@xopcai/xopc 0.0.313 → 0.0.314

package/dist/src/extensions/types/manifest.d.ts

@@ -2,6 +2,7 @@
  * Extension manifest — control-plane metadata (readable without loading extension code).
  */
 import type { ExtensionKind } from './core.js';
+import type { ExtensionCapabilityBinding } from '@xopcai/gateway-contract';
 /** Declared in `engines` in the extension manifest (e.g. VSCode-style). */
 export interface EnginesDeclaration {
     /** Semver range string for the running xopc CLI / gateway, e.g. `">=0.0.20"`. */
@@ -121,6 +122,8 @@ export interface ExtensionManifestCommand {
 }
 /** Top-level UI declaration within an extension manifest. */
 export interface ExtensionUiManifest {
+    /** Exact host-owned read contracts requested by this UI release. */
+    capabilities?: ExtensionCapabilityBinding[];
     /** Frontend entry HTML (relative to extension root). */
     main?: string;
     /** Extension icon path (relative to extension root; SVG recommended). */

package/dist/src/gateway/agent-builtin-tools.d.ts

@@ -277,4 +277,4 @@ export declare const GATEWAY_BUILTIN_TOOLS: readonly [{
         readonly zh: "使用已验证的参数执行选定的外部工具。";
     };
 }];
-export declare const GATEWAY_BUILTIN_TOOL_IDS: ("automation" | "workflow" | "find" | "image" | "knowledge_search" | "knowledge_get" | "knowledge_write" | "user_context_search" | "user_context_get" | "user_context_update" | "web_search" | "web_fetch" | "browser_use" | "grep" | "session_search" | "read_file" | "list_dir" | "write_file" | "apply_patch" | "exec_command" | "update_plan" | "todo" | "clarify" | "xopc_tool_execute" | "web_extract" | "image_generate" | "skills_list" | "skill_view" | "skill_manage" | "skills_marketplace_search" | "xopc_tool_search" | "xopc_tool_describe" | "send_message" | "send_media" | "read_media" | "create_share" | "session_status" | "memory_maintenance" | "computer_use" | "tool_manual" | "delegate_task" | "skill_install" | "text_to_speech" | "execute_code" | "create_desktop_pet")[];
+export declare const GATEWAY_BUILTIN_TOOL_IDS: ("automation" | "workflow" | "find" | "image" | "knowledge_search" | "knowledge_get" | "knowledge_write" | "user_context_search" | "user_context_get" | "user_context_update" | "web_search" | "web_fetch" | "browser_use" | "grep" | "session_search" | "read_file" | "list_dir" | "write_file" | "apply_patch" | "exec_command" | "update_plan" | "todo" | "clarify" | "xopc_tool_execute" | "computer_use" | "tool_manual" | "web_extract" | "image_generate" | "skills_list" | "skill_view" | "skill_manage" | "skills_marketplace_search" | "session_status" | "send_message" | "send_media" | "delegate_task" | "skill_install" | "text_to_speech" | "create_share" | "xopc_tool_search" | "xopc_tool_describe" | "read_media" | "memory_maintenance" | "execute_code" | "create_desktop_pet")[];

package/dist/src/gateway/agents-admin.js

@@ -1,11 +1,11 @@
 import { init_agent_scope, listAgentEntries, normalizeAgentId, resolveAgentDir, resolveAgentProfileDir, resolveAgentWorkspaceDir, resolveDefaultAgentId, resolveUserPath, validateAgentIdForNewAgent } from "../agent/agent-scope.js";
-import { WORKSPACE_FILES, init_paths } from "../config/paths.js";
 import { resolveEffectiveAgentProfile } from "../config/agent-profile.js";
-import { applyAgentConfig, findAgentEntryIndex, getAgentDeleteBlocker, pruneAgentConfig, removeAgentDirsFromDisk } from "../commands/agents.config.js";
-import { GATEWAY_BUILTIN_TOOL_IDS } from "./agent-builtin-tools.js";
+import { WORKSPACE_FILES, init_paths } from "../config/paths.js";
 import { AGENT_PROFILE_MARKDOWN_SYSTEM_FILES, REQUIRED_AGENT_PROFILE_MARKDOWN_FILE_SET } from "../agent/context/workspace.js";
-import { seedAgentProfileMarkdownFiles } from "../agent/context/workspace-seed.js";
 import { isPathUnderWorkspace, resolveWorkspaceSafePath } from "./workspace-editor-path.js";
+import { seedAgentProfileMarkdownFiles } from "../agent/context/workspace-seed.js";
+import { applyAgentConfig, findAgentEntryIndex, getAgentDeleteBlocker, pruneAgentConfig, removeAgentDirsFromDisk } from "../commands/agents.config.js";
+import { GATEWAY_BUILTIN_TOOL_IDS } from "./agent-builtin-tools.js";
 import { join, resolve } from "node:path";
 import { mkdir, readFile, realpath, stat, unlink, writeFile } from "node:fs/promises";
 //#region src/gateway/agents-admin.ts

