id = a.connector_id
+      JOIN connector_installations i ON i.id = c.installation_id AND i.principal_id = a.principal_id AND i.connector_id = a.connector_id
+      WHERE a.principal_id = ? AND a.enabled = 1 AND c.status = 'active' AND c.provider = 'composio'
+        AND i.enabled = 1 AND i.confirmation_policy <> 'always'
+        AND json_array_length(i.allowed_agent_ids_json) = 0 AND a.allowed_agent_ids_json IS NULL
+        AND (i.selected_account_ids_json = 'null' OR EXISTS (SELECT 1 FROM json_each(i.selected_account_ids_json) WHERE value = a.id))
+        AND (c.expires_at IS NULL OR julianday(c.expires_at) > julianday('now')) ORDER BY a.id LIMIT 100`).all(principal.ownerId).filter((row) => {
+			const definition = getConnectorDefinition(String(row.connector_id));
+			return definition?.runtime.type === "composio" && definition.runtime.toolkit === "slack";
+		}).map((row) => ({
+			id: String(row.id),
+			label: String(row.label || row.id).slice(0, 300)
+		}));
+	}
+	connection(principal, accountId) {
+		if (!this.listAccounts(principal).some((account) => account.id === accountId)) throw new Error("Slack account permission unavailable");
+		const row = this.db.prepare("SELECT current_connection_id FROM connector_accounts WHERE id = ?").get(accountId);
+		return getConnectorConnection(String(row.current_connection_id));
+	}
+	async call(principal, accountId, actionId, args, signal) {
+		signal.throwIfAborted();
+		const connection = this.connection(principal, accountId);
+		const installation = getConnectorInstallation(connection.installationId);
+		const day = Math.floor(Date.now() / 864e5);
+		const usage = this.db.prepare("SELECT request_count FROM scene_connector_usage WHERE owner_id = ? AND workspace_id = ? AND account_id = ? AND utc_day = ?").get(principal.ownerId, principal.workspaceId, accountId, day);
+		if (Number(usage?.request_count ?? 0) >= 3e3) throw new Error("Slack daily request budget exhausted");
+		this.db.prepare(`INSERT INTO scene_connector_usage VALUES (?, ?, ?, ?, 1)
+      ON CONFLICT(owner_id, workspace_id, account_id, utc_day) DO UPDATE SET request_count = request_count + 1`).run(principal.ownerId, principal.workspaceId, accountId, day);
+		const result = await this.adapter.executeWithPolicy({
+			context: {
+				principalId: principal.ownerId,
+				toolkits: ["slack"]
+			},
+			connection,
+			installation,
+			signal,
+			args,
+			action: {
+				connectorId: connection.connectorId,
+				toolkit: "slack",
+				actionId,
+				scope: "read",
+				curated: true,
+				cachedAt: (/* @__PURE__ */ new Date()).toISOString()
+			}
+		});
+		signal.throwIfAborted();
+		if (this.connection(principal, accountId).id !== connection.id) throw new Error("Slack connection changed");
+		if (result.decision !== "allowed") throw new Error("Slack read requires permission");
+		const envelope = object(result.result);
+		const data = object(envelope.data);
+		if (envelope.successful === false || envelope.error || data.ok === false || data.error || !Object.keys(data).length) throw new Error("Slack source unavailable; check connection permissions or rate limit");
+		return data;
+	}
+	async resolveLink(principal, accountId, url, signal) {
