@xopcai/xopc 0.0.350 → 0.0.352

package/dist/src/connectors/connection-recovery-service.js

@@ -7,18 +7,18 @@ import { getConnectorAccount, init_connector_account_repository } from "../stora
 import { getConnectorConnection, getConnectorInstallation, init_connector_repository, listConnectorConnections, upsertConnectorInstallation } from "../storage/sqlite/connector-repository.js";
 import { cancelConnectionObjective, getActiveConnectionWait, getConnectionWait, init_connection_wait_repository, listConnectionWaitsToCheck, publishConnectionWait, queueConnectionResolution, updateConnectionWait } from "../storage/sqlite/connection-wait-repository.js";
 import { init_session_repository } from "../storage/sqlite/session-repository.js";
-import { canAccessConnectorAccount, currentAccountConnections } from "./account-access.js";
 import { getCliAdapter } from "./cli/adapterRegistry.js";
+import { canAccessConnectorAccount, currentAccountConnections } from "./account-access.js";
 import { ComposioSessionsAdapter } from "./composio-sessions.js";
 import { getConfiguredComposioAuthConfigs, isComposioActionAllowedByCatalog, scopeForComposioAction } from "./composio.js";
 import { getConnectorDefinition } from "./catalog.js";
 import { getInstalledConnectorDefinition, listConnectorInstances } from "./instances.js";
-import { describeCliAction, verifyCliConnection } from "./cli/runtime.js";
-import { connectorPrincipalForSession } from "./principal.js";
-import { capabilityActions, isToolInputSchema, missingConnectionCapabilities } from "./connection-capabilities.js";
 import { installConnector } from "./install.js";
-import { resolveConnectionCandidate } from "./connection-candidates.js";
 import { persistConfigMutation } from "../config/config-mutation.js";
+import { resolveConnectionCandidate } from "./connection-candidates.js";
+import { capabilityActions, isToolInputSchema, missingConnectionCapabilities } from "./connection-capabilities.js";
+import { describeCliAction, verifyCliConnection } from "./cli/runtime.js";
+import { connectorPrincipalForSession } from "./principal.js";
 import { HostPluginMcpRecovery } from "./plugin-mcp-recovery.js";
 import { randomUUID } from "node:crypto";
 //#region src/connectors/connection-recovery-service.ts
@@ -102,6 +102,7 @@ var ConnectionRecoveryService = class {
 				const phase = !availability.available || need.connectionId && need.capabilityError ? "blocked" : need.connectionId === need.target.serverId ? "ready" : need.attempt && need.attempt.expiresAt > Date.now() ? "authorizing" : need.unavailable ? "reconnect" : "connect";
 				return {
 					...need,
+					authorizationMode: "desktop",
 					phase,
 					accounts: [],
 					alternatives: [],
@@ -127,6 +128,7 @@ var ConnectionRecoveryService = class {
 				const phase = !instance ? "install" : !digestMatches || unhealthy ? "blocked" : "ready";
 				return {
 					...need,
+					authorizationMode: "desktop",
 					...instance ? { connectionId: instance.instanceId } : {},
 					phase,
 					accounts: [],
@@ -136,6 +138,8 @@ var ConnectionRecoveryService = class {
 			}
 			const id = need.target.connectorId;
 			const instance = listConnectorInstances(this.deps.getConfig()).find((instance) => instance.connectorId === id);
+			const definition = (instance ? getInstalledConnectorDefinition(this.deps.getConfig(), instance.instanceId) : void 0) ?? getConnectorDefinition(id);
+			const authorizationMode = definition?.runtime.type === "composio" && definition.runtime.role === "toolkit" ? "browser" : "desktop";
 			const installation = getConnectorInstallation(`${id}-${wait.principalId}`);
 			const cli = instance?.materialized.type === "cli" ? getCliAdapter(instance.materialized.adapterId) : void 0;
 			const scopeBlocked = Math.max(1, ...need.capabilities.filter((capability) => cli || /^[A-Z]+_/.test(capability)).map((capability) => SCOPE_ORDER[cli ? cli.curatedActions[capability] ?? "read" : scopeForComposioAction(capability).scope])) > SCOPE_ORDER[installation?.maxScope ?? "read"];
@@ -166,6 +170,7 @@ var ConnectionRecoveryService = class {
 			})) : [];
 			return {
 				...need,
+				authorizationMode,
 				alternatives,
 				accountId: selected?.accountId ?? need.accountId,
 				connectionId: selected?.id ?? need.connectionId,

package/dist/src/connectors/health.js

@@ -2,8 +2,8 @@ import { init_connector_repository, listConnectorConnections } from "../storage/
 import { currentAccountConnections } from "./account-access.js";
 import { materializeConnectorMcpServer } from "./materialize.js";
 import { getConnectorInstance } from "./instances.js";
-import { describeCliAction, verifyCliConnection } from "./cli/runtime.js";
 import { getWorkspacePath } from "../config/workspace-path-helpers.js";
+import { describeCliAction, verifyCliConnection } from "./cli/runtime.js";
 import { listBundleMcpServerCapabilitiesForGateway } from "../agent/mcp/bundle-mcp-gateway.js";
 //#region src/connectors/health.ts
 init_connector_repository();

package/dist/src/connectors/plugin-mcp-recovery.js

@@ -1,7 +1,7 @@
+import { getWorkspacePath } from "../config/workspace-path-helpers.js";
 import { AgentPluginStore } from "../extensions/agent-plugins/store.js";
 import { savePluginAuthBinding } from "../extensions/agent-plugins/auth.js";
 import { loadMergedBundleMcpConfig } from "../agent/mcp/bundle-mcp-config.js";
-import { getWorkspacePath } from "../config/workspace-path-helpers.js";
 import { getMcpOAuthManager } from "../agent/mcp/oauth/mcp-oauth-manager.js";
 import { listBundleMcpServerCapabilitiesForGateway } from "../agent/mcp/bundle-mcp-gateway.js";
 //#region src/connectors/plugin-mcp-recovery.ts