package/dist/src/gateway/device-routes.js

@@ -1,6 +1,6 @@
-import { getTailscaleExposureState } from "./tailscale-lifecycle.js";
-import { resolveReverseProxyPublicUrl } from "./public-url.js";
 import { getTunnelService } from "../tunnel/tunnel-service.js";
+import { resolveReverseProxyPublicUrl } from "./public-url.js";
+import { getTailscaleExposureState } from "./tailscale-lifecycle.js";
 import crypto from "node:crypto";
 //#region src/gateway/device-routes.ts
 function secureUrl(value) {

package/dist/src/gateway/file-path-classifier.js

@@ -1,9 +1,9 @@
 import { init_paths_state, resolveStateDir } from "../config/paths-state.js";
 import { init_agent_scope, resolveAgentProfileDir } from "../agent/agent-scope.js";
-import { init_paths, resolveConfigPath, resolveSkillsDir } from "../config/paths.js";
 import { extractProfileAgentId } from "../config/agent-profile.js";
-import { isPathUnderWorkspace, resolveWorkspaceSafePath } from "./workspace-editor-path.js";
+import { init_paths, resolveConfigPath, resolveSkillsDir } from "../config/paths.js";
 import { isBareProfileMarkdownFileName, resolveProfileMarkdownPathIfBareName } from "../agent/tools/tool-paths.js";
+import { isPathUnderWorkspace, resolveWorkspaceSafePath } from "./workspace-editor-path.js";
 import { basename, isAbsolute, resolve } from "node:path";
 import { stat } from "node:fs/promises";
 //#region src/gateway/file-path-classifier.ts

package/dist/src/gateway/global-defaults-admin.js

@@ -1,7 +1,7 @@
 import { AgentDefaultsSchema } from "../agent-config/schema.js";
 import { init_agent_config } from "../agent-config/index.js";
-import { validateComputerModelChanges } from "../computer/model-config.js";
 import { GATEWAY_BUILTIN_TOOLS } from "./agent-builtin-tools.js";
+import { validateComputerModelChanges } from "../computer/model-config.js";
 import { isDeepStrictEqual } from "node:util";
 //#region src/gateway/global-defaults-admin.ts
 init_agent_config();

package/dist/src/gateway/hono/app.js

@@ -2,13 +2,13 @@ import { createLogger } from "../../utils/logger/index.js";
 import { init_logger } from "../../utils/logger.js";
 import { listDevices } from "../../storage/sqlite/device-access-repository.js";
 import { ENDPOINT_MAX_FILE_BYTES, init_src } from "../../../packages/endpoint-tools-protocol/src/index.js";
-import { BROWSER_EXTENSION_ID } from "../../browser/extension-identity.js";
 import { resolveAllowedBrowserOrigins, resolveGatewayServiceListenPort } from "../host.js";
 import { resolveGatewayEffectiveHost } from "../../config/gateway-bind.js";
+import { loadTunnelState } from "../../tunnel/tunnel-state.js";
+import { resolveReverseProxyPublicUrl } from "../public-url.js";
 import { maxSessionInputRequestBodyBytes } from "../chat-limits.js";
+import { BROWSER_EXTENSION_ID } from "../../browser/extension-identity.js";
 import { isLoopbackIpAddress, isTrustedProxyAddress } from "../client-ip.js";
-import { resolveReverseProxyPublicUrl } from "../public-url.js";
-import { loadTunnelState } from "../../tunnel/tunnel-state.js";
 import { buildGatewayConsoleCspHeader } from "../security/csp.js";
 import { checkBrowserOrigin, isChromeExtensionOrigin } from "../security/origin-check.js";
 import { auth } from "./middleware/auth.js";

package/dist/src/gateway/hono/lib/config-payload.d.ts

@@ -260,6 +260,7 @@ export declare function buildSafeWebConfigPayload(service: GatewayService, optio
                 summaryChunkTokens: number;
                 summaryTimeoutMs: number;
                 summaryRetries: number;
+                reasoningLevel: "low" | "off";
                 qualityGuard: boolean;
                 gapAudit: boolean;
                 minToolResultKeepChars: number;

