@xopcai/xopc 0.0.313 → 0.0.315

package/dist/src/gateway/file-path-classifier.js

@@ -1,9 +1,9 @@
 import { init_paths_state, resolveStateDir } from "../config/paths-state.js";
 import { init_agent_scope, resolveAgentProfileDir } from "../agent/agent-scope.js";
-import { init_paths, resolveConfigPath, resolveSkillsDir } from "../config/paths.js";
 import { extractProfileAgentId } from "../config/agent-profile.js";
-import { isPathUnderWorkspace, resolveWorkspaceSafePath } from "./workspace-editor-path.js";
+import { init_paths, resolveConfigPath, resolveSkillsDir } from "../config/paths.js";
 import { isBareProfileMarkdownFileName, resolveProfileMarkdownPathIfBareName } from "../agent/tools/tool-paths.js";
+import { isPathUnderWorkspace, resolveWorkspaceSafePath } from "./workspace-editor-path.js";
 import { basename, isAbsolute, resolve } from "node:path";
 import { stat } from "node:fs/promises";
 //#region src/gateway/file-path-classifier.ts

package/dist/src/gateway/global-defaults-admin.js

@@ -1,7 +1,7 @@
 import { AgentDefaultsSchema } from "../agent-config/schema.js";
 import { init_agent_config } from "../agent-config/index.js";
-import { validateComputerModelChanges } from "../computer/model-config.js";
 import { GATEWAY_BUILTIN_TOOLS } from "./agent-builtin-tools.js";
+import { validateComputerModelChanges } from "../computer/model-config.js";
 import { isDeepStrictEqual } from "node:util";
 //#region src/gateway/global-defaults-admin.ts
 init_agent_config();

package/dist/src/gateway/hono/app.js

@@ -2,13 +2,13 @@ import { createLogger } from "../../utils/logger/index.js";
 import { init_logger } from "../../utils/logger.js";
 import { listDevices } from "../../storage/sqlite/device-access-repository.js";
 import { ENDPOINT_MAX_FILE_BYTES, init_src } from "../../../packages/endpoint-tools-protocol/src/index.js";
-import { BROWSER_EXTENSION_ID } from "../../browser/extension-identity.js";
 import { resolveAllowedBrowserOrigins, resolveGatewayServiceListenPort } from "../host.js";
 import { resolveGatewayEffectiveHost } from "../../config/gateway-bind.js";
+import { loadTunnelState } from "../../tunnel/tunnel-state.js";
+import { resolveReverseProxyPublicUrl } from "../public-url.js";
 import { maxSessionInputRequestBodyBytes } from "../chat-limits.js";
+import { BROWSER_EXTENSION_ID } from "../../browser/extension-identity.js";
 import { isLoopbackIpAddress, isTrustedProxyAddress } from "../client-ip.js";
-import { resolveReverseProxyPublicUrl } from "../public-url.js";
-import { loadTunnelState } from "../../tunnel/tunnel-state.js";
 import { buildGatewayConsoleCspHeader } from "../security/csp.js";
 import { checkBrowserOrigin, isChromeExtensionOrigin } from "../security/origin-check.js";
 import { auth } from "./middleware/auth.js";

package/dist/src/gateway/hono/lib/config-payload.d.ts

@@ -260,6 +260,7 @@ export declare function buildSafeWebConfigPayload(service: GatewayService, optio
                 summaryChunkTokens: number;
                 summaryTimeoutMs: number;
                 summaryRetries: number;
+                reasoningLevel: "low" | "off";
                 qualityGuard: boolean;
                 gapAudit: boolean;
                 minToolResultKeepChars: number;