+		const parsed = parseSlackThreadUrl(url);
+		const auth = await this.call(principal, accountId, "SLACK_TEST_AUTH", {}, signal);
+		if (typeof auth.team_id !== "string" || !/^T[A-Z0-9]+$/.test(auth.team_id)) throw new Error("Slack workspace identity unavailable");
+		return {
+			accountId,
+			teamId: auth.team_id,
+			...parsed
+		};
+	}
+	async read(principal, reference, signal) {
+		const thread = this.normalize(reference);
+		if ((await this.call(principal, thread.accountId, "SLACK_TEST_AUTH", {}, signal)).team_id !== thread.teamId) throw new Error("Slack workspace identity changed");
+		const messages = /* @__PURE__ */ new Map();
+		const cursors = /* @__PURE__ */ new Set();
+		let cursor;
+		do {
+			const data = await this.call(principal, thread.accountId, "SLACK_FETCH_MESSAGE_THREAD_FROM_A_CONVERSATION", {
+				channel: thread.channelId,
+				ts: thread.threadTs,
+				limit: 100,
+				...cursor ? { cursor } : {}
+			}, signal);
+			if (!Array.isArray(data.messages) || !data.messages.length) throw new Error("Slack thread is missing or incomplete");
+			for (const item of data.messages) {
+				const message = object(item);
+				if (typeof message.ts !== "string" || typeof message.text !== "string" || message.ts !== thread.threadTs && message.thread_ts !== thread.threadTs) throw new Error("Unexpected Slack thread response");
+				messages.set(message.ts, {
+					ts: message.ts,
+					user: String(message.user ?? message.bot_id ?? "unknown"),
+					text: String(sanitizeConnectedSourceValue(message.text)),
+					...Array.isArray(message.files) && message.files.length || Array.isArray(message.attachments) && message.attachments.length ? { unreadAttachments: sanitizeConnectedSourceValue({
+						files: Array.isArray(message.files) ? message.files.slice(0, 20).map((value) => {
+							const file = object(value);
+							return {
+								id: file.id,
+								name: file.name,
+								mimetype: file.mimetype
+							};
+						}) : [],
+						richMessageCount: Array.isArray(message.attachments) ? message.attachments.length : 0,
+						contentFetched: false
+					}) } : {}
+				});
+			}
+			if (messages.size > 200) throw new Error("Slack thread exceeds the 200-message context budget");
+			const next = object(data.response_metadata).next_cursor;
+			if (next != null && typeof next !== "string") throw new Error("Invalid Slack pagination");
+			cursor = typeof next === "string" && next.trim() ? next.trim() : void 0;
+			if (data.has_more === true && !cursor) throw new Error("Slack thread pagination is incomplete");
+			if (cursor && (cursors.has(cursor) || cursors.size >= 9)) throw new Error("Slack pagination budget exceeded");
+			if (cursor) cursors.add(cursor);
+		} while (cursor);
+		if (!messages.has(thread.threadTs)) throw new Error("Select the root of the Slack thread");
+		const ordered = [...messages.values()].sort((a, b) => a.ts.localeCompare(b.ts));
+		const text = JSON.stringify(ordered);
+		if (text.length > 32e3) throw new Error("Slack thread exceeds the 32,000-character context budget");
+		return {
+			revision: sceneContentHash(ordered),
+			text,
+			observedAt: Date.now()
+		};
+	}
+};
+//#endregion
+export { SlackThreadSource, parseSlackThreadUrl, slackThreadSchema };

