@xopcai/xopc 0.0.351 → 0.0.353

package/dist/src/config/schema.d.ts

@@ -492,21 +492,6 @@ export declare const GatewayModeSchema: z.ZodDefault<z.ZodEnum<{
     local: "local";
     remote: "remote";
 }>>;
-export declare const HeartbeatConfigSchema: z.ZodDefault<z.ZodObject<{
-    enabled: z.ZodBoolean;
-    intervalMs: z.ZodNumber;
-    includeSystemPromptSection: z.ZodDefault<z.ZodOptional<z.ZodBoolean>>;
-    target: z.ZodOptional<z.ZodString>;
-    targetChatId: z.ZodOptional<z.ZodString>;
-    prompt: z.ZodOptional<z.ZodString>;
-    ackMaxChars: z.ZodOptional<z.ZodNumber>;
-    isolatedSession: z.ZodOptional<z.ZodBoolean>;
-    activeHours: z.ZodOptional<z.ZodObject<{
-        start: z.ZodString;
-        end: z.ZodString;
-        timezone: z.ZodOptional<z.ZodString>;
-    }, z.core.$strip>>;
-}, z.core.$strip>>;
 export declare const GatewayChannelConnectDeferModeSchema: z.ZodEnum<{
     explicit: "explicit";
     off: "off";
@@ -634,21 +619,6 @@ export declare const GatewayConfigSchema: z.ZodDefault<z.ZodObject<{
             allowLoopback: z.ZodOptional<z.ZodBoolean>;
         }, z.core.$strict>>;
     }, z.core.$strip>>>;
-    heartbeat: z.ZodPreprocess<z.ZodOptional<z.ZodDefault<z.ZodObject<{
-        enabled: z.ZodBoolean;
-        intervalMs: z.ZodNumber;
-        includeSystemPromptSection: z.ZodDefault<z.ZodOptional<z.ZodBoolean>>;
-        target: z.ZodOptional<z.ZodString>;
-        targetChatId: z.ZodOptional<z.ZodString>;
-        prompt: z.ZodOptional<z.ZodString>;
-        ackMaxChars: z.ZodOptional<z.ZodNumber>;
-        isolatedSession: z.ZodOptional<z.ZodBoolean>;
-        activeHours: z.ZodOptional<z.ZodObject<{
-            start: z.ZodString;
-            end: z.ZodString;
-            timezone: z.ZodOptional<z.ZodString>;
-        }, z.core.$strip>>;
-    }, z.core.$strip>>>>;
     webchat: z.ZodOptional<z.ZodDefault<z.ZodObject<{
         activityDetailDefault: z.ZodDefault<z.ZodEnum<{
             stream: "stream";
@@ -1498,21 +1468,6 @@ export declare const ConfigSchema: z.ZodDefault<z.ZodObject<{
                 allowLoopback: z.ZodOptional<z.ZodBoolean>;
             }, z.core.$strict>>;
         }, z.core.$strip>>>;
-        heartbeat: z.ZodPreprocess<z.ZodOptional<z.ZodDefault<z.ZodObject<{
-            enabled: z.ZodBoolean;
-            intervalMs: z.ZodNumber;
-            includeSystemPromptSection: z.ZodDefault<z.ZodOptional<z.ZodBoolean>>;
-            target: z.ZodOptional<z.ZodString>;
-            targetChatId: z.ZodOptional<z.ZodString>;
-            prompt: z.ZodOptional<z.ZodString>;
-            ackMaxChars: z.ZodOptional<z.ZodNumber>;
-            isolatedSession: z.ZodOptional<z.ZodBoolean>;
-            activeHours: z.ZodOptional<z.ZodObject<{
-                start: z.ZodString;
-                end: z.ZodString;
-                timezone: z.ZodOptional<z.ZodString>;
-            }, z.core.$strip>>;
-        }, z.core.$strip>>>>;
         webchat: z.ZodOptional<z.ZodDefault<z.ZodObject<{
             activityDetailDefault: z.ZodDefault<z.ZodEnum<{
                 stream: "stream";

