@xopcai/xopc 0.0.368 → 0.0.370

package/dist/src/gateway/hono/routes/device-authorizations.js

@@ -0,0 +1,74 @@
+import { locationRequestSchema } from "../../../../packages/endpoint-tools-protocol/src/location.js";
+import { init_src } from "../../../../packages/endpoint-tools-protocol/src/index.js";
+import { getSessionMetadata } from "../../../storage/sqlite/session-read-repository.js";
+import { init_session_repository } from "../../../storage/sqlite/session-repository.js";
+import { getGatewayPrincipal } from "../../security/gateway-principal.js";
+import { z } from "zod";
+//#region src/gateway/hono/routes/device-authorizations.ts
+init_src();
+init_session_repository();
+const authorizationSchema = z.object({
+	conversationId: z.uuid(),
+	requestorPrincipalId: z.string().min(1).max(160),
+	targetEndpointId: z.string().min(1).max(160),
+	toolName: z.enum([
+		"mobile.device.get_location",
+		"web.device.get_location",
+		"desktop.device.get_location"
+	]),
+	arguments: locationRequestSchema
+}).strict();
+function registerDeviceAuthorizationRoutes(app, deps) {
+	app.use("/api/endpoint-tools/target-authorizations*", async (c, next) => {
+		if (getGatewayPrincipal(c).kind !== "owner") return c.json({
+			ok: false,
+			error: {
+				code: "FORBIDDEN",
+				message: "Device authorization requires Gateway owner consent"
+			}
+		}, 403);
+		c.header("Cache-Control", "no-store");
+		await next();
+	});
+	app.get("/api/endpoint-tools/target-authorizations", (c) => c.json({
+		ok: true,
+		payload: deps.service.endpointTools.grants.list()
+	}));
+	app.post("/api/endpoint-tools/target-authorizations", async (c) => {
+		const parsed = authorizationSchema.safeParse(await c.req.json().catch(() => null));
+		if (!parsed.success) return c.json({
+			ok: false,
+			error: {
+				code: "BAD_REQUEST",
+				message: "Invalid single-call device authorization"
+			}
+		}, 400);
+		if (!getSessionMetadata(parsed.data.conversationId)) return c.json({
+			ok: false,
+			error: {
+				code: "NOT_FOUND",
+				message: "Conversation not found"
+			}
+		}, 404);
+		try {
+			return c.json({
+				ok: true,
+				payload: deps.service.endpointTools.grants.issue(parsed.data)
+			}, 201);
+		} catch {
+			return c.json({
+				ok: false,
+				error: {
+					code: "TARGET_UNAVAILABLE",
+					message: "Device or capability is unavailable"
+				}
+			}, 409);
+		}
+	});
+	app.delete("/api/endpoint-tools/target-authorizations/:grantId", (c) => c.json({
+		ok: true,
+		payload: { revoked: deps.service.endpointTools.grants.revoke(c.req.param("grantId")) }
+	}));
+}
+//#endregion
+export { registerDeviceAuthorizationRoutes };

package/dist/src/gateway/hono/routes/device-push.js

@@ -13,6 +13,7 @@ function parsePreferences(value) {
 	const source = value;
 	const result = {};
 	for (const key of [
+		"chatNeedsInput",
 		"chatCompleted",
 		"chatFailed",
 		"taskNeedsInput",

package/dist/src/gateway/hono/routes/endpoint-compatibility.js

@@ -1,11 +1,13 @@
 import { init_src } from "../../../../packages/endpoint-tools-protocol/src/index.js";
 import { COMPUTER_DESCRIPTOR, COMPUTER_FRAME_MAX_BYTES, init_src as init_src$1 } from "../../../../packages/computer-control-contract/src/index.js";
 import { REALTIME_CAPABILITIES } from "../../../../packages/realtime-protocol/src/index.js";
+import { getGatewayPrincipal } from "../../security/gateway-principal.js";
 //#region src/gateway/hono/routes/endpoint-compatibility.ts
 init_src$1();
 init_src();
 function registerEndpointCompatibilityRoutes(authenticated) {
 	authenticated.get("/api/endpoint-tools/compatibility", (c) => {
+		const principal = getGatewayPrincipal(c);
 		c.header("Cache-Control", "no-store");
 		return c.json({
 			ok: true,
@@ -16,6 +18,11 @@ function registerEndpointCompatibilityRoutes(authenticated) {
 					maxVersion: 2,
 					capabilities: REALTIME_CAPABILITIES
 				},
+				turnDeviceContextV1: true,
+				deviceStateToolsV1: true,
+				hardwareBridgeV1: true,
+				deviceLocationTasksV1: true,
+				...principal.kind === "device" ? { deviceId: principal.deviceId } : {},
 				endpointProtocolVersion: 2,
 				computerControl: COMPUTER_DESCRIPTOR,
 				computerFrameUploadMaxBytes: COMPUTER_FRAME_MAX_BYTES

