@xopcai/xopc 0.0.321 → 0.0.324

package/dist/src/gateway/hono/middleware/auth.js

@@ -1,7 +1,7 @@
 import { logAuthEvent } from "../../../utils/logger/audit.js";
 import { createLogger } from "../../../utils/logger/index.js";
 import { init_logger } from "../../../utils/logger.js";
-import { authenticateDeviceAccessToken, getDevice } from "../../../storage/sqlite/device-access-repository.js";
+import { authenticateDeviceAccessToken, getDevice, init_device_access_repository } from "../../../storage/sqlite/device-access-repository.js";
 import { safeEqualSecret } from "../../security/secret-equal.js";
 import { resolveClientIpFromRequest } from "../../client-ip.js";
 import { authPolicyConfig, buckets, resolveAuthRateLimit } from "../../rate-limit/buckets.js";
@@ -16,6 +16,7 @@ import { setGatewayPrincipal } from "../../security/gateway-principal.js";
 import { createMiddleware } from "hono/factory";
 import { getConnInfo } from "@hono/node-server/conninfo";
 //#region src/gateway/hono/middleware/auth.ts
+init_device_access_repository();
 init_logger();
 const log = createLogger("Gateway:Auth");
 function resolveExpectedCredential(auth) {

package/dist/src/gateway/hono/middleware/scopes.js

@@ -1,9 +1,10 @@
 import { createLogger } from "../../../utils/logger/index.js";
 import { init_logger } from "../../../utils/logger.js";
-import { hasGatewayScope, requiredGatewayScope } from "../../security/gateway-scopes.js";
+import { hasGatewayScope, init_gateway_scopes, requiredGatewayScope } from "../../security/gateway-scopes.js";
 import { getGatewayPrincipal } from "../../security/gateway-principal.js";
 import { createMiddleware } from "hono/factory";
 //#region src/gateway/hono/middleware/scopes.ts
+init_gateway_scopes();
 init_logger();
 const log = createLogger("Hono:Scopes");
 /** Enforces fail-closed route scopes after authentication establishes a principal. */

package/dist/src/gateway/hono/routes/agent-plugins.d.ts

@@ -0,0 +1,3 @@
+import type { Hono } from 'hono';
+import type { AuthenticatedRouteDeps } from './deps.js';
+export declare function registerAgentPluginRoutes(app: Hono, deps: AuthenticatedRouteDeps): void;