package/dist/src/gateway/hono/lib/config-payload.js

@@ -1,17 +1,17 @@
 import { ContextPlanningConfigSchema, KnowledgeMemoryConfigSchema, UserModelConfigSchema, init_config } from "../../../user-context/config.js";
 import { init_agent_scope, listAgentEntries, normalizeAgentId, resolveDefaultAgentId } from "../../../agent/agent-scope.js";
 import { resolveModelsJsonPath } from "../../../config/paths.js";
+import { buildChannelCatalogForConfig, buildChannelCatalogFromSnapshot, getChannelSetupStatus, init_channel_catalog_service } from "../../../channels/catalog/channel-catalog-service.js";
 import { init_models_json, loadModelsJson } from "../../../config/models-json.js";
 import { CredentialResolver, init_credentials } from "../../../auth/credentials.js";
-import { buildChannelCatalogForConfig, buildChannelCatalogFromSnapshot, getChannelSetupStatus, init_channel_catalog_service } from "../../../channels/catalog/channel-catalog-service.js";
 import { getProviderRegistry, init_plugin_registry } from "../../../providers/plugin-registry.js";
 import { getAllProviders, init_providers, isProviderConfigured } from "../../../providers/index.js";
 import { normalizeConfiguredMcpServers } from "../../../config/mcp-config-normalize.js";
+import { resolveShareConfig } from "../../../share/share-config.js";
+import { maskTunnelSecretForWeb } from "../../../tunnel/env.js";
 import { resolveSessionConfigForWeb, resolveUpdateConfigForWeb } from "../../../config/web-patch.js";
 import { GENERIC_MASKED_SECRET, maskSecretLength } from "./mask-secret-length.js";
 import { safeToolsWebForGet } from "../../config-tools-web.js";
-import { maskTunnelSecretForWeb } from "../../../tunnel/env.js";
-import { resolveShareConfig } from "../../../share/share-config.js";
 import { buildSafeProvidersConfigForWeb } from "./safe-providers-config.js";
 import { maskRealtimeVoiceConfigForWeb, maskSttConfigForWeb, maskTtsConfigForWeb } from "./safe-voice-config.js";
 //#region src/gateway/hono/lib/config-payload.ts

package/dist/src/gateway/hono/middleware/scopes.js

@@ -11,7 +11,7 @@ function gatewayScopes() {
 	return createMiddleware(async (c, next) => {
 		const principal = getGatewayPrincipal(c);
 		const requiredScope = requiredGatewayScope(c.req.method, c.req.path);
-		if (!hasGatewayScope(principal.scopes, requiredScope)) {
+		if (requiredScope && !hasGatewayScope(principal.scopes, requiredScope)) {
 			log.warn({
 				path: c.req.path,
 				method: c.req.method,

package/dist/src/gateway/hono/routes/agents.js

@@ -1,8 +1,8 @@
 import { AgentModelsOverrideSchema, AgentProfileSchema, RuntimePolicySchema, SkillOverrideSchema, ToolPoliciesSchema, WorkflowPolicySchema } from "../../../agent-config/schema.js";
 import { init_agent_config } from "../../../agent-config/index.js";
 import { init_agent_scope, normalizeAgentId } from "../../../agent/agent-scope.js";
-import { getVoiceModelsConfig } from "../../../config/voice.js";
 import { deleteAgentAvatarFile, finalizeCreateAgentDirs, getGatewayAgentEffectiveConfig, listAgentProfileFiles, listGatewayAgents, prepareCreateAgent, prepareDeleteAgent, prepareUpdateAgent, readAgentAvatarFile, readAgentProfileFile, runAfterDeletePurge, writeAgentAvatarFromBase64, writeAgentProfileFile } from "../../agents-admin.js";
+import { getVoiceModelsConfig } from "../../../config/voice.js";
 //#region src/gateway/hono/routes/agents.ts
 init_agent_config();
 init_agent_scope();

package/dist/src/gateway/hono/routes/auth-registry-extensions.js

@@ -1,6 +1,6 @@
 import { getAllModels, getAvailableModels, init_providers } from "../../../providers/index.js";
-import { mergeActivationContext } from "../../../extensions/activation-context.js";
 import { ActivationPlanner } from "../../../extensions/activation-planner.js";
+import { mergeActivationContext } from "../../../extensions/activation-context.js";
 import { validateExtensionConfig } from "../../../extensions/config-validation.js";
 import { fetchRegistry, listExtensions, searchExtensions } from "../../../extensions/marketplace.js";
 import { createOAuthAsyncHandler } from "../oauth-async.js";
@@ -231,8 +231,11 @@ function registerAuthRegistryExtensionsRoutes(authenticated, deps) {
 	authenticated.get("/api/extensions/:id/ui-grant", (c) => {
 		return c.json({ grant: service.localApps.getUiGrant(c.req.param("id")) });
 	});
-	authenticated.post("/api/extensions/:id/ui-grant", (c) => {
-		return c.json({ grant: service.localApps.grantUiPermissions(c.req.param("id")) });
+	authenticated.post("/api/extensions/:id/ui-grant", async (c) => {
+		const body = await c.req.json().catch(() => null);
+		if (!body || typeof body.manifestDigest !== "string" || !/^[a-f0-9]{64}$/.test(body.manifestDigest)) return c.json({ error: "The reviewed manifestDigest is required" }, 400);
+		if (service.localApps.getUiGrant(c.req.param("id")).manifestDigest !== body.manifestDigest) return c.json({ error: "Extension release changed; review permissions again" }, 409);
+		return c.json({ grant: service.localApps.grantUiPermissions(c.req.param("id"), body.manifestDigest) });
 	});
 	authenticated.get("/api/extensions/:id/storage", async (c) => {
 		const store = await loadExtensionStore(c.req.param("id"));