package/dist/src/gateway/hono/routes/endpoint-tools.d.ts

@@ -1,3 +1,4 @@
 import type { Hono } from 'hono';
 import type { AuthenticatedRouteDeps } from './deps.js';
 export declare function registerEndpointToolRoutes(authenticated: Hono, deps: AuthenticatedRouteDeps): void;
+export declare function registerDeviceSettingsRoutes(authenticated: Hono): void;

package/dist/src/gateway/hono/routes/endpoint-tools.js

@@ -5,9 +5,11 @@ import { endpointPrincipalRegistrationSchema, endpointSessionBindingRequestSchem
 import { createEndpointPrincipal, getEndpointPrincipal, listEndpointPrincipals, revokeEndpointPrincipal } from "../../../storage/sqlite/endpoint-principal-repository.js";
 import { listEndpointToolInvocationAuditPage } from "../../../storage/sqlite/endpoint-tool-invocation-repository.js";
 import { init_sqlite } from "../../../storage/sqlite/index.js";
+import { getEndpointDeviceSettings, renameEndpointDevice } from "../../../storage/sqlite/endpoint-device-settings-repository.js";
 import { parseEndpointPublicKey } from "../../../endpoint-tools/auth.js";
 import { ENDPOINT_UPLOAD_MAX_BYTES, EndpointUploadError } from "../../../endpoint-tools/upload-service.js";
 import { getGatewayPrincipal } from "../../security/gateway-principal.js";
+import { z } from "zod";
 //#region src/gateway/hono/routes/endpoint-tools.ts
 init_src();
 init_sqlite();
@@ -52,13 +54,17 @@ function registerEndpointToolRoutes(authenticated, deps) {
 		}
 		const devicesById = new Map(listDevices().map((device) => [device.id, device]));
 		const principalsById = new Map(listEndpointPrincipals().map((principal) => [principal.id, principal]));
-		const devices = [...new Set([...devicesById.keys(), ...principalsById.keys()])].map((id) => {
+		const ids = new Set([...devicesById.keys(), ...principalsById.keys()]);
+		const actor = getGatewayPrincipal(c);
+		const devices = [...ids].filter((id) => actor.kind !== "device" || id === actor.deviceId).map((id) => {
 			const access = devicesById.get(id);
 			const principal = principalsById.get(id);
+			const settings = principal ? getEndpointDeviceSettings(id) : void 0;
 			const lastSeenAt = Math.max(access?.lastSeenAt ?? 0, principal?.lastSeenAt ?? 0) || void 0;
 			return {
 				id,
-				displayName: principal?.displayName ?? access?.displayName ?? id,
+				displayName: settings?.nickname ?? principal?.displayName ?? access?.displayName ?? id,
+				settingsRevision: settings?.revision ?? 0,
 				kind: principal?.kind ?? (access?.platform === "chrome" ? "browser" : "mobile"),
 				platform: principal?.platform ?? access?.platform ?? "unknown",
 				createdAt: Math.min(access?.createdAt ?? Number.POSITIVE_INFINITY, principal?.createdAt ?? Number.POSITIVE_INFINITY),
@@ -365,5 +371,49 @@ function registerEndpointToolRoutes(authenticated, deps) {
 		return c.body(body);
 	});
 }
+function registerDeviceSettingsRoutes(authenticated) {
+	authenticated.patch("/api/endpoint-tools/devices/:principalId", async (c) => {
+		const parsed = z.strictObject({
+			nickname: z.string().trim().min(1).max(80),
+			expectedRevision: z.number().int().nonnegative()
+		}).safeParse(await c.req.json().catch(() => null));
+		if (!parsed.success) return c.json({
+			ok: false,
+			error: {
+				code: "BAD_REQUEST",
+				message: "Invalid device settings"
+			}
+		}, 400);
+		const actor = getGatewayPrincipal(c);
+		const id = c.req.param("principalId");
+		if (actor.kind !== "owner" && !(actor.kind === "device" && actor.deviceId === id)) return c.json({
+			ok: false,
+			error: {
+				code: "FORBIDDEN",
+				message: "Device settings are not accessible"
+			}
+		}, 403);
+		const principal = getEndpointPrincipal(id);
+		if (!principal || principal.revokedAt) return c.json({
+			ok: false,
+			error: {
+				code: "NOT_FOUND",
+				message: "Device is unavailable"
+			}
+		}, 404);
+		const settings = renameEndpointDevice(id, parsed.data.nickname, parsed.data.expectedRevision);
+		if (!settings) return c.json({
+			ok: false,
+			error: {
+				code: "CONFLICT",
+				message: "Device settings changed. Refresh before saving."
+			}
+		}, 409);
+		return c.json({
+			ok: true,
+			payload: settings
+		});
+	});
+}
 //#endregion
-export { registerEndpointToolRoutes };
+export { registerDeviceSettingsRoutes, registerEndpointToolRoutes };