package/dist/src/config/schema.js

@@ -41,7 +41,7 @@ function parseModelRef(ref) {
 		model: trimmed.slice(idx + 1).trim()
 	};
 }
-var AgentModelRefSchema, AgentImageGenerationModelSchema, AgentModelsSchema, BrowserDriverSchema, BrowserHostnameSchema, BrowserConfigSchema, SessionDmScopeSchema, SessionStorageConfigSchema, SessionResetModeSchema, SessionResetConfigSchema, SessionResetByTypeSchema, SessionScopeSchema, SessionConfigSchema, ChannelsConfigSchema, SearchProviderEntrySchema, WebSearchConfigSchema, WebsiteBlocklistSchema, WebToolsConfigSchema, ToolsConfigSchema, RuntimePreferenceSchema, RuntimeProvisionSchema, RuntimeVersionRequestSchema, LanguageRuntimeSchema, DEFAULT_RUNTIME_TOOLS_CONFIG, RuntimeToolsConfigSchema, GatewayAuthRateLimitSchema, GatewaySecuritySchema, GatewayTrustedProxySchema, GatewayAuthSchema, GatewayTailscaleConsentSchema, GatewayTailscaleSchema, GatewayRemoteSchema, GatewayTlsSchema, GatewayModeSchema, HeartbeatConfigSchema, GatewayChannelConnectDeferModeSchema, TunnelConsentSchema, TunnelConfigSchema, WorkspaceImportConfigSchema, WorkspaceConfigSchema, GatewayBindModeSchema, GatewayWebchatConfigSchema, GatewayScenesConfigSchema, GatewayConfigSchema, ModelsDevConfigSchema, ModelCatalogConfigSchema, SttProviderConfigCatchallSchema, STTProviderConfigSchema, STTFallbackConfigSchema, MediaUnderstandingCapabilitiesSchema, MediaUnderstandingModelSchema, STTConfigSchema, TtsProviderConfigCatchallSchema, TTSProviderConfigSchema, TTSFallbackConfigSchema, TTSModelOverridesConfigSchema, TTSEdgeConfigSchema, TTSSummarizationConfigSchema, TTSConfigSchema, VoiceRefinementConfigSchema, VoiceConfigSchema, MessagesConfigSchema, ToolsMediaAudioConfigSchema, ToolsMediaConfigSchema, ProviderAzureConfigSchema, ProviderRequestOverridesSchema, ProviderAuthConfigSchema, ProvidersConfigSchema, ExtensionSecurityConfigSchema, ExtensionSlotsConfigSchema, ExtensionsConfigSchema, UpdateAutoConfigSchema, UpdateConfigSchema, CommandsConfigSchema, McpHttpUrlSchema, ConnectorSecretReferenceSchema, McpConfigScalarSchema, McpOAuthConfigSchema, McpServerSchema, McpConfigSchema, ConnectorsConfigSchema, ExperimentalConfigSchema, ConfigSchema;
+var AgentModelRefSchema, AgentImageGenerationModelSchema, AgentModelsSchema, BrowserDriverSchema, BrowserHostnameSchema, BrowserConfigSchema, SessionDmScopeSchema, SessionStorageConfigSchema, SessionResetModeSchema, SessionResetConfigSchema, SessionResetByTypeSchema, SessionScopeSchema, SessionConfigSchema, ChannelsConfigSchema, SearchProviderEntrySchema, WebSearchConfigSchema, WebsiteBlocklistSchema, WebToolsConfigSchema, ToolsConfigSchema, RuntimePreferenceSchema, RuntimeProvisionSchema, RuntimeVersionRequestSchema, LanguageRuntimeSchema, DEFAULT_RUNTIME_TOOLS_CONFIG, RuntimeToolsConfigSchema, GatewayAuthRateLimitSchema, GatewaySecuritySchema, GatewayTrustedProxySchema, GatewayAuthSchema, GatewayTailscaleConsentSchema, GatewayTailscaleSchema, GatewayRemoteSchema, GatewayTlsSchema, GatewayModeSchema, GatewayChannelConnectDeferModeSchema, TunnelConsentSchema, TunnelConfigSchema, WorkspaceImportConfigSchema, WorkspaceConfigSchema, GatewayBindModeSchema, GatewayWebchatConfigSchema, GatewayScenesConfigSchema, GatewayConfigSchema, ModelsDevConfigSchema, ModelCatalogConfigSchema, SttProviderConfigCatchallSchema, STTProviderConfigSchema, STTFallbackConfigSchema, MediaUnderstandingCapabilitiesSchema, MediaUnderstandingModelSchema, STTConfigSchema, TtsProviderConfigCatchallSchema, TTSProviderConfigSchema, TTSFallbackConfigSchema, TTSModelOverridesConfigSchema, TTSEdgeConfigSchema, TTSSummarizationConfigSchema, TTSConfigSchema, VoiceRefinementConfigSchema, VoiceConfigSchema, MessagesConfigSchema, ToolsMediaAudioConfigSchema, ToolsMediaConfigSchema, ProviderAzureConfigSchema, ProviderRequestOverridesSchema, ProviderAuthConfigSchema, ProvidersConfigSchema, ExtensionSecurityConfigSchema, ExtensionSlotsConfigSchema, ExtensionsConfigSchema, UpdateAutoConfigSchema, UpdateConfigSchema, CommandsConfigSchema, McpHttpUrlSchema, ConnectorSecretReferenceSchema, McpConfigScalarSchema, McpOAuthConfigSchema, McpServerSchema, McpConfigSchema, ConnectorsConfigSchema, ExperimentalConfigSchema, ConfigSchema;
 var init_schema = __esmMin((() => {
 	init_config();
 	init_agent_config();
@@ -382,26 +382,6 @@ strict: z.boolean().optional() }).optional();
 		autoGenerate: false
 	});
 	GatewayModeSchema = z.enum(["local", "remote"]).default("local");
-	HeartbeatConfigSchema = z.object({
-		enabled: z.boolean(),
-		intervalMs: z.number(),
-		/** When false, heartbeat instructions are only sent during heartbeat polling turns (not in every chat system prompt). */
-		includeSystemPromptSection: z.boolean().optional().default(false),
-		target: z.string().optional(),
-		targetChatId: z.string().optional(),
-		prompt: z.string().optional(),
-		ackMaxChars: z.number().optional(),
-		isolatedSession: z.boolean().optional(),