package/dist/src/gateway/hono/routes/browser.js

@@ -2,8 +2,8 @@ import { deleteBrowserTabBinding, getBrowserTabBinding, setBrowserTabBinding } f
 import { browserTabBindingRequestSchema } from "../../../../packages/gateway-contract/src/browser-tab-binding.js";
 import { init_src } from "../../../../packages/gateway-contract/src/index.js";
 import { getDevice } from "../../../storage/sqlite/device-access-repository.js";
-import { decideBrowserApproval, listBrowserApprovals } from "../../../browser/policy/approval-store.js";
 import "../../../../packages/browser-control-contract/src/index.js";
+import { decideBrowserApproval, listBrowserApprovals } from "../../../browser/policy/approval-store.js";
 import { createBrowserDriver } from "../../../browser/drivers/create-driver.js";
 import { checkBrowserReadiness } from "../../../browser/readiness.js";
 import { isLoopbackClientIp } from "../../security/loopback.js";

package/dist/src/gateway/hono/routes/capability-operations.d.ts

@@ -0,0 +1,3 @@
+import type { Hono } from 'hono';
+import type { AuthenticatedRouteDeps } from './deps.js';
+export declare function registerCapabilityOperationRoutes(app: Hono, deps: AuthenticatedRouteDeps): void;

package/dist/src/gateway/hono/routes/capability-operations.js

@@ -0,0 +1,52 @@
+import { CapabilityCallSchema } from "../../../../packages/gateway-contract/src/capabilities.js";
+import { init_src } from "../../../../packages/gateway-contract/src/index.js";
+import { CapabilityError } from "../../../capabilities/runtime/errors.js";
+import "../../../capabilities/runtime/dispatcher.js";
+import { createProductDispatcher } from "../../../capabilities/runtime/product.js";
+import { capabilityHttpContext, capabilityHttpError } from "../../../capabilities/adapters/http.js";
+//#region src/gateway/hono/routes/capability-operations.ts
+init_src();
+function registerCapabilityOperationRoutes(app, deps) {
+	const dispatcher = createProductDispatcher(() => deps.service.notesServiceInstance, {
+		getConfig: () => deps.service.currentConfig,
+		getProjects: () => deps.service.projects,
+		getAutomations: () => deps.service.automationServiceInstance,
+		getWorkDiscovery: () => deps.service.workDiscovery,
+		getLocalApps: () => deps.service.localApps,
+		...deps.scenes ? { getSceneAccess: () => ({
+			services: deps.scenes,
+			principal: {
+				ownerId: "local-owner",
+				workspaceId: deps.service.currentWorkspacePath
+			}
+		}) } : {},
+		wake: (runId) => runId ? deps.service.dispatchTaskRuns() : deps.service.dispatchTaskEvents(),
+		abortConversation: async (conversationId) => {
+			const liveRunId = deps.service.getActiveWebchatRunId(conversationId);
+			if (liveRunId) await deps.service.abortAgentRun(liveRunId);
+		}
+	});
+	app.get("/api/capabilities/operations", (c) => c.json({ capabilities: dispatcher.list(capabilityHttpContext(c)) }));
+	app.get("/api/capabilities/operations/:id", (c) => {
+		try {
+			return c.json(dispatcher.describe(c.req.param("id"), capabilityHttpContext(c)));
+		} catch (error) {
+			return capabilityHttpError(c, error);
+		}
+	});
+	app.post("/api/capabilities/operations/:id/invocations", deps.strictRateLimitMiddleware, async (c) => {
+		try {
+			const parsed = CapabilityCallSchema.safeParse(await c.req.json().catch(() => null));
+			if (!parsed.success) throw new CapabilityError("INVALID_INPUT", "Invalid capability request");
+			const result = await dispatcher.call(c.req.param("id"), parsed.data.input, capabilityHttpContext(c), parsed.data);
+			return c.json({
+				status: "succeeded",
+				data: result
+			});
+		} catch (error) {
+			return capabilityHttpError(c, error);
+		}
+	});
+}
+//#endregion
+export { registerCapabilityOperationRoutes };