package/dist/src/gateway/hono/routes/home.js

@@ -13,7 +13,7 @@ init_sqlite();
 /** Register the unified work-home read model and its decision actions. */
 function registerHomeRoutes(authenticated, deps) {
 	const { service } = deps;
-	const home = new HomeQueryService(service, () => service.homeIntelligence.getAdvisor());
+	const home = new HomeQueryService(service, (locale) => service.homeIntelligence.getAdvisor(locale));
 	authenticated.get("/api/home", async (c) => {
 		const locale = c.req.query("locale");
 		return c.json(await home.getSnapshot(locale));

package/dist/src/gateway/hono/routes/lazy-bundles.js

@@ -35,6 +35,22 @@ const AUTHENTICATED_LAZY_ROUTE_BUNDLES = [
 			return { register: registerCapabilityOperationRoutes };
 		}
 	},
+	{
+		id: "device-authorizations",
+		match: (path) => /^\/api\/endpoint-tools\/target-authorizations(?:\/[^/]+)?$/.test(path),
+		load: async () => {
+			const { registerDeviceAuthorizationRoutes } = await import("./device-authorizations.js");
+			return { register: registerDeviceAuthorizationRoutes };
+		}
+	},
+	{
+		id: "device-settings",
+		match: (path) => /^\/api\/endpoint-tools\/devices\/[^/]+$/.test(path) && path !== "/api/endpoint-tools/devices/revoke",
+		load: async () => {
+			const { registerDeviceSettingsRoutes } = await import("./endpoint-tools.js");
+			return { register: registerDeviceSettingsRoutes };
+		}
+	},
 	{
 		id: "endpoint-compatibility",
 		match: (path) => path === "/api/endpoint-tools/compatibility",
@@ -123,6 +139,14 @@ const AUTHENTICATED_LAZY_ROUTE_BUNDLES = [
 			return { register: registerBrowserInstallRoutes };
 		}
 	},
+	{
+		id: "browser-recordings",
+		match: (path) => path.startsWith("/api/browser/recordings/"),
+		load: async () => {
+			const { registerBrowserRecordingRoutes } = await import("./browser-recordings.js");
+			return { register: registerBrowserRecordingRoutes };
+		}
+	},
 	{
 		id: "browser-automations",
 		match: (path) => startsWithAny(path, ["/api/browser/automations", "/api/browser/automation-runs"]),
@@ -416,7 +440,7 @@ const AUTHENTICATED_LAZY_ROUTE_BUNDLES = [
 	},
 	{
 		id: "mcp",
-		match: (path) => startsWithAny(path, ["/api/mcp"]),
+		match: (path) => path === "/api/mcp/servers",
 		load: async () => {
 			const { registerMcpRoutes } = await import("./mcp.js");
 			return { register: registerMcpRoutes };

package/dist/src/gateway/hono/routes/mcp.d.ts

@@ -1,3 +1,3 @@
 import type { Hono } from 'hono';
 import type { AuthenticatedRouteDeps } from './deps.js';
-export declare function registerMcpRoutes(authenticated: Hono, deps: AuthenticatedRouteDeps): void;
+export declare function registerMcpRoutes(app: Hono, deps: AuthenticatedRouteDeps): void;

