@xopcai/xopc 0.0.368 → 0.0.370

package/dist/src/gateway/agents-admin.js

@@ -434,5 +434,60 @@ async function deleteAgentAvatarFile(agentId) {
 		data: { agentId: id }
 	};
 }
+const renderedAvatarCache = /* @__PURE__ */ new Map();
+/** Rasterize configured generated avatars locally for native mobile clients. */
+async function resolveAgentAvatarImage(agentId) {
+	const missing = assertAgentExistsForAvatar(agentId);
+	if (missing) return missing;
+	const id = normalizeAgentId(agentId);
+	const reference = listAgentEntries().find((entry) => normalizeAgentId(entry.id) === id)?.profile?.avatar?.trim() ?? "";
+	if (reference === "xopc:custom") return readAgentAvatarFile(id);
+	if (reference.startsWith("xopc:loopi:") || /^https?:\/\//i.test(reference)) return {
+		ok: false,
+		status: 404,
+		error: "Avatar is rendered by the client"
+	};
+	const match = /^xopc:dicebear:(adventurer|bottts|lorelei|thumbs|fun-emoji|pixel-art):(.+)$/.exec(reference);
+	const style = match?.[1] ?? "adventurer";
+	const seed = match?.[2] ?? id;
+	const key = JSON.stringify([style, seed]);
+	const cached = renderedAvatarCache.get(key);
+	if (cached) return {
+		ok: true,
+		data: {
+			buffer: cached,
+			contentType: "image/png"
+		}
+	};
+	const [{ createAvatar }, collection, { default: sharp }] = await Promise.all([
+		import("@dicebear/core"),
+		import("@dicebear/collection"),
+		import("sharp")
+	]);
+	const options = {
+		seed,
+		size: 128
+	};
+	const svg = (() => {
+		switch (style) {
+			case "bottts": return createAvatar(collection.bottts, options).toString();
+			case "lorelei": return createAvatar(collection.lorelei, options).toString();
+			case "thumbs": return createAvatar(collection.thumbs, options).toString();
+			case "fun-emoji": return createAvatar(collection.funEmoji, options).toString();
+			case "pixel-art": return createAvatar(collection.pixelArt, options).toString();
+			default: return createAvatar(collection.adventurer, options).toString();
+		}
+	})();
+	const buffer = await sharp(Buffer.from(svg)).png().toBuffer();
+	if (renderedAvatarCache.size >= 64) renderedAvatarCache.delete(renderedAvatarCache.keys().next().value);
+	renderedAvatarCache.set(key, buffer);
+	return {
+		ok: true,
+		data: {
+			buffer,
+			contentType: "image/png"
+		}
+	};
+}
 //#endregion
-export { createGatewayAgent, deleteAgentAvatarFile, deleteGatewayAgent, getGatewayAgentEffectiveConfig, listAgentProfileFiles, listGatewayAgents, readAgentAvatarFile, readAgentProfileFile, updateGatewayAgent, writeAgentAvatarFromBase64, writeAgentProfileFile };
+export { createGatewayAgent, deleteAgentAvatarFile, deleteGatewayAgent, getGatewayAgentEffectiveConfig, listAgentProfileFiles, listGatewayAgents, readAgentAvatarFile, readAgentProfileFile, resolveAgentAvatarImage, updateGatewayAgent, writeAgentAvatarFromBase64, writeAgentProfileFile };

package/dist/src/gateway/chat-stream/mapper.js

@@ -274,6 +274,7 @@ var ChatStreamMapper = class {
 		const toolName = String(event.toolName ?? "unknown");
 		this.toolCallToMessageId.set(toolCallId, messageId);
 		const events = [this.make("tool_start", {
+			...toolExecutionMetadata(event),
 			messageId,
 			toolCallId,
 			toolName,
@@ -300,6 +301,7 @@ var ChatStreamMapper = class {
 		const textDelta = extractText(partial);
 		const toolName = String(event.toolName ?? "unknown");
 		const events = [this.make("tool_update", {
+			...toolExecutionMetadata(event),
 			messageId,
 			toolCallId,
 			toolName,
@@ -329,6 +331,7 @@ var ChatStreamMapper = class {
 		const result = boundRealtimeToolResult(fullResult);
 		const toolName = String(event.toolName ?? "unknown");
 		const events = [this.make("tool_end", {
+			...toolExecutionMetadata(event),
 			messageId,
 			toolCallId,
 			toolName,
@@ -541,6 +544,12 @@ function extractDetails(value) {
 function asRecord(value) {
 	return value && typeof value === "object" && !Array.isArray(value) ? value : null;
 }
+function toolExecutionMetadata(event) {
+	return {
+		...typeof event.parentToolCallId === "string" ? { parentToolCallId: event.parentToolCallId } : {},
+		...typeof event.durationMs === "number" ? { durationMs: event.durationMs } : {}
+	};
+}
 function normalizeToolResult(value) {
 	if (value == null) return void 0;
 	if (typeof value === "string") return { text: value };