package/dist/src/gateway/hono/lib/config-payload.js

@@ -1,17 +1,17 @@
 import { ContextPlanningConfigSchema, KnowledgeMemoryConfigSchema, UserModelConfigSchema, init_config } from "../../../user-context/config.js";
 import { init_agent_scope, listAgentEntries, normalizeAgentId, resolveDefaultAgentId } from "../../../agent/agent-scope.js";
 import { resolveModelsJsonPath } from "../../../config/paths.js";
+import { buildChannelCatalogForConfig, buildChannelCatalogFromSnapshot, getChannelSetupStatus, init_channel_catalog_service } from "../../../channels/catalog/channel-catalog-service.js";
 import { init_models_json, loadModelsJson } from "../../../config/models-json.js";
 import { CredentialResolver, init_credentials } from "../../../auth/credentials.js";
-import { buildChannelCatalogForConfig, buildChannelCatalogFromSnapshot, getChannelSetupStatus, init_channel_catalog_service } from "../../../channels/catalog/channel-catalog-service.js";
 import { getProviderRegistry, init_plugin_registry } from "../../../providers/plugin-registry.js";
 import { getAllProviders, init_providers, isProviderConfigured } from "../../../providers/index.js";
 import { normalizeConfiguredMcpServers } from "../../../config/mcp-config-normalize.js";
+import { resolveShareConfig } from "../../../share/share-config.js";
+import { maskTunnelSecretForWeb } from "../../../tunnel/env.js";
 import { resolveSessionConfigForWeb, resolveUpdateConfigForWeb } from "../../../config/web-patch.js";
 import { GENERIC_MASKED_SECRET, maskSecretLength } from "./mask-secret-length.js";
 import { safeToolsWebForGet } from "../../config-tools-web.js";
-import { maskTunnelSecretForWeb } from "../../../tunnel/env.js";
-import { resolveShareConfig } from "../../../share/share-config.js";
 import { buildSafeProvidersConfigForWeb } from "./safe-providers-config.js";
 import { maskRealtimeVoiceConfigForWeb, maskSttConfigForWeb, maskTtsConfigForWeb } from "./safe-voice-config.js";
 //#region src/gateway/hono/lib/config-payload.ts

package/dist/src/gateway/hono/middleware/scopes.js

@@ -11,7 +11,7 @@ function gatewayScopes() {
 	return createMiddleware(async (c, next) => {
 		const principal = getGatewayPrincipal(c);
 		const requiredScope = requiredGatewayScope(c.req.method, c.req.path);
-		if (!hasGatewayScope(principal.scopes, requiredScope)) {
+		if (requiredScope && !hasGatewayScope(principal.scopes, requiredScope)) {
 			log.warn({
 				path: c.req.path,
 				method: c.req.method,

package/dist/src/gateway/hono/routes/agent-stream.js

@@ -57,7 +57,7 @@ function registerAgentStreamRoutes(authenticated, deps) {
 			ok: false,
 			error: {
 				code: "BAD_REQUEST",
-				message: "Invalid Note context references"
+				message: "Invalid source context references"
 			}
 		}, 400);
 		if (body.content !== void 0) {
@@ -93,7 +93,7 @@ function registerAgentStreamRoutes(authenticated, deps) {
 			ok: false,
 			error: {
 				code: result.contextUnavailable ? "CONTEXT_UNAVAILABLE" : "CONFLICT",
-				message: result.contextUnavailable ? "A referenced Note changed or is no longer available. Select it again." : "Input changed"
+				message: result.contextUnavailable ? "A referenced source changed or is no longer available. Select it again." : "Input changed"
 			},
 			payload: result.state
 		}, 409);

package/dist/src/gateway/hono/routes/agents.js

@@ -1,8 +1,8 @@
 import { AgentModelsOverrideSchema, AgentProfileSchema, RuntimePolicySchema, SkillOverrideSchema, ToolPoliciesSchema, WorkflowPolicySchema } from "../../../agent-config/schema.js";
 import { init_agent_config } from "../../../agent-config/index.js";
 import { init_agent_scope, normalizeAgentId } from "../../../agent/agent-scope.js";
-import { getVoiceModelsConfig } from "../../../config/voice.js";
 import { deleteAgentAvatarFile, finalizeCreateAgentDirs, getGatewayAgentEffectiveConfig, listAgentProfileFiles, listGatewayAgents, prepareCreateAgent, prepareDeleteAgent, prepareUpdateAgent, readAgentAvatarFile, readAgentProfileFile, runAfterDeletePurge, writeAgentAvatarFromBase64, writeAgentProfileFile } from "../../agents-admin.js";
+import { getVoiceModelsConfig } from "../../../config/voice.js";
 //#region src/gateway/hono/routes/agents.ts
 init_agent_config();
 init_agent_scope();