package/dist/src/gateway/hono/routes/agent-plugins.js

@@ -0,0 +1,166 @@
+import { AgentPluginStore } from "../../../extensions/agent-plugins/store.js";
+import { removePluginCredentials, savePluginAuthBinding } from "../../../extensions/agent-plugins/auth.js";
+import { disposeAllSessionMcpRuntimes } from "../../../agent/mcp/bundle-mcp-runtime.js";
+import { withAgentPluginSource } from "../../../extensions/agent-plugins/sources.js";
+import { agentPluginInventoryRow } from "../../../extensions/agent-plugins/inventory.js";
+import { z } from "zod";
+//#region src/gateway/hono/routes/agent-plugins.ts
+const sourceBody = z.strictObject({
+	source: z.string().min(1),
+	reviewHash: z.string().optional()
+});
+function registerAgentPluginRoutes(app, deps) {
+	const store = new AgentPluginStore();
+	const refresh = async () => {
+		await disposeAllSessionMcpRuntimes();
+		deps.service.marketplace.reloadSkills();
+	};
+	app.post("/api/extensions/inspect", deps.strictRateLimitMiddleware, async (c) => {
+		try {
+			const body = sourceBody.parse(await c.req.json());
+			return c.json({
+				ok: true,
+				payload: await withAgentPluginSource(body.source, deps.service.currentConfig, (source) => store.inspect(source))
+			});
+		} catch (error) {
+			return c.json({
+				ok: false,
+				error: error instanceof Error ? error.message : String(error)
+			}, 400);
+		}
+	});
+	app.post("/api/extensions/install", deps.strictRateLimitMiddleware, async (c) => {
+		try {
+			const body = sourceBody.parse(await c.req.json());
+			const plugin = await withAgentPluginSource(body.source, deps.service.currentConfig, (source) => store.install(source, {
+				reviewHash: body.reviewHash,
+				sourceLabel: body.source
+			}));
+			await refresh();
+			return c.json({
+				ok: true,
+				payload: agentPluginInventoryRow(plugin)
+			});
+		} catch (error) {
+			return c.json({
+				ok: false,
+				error: error instanceof Error ? error.message : String(error)
+			}, 400);
+		}
+	});
+	app.get("/api/extensions/agent-plugins/:id", (c) => {
+		try {
+			const plugin = store.get(c.req.param("id"));
+			return plugin ? c.json({
+				ok: true,
+				payload: agentPluginInventoryRow(plugin)
+			}) : c.json({
+				ok: false,
+				error: "Plugin not found"
+			}, 404);
+		} catch (error) {
+			return c.json({
+				ok: false,
+				error: error instanceof Error ? error.message : String(error)
+			}, 400);
+		}
+	});
+	app.post("/api/extensions/agent-plugins/:id/activation", deps.strictRateLimitMiddleware, async (c) => {
+		try {
+			const body = z.strictObject({ enabled: z.boolean() }).parse(await c.req.json());
+			const plugin = store.setEnabled(c.req.param("id"), body.enabled);
+			await refresh();
+			return c.json({
+				ok: true,
+				payload: agentPluginInventoryRow(plugin)
+			});
+		} catch (error) {
+			return c.json({
+				ok: false,
+				error: error instanceof Error ? error.message : String(error)
+			}, 400);
+		}
+	});
+	app.post("/api/extensions/agent-plugins/:id/update", deps.strictRateLimitMiddleware, async (c) => {
+		try {
+			const body = sourceBody.parse(await c.req.json());
+			const plugin = await withAgentPluginSource(body.source, deps.service.currentConfig, (source) => store.install(source, {
+				reviewHash: body.reviewHash,
+				replace: true,
+				expectedId: c.req.param("id"),
+				sourceLabel: body.source
+			}));
+			await refresh();
+			return c.json({
+				ok: true,
+				payload: agentPluginInventoryRow(plugin)
+			});
+		} catch (error) {
+			return c.json({
+				ok: false,
+				error: error instanceof Error ? error.message : String(error)
+			}, 400);
+		}
+	});
+	app.post("/api/extensions/agent-plugins/:id/rollback", deps.strictRateLimitMiddleware, async (c) => {
+		try {
+			const plugin = store.rollback(c.req.param("id"));
+			await refresh();
+			return c.json({
+				ok: true,
+				payload: agentPluginInventoryRow(plugin)
+			});
+		} catch (error) {
+			return c.json({
+				ok: false,
+				error: error instanceof Error ? error.message : String(error)
+			}, 400);
+		}
+	});
+	app.put("/api/extensions/agent-plugins/:id/mcp/:server/auth", deps.strictRateLimitMiddleware, async (c) => {
+		try {
+			const body = z.strictObject({
+				mode: z.enum([
+					"auto",
+					"oauth",
+					"api-key",
+					"none"
+				]),
+				secrets: z.array(z.strictObject({
+					target: z.enum(["headers", "env"]),
+					key: z.string(),
+					value: z.string(),
+					prefix: z.string().optional()
+				})).max(20).optional()
+			}).parse(await c.req.json());
+			await savePluginAuthBinding(store, c.req.param("id"), c.req.param("server"), body);
+			await refresh();
+			return c.json({ ok: true });
+		} catch (error) {
+			return c.json({
+				ok: false,
+				error: error instanceof Error ? error.message : String(error)
+			}, 400);
+		}
+	});
+	app.delete("/api/extensions/agent-plugins/:id", deps.strictRateLimitMiddleware, async (c) => {
+		try {
+			const body = z.strictObject({
+				removeData: z.boolean().optional(),
+				removeCredentials: z.boolean().optional()
+			}).parse(await c.req.json());
+			await disposeAllSessionMcpRuntimes();
+			if (body.removeCredentials) await removePluginCredentials(store, c.req.param("id"));
+			store.remove(c.req.param("id"), body.removeData);
+			deps.service.marketplace.reloadSkills();
+			return c.json({ ok: true });
+		} catch (error) {
+			return c.json({
+				ok: false,
+				error: error instanceof Error ? error.message : String(error)
+			}, 400);
+		}
+	});
+}
+//#endregion
+export { registerAgentPluginRoutes };