package/dist/src/gateway/hono/routes/commands-skills.js

@@ -1,11 +1,11 @@
-import { commandRegistry } from "../../../chat-commands/registry.js";
 import { effectiveWorkspacePathForSession } from "../../../session/session-workspace.js";
 import { getProjectForSession } from "../../../projects/workspace.js";
-import { buildReviewContext, resolveGitRoot } from "../../../review/review-git.js";
-import "../../../chat-commands/index.js";
 import { isRegisteredProvider } from "../../../agent/skills/marketplace/registry.js";
 import "../../../agent/skills/skills-marketplace.js";
 import { isSkillInstallTarget } from "../../../agent/skills/install-target.js";
+import { commandRegistry } from "../../../chat-commands/registry.js";
+import { buildReviewContext, resolveGitRoot } from "../../../review/review-git.js";
+import "../../../chat-commands/index.js";
 //#region src/gateway/hono/routes/commands-skills.ts
 function parseMarketplaceProviderQuery(raw) {
 	const v = raw?.trim().toLowerCase();

package/dist/src/gateway/hono/routes/config-patch/gateway.js

@@ -1,8 +1,8 @@
 import { init_public_url, validatePublicUrl } from "../../../../config/public-url.js";
 import { isValidIPv4 } from "../../../../config/gateway-bind.js";
-import { isMaskedSecretPatchValue } from "../../lib/mask-secret-length.js";
 import { mergeShareConfigPatch } from "../../../../share/share-config.js";
 import { mergeSiteShareConfigPatch } from "../../../../share/site-share-config.js";
+import { isMaskedSecretPatchValue } from "../../lib/mask-secret-length.js";
 import { PATCH_OK, patchError } from "./result.js";
 //#region src/gateway/hono/routes/config-patch/gateway.ts
 init_public_url();

package/dist/src/gateway/hono/routes/config-patch/misc.js

@@ -2,8 +2,8 @@ import { ComputerConfigSchema, init_config } from "../../../../computer/config.j
 import { ContextPlanningConfigSchema, KnowledgeMemoryConfigSchema, UserContextConfigSchema, UserModelConfigSchema, init_config as init_config$1 } from "../../../../user-context/config.js";
 import { BindingsConfigSchema, BrowserConfigSchema, McpConfigSchema, VoiceConfigSchema, init_schema } from "../../../../config/schema.js";
 import { CredentialResolver, init_credentials } from "../../../../auth/credentials.js";
-import { setTuiDefaultAgentConfig } from "../../../../commands/agents.config.js";
 import { canonicalizeConfiguredMcpServer } from "../../../../config/mcp-config-normalize.js";
+import { setTuiDefaultAgentConfig } from "../../../../commands/agents.config.js";
 import { mergeGatewaySkillsMarketplacePatch, mergeSessionConfigPatch, mergeUpdateConfigPatch } from "../../../../config/web-patch.js";
 import { assertGatewayAuthConfigured, resolveGatewayAuth } from "../../../auth.js";
 import { isMaskedSecretPatchValue } from "../../lib/mask-secret-length.js";

package/dist/src/gateway/hono/routes/home.js

@@ -1,9 +1,9 @@
 import { acknowledgeHomeAttention } from "../../../storage/sqlite/home-attention-repository.js";
 import { decideConnectorApproval } from "../../../storage/sqlite/connector-repository.js";
 import "../../../storage/sqlite/index.js";
-import { resumeApprovedConnectorAction } from "../../../connectors/approval-resume.js";
 import { listGatewayAgents } from "../../agents-admin.js";
 import { HomeQueryService, buildHomeWorkbench, decisionFromTask } from "../../../tasks/home-query-service.js";
+import { resumeApprovedConnectorAction } from "../../../connectors/approval-resume.js";
 //#region src/gateway/hono/routes/home.ts
 /** Register the unified work-home read model and its decision actions. */
 function registerHomeRoutes(authenticated, deps) {

package/dist/src/gateway/hono/routes/imports.js

@@ -1,10 +1,10 @@
+import { getGatewayPrincipal } from "../../security/gateway-principal.js";
 import { ImportError } from "../../../imports/types.js";
 import { isImportSource } from "../../../imports/sources.js";
 import { ImportSelectionRepository } from "../../../storage/sqlite/import-selection-repository.js";
 import { getLiveInventory, previewInventoryItem, publicInventory, scanProduct } from "../../../imports/inventory.js";
 import { importSelection, listImportSources } from "../../../imports/productImport.js";
 import { createRuntimeImportService } from "../../../imports/runtime.js";
-import { getGatewayPrincipal } from "../../security/gateway-principal.js";
 import { z } from "zod";
 //#region src/gateway/hono/routes/imports.ts
 const selectionSchema = z.object({