package/dist/src/gateway/hono/routes/auth-registry-extensions.js

@@ -1,6 +1,6 @@
 import { getAllModels, getAvailableModels, init_providers } from "../../../providers/index.js";
-import { mergeActivationContext } from "../../../extensions/activation-context.js";
 import { ActivationPlanner } from "../../../extensions/activation-planner.js";
+import { mergeActivationContext } from "../../../extensions/activation-context.js";
 import { validateExtensionConfig } from "../../../extensions/config-validation.js";
 import { fetchRegistry, listExtensions, searchExtensions } from "../../../extensions/marketplace.js";
 import { createOAuthAsyncHandler } from "../oauth-async.js";
@@ -231,8 +231,11 @@ function registerAuthRegistryExtensionsRoutes(authenticated, deps) {
 	authenticated.get("/api/extensions/:id/ui-grant", (c) => {
 		return c.json({ grant: service.localApps.getUiGrant(c.req.param("id")) });
 	});
-	authenticated.post("/api/extensions/:id/ui-grant", (c) => {
-		return c.json({ grant: service.localApps.grantUiPermissions(c.req.param("id")) });
+	authenticated.post("/api/extensions/:id/ui-grant", async (c) => {
+		const body = await c.req.json().catch(() => null);
+		if (!body || typeof body.manifestDigest !== "string" || !/^[a-f0-9]{64}$/.test(body.manifestDigest)) return c.json({ error: "The reviewed manifestDigest is required" }, 400);
+		if (service.localApps.getUiGrant(c.req.param("id")).manifestDigest !== body.manifestDigest) return c.json({ error: "Extension release changed; review permissions again" }, 409);
+		return c.json({ grant: service.localApps.grantUiPermissions(c.req.param("id"), body.manifestDigest) });
 	});
 	authenticated.get("/api/extensions/:id/storage", async (c) => {
 		const store = await loadExtensionStore(c.req.param("id"));

package/dist/src/gateway/hono/routes/browser.js

@@ -2,8 +2,8 @@ import { deleteBrowserTabBinding, getBrowserTabBinding, setBrowserTabBinding } f
 import { browserTabBindingRequestSchema } from "../../../../packages/gateway-contract/src/browser-tab-binding.js";
 import { init_src } from "../../../../packages/gateway-contract/src/index.js";
 import { getDevice } from "../../../storage/sqlite/device-access-repository.js";
-import { decideBrowserApproval, listBrowserApprovals } from "../../../browser/policy/approval-store.js";
 import "../../../../packages/browser-control-contract/src/index.js";
+import { decideBrowserApproval, listBrowserApprovals } from "../../../browser/policy/approval-store.js";
 import { createBrowserDriver } from "../../../browser/drivers/create-driver.js";
 import { checkBrowserReadiness } from "../../../browser/readiness.js";
 import { isLoopbackClientIp } from "../../security/loopback.js";
@@ -78,6 +78,38 @@ function canManageBrowserSession(c, service, conversationId) {
 }
 function registerBrowserRoutes(authenticated, deps) {
 	const { service, strictRateLimitMiddleware } = deps;
+	authenticated.get("/api/browser/tabs", (c) => {
+		const conversationId = (c.req.query("conversationId") ?? "").trim();
+		if (!conversationId) return c.json({
+			ok: false,
+			error: {
+				code: "BAD_REQUEST",
+				message: "Missing conversationId"
+			}
+		}, 400);
+		const binding = getBrowserTabBinding(conversationId);
+		if (!binding) return c.json({
+			ok: true,
+			payload: { tabs: [] }
+		});
+		if (!canManageBrowserSession(c, service, conversationId)) return c.json({
+			ok: false,
+			error: {
+				code: "FORBIDDEN",
+				message: "Tab binding belongs to another device"
+			}
+		}, 403);
+		return c.json({
+			ok: true,
+			payload: { tabs: [{
+				id: binding.id,
+				title: new URL(binding.urlOrigin).hostname,
+				url: binding.urlOrigin,
+				documentId: binding.documentId,
+				active: true
+			}] }
+		});
+	});
 	authenticated.get("/api/browser/tab-bindings/:conversationId", (c) => {
 		const conversationId = c.req.param("conversationId").trim();
 		const binding = getBrowserTabBinding(conversationId);

