@xopcai/xopc 0.0.314 → 0.0.315

package/dist/src/gateway/hono/routes/endpoint-tools.js

@@ -1,9 +1,9 @@
 import { createLogger } from "../../../utils/logger/index.js";
 import { init_logger } from "../../../utils/logger.js";
-import { getDevice } from "../../../storage/sqlite/device-access-repository.js";
+import { getDevice, listDevices, revokeDevice } from "../../../storage/sqlite/device-access-repository.js";
 import { endpointPrincipalRegistrationSchema, endpointSessionBindingRequestSchema, init_src } from "../../../../packages/endpoint-tools-protocol/src/index.js";
 import { createEndpointPrincipal, getEndpointPrincipal, listEndpointPrincipals, revokeEndpointPrincipal } from "../../../storage/sqlite/endpoint-principal-repository.js";
-import { listEndpointToolInvocationAudits } from "../../../storage/sqlite/endpoint-tool-invocation-repository.js";
+import { listEndpointToolInvocationAuditPage } from "../../../storage/sqlite/endpoint-tool-invocation-repository.js";
 import "../../../storage/sqlite/index.js";
 import { parseEndpointPublicKey } from "../../../endpoint-tools/auth.js";
 import { ENDPOINT_UPLOAD_MAX_BYTES, EndpointUploadError } from "../../../endpoint-tools/upload-service.js";
@@ -42,19 +42,75 @@ async function readBoundedBody(body, maxBytes) {
 	}
 }
 function registerEndpointToolRoutes(authenticated, deps) {
-	authenticated.get("/api/endpoint-tools/principals", (c) => {
+	authenticated.get("/api/endpoint-tools/devices", (c) => {
 		const endpointsByPrincipal = /* @__PURE__ */ new Map();
 		for (const endpoint of deps.service.endpointTools.registry.list()) {
 			const endpoints = endpointsByPrincipal.get(endpoint.principalId) ?? [];
 			endpoints.push(endpoint);
 			endpointsByPrincipal.set(endpoint.principalId, endpoints);
 		}
+		const devicesById = new Map(listDevices().map((device) => [device.id, device]));
+		const principalsById = new Map(listEndpointPrincipals().map((principal) => [principal.id, principal]));
+		const devices = [...new Set([...devicesById.keys(), ...principalsById.keys()])].map((id) => {
+			const access = devicesById.get(id);
+			const principal = principalsById.get(id);
+			const lastSeenAt = Math.max(access?.lastSeenAt ?? 0, principal?.lastSeenAt ?? 0) || void 0;
+			return {
+				id,
+				displayName: principal?.displayName ?? access?.displayName ?? id,
+				kind: principal?.kind ?? (access?.platform === "chrome" ? "browser" : "mobile"),
+				platform: principal?.platform ?? access?.platform ?? "unknown",
+				createdAt: Math.min(access?.createdAt ?? Number.POSITIVE_INFINITY, principal?.createdAt ?? Number.POSITIVE_INFINITY),
+				...lastSeenAt ? { lastSeenAt } : {},
+				access: access ? {
+					scopes: access.scopes,
+					createdAt: access.createdAt,
+					...access.lastSeenAt ? { lastSeenAt: access.lastSeenAt } : {},
+					...access.revokedAt ? { revokedAt: access.revokedAt } : {}
+				} : null,
+				principal: principal ? {
+					createdAt: principal.createdAt,
+					...principal.lastSeenAt ? { lastSeenAt: principal.lastSeenAt } : {},
+					...principal.revokedAt ? { revokedAt: principal.revokedAt } : {}
+				} : null,
+				endpoints: endpointsByPrincipal.get(id) ?? []
+			};
+		}).sort((left, right) => (right.lastSeenAt ?? right.createdAt) - (left.lastSeenAt ?? left.createdAt));
 		return c.json({
 			ok: true,
-			payload: listEndpointPrincipals().map(({ publicKey: _publicKey, ...principal }) => ({
-				...principal,
-				endpoints: endpointsByPrincipal.get(principal.id) ?? []