package/dist/src/discussions/live-worker.js

@@ -1,8 +1,8 @@
 import { createLogger } from "../utils/logger/index.js";
 import { init_logger } from "../utils/logger.js";
 import { ObjectLinkService } from "../activity/service.js";
-import { transcribe } from "../voice/stt/transcribe-core.js";
 import { isSTTAvailable } from "../voice/stt/availability.js";
+import { transcribe } from "../voice/stt/transcribe-core.js";
 import { mergeSttConfigFromAppConfig } from "../voice/stt/config.js";
 import "../voice/stt/index.js";
 import { claimNextDiscussionTranscriptSegment, completeDiscussionTranscriptSegment, getDiscussionCapture, listDiscussionTranscriptSegments, retryOrFailDiscussionTranscriptSegment, updateDiscussionCapture } from "./repository.js";

package/dist/src/discussions/recording.js

@@ -1,9 +1,9 @@
 import { getSqliteDatabase, init_transaction, runSqliteWriteTransaction } from "../storage/sqlite/transaction.js";
 import { DISCUSSION_MAX_DURATION_MS } from "../../packages/gateway-contract/src/discussions.js";
 import { init_src } from "../../packages/gateway-contract/src/index.js";
-import { resolveNoteMediaDir } from "../notes/paths.js";
 import { DiscussionServiceError } from "./errors.js";
 import { getDiscussionCapture, updateDiscussionCapture } from "./repository.js";
+import { resolveNoteMediaDir } from "../notes/paths.js";
 import { decodeWavToMonoFloat32 } from "../voice/audio/wav.js";
 import { forEachNormalizedAudioSegment } from "../voice/audio/normalize.js";
 import { join } from "node:path";

package/dist/src/discussions/sealer.js

@@ -1,7 +1,7 @@
 import { createLogger } from "../utils/logger/index.js";
 import { init_logger } from "../utils/logger.js";
-import { transcribe } from "../voice/stt/transcribe-core.js";
 import { isSTTAvailable } from "../voice/stt/availability.js";
+import { transcribe } from "../voice/stt/transcribe-core.js";
 import { mergeSttConfigFromAppConfig } from "../voice/stt/config.js";
 import "../voice/stt/index.js";
 import { getDiscussionCapture, listDiscussionCaptures, listDiscussionTranscriptSegments, updateDiscussionCapture } from "./repository.js";

package/dist/src/extensions/activation-context.js

@@ -1,12 +1,12 @@
 import { getAgentDefaultModelRef, init_schema } from "../config/schema.js";
 import { PROVIDER_ENV_MAP, init_env_keys } from "../providers/env-keys.js";
 import { init_providers, isProviderConfiguredSync } from "../providers/index.js";
-import { collectSttProviderConfigEntries } from "../voice/stt/config-slice.js";
-import { mergeSttConfigFromAppConfig } from "../voice/stt/config.js";
-import "../voice/stt/index.js";
 import { collectTtsProviderConfigEntries } from "../voice/tts/config-slice.js";
 import { isProviderConfigured } from "../voice/tts/factory.js";
 import { mergeTtsConfigFromAppConfig } from "../voice/tts/merge-config.js";
+import { collectSttProviderConfigEntries } from "../voice/stt/config-slice.js";
+import { mergeSttConfigFromAppConfig } from "../voice/stt/config.js";
+import "../voice/stt/index.js";
 import { isSttProviderConfigured } from "../voice/stt/list-providers.js";
 //#region src/extensions/activation-context.ts
 init_providers();

package/dist/src/extensions/agent-plugins/validation.js

@@ -1,8 +1,8 @@
 import { dirname, isAbsolute, join, relative, resolve } from "node:path";
 import { existsSync, lstatSync, readFileSync, readdirSync, realpathSync, statSync } from "node:fs";
 import { z } from "zod";
-import { validateHeaderName, validateHeaderValue } from "node:http";
 import yaml from "js-yaml";
+import { validateHeaderName, validateHeaderValue } from "node:http";
 //#region src/extensions/agent-plugins/validation.ts
 const PLUGIN_SCHEMA = "https://agent-plugins.org/schemas/1.0.0/plugin.schema.json";
 const MCP_SCHEMA = "https://agent-plugins.org/schemas/1.0.0/mcp.schema.json";

package/dist/src/extensions/api.js

@@ -1,14 +1,14 @@
 import { createLogger } from "../utils/logger/index.js";
 import { init_logger } from "../utils/logger.js";
 import { getProviderRegistry, init_plugin_registry } from "../providers/plugin-registry.js";
-import { registerMarketplaceAdapter, unregisterMarketplaceAdapter } from "../agent/skills/marketplace/registry.js";
-import { registerMediaUnderstandingProvider } from "../media-understanding/registry.js";
+import { registerMigration } from "../migrations/registry.js";
 import { registerSpeechProvider } from "../voice/tts/speech-registry.js";
-import { HOOK_EXECUTION_MODES } from "./types/hooks.js";
+import { registerMediaUnderstandingProvider } from "../media-understanding/registry.js";
 import { commandRegistry } from "../chat-commands/registry.js";
+import { HOOK_EXECUTION_MODES } from "./types/hooks.js";
 import { TypedEventBus } from "./typed-event-bus.js";
 import { ExtensionRegistryImpl } from "./extension-registry-impl.js";
-import { registerMigration } from "../migrations/registry.js";
+import { registerMarketplaceAdapter, unregisterMarketplaceAdapter } from "../agent/skills/marketplace/registry.js";
 import { isAbsolute, resolve } from "path";
 import { EventEmitter } from "events";
 //#region src/extensions/api.ts