package/dist/src/gateway/chat-stream/protocol.d.ts

@@ -1,4 +1,4 @@
-import type { ToolActivity, TurnOutcome } from '@xopcai/gateway-contract';
+import type { AgentStreamToolExecutionMetadata, ToolActivity, TurnOutcome } from '@xopcai/gateway-contract';
 import type { TaskUpdateTrigger } from '../../storage/sqlite/session-input-repository.js';
 export type ChatStreamStatus = 'success' | 'error' | 'cancelled' | 'suspended';
 export type PetFeedbackTaskState = 'working' | 'waiting' | 'success' | 'error';
@@ -63,14 +63,14 @@ export type ToolStartEvent = ChatStreamEnvelope<'tool_start', {
     toolName: string;
     args?: unknown;
     activity: ToolActivity;
-}>;
+} & AgentStreamToolExecutionMetadata>;
 export type ToolUpdateEvent = ChatStreamEnvelope<'tool_update', {
     messageId: string;
     toolCallId: string;
     toolName: string;
     details?: unknown;
     textDelta?: string;
-}>;
+} & AgentStreamToolExecutionMetadata>;
 export type ToolEndEvent = ChatStreamEnvelope<'tool_end', {
     messageId: string;
     toolCallId: string;
@@ -84,7 +84,7 @@ export type ToolEndEvent = ChatStreamEnvelope<'tool_end', {
     };
     deliveries?: import('@xopcai/gateway-contract').ProductDeliveryEnvelope[];
     errorMessage?: string;
-}>;
+} & AgentStreamToolExecutionMetadata>;
 export type CommandStartedEvent = ChatStreamEnvelope<'command_started', {
     messageId: string;
     toolCallId: string;

package/dist/src/gateway/hono/lib/config-payload.d.ts

@@ -2,8 +2,7 @@ import type { Config } from '../../../config/schema.js';
 import type { GatewayService } from '../../service.js';
 /** MCP block for GET/PATCH `/api/config` (authenticated console editing). */
 export declare function buildSafeMcpConfigForWeb(config: Config): {
-    servers: import("../../../config/mcp-config-normalize.js").ConfigMcpServers;
-    sessionIdleTtlMs?: number;
+    servers: Record<string, Record<string, unknown>>;
 };
 export declare function buildSafeBrowserConfigForWeb(browser: unknown): {
     security?: unknown;
@@ -109,6 +108,13 @@ export declare function buildSafeWebConfigPayload(service: GatewayService, optio
                 allowed?: string[];
             };
             runtime: {
+                codemode?: {
+                    enabled: boolean;
+                    timeoutMs: number;
+                    maxConcurrentCalls: number;
+                    maxCalls: number;
+                    maxOutputTokens: number;
+                };
                 thinkingLevel?: "low" | "high" | "off" | "medium" | "minimal" | "xhigh" | "max";
                 commandIsolation?: {
                     mode: "host";
@@ -345,7 +351,6 @@ export declare function buildSafeWebConfigPayload(service: GatewayService, optio
         id?: string;
     }[];
     mcp: {
-        servers: import("../../../config/mcp-config-normalize.js").ConfigMcpServers;
-        sessionIdleTtlMs?: number;
+        servers: Record<string, Record<string, unknown>>;
     };
 }>;