-			}))
+			payload: devices
+		});
+	});
+	authenticated.post("/api/endpoint-tools/devices/revoke", async (c) => {
+		const body = await c.req.json().catch(() => null);
+		if (!Array.isArray(body?.ids) || body.ids.length === 0 || body.ids.length > 100 || body.ids.some((id) => typeof id !== "string" || !id.trim())) return c.json({
+			ok: false,
+			error: {
+				code: "BAD_REQUEST",
+				message: "Expected 1 to 100 device ids"
+			}
+		}, 400);
+		const results = [...new Set(body.ids.map((id) => id.trim()))].map((id) => {
+			const access = getDevice(id);
+			const principal = getEndpointPrincipal(id);
+			const accessRevoked = Boolean(access && access.revokedAt === void 0 && revokeDevice(id));
+			const principalRevoked = Boolean(principal && principal.revokedAt === void 0 && revokeEndpointPrincipal(id));
+			if (accessRevoked) {
+				deps.service.realtime.disconnectPrincipal(id);
+				deps.service.voiceRealtime.disconnectPrincipal(id);
+			}
+			if (principalRevoked) {
+				for (const endpoint of deps.service.endpointTools.registry.list()) if (endpoint.principalId === id) deps.service.endpointTools.disconnect(endpoint.endpointId, "Device revoked");
+			}
+			return {
+				id,
+				found: Boolean(access || principal),
+				revoked: accessRevoked || principalRevoked
+			};
+		});
+		return c.json({
+			ok: true,
+			payload: { results }
 		});
 	});
 	authenticated.post("/api/endpoint-tools/principals", async (c) => {
@@ -123,36 +179,36 @@ function registerEndpointToolRoutes(authenticated, deps) {
 			payload: principal
 		}, 201);
 	});
-	authenticated.delete("/api/endpoint-tools/principals/:principalId", (c) => {
-		const principalId = c.req.param("principalId").trim();
-		if (!principalId) return c.json({
+	authenticated.get("/api/endpoint-tools/invocations", (c) => {
+		const page = Number(c.req.query("page") ?? 1);
+		const pageSize = Number(c.req.query("pageSize") ?? 20);
+		const status = c.req.query("status");
+		const effect = c.req.query("effect");
+		if (!Number.isInteger(page) || page < 1 || !Number.isInteger(pageSize) || pageSize < 1 || pageSize > 100 || status && ![
+			"running",
+			"succeeded",
+			"failed"
+		].includes(status) || effect && ![
+			"read",
+			"write",
+			"destructive"
+		].includes(effect)) return c.json({
 			ok: false,
 			error: {
 				code: "BAD_REQUEST",
-				message: "Missing principal id"
+				message: "Invalid invocation filters"
 			}
 		}, 400);
-		if (!revokeEndpointPrincipal(principalId)) return c.json({
-			ok: false,
-			error: {
-				code: "NOT_FOUND",
-				message: "Endpoint principal not found"
-			}
-		}, 404);
-		for (const endpoint of deps.service.endpointTools.registry.list()) if (endpoint.principalId === principalId) deps.service.endpointTools.disconnect(endpoint.endpointId, "Endpoint principal revoked");
-		return c.json({
-			ok: true,
-			payload: {
-				principalId,
-				revoked: true
-			}
-		});
-	});
-	authenticated.get("/api/endpoint-tools/invocations", (c) => {
-		const limit = Number(c.req.query("limit") ?? 100);
 		return c.json({
 			ok: true,
-			payload: listEndpointToolInvocationAudits(Number.isFinite(limit) ? limit : 100)
+			payload: listEndpointToolInvocationAuditPage({
+				page,
+				pageSize,
+				query: c.req.query("query"),
+				principalId: c.req.query("principalId"),
+				status,
+				effect
+			})
 		});
 	});
 	authenticated.get("/api/endpoint-tools/bindings/:conversationId", (c) => {