package/dist/src/gateway/security/gateway-scopes.d.ts

@@ -1,5 +1,5 @@
 import { DEFAULT_BROWSER_EXTENSION_SCOPES, DEFAULT_MOBILE_SCOPES, GATEWAY_SCOPES, isGatewayScope, type GatewayScope } from '@xopcai/gateway-contract';
 export { DEFAULT_BROWSER_EXTENSION_SCOPES, DEFAULT_MOBILE_SCOPES, GATEWAY_SCOPES, isGatewayScope, type GatewayScope, };
 export declare function parseGatewayScopes(value: string): GatewayScope[];
-export declare function requiredGatewayScope(method: string, path: string): GatewayScope;
+export declare function requiredGatewayScope(method: string, path: string): GatewayScope | undefined;
 export declare function hasGatewayScope(granted: readonly GatewayScope[], required: GatewayScope): boolean;

package/dist/src/gateway/security/gateway-scopes.js

@@ -11,6 +11,8 @@ function methodScope(method, read, write) {
 	return method === "GET" ? read : write;
 }
 function requiredGatewayScope(method, path) {
+	if (/^\/api\/local-app-capabilities\/[^/]+(?:\/[^/]+\/invocations)?$/.test(path)) return void 0;
+	if (path === "/api/capabilities/operations" || path.startsWith("/api/capabilities/operations/")) return void 0;
 	if (method === "GET" && path === "/api/mobile/privacy") return "gateway.status";
 	if (path === "/api/realtime/tickets" || path.startsWith("/api/status")) return "gateway.status";
 	if (path === "/api/device-auth/refresh" || path === "/api/devices/me") return "device.self";
@@ -23,7 +25,10 @@ function requiredGatewayScope(method, path) {
 	if (path.startsWith("/api/agents") || path.startsWith("/api/models")) return methodScope(method, "agents.read", "gateway.admin");
 	if (path.startsWith("/api/sessions") || path.startsWith("/api/side-chats")) return methodScope(method, "sessions.read", "sessions.write");
 	if (path.startsWith("/api/tasks")) return methodScope(method, "tasks.read", "tasks.write");
+	if (path === "/api/task-runs" || path.startsWith("/api/task-runs/")) return methodScope(method, "tasks.read", "tasks.write");
 	if (path.startsWith("/api/home") || path.startsWith("/api/inbox")) return methodScope(method, "tasks.read", "tasks.write");
+	if (method === "POST" && path === "/api/automations/simulate") return "automations.read";
+	if (method === "POST" && /^\/api\/notes\/[^/]+\/ai\/edit$/.test(path)) return "workspace.read";
 	if (path.startsWith("/api/automations") || path.startsWith("/api/automation-runs")) return methodScope(method, "automations.read", "automations.write");
 	if (path.startsWith("/api/workflows")) return methodScope(method, "automations.read", "automations.write");
 	if (path === "/api/voice/selection" || path === "/api/voice/catalog/refresh") return "voice.configure";

package/dist/src/gateway/service/app-context-access.d.ts

@@ -0,0 +1,11 @@
+import type { AgentSourceContext } from '../../agent/source-context/types.js';
+import { type CapabilityDispatcher } from '../../capabilities/runtime/dispatcher.js';
+import type { ResolvedGatewayAuth } from '../auth.js';
+import type { GatewayPrincipal } from '../security/gateway-principal.js';
+export interface AppContextGrant {
+    principal: GatewayPrincipal;
+    authRevision: string;
+}
+/** A queued read retains its original scope ceiling, but never a revoked identity. */
+export declare function checkAppContextAccess(source: AgentSourceContext, dispatcher: CapabilityDispatcher, auth: ResolvedGatewayAuth): Promise<void>;
+export declare function prepareAppContext(input: unknown, principal: GatewayPrincipal, auth: ResolvedGatewayAuth, dispatcher: CapabilityDispatcher, previous?: AgentSourceContext): Promise<AgentSourceContext>;