package/dist/src/extensions/bundled-extension-activation.js

@@ -1,5 +1,5 @@
-import { ActivationPlanner } from "./activation-planner.js";
 import { mergeActivationContext } from "./activation-context.js";
+import { ActivationPlanner } from "./activation-planner.js";
 //#region src/extensions/bundled-extension-activation.ts
 function asSurfaceConfig(config) {
 	return config;

package/dist/src/extensions/index.js

@@ -1,14 +1,14 @@
 import { normalizeExtensionManifest } from "./normalize-manifest.js";
 import { areExtensionsGloballyDisabled, discoverExtensionsFromDisk } from "./discover-extensions.js";
+import { ManifestRegistry } from "./manifest-registry.js";
+import { buildExtensionMetadataSnapshot, resolveExtensionLoaderOptionsFromConfig } from "./extension-metadata-snapshot.js";
+import { collectConfiguredChannelIds, collectConfiguredProviderIds, mergeActivationContext } from "./activation-context.js";
 import { HOOK_EXECUTION_MODES } from "./types/hooks.js";
 import { BUILTIN_PROVIDERS } from "./types/providers.js";
 import { ExtensionRegistryImpl } from "./extension-registry-impl.js";
 import { ExtensionApiImpl, createExtensionLogger, createPathResolver } from "./api.js";
 import { ActivationPlanner } from "./activation-planner.js";
-import { collectConfiguredChannelIds, collectConfiguredProviderIds, mergeActivationContext } from "./activation-context.js";
-import { ManifestRegistry } from "./manifest-registry.js";
 import { ExtensionLoader, normalizeExtensionConfig, resolveExtensionPath } from "./loader.js";
 import { listOnboardChannels, listOnboardProviders, resolveProviderForModel } from "./onboard-helpers.js";
-import { buildExtensionMetadataSnapshot, resolveExtensionLoaderOptionsFromConfig } from "./extension-metadata-snapshot.js";
 import { ExtensionHookRunner, createHookContext, isHookEvent } from "./hooks.js";
 export { ActivationPlanner, BUILTIN_PROVIDERS, ExtensionApiImpl, ExtensionHookRunner, ExtensionLoader, ExtensionRegistryImpl, HOOK_EXECUTION_MODES, ManifestRegistry, areExtensionsGloballyDisabled, buildExtensionMetadataSnapshot, collectConfiguredChannelIds, collectConfiguredProviderIds, createExtensionLogger, createHookContext, createPathResolver, discoverExtensionsFromDisk, isHookEvent, listOnboardChannels, listOnboardProviders, mergeActivationContext, normalizeExtensionConfig, normalizeExtensionManifest, resolveExtensionLoaderOptionsFromConfig, resolveExtensionPath, resolveProviderForModel };

package/dist/src/extensions/install.js

@@ -10,8 +10,8 @@ import { dirname, isAbsolute, join, resolve, sep } from "path";
 import { cpSync, existsSync, mkdirSync, mkdtempSync, readFileSync, readdirSync, rmSync, writeFileSync } from "fs";
 import { execFileSync } from "node:child_process";
 import semver from "semver";
-import AdmZip from "adm-zip";
 import { tmpdir } from "os";
+import AdmZip from "adm-zip";
 //#region src/extensions/install.ts
 /**
 * Extension Installation Module

package/dist/src/extensions/loader.js

@@ -6,11 +6,11 @@ import { init_paths, resolveBundledExtensionsDir, resolveExtensionSdkPath, resol
 import { getProviderRegistry, init_plugin_registry } from "../providers/plugin-registry.js";
 import { normalizeExtensionManifest } from "./normalize-manifest.js";
 import { areExtensionsGloballyDisabled, discoverExtensionsFromDisk } from "./discover-extensions.js";
+import { ManifestRegistry } from "./manifest-registry.js";
+import { mergeActivationContext } from "./activation-context.js";
 import { ExtensionRegistryImpl } from "./extension-registry-impl.js";
 import { ExtensionApiImpl, createExtensionLogger, createPathResolver } from "./api.js";
 import { ActivationPlanner } from "./activation-planner.js";
-import { mergeActivationContext } from "./activation-context.js";
-import { ManifestRegistry } from "./manifest-registry.js";
 import { checkEngineCompatibility } from "./engine-check.js";
 import { validateSpeechProviderContracts } from "./speech-provider-contracts.js";
 import { validateMediaUnderstandingProviderContracts } from "./media-provider-contracts.js";

package/dist/src/extensions/sdk/index.js

@@ -1,4 +1,5 @@
 import { ProviderPluginRegistry, getProviderRegistry, init_plugin_registry } from "../../providers/plugin-registry.js";
+import { defineChannelPluginEntry } from "./channel-entry.js";
 import { HOOK_EXECUTION_MODES } from "../types/hooks.js";
 import { TypedEventBus } from "../typed-event-bus.js";
 import { ExtensionRegistryImpl } from "../extension-registry-impl.js";
@@ -7,7 +8,6 @@ import { DEFAULT_SECURITY_CONFIG, checkExtensionDirSafety, checkExtensionPathSaf
 import { SlotRegistry, getSlotRegistry, registerSlotType } from "../slots.js";
 import { ExtensionDiagnostics, ExtensionLoaderCacheImpl, getExtensionCache, getExtensionDiagnostics } from "../diagnostics.js";
 import { ExtensionHookRunner, createHookContext, isHookEvent } from "../hooks.js";
-import { defineChannelPluginEntry } from "./channel-entry.js";
 import { registerExtensionCliProgram } from "./channel-helpers.js";
 import { lazyFunction, lazyModule } from "./lazy.js";
 import { createMockExtensionApi, createTestGateway } from "./testing.js";