package/dist/src/gateway/hono/routes/capability-operations.d.ts

@@ -0,0 +1,3 @@
+import type { Hono } from 'hono';
+import type { AuthenticatedRouteDeps } from './deps.js';
+export declare function registerCapabilityOperationRoutes(app: Hono, deps: AuthenticatedRouteDeps): void;

package/dist/src/gateway/hono/routes/capability-operations.js

@@ -0,0 +1,52 @@
+import { CapabilityCallSchema } from "../../../../packages/gateway-contract/src/capabilities.js";
+import { init_src } from "../../../../packages/gateway-contract/src/index.js";
+import { CapabilityError } from "../../../capabilities/runtime/errors.js";
+import "../../../capabilities/runtime/dispatcher.js";
+import { createProductDispatcher } from "../../../capabilities/runtime/product.js";
+import { capabilityHttpContext, capabilityHttpError } from "../../../capabilities/adapters/http.js";
+//#region src/gateway/hono/routes/capability-operations.ts
+init_src();
+function registerCapabilityOperationRoutes(app, deps) {
+	const dispatcher = createProductDispatcher(() => deps.service.notesServiceInstance, {
+		getConfig: () => deps.service.currentConfig,
+		getProjects: () => deps.service.projects,
+		getAutomations: () => deps.service.automationServiceInstance,
+		getWorkDiscovery: () => deps.service.workDiscovery,
+		getLocalApps: () => deps.service.localApps,
+		...deps.scenes ? { getSceneAccess: () => ({
+			services: deps.scenes,
+			principal: {
+				ownerId: "local-owner",
+				workspaceId: deps.service.currentWorkspacePath
+			}
+		}) } : {},
+		wake: (runId) => runId ? deps.service.dispatchTaskRuns() : deps.service.dispatchTaskEvents(),
+		abortConversation: async (conversationId) => {
+			const liveRunId = deps.service.getActiveWebchatRunId(conversationId);
+			if (liveRunId) await deps.service.abortAgentRun(liveRunId);
+		}
+	});
+	app.get("/api/capabilities/operations", (c) => c.json({ capabilities: dispatcher.list(capabilityHttpContext(c)) }));
+	app.get("/api/capabilities/operations/:id", (c) => {
+		try {
+			return c.json(dispatcher.describe(c.req.param("id"), capabilityHttpContext(c)));
+		} catch (error) {
+			return capabilityHttpError(c, error);
+		}
+	});
+	app.post("/api/capabilities/operations/:id/invocations", deps.strictRateLimitMiddleware, async (c) => {
+		try {
+			const parsed = CapabilityCallSchema.safeParse(await c.req.json().catch(() => null));
+			if (!parsed.success) throw new CapabilityError("INVALID_INPUT", "Invalid capability request");
+			const result = await dispatcher.call(c.req.param("id"), parsed.data.input, capabilityHttpContext(c), parsed.data);
+			return c.json({
+				status: "succeeded",
+				data: result
+			});
+		} catch (error) {
+			return capabilityHttpError(c, error);
+		}
+	});
+}
+//#endregion
+export { registerCapabilityOperationRoutes };

package/dist/src/gateway/hono/routes/commands-skills.js

@@ -1,11 +1,11 @@
-import { commandRegistry } from "../../../chat-commands/registry.js";
 import { effectiveWorkspacePathForSession } from "../../../session/session-workspace.js";
 import { getProjectForSession } from "../../../projects/workspace.js";
-import { buildReviewContext, resolveGitRoot } from "../../../review/review-git.js";
-import "../../../chat-commands/index.js";
 import { isRegisteredProvider } from "../../../agent/skills/marketplace/registry.js";
 import "../../../agent/skills/skills-marketplace.js";
 import { isSkillInstallTarget } from "../../../agent/skills/install-target.js";
+import { commandRegistry } from "../../../chat-commands/registry.js";
+import { buildReviewContext, resolveGitRoot } from "../../../review/review-git.js";
+import "../../../chat-commands/index.js";
 //#region src/gateway/hono/routes/commands-skills.ts
 function parseMarketplaceProviderQuery(raw) {
 	const v = raw?.trim().toLowerCase();