package/dist/src/gateway/hono/routes/lazy-bundles.js

@@ -3,6 +3,22 @@ function startsWithAny(path, prefixes) {
 	return prefixes.some((prefix) => path === prefix || path.startsWith(`${prefix}/`));
 }
 const AUTHENTICATED_LAZY_ROUTE_BUNDLES = [
+	{
+		id: "local-app-capabilities",
+		match: (path) => /^\/api\/local-app-capabilities\/[^/]+(?:\/[^/]+\/invocations)?$/.test(path),
+		load: async () => {
+			const { registerLocalAppCapabilityRoutes } = await import("./local-app-capabilities.js");
+			return { register: registerLocalAppCapabilityRoutes };
+		}
+	},
+	{
+		id: "capability-operations",
+		match: (path) => startsWithAny(path, ["/api/capabilities/operations"]),
+		load: async () => {
+			const { registerCapabilityOperationRoutes } = await import("./capability-operations.js");
+			return { register: registerCapabilityOperationRoutes };
+		}
+	},
 	{
 		id: "endpoint-compatibility",
 		match: (path) => path === "/api/endpoint-tools/compatibility",

package/dist/src/gateway/hono/routes/local-app-capabilities.d.ts

@@ -0,0 +1,4 @@
+import type { Hono } from 'hono';
+import type { AuthenticatedRouteDeps } from './deps.js';
+/** Authenticated host API. Iframes must not receive Gateway credentials. */
+export declare function registerLocalAppCapabilityRoutes(app: Hono, deps: AuthenticatedRouteDeps): void;

package/dist/src/gateway/hono/routes/local-app-capabilities.js

@@ -0,0 +1,41 @@
+import { CapabilityCallSchema } from "../../../../packages/gateway-contract/src/capabilities.js";
+import { init_src } from "../../../../packages/gateway-contract/src/index.js";
+import { CapabilityError } from "../../../capabilities/runtime/errors.js";
+import { createProductDispatcher } from "../../../capabilities/runtime/product.js";
+import { localAppCapabilities } from "../../../local-apps/capabilities/runtime.js";
+import { capabilityHttpContext, capabilityHttpError } from "../../../capabilities/adapters/http.js";
+import { z } from "zod";
+//#region src/gateway/hono/routes/local-app-capabilities.ts
+init_src();
+const Digest = z.string().regex(/^[a-f0-9]{64}$/);
+const Invocation = z.strictObject({
+	manifestDigest: Digest,
+	call: CapabilityCallSchema
+});
+/** Authenticated host API. Iframes must not receive Gateway credentials. */
+function registerLocalAppCapabilityRoutes(app, deps) {
+	const dispatcher = createProductDispatcher(() => deps.service.notesServiceInstance, { getProjects: () => deps.service.projects });
+	const path = "/api/local-app-capabilities/:extensionId";
+	app.get(path, (c) => {
+		try {
+			const digest = Digest.parse(c.req.query("manifestDigest"));
+			return c.json(localAppCapabilities(deps.service.localApps, dispatcher, c.req.param("extensionId"), digest, capabilityHttpContext(c)).list());
+		} catch (error) {
+			return capabilityHttpError(c, error instanceof z.ZodError ? new CapabilityError("INVALID_INPUT", "Invalid manifest digest") : error);
+		}
+	});
+	app.post(`${path}/:id/invocations`, deps.strictRateLimitMiddleware, async (c) => {
+		try {
+			const parsed = Invocation.safeParse(await c.req.json().catch(() => null));
+			if (!parsed.success) throw new CapabilityError("INVALID_INPUT", "Invalid local app invocation");
+			const { manifestDigest, call } = parsed.data;
+			const extensionId = c.req.param("extensionId");
+			const id = c.req.param("id");
+			return c.json(await localAppCapabilities(deps.service.localApps, dispatcher, extensionId, manifestDigest, capabilityHttpContext(c)).call(id, call));
+		} catch (error) {
+			return capabilityHttpError(c, error);
+		}
+	});
+}
+//#endregion
+export { registerLocalAppCapabilityRoutes };