package/dist/src/gateway/hono/lib/config-payload.js

@@ -7,9 +7,9 @@ import { ContextPlanningConfigSchema, KnowledgeMemoryConfigSchema, UserModelConf
 import { init_models_json, loadModelsJson } from "../../../config/models-json.js";
 import { getProviderRegistry, init_plugin_registry } from "../../../providers/plugin-registry.js";
 import { getAllProviders, init_providers, isProviderConfigured } from "../../../providers/index.js";
-import { normalizeConfiguredMcpServers } from "../../../config/mcp-config-normalize.js";
 import { resolveShareConfig } from "../../../share/share-config.js";
 import { maskTunnelSecretForWeb } from "../../../tunnel/env.js";
+import { normalizeConfiguredMcpServers } from "../../../config/mcp-config-normalize.js";
 import { buildChannelCatalogForConfig, buildChannelCatalogFromSnapshot, getChannelSetupStatus } from "../../../channels/catalog/channel-catalog-service.js";
 import { resolveSessionConfigForWeb, resolveUpdateConfigForWeb } from "../../../config/web-patch.js";
 import { GENERIC_MASKED_SECRET, maskSecretLength } from "./mask-secret-length.js";
@@ -43,10 +43,7 @@ async function maskLlmProviderApiKeyForWeb(provider) {
 function buildSafeMcpConfigForWeb(config) {
 	const mcp = config.mcp;
 	if (!mcp) return { servers: {} };
-	return {
-		...mcp.sessionIdleTtlMs !== void 0 ? { sessionIdleTtlMs: mcp.sessionIdleTtlMs } : {},
-		servers: normalizeConfiguredMcpServers(mcp.servers)
-	};
+	return { servers: normalizeConfiguredMcpServers(mcp.servers) };
 }
 function buildSafeBrowserConfigForWeb(browser) {
 	if (!browser || typeof browser !== "object") return { enabled: false };

package/dist/src/gateway/hono/oauth-async.js

@@ -295,13 +295,20 @@ async function runOAuthFlow(session, oauthProvider, service) {
 			session.deviceCode = prompt.deviceCode;
 			session.verificationUri = prompt.verificationUri;
 			session.message = prompt.message;
-			manualCodePromise = new Promise((resolve, reject) => {
+			manualCodePromise ??= new Promise((resolve, reject) => {
 				manualCodeResolve = resolve;
 				manualCodeReject = reject;
 			});
 			session.manualCodeResolve = manualCodeResolve;
 			session.manualCodeReject = manualCodeReject;
-			return "";
+			const cancel = () => manualCodeReject?.(/* @__PURE__ */ new Error("OAuth prompt cancelled"));
+			prompt.signal?.addEventListener("abort", cancel, { once: true });
+			try {
+				if (prompt.signal?.aborted) cancel();
+				return await manualCodePromise;
+			} finally {
+				prompt.signal?.removeEventListener("abort", cancel);
+			}
 		},
 		onProgress: (message) => {
 			log.debug({

package/dist/src/gateway/hono/routes/agent-plugins.js

@@ -1,6 +1,6 @@
 import { AgentPluginStore } from "../../../extensions/agent-plugins/store.js";
 import { savePluginAuthBinding } from "../../../extensions/agent-plugins/auth.js";
-import { disposeAllSessionMcpRuntimes } from "../../../agent/mcp/bundle-mcp-runtime.js";
+import { evictAllEmbeddedSessionRunners } from "../../../agent/embedded/session-runner.js";
 import { withAgentPluginSource } from "../../../extensions/agent-plugins/sources.js";
 import { agentPluginInventoryRow } from "../../../extensions/agent-plugins/inventory.js";
 import { removePluginCredentials } from "../../../extensions/agent-plugins/credentials.js";
@@ -13,7 +13,7 @@ const sourceBody = z.strictObject({
 function registerAgentPluginRoutes(app, deps) {
 	const store = new AgentPluginStore();
 	const refresh = async () => {
-		await disposeAllSessionMcpRuntimes();
+		evictAllEmbeddedSessionRunners();
 		deps.service.marketplace.reloadSkills();
 	};
 	app.post("/api/extensions/inspect", deps.strictRateLimitMiddleware, async (c) => {
@@ -123,12 +123,7 @@ function registerAgentPluginRoutes(app, deps) {
 	app.put("/api/extensions/agent-plugins/:id/mcp/:server/auth", deps.strictRateLimitMiddleware, async (c) => {
 		try {
 			const body = z.strictObject({
-				mode: z.enum([
-					"auto",
-					"oauth",
-					"api-key",
-					"none"
-				]),
+				mode: z.enum(["auto", "api-key"]),
 				secrets: z.array(z.strictObject({
 					target: z.enum(["headers", "env"]),
 					key: z.string(),
@@ -152,7 +147,7 @@ function registerAgentPluginRoutes(app, deps) {
 				removeData: z.boolean().optional(),
 				removeCredentials: z.boolean().optional()
 			}).parse(await c.req.json());
-			await disposeAllSessionMcpRuntimes();
+			evictAllEmbeddedSessionRunners();
 			if (body.removeCredentials) await removePluginCredentials(store, c.req.param("id"));
 			store.remove(c.req.param("id"), body.removeData);
 			deps.service.marketplace.reloadSkills();