package/dist/src/gateway/hono/routes/agent-stream.js

@@ -1,7 +1,10 @@
+import { parseUserTurnDocument, userTurnDocumentRefIds } from "../../../../packages/gateway-contract/src/user-turn-document.js";
+import { init_src } from "../../../../packages/gateway-contract/src/index.js";
 import { validateWebchatAttachments, validateWebchatContent } from "../../chat-limits.js";
 import { parseTurnContextRefs } from "../../../agent/source-context/types.js";
 import { replaceLatestSessionTurn, submitSessionInput } from "./session-input-handler.js";
 //#region src/gateway/hono/routes/agent-stream.ts
+init_src();
 function registerAgentStreamRoutes(authenticated, deps) {
 	const { service, chatRateLimitMiddleware } = deps;
 	authenticated.post("/api/agent/abort", chatRateLimitMiddleware, async (c) => {
@@ -60,6 +63,17 @@ function registerAgentStreamRoutes(authenticated, deps) {
 				message: "Invalid source context references"
 			}
 		}, 400);
+		if (typeof body.content === "string") {
+			const document = parseUserTurnDocument(body.content);
+			const refIds = new Set((contextRefs ?? []).flatMap((ref) => ref.refId ? [ref.refId] : []));
+			if (document && !userTurnDocumentRefIds(document).every((refId) => refIds.has(refId))) return c.json({
+				ok: false,
+				error: {
+					code: "BAD_REQUEST",
+					message: "Input contains an unknown context reference"
+				}
+			}, 400);
+		}
 		if (body.content !== void 0) {
 			const contentError = validateWebchatContent(body.content);
 			if (contentError) return c.json({