package/dist/src/extensions/sdk/media.js

@@ -1,7 +1,7 @@
-import { getMediaUnderstandingProvider, listMediaUnderstandingProviders, registerMediaUnderstandingProvider } from "../../media-understanding/registry.js";
 import { ProviderHttpError, assertOkOrThrowHttpError } from "../../media-shared/http/provider-http-errors.js";
 import { SsrfBlockedError, assertSafeUrl } from "../../media-shared/http/ssrf-guard.js";
 import { fetchWithTimeoutGuarded, normalizeBaseUrl, postMultipartRequest } from "../../media-shared/http/provider-http.js";
 import "../../media-shared/http/index.js";
+import { getMediaUnderstandingProvider, listMediaUnderstandingProviders, registerMediaUnderstandingProvider } from "../../media-understanding/registry.js";
 import { buildAudioTranscriptionFormData, createOpenAiCompatibleAudioProvider, registerOpenAiCompatibleAudioProvider, resolveAudioTranscriptionUploadFileName, transcribeOpenAiCompatibleAudio } from "../../media-understanding/openai-compatible-audio.js";
 export { ProviderHttpError, SsrfBlockedError, assertOkOrThrowHttpError, assertSafeUrl, buildAudioTranscriptionFormData, createOpenAiCompatibleAudioProvider, fetchWithTimeoutGuarded, getMediaUnderstandingProvider, listMediaUnderstandingProviders, normalizeBaseUrl, postMultipartRequest, registerMediaUnderstandingProvider, registerOpenAiCompatibleAudioProvider, resolveAudioTranscriptionUploadFileName, transcribeOpenAiCompatibleAudio };

package/dist/src/extensions/update.js

@@ -1,9 +1,9 @@
 import { createLogger } from "../utils/logger/index.js";
 import { init_logger } from "../utils/logger.js";
 import { init_paths, resolveBundledExtensionsDir, resolveExtensionsDir } from "../config/paths.js";
+import { loadConfig } from "../config/loader.js";
 import { downloadExtensionStoreZipBuffer, resolveExtensionZipDownloadUrl, resolveExtensionsStoreBaseUrl, verifyStoreArtifactSha256 } from "../agent/skills/marketplace/adapters/store/store-api-client.js";
 import { computeExtensionDirectoryIntegrity, getExtensionLockfileManager } from "./lockfile.js";
-import { loadConfig } from "../config/loader.js";
 import { commitStagedExtensionInstall, finalizeStagedExtensionInstall, rollbackStagedExtensionInstall, stageExtensionNpm, stageExtensionStoreZip } from "./install-transaction.js";
 import { findExtension } from "./marketplace.js";
 import { join } from "node:path";

package/dist/src/gateway/agents-admin.d.ts

@@ -64,6 +64,7 @@ export type UpdateAgentBody = {
     setDefault?: boolean;
     skills?: SkillOverride | null;
     tools?: AgentEntry['tools'] | null;
+    toolAllowlist?: AgentEntry['toolAllowlist'] | null;
     workflows?: AgentEntry['workflows'] | null;
     runtime?: AgentEntry['runtime'] | null;
 };

package/dist/src/gateway/agents-admin.js

@@ -1,12 +1,12 @@
 import { normalizeAgentId, validateAgentIdForNewAgent } from "../agent-catalog/id.js";
 import { AgentCatalogRepository, init_repository } from "../agent-catalog/repository.js";
 import { init_agent_scope, listAgentEntries, resolveAgentProfileDir, resolveAgentWorkspaceDir, resolveDefaultAgentId, resolveUserPath } from "../agent/agent-scope.js";
-import { resolveEffectiveAgentProfile } from "../config/agent-profile.js";
 import { WORKSPACE_FILES, init_paths } from "../config/paths.js";
 import { AGENT_PROFILE_MARKDOWN_SYSTEM_FILES, REQUIRED_AGENT_PROFILE_MARKDOWN_FILE_SET } from "../agent/context/workspace.js";
-import { isPathUnderWorkspace, resolveWorkspaceSafePath } from "./workspace-editor-path.js";
 import { AgentCatalogService } from "../agent-catalog/service.js";
+import { resolveEffectiveAgentProfile } from "../config/agent-profile.js";
 import { GATEWAY_BUILTIN_TOOL_IDS } from "./agent-builtin-tools.js";
+import { isPathUnderWorkspace, resolveWorkspaceSafePath } from "./workspace-editor-path.js";
 import { join, resolve } from "node:path";
 import { mkdir, readFile, realpath, stat, unlink, writeFile } from "node:fs/promises";
 //#region src/gateway/agents-admin.ts
@@ -153,6 +153,7 @@ async function updateGatewayAgent(agentIdRaw, body) {
 	if (body.models !== void 0) patch.models = body.models ?? void 0;
 	if (body.skills !== void 0) patch.skills = body.skills ?? void 0;
 	if (body.tools !== void 0) patch.tools = body.tools ?? void 0;
+	if (body.toolAllowlist !== void 0) patch.toolAllowlist = body.toolAllowlist ?? void 0;
 	if (body.workflows !== void 0) patch.workflows = body.workflows ?? void 0;
 	if (body.runtime !== void 0) patch.runtime = body.runtime ?? void 0;
 	try {

package/dist/src/gateway/device-routes.js

@@ -1,6 +1,6 @@
-import { getTunnelService } from "../tunnel/tunnel-service.js";
-import { resolveReverseProxyPublicUrl } from "./public-url.js";
 import { getTailscaleExposureState } from "./tailscale-lifecycle.js";
+import { resolveReverseProxyPublicUrl } from "./public-url.js";
+import { getTunnelService } from "../tunnel/tunnel-service.js";
 import crypto from "node:crypto";
 //#region src/gateway/device-routes.ts
 function secureUrl(value) {