-		activeHours: z.object({
-			start: z.string(),
-			end: z.string(),
-			timezone: z.string().optional()
-		}).optional()
-	}).default({
-		enabled: true,
-		intervalMs: 18e5,
-		includeSystemPromptSection: false
-	});
 	GatewayChannelConnectDeferModeSchema = z.enum([
 		"auto",
 		"off",
@@ -463,7 +443,6 @@ enabled: z.boolean().default(false) }).default({ enabled: false });
 		tailscale: GatewayTailscaleSchema.optional(),
 		tls: GatewayTlsSchema.optional(),
 		auth: GatewayAuthSchema.optional(),
-		heartbeat: z.preprocess(() => void 0, HeartbeatConfigSchema.optional()),
 		webchat: GatewayWebchatConfigSchema.optional(),
 		scenes: GatewayScenesConfigSchema.optional(),
 		corsOrigins: z.array(z.string()).optional(),
@@ -1143,4 +1122,4 @@ workDiscoveryOnboarding: z.boolean().default(true) }).strict().default({ workDis
 }));
 //#endregion
 init_schema();
-export { AgentImageGenerationModelSchema, AgentModelRefSchema, AgentModelsSchema, BrowserConfigSchema, ChannelsConfigSchema, CommandsConfigSchema, ConfigSchema, ConnectorsConfigSchema, ExperimentalConfigSchema, ExtensionSecurityConfigSchema, ExtensionSlotsConfigSchema, ExtensionsConfigSchema, GatewayAuthRateLimitSchema, GatewayAuthSchema, GatewayBindModeSchema, GatewayChannelConnectDeferModeSchema, GatewayConfigSchema, GatewayModeSchema, GatewayRemoteSchema, GatewayScenesConfigSchema, GatewaySecuritySchema, GatewayTailscaleConsentSchema, GatewayTailscaleSchema, GatewayTlsSchema, GatewayTrustedProxySchema, GatewayWebchatConfigSchema, HeartbeatConfigSchema, McpConfigSchema, McpOAuthConfigSchema, McpServerSchema, MediaUnderstandingCapabilitiesSchema, MediaUnderstandingModelSchema, MessagesConfigSchema, ModelCatalogConfigSchema, ModelsDevConfigSchema, ProviderAuthConfigSchema, ProviderAzureConfigSchema, ProviderRequestOverridesSchema, ProvidersConfigSchema, RuntimeToolsConfigSchema, STTConfigSchema, STTFallbackConfigSchema, STTProviderConfigSchema, SearchProviderEntrySchema, SessionConfigSchema, SessionDmScopeSchema, SessionResetByTypeSchema, SessionResetConfigSchema, SessionResetModeSchema, SessionScopeSchema, SessionStorageConfigSchema, TTSConfigSchema, TTSEdgeConfigSchema, TTSFallbackConfigSchema, TTSModelOverridesConfigSchema, TTSProviderConfigSchema, TTSSummarizationConfigSchema, TelegramAccountConfigSchema, TelegramConfigSchema, TelegramGroupConfigSchema, TelegramTopicConfigSchema, ToolsConfigSchema, ToolsMediaAudioConfigSchema, ToolsMediaConfigSchema, TunnelConfigSchema, TunnelConsentSchema, UpdateAutoConfigSchema, UpdateConfigSchema, VoiceConfigSchema, VoiceRefinementConfigSchema, WebSearchConfigSchema, WebToolsConfigSchema, WebsiteBlocklistSchema, WeixinAccountConfigSchema, WeixinConfigSchema, WorkspaceConfigSchema, WorkspaceImportConfigSchema, getAgentDefaultImageGenerationModelConfig, getAgentDefaultImageModelConfig, getAgentDefaultModelRef, init_schema, parseModelRef };
+export { AgentImageGenerationModelSchema, AgentModelRefSchema, AgentModelsSchema, BrowserConfigSchema, ChannelsConfigSchema, CommandsConfigSchema, ConfigSchema, ConnectorsConfigSchema, ExperimentalConfigSchema, ExtensionSecurityConfigSchema, ExtensionSlotsConfigSchema, ExtensionsConfigSchema, GatewayAuthRateLimitSchema, GatewayAuthSchema, GatewayBindModeSchema, GatewayChannelConnectDeferModeSchema, GatewayConfigSchema, GatewayModeSchema, GatewayRemoteSchema, GatewayScenesConfigSchema, GatewaySecuritySchema, GatewayTailscaleConsentSchema, GatewayTailscaleSchema, GatewayTlsSchema, GatewayTrustedProxySchema, GatewayWebchatConfigSchema, McpConfigSchema, McpOAuthConfigSchema, McpServerSchema, MediaUnderstandingCapabilitiesSchema, MediaUnderstandingModelSchema, MessagesConfigSchema, ModelCatalogConfigSchema, ModelsDevConfigSchema, ProviderAuthConfigSchema, ProviderAzureConfigSchema, ProviderRequestOverridesSchema, ProvidersConfigSchema, RuntimeToolsConfigSchema, STTConfigSchema, STTFallbackConfigSchema, STTProviderConfigSchema, SearchProviderEntrySchema, SessionConfigSchema, SessionDmScopeSchema, SessionResetByTypeSchema, SessionResetConfigSchema, SessionResetModeSchema, SessionScopeSchema, SessionStorageConfigSchema, TTSConfigSchema, TTSEdgeConfigSchema, TTSFallbackConfigSchema, TTSModelOverridesConfigSchema, TTSProviderConfigSchema, TTSSummarizationConfigSchema, TelegramAccountConfigSchema, TelegramConfigSchema, TelegramGroupConfigSchema, TelegramTopicConfigSchema, ToolsConfigSchema, ToolsMediaAudioConfigSchema, ToolsMediaConfigSchema, TunnelConfigSchema, TunnelConsentSchema, UpdateAutoConfigSchema, UpdateConfigSchema, VoiceConfigSchema, VoiceRefinementConfigSchema, WebSearchConfigSchema, WebToolsConfigSchema, WebsiteBlocklistSchema, WeixinAccountConfigSchema, WeixinConfigSchema, WorkspaceConfigSchema, WorkspaceImportConfigSchema, getAgentDefaultImageGenerationModelConfig, getAgentDefaultImageModelConfig, getAgentDefaultModelRef, init_schema, parseModelRef };

