@xopcai/xopc 0.0.321 → 0.0.323

package/dist/browser-ext/dist/assets/{auth-DKo-NMUY.js → auth-DocRzRlS.js}

@@ -6116,12 +6116,15 @@ async function clearBrowserChatState() {
 
 const PROFILE_KEY = "xopc.browser.profile";
 const PAIRING_JOURNAL_KEY = "xopc.browser.pairing";
+const REFRESH_JOURNAL_KEY = "xopc.browser.auth-refresh";
 const AUTO_CONNECT_KEY = "xopc.browser.auto-connect";
 const KEY_DATABASE = "xopc-browser-identity";
 const KEY_STORE = "identity";
 const KEY_NAME = "device-key";
 const NATIVE_HOST_NAME = "ai.xopc.browser";
 const GATEWAY_REQUEST_TIMEOUT_MS = 8e3;
+const ACCESS_TOKEN_EXPIRY_MARGIN_MS = 3e4;
+const REFRESH_LOCK_NAME = "xopc.browser.auth-refresh";
 let refreshTask;
 async function browserPublicKeyThumbprint(jwk) {
   const canonical = JSON.stringify({ crv: jwk.crv, kty: jwk.kty, x: jwk.x, y: jwk.y });
@@ -6286,12 +6289,16 @@ async function hasGatewayOriginPermission(origin) {
   return chrome.permissions.contains({ origins: [`${url.origin}/*`] });
 }
 class GatewayHttpError extends Error {
-  constructor(message, status) {
-    super(message);
+  constructor(code, status, serverMessage) {
+    super(code);
+    this.code = code;
     this.status = status;
+    this.serverMessage = serverMessage;
     this.name = "GatewayHttpError";
   }
+  code;
   status;
+  serverMessage;
 }
 async function post(origin, path, body) {
   const controller = new AbortController();
@@ -6314,7 +6321,8 @@ async function post(origin, path, body) {
   if (!response.ok) {
     throw new GatewayHttpError(
       json.error?.code ?? json.error?.message ?? t("errorGatewayStatus", String(response.status)),
-      response.status
+      response.status,
+      json.error?.message
     );
   }
   return json;
@@ -6564,25 +6572,93 @@ async function readProfile() {
   const stored = await chrome.storage.local.get([PROFILE_KEY, PAIRING_JOURNAL_KEY]);
   const profile = stored[PROFILE_KEY];
   if (!profile?.gatewayId || !profile.gatewayUrl || !profile.refreshToken) return void 0;
-  if (stored[PAIRING_JOURNAL_KEY]) await chrome.storage.local.remove(PAIRING_JOURNAL_KEY);
+  const pairing = stored[PAIRING_JOURNAL_KEY];
+  if (pairing?.payload?.gatewayId === profile.gatewayId && pairing.completed?.deviceId === profile.deviceId) {
+    await chrome.storage.local.remove(PAIRING_JOURNAL_KEY);
+  }
   return profile;
 }
-async function getAccessProfile() {
+function withRefreshLock(operation) {
+  const locks = globalThis.navigator?.locks;
+  if (!locks) return operation();
+  return new Promise((resolve, reject) => {
+    void locks.request(REFRESH_LOCK_NAME, () => operation().then(resolve, reject)).catch(reject);
+  });
+}
+function isRefreshDenied(cause) {
+  return cause instanceof GatewayHttpError && cause.status === 401 && cause.code === "REFRESH_DENIED";
+}
+async function refreshJournalFor(profile) {
+  const stored = await chrome.storage.local.get(REFRESH_JOURNAL_KEY);
+  const journal = stored[REFRESH_JOURNAL_KEY];
+  if (journal?.gatewayId === profile.gatewayId && journal.refreshToken === profile.refreshToken) return journal;
+  const next = {
+    gatewayId: profile.gatewayId,
+    refreshToken: profile.refreshToken,
+    requestId: crypto.randomUUID(),
+    nextRefreshToken: createRefreshToken()
+  };
+  await chrome.storage.local.set({ [REFRESH_JOURNAL_KEY]: next });
+  return next;
+}
+async function recoverLocalProfile(gatewayId) {
+  const local = await discoverLocalGateway();
+  if (!local) return void 0;
+  try {
+    if (parseBrowserPairingInvitation(local.invitation).gatewayId !== gatewayId) return void 0;
+    return await pairGateway(local.invitation, () => void 0, new URL(local.gatewayUrl).origin);
+  } catch {
+    return void 0;
+  }
+}
+async function refreshStoredProfile(options) {