package/dist/src/gateway/file-path-classifier.js

@@ -1,9 +1,9 @@
 import { init_paths_state, resolveStateDir } from "../config/paths-state.js";
 import { init_agent_scope, resolveAgentProfileDir } from "../agent/agent-scope.js";
-import { extractProfileAgentId } from "../config/agent-profile.js";
 import { init_paths, resolveConfigPath, resolveSkillsDir } from "../config/paths.js";
-import { isBareProfileMarkdownFileName, resolveProfileMarkdownPathIfBareName } from "../agent/tools/tool-paths.js";
+import { extractProfileAgentId } from "../config/agent-profile.js";
 import { isPathUnderWorkspace, resolveWorkspaceSafePath } from "./workspace-editor-path.js";
+import { isBareProfileMarkdownFileName, resolveProfileMarkdownPathIfBareName } from "../agent/tools/tool-paths.js";
 import { basename, isAbsolute, resolve } from "node:path";
 import { stat } from "node:fs/promises";
 //#region src/gateway/file-path-classifier.ts

package/dist/src/gateway/global-defaults-admin.js

@@ -2,8 +2,8 @@ import { AgentDefaultsSchema } from "../agent-config/schema.js";
 import { init_agent_config } from "../agent-config/index.js";
 import { AgentCatalogRepository, init_repository } from "../agent-catalog/repository.js";
 import { AgentCatalogService } from "../agent-catalog/service.js";
-import { GATEWAY_BUILTIN_TOOLS } from "./agent-builtin-tools.js";
 import { validateComputerModelChange } from "../computer/model-config.js";
+import { GATEWAY_BUILTIN_TOOLS } from "./agent-builtin-tools.js";
 import { isDeepStrictEqual } from "node:util";
 //#region src/gateway/global-defaults-admin.ts
 init_agent_config();

package/dist/src/gateway/hono/app.js

@@ -2,13 +2,13 @@ import { createLogger } from "../../utils/logger/index.js";
 import { init_logger } from "../../utils/logger.js";
 import { init_device_access_repository, listDevices } from "../../storage/sqlite/device-access-repository.js";
 import { ENDPOINT_MAX_FILE_BYTES, init_src } from "../../../packages/endpoint-tools-protocol/src/index.js";
+import { BROWSER_EXTENSION_ID } from "../../browser/extension-identity.js";
 import { resolveAllowedBrowserOrigins, resolveGatewayServiceListenPort } from "../host.js";
 import { resolveGatewayEffectiveHost } from "../../config/gateway-bind.js";
-import { loadTunnelState } from "../../tunnel/tunnel-state.js";
-import { resolveReverseProxyPublicUrl } from "../public-url.js";
 import { maxSessionInputRequestBodyBytes } from "../chat-limits.js";
-import { BROWSER_EXTENSION_ID } from "../../browser/extension-identity.js";
 import { isLoopbackIpAddress, isTrustedProxyAddress } from "../client-ip.js";
+import { resolveReverseProxyPublicUrl } from "../public-url.js";
+import { loadTunnelState } from "../../tunnel/tunnel-state.js";
 import { buildGatewayConsoleCspHeader } from "../security/csp.js";
 import { checkBrowserOrigin, isChromeExtensionOrigin } from "../security/origin-check.js";
 import { auth } from "./middleware/auth.js";

package/dist/src/gateway/hono/lib/config-payload.js

@@ -1,19 +1,19 @@
 import { normalizeAgentId } from "../../../agent-catalog/id.js";
 import { AgentCatalogRepository, init_repository } from "../../../agent-catalog/repository.js";
-import { ContextPlanningConfigSchema, KnowledgeMemoryConfigSchema, UserModelConfigSchema, init_config } from "../../../user-context/config.js";
 import { init_agent_scope, listAgentEntries, resolveDefaultAgentId } from "../../../agent/agent-scope.js";
 import { resolveModelsJsonPath } from "../../../config/paths.js";
+import { ContextPlanningConfigSchema, KnowledgeMemoryConfigSchema, UserModelConfigSchema, init_config } from "../../../user-context/config.js";
 import { init_models_json, loadModelsJson } from "../../../config/models-json.js";
 import { CredentialResolver, init_credentials } from "../../../auth/credentials.js";
 import { getProviderRegistry, init_plugin_registry } from "../../../providers/plugin-registry.js";
 import { getAllProviders, init_providers, isProviderConfigured } from "../../../providers/index.js";
-import { normalizeConfiguredMcpServers } from "../../../config/mcp-config-normalize.js";
-import { resolveShareConfig } from "../../../share/share-config.js";
-import { maskTunnelSecretForWeb } from "../../../tunnel/env.js";
 import { buildChannelCatalogForConfig, buildChannelCatalogFromSnapshot, getChannelSetupStatus } from "../../../channels/catalog/channel-catalog-service.js";
+import { normalizeConfiguredMcpServers } from "../../../config/mcp-config-normalize.js";
 import { resolveSessionConfigForWeb, resolveUpdateConfigForWeb } from "../../../config/web-patch.js";
 import { GENERIC_MASKED_SECRET, maskSecretLength } from "./mask-secret-length.js";
 import { safeToolsWebForGet } from "../../config-tools-web.js";
+import { maskTunnelSecretForWeb } from "../../../tunnel/env.js";
+import { resolveShareConfig } from "../../../share/share-config.js";
 import { buildSafeProvidersConfigForWeb } from "./safe-providers-config.js";
 import { maskRealtimeVoiceConfigForWeb, maskSttConfigForWeb, maskTtsConfigForWeb } from "./safe-voice-config.js";
 //#region src/gateway/hono/lib/config-payload.ts