package/dist/src/gateway/hono/routes/mcp.js

@@ -3,7 +3,7 @@ import { canonicalizeConfiguredMcpServer, normalizeConfiguredMcpServers } from "
 import { loadMergedBundleMcpConfig } from "../../../agent/mcp/bundle-mcp-config.js";
 import { getWorkspacePath } from "../../../config/workspace-path-helpers.js";
 import { getMcpOAuthManager } from "../../../agent/mcp/oauth/mcp-oauth-manager.js";
-import { listBundleMcpServerCapabilitiesForGateway, listBundleMcpServerToolsForGateway } from "../../../agent/mcp/bundle-mcp-gateway.js";
+import { listBundleMcpResourcesForGateway, listBundleMcpServerCapabilitiesForGateway, listBundleMcpServerToolsForGateway } from "../../../agent/mcp/bundle-mcp-gateway.js";
 //#region src/gateway/hono/routes/mcp.ts
 function registerMcpRoutes(authenticated, deps) {
 	const resolveServer = (id) => {
@@ -36,6 +36,37 @@ function registerMcpRoutes(authenticated, deps) {
 			}
 		});
 	});
+	authenticated.get("/api/mcp/resources", async (c) => {
+		const cfg = deps.service.currentConfig;
+		const workspaceDir = getWorkspacePath(cfg) || "./workspace";
+		const query = (c.req.query("q") ?? "").trim().toLocaleLowerCase();
+		const serverId = (c.req.query("serverId") ?? "").trim();
+		try {
+			const items = (await listBundleMcpResourcesForGateway({
+				workspaceDir,
+				cfg
+			})).filter((resource) => {
+				if (serverId && resource.serverId !== serverId) return false;
+				if (!query) return true;
+				return [
+					resource.name,
+					resource.title,
+					resource.description,
+					resource.uri,
+					resource.serverId
+				].some((value) => value?.toLocaleLowerCase().includes(query));
+			}).slice(0, 20);
+			return c.json({
+				ok: true,
+				payload: { resources: items }
+			});
+		} catch (err) {
+			return c.json({
+				ok: false,
+				error: err instanceof Error ? err.message : String(err)
+			}, 500);
+		}
+	});
 	authenticated.get("/api/mcp/servers/:id/oauth", async (c) => {
 		const id = c.req.param("id");
 		const server = resolveServer(id);

package/dist/src/gateway/hono/routes/session-input-handler.d.ts

@@ -62,9 +62,10 @@ export declare function submitSessionInput(c: Context, deps: AuthenticatedRouteD
                     url?: string;
                     capturedAt?: number;
                     documentId?: string;
+                    fileKind?: "file" | "directory";
                 }[];
                 contextSnapshots?: {
-                    kind: import("../../../agent/source-context/types.js").SessionSourceBinding["kind"] | "task" | "browser_page" | "app_context";
+                    kind: import("../../../agent/source-context/types.js").SessionSourceBinding["kind"] | "task" | "file" | "session" | "mcp_resource" | "browser_tab" | "browser_page" | "app_context";
                     sourceId: string;
                     version: string;
                     title: string;
@@ -79,6 +80,7 @@ export declare function submitSessionInput(c: Context, deps: AuthenticatedRouteD
                     url?: string;
                     capturedAt?: number;
                     documentId?: string;
+                    fileKind?: "file" | "directory";
                     appContext?: {
                         version: 1;
                         clientInstanceId: string;
@@ -196,9 +198,10 @@ export declare function replaceLatestSessionTurn(c: Context, deps: Authenticated
                     url?: string;
                     capturedAt?: number;
                     documentId?: string;
+                    fileKind?: "file" | "directory";
                 }[];
                 contextSnapshots?: {
-                    kind: import("../../../agent/source-context/types.js").SessionSourceBinding["kind"] | "task" | "browser_page" | "app_context";
+                    kind: import("../../../agent/source-context/types.js").SessionSourceBinding["kind"] | "task" | "file" | "session" | "mcp_resource" | "browser_tab" | "browser_page" | "app_context";
                     sourceId: string;
                     version: string;
                     title: string;
@@ -213,6 +216,7 @@ export declare function replaceLatestSessionTurn(c: Context, deps: Authenticated
                     url?: string;
                     capturedAt?: number;
                     documentId?: string;
+                    fileKind?: "file" | "directory";
                     appContext?: {
                         version: 1;
                         clientInstanceId: string;