+  return withRefreshLock(async () => {
+    const profile = await readProfile();
+    if (!profile) throw new Error(t("errorBrowserNotPaired"));
+    if (options?.rejectedAccessToken && profile.accessToken !== options.rejectedAccessToken && profile.accessTokenExpiresAt > Date.now() + ACCESS_TOKEN_EXPIRY_MARGIN_MS) return profile;
+    if (!options?.rejectedAccessToken && profile.accessTokenExpiresAt > Date.now() + ACCESS_TOKEN_EXPIRY_MARGIN_MS) return profile;
+    const gatewayUrls = profile.gatewayUrls?.length ? profile.gatewayUrls : [profile.gatewayUrl];
+    const journal = await refreshJournalFor(profile);
+    try {
+      const tokens = await refreshAccessToken(
+        gatewayUrls,
+        profile.refreshToken,
+        await getOrCreateKeyPair(),
+        profile,
+        journal
+      );
+      const current = await readProfile();
+      if (current && current.gatewayId === profile.gatewayId && current.refreshToken !== profile.refreshToken) {
+        return current;
+      }
+      const next = {
+        ...profile,
+        ...tokens,
+        gatewayUrls: [tokens.gatewayUrl, ...gatewayUrls.filter((candidate) => candidate !== tokens.gatewayUrl)]
+      };
+      await chrome.storage.local.set({ [PROFILE_KEY]: next });
+      await chrome.storage.local.remove(REFRESH_JOURNAL_KEY);
+      return next;
+    } catch (cause) {
+      const current = await readProfile();
+      if (current && current.gatewayId === profile.gatewayId && current.refreshToken !== profile.refreshToken && current.accessTokenExpiresAt > Date.now()) return current;
+      if (!isRefreshDenied(cause)) throw cause;
+      const recovered = await recoverLocalProfile(profile.gatewayId);
+      if (recovered) {
+        await chrome.storage.local.remove(REFRESH_JOURNAL_KEY);
+        return recovered;
+      }
+      await chrome.storage.local.remove([PROFILE_KEY, REFRESH_JOURNAL_KEY]);
+      throw new Error(t("errorBrowserNotPaired"), { cause });
+    }
+  });
+}
+async function getAccessProfile(options) {
   const profile = await readProfile();
   if (!profile) throw new Error(t("errorBrowserNotPaired"));
-  if (profile.accessTokenExpiresAt > Date.now() + 3e4) return profile;
+  if (!options?.rejectedAccessToken && profile.accessTokenExpiresAt > Date.now() + ACCESS_TOKEN_EXPIRY_MARGIN_MS) return profile;
   if (refreshTask) return refreshTask;
-  refreshTask = (async () => {
-    const gatewayUrls = profile.gatewayUrls?.length ? profile.gatewayUrls : [profile.gatewayUrl];
-    const tokens = await refreshAccessToken(gatewayUrls, profile.refreshToken, await getOrCreateKeyPair(), profile);
-    const next = {
-      ...profile,
-      ...tokens,
-      gatewayUrls: [tokens.gatewayUrl, ...gatewayUrls.filter((candidate) => candidate !== tokens.gatewayUrl)]
-    };
-    await chrome.storage.local.set({ [PROFILE_KEY]: next });
-    return next;
-  })();
+  refreshTask = refreshStoredProfile(options);
   try {
     return await refreshTask;
   } finally {
@@ -6598,9 +6674,7 @@ async function gatewayFetch(path, init = {}) {
   };
   let response = await request();
   if (response.status !== 401) return response;
-  profile = { ...profile, accessTokenExpiresAt: 0 };
-  await chrome.storage.local.set({ [PROFILE_KEY]: profile });
-  profile = await getAccessProfile();
+  profile = await getAccessProfile({ rejectedAccessToken: profile.accessToken });
   response = await request();
   return response;
 }
@@ -6644,7 +6718,7 @@ async function createBrowserEndpointHello(tools = []) {
   };
 }
 async function forgetProfile() {
-  await chrome.storage.local.remove([PROFILE_KEY, PAIRING_JOURNAL_KEY]);
+  await chrome.storage.local.remove([PROFILE_KEY, PAIRING_JOURNAL_KEY, REFRESH_JOURNAL_KEY]);
 }
 async function revokeAndForgetProfile() {
   try {