package/dist/src/gateway/service/app-context-access.js

@@ -0,0 +1,70 @@
+import { parseAppContextEnvelope } from "../../../packages/gateway-contract/src/app-context.js";
+import { init_src } from "../../../packages/gateway-contract/src/index.js";
+import { getDevice } from "../../storage/sqlite/device-access-repository.js";
+import { CapabilityError } from "../../capabilities/runtime/errors.js";
+import { canonicalCapabilityJson } from "../../capabilities/runtime/dispatcher.js";
+import { isBrowserSessionActive } from "../../storage/sqlite/browser-session-repository.js";
+import { appContextToAgentContext } from "../../agent/source-context/app-context.js";
+import { createHmac, randomBytes } from "node:crypto";
+//#region src/gateway/service/app-context-access.ts
+init_src();
+const authorizationEpochKey = randomBytes(32);
+function authRevision(auth) {
+	return createHmac("sha256", authorizationEpochKey).update(canonicalCapabilityJson(JSON.parse(JSON.stringify(auth)))).digest("hex");
+}
+/** A queued read retains its original scope ceiling, but never a revoked identity. */
+async function checkAppContextAccess(source, dispatcher, auth) {
+	const grant = source.appContextGrant;
+	if (!grant || grant.authRevision !== authRevision(auth) || !source.appContext) throw new CapabilityError("FORBIDDEN", "Application context authorization changed");
+	const { principal } = grant;
+	let scopes = principal.scopes;
+	if (principal.kind === "device") {
+		const device = principal.deviceId ? getDevice(principal.deviceId) : void 0;
+		if (!device || device.revokedAt !== void 0 || device.id !== principal.principalId) throw new CapabilityError("FORBIDDEN", "Application context device access was revoked");
+		scopes = scopes.filter((scope) => device.scopes.includes(scope));
+	}
+	if (principal.browserSessionId && !isBrowserSessionActive(principal.browserSessionId, auth)) throw new CapabilityError("FORBIDDEN", "Application context browser session ended");
+	for (const ref of source.appContext.resourceRefs) {
+		const domain = ref.kind === "local_app" ? "local_apps" : `${ref.kind}s`;
+		await dispatcher.call(`xopc.${domain}.get`, { id: ref.id }, {
+			principalId: principal.principalId,
+			scopes,
+			surface: "http",
+			authorize: () => true
+		});
+	}
+}
+async function prepareAppContext(input, principal, auth, dispatcher, previous) {
+	let snapshot;
+	try {
+		snapshot = parseAppContextEnvelope(input);
+	} catch {
+		throw new CapabilityError("INVALID_INPUT", "Invalid application context envelope");
+	}
+	const grant = {
+		principal: structuredClone(principal),
+		authRevision: authRevision(auth)
+	};
+	if (previous) {
+		if (canonicalCapabilityJson(previous.appContext) !== canonicalCapabilityJson(snapshot) || previous.appContextGrant?.principal.principalId !== principal.principalId) throw new CapabilityError("REVISION_CONFLICT", "Submission identity already belongs to another context");
+		await checkAppContextAccess(previous, dispatcher, auth);
+		await checkAppContextAccess({
+			...previous,
+			appContextGrant: grant
+		}, dispatcher, auth);
+		return structuredClone(previous);
+	}
+	const source = {
+		...appContextToAgentContext(await dispatcher.call("xopc.context.resolve", snapshot, {
+			principalId: principal.principalId,
+			scopes: principal.scopes,
+			surface: "http",
+			authorize: () => true
+		})),
+		appContextGrant: grant
+	};
+	await checkAppContextAccess(source, dispatcher, auth);
+	return source;
+}
+//#endregion
+export { checkAppContextAccess, prepareAppContext };

package/dist/src/gateway/service/run-gateway-agent.js

@@ -11,9 +11,9 @@ import { resolveExecutionContext } from "../../tasks/execution-context.js";
 import { TaskRunCoordinator } from "../../tasks/task-run-coordinator.js";
 import { formatAgentRunErrorForClient } from "../../agent/client-error-format.js";
 import "../chat-limits.js";
-import { prependEnvelopeTimestamp } from "../../channels/envelope-timestamp.js";
 import { ChatStreamMapper } from "../chat-stream/mapper.js";
 import { markdownNotificationPreview } from "../../notifications/plain-text.js";
+import { prependEnvelopeTimestamp } from "../../channels/envelope-timestamp.js";
 import { resolveWebchatConversationId } from "../resolve-webchat-session-key.js";
 import { recordExplicitRelationshipFollowUp } from "../../user-context/relationship-continuity.js";
 import { coalesceThinkingDeltas } from "../chat-stream/thinking-delta-coalescer.js";
@@ -142,7 +142,16 @@ async function* runGatewayAgent(deps, message, channel, chatId, origin, attachme
 					signal: mergedSignal,
 					runId,
 					sourceContexts: runOptions?.sourceContexts,
-					presentation: runOptions?.presentation
+					presentation: runOptions?.presentation,
+					onDeferredAudio: (audio) => {
+						publishRealtime("sessions", "session.audio_ready", {
+							conversationId,
+							runId,
+							...audio,
+							createdAtMs: Date.now()
+						});
+						emit("session.transcript_updated", { key: conversationId });
+					}
 				});
 				const mappedEvents = (async function* () {
 					for await (const event of eventStream) yield* mapper.map(event);