package/dist/src/gateway/hono/routes/agents.js

@@ -2,7 +2,7 @@ import { normalizeAgentId } from "../../../agent-catalog/id.js";
 import { AgentEntrySchema, AgentModelsOverrideSchema, AgentProfileSchema, RuntimePolicySchema, SkillOverrideSchema, ToolPoliciesSchema, WorkflowPolicySchema } from "../../../agent-config/schema.js";
 import { init_agent_config } from "../../../agent-config/index.js";
 import { init_agent_scope } from "../../../agent/agent-scope.js";
-import { createGatewayAgent, deleteAgentAvatarFile, deleteGatewayAgent, getGatewayAgentEffectiveConfig, listAgentProfileFiles, listGatewayAgents, readAgentAvatarFile, readAgentProfileFile, updateGatewayAgent, writeAgentAvatarFromBase64, writeAgentProfileFile } from "../../agents-admin.js";
+import { createGatewayAgent, deleteAgentAvatarFile, deleteGatewayAgent, getGatewayAgentEffectiveConfig, listAgentProfileFiles, listGatewayAgents, readAgentAvatarFile, readAgentProfileFile, resolveAgentAvatarImage, updateGatewayAgent, writeAgentAvatarFromBase64, writeAgentProfileFile } from "../../agents-admin.js";
 import { getVoiceModelsConfig } from "../../../config/voice.js";
 //#region src/gateway/hono/routes/agents.ts
 init_agent_config();
@@ -208,7 +208,8 @@ function registerAgentsRoutes(authenticated, deps) {
 		});
 	});
 	authenticated.get("/api/agents/:id/avatar", async (c) => {
-		const res = await readAgentAvatarFile(normalizeAgentId(c.req.param("id") ?? ""));
+		const id = normalizeAgentId(c.req.param("id") ?? "");
+		const res = c.req.query("resolve") === "1" ? await resolveAgentAvatarImage(id) : await readAgentAvatarFile(id);
 		if (res.ok === false) return c.json({
 			ok: false,
 			error: { message: res.error }
@@ -217,7 +218,7 @@ function registerAgentsRoutes(authenticated, deps) {
 			status: 200,
 			headers: {
 				"Content-Type": res.data.contentType,
-				"Cache-Control": "private, max-age=3600"
+				"Cache-Control": c.req.query("resolve") === "1" ? "private, no-store" : "private, max-age=3600"
 			}
 		});
 	});