package/dist/src/connectors/connection-recovery-service.js

@@ -102,6 +102,7 @@ var ConnectionRecoveryService = class {
 				const phase = !availability.available || need.connectionId && need.capabilityError ? "blocked" : need.connectionId === need.target.serverId ? "ready" : need.attempt && need.attempt.expiresAt > Date.now() ? "authorizing" : need.unavailable ? "reconnect" : "connect";
 				return {
 					...need,
+					authorizationMode: "desktop",
 					phase,
 					accounts: [],
 					alternatives: [],
@@ -127,6 +128,7 @@ var ConnectionRecoveryService = class {
 				const phase = !instance ? "install" : !digestMatches || unhealthy ? "blocked" : "ready";
 				return {
 					...need,
+					authorizationMode: "desktop",
 					...instance ? { connectionId: instance.instanceId } : {},
 					phase,
 					accounts: [],
@@ -136,6 +138,8 @@ var ConnectionRecoveryService = class {
 			}
 			const id = need.target.connectorId;
 			const instance = listConnectorInstances(this.deps.getConfig()).find((instance) => instance.connectorId === id);
+			const definition = (instance ? getInstalledConnectorDefinition(this.deps.getConfig(), instance.instanceId) : void 0) ?? getConnectorDefinition(id);
+			const authorizationMode = definition?.runtime.type === "composio" && definition.runtime.role === "toolkit" ? "browser" : "desktop";
 			const installation = getConnectorInstallation(`${id}-${wait.principalId}`);
 			const cli = instance?.materialized.type === "cli" ? getCliAdapter(instance.materialized.adapterId) : void 0;
 			const scopeBlocked = Math.max(1, ...need.capabilities.filter((capability) => cli || /^[A-Z]+_/.test(capability)).map((capability) => SCOPE_ORDER[cli ? cli.curatedActions[capability] ?? "read" : scopeForComposioAction(capability).scope])) > SCOPE_ORDER[installation?.maxScope ?? "read"];
@@ -166,6 +170,7 @@ var ConnectionRecoveryService = class {
 			})) : [];
 			return {
 				...need,
+				authorizationMode,
 				alternatives,
 				accountId: selected?.accountId ?? need.accountId,
 				connectionId: selected?.id ?? need.connectionId,

package/dist/src/extensions/lockfile.js

@@ -1,7 +1,7 @@
 import { createLogger } from "../utils/logger/index.js";
 import { init_logger } from "../utils/logger.js";
-import { init_paths, resolveExtensionsDir, resolveExtensionsLockPath } from "../config/paths.js";
 import { init_write_file_atomic, writeTextAtomic } from "../infra/write-file-atomic.js";
+import { init_paths, resolveExtensionsDir, resolveExtensionsLockPath } from "../config/paths.js";
 import { dirname, join } from "path";
 import { existsSync, lstatSync, readFileSync, readdirSync, readlinkSync } from "fs";
 import { mkdir, readFile } from "fs/promises";

package/dist/src/gateway/agents-admin.d.ts

@@ -7,7 +7,7 @@ export type GatewayAgentRow = {
     name?: string;
     description?: string;
     language?: string;
-    /** Value from `IDENTITY.md` **Avatar:** line when present (may be URL, `xopc:…`, etc.). */
+    /** Avatar reference from the structured Agent profile. */
     avatar?: string;
     workspace: string;
     /** Absolute directory for profile Markdown (`SOUL.md`, …) and gateway avatars: `agents/<id>/profile/`. */
@@ -26,14 +26,6 @@ export type GatewayAgentEffectiveConfigResponse = {
     config: EffectiveAgentConfig;
     sources: Record<string, 'system' | 'global' | 'agent'>;
 };
-/** Extract `**Avatar:**` value from profile IDENTITY.md (same line shape as the gateway console parser). */
-export declare function extractAvatarFromIdentityMarkdown(content: string): string | undefined;
-export declare function parseIdentityMarkdown(content: string): {
-    name?: string;
-    description?: string;
-    language?: string;
-    avatar?: string;
-};
 export declare function listGatewayAgents(_options?: {
     locale?: string;
 }): Promise<GatewayAgentsListResponse>;
@@ -64,6 +56,7 @@ export type UpdateAgentBody = {
     setDefault?: boolean;
     skills?: SkillOverride | null;
     tools?: AgentEntry['tools'] | null;
+    toolAllowlist?: AgentEntry['toolAllowlist'] | null;
     workflows?: AgentEntry['workflows'] | null;
     runtime?: AgentEntry['runtime'] | null;
 };