package/dist/src/gateway/hono/routes/agents.js

@@ -1,9 +1,9 @@
-import { AgentModelsOverrideSchema, AgentProfileSchema, RuntimePolicySchema, SkillOverrideSchema, ToolPoliciesSchema, WorkflowPolicySchema } from "../../../agent-config/schema.js";
+import { AgentEntrySchema, AgentModelsOverrideSchema, AgentProfileSchema, RuntimePolicySchema, SkillOverrideSchema, ToolPoliciesSchema, WorkflowPolicySchema } from "../../../agent-config/schema.js";
 import { init_agent_config } from "../../../agent-config/index.js";
 import { normalizeAgentId } from "../../../agent-catalog/id.js";
 import { init_agent_scope } from "../../../agent/agent-scope.js";
-import { createGatewayAgent, deleteAgentAvatarFile, deleteGatewayAgent, getGatewayAgentEffectiveConfig, listAgentProfileFiles, listGatewayAgents, readAgentAvatarFile, readAgentProfileFile, updateGatewayAgent, writeAgentAvatarFromBase64, writeAgentProfileFile } from "../../agents-admin.js";
 import { getVoiceModelsConfig } from "../../../config/voice.js";
+import { createGatewayAgent, deleteAgentAvatarFile, deleteGatewayAgent, getGatewayAgentEffectiveConfig, listAgentProfileFiles, listGatewayAgents, readAgentAvatarFile, readAgentProfileFile, updateGatewayAgent, writeAgentAvatarFromBase64, writeAgentProfileFile } from "../../agents-admin.js";
 //#region src/gateway/hono/routes/agents.ts
 init_agent_config();
 init_agent_scope();
@@ -105,6 +105,7 @@ function registerAgentsRoutes(authenticated, deps) {
 			"models",
 			"skills",
 			"tools",
+			"toolAllowlist",
 			"workflows",
 			"runtime",
 			"setDefault"
@@ -132,6 +133,11 @@ function registerAgentsRoutes(authenticated, deps) {
 			ok: false,
 			error: { message: "tools must be an object or null" }
 		}, 400);
+		const toolAllowlistPatch = body.toolAllowlist === null ? null : Object.hasOwn(body, "toolAllowlist") ? AgentEntrySchema.shape.toolAllowlist.safeParse(body.toolAllowlist) : void 0;
+		if (toolAllowlistPatch && toolAllowlistPatch !== null && !toolAllowlistPatch.success) return c.json({
+			ok: false,
+			error: { message: `toolAllowlist ${toolAllowlistPatch.error.issues[0]?.message ?? "is invalid"}` }
+		}, 400);
 		const modelsPatch = Object.hasOwn(body, "models") ? parsePatchModels(body.models) : void 0;
 		if (isParseError(modelsPatch)) return c.json({
 			ok: false,
@@ -166,6 +172,7 @@ function registerAgentsRoutes(authenticated, deps) {
 			setDefault: body.setDefault === true,
 			...skillsPatch !== void 0 ? { skills: skillsPatch === null ? null : skillsPatch.data } : {},
 			...toolsPatch !== void 0 ? { tools: toolsPatch } : {},
+			...toolAllowlistPatch !== void 0 ? { toolAllowlist: toolAllowlistPatch === null ? null : toolAllowlistPatch.data } : {},
 			...workflowsPatch !== void 0 ? { workflows: workflowsPatch === null ? null : workflowsPatch.data } : {},
 			...runtimePatch !== void 0 ? { runtime: runtimePatch === null ? null : runtimePatch.data } : {}
 		});

package/dist/src/gateway/hono/routes/auth-registry-extensions.js

@@ -1,6 +1,6 @@
 import { getAllModels, getAvailableModels, init_providers } from "../../../providers/index.js";
-import { ActivationPlanner } from "../../../extensions/activation-planner.js";
 import { mergeActivationContext } from "../../../extensions/activation-context.js";
+import { ActivationPlanner } from "../../../extensions/activation-planner.js";
 import { validateExtensionConfig } from "../../../extensions/config-validation.js";
 import { fetchRegistry, listExtensions, searchExtensions } from "../../../extensions/marketplace.js";
 import { createOAuthAsyncHandler } from "../oauth-async.js";

package/dist/src/gateway/hono/routes/browser.js

@@ -2,8 +2,8 @@ import { deleteBrowserTabBinding, getBrowserTabBinding, init_browser_tab_binding
 import { browserTabBindingRequestSchema } from "../../../../packages/gateway-contract/src/browser-tab-binding.js";
 import { init_src } from "../../../../packages/gateway-contract/src/index.js";
 import { getDevice, init_device_access_repository } from "../../../storage/sqlite/device-access-repository.js";
-import "../../../../packages/browser-control-contract/src/index.js";
 import { decideBrowserApproval, listBrowserApprovals } from "../../../browser/policy/approval-store.js";
+import "../../../../packages/browser-control-contract/src/index.js";
 import { createBrowserDriver } from "../../../browser/drivers/create-driver.js";
 import { checkBrowserReadiness } from "../../../browser/readiness.js";
 import { isLoopbackClientIp } from "../../security/loopback.js";

package/dist/src/gateway/hono/routes/commands-skills.js

@@ -1,15 +1,15 @@
 import { init_agent_scope, resolveDefaultAgentId } from "../../../agent/agent-scope.js";
+import { commandRegistry } from "../../../chat-commands/registry.js";
 import { resolveEffectiveAgentProfile } from "../../../config/agent-profile.js";
 import { effectiveWorkspacePathForSession, projectWorkspacePath } from "../../../session/session-workspace.js";
 import { getProjectForSession } from "../../../projects/workspace.js";
-import { ProjectService } from "../../../projects/project-service.js";
+import { buildReviewContext, resolveGitRoot } from "../../../review/review-git.js";
+import "../../../chat-commands/index.js";
 import { isRegisteredProvider } from "../../../agent/skills/marketplace/registry.js";
+import { ProjectService } from "../../../projects/project-service.js";
 import "../../../agent/skills/skills-marketplace.js";
 import "../../../projects/index.js";
 import { isSkillInstallTarget } from "../../../agent/skills/install-target.js";
-import { commandRegistry } from "../../../chat-commands/registry.js";
-import { buildReviewContext, resolveGitRoot } from "../../../review/review-git.js";
-import "../../../chat-commands/index.js";
 //#region src/gateway/hono/routes/commands-skills.ts
 init_agent_scope();
 function parseMarketplaceProviderQuery(raw) {