package/dist/browser-ext/dist/background.js

@@ -1,4 +1,4 @@
-import { j as endpointToolContentSchema, E as ENDPOINT_PROTOCOL_VERSION, e as canonicalJson, T as TAB_BINDING_PREFIX, f as captureTabWithPermission, P as PENDING_CONTEXT_KEY, x as t, q as readProfile, s as registerBrowserEndpoint, m as getAccessProfile, a as RealtimeClient, g as createBrowserEndpointHello, l as gatewayFetch, R as REALTIME_PROTOCOL_VERSION } from './assets/auth-DKo-NMUY.js';
+import { j as endpointToolContentSchema, E as ENDPOINT_PROTOCOL_VERSION, e as canonicalJson, T as TAB_BINDING_PREFIX, f as captureTabWithPermission, P as PENDING_CONTEXT_KEY, x as t, q as readProfile, s as registerBrowserEndpoint, m as getAccessProfile, a as RealtimeClient, g as createBrowserEndpointHello, l as gatewayFetch, R as REALTIME_PROTOCOL_VERSION } from './assets/auth-DocRzRlS.js';
 
 const BROWSER_EXTENSION_PROTOCOL_VERSION = 5;
 const BROWSER_CONTROL_ENDPOINT_TOOL_NAME = "browser.control";

package/dist/browser-ext/dist/sidepanel.html

@@ -5,7 +5,7 @@
     <meta name="viewport" content="width=device-width, initial-scale=1.0" />
     <title>xopc</title>
     <script type="module" crossorigin src="./sidepanel.js"></script>
-    <link rel="modulepreload" crossorigin href="./assets/auth-DKo-NMUY.js">
+    <link rel="modulepreload" crossorigin href="./assets/auth-DocRzRlS.js">
     <link rel="stylesheet" crossorigin href="./assets/sidepanel-DD6GEMvc.css">
   </head>
   <body>

package/dist/browser-ext/dist/sidepanel.js

@@ -1,4 +1,4 @@
-import { x as t, M as MAX_BROWSER_CONTEXTS_PER_TURN, c as browserPageContextsInputSchema, l as gatewayFetch, k as extensionLocale, o as openDatabase, a as RealtimeClient, R as REALTIME_PROTOCOL_VERSION, b as activeTabId, h as currentTabDescriptor, T as TAB_BINDING_PREFIX, m as getAccessProfile, u as runWithTabSiteAccess, P as PENDING_CONTEXT_KEY, f as captureTabWithPermission, p as pairGateway, w as setAutoConnectEnabled, r as readPendingBrowserPairing, q as readProfile, i as discoverLocalGateway, v as saveExtensionLocalePreference, t as revokeAndForgetProfile, d as cancelPendingBrowserPairing, n as loadExtensionLocalePreference } from './assets/auth-DKo-NMUY.js';
+import { x as t, M as MAX_BROWSER_CONTEXTS_PER_TURN, c as browserPageContextsInputSchema, l as gatewayFetch, k as extensionLocale, o as openDatabase, a as RealtimeClient, R as REALTIME_PROTOCOL_VERSION, b as activeTabId, h as currentTabDescriptor, T as TAB_BINDING_PREFIX, m as getAccessProfile, u as runWithTabSiteAccess, P as PENDING_CONTEXT_KEY, f as captureTabWithPermission, p as pairGateway, w as setAutoConnectEnabled, r as readPendingBrowserPairing, q as readProfile, i as discoverLocalGateway, v as saveExtensionLocalePreference, t as revokeAndForgetProfile, d as cancelPendingBrowserPairing, n as loadExtensionLocalePreference } from './assets/auth-DocRzRlS.js';
 