package/dist/src/gateway/hono/routes/session-input-handler.js

@@ -39,7 +39,7 @@ async function submitSessionInput(c, deps, conversationId, options) {
 		ok: false,
 		error: {
 			code: "BAD_REQUEST",
-			message: `contextRefs must contain at most ${MAX_TURN_CONTEXTS} valid note or task references`
+			message: `contextRefs must contain at most ${MAX_TURN_CONTEXTS} valid source references`
 		}
 	}, 400);
 	const browserContexts = browserPageContextsInputSchema.safeParse(body.browserContexts ?? []);
@@ -201,7 +201,7 @@ async function submitSessionInput(c, deps, conversationId, options) {
 			ok: false,
 			error: {
 				code: result.code,
-				message: result.code === "CONTEXT_UNAVAILABLE" ? "A referenced Note changed or is no longer available. Select it again." : "Input was not accepted"
+				message: result.code === "CONTEXT_UNAVAILABLE" ? "A referenced source changed or is no longer available. Select it again." : "Input was not accepted"
 			}
 		}, result.code === "SESSION_CHANGED" || result.code === "QUEUE_FULL" || result.code === "CONTEXT_UNAVAILABLE" ? 409 : 400);
 		return c.json({
@@ -235,7 +235,7 @@ async function replaceLatestSessionTurn(c, deps, conversationId, targetTurnId) {
 		ok: false,
 		error: {
 			code: "BAD_REQUEST",
-			message: `contextRefs must contain at most ${MAX_TURN_CONTEXTS} valid note or task references`
+			message: `contextRefs must contain at most ${MAX_TURN_CONTEXTS} valid source references`
 		}
 	}, 400);
 	const content = typeof body.content === "string" ? body.content : "";
@@ -321,7 +321,7 @@ async function replaceLatestSessionTurn(c, deps, conversationId, targetTurnId) {
 		});
 		if (result.ok === false) {
 			const status = result.code === "TARGET_NOT_FOUND" ? 404 : result.code === "BAD_REQUEST" ? 400 : 409;
-			const message = result.code === "NOT_LATEST" ? "Only the latest user turn can be replaced" : result.code === "SESSION_BUSY" ? "Session has pending input" : result.code === "TARGET_NOT_FOUND" ? "User turn was not found" : result.code === "CONTEXT_UNAVAILABLE" ? "A referenced Note changed or is no longer available. Select it again." : "Replacement input was not accepted";
+			const message = result.code === "NOT_LATEST" ? "Only the latest user turn can be replaced" : result.code === "SESSION_BUSY" ? "Session has pending input" : result.code === "TARGET_NOT_FOUND" ? "User turn was not found" : result.code === "CONTEXT_UNAVAILABLE" ? "A referenced source changed or is no longer available. Select it again." : "Replacement input was not accepted";
 			return c.json({
 				ok: false,
 				error: {

package/dist/src/gateway/hono/routes/voice.js

@@ -21,8 +21,8 @@ import { VoiceSessionCreationError, resolveStreamingStt, resolveStreamingTts } f
 import { getGatewayPrincipal } from "../../security/gateway-principal.js";
 import { createGatewayRouteLogger } from "../lib/route-logger.js";
 import { selectPlatformVoice, voiceSettingsCatalog } from "../../../voice/platform-settings.js";
-import { listLocalVoiceModelStatuses, removeLocalVoiceModel, startLocalVoiceModelInstall } from "../../../voice/local/model-manager.js";
 import { listTtsProvidersForApi } from "../../../voice/tts/list-providers.js";
+import { listLocalVoiceModelStatuses, removeLocalVoiceModel, startLocalVoiceModelInstall } from "../../../voice/local/model-manager.js";
 import { z } from "zod";
 //#region src/gateway/hono/routes/voice.ts
 init_voice();

package/dist/src/gateway/service/agent-runner.d.ts

@@ -22,7 +22,7 @@ export interface GatewayAgentRunnerOptions {
     emit: (type: string, payload: unknown) => void;
     publishRealtime: (topic: string, event: string, data: unknown) => void;
     completeRealtimeTopic: (topic: string) => void;
-    resolveTurnContext: (ref: TurnContextRef) => Promise<AgentSourceContext | null>;
+    resolveTurnContext: (ref: TurnContextRef, conversationId: string) => Promise<AgentSourceContext | null>;
 }
 export declare class GatewayAgentRunner {
     private readonly opts;

package/dist/src/gateway/service/agent-runner.js

@@ -76,7 +76,7 @@ var GatewayAgentRunner = class {
 					size: ref.size
 				}));
 			},
-			prepareContexts: async (refs) => {
+			prepareContexts: async (conversationId, refs) => {
 				if (!refs?.length) return void 0;
 				const unique = /* @__PURE__ */ new Map();
 				for (const ref of refs) {
@@ -87,7 +87,7 @@ var GatewayAgentRunner = class {
 					});
 				}
 				if (unique.size > MAX_TURN_CONTEXTS) throw new Error(`A message can reference at most ${MAX_TURN_CONTEXTS} sources`);
-				const contexts = await Promise.all([...unique.values()].map((ref) => opts.resolveTurnContext(ref)));
+				const contexts = await Promise.all([...unique.values()].map((ref) => opts.resolveTurnContext(ref, conversationId)));
 				if (contexts.some((context) => context === null)) throw new Error("A referenced source is unavailable or has changed; select it again");
 				return fitSourceContextsToBudget(contexts.filter((context) => context !== null));
 			},