package/dist/src/gateway/hono/routes/local-apps.js

@@ -1,8 +1,13 @@
+import { CapabilityError } from "../../../capabilities/runtime/errors.js";
+import "../../../capabilities/runtime/dispatcher.js";
 import { readLocalAppAcceptanceConfig } from "../../../local-apps/acceptance.js";
+import { createProductDispatcher } from "../../../capabilities/runtime/product.js";
 import { extensionAssetMimeType } from "../lib/extension-assets.js";
+import { capabilityHttpContext, capabilityHttpError } from "../../../capabilities/adapters/http.js";
 import { LOCAL_APP_RUNTIME_BRIDGE_HASH, injectLocalAppRuntimeBridge } from "../../../local-apps/preview-runtime-bridge.js";
 import { relative, resolve } from "node:path";
 import { existsSync, readFileSync, statSync } from "node:fs";
+import { randomUUID } from "node:crypto";
 //#region src/gateway/hono/routes/local-apps.ts
 const LOCAL_APP_PREVIEW_CSP = `default-src 'self'; script-src 'self' 'sha256-${LOCAL_APP_RUNTIME_BRIDGE_HASH}'; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob:; connect-src 'none'; frame-ancestors 'self'; frame-src 'none'; base-uri 'none'; object-src 'none'; form-action 'none'`;
 function registerPublicLocalAppPreviewRoutes(app, service) {
@@ -49,7 +54,14 @@ function registerPublicLocalAppPreviewRoutes(app, service) {
 	});
 }
 function registerLocalAppsRoutes(app, deps) {
-	app.get("/api/local-apps", (c) => c.json({ apps: deps.service.localApps.list() }));
+	const capabilities = createProductDispatcher(void 0, { getLocalApps: () => deps.service.localApps });
+	app.get("/api/local-apps", async (c) => {
+		try {
+			return c.json(await capabilities.call("xopc.local_apps.list", {}, capabilityHttpContext(c)));
+		} catch (error) {
+			return capabilityHttpError(c, error);
+		}
+	});
 	app.post("/api/local-apps", async (c) => {
 		const body = await c.req.json();
 		if (typeof body.name !== "string" || typeof body.idea !== "string") return c.json({ error: "name and idea are required" }, 400);
@@ -60,17 +72,37 @@ function registerLocalAppsRoutes(app, deps) {
 		});
 		return c.json({ app: appDetail }, 201);
 	});
-	app.get("/api/local-apps/:id", (c) => {
-		const appDetail = deps.service.localApps.get(c.req.param("id"));
-		return appDetail ? c.json({ app: appDetail }) : c.json({ error: "Local app not found" }, 404);
+	app.get("/api/local-apps/:id", async (c) => {
+		try {
+			return c.json(await capabilities.call("xopc.local_apps.get", { id: c.req.param("id") }, capabilityHttpContext(c)));
+		} catch (error) {
+			return capabilityHttpError(c, error);
+		}
 	});
-	app.post("/api/local-apps/:id/validate", (c) => {
-		return c.json({ validation: deps.service.localApps.validate(c.req.param("id")) });
+	app.post("/api/local-apps/:id/validate", async (c) => {
+		try {
+			return c.json(await capabilities.call("xopc.local_apps.validate", { id: c.req.param("id") }, capabilityHttpContext(c)));
+		} catch (error) {
+			return capabilityHttpError(c, error);
+		}
 	});
 	app.post("/api/local-apps/:id/acceptance-runs", async (c) => {
-		const body = await c.req.json();
-		const acceptance = deps.service.localApps.recordAcceptance(c.req.param("id"), body);
-		return c.json({ acceptance }, 201);
+		try {
+			const body = await c.req.json().catch(() => {
+				throw new CapabilityError("INVALID_INPUT", "Invalid JSON body");
+			});
+			const caller = capabilityHttpContext(c);
+			const operation = "xopc.local_apps.record_acceptance";
+			return c.json(await capabilities.call(operation, {
+				...body,
+				id: c.req.param("id")
+			}, caller, {
+				...capabilities.describe(operation, caller),
+				idempotencyKey: c.req.header("idempotency-key") ?? randomUUID()
+			}), 201);
+		} catch (error) {
+			return capabilityHttpError(c, error);
+		}
 	});
 	app.post("/api/local-apps/:id/install", async (c) => {
 		const appDetail = await deps.service.localApps.install(c.req.param("id"));

package/dist/src/gateway/hono/routes/mcp.js

@@ -1,7 +1,7 @@
 import { isManagedConnectorServer } from "../../../connectors/materialize.js";
-import { getWorkspacePath } from "../../../config/workspace-path-helpers.js";
 import { canonicalizeConfiguredMcpServer, normalizeConfiguredMcpServers } from "../../../config/mcp-config-normalize.js";
 import { loadMergedBundleMcpConfig } from "../../../agent/mcp/bundle-mcp-config.js";
+import { getWorkspacePath } from "../../../config/workspace-path-helpers.js";
 import { getMcpOAuthManager } from "../../../agent/mcp/oauth/mcp-oauth-manager.js";
 import { listBundleMcpServerCapabilitiesForGateway, listBundleMcpServerToolsForGateway } from "../../../agent/mcp/bundle-mcp-gateway.js";
 //#region src/gateway/hono/routes/mcp.ts