package/dist/src/gateway/agents-admin.js

@@ -1,13 +1,12 @@
 import { normalizeAgentId, validateAgentIdForNewAgent } from "../agent-catalog/id.js";
 import { AgentCatalogRepository, init_repository } from "../agent-catalog/repository.js";
 import { init_agent_scope, listAgentEntries, resolveAgentProfileDir, resolveAgentWorkspaceDir, resolveDefaultAgentId, resolveUserPath } from "../agent/agent-scope.js";
-import { WORKSPACE_FILES, init_paths } from "../config/paths.js";
 import { AGENT_PROFILE_MARKDOWN_SYSTEM_FILES, REQUIRED_AGENT_PROFILE_MARKDOWN_FILE_SET } from "../agent/context/workspace.js";
 import { AgentCatalogService } from "../agent-catalog/service.js";
 import { resolveEffectiveAgentProfile } from "../config/agent-profile.js";
 import { isPathUnderWorkspace, resolveWorkspaceSafePath } from "./workspace-editor-path.js";
 import { GATEWAY_BUILTIN_TOOL_IDS } from "./agent-builtin-tools.js";
-import { join, resolve } from "node:path";
+import { resolve } from "node:path";
 import { mkdir, readFile, realpath, stat, unlink, writeFile } from "node:fs/promises";
 //#region src/gateway/agents-admin.ts
 /**
@@ -15,7 +14,6 @@ import { mkdir, readFile, realpath, stat, unlink, writeFile } from "node:fs/prom
 */
 init_agent_scope();
 init_repository();
-init_paths();
 const EDITABLE_PROFILE_MARKDOWN_NAMES = new Set([...AGENT_PROFILE_MARKDOWN_SYSTEM_FILES]);
 function collectAgentIdsForList() {
 	const entries = listAgentEntries().filter((e) => e.enabled !== false);
@@ -26,26 +24,6 @@ function collectAgentIdsForList() {
 	ids.add(defaultId);
 	return [...ids];
 }
-/** Extract `**Avatar:**` value from profile IDENTITY.md (same line shape as the gateway console parser). */
-function extractAvatarFromIdentityMarkdown(content) {
-	return parseIdentityMarkdown(content).avatar || void 0;
-}
-function parseIdentityMarkdown(content) {
-	const out = {};
-	for (const line of content.split("\n")) {
-		const match = line.match(/^[-*]\s+\*\*(Name|Description|Language|Avatar):\*\*\s*(.*)/i);
-		if (match) {
-			const key = match[1]?.toLowerCase();
-			const v = match[2]?.trim() ?? "";
-			if (!v || /^_\(.*\)_$/.test(v)) continue;
-			if (key === "name") out.name = v;
-			if (key === "description") out.description = v;
-			if (key === "language") out.language = v;
-			if (key === "avatar") out.avatar = v;
-		}
-	}
-	return out;
-}
 async function listGatewayAgents(_options = {}) {
 	const defaultId = resolveDefaultAgentId();
 	const agents = [];
@@ -53,16 +31,13 @@ async function listGatewayAgents(_options = {}) {
 		const profile = resolveEffectiveAgentProfile(id);
 		const entry = listAgentEntries().find((e) => normalizeAgentId(e.id) === id);
 		if (!entry) continue;
-		let identity = {};
-		try {
-			identity = parseIdentityMarkdown(await readFile(join(resolveAgentProfileDir(id), WORKSPACE_FILES.IDENTITY), "utf-8"));
-		} catch {}
+		const identity = entry.profile;
 		agents.push({
 			id,
-			name: entry.profile?.name ?? identity.name ?? id,
-			...identity.description ? { description: identity.description } : {},
-			...identity.language ? { language: identity.language } : {},
-			...identity.avatar ? { avatar: identity.avatar } : {},
+			name: identity?.name ?? id,
+			...identity?.description ? { description: identity.description } : {},
+			...identity?.language ? { language: identity.language } : {},
+			...identity?.avatar ? { avatar: identity.avatar } : {},
 			workspace: profile.resolvedWorkspacePath,
 			profileDir: resolveAgentProfileDir(id),
 			override: structuredClone(entry),
@@ -153,6 +128,7 @@ async function updateGatewayAgent(agentIdRaw, body) {
 	if (body.models !== void 0) patch.models = body.models ?? void 0;
 	if (body.skills !== void 0) patch.skills = body.skills ?? void 0;
 	if (body.tools !== void 0) patch.tools = body.tools ?? void 0;
+	if (body.toolAllowlist !== void 0) patch.toolAllowlist = body.toolAllowlist ?? void 0;
 	if (body.workflows !== void 0) patch.workflows = body.workflows ?? void 0;
 	if (body.runtime !== void 0) patch.runtime = body.runtime ?? void 0;
 	try {
@@ -459,4 +435,4 @@ async function deleteAgentAvatarFile(agentId) {
 	};
 }
 //#endregion
-export { createGatewayAgent, deleteAgentAvatarFile, deleteGatewayAgent, extractAvatarFromIdentityMarkdown, getGatewayAgentEffectiveConfig, listAgentProfileFiles, listGatewayAgents, parseIdentityMarkdown, readAgentAvatarFile, readAgentProfileFile, updateGatewayAgent, writeAgentAvatarFromBase64, writeAgentProfileFile };
+export { createGatewayAgent, deleteAgentAvatarFile, deleteGatewayAgent, getGatewayAgentEffectiveConfig, listAgentProfileFiles, listGatewayAgents, readAgentAvatarFile, readAgentProfileFile, updateGatewayAgent, writeAgentAvatarFromBase64, writeAgentProfileFile };

package/dist/src/gateway/file-path-classifier.js

@@ -1,7 +1,7 @@
 import { init_paths_state, resolveStateDir } from "../config/paths-state.js";
 import { init_agent_scope, resolveAgentProfileDir } from "../agent/agent-scope.js";
-import { init_paths, resolveConfigPath, resolveSkillsDir } from "../config/paths.js";
 import { extractProfileAgentId } from "../config/agent-profile.js";
+import { init_paths, resolveConfigPath, resolveSkillsDir } from "../config/paths.js";
 import { isBareProfileMarkdownFileName, resolveProfileMarkdownPathIfBareName } from "../agent/tools/tool-paths.js";
 import { isPathUnderWorkspace, resolveWorkspaceSafePath } from "./workspace-editor-path.js";
 import { basename, isAbsolute, resolve } from "node:path";

package/dist/src/gateway/hono/lib/config-payload.js

@@ -1,8 +1,8 @@
 import { normalizeAgentId } from "../../../agent-catalog/id.js";
 import { AgentCatalogRepository, init_repository } from "../../../agent-catalog/repository.js";
 import { init_agent_scope, listAgentEntries, resolveDefaultAgentId } from "../../../agent/agent-scope.js";
-import { resolveModelsJsonPath } from "../../../config/paths.js";
 import { ContextPlanningConfigSchema, KnowledgeMemoryConfigSchema, UserModelConfigSchema, init_config } from "../../../user-context/config.js";
+import { resolveModelsJsonPath } from "../../../config/paths.js";
 import { init_models_json, loadModelsJson } from "../../../config/models-json.js";
 import { CredentialResolver, init_credentials } from "../../../auth/credentials.js";
 import { getProviderRegistry, init_plugin_registry } from "../../../providers/plugin-registry.js";