package/dist/src/gateway/service/session-input-coordinator.js

@@ -9,16 +9,25 @@ import { summarizeSourceContext } from "../../agent/source-context/types.js";
 import { deleteMediaUrisNoLongerReferenced } from "../../media/session-references.js";
 import { fitSourceContextsToBudget } from "../../agent/source-context/budget.js";
 import crypto from "node:crypto";
+import { isDeepStrictEqual } from "node:util";
 //#region src/gateway/service/session-input-coordinator.ts
 init_connection_wait_repository();
 init_session_input_repository();
 init_logger();
 const log = createLogger("SessionInputCoordinator");
 const MAX_PENDING_INPUTS = 10;
+function sameAppContext(input, existing) {
+	const identity = (sources) => sources?.filter((source) => source.kind === "app_context").map((source) => ({
+		snapshot: source.appContext,
+		principal: source.appContextGrant?.principal.principalId
+	})) ?? [];
+	return isDeepStrictEqual(identity(input.sourceContexts), identity(existing.contextSnapshots));
+}
 function contextRefsMatchFrozenSnapshot(requested, frozen) {
-	if (requested.length !== (frozen?.length ?? 0)) return false;
+	const editable = frozen?.filter((ref) => ref.kind === "note" || ref.kind === "task") ?? [];
+	if (requested.length !== editable.length) return false;
 	return requested.every((ref, index) => {
-		const snapshot = frozen?.[index];
+		const snapshot = editable[index];
 		return snapshot?.kind === ref.kind && snapshot.sourceId === ref.sourceId && ref.expectedVersion === snapshot.version;
 	});
 }
@@ -53,6 +62,7 @@ var SessionInputCoordinator = class {
 		}
 	}
 	async submit(input) {
+		input = structuredClone(input);
 		const conversationId = input.conversationId.trim();
 		try {
 			return await this.runSubmissionExclusive(conversationId, () => this.submitLocked({
@@ -68,6 +78,7 @@ var SessionInputCoordinator = class {
 		}
 	}
 	async replaceLatestTurn(input, beforeReplace) {
+		input = structuredClone(input);
 		const conversationId = input.conversationId.trim();
 		return this.runSubmissionExclusive(conversationId, async () => {
 			const clientMessageId = input.clientMessageId.trim();
@@ -81,14 +92,20 @@ var SessionInputCoordinator = class {
 				ok: false,
 				code: "BAD_REQUEST"
 			};
-			if (findSessionInput(conversationId, clientMessageId)) return {
-				ok: true,
-				effectiveDelivery: "next",
-				state: this.snapshot(conversationId)
-			};
+			const existing = findSessionInput(conversationId, clientMessageId);
+			if (existing) {
+				if (!sameAppContext(input, existing)) return {
+					ok: false,
+					code: "CONTEXT_UNAVAILABLE"
+				};
+				return {
+					ok: true,
+					effectiveDelivery: "next",
+					state: this.snapshot(conversationId)
+				};
+			}
 			const target = validateLatestSessionTurnTarget(conversationId, targetTurnId);
 			if (target.ok === false) return target;
-			await beforeReplace();
 			const attachments = await this.deps.prepareAttachments(conversationId, input.attachments);
 			let sourceContexts;
 			try {
@@ -103,6 +120,7 @@ var SessionInputCoordinator = class {
 					code: "CONTEXT_UNAVAILABLE"
 				};
 			}
+			await beforeReplace();
 			const result = replaceLatestSessionTurnAndQueueInput({
 				conversationId,
 				targetTurnId,
@@ -149,11 +167,17 @@ var SessionInputCoordinator = class {
 			code: "BAD_REQUEST"
 		};
 		const existing = findSessionInput(conversationId, clientMessageId);
-		if (existing) return {
-			ok: true,
-			effectiveDelivery: existing.effectiveDelivery,
-			state: this.snapshot(conversationId)
-		};
+		if (existing) {
+			if (!sameAppContext(input, existing)) return {
+				ok: false,
+				code: "CONTEXT_UNAVAILABLE"
+			};
+			return {
+				ok: true,
+				effectiveDelivery: existing.effectiveDelivery,
+				state: this.snapshot(conversationId)
+			};
+		}
 		if (this.snapshot(conversationId).inputs.length >= MAX_PENDING_INPUTS) return {
 			ok: false,
 			code: "QUEUE_FULL"
@@ -227,7 +251,21 @@ var SessionInputCoordinator = class {
 				const runId = crypto.randomUUID();
 				const input = claimNextSessionInput(conversationId, runId);
 				if (!input) return;
-				if (this.deps.beforeExecute && !await this.deps.beforeExecute(input) || !consumeConnectionResume(input) || !consumeClarificationResume(input)) {
+				let allowed;
+				try {
+					allowed = (!this.deps.beforeExecute || await this.deps.beforeExecute(input)) && consumeConnectionResume(input) && consumeClarificationResume(input);
+				} catch (err) {
+					log.warn({
+						err,
+						conversationId,
+						runId,
+						inputId: input.id
+					}, "Session input preflight failed");
+					finishSessionInputRun(conversationId, runId, "failed", "Input preflight failed");
+					this.publish(conversationId);
+					continue;
+				}
+				if (!allowed) {
 					finishSessionInputRun(conversationId, runId, "cancelled");
 					this.publish(conversationId);
 					continue;
@@ -272,7 +310,8 @@ var SessionInputCoordinator = class {
 		if (body.contextRefs !== void 0) {
 			const existing = getSessionInputById(conversationId, id);
 			if (!contextRefsMatchFrozenSnapshot(body.contextRefs, existing?.contextRefs)) try {
-				sourceContexts = await this.deps.prepareContexts(body.contextRefs) ?? [];
+				const resolved = await this.deps.prepareContexts(body.contextRefs) ?? [];
+				sourceContexts = fitSourceContextsToBudget([...existing?.contextSnapshots?.filter((source) => source.kind !== "note" && source.kind !== "task") ?? [], ...resolved]);
 			} catch (err) {
 				log.warn({
 					err,