package/dist/src/gateway/hono/routes/config-patch/gateway.js

@@ -1,8 +1,8 @@
 import { init_public_url, validatePublicUrl } from "../../../../config/public-url.js";
 import { isValidIPv4 } from "../../../../config/gateway-bind.js";
-import { isMaskedSecretPatchValue } from "../../lib/mask-secret-length.js";
 import { mergeShareConfigPatch } from "../../../../share/share-config.js";
 import { mergeSiteShareConfigPatch } from "../../../../share/site-share-config.js";
+import { isMaskedSecretPatchValue } from "../../lib/mask-secret-length.js";
 import { PATCH_OK, patchError } from "./result.js";
 //#region src/gateway/hono/routes/config-patch/gateway.ts
 init_public_url();

package/dist/src/gateway/hono/routes/config-patch/misc.js

@@ -2,8 +2,8 @@ import { ComputerConfigSchema, init_config } from "../../../../computer/config.j
 import { ContextPlanningConfigSchema, KnowledgeMemoryConfigSchema, UserContextConfigSchema, UserModelConfigSchema, init_config as init_config$1 } from "../../../../user-context/config.js";
 import { BindingsConfigSchema, BrowserConfigSchema, McpConfigSchema, VoiceConfigSchema, init_schema } from "../../../../config/schema.js";
 import { CredentialResolver, init_credentials } from "../../../../auth/credentials.js";
-import { setTuiDefaultAgentConfig } from "../../../../commands/agents.config.js";
 import { canonicalizeConfiguredMcpServer } from "../../../../config/mcp-config-normalize.js";
+import { setTuiDefaultAgentConfig } from "../../../../commands/agents.config.js";
 import { mergeGatewaySkillsMarketplacePatch, mergeSessionConfigPatch, mergeUpdateConfigPatch } from "../../../../config/web-patch.js";
 import { assertGatewayAuthConfigured, resolveGatewayAuth } from "../../../auth.js";
 import { isMaskedSecretPatchValue } from "../../lib/mask-secret-length.js";

package/dist/src/gateway/hono/routes/devices.js

@@ -180,10 +180,6 @@ function registerDeviceRoutes(authenticated, deps) {
 			}
 		}, 201);
 	});
-	authenticated.get("/api/devices", (c) => c.json({
-		ok: true,
-		devices: listDevices()
-	}));
 	authenticated.get("/api/devices/me", (c) => {
 		const principal = getGatewayPrincipal(c);
 		if (principal.kind !== "device" || !principal.deviceId) return c.json({
@@ -224,18 +220,6 @@ function registerDeviceRoutes(authenticated, deps) {
 			revoked
 		});
 	});
-	authenticated.delete("/api/devices/:deviceId", (c) => {
-		const deviceId = c.req.param("deviceId");
-		const revoked = revokeDevice(deviceId);
-		if (revoked) {
-			deps.service.realtime.disconnectPrincipal(deviceId);
-			deps.service.voiceRealtime.disconnectPrincipal(deviceId);
-		}
-		return c.json({
-			ok: true,
-			revoked
-		});
-	});
 }
 //#endregion
 export { registerDeviceAuthPublicRoutes, registerDeviceRoutes };