package/dist/src/gateway/hono/routes/agents.js

@@ -1,7 +1,8 @@
 import { AgentModelsOverrideSchema, AgentProfileSchema, RuntimePolicySchema, SkillOverrideSchema, ToolPoliciesSchema, WorkflowPolicySchema } from "../../../agent-config/schema.js";
 import { init_agent_config } from "../../../agent-config/index.js";
-import { init_agent_scope, normalizeAgentId } from "../../../agent/agent-scope.js";
-import { deleteAgentAvatarFile, finalizeCreateAgentDirs, getGatewayAgentEffectiveConfig, listAgentProfileFiles, listGatewayAgents, prepareCreateAgent, prepareDeleteAgent, prepareUpdateAgent, readAgentAvatarFile, readAgentProfileFile, runAfterDeletePurge, writeAgentAvatarFromBase64, writeAgentProfileFile } from "../../agents-admin.js";
+import { normalizeAgentId } from "../../../agent-catalog/id.js";
+import { init_agent_scope } from "../../../agent/agent-scope.js";
+import { createGatewayAgent, deleteAgentAvatarFile, deleteGatewayAgent, getGatewayAgentEffectiveConfig, listAgentProfileFiles, listGatewayAgents, readAgentAvatarFile, readAgentProfileFile, updateGatewayAgent, writeAgentAvatarFromBase64, writeAgentProfileFile } from "../../agents-admin.js";
 import { getVoiceModelsConfig } from "../../../config/voice.js";
 //#region src/gateway/hono/routes/agents.ts
 init_agent_config();
@@ -39,8 +40,7 @@ function parsePatchModels(raw) {
 function registerAgentsRoutes(authenticated, deps) {
 	const { service, strictRateLimitMiddleware } = deps;
 	authenticated.get("/api/agents", async (c) => {
-		const cfg = service.currentConfig;
-		const payload = await listGatewayAgents(cfg, { locale: c.req.query("locale") || c.req.header("Accept-Language")?.split(",")[0]?.trim() });
+		const payload = await listGatewayAgents({ locale: c.req.query("locale") || c.req.header("Accept-Language")?.split(",")[0]?.trim() });
 		return c.json({
 			ok: true,
 			payload
@@ -61,24 +61,14 @@ function registerAgentsRoutes(authenticated, deps) {
 			ok: false,
 			error: { message: parsed.error }
 		}, 400);
-		const prep = prepareCreateAgent(service.currentConfig, parsed);
+		const prep = await createGatewayAgent(parsed);
 		if (prep.ok === false) return c.json({
 			ok: false,
 			error: { message: prep.error }
 		}, prep.status ?? 400);
-		const { nextConfig, agentId } = prep.data;
-		const save = await service.saveConfig(nextConfig);
-		if (!save.saved) return c.json({
-			ok: false,
-			error: { message: save.error ?? "save failed" }
-		}, 500);
-		const finalized = await finalizeCreateAgentDirs(service.currentConfig, agentId);
-		if (finalized.ok === false) return c.json({
-			ok: false,
-			error: { message: finalized.error }
-		}, finalized.status ?? 400);
-		const locale = c.req.query("locale") || c.req.header("Accept-Language")?.split(",")[0]?.trim();
-		const agentsPayload = await listGatewayAgents(service.currentConfig, { locale });
+		const { agentId } = prep.data;
+		service.refreshAgentCatalog();
+		const agentsPayload = await listGatewayAgents({ locale: c.req.query("locale") || c.req.header("Accept-Language")?.split(",")[0]?.trim() });
 		return c.json({
 			ok: true,
 			payload: {
@@ -88,8 +78,7 @@ function registerAgentsRoutes(authenticated, deps) {
 		});
 	});
 	authenticated.get("/api/agents/:id/effective-config", async (c) => {
-		const id = normalizeAgentId(c.req.param("id") ?? "");
-		const res = getGatewayAgentEffectiveConfig(service.currentConfig, id);
+		const res = getGatewayAgentEffectiveConfig(normalizeAgentId(c.req.param("id") ?? ""));
 		if (res.ok === false) return c.json({
 			ok: false,
 			error: { message: res.error }
@@ -170,7 +159,7 @@ function registerAgentsRoutes(authenticated, deps) {
 			ok: false,
 			error: { message: "workspace must be a string or null" }
 		}, 400);
-		const prep = prepareUpdateAgent(service.currentConfig, id, {
+		const prep = await updateGatewayAgent(id, {
 			...workspacePatch !== void 0 ? { workspace: workspacePatch } : {},
 			...profilePatch !== void 0 ? { profile: profilePatch === null ? null : profilePatch.data } : {},
 			...modelsPatch !== void 0 ? { models: modelsPatch } : {},
@@ -184,13 +173,8 @@ function registerAgentsRoutes(authenticated, deps) {
 			ok: false,
 			error: { message: prep.error }
 		}, prep.status ?? 400);
-		const save = await service.saveConfig(prep.data.nextConfig);
-		if (!save.saved) return c.json({
-			ok: false,
-			error: { message: save.error ?? "save failed" }
-		}, 500);
-		const locale = c.req.query("locale") || c.req.header("Accept-Language")?.split(",")[0]?.trim();
-		const agentsPayload = await listGatewayAgents(service.currentConfig, { locale });
+		service.refreshAgentCatalog();
+		const agentsPayload = await listGatewayAgents({ locale: c.req.query("locale") || c.req.header("Accept-Language")?.split(",")[0]?.trim() });
 		return c.json({
 			ok: true,
 			payload: agentsPayload
@@ -199,20 +183,14 @@ function registerAgentsRoutes(authenticated, deps) {
 	authenticated.delete("/api/agents/:id", strictRateLimitMiddleware, async (c) => {
 		const id = normalizeAgentId(c.req.param("id") ?? "");
 		const purge = c.req.query("purge") === "1" || c.req.query("purge") === "true";
-		const prep = prepareDeleteAgent(service.currentConfig, id);
+		const prep = await deleteGatewayAgent(id, { purge });
 		if (prep.ok === false) return c.json({
 			ok: false,
 			error: { message: prep.error }
 		}, prep.status ?? 400);
-		const { nextConfig, agentId } = prep.data;
-		const save = await service.saveConfig(nextConfig);
-		if (!save.saved) return c.json({
-			ok: false,
-			error: { message: save.error ?? "save failed" }
-		}, 500);
-		if (purge) await runAfterDeletePurge(service.currentConfig, agentId);
-		const locale = c.req.query("locale") || c.req.header("Accept-Language")?.split(",")[0]?.trim();
-		const agentsPayload = await listGatewayAgents(service.currentConfig, { locale });
+		const { agentId } = prep.data;
+		service.refreshAgentCatalog();
+		const agentsPayload = await listGatewayAgents({ locale: c.req.query("locale") || c.req.header("Accept-Language")?.split(",")[0]?.trim() });
 		return c.json({
 			ok: true,
 			payload: {
@@ -223,8 +201,7 @@ function registerAgentsRoutes(authenticated, deps) {
 		});
 	});
 	authenticated.get("/api/agents/:id/avatar", async (c) => {
-		const id = normalizeAgentId(c.req.param("id") ?? "");
-		const res = await readAgentAvatarFile(service.currentConfig, id);
+		const res = await readAgentAvatarFile(normalizeAgentId(c.req.param("id") ?? ""));
 		if (res.ok === false) return c.json({
 			ok: false,
 			error: { message: res.error }
@@ -248,9 +225,7 @@ function registerAgentsRoutes(authenticated, deps) {
 				error: { message: "Invalid JSON" }
 			}, 400);
 		}
-		const base64 = typeof body.base64 === "string" ? body.base64 : "";
-		const mimeType = typeof body.mimeType === "string" ? body.mimeType : "";
-		const res = await writeAgentAvatarFromBase64(service.currentConfig, id, base64, mimeType);
+		const res = await writeAgentAvatarFromBase64(id, typeof body.base64 === "string" ? body.base64 : "", typeof body.mimeType === "string" ? body.mimeType : "");
 		if (res.ok === false) return c.json({
 			ok: false,
 			error: { message: res.error }
@@ -261,8 +236,7 @@ function registerAgentsRoutes(authenticated, deps) {
 		});
 	});
 	authenticated.delete("/api/agents/:id/avatar", strictRateLimitMiddleware, async (c) => {
-		const id = normalizeAgentId(c.req.param("id") ?? "");
-		const res = await deleteAgentAvatarFile(service.currentConfig, id);
+		const res = await deleteAgentAvatarFile(normalizeAgentId(c.req.param("id") ?? ""));
 		if (res.ok === false) return c.json({
 			ok: false,
 			error: { message: res.error }
@@ -273,8 +247,7 @@ function registerAgentsRoutes(authenticated, deps) {
 		});
 	});
 	authenticated.get("/api/agents/:id/files", async (c) => {
-		const id = normalizeAgentId(c.req.param("id") ?? "");
-		const res = await listAgentProfileFiles(service.currentConfig, id);
+		const res = await listAgentProfileFiles(normalizeAgentId(c.req.param("id") ?? ""));
 		if (res.ok === false) return c.json({
 			ok: false,
 			error: { message: res.error }
@@ -287,7 +260,7 @@ function registerAgentsRoutes(authenticated, deps) {
 	authenticated.get("/api/agents/:id/files/:name", async (c) => {
 		const id = normalizeAgentId(c.req.param("id") ?? "");
 		const name = decodeURIComponent(c.req.param("name") ?? "");
-		const res = await readAgentProfileFile(service.currentConfig, id, name);
+		const res = await readAgentProfileFile(id, name);
 		if (res.ok === false) return c.json({
 			ok: false,
 			error: { message: res.error }
@@ -314,7 +287,7 @@ function registerAgentsRoutes(authenticated, deps) {
 				error: { message: "Invalid JSON" }
 			}, 400);
 		}
-		const res = await writeAgentProfileFile(service.currentConfig, id, name, content);
+		const res = await writeAgentProfileFile(id, name, content);
 		if (res.ok === false) return c.json({
 			ok: false,
 			error: { message: res.error }