package/dist/src/gateway/hono/routes/agents.js

@@ -1,4 +1,4 @@
-import { AgentModelsOverrideSchema, AgentProfileSchema, RuntimePolicySchema, SkillOverrideSchema, ToolPoliciesSchema, WorkflowPolicySchema } from "../../../agent-config/schema.js";
+import { AgentEntrySchema, AgentModelsOverrideSchema, AgentProfileSchema, RuntimePolicySchema, SkillOverrideSchema, ToolPoliciesSchema, WorkflowPolicySchema } from "../../../agent-config/schema.js";
 import { init_agent_config } from "../../../agent-config/index.js";
 import { normalizeAgentId } from "../../../agent-catalog/id.js";
 import { init_agent_scope } from "../../../agent/agent-scope.js";
@@ -105,6 +105,7 @@ function registerAgentsRoutes(authenticated, deps) {
 			"models",
 			"skills",
 			"tools",
+			"toolAllowlist",
 			"workflows",
 			"runtime",
 			"setDefault"
@@ -132,6 +133,11 @@ function registerAgentsRoutes(authenticated, deps) {
 			ok: false,
 			error: { message: "tools must be an object or null" }
 		}, 400);
+		const toolAllowlistPatch = body.toolAllowlist === null ? null : Object.hasOwn(body, "toolAllowlist") ? AgentEntrySchema.shape.toolAllowlist.safeParse(body.toolAllowlist) : void 0;
+		if (toolAllowlistPatch && toolAllowlistPatch !== null && !toolAllowlistPatch.success) return c.json({
+			ok: false,
+			error: { message: `toolAllowlist ${toolAllowlistPatch.error.issues[0]?.message ?? "is invalid"}` }
+		}, 400);
 		const modelsPatch = Object.hasOwn(body, "models") ? parsePatchModels(body.models) : void 0;
 		if (isParseError(modelsPatch)) return c.json({
 			ok: false,
@@ -166,6 +172,7 @@ function registerAgentsRoutes(authenticated, deps) {
 			setDefault: body.setDefault === true,
 			...skillsPatch !== void 0 ? { skills: skillsPatch === null ? null : skillsPatch.data } : {},
 			...toolsPatch !== void 0 ? { tools: toolsPatch } : {},
+			...toolAllowlistPatch !== void 0 ? { toolAllowlist: toolAllowlistPatch === null ? null : toolAllowlistPatch.data } : {},
 			...workflowsPatch !== void 0 ? { workflows: workflowsPatch === null ? null : workflowsPatch.data } : {},
 			...runtimePatch !== void 0 ? { runtime: runtimePatch === null ? null : runtimePatch.data } : {}
 		});

package/dist/src/gateway/hono/routes/connectors.js

@@ -20,6 +20,7 @@ import { createConnectorSetupSecretRequest, submitConnectorSetupSecret } from ".
 import { recordConnectorHealthUsage } from "../../../connectors/usage.js";
 import { getConnectorInstance, getInstalledConnectorDefinition, listConnectorInstances } from "../../../connectors/instances.js";
 import { installConnector, installConnectorDefinition, uninstallConnector, updateConnectorConfig } from "../../../connectors/install.js";
+import { ConfigPersistenceError, persistConfigMutation } from "../../../config/config-mutation.js";
 import { resumeApprovedConnectorAction } from "../../../connectors/approval-resume.js";
 import { getMcpOAuthManager } from "../../../agent/mcp/oauth/mcp-oauth-manager.js";
 import { startConnectorAuthorization } from "../../../connectors/auth-provider-registry.js";
@@ -28,7 +29,6 @@ import { inspectManagedComposioStatus } from "../../../connectors/composio-manag
 import { appendComposioTriggerEvent, listComposioTriggerEvents } from "../../../connectors/composio-triggers.js";
 import { ingestLocalFolderSource } from "../../../connectors/connected-source-ingestion.js";
 import { listUnderstandingSourceGrants, revokeUnderstandingSourceGrant } from "../../../user-context/sources/repository.js";
-import { ConfigPersistenceError, persistConfigMutation } from "../../../config/config-mutation.js";
 import { previewConnectorDefinition, testConnectorInstance } from "../../../connectors/health.js";
 import { setConnectorEnabled } from "../../../connectors/lifecycle.js";
 import { projectComposioConnectionStatus } from "../../../connectors/runtime-status.js";

package/dist/src/gateway/hono/routes/device-push.js

@@ -30,7 +30,7 @@ function parsePreferences(value) {
 	return result;
 }
 function parsePlatform(value) {
-	return value === "ios" || value === "android" || value === "harmonyos" ? value : null;
+	return value === "harmonyos" ? value : null;
 }
 function parsePermission(value) {
 	return value === "granted" || value === "denied" || value === "unknown" ? value : null;

package/dist/src/gateway/hono/routes/models.js

@@ -1,5 +1,5 @@
-import { resolveModelsJsonPath } from "../../../config/paths.js";
 import { resolveEffectiveAgentConfigForAgent } from "../../../config/agent-profile.js";
+import { resolveModelsJsonPath } from "../../../config/paths.js";
 import { init_resolve_config_value, testApiKeyResolution } from "../../../config/resolve-config-value.js";
 import { computerModelProfile, init_model_policy, isDedicatedComputerModel } from "../../../computer/model-policy.js";
 import { init_models_json, loadModelsJson, saveModelsJson, validateModelsConfig } from "../../../config/models-json.js";