package/dist/src/gateway/hono/routes/browser-automations.js

@@ -1,8 +1,11 @@
+import { getGatewayPrincipal } from "../../security/gateway-principal.js";
 //#region src/gateway/hono/routes/browser-automations.ts
 function presentRun(run) {
 	return {
 		id: run.id,
 		automationId: run.automationId,
+		automationRevision: run.automationRevision,
+		businessOutcome: run.businessOutcome,
 		status: run.status,
 		inputs: run.inputs,
 		result: run.result,
@@ -21,6 +24,14 @@ function parseStatus(value) {
 function registerBrowserAutomationRoutes(authenticated, deps) {
 	const service = deps.service.browserAutomations;
 	authenticated.get("/api/browser/automations", (c) => c.json({ automations: service.list() }));
+	authenticated.post("/api/browser/automations/validate", async (c) => {
+		const parsed = service.validate((await c.req.json()).definition);
+		return c.json({
+			valid: parsed.success,
+			issues: parsed.success ? [] : parsed.error.issues
+		});
+	});
+	authenticated.get("/api/browser/automations/:id/versions", (c) => c.json({ versions: service.versions(c.req.param("id")) }));
 	authenticated.post("/api/browser/automations", deps.strictRateLimitMiddleware, async (c) => {
 		try {
 			const body = await c.req.json();
@@ -29,7 +40,7 @@ function registerBrowserAutomationRoutes(authenticated, deps) {
 				status: parseStatus(body.status)
 			}) }, 201);
 		} catch (error) {
-			return c.json({ error: error instanceof Error ? error.message : String(error) }, 400);
+			return c.json({ error: error instanceof Error ? error.message : String(error) }, /revision changed|reused/.test(String(error)) ? 409 : 400);
 		}
 	});
 	authenticated.get("/api/browser/automations/:id", (c) => {
@@ -44,10 +55,11 @@ function registerBrowserAutomationRoutes(authenticated, deps) {
 			return c.json({ automation: service.save({
 				definition: body.definition ?? current.definition,
 				status: parseStatus(body.status) ?? current.status,
-				expectedId: current.id
+				expectedId: current.id,
+				expectedRevision: body.expectedRevision
 			}) });
 		} catch (error) {
-			return c.json({ error: error instanceof Error ? error.message : String(error) }, 400);
+			return c.json({ error: error instanceof Error ? error.message : String(error) }, /revision changed|reused/.test(String(error)) ? 409 : 400);
 		}
 	});
 	authenticated.delete("/api/browser/automations/:id", deps.strictRateLimitMiddleware, (c) => {
@@ -57,13 +69,17 @@ function registerBrowserAutomationRoutes(authenticated, deps) {
 			return c.json({ error: error instanceof Error ? error.message : String(error) }, 409);
 		}
 	});
-	authenticated.post("/api/browser/automations/:id/run", deps.strictRateLimitMiddleware, async (c) => {
+	authenticated.post("/api/browser/automations/:id/:operation{run|test}", deps.strictRateLimitMiddleware, async (c) => {
 		try {
-			const inputs = (await c.req.json().catch(() => ({}))).inputs ?? {};
+			const body = await c.req.json().catch(() => ({}));
+			const inputs = body.inputs ?? {};
 			if (!inputs || typeof inputs !== "object" || Array.isArray(inputs)) return c.json({ error: "inputs must be an object." }, 400);
-			return c.json({ run: presentRun(service.startRun(c.req.param("id"), inputs)) }, 202);
+			return c.json({ run: presentRun(service.startRun(c.req.param("id"), inputs, {
+				revision: body.revision,
+				clientRequestId: typeof body.clientRequestId === "string" ? `${getGatewayPrincipal(c).kind === "device" ? getGatewayPrincipal(c).deviceId : "owner"}:${body.clientRequestId}` : void 0
+			})) }, 202);
 		} catch (error) {
-			return c.json({ error: error instanceof Error ? error.message : String(error) }, 400);
+			return c.json({ error: error instanceof Error ? error.message : String(error) }, /revision changed|reused/.test(String(error)) ? 409 : 400);
 		}
 	});
 	authenticated.get("/api/browser/automation-runs", (c) => c.json({ runs: service.listRuns(c.req.query("automationId")).map(presentRun) }));

package/dist/src/gateway/hono/routes/browser-recordings.d.ts

@@ -0,0 +1,3 @@
+import type { Hono } from 'hono';
+import type { AuthenticatedRouteDeps } from './deps.js';
+export declare function registerBrowserRecordingRoutes(app: Hono, deps: AuthenticatedRouteDeps): void;