package/dist/src/gateway/hono/routes/config-patch/gateway.js

@@ -1,8 +1,8 @@
 import { init_public_url, validatePublicUrl } from "../../../../config/public-url.js";
 import { isValidIPv4 } from "../../../../config/gateway-bind.js";
+import { isMaskedSecretPatchValue } from "../../lib/mask-secret-length.js";
 import { mergeShareConfigPatch } from "../../../../share/share-config.js";
 import { mergeSiteShareConfigPatch } from "../../../../share/site-share-config.js";
-import { isMaskedSecretPatchValue } from "../../lib/mask-secret-length.js";
 import { PATCH_OK, patchError } from "./result.js";
 //#region src/gateway/hono/routes/config-patch/gateway.ts
 init_public_url();

package/dist/src/gateway/hono/routes/config-patch/misc.js

@@ -1,10 +1,10 @@
-import { ComputerConfigSchema, init_config } from "../../../../computer/config.js";
 import { BindingsSchema, init_binding_schema } from "../../../../routing/binding-schema.js";
+import { AgentCatalogService } from "../../../../agent-catalog/service.js";
+import { ComputerConfigSchema, init_config } from "../../../../computer/config.js";
 import { ContextPlanningConfigSchema, HomeIntelligenceConfigSchema, KnowledgeMemoryConfigSchema, UserContextConfigSchema, UserModelConfigSchema, init_config as init_config$1 } from "../../../../user-context/config.js";
 import { BrowserConfigSchema, McpConfigSchema, VoiceConfigSchema, init_schema } from "../../../../config/schema.js";
 import { CredentialResolver, init_credentials } from "../../../../auth/credentials.js";
 import { canonicalizeConfiguredMcpServer } from "../../../../config/mcp-config-normalize.js";
-import { AgentCatalogService } from "../../../../agent-catalog/service.js";
 import { mergeGatewaySkillsMarketplacePatch, mergeSessionConfigPatch, mergeUpdateConfigPatch } from "../../../../config/web-patch.js";
 import { assertGatewayAuthConfigured, resolveGatewayAuth } from "../../../auth.js";
 import { isMaskedSecretPatchValue } from "../../lib/mask-secret-length.js";

package/dist/src/gateway/hono/routes/device-push.js

@@ -30,7 +30,7 @@ function parsePreferences(value) {
 	return result;
 }
 function parsePlatform(value) {
-	return value === "ios" || value === "android" || value === "harmonyos" ? value : null;
+	return value === "harmonyos" ? value : null;
 }
 function parsePermission(value) {
 	return value === "granted" || value === "denied" || value === "unknown" ? value : null;

package/dist/src/gateway/hono/routes/home.js

@@ -3,9 +3,9 @@ import { init_src } from "../../../../packages/gateway-contract/src/index.js";
 import { acknowledgeHomeAttention } from "../../../storage/sqlite/home-attention-repository.js";
 import { decideConnectorApproval } from "../../../storage/sqlite/connector-repository.js";
 import { init_sqlite } from "../../../storage/sqlite/index.js";
+import { resumeApprovedConnectorAction } from "../../../connectors/approval-resume.js";
 import { listGatewayAgents } from "../../agents-admin.js";
 import { HomeQueryService, buildHomeWorkbench, decisionFromTask } from "../../../tasks/home-query-service.js";
-import { resumeApprovedConnectorAction } from "../../../connectors/approval-resume.js";
 import { HomeOpportunityActionError, HomeOpportunityNotFoundError } from "../../../home-intelligence/application-service.js";
 //#region src/gateway/hono/routes/home.ts
 init_src();

package/dist/src/gateway/hono/routes/mcp.js

@@ -1,9 +1,9 @@
 import { isManagedConnectorServer } from "../../../connectors/materialize.js";
-import { AgentPluginStore } from "../../../extensions/agent-plugins/store.js";
+import { getWorkspacePath } from "../../../config/workspace-path-helpers.js";
 import { canonicalizeConfiguredMcpServer, normalizeConfiguredMcpServers } from "../../../config/mcp-config-normalize.js";
+import { AgentPluginStore } from "../../../extensions/agent-plugins/store.js";
 import { savePluginAuthBinding } from "../../../extensions/agent-plugins/auth.js";
 import { loadMergedBundleMcpConfig } from "../../../agent/mcp/bundle-mcp-config.js";
-import { getWorkspacePath } from "../../../config/workspace-path-helpers.js";
 import { getMcpOAuthManager } from "../../../agent/mcp/oauth/mcp-oauth-manager.js";
 import { listBundleMcpResourcesForGateway, listBundleMcpServerCapabilitiesForGateway, listBundleMcpServerToolsForGateway } from "../../../agent/mcp/bundle-mcp-gateway.js";
 //#region src/gateway/hono/routes/mcp.ts

package/dist/src/gateway/hono/routes/media.js

@@ -1,6 +1,6 @@
+import { MAX_WEBCHAT_ATTACHMENT_FILE_BYTES } from "../../chat-limits.js";
 import { mimeTypeFromMediaPath, saveMediaBuffer } from "../../../media/store.js";
 import { readMediaReference } from "../../../media/media-reference.js";
-import { MAX_WEBCHAT_ATTACHMENT_FILE_BYTES } from "../../chat-limits.js";
 import { createGatewayRouteLogger } from "../lib/route-logger.js";
 import { resolveScopedMediaReference } from "../../media-access.js";
 //#region src/gateway/hono/routes/media.ts