package/dist/src/gateway/hono/routes/auth-registry-extensions.js

@@ -7,6 +7,7 @@ import { createOAuthAsyncHandler } from "../oauth-async.js";
 import { createOAuthHandler } from "../oauth.js";
 import { extensionAssetMimeType } from "../lib/extension-assets.js";
 import { loadExtensionStore, saveExtensionStore } from "../lib/extension-store.js";
+import { listAgentPluginInventory } from "../../../extensions/agent-plugins/inventory.js";
 import { relative, resolve } from "node:path";
 import { existsSync, readFileSync, statSync } from "node:fs";
 //#region src/gateway/hono/routes/auth-registry-extensions.ts
@@ -152,7 +153,7 @@ function registerAuthRegistryExtensionsRoutes(authenticated, deps) {
 	});
 	authenticated.get("/api/extensions", async (c) => {
 		const loader = service.getExtensionLoader();
-		if (!loader) return c.json({ extensions: [] });
+		if (!loader) return c.json({ extensions: listAgentPluginInventory() });
 		const registry = loader.getRegistry();
 		const discovered = loader.discoverExtensions();
 		const activeIds = /* @__PURE__ */ new Set();
@@ -166,6 +167,7 @@ function registerAuthRegistryExtensionsRoutes(authenticated, deps) {
 			activationEligibleIds = /* @__PURE__ */ new Set();
 		}
 		const extensions = discovered.map((ext) => ({
+			format: "native-extension",
 			id: ext.manifest.id,
 			name: ext.manifest.name,
 			description: ext.manifest.description,
@@ -182,7 +184,7 @@ function registerAuthRegistryExtensionsRoutes(authenticated, deps) {
 				contributions: ext.manifest.ui.contributions
 			} : void 0
 		}));
-		return c.json({ extensions });
+		return c.json({ extensions: [...extensions, ...listAgentPluginInventory()] });
 	});
 	/**
 	* Built-in (bundled) extension enable/disable — persists `extensions.enabled` / `extensions.disabled`.