package/dist/src/gateway/hono/routes/endpoint-tools.js

@@ -1,9 +1,9 @@
 import { createLogger } from "../../../utils/logger/index.js";
 import { init_logger } from "../../../utils/logger.js";
-import { getDevice } from "../../../storage/sqlite/device-access-repository.js";
+import { getDevice, listDevices, revokeDevice } from "../../../storage/sqlite/device-access-repository.js";
 import { endpointPrincipalRegistrationSchema, endpointSessionBindingRequestSchema, init_src } from "../../../../packages/endpoint-tools-protocol/src/index.js";
 import { createEndpointPrincipal, getEndpointPrincipal, listEndpointPrincipals, revokeEndpointPrincipal } from "../../../storage/sqlite/endpoint-principal-repository.js";
-import { listEndpointToolInvocationAudits } from "../../../storage/sqlite/endpoint-tool-invocation-repository.js";
+import { listEndpointToolInvocationAuditPage } from "../../../storage/sqlite/endpoint-tool-invocation-repository.js";
 import "../../../storage/sqlite/index.js";
 import { parseEndpointPublicKey } from "../../../endpoint-tools/auth.js";
 import { ENDPOINT_UPLOAD_MAX_BYTES, EndpointUploadError } from "../../../endpoint-tools/upload-service.js";
@@ -42,19 +42,75 @@ async function readBoundedBody(body, maxBytes) {
 	}
 }
 function registerEndpointToolRoutes(authenticated, deps) {
-	authenticated.get("/api/endpoint-tools/principals", (c) => {
+	authenticated.get("/api/endpoint-tools/devices", (c) => {
 		const endpointsByPrincipal = /* @__PURE__ */ new Map();
 		for (const endpoint of deps.service.endpointTools.registry.list()) {
 			const endpoints = endpointsByPrincipal.get(endpoint.principalId) ?? [];
 			endpoints.push(endpoint);
 			endpointsByPrincipal.set(endpoint.principalId, endpoints);
 		}
+		const devicesById = new Map(listDevices().map((device) => [device.id, device]));
+		const principalsById = new Map(listEndpointPrincipals().map((principal) => [principal.id, principal]));
+		const devices = [...new Set([...devicesById.keys(), ...principalsById.keys()])].map((id) => {
+			const access = devicesById.get(id);
+			const principal = principalsById.get(id);
+			const lastSeenAt = Math.max(access?.lastSeenAt ?? 0, principal?.lastSeenAt ?? 0) || void 0;
+			return {
+				id,
+				displayName: principal?.displayName ?? access?.displayName ?? id,
+				kind: principal?.kind ?? (access?.platform === "chrome" ? "browser" : "mobile"),
+				platform: principal?.platform ?? access?.platform ?? "unknown",
+				createdAt: Math.min(access?.createdAt ?? Number.POSITIVE_INFINITY, principal?.createdAt ?? Number.POSITIVE_INFINITY),
+				...lastSeenAt ? { lastSeenAt } : {},
+				access: access ? {
+					scopes: access.scopes,
+					createdAt: access.createdAt,
+					...access.lastSeenAt ? { lastSeenAt: access.lastSeenAt } : {},
+					...access.revokedAt ? { revokedAt: access.revokedAt } : {}
+				} : null,
+				principal: principal ? {
+					createdAt: principal.createdAt,
+					...principal.lastSeenAt ? { lastSeenAt: principal.lastSeenAt } : {},
+					...principal.revokedAt ? { revokedAt: principal.revokedAt } : {}
+				} : null,
+				endpoints: endpointsByPrincipal.get(id) ?? []
+			};
+		}).sort((left, right) => (right.lastSeenAt ?? right.createdAt) - (left.lastSeenAt ?? left.createdAt));
 		return c.json({
 			ok: true,
-			payload: listEndpointPrincipals().map(({ publicKey: _publicKey, ...principal }) => ({
-				...principal,
-				endpoints: endpointsByPrincipal.get(principal.id) ?? []
-			}))
+			payload: devices
+		});
+	});
+	authenticated.post("/api/endpoint-tools/devices/revoke", async (c) => {
+		const body = await c.req.json().catch(() => null);
+		if (!Array.isArray(body?.ids) || body.ids.length === 0 || body.ids.length > 100 || body.ids.some((id) => typeof id !== "string" || !id.trim())) return c.json({
+			ok: false,
+			error: {
+				code: "BAD_REQUEST",
+				message: "Expected 1 to 100 device ids"
+			}
+		}, 400);
+		const results = [...new Set(body.ids.map((id) => id.trim()))].map((id) => {
+			const access = getDevice(id);
+			const principal = getEndpointPrincipal(id);
+			const accessRevoked = Boolean(access && access.revokedAt === void 0 && revokeDevice(id));
+			const principalRevoked = Boolean(principal && principal.revokedAt === void 0 && revokeEndpointPrincipal(id));
+			if (accessRevoked) {
+				deps.service.realtime.disconnectPrincipal(id);
+				deps.service.voiceRealtime.disconnectPrincipal(id);
+			}
+			if (principalRevoked) {
+				for (const endpoint of deps.service.endpointTools.registry.list()) if (endpoint.principalId === id) deps.service.endpointTools.disconnect(endpoint.endpointId, "Device revoked");
+			}
+			return {
+				id,
+				found: Boolean(access || principal),
+				revoked: accessRevoked || principalRevoked
+			};
+		});
+		return c.json({
+			ok: true,
+			payload: { results }
 		});
 	});
 	authenticated.post("/api/endpoint-tools/principals", async (c) => {
@@ -123,36 +179,36 @@ function registerEndpointToolRoutes(authenticated, deps) {
 			payload: principal
 		}, 201);
 	});
-	authenticated.delete("/api/endpoint-tools/principals/:principalId", (c) => {
-		const principalId = c.req.param("principalId").trim();
-		if (!principalId) return c.json({
+	authenticated.get("/api/endpoint-tools/invocations", (c) => {
+		const page = Number(c.req.query("page") ?? 1);
+		const pageSize = Number(c.req.query("pageSize") ?? 20);
+		const status = c.req.query("status");
+		const effect = c.req.query("effect");
+		if (!Number.isInteger(page) || page < 1 || !Number.isInteger(pageSize) || pageSize < 1 || pageSize > 100 || status && ![
+			"running",
+			"succeeded",
+			"failed"
+		].includes(status) || effect && ![
+			"read",
+			"write",
+			"destructive"
+		].includes(effect)) return c.json({
 			ok: false,
 			error: {
 				code: "BAD_REQUEST",
-				message: "Missing principal id"
+				message: "Invalid invocation filters"
 			}
 		}, 400);
-		if (!revokeEndpointPrincipal(principalId)) return c.json({
-			ok: false,
-			error: {
-				code: "NOT_FOUND",
-				message: "Endpoint principal not found"
-			}
-		}, 404);
-		for (const endpoint of deps.service.endpointTools.registry.list()) if (endpoint.principalId === principalId) deps.service.endpointTools.disconnect(endpoint.endpointId, "Endpoint principal revoked");
-		return c.json({
-			ok: true,
-			payload: {
-				principalId,
-				revoked: true
-			}
-		});
-	});
-	authenticated.get("/api/endpoint-tools/invocations", (c) => {
-		const limit = Number(c.req.query("limit") ?? 100);
 		return c.json({
 			ok: true,
-			payload: listEndpointToolInvocationAudits(Number.isFinite(limit) ? limit : 100)
+			payload: listEndpointToolInvocationAuditPage({
+				page,
+				pageSize,
+				query: c.req.query("query"),
+				principalId: c.req.query("principalId"),
+				status,
+				effect
+			})
 		});
 	});
 	authenticated.get("/api/endpoint-tools/bindings/:conversationId", (c) => {