package/dist/src/gateway/hono/routes/browser-recordings.js

@@ -0,0 +1,78 @@
+import { getGatewayPrincipal } from "../../security/gateway-principal.js";
+import { BrowserRecordingService } from "../../../browser/recordings/service.js";
+import { randomUUID } from "node:crypto";
+//#region src/gateway/hono/routes/browser-recordings.ts
+function recordingAvailability(deps, deviceId) {
+	const browsers = deps.service.endpointTools.registry.list().filter((endpoint) => endpoint.kind === "browser" && (!deviceId || endpoint.principalId === deviceId));
+	const endpoints = browsers.filter((endpoint) => endpoint.tools.some((tool) => tool.descriptor.name === "browser.recording")).map(({ endpointId, displayName }) => ({
+		endpointId,
+		displayName
+	}));
+	return {
+		state: endpoints.length > 1 ? "choose_browser" : endpoints.length === 1 ? "ready" : browsers.length ? "update_required" : "connect_required",
+		endpoints
+	};
+}
+function registerBrowserRecordingRoutes(app, deps) {
+	const service = new BrowserRecordingService(deps.service.browserAutomations);
+	app.get("/api/browser/recordings/availability", (c) => {
+		const principal = getGatewayPrincipal(c);
+		return c.json(recordingAvailability(deps, principal.kind === "device" ? principal.deviceId : void 0));
+	});
+	app.post("/api/browser/recordings/control", async (c) => {
+		try {
+			const body = await c.req.json();
+			if (![
+				"start",
+				"pause",
+				"resume",
+				"finish",
+				"status"
+			].includes(body.operation)) return c.json({ error: "Invalid recording operation." }, 400);
+			const principal = getGatewayPrincipal(c);
+			const endpoints = deps.service.endpointTools.registry.list().filter((endpoint) => endpoint.kind === "browser" && (principal.kind !== "device" || endpoint.principalId === principal.deviceId) && (!body.endpointId || endpoint.endpointId === body.endpointId) && endpoint.tools.some((tool) => tool.descriptor.name === "browser.recording"));
+			if (endpoints.length !== 1) {
+				const availability = recordingAvailability(deps, principal.kind === "device" ? principal.deviceId : void 0);
+				return c.json({
+					code: availability.state === "ready" ? "connect_required" : availability.state,
+					error: "Recording requires a connected browser with recording support.",
+					endpoints: availability.endpoints
+				}, 409);
+			}
+			const endpoint = endpoints[0];
+			const tool = deps.service.endpointTools.registry.getTool(endpoint.endpointId, "browser.recording");
+			const result = await deps.service.endpointTools.invocations.invoke({
+				endpointId: endpoint.endpointId,
+				toolCallId: `recording:${randomUUID()}`,
+				toolName: "browser.recording",
+				arguments: { operation: body.operation },
+				descriptorRevision: tool.revision,
+				signal: AbortSignal.timeout(3e4)
+			});
+			return c.json({
+				value: result.content.find((item) => item.type === "json")?.value,
+				endpointId: endpoint.endpointId
+			});
+		} catch (error) {
+			return c.json({ error: error instanceof Error ? error.message : String(error) }, 400);
+		}
+	});
+	app.post("/api/browser/recordings/:id/:operation{events|finish}", async (c) => {
+		const principal = getGatewayPrincipal(c);
+		const endpointId = c.req.header("x-endpoint-id") ?? "";
+		const claim = c.req.header("x-endpoint-claim") ?? "";
+		const endpoint = deps.service.endpointTools.registry.get(endpointId);
+		if (principal.kind !== "device" || !principal.deviceId || endpoint?.principalId !== principal.deviceId || !deps.service.endpointTools.registry.verifyTurnClaim(endpointId, claim)) return c.json({ error: "Recording device is not authenticated." }, 403);
+		try {
+			if (Number(c.req.header("content-length") ?? 0) > 262144) return c.json({ error: "Recording batch is too large." }, 413);
+			const raw = await c.req.text();
+			if (Buffer.byteLength(raw) > 262144) return c.json({ error: "Recording batch is too large." }, 413);
+			const body = JSON.parse(raw);
+			return c.req.param("operation") === "events" ? c.json(service.append(c.req.param("id"), principal.deviceId, body.events)) : c.json({ automation: service.finish(c.req.param("id"), principal.deviceId, body.finalSeq) });
+		} catch (error) {
+			return c.json({ error: error instanceof Error ? error.message : String(error) }, 400);
+		}
+	});
+}
+//#endregion
+export { registerBrowserRecordingRoutes };