package/dist/src/gateway/host.d.ts

@@ -4,8 +4,6 @@ export declare function isLoopbackHost(host: string | undefined): boolean;
 export declare function isAllInterfacesHost(host: string | undefined): boolean;
 /** Vite dev server origins for the gateway console (`web/` defaults to port 3000). */
 export declare const GATEWAY_DEV_CONSOLE_ORIGINS: readonly ["http://localhost:3000", "http://127.0.0.1:3000"];
-/** Expo / React Native web dev server (Metro defaults to port 8081). */
-export declare const GATEWAY_EXPO_DEV_ORIGINS: readonly ["http://localhost:8081", "http://127.0.0.1:8081"];
 export type LanGatewayCandidate = {
     url: string;
     address: string;

package/dist/src/gateway/host.js

@@ -15,9 +15,6 @@ function isAllInterfacesHost(host) {
 }
 /** Vite dev server origins for the gateway console (`web/` defaults to port 3000). */
 const GATEWAY_DEV_CONSOLE_ORIGINS = ["http://localhost:3000", "http://127.0.0.1:3000"];
-/** Expo / React Native web dev server (Metro defaults to port 8081). */
-const GATEWAY_EXPO_DEV_ORIGINS = ["http://localhost:8081", "http://127.0.0.1:8081"];
-const GATEWAY_LOOPBACK_DEV_ORIGINS = [...GATEWAY_DEV_CONSOLE_ORIGINS, ...GATEWAY_EXPO_DEV_ORIGINS];
 /** Non-internal IPv4 addresses that can serve this gateway on the local network. */
 function enumerateLanGatewayCandidates(port) {
 	const seen = /* @__PURE__ */ new Set();
@@ -47,7 +44,7 @@ function buildDefaultCorsOrigins(params) {
 	const origins = new Set([
 		`http://localhost:${params.port}`,
 		`http://127.0.0.1:${params.port}`,
-		...GATEWAY_LOOPBACK_DEV_ORIGINS
+		...GATEWAY_DEV_CONSOLE_ORIGINS
 	]);
 	const bindHost = params.bindHost?.trim();
 	if (bindHost && !isLoopbackHost(bindHost) && !isAllInterfacesHost(bindHost)) origins.add(`http://${bindHost}:${params.port}`);
@@ -90,4 +87,4 @@ function resolveAllowedBrowserOrigins(params) {
 	return origins;
 }
 //#endregion
-export { GATEWAY_DEV_CONSOLE_ORIGINS, GATEWAY_EXPO_DEV_ORIGINS, buildDefaultCorsOrigins, enumerateLanGatewayCandidates, isAllInterfacesHost, isLoopbackHost, originFromGatewayPublicUrl, resolveAllowedBrowserOrigins, resolveEffectiveGatewayPort, resolveGatewayCorsOrigins, resolveGatewayServiceListenPort };
+export { GATEWAY_DEV_CONSOLE_ORIGINS, buildDefaultCorsOrigins, enumerateLanGatewayCandidates, isAllInterfacesHost, isLoopbackHost, originFromGatewayPublicUrl, resolveAllowedBrowserOrigins, resolveEffectiveGatewayPort, resolveGatewayCorsOrigins, resolveGatewayServiceListenPort };

package/dist/src/gateway/service.js

@@ -18,13 +18,13 @@ import { getSessionConfig, init_config_repository } from "../storage/sqlite/conf
 import { init_sqlite } from "../storage/sqlite/index.js";
 import { normalizeAgentId } from "../agent-catalog/id.js";
 import { init_agent_scope, listAgentEntries, resolveAgentWorkspaceDir, resolveDefaultAgentId } from "../agent/agent-scope.js";
-import { init_paths, resolveConfigPath, resolveExtensionsDir } from "../config/paths.js";
 import { init_config, resolveKnowledgeReadPolicy } from "../user-context/config.js";
 import { getAgentDefaultModelRef, init_schema } from "../config/schema.js";
 import { init_agent_session_key, resolveAgentMainConversationId } from "../routing/agent-session-key.js";
 import { init_session_key, resolveConversationId, sanitizeSegment } from "../routing/session-key.js";
 import { getDefaultAgentId, init_resolve_route } from "../routing/resolve-route.js";
 import { resolveEffectiveAgentProfileForSession } from "../config/agent-profile.js";
+import { init_paths, resolveConfigPath, resolveExtensionsDir } from "../config/paths.js";
 import { prewarmModelRegistry } from "../providers/model-registry.js";
 import { init_providers, providers_exports } from "../providers/index.js";
 import { AI_USAGE_RETENTION_MS, markStaleAiUsageEventsUnknown, pruneAiUsageEvents } from "../storage/sqlite/ai-usage-repository.js";
@@ -74,12 +74,6 @@ import { ChatPreviewService } from "../chat-previews/service.js";
 import "../chat-previews/index.js";
 import { getWorkspacePath } from "../config/workspace-path-helpers.js";
 import "../config/index.js";
-import { ManagedComposioEventPoller } from "../connectors/composio-managed-events.js";
-import { startConnectedKnowledgeCoordinator } from "../knowledge/coordinator.js";
-import "../knowledge/index.js";
-import { ConnectionRecoveryService } from "../connectors/connection-recovery-service.js";
-import { startConnectorLearningCoordinator } from "../connectors/learning-coordinator.js";
-import { startConnectorSupervisor } from "../connectors/supervisor.js";
 import { DiscussionService } from "../discussions/service.js";
 import { DiscussionOrganizer } from "../discussions/organizer.js";
 import { DiscussionLiveWorker } from "../discussions/live-worker.js";
@@ -88,6 +82,16 @@ import { DiscussionSealer } from "../discussions/sealer.js";
 import "../discussions/index.js";
 import { EndpointToolRuntime } from "../endpoint-tools/runtime.js";
 import "../endpoint-tools/index.js";
+import { ManagedComposioEventPoller } from "../connectors/composio-managed-events.js";
+import { startConnectedKnowledgeCoordinator } from "../knowledge/coordinator.js";
+import "../knowledge/index.js";
+import { ConnectionRecoveryService } from "../connectors/connection-recovery-service.js";
+import { startConnectorLearningCoordinator } from "../connectors/learning-coordinator.js";
+import { startConnectorSupervisor } from "../connectors/supervisor.js";
+import { HomeCapabilityPreflightService } from "../home-intelligence/capability-preflight.js";
+import { HomeAdviceGenerator } from "../home-intelligence/generator.js";
+import { HomeIntelligenceHost } from "../home-intelligence/host.js";
+import { HomeSnapshotBuilder } from "../home-intelligence/snapshot.js";
 import { assertGatewayAuthConfigured, extractToken, resolveGatewayAuth, validateToken } from "./auth.js";
 import { prepareAutomationAgentSession } from "./automation-agent-session.js";
 import { stopTailscaleExposure } from "./tailscale-lifecycle.js";
@@ -149,10 +153,6 @@ import { TaskMainUpdateDecisionService } from "../tasks/task-main-update-decisio
 import { selectTaskMainUpdateAttempt, submitAndConfirmTaskMainUpdate } from "../tasks/task-main-update-input.js";
 import { checkAppContextAccess, prepareAppContext } from "./service/app-context-access.js";
 import { applyAutomaticVoiceLanguage, inferProductLanguageFromEnvironment, initializeVoiceDefaults } from "../voice/language-profile.js";
-import { HomeAdviceGenerator } from "../home-intelligence/generator.js";
-import { HomeIntelligenceHost } from "../home-intelligence/host.js";
-import { HomeSnapshotBuilder } from "../home-intelligence/snapshot.js";
-import { HomeCapabilityPreflightService } from "../home-intelligence/capability-preflight.js";
 import crypto from "node:crypto";
 //#region src/gateway/service.ts
 init_session_repository();