package/dist/src/gateway/hono/routes/home.js

@@ -1,9 +1,9 @@
 import { acknowledgeHomeAttention } from "../../../storage/sqlite/home-attention-repository.js";
 import { decideConnectorApproval } from "../../../storage/sqlite/connector-repository.js";
 import "../../../storage/sqlite/index.js";
-import { resumeApprovedConnectorAction } from "../../../connectors/approval-resume.js";
 import { listGatewayAgents } from "../../agents-admin.js";
 import { HomeQueryService, buildHomeWorkbench, decisionFromTask } from "../../../tasks/home-query-service.js";
+import { resumeApprovedConnectorAction } from "../../../connectors/approval-resume.js";
 //#region src/gateway/hono/routes/home.ts
 /** Register the unified work-home read model and its decision actions. */
 function registerHomeRoutes(authenticated, deps) {

package/dist/src/gateway/hono/routes/imports.js

@@ -1,10 +1,10 @@
+import { getGatewayPrincipal } from "../../security/gateway-principal.js";
 import { ImportError } from "../../../imports/types.js";
 import { isImportSource } from "../../../imports/sources.js";
 import { ImportSelectionRepository } from "../../../storage/sqlite/import-selection-repository.js";
 import { getLiveInventory, previewInventoryItem, publicInventory, scanProduct } from "../../../imports/inventory.js";
 import { importSelection, listImportSources } from "../../../imports/productImport.js";
 import { createRuntimeImportService } from "../../../imports/runtime.js";
-import { getGatewayPrincipal } from "../../security/gateway-principal.js";
 import { z } from "zod";
 //#region src/gateway/hono/routes/imports.ts
 const selectionSchema = z.object({