package/dist/src/gateway/hono/routes/browser.js

@@ -1,7 +1,7 @@
-import { deleteBrowserTabBinding, getBrowserTabBinding, setBrowserTabBinding } from "../../../storage/sqlite/browser-tab-binding-repository.js";
+import { deleteBrowserTabBinding, getBrowserTabBinding, init_browser_tab_binding_repository, setBrowserTabBinding } from "../../../storage/sqlite/browser-tab-binding-repository.js";
 import { browserTabBindingRequestSchema } from "../../../../packages/gateway-contract/src/browser-tab-binding.js";
 import { init_src } from "../../../../packages/gateway-contract/src/index.js";
-import { getDevice } from "../../../storage/sqlite/device-access-repository.js";
+import { getDevice, init_device_access_repository } from "../../../storage/sqlite/device-access-repository.js";
 import "../../../../packages/browser-control-contract/src/index.js";
 import { decideBrowserApproval, listBrowserApprovals } from "../../../browser/policy/approval-store.js";
 import { createBrowserDriver } from "../../../browser/drivers/create-driver.js";
@@ -12,6 +12,8 @@ import { getConnInfo } from "@hono/node-server/conninfo";
 //#region src/gateway/hono/routes/browser.ts
 /** Browser Control status, approvals, and driver diagnostics. */
 init_src();
+init_device_access_repository();
+init_browser_tab_binding_repository();
 async function extensionStatus(service, includeLocalArtifacts) {
 	const endpoints = service.endpointTools.registry.list().filter((item) => item.kind === "browser" && item.tools.some((tool) => tool.descriptor.name === "browser.control")).sort((left, right) => right.lastHeartbeatAt - left.lastHeartbeatAt);
 	const endpoint = endpoints[0];

package/dist/src/gateway/hono/routes/channels.js

@@ -1,7 +1,6 @@
-import { buildChannelCatalogForConfig, buildChannelCatalogFromSnapshot, getChannelSetupStatus, init_channel_catalog_service } from "../../../channels/catalog/channel-catalog-service.js";
+import { buildChannelCatalogForConfig, buildChannelCatalogFromSnapshot, getChannelSetupStatus } from "../../../channels/catalog/channel-catalog-service.js";
 import { approveChannelPairing, approveChannelPairingBySender, dismissChannelPairingPending, listChannelPairingState, listChannelPairingSummary, revokeChannelPairingPaired } from "../../../channels/pairing/pairing-service.js";
 //#region src/gateway/hono/routes/channels.ts
-init_channel_catalog_service();
 function channelIdParam(raw) {
 	return (raw ?? "").trim().toLowerCase();
 }

package/dist/src/gateway/hono/routes/chat-previews.d.ts

@@ -0,0 +1,3 @@
+import type { Hono } from 'hono';
+import type { AuthenticatedRouteDeps } from './deps.js';
+export declare function registerChatPreviewRoutes(app: Hono, deps: AuthenticatedRouteDeps): void;

package/dist/src/gateway/hono/routes/chat-previews.js

@@ -0,0 +1,41 @@
+import { ChatPreviewFixGuidanceInputSchema, ChatPreviewSourceHashSchema } from "../../../../packages/gateway-contract/src/chat-previews.js";
+import { init_src } from "../../../../packages/gateway-contract/src/index.js";
+import { ChatPreviewNotFoundError } from "../../../chat-previews/service.js";
+import "../../../chat-previews/index.js";
+//#region src/gateway/hono/routes/chat-previews.ts
+init_src();
+function registerChatPreviewRoutes(app, deps) {
+	app.get("/api/chat-previews/:id/revisions/:sourceHash", (c) => {
+		const sourceHash = ChatPreviewSourceHashSchema.safeParse(c.req.param("sourceHash"));
+		if (!sourceHash.success) return c.json({ error: "Invalid preview revision" }, 400);
+		try {
+			return c.json({ revision: deps.service.chatPreviews.getRevision(c.req.param("id"), sourceHash.data) }, 200, { "Cache-Control": "private, max-age=31536000, immutable" });
+		} catch (error) {
+			if (error instanceof ChatPreviewNotFoundError) return c.json({ error: error.message }, 404);
+			throw error;
+		}
+	});
+	app.post("/api/chat-previews/:id/fix-guidance", async (c) => {
+		const parsed = ChatPreviewFixGuidanceInputSchema.safeParse(await c.req.json().catch(() => null));
+		if (!parsed.success) return c.json({ error: "Invalid fix guidance input" }, 400);
+		try {
+			return c.json({ guidance: deps.service.chatPreviews.getFixGuidance(c.req.param("id"), parsed.data.sourceHash, parsed.data.diagnostics, parsed.data.locale) });
+		} catch (error) {
+			if (error instanceof ChatPreviewNotFoundError) return c.json({ error: error.message }, 404);
+			throw error;
+		}
+	});
+	app.post("/api/chat-previews/:id/promote", async (c) => {
+		const body = await c.req.json().catch(() => null);
+		const sourceHash = ChatPreviewSourceHashSchema.safeParse(body?.sourceHash);
+		if (!sourceHash.success) return c.json({ error: "Invalid preview revision" }, 400);
+		try {
+			return c.json({ app: deps.service.chatPreviews.promote(c.req.param("id"), sourceHash.data) }, 201);
+		} catch (error) {
+			if (error instanceof ChatPreviewNotFoundError) return c.json({ error: error.message }, 404);
+			throw error;
+		}
+	});
+}
+//#endregion
+export { registerChatPreviewRoutes };