package/dist/src/gateway/service/app-context-access.d.ts

@@ -2,10 +2,6 @@ import type { AgentSourceContext } from '../../agent/source-context/types.js';
 import { type CapabilityDispatcher } from '../../capabilities/runtime/dispatcher.js';
 import type { ResolvedGatewayAuth } from '../auth.js';
 import type { GatewayPrincipal } from '../security/gateway-principal.js';
-export interface AppContextGrant {
-    principal: GatewayPrincipal;
-    authRevision: string;
-}
 /** A queued read retains its original scope ceiling, but never a revoked identity. */
 export declare function checkAppContextAccess(source: AgentSourceContext, dispatcher: CapabilityDispatcher, auth: ResolvedGatewayAuth): Promise<void>;
 export declare function prepareAppContext(input: unknown, principal: GatewayPrincipal, auth: ResolvedGatewayAuth, dispatcher: CapabilityDispatcher, previous?: AgentSourceContext): Promise<AgentSourceContext>;

package/dist/src/gateway/service/run-gateway-agent.js

@@ -11,9 +11,9 @@ import { resolveExecutionContext } from "../../tasks/execution-context.js";
 import { TaskRunCoordinator } from "../../tasks/task-run-coordinator.js";
 import { formatAgentRunErrorForClient } from "../../agent/client-error-format.js";
 import "../chat-limits.js";
+import { prependEnvelopeTimestamp } from "../../channels/envelope-timestamp.js";
 import { ChatStreamMapper } from "../chat-stream/mapper.js";
 import { markdownNotificationPreview } from "../../notifications/plain-text.js";
-import { prependEnvelopeTimestamp } from "../../channels/envelope-timestamp.js";
 import { resolveWebchatConversationId } from "../resolve-webchat-session-key.js";
 import { recordExplicitRelationshipFollowUp } from "../../user-context/relationship-continuity.js";
 import { coalesceThinkingDeltas } from "../chat-stream/thinking-delta-coalescer.js";

package/dist/src/gateway/service/session-input-coordinator.d.ts

@@ -39,7 +39,7 @@ export declare class SessionInputCoordinator {
             summary: string;
         }>;
         prepareAttachments: (conversationId: string, attachments?: UserTurnAttachment[]) => Promise<UserTurnAttachment[] | undefined>;
-        prepareContexts: (contextRefs?: TurnContextRef[]) => Promise<AgentSourceContext[] | undefined>;
+        prepareContexts: (conversationId: string, contextRefs?: TurnContextRef[]) => Promise<AgentSourceContext[] | undefined>;
         steer: (conversationId: string, content: string) => Promise<boolean>;
         emit: (type: string, payload: unknown) => void;
     });

package/dist/src/gateway/service/session-input-coordinator.js

@@ -109,7 +109,7 @@ var SessionInputCoordinator = class {
 			const attachments = await this.deps.prepareAttachments(conversationId, input.attachments);
 			let sourceContexts;
 			try {
-				sourceContexts = fitSourceContextsToBudget([...await this.deps.prepareContexts(input.contextRefs) ?? [], ...input.sourceContexts ?? []]);
+				sourceContexts = fitSourceContextsToBudget([...await this.deps.prepareContexts(conversationId, input.contextRefs) ?? [], ...input.sourceContexts ?? []]);
 			} catch (err) {
 				log.warn({
 					err,
@@ -185,7 +185,7 @@ var SessionInputCoordinator = class {
 		const attachments = await this.deps.prepareAttachments(conversationId, input.attachments);
 		let sourceContexts;
 		try {
-			sourceContexts = fitSourceContextsToBudget([...await this.deps.prepareContexts(input.contextRefs) ?? [], ...input.sourceContexts ?? []]);
+			sourceContexts = fitSourceContextsToBudget([...await this.deps.prepareContexts(conversationId, input.contextRefs) ?? [], ...input.sourceContexts ?? []]);
 		} catch (err) {
 			log.warn({
 				err,
@@ -310,7 +310,7 @@ var SessionInputCoordinator = class {
 		if (body.contextRefs !== void 0) {
 			const existing = getSessionInputById(conversationId, id);
 			if (!contextRefsMatchFrozenSnapshot(body.contextRefs, existing?.contextRefs)) try {
-				const resolved = await this.deps.prepareContexts(body.contextRefs) ?? [];
+				const resolved = await this.deps.prepareContexts(conversationId, body.contextRefs) ?? [];
 				sourceContexts = fitSourceContextsToBudget([...existing?.contextSnapshots?.filter((source) => source.kind !== "note" && source.kind !== "task") ?? [], ...resolved]);
 			} catch (err) {
 				log.warn({