package/dist/src/home-intelligence/host.js

@@ -1,10 +1,10 @@
 import { createLogger } from "../utils/logger/index.js";
 import { init_logger } from "../utils/logger.js";
-import { HomeAdviceBudgetExceededError } from "./generator.js";
 import { homePatternKey } from "./strategy.js";
-import { HomeAdvicePolicy } from "./policy.js";
 import { HomeIntelligenceRepository } from "./repository.js";
 import { HomeOpportunityApplicationService } from "./application-service.js";
+import { HomeAdvicePolicy } from "./policy.js";
+import { HomeAdviceBudgetExceededError } from "./generator.js";
 import { buildHomeOpportunityNotification } from "./notification.js";
 import { createHash } from "node:crypto";
 //#region src/home-intelligence/host.ts

package/dist/src/infra/update-restart.js

@@ -2,8 +2,8 @@ import { createLogger } from "../utils/logger/index.js";
 import { init_logger } from "../utils/logger.js";
 import { init_paths, resolveConfigPath } from "../config/paths.js";
 import { loadConfig } from "../config/loader.js";
-import { resolveGatewayService } from "../daemon/service.js";
 import { isRestartEnabled } from "../config/commands.flags.js";
+import { resolveGatewayService } from "../daemon/service.js";
 import { authorizeGatewaySigusr1Restart, writeGatewayRestartIntentSync } from "./restart.js";
 import { findVerifiedGatewayListenerPidsOnPortSync, signalVerifiedGatewayPidSync } from "./gateway-processes.js";
 import { refreshGatewayServiceAfterUpdate } from "./update-service-refresh.js";

package/dist/src/notifications/device-store.d.ts

@@ -13,4 +13,3 @@ export declare function getNotificationDevice(deviceId: string): NotificationDev
 export declare function listDeliverableNotificationDevices(now?: number): NotificationDevice[];
 export declare function updateNotificationDevicePreferences(deviceId: string, patch: Partial<NotificationPreferences>): NotificationDevice | null;
 export declare function removeNotificationDevice(deviceId: string): boolean;
-export declare function disableNotificationDeviceForPushToken(pushToken: string): void;

package/dist/src/notifications/device-store.js

@@ -70,7 +70,7 @@ function getNotificationDevice(deviceId) {
 }
 function listDeliverableNotificationDevices(now = Date.now()) {
 	return getSqliteDatabase().prepare(`SELECT * FROM device_push_endpoints
-     WHERE enabled = 1 AND permissions = 'granted' AND lease_expires_at > ?
+     WHERE enabled = 1 AND permissions = 'granted' AND platform = 'harmonyos' AND lease_expires_at > ?
      ORDER BY updated_at DESC`).all(now).map(deviceFromRow);
 }
 function updateNotificationDevicePreferences(deviceId, patch) {
@@ -88,10 +88,5 @@ function updateNotificationDevicePreferences(deviceId, patch) {
 function removeNotificationDevice(deviceId) {
 	return runSqliteWriteTransaction((db) => db.prepare("DELETE FROM device_push_endpoints WHERE device_id = ?").run(deviceId).changes > 0);
 }
-function disableNotificationDeviceForPushToken(pushToken) {
-	runSqliteWriteTransaction((db) => {
-		db.prepare("UPDATE device_push_endpoints SET enabled = 0, updated_at = ? WHERE push_token = ?").run(Date.now(), pushToken);
-	});
-}
 //#endregion
-export { disableNotificationDeviceForPushToken, getNotificationDevice, listDeliverableNotificationDevices, registerNotificationDevice, removeNotificationDevice, updateNotificationDevicePreferences };
+export { getNotificationDevice, listDeliverableNotificationDevices, registerNotificationDevice, removeNotificationDevice, updateNotificationDevicePreferences };

package/dist/src/notifications/service.d.ts

@@ -101,6 +101,5 @@ export declare class NotificationService {
     drain(): Promise<void>;
     private deliverPending;
     private send;
-    private checkReceipts;
     private retryOrFail;
 }