 const OTHER_ACTIVITY = {
   category: "other",
@@ -29158,6 +29158,22 @@ function SidePanelApp({ initialLocale, initialTheme }) {
       await connect(local.invitation);
     })();
   }, [connect]);
+  reactExports.useEffect(() => {
+    const onProfileChanged = (changes, area) => {
+      if (area !== "local" || !changes["xopc.browser.profile"]) return;
+      const next = changes["xopc.browser.profile"].newValue;
+      if (next?.gatewayId && next.gatewayUrl && next.refreshToken) {
+        setProfile(next);
+        setError("");
+        setState("online");
+      } else {
+        setProfile(void 0);
+        setState("unpaired");
+      }
+    };
+    chrome.storage.onChanged.addListener(onProfileChanged);
+    return () => chrome.storage.onChanged.removeListener(onProfileChanged);
+  }, []);
   reactExports.useEffect(() => {
     function closeSettings(event) {
       const target = event.target;
@@ -29304,7 +29320,7 @@ function SidePanelApp({ initialLocale, initialTheme }) {
           invitation ? /* @__PURE__ */ jsxRuntimeExports.jsx("button", { onClick: () => void cancelPairing(), disabled: state === "pairing", children: t("cancelPairing") }) : null
         ] })
       ] }) : null
-    ] }) : /* @__PURE__ */ jsxRuntimeExports.jsx(ChatPanel, { gatewayId: profile.gatewayId }, profile.gatewayId)
+    ] }) : /* @__PURE__ */ jsxRuntimeExports.jsx(ChatPanel, { gatewayId: profile.gatewayId }, `${profile.gatewayId}:${profile.gatewayUrl}`)
   ] });
 }
 

package/dist/browser-ext/manifest.json

@@ -3,7 +3,7 @@
   "minimum_chrome_version": "120",
   "default_locale": "en",
   "name": "__MSG_appName__",
-  "version": "0.0.321",
+  "version": "0.0.323",
   "description": "__MSG_appDescription__",
   "key": "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAqnpr4vpLC/nmvy+wiOWk3SWlp2nEZkFijfk8ivGw7StNZgCK90nOMvwhdEtlkk3GOWDvdVnq8HxCsM3UNQ8FnGUyerpH1FJXqXuradxeHf8ZxFjiQU/mIWfnKbUuONWQORon3/pigyoXoK/VUXgg0Wbm/rbVwsS0bv+25R6m+mZgBspOLeKuoH7ivhL+48WV6POtMBsFPZweY26477EM7ukh+56Ff5ENevB8ymxBBn7qK5ZoeZd2a23U8ioX5TsHfe6fnrjitPWjIxD8G0NoKQxcaa/Mo+xs+T6UiLKxP0wjz5bm7jB5H+CXtkRJqzBWUB0h+RSLJckzZfA8BAJrRwIDAQAB",
   "permissions": [

package/dist/extensions/telegram/xopc.extension.json

@@ -2,7 +2,7 @@
   "id": "telegram",
   "name": "Telegram Channel",
   "description": "Bundled Telegram Bot channel (private workspace sources; ships inside @xopcai/xopc dist/)",
-  "version": "0.0.321",
+  "version": "0.0.323",
   "kind": "channel",
   "main": "src/index.js",
   "channels": [