package/dist/src/gateway/hono/routes/browser.js

@@ -3,14 +3,13 @@ import { browserTabBindingRequestSchema } from "../../../../packages/gateway-con
 import { init_src } from "../../../../packages/gateway-contract/src/index.js";
 import { getDevice, init_device_access_repository } from "../../../storage/sqlite/device-access-repository.js";
 import "../../../../packages/browser-control-contract/src/index.js";
-import { decideBrowserApproval, listBrowserApprovals } from "../../../browser/policy/approval-store.js";
 import { createBrowserDriver } from "../../../browser/drivers/create-driver.js";
 import { checkBrowserReadiness } from "../../../browser/readiness.js";
 import { isLoopbackClientIp } from "../../security/loopback.js";
 import { getGatewayPrincipal } from "../../security/gateway-principal.js";
 import { getConnInfo } from "@hono/node-server/conninfo";
 //#region src/gateway/hono/routes/browser.ts
-/** Browser Control status, approvals, and driver diagnostics. */
+/** Browser Control status and driver diagnostics. */
 init_src();
 init_device_access_repository();
 init_browser_tab_binding_repository();
@@ -332,38 +331,6 @@ function registerBrowserRoutes(authenticated, deps) {
 			}, 400);
 		}
 	});
-	authenticated.get("/api/browser/approvals", (c) => {
-		const conversationId = c.req.query("conversationId");
-		if (!isLocalOwnerRequest(c, service) && (!conversationId || !canManageBrowserSession(c, service, conversationId))) return c.json({
-			ok: false,
-			error: "Local owner access required."
-		}, 403);
-		return c.json({
-			ok: true,
-			approvals: listBrowserApprovals(conversationId)
-		});
-	});
-	authenticated.post("/api/browser/approvals/respond", strictRateLimitMiddleware, async (c) => {
-		const body = await c.req.json().catch(() => null);
-		const approval = typeof body?.id === "string" ? listBrowserApprovals().find((candidate) => candidate.id === body.id) : void 0;
-		if (!isLocalOwnerRequest(c, service) && (!approval || !canManageBrowserSession(c, service, approval.conversationId))) return c.json({
-			ok: false,
-			error: "Local owner access required."
-		}, 403);
-		if (typeof body?.id !== "string" || body.decision !== "approved" && body.decision !== "denied") return c.json({
-			ok: false,
-			error: "id and decision are required."
-		}, 400);
-		const decided = decideBrowserApproval(body.id, body.decision);
-		if (!decided) return c.json({
-			ok: false,
-			error: "Approval not found."
-		}, 404);
-		return c.json({
-			ok: true,
-			approval: decided
-		});
-	});
 	authenticated.get("/api/browser/playwright/doctor", async (c) => {
 		try {
 			const { playwrightChromiumDoctor } = await import("../../../browser/providers/playwright-doctor.js");

package/dist/src/gateway/hono/routes/connection-waits.js

@@ -13,14 +13,11 @@ const actionSchema = z.object({
 		"cancel",
 		"select_account",
 		"confirm_scope",
-		"replace_source",
-		"submit_callback"
+		"replace_source"
 	]),
 	candidateRef: z.string().optional(),
 	needKey: z.string().optional(),
-	accountId: z.string().optional(),
-	callbackUrl: z.string().max(16384).optional(),
-	instanceId: z.string().optional()
+	accountId: z.string().optional()
 }).strict();
 function registerConnectionWaitRoutes(app, { service, strictRateLimitMiddleware }) {
 	app.get("/api/sessions/:conversationId/connection-wait", (c) => {