package/dist/src/gateway/hono/routes/cli-connectors.js

@@ -1,5 +1,5 @@
 import { getSqliteDatabase, init_transaction } from "../../../storage/sqlite/transaction.js";
-import { hasGatewayScope } from "../../security/gateway-scopes.js";
+import { hasGatewayScope, init_gateway_scopes } from "../../security/gateway-scopes.js";
 import { getConnectorAccount, init_connector_account_repository, listConnectorAccounts, updateConnectorAccount } from "../../../storage/sqlite/connector-account-repository.js";
 import { getConnectorConnection, getConnectorInstallation, init_connector_repository, listConnectorConnections, upsertConnectorConnection, upsertConnectorInstallation } from "../../../storage/sqlite/connector-repository.js";
 import { cancelCliContext, cliContextPath, resolveCliArtifact } from "../../../connectors/cli/process.js";
@@ -12,6 +12,7 @@ import { readFile } from "node:fs/promises";
 init_connector_account_repository();
 init_connector_repository();
 init_transaction();
+init_gateway_scopes();
 function registerCliConnectorRoutes(app, deps) {
 	const admin = async (c, next) => {
 		if (!hasGatewayScope(getGatewayPrincipal(c).scopes, "gateway.admin")) return c.json({

package/dist/src/gateway/hono/routes/commands-skills.js

@@ -1,3 +1,4 @@
+import { init_agent_scope, resolveDefaultAgentId } from "../../../agent/agent-scope.js";
 import { effectiveWorkspacePathForSession } from "../../../session/session-workspace.js";
 import { getProjectForSession } from "../../../projects/workspace.js";
 import { isRegisteredProvider } from "../../../agent/skills/marketplace/registry.js";
@@ -7,6 +8,7 @@ import { commandRegistry } from "../../../chat-commands/registry.js";
 import { buildReviewContext, resolveGitRoot } from "../../../review/review-git.js";
 import "../../../chat-commands/index.js";
 //#region src/gateway/hono/routes/commands-skills.ts
+init_agent_scope();
 function parseMarketplaceProviderQuery(raw) {
 	const v = raw?.trim().toLowerCase();
 	if (v && isRegisteredProvider(v)) return v;
@@ -77,7 +79,7 @@ function registerCommandsSkillsRoutes(authenticated, deps) {
 	});
 	authenticated.get("/api/chat/skills", async (c) => {
 		const conversationId = c.req.query("conversationId")?.trim();
-		const agentId = c.req.query("agentId")?.trim() || service.getConfig().agents?.default || "main";
+		const agentId = c.req.query("agentId")?.trim() || resolveDefaultAgentId();
 		const payload = conversationId ? await service.marketplace.getSessionSkillsApi(conversationId) : service.marketplace.getAgentSkillsApi(agentId);
 		return c.json({
 			ok: true,

package/dist/src/gateway/hono/routes/composer-history.js

@@ -1,6 +1,7 @@
 import { appendComposerInputHistory, clearComposerInputHistory, listComposerInputHistory } from "../../../storage/sqlite/composer-input-history-repository.js";
-import "../../../storage/sqlite/index.js";
+import { init_sqlite } from "../../../storage/sqlite/index.js";
 //#region src/gateway/hono/routes/composer-history.ts
+init_sqlite();
 const MAX_TEXT_LENGTH = 1e5;
 function registerComposerHistoryRoutes(authenticated, deps) {
 	authenticated.get("/api/composer-history", (c) => {

package/dist/src/gateway/hono/routes/config-patch/index.d.ts

@@ -1,8 +1,6 @@
 /**
- * Barrel for `PATCH /api/config` section patchers. See `agents.ts`,
- * `channels.ts`, `gateway.ts`, `misc.ts` for the per-section split.
+ * Barrel for `PATCH /api/config` section patchers.
  */
-export { applyAgentsPatch } from './agents.js';
 export { applyChannelsPatch } from './channels.js';
 export { applyGatewayPatch } from './gateway.js';
 export { applyMiscPatch, validateGatewayAfterPatch } from './misc.js';