package/dist/src/gateway/service/sessions-api.d.ts

@@ -133,6 +133,7 @@ export declare class GatewaySessionsApi {
     }>;
     search(query: string): Promise<import("../../session/types.js").SessionMetadata[]>;
     searchIn(key: string, keyword: string): Promise<import("../../session/types.js").Message[]>;
+    findMessages(key: string, query: string, limit?: number): Promise<import("../../session/session-find.js").SessionFindResult>;
     export(key: string, format: ExportFormat): Promise<{
         content: string;
     }>;

package/dist/src/gateway/service/sessions-api.js

@@ -201,6 +201,9 @@ var GatewaySessionsApi = class {
 	searchIn(key, keyword) {
 		return this.opts.sessionIndex.searchInSession(key, keyword);
 	}
+	findMessages(key, query, limit) {
+		return this.opts.sessionIndex.getStore().findInSession(key, query, limit);
+	}
 	async export(key, format) {
 		return { content: await this.opts.sessionIndex.exportSession(key, format) };
 	}

package/dist/src/gateway/service/task-conversation-query-service.d.ts

@@ -1,3 +1,4 @@
+import type { SessionFindResult } from '../../session/session-find.js';
 import type { SessionTimelineItem } from '../../session/transcript-outline.js';
 import { TaskConversationRepository } from '../../tasks/task-conversation-repository.js';
 import type { GatewaySessionsApi } from './sessions-api.js';
@@ -5,7 +6,7 @@ export declare class TaskConversationQueryService {
     #private;
     private readonly sessions;
     private readonly conversations;
-    constructor(sessions: Pick<GatewaySessionsApi, 'getMessagePage' | 'getTimeline'>, conversations?: Pick<TaskConversationRepository, 'listSessions'>);
+    constructor(sessions: Pick<GatewaySessionsApi, 'findMessages' | 'getMessagePage' | 'getTimeline'>, conversations?: Pick<TaskConversationRepository, 'listSessions'>);
     getMessagePage(taskId: string, options: {
         limit: number;
         offset: number;
@@ -56,4 +57,5 @@ export declare class TaskConversationQueryService {
         };
     }>;
     getTimeline(taskId: string): Promise<SessionTimelineItem[] | null>;
+    findMessages(taskId: string, query: string, limit?: number): Promise<SessionFindResult | null>;
 }