package/dist/src/gateway/service.js

@@ -7,6 +7,7 @@ import { createLogger } from "../utils/logger/index.js";
 import { init_logger } from "../utils/logger.js";
 import { closeXopcDatabase, openXopcDatabase } from "../storage/sqlite/connection.js";
 import { getSqliteDatabase, init_transaction } from "../storage/sqlite/transaction.js";
+import { getBrowserTabBindingById } from "../storage/sqlite/browser-tab-binding-repository.js";
 import { findSessionInput, init_session_input_repository, insertSessionInput } from "../storage/sqlite/session-input-repository.js";
 import { TaskRepository } from "../tasks/task-repository.js";
 import { TaskRunRepository, init_task_run_repository } from "../tasks/task-run-repository.js";
@@ -37,6 +38,7 @@ import { ProjectService } from "../projects/project-service.js";
 import { resolveProjectAgentId } from "../projects/project-agent.js";
 import "../projects/index.js";
 import { resolveEffectiveGatewayPort } from "./host.js";
+import { RealtimeExtensionBrowserProvider } from "../browser/providers/realtime-extension.js";
 import { onSessionTranscriptUpdate } from "../session/transcript-events.js";
 import { buildNoteAgentContext } from "../notes/agent-context.js";
 import { NotesStore } from "../notes/store.js";
@@ -59,6 +61,9 @@ import "../infra/bus/index.js";
 import { collectMediaUrisFromMessages, deleteMediaUris } from "../media/session-references.js";
 import { AgentService } from "../agent/service.js";
 import { ensureStarterAgentsInitialized } from "../agent/starter-agents.js";
+import { setPairingBroadcastSink } from "../channels/pairing/pairing-events.js";
+import { registerClarificationChannelRuntime } from "./clarify-runtime.js";
+import { ChannelManager } from "../channels/manager.js";
 import { getWorkspacePath } from "../config/workspace-path-helpers.js";
 import "../config/index.js";
 import { ManagedComposioEventPoller } from "../connectors/composio-managed-events.js";
@@ -77,16 +82,18 @@ import { EndpointToolRuntime } from "../endpoint-tools/runtime.js";
 import "../endpoint-tools/index.js";
 import { assertGatewayAuthConfigured, extractToken, resolveGatewayAuth, validateToken } from "./auth.js";
 import { prepareAutomationAgentSession } from "./automation-agent-session.js";
-import { registerClarificationChannelRuntime } from "./clarify-runtime.js";
 import { stopTailscaleExposure } from "./tailscale-lifecycle.js";
+import { getGatewayFileSpaceService } from "./file-space-service.js";
 import { createBackgroundTask } from "../infra/background-task.js";
 import { buildTaskAgentContext } from "../agent/source-context/task-context.js";
+import { buildFileAgentContext } from "../agent/source-context/file-context.js";
+import { buildSessionAgentContext } from "../agent/source-context/session-context.js";
+import { buildMcpResourceAgentContext } from "../agent/source-context/mcp-resource-context.js";
+import { buildBrowserTabAgentContext } from "../agent/source-context/browser-tab.js";
 import { WorkDiscoveryService } from "../work-discovery/service.js";
 import { buildVoiceMemoryContext } from "../voice/realtime/memory-context.js";
 import { buildVoicePersonaContext } from "../voice/realtime/persona-context.js";
 import { voiceMemoryBudget, voicePersonaBudget } from "../voice/realtime/conversation-context.js";
-import { setPairingBroadcastSink } from "../channels/pairing/pairing-events.js";
-import { ChannelManager } from "../channels/manager.js";
 import "../notes/index.js";
 import { buildWorkflowChildTools } from "../agent/workflow/workflow-child-tools.js";
 import { WorkflowRunService } from "../workflows/service/workflow-run-service.js";
@@ -470,9 +477,39 @@ var GatewayService = class {
 			getAgentService: () => this.ensureAgentService(),
 			getChannelManager: () => this.channelManager,
 			getConfig: () => this.config,
-			resolveTurnContext: async (ref) => {
+			resolveTurnContext: async (ref, conversationId) => {
 				if (ref.kind === "task") return buildTaskAgentContext(new TaskRepository().get(ref.sourceId), ref.expectedVersion);
-				if (ref.kind !== "note") return null;
+				if (ref.kind === "file") {
+					const files = getGatewayFileSpaceService(this);
+					const space = await files.forContext("session", conversationId).catch(() => null);
+					if (!space) return null;
+					return buildFileAgentContext(files, ref.sourceId, ref.expectedVersion, space.id);
+				}
+				if (ref.kind === "session") {
+					const [metadata, messages] = await Promise.all([this.sessionIndex.getSessionMetadata(ref.sourceId), this.sessionIndex.getStore().loadMessages(ref.sourceId)]);
+					return buildSessionAgentContext(metadata, messages, ref.expectedVersion);
+				}
+				if (ref.kind === "mcp_resource") return buildMcpResourceAgentContext({
+					workspaceDir: this.currentWorkspacePath,
+					config: this.config,
+					sourceId: ref.sourceId,
+					expectedVersion: ref.expectedVersion
+				});
+				if (ref.kind === "browser_tab") {
+					const binding = getBrowserTabBindingById(ref.sourceId);
+					if (!binding || binding.conversationId !== conversationId || ref.expectedVersion && ref.expectedVersion !== binding.documentId) return null;
+					const wire = await new RealtimeExtensionBrowserProvider(this.endpointTools).send({
+						action: "observe",
+						sessionId: `context:${binding.conversationId}`,
+						target: {
+							kind: "attached_tab",
+							bindingId: binding.id
+						},
+						visual: "never"
+					}).catch(() => null);
+					if (!wire?.result.ok || !wire.result.receipt.observation) return null;
+					return buildBrowserTabAgentContext(ref.sourceId, wire.result.receipt.observation, ref.expectedVersion);
+				}
 				const note = await this.notesService.getNote(ref.sourceId);
 				if (!note || note.status === "trashed") return null;
 				if (ref.expectedVersion && ref.expectedVersion !== String(note.updatedAt)) return null;