package/dist/src/gateway/hono/routes/models.js

@@ -1,4 +1,3 @@
-import { resolveEffectiveAgentConfigForAgent } from "../../../config/agent-profile.js";
 import { resolveModelsJsonPath } from "../../../config/paths.js";
 import { init_resolve_config_value, testApiKeyResolution } from "../../../config/resolve-config-value.js";
 import { computerModelProfile, init_model_policy, isDedicatedComputerModel } from "../../../computer/model-policy.js";
@@ -9,13 +8,14 @@ import { CredentialResolver, init_credentials } from "../../../auth/credentials.
 import "../../../providers/constants.js";
 import { getProviderRegistry, init_plugin_registry } from "../../../providers/plugin-registry.js";
 import { PROVIDER_META, getAllModels, getAllProviders, getAvailableModels, getProviderAuthState, init_providers, isProviderConfigured, isProviderConfiguredSync } from "../../../providers/index.js";
-import { buildCapabilityPlansForConfig } from "../../../capabilities/readiness/from-config.js";
-import "../../../capabilities/readiness/index.js";
+import { resolveEffectiveAgentConfigForAgent } from "../../../config/agent-profile.js";
+import { deleteCustomImageProvider, listCustomImageProviders, upsertCustomImageProvider } from "../../custom-image-providers.js";
 import { getImageGenerationProvider, reloadImageGenerationProviders, resolveImageGenerationCredentialMode } from "../../../agent/image/generation/provider-registry.js";
+import { applyImageGenerationCatalogUpdate, getAgentImageGenerationConfig, getDefaultImageGenerationConfig, getImageGenerationCatalog, prepareDefaultImageGenerationSetup, prepareImageGenerationSetup, verifyImageGenerationCredential } from "../../image-generation-setup.js";
 import { SessionConfigStore } from "../../../session/config-store.js";
+import { buildCapabilityPlansForConfig } from "../../../capabilities/readiness/from-config.js";
+import "../../../capabilities/readiness/index.js";
 import { getModelThinking } from "../../../providers/model-thinking.js";
-import { deleteCustomImageProvider, listCustomImageProviders, upsertCustomImageProvider } from "../../custom-image-providers.js";
-import { applyImageGenerationCatalogUpdate, getAgentImageGenerationConfig, getDefaultImageGenerationConfig, getImageGenerationCatalog, prepareDefaultImageGenerationSetup, prepareImageGenerationSetup, verifyImageGenerationCredential } from "../../image-generation-setup.js";
 import { discoverProviderModels, isProviderApiDiscoverable } from "../../../providers/model-discovery.js";
 import { getXopcCloudCatalogCoordinator } from "../../../providers/xopc-cloud-catalog-coordinator.js";
 import { respondStartupUnavailable } from "../lib/startup-unavailable.js";

package/dist/src/gateway/hono/routes/notes.js

@@ -1,13 +1,13 @@
 import { NoteDeleteOutputSchema, NoteGetOutputSchema, ProductReadContracts } from "../../../../packages/gateway-contract/src/capabilities.js";
 import { init_src } from "../../../../packages/gateway-contract/src/index.js";
-import { init_session_key, resolveConversationId } from "../../../routing/session-key.js";
-import { agentExists, getDefaultAgentId, init_resolve_route } from "../../../routing/resolve-route.js";
 import { CapabilityError } from "../../../capabilities/runtime/errors.js";
 import "../../../capabilities/runtime/dispatcher.js";
+import { init_session_key, resolveConversationId } from "../../../routing/session-key.js";
+import { agentExists, getDefaultAgentId, init_resolve_route } from "../../../routing/resolve-route.js";
 import { resolveGatewayEffectiveHost } from "../../../config/gateway-bind.js";
+import { resolveReverseProxyPublicUrl } from "../../public-url.js";
 import { getShareStore } from "../../../share/share-store.js";
 import { resolveShareUrl } from "../../../share/share-url.js";
-import { resolveReverseProxyPublicUrl } from "../../public-url.js";
 import { createProductDispatcher } from "../../../capabilities/runtime/product.js";
 import { getGatewayPrincipal } from "../../security/gateway-principal.js";
 import { capabilityHttpContext, capabilityHttpError } from "../../../capabilities/adapters/http.js";

package/dist/src/gateway/hono/routes/projects.js

@@ -7,12 +7,13 @@ import { loadTranscriptRowsForSession } from "../../../storage/sqlite/transcript
 import { init_sqlite } from "../../../storage/sqlite/index.js";
 import { ActivityService } from "../../../activity/service.js";
 import "../../../activity/index.js";
+import { CapabilityError } from "../../../capabilities/runtime/errors.js";
+import "../../../capabilities/runtime/dispatcher.js";
 import { resolveEffectiveAgentProfile } from "../../../config/agent-profile.js";
-import { TaskReadModelProjector } from "../../../tasks/task-read-model-projector.js";
 import { listKnowledgeItems, writeKnowledgeItem } from "../../../knowledge-memory/repository.js";
 import "../../../knowledge-memory/index.js";
-import { CapabilityError } from "../../../capabilities/runtime/errors.js";
-import "../../../capabilities/runtime/dispatcher.js";
+import { TaskReadModelProjector } from "../../../tasks/task-read-model-projector.js";
+import { TaskApplicationService } from "../../../tasks/task-application-service.js";
 import { ProjectWorkspaceConflictError, ProjectWorkspaceMissingError } from "../../../projects/workspace-project.js";
 import { inferProjectExecutionMode, inferProjectKind } from "../../../projects/project-kind.js";
 import { ProjectDeletionBlockedError, ProjectWorkspaceInUseError } from "../../../projects/project-service.js";
@@ -20,7 +21,6 @@ import { resolveProjectAgentId } from "../../../projects/project-agent.js";
 import { inferSuggestedProjectDefaultAgentId } from "../../../projects/project-agent-suggestion.js";
 import { buildProjectLoopOverview } from "../../../projects/project-loop.js";
 import "../../../projects/index.js";
-import { TaskApplicationService } from "../../../tasks/task-application-service.js";
 import { createProductDispatcher } from "../../../capabilities/runtime/product.js";
 import { defineTaskContract } from "../../../tasks/task-contract-definition.js";
 import { ProjectOperatingViewService, summarizeProjectOperatingView } from "../../../tasks/project-operating-view-service.js";