package/dist/src/gateway/hono/routes/media.js

@@ -1,6 +1,6 @@
-import { MAX_WEBCHAT_ATTACHMENT_FILE_BYTES } from "../../chat-limits.js";
 import { mimeTypeFromMediaPath, saveMediaBuffer } from "../../../media/store.js";
 import { readMediaReference } from "../../../media/media-reference.js";
+import { MAX_WEBCHAT_ATTACHMENT_FILE_BYTES } from "../../chat-limits.js";
 import { createGatewayRouteLogger } from "../lib/route-logger.js";
 import { resolveScopedMediaReference } from "../../media-access.js";
 //#region src/gateway/hono/routes/media.ts

package/dist/src/gateway/hono/routes/models.js

@@ -1,6 +1,6 @@
-import { init_resolve_config_value, testApiKeyResolution } from "../../../config/resolve-config-value.js";
 import { resolveModelsJsonPath } from "../../../config/paths.js";
-import { computerModelProfile, init_model_policy } from "../../../computer/model-policy.js";
+import { init_resolve_config_value, testApiKeyResolution } from "../../../config/resolve-config-value.js";
+import { computerModelProfile, init_model_policy, isDedicatedComputerModel } from "../../../computer/model-policy.js";
 import { init_models_json, loadModelsJson, saveModelsJson, validateModelsConfig } from "../../../config/models-json.js";
 import { getModelCatalogStore, init_model_catalog_store } from "../../../providers/model-catalog-store.js";
 import { getModelRegistry } from "../../../providers/model-registry.js";
@@ -8,13 +8,13 @@ import { CredentialResolver, init_credentials } from "../../../auth/credentials.
 import "../../../providers/constants.js";
 import { getProviderRegistry, init_plugin_registry } from "../../../providers/plugin-registry.js";
 import { PROVIDER_META, getAllModels, getAllProviders, getAvailableModels, getProviderAuthState, init_providers, isProviderConfigured, isProviderConfiguredSync } from "../../../providers/index.js";
-import { deleteCustomImageProvider, listCustomImageProviders, upsertCustomImageProvider } from "../../custom-image-providers.js";
-import { getImageGenerationProvider, reloadImageGenerationProviders, resolveImageGenerationCredentialMode } from "../../../agent/image/generation/provider-registry.js";
-import { getAgentImageGenerationConfig, getDefaultImageGenerationConfig, getImageGenerationCatalog, prepareDefaultImageGenerationSetup, prepareImageGenerationSetup, verifyImageGenerationCredential } from "../../image-generation-setup.js";
-import { SessionConfigStore } from "../../../session/config-store.js";
 import { buildCapabilityPlansForConfig } from "../../../capabilities/readiness/from-config.js";
 import "../../../capabilities/readiness/index.js";
+import { getImageGenerationProvider, reloadImageGenerationProviders, resolveImageGenerationCredentialMode } from "../../../agent/image/generation/provider-registry.js";
+import { SessionConfigStore } from "../../../session/config-store.js";
 import { getModelThinking } from "../../../providers/model-thinking.js";
+import { deleteCustomImageProvider, listCustomImageProviders, upsertCustomImageProvider } from "../../custom-image-providers.js";
+import { getAgentImageGenerationConfig, getDefaultImageGenerationConfig, getImageGenerationCatalog, prepareDefaultImageGenerationSetup, prepareImageGenerationSetup, verifyImageGenerationCredential } from "../../image-generation-setup.js";
 import { discoverProviderModels, isProviderApiDiscoverable } from "../../../providers/model-discovery.js";
 import { getXopcCloudCatalogCoordinator } from "../../../providers/xopc-cloud-catalog-coordinator.js";
 import { respondStartupUnavailable } from "../lib/startup-unavailable.js";
@@ -306,7 +306,7 @@ function registerModelsRoutes(authenticated, deps) {
 			reasoning: m.reasoning ?? false,
 			thinking: getModelThinking(m),
 			vision: m.input?.includes("image") ?? false,
-			recommended: !computerModelProfile(m) && isRecommendedModel(m.provider, m.id),
+			recommended: !isDedicatedComputerModel(m) && isRecommendedModel(m.provider, m.id),
 			cost: {
 				input: m.cost?.input ?? 0,
 				output: m.cost?.output ?? 0