package/dist/src/gateway/workspace-file-search.js

@@ -35,13 +35,29 @@ async function fuzzySearchWorkspaceFiles(workspaceRoot, query, limit) {
 	}
 	const q = query.trim();
 	const capped = Math.min(Math.max(limit, 1), 50);
+	const directories = /* @__PURE__ */ new Set();
+	for (const file of files) {
+		const parts = file.split("/");
+		for (let end = 1; end < parts.length; end += 1) {
+			const directory = parts.slice(0, end).join("/");
+			if (directory) directories.add(directory);
+		}
+	}
+	const candidates = [...directories].map((path) => ({
+		name: basename(path),
+		path,
+		isDirectory: true
+	}));
+	candidates.push(...files.map((path) => ({
+		name: basename(path),
+		path,
+		isDirectory: false
+	})));
 	const rows = [];
 	if (!q) {
-		const sorted = [...files].sort((a, b) => a.localeCompare(b));
-		for (const rel of sorted.slice(0, capped)) rows.push({
-			name: basename(rel),
-			path: rel,
-			isDirectory: false,
+		const sorted = candidates.sort((a, b) => a.path.localeCompare(b.path));
+		for (const candidate of sorted.slice(0, capped)) rows.push({
+			...candidate,
 			score: 0
 		});
 		return rows.map(({ name, path, isDirectory }) => ({
@@ -50,16 +66,13 @@ async function fuzzySearchWorkspaceFiles(workspaceRoot, query, limit) {
 			isDirectory
 		}));
 	}
-	for (const rel of files) {
-		const name = basename(rel);
-		const scorePath = fuzzySubsequenceScore(q, rel);
-		const scoreName = fuzzySubsequenceScore(q, name);
+	for (const candidate of candidates) {
+		const scorePath = fuzzySubsequenceScore(q, candidate.path);
+		const scoreName = fuzzySubsequenceScore(q, candidate.name);
 		const score = Math.max(scorePath ?? -Infinity, scoreName ?? -Infinity);
 		if (score === -Infinity) continue;
 		rows.push({
-			name,
-			path: rel,
-			isDirectory: false,
+			...candidate,
 			score
 		});
 	}