package/dist/src/gateway/hono/routes/config-patch/index.js

@@ -1,6 +1,5 @@
-import { applyAgentsPatch } from "./agents.js";
 import { applyChannelsPatch } from "./channels.js";
 import { PATCH_OK, patchError } from "./result.js";
 import { applyGatewayPatch } from "./gateway.js";
 import { applyMiscPatch, validateGatewayAfterPatch } from "./misc.js";
-export { PATCH_OK, applyAgentsPatch, applyChannelsPatch, applyGatewayPatch, applyMiscPatch, patchError, validateGatewayAfterPatch };
+export { PATCH_OK, applyChannelsPatch, applyGatewayPatch, applyMiscPatch, patchError, validateGatewayAfterPatch };

package/dist/src/gateway/hono/routes/config-patch/misc.js

@@ -1,9 +1,10 @@
+import { BindingsSchema, init_binding_schema } from "../../../../routing/binding-schema.js";
+import { AgentCatalogService } from "../../../../agent-catalog/service.js";
 import { ComputerConfigSchema, init_config } from "../../../../computer/config.js";
 import { ContextPlanningConfigSchema, KnowledgeMemoryConfigSchema, UserContextConfigSchema, UserModelConfigSchema, init_config as init_config$1 } from "../../../../user-context/config.js";
-import { BindingsConfigSchema, BrowserConfigSchema, McpConfigSchema, VoiceConfigSchema, init_schema } from "../../../../config/schema.js";
+import { BrowserConfigSchema, McpConfigSchema, VoiceConfigSchema, init_schema } from "../../../../config/schema.js";
 import { CredentialResolver, init_credentials } from "../../../../auth/credentials.js";
 import { canonicalizeConfiguredMcpServer } from "../../../../config/mcp-config-normalize.js";
-import { setTuiDefaultAgentConfig } from "../../../../commands/agents.config.js";
 import { mergeGatewaySkillsMarketplacePatch, mergeSessionConfigPatch, mergeUpdateConfigPatch } from "../../../../config/web-patch.js";
 import { assertGatewayAuthConfigured, resolveGatewayAuth } from "../../../auth.js";
 import { isMaskedSecretPatchValue } from "../../lib/mask-secret-length.js";
@@ -15,6 +16,7 @@ import { PATCH_OK, patchError } from "./result.js";
 //#region src/gateway/hono/routes/config-patch/misc.ts
 init_config();
 init_schema();
+init_binding_schema();
 init_credentials();
 init_config$1();
 async function applyMiscPatch(config, body) {
@@ -116,14 +118,15 @@ async function applyMiscPatch(config, body) {
 	if (body.tui !== void 0) {
 		if (typeof body.tui !== "object" || body.tui === null || Array.isArray(body.tui)) return patchError("tui must be an object");
 		const tuiPatch = body.tui;
-		if (tuiPatch.defaultAgent !== void 0) if (tuiPatch.defaultAgent === null) {
-			config.tui = { ...config.tui };
-			delete config.tui.defaultAgent;
-		} else {
+		const catalog = new AgentCatalogService();
+		if (tuiPatch.defaultAgent !== void 0) if (tuiPatch.defaultAgent === null) catalog.clearSurfaceDefault("tui");
+		else {
 			if (typeof tuiPatch.defaultAgent !== "string" || !tuiPatch.defaultAgent.trim()) return patchError("tui.defaultAgent must be a non-empty string");
-			const result = setTuiDefaultAgentConfig(config, tuiPatch.defaultAgent);
-			if (result.ok === false) return patchError(result.message);
-			config.tui = result.config.tui;
+			try {
+				catalog.setSurfaceDefault("tui", tuiPatch.defaultAgent);
+			} catch (error) {
+				return patchError(error instanceof Error ? error.message : String(error));
+			}
 		}
 	}
 	if (body.browser !== void 0) {
@@ -212,9 +215,13 @@ async function applyMiscPatch(config, body) {
 	}
 	if (body.bindings !== void 0) {
 		if (!Array.isArray(body.bindings)) return patchError("bindings must be an array");
-		const parsed = BindingsConfigSchema.safeParse(body.bindings);
+		const parsed = BindingsSchema.safeParse(body.bindings);
 		if (!parsed.success) return patchError(parsed.error.issues.map((i) => i.message).join("; "));
-		config.bindings = parsed.data;
+		try {
+			new AgentCatalogService().replaceBindings(parsed.data);
+		} catch (error) {
+			return patchError(error instanceof Error ? error.message : String(error));
+		}
 	}
 	if (body.mcp !== void 0) if (body.mcp === null) delete config.mcp;
 	else if (typeof body.mcp !== "object" || Array.isArray(body.mcp)) return patchError("mcp must be an object");