package/dist/src/gateway/hono/routes/connectors.js

@@ -22,14 +22,13 @@ import { getConnectorInstance, getInstalledConnectorDefinition, listConnectorIns
 import { installConnector, installConnectorDefinition, uninstallConnector, updateConnectorConfig } from "../../../connectors/install.js";
 import { ConfigPersistenceError, persistConfigMutation } from "../../../config/config-mutation.js";
 import { resumeApprovedConnectorAction } from "../../../connectors/approval-resume.js";
-import { getMcpOAuthManager } from "../../../agent/mcp/oauth/mcp-oauth-manager.js";
 import { startConnectorAuthorization } from "../../../connectors/auth-provider-registry.js";
 import { composioLogoResponse } from "../../../connectors/composio-logo.js";
 import { inspectManagedComposioStatus } from "../../../connectors/composio-managed-client.js";
 import { appendComposioTriggerEvent, listComposioTriggerEvents } from "../../../connectors/composio-triggers.js";
 import { ingestLocalFolderSource } from "../../../connectors/connected-source-ingestion.js";
 import { listUnderstandingSourceGrants, revokeUnderstandingSourceGrant } from "../../../user-context/sources/repository.js";
-import { previewConnectorDefinition, testConnectorInstance } from "../../../connectors/health.js";
+import { testConnectorInstance } from "../../../connectors/health.js";
 import { setConnectorEnabled } from "../../../connectors/lifecycle.js";
 import { projectComposioConnectionStatus } from "../../../connectors/runtime-status.js";
 import { getGatewayPrincipal } from "../../security/gateway-principal.js";
@@ -82,35 +81,7 @@ function registerConnectorRoutes(authenticated, deps) {
 					connectionStatus: connected ? "connected" : "disconnected"
 				};
 			}
-			if (!instance.enabled || instance.materialized.type !== "mcp") return instance;
-			const server = config.mcp?.servers?.[instance.materialized.serverId];
-			if (!server) return instance;
-			const oauth = await getMcpOAuthManager().status(instance.materialized.serverId, server);
-			if (!oauth.configured) return instance;
-			if (oauth.status === "connected") return {
-				...instance,
-				authStatus: "connected",
-				connectionStatus: "connected"
-			};
-			if (oauth.status === "authorizing") return {
-				...instance,
-				status: "connecting",
-				authStatus: "unknown",
-				connectionStatus: "connecting"
-			};
-			if (oauth.status === "error") return {
-				...instance,
-				status: "failed",
-				authStatus: "unauthorized",
-				connectionStatus: "error",
-				lastError: oauth.session?.error ?? instance.lastError
-			};
-			return {
-				...instance,
-				status: "unauthorized",
-				authStatus: "missing",
-				connectionStatus: "disconnected"
-			};
+			return instance;
 		}));
 		const connections = listConnectorConnections({ principalId: "local-owner" });
 		return c.json({
@@ -586,27 +557,6 @@ function registerConnectorRoutes(authenticated, deps) {
 			}
 		});
 	});
-	authenticated.post("/api/connectors/preview", strictRateLimitMiddleware, async (c) => {
-		const body = await c.req.json().catch(() => ({}));
-		const definition = body && typeof body === "object" && !Array.isArray(body) && body.definition && typeof body.definition === "object" && !Array.isArray(body.definition) ? body.definition : void 0;
-		if (!definition) return c.json({
-			ok: false,
-			error: "Missing connector definition."
-		}, 400);
-		const input = body && typeof body === "object" && !Array.isArray(body) ? body : {};
-		try {
-			const preview = await previewConnectorDefinition(service.currentConfig, definition, input);
-			return c.json({
-				ok: true,
-				payload: { preview }
-			});
-		} catch (error) {
-			return c.json({
-				ok: false,
-				error: errorMessage(error)
-			}, 400);
-		}
-	});
 	authenticated.get("/api/connectors/composio/:toolkit/health", async (c) => {
 		const health = await inspectComposioConnectorHealth(c.req.param("toolkit"));
 		return c.json({
@@ -880,12 +830,12 @@ function registerConnectorRoutes(authenticated, deps) {
 			ok: false,
 			error: `Connector instance not found: ${instanceId}`
 		}, 404);
-		if (instance.materialized.type !== "mcp" && instance.materialized.type !== "cli") return c.json({
+		if (instance.materialized.type !== "cli") return c.json({
 			ok: false,
-			error: `Connector type "${instance.materialized.type}" does not support MCP health checks.`
+			error: `Connector type "${instance.materialized.type}" does not support CLI health checks. Use xopc mcp list for MCP diagnostics.`
 		}, 400);
 		try {
-			const result = await testConnectorInstance(config, instance.materialized.type === "mcp" ? instance.materialized.serverId : instance.instanceId);
+			const result = await testConnectorInstance(config, instance.instanceId);
 			await persistConfigMutation({
 				config,
 				mutate: () => recordConnectorHealthUsage(config, instance.instanceId, result),
@@ -987,11 +937,6 @@ function registerConnectorRoutes(authenticated, deps) {
 		const instanceId = c.req.param("id");
 		const config = service.currentConfig;
 		try {
-			const definition = getInstalledConnectorDefinition(config, instanceId);
-			const installed = getConnectorInstance(config, instanceId);
-			const serverId = installed?.materialized.type === "mcp" ? installed.materialized.serverId : void 0;
-			const rawServer = serverId ? config.mcp?.servers?.[serverId] : void 0;
-			if (definition?.auth.mode === "oauth" && definition.runtime.type === "mcp" && rawServer) await getMcpOAuthManager().disconnect(serverId, rawServer);
 			const instance = await persistConfigMutation({
 				config,
 				mutate: () => uninstallConnector(config, instanceId),

package/dist/src/gateway/hono/routes/device-authorizations.d.ts

@@ -0,0 +1,3 @@
+import type { Hono } from 'hono';
+import type { AuthenticatedRouteDeps } from './deps.js';
+export declare function registerDeviceAuthorizationRoutes(app: Hono, deps: AuthenticatedRouteDeps): void;