package/dist/src/platform/client.d.ts

@@ -66,10 +66,10 @@ export declare const RuntimeCommandSchema: z.ZodObject<{
                     read: "read";
                     write: "write";
                     execute: "execute";
+                    admin: "admin";
                     send: "send";
                     purchase: "purchase";
                     publish: "publish";
-                    admin: "admin";
                 }>>;
             }, z.core.$strict>;
             data: z.ZodObject<{

package/dist/src/platform/contracts.d.ts

@@ -152,10 +152,10 @@ export declare const AgentManifestSchema: z.ZodObject<{
             read: "read";
             write: "write";
             execute: "execute";
+            admin: "admin";
             send: "send";
             purchase: "purchase";
             publish: "publish";
-            admin: "admin";
         }>>;
     }, z.core.$strict>;
     data: z.ZodObject<{

package/dist/src/session/client-history.d.ts

@@ -15,7 +15,7 @@ export interface ClientHistoryMessage {
     /** Whitelisted display metadata; never includes source snapshot text. */
     metadata?: {
         sourceContexts?: Array<{
-            kind: 'note' | 'task' | 'browser_page';
+            kind: 'note' | 'task' | 'file' | 'session' | 'browser_tab' | 'browser_page' | 'mcp_resource';
             sourceId: string;
             version: string;
             title: string;
@@ -24,6 +24,7 @@ export interface ClientHistoryMessage {
             url?: string;
             capturedAt?: number;
             documentId?: string;
+            fileKind?: 'file' | 'directory';
         }>;
         turnOutcome?: TurnOutcome;
     };

package/dist/src/session/client-history.js

@@ -11,7 +11,7 @@ function sourceContextDisplayMetadata(metadata) {
 	const sourceContexts = rows.flatMap((value) => {
 		if (!value || typeof value !== "object" || Array.isArray(value)) return [];
 		const row = value;
-		if (row.kind !== "note" && row.kind !== "task" && row.kind !== "browser_page" || typeof row.sourceId !== "string" || typeof row.version !== "string" || typeof row.title !== "string") return [];
+		if (row.kind !== "note" && row.kind !== "task" && row.kind !== "file" && row.kind !== "session" && row.kind !== "browser_tab" && row.kind !== "browser_page" && row.kind !== "mcp_resource" || typeof row.sourceId !== "string" || typeof row.version !== "string" || typeof row.title !== "string") return [];
 		return [{
 			kind: row.kind,
 			sourceId: row.sourceId,
@@ -21,7 +21,8 @@ function sourceContextDisplayMetadata(metadata) {
 			...row.truncated === true ? { truncated: true } : {},
 			...typeof row.url === "string" ? { url: row.url } : {},
 			...typeof row.capturedAt === "number" ? { capturedAt: row.capturedAt } : {},
-			...typeof row.documentId === "string" ? { documentId: row.documentId } : {}
+			...typeof row.documentId === "string" ? { documentId: row.documentId } : {},
+			...row.kind === "file" && (row.fileKind === "file" || row.fileKind === "directory") ? { fileKind: row.fileKind } : {}
 		}];
 	});
 	return sourceContexts.length ? { sourceContexts } : void 0;

package/dist/src/storage/sqlite/endpoint-tool-invocation-repository.d.ts

@@ -22,4 +22,18 @@ export declare function finishEndpointToolInvocationAudit(params: {
     errorMessage?: string;
     completedAt?: number;
 }): void;
-export declare function listEndpointToolInvocationAudits(limit?: number): EndpointToolInvocationAudit[];
+export interface EndpointToolInvocationAuditPage {
+    items: EndpointToolInvocationAudit[];
+    page: number;
+    pageSize: number;
+    total: number;
+    totalPages: number;
+}
+export declare function listEndpointToolInvocationAuditPage(options?: {
+    page?: number;
+    pageSize?: number;
+    query?: string;
+    principalId?: string;
+    status?: EndpointToolInvocationAudit['status'];
+    effect?: EndpointEffect;
+}): EndpointToolInvocationAuditPage;