package/dist/src/gateway/hono/routes/lazy-bundles.js

@@ -3,6 +3,22 @@ function startsWithAny(path, prefixes) {
 	return prefixes.some((prefix) => path === prefix || path.startsWith(`${prefix}/`));
 }
 const AUTHENTICATED_LAZY_ROUTE_BUNDLES = [
+	{
+		id: "local-app-capabilities",
+		match: (path) => /^\/api\/local-app-capabilities\/[^/]+(?:\/[^/]+\/invocations)?$/.test(path),
+		load: async () => {
+			const { registerLocalAppCapabilityRoutes } = await import("./local-app-capabilities.js");
+			return { register: registerLocalAppCapabilityRoutes };
+		}
+	},
+	{
+		id: "capability-operations",
+		match: (path) => startsWithAny(path, ["/api/capabilities/operations"]),
+		load: async () => {
+			const { registerCapabilityOperationRoutes } = await import("./capability-operations.js");
+			return { register: registerCapabilityOperationRoutes };
+		}
+	},
 	{
 		id: "endpoint-compatibility",
 		match: (path) => path === "/api/endpoint-tools/compatibility",

package/dist/src/gateway/hono/routes/local-app-capabilities.d.ts

@@ -0,0 +1,4 @@
+import type { Hono } from 'hono';
+import type { AuthenticatedRouteDeps } from './deps.js';
+/** Authenticated host API. Iframes must not receive Gateway credentials. */
+export declare function registerLocalAppCapabilityRoutes(app: Hono, deps: AuthenticatedRouteDeps): void;

package/dist/src/gateway/hono/routes/local-app-capabilities.js

@@ -0,0 +1,41 @@
+import { CapabilityCallSchema } from "../../../../packages/gateway-contract/src/capabilities.js";
+import { init_src } from "../../../../packages/gateway-contract/src/index.js";
+import { CapabilityError } from "../../../capabilities/runtime/errors.js";
+import { createProductDispatcher } from "../../../capabilities/runtime/product.js";
+import { localAppCapabilities } from "../../../local-apps/capabilities/runtime.js";
+import { capabilityHttpContext, capabilityHttpError } from "../../../capabilities/adapters/http.js";
+import { z } from "zod";
+//#region src/gateway/hono/routes/local-app-capabilities.ts
+init_src();
+const Digest = z.string().regex(/^[a-f0-9]{64}$/);
+const Invocation = z.strictObject({
+	manifestDigest: Digest,
+	call: CapabilityCallSchema
+});
+/** Authenticated host API. Iframes must not receive Gateway credentials. */
+function registerLocalAppCapabilityRoutes(app, deps) {
+	const dispatcher = createProductDispatcher(() => deps.service.notesServiceInstance, { getProjects: () => deps.service.projects });
+	const path = "/api/local-app-capabilities/:extensionId";
+	app.get(path, (c) => {
+		try {
+			const digest = Digest.parse(c.req.query("manifestDigest"));
+			return c.json(localAppCapabilities(deps.service.localApps, dispatcher, c.req.param("extensionId"), digest, capabilityHttpContext(c)).list());
+		} catch (error) {
+			return capabilityHttpError(c, error instanceof z.ZodError ? new CapabilityError("INVALID_INPUT", "Invalid manifest digest") : error);
+		}
+	});
+	app.post(`${path}/:id/invocations`, deps.strictRateLimitMiddleware, async (c) => {
+		try {
+			const parsed = Invocation.safeParse(await c.req.json().catch(() => null));
+			if (!parsed.success) throw new CapabilityError("INVALID_INPUT", "Invalid local app invocation");
+			const { manifestDigest, call } = parsed.data;
+			const extensionId = c.req.param("extensionId");
+			const id = c.req.param("id");
+			return c.json(await localAppCapabilities(deps.service.localApps, dispatcher, extensionId, manifestDigest, capabilityHttpContext(c)).call(id, call));
+		} catch (error) {
+			return capabilityHttpError(c, error);
+		}
+	});
+}
+//#endregion
+export { registerLocalAppCapabilityRoutes };