package/dist/src/gateway/hono/routes/mcp.js

@@ -1,254 +1,28 @@
 import { isManagedConnectorServer } from "../../../connectors/materialize.js";
-import { AgentPluginStore } from "../../../extensions/agent-plugins/store.js";
-import { canonicalizeConfiguredMcpServer, normalizeConfiguredMcpServers } from "../../../config/mcp-config-normalize.js";
-import { savePluginAuthBinding } from "../../../extensions/agent-plugins/auth.js";
-import { loadMergedBundleMcpConfig } from "../../../agent/mcp/bundle-mcp-config.js";
+import { loadMergedMcpConfig } from "../../../agent/mcp/config.js";
 import { getWorkspacePath } from "../../../config/workspace-path-helpers.js";
-import { getMcpOAuthManager } from "../../../agent/mcp/oauth/mcp-oauth-manager.js";
-import { listBundleMcpResourcesForGateway, listBundleMcpServerCapabilitiesForGateway, listBundleMcpServerToolsForGateway } from "../../../agent/mcp/bundle-mcp-gateway.js";
 //#region src/gateway/hono/routes/mcp.ts
-function registerMcpRoutes(authenticated, deps) {
-	const resolveServer = (id) => {
+function registerMcpRoutes(app, deps) {
+	app.get("/api/mcp/servers", (c) => {
 		const cfg = deps.service.currentConfig;
-		return loadMergedBundleMcpConfig({
-			workspaceDir: getWorkspacePath(cfg) || "./workspace",
-			cfg
-		}).config.mcpServers[id];
-	};
-	authenticated.get("/api/mcp/servers", async (c) => {
-		const cfg = deps.service.currentConfig;
-		const merged = loadMergedBundleMcpConfig({
+		const merged = loadMergedMcpConfig({
 			workspaceDir: getWorkspacePath(cfg) || "./workspace",
 			cfg
 		});
-		const configured = normalizeConfiguredMcpServers(cfg.mcp?.servers);
-		const servers = await Promise.all(Object.entries(merged.config.mcpServers).map(async ([id, server]) => ({
-			id,
-			plugin: server.xopcPlugin,
-			managed: isManagedConnectorServer(server),
-			connectorId: isManagedConnectorServer(server) ? server.xopcConnector.connectorId : void 0,
-			oauth: await getMcpOAuthManager(server).status(id, server)
-		})));
 		return c.json({
 			ok: true,
 			payload: {
-				servers: servers.sort((left, right) => left.id.localeCompare(right.id)),
+				servers: Object.entries(merged.config.mcpServers).map(([id, server]) => ({
+					id,
+					plugin: server.xopcPlugin,
+					managed: isManagedConnectorServer(server),
+					connectorId: isManagedConnectorServer(server) ? server.xopcConnector.connectorId : void 0
+				})).sort((a, b) => a.id.localeCompare(b.id)),
 				mergedServerIds: Object.keys(merged.config.mcpServers).sort(),
-				configured
+				configured: cfg.mcp?.servers ?? {}
 			}
 		});
 	});
-	authenticated.get("/api/mcp/resources", async (c) => {
-		const cfg = deps.service.currentConfig;
-		const workspaceDir = getWorkspacePath(cfg) || "./workspace";
-		const query = (c.req.query("q") ?? "").trim().toLocaleLowerCase();
-		const serverId = (c.req.query("serverId") ?? "").trim();
-		try {
-			const items = (await listBundleMcpResourcesForGateway({
-				workspaceDir,
-				cfg
-			})).filter((resource) => {
-				if (serverId && resource.serverId !== serverId) return false;
-				if (!query) return true;
-				return [
-					resource.name,
-					resource.title,
-					resource.description,
-					resource.uri,
-					resource.serverId
-				].some((value) => value?.toLocaleLowerCase().includes(query));
-			}).slice(0, 20);
-			return c.json({
-				ok: true,
-				payload: { resources: items }
-			});
-		} catch (err) {
-			return c.json({
-				ok: false,
-				error: err instanceof Error ? err.message : String(err)
-			}, 500);
-		}
-	});
-	authenticated.get("/api/mcp/servers/:id/oauth", async (c) => {
-		const id = c.req.param("id");
-		const server = resolveServer(id);
-		if (!server) return c.json({
-			ok: false,
-			error: `Unknown MCP server: ${id}`
-		}, 404);
-		return c.json({
-			ok: true,
-			payload: await getMcpOAuthManager(server).status(id, server)
-		});
-	});
-	authenticated.post("/api/mcp/servers/:id/oauth/callback", deps.strictRateLimitMiddleware, async (c) => {
-		const id = c.req.param("id");
-		const server = resolveServer(id);
-		if (!server) return c.json({
-			ok: false,
-			error: "Unknown MCP server"
-		}, 404);
-		try {
-			const body = await c.req.json();
-			if (typeof body.callbackUrl !== "string" || body.callbackUrl.length > 16384) throw new Error("Expected callbackUrl");
-			return c.json({
-				ok: true,
-				payload: await getMcpOAuthManager(server).submitCallback(id, server, body.callbackUrl)
-			});
-		} catch {
-			return c.json({
-				ok: false,
-				error: "OAuth callback rejected; verify the URL and active authorization session"
-			}, 400);
-		}
-	});
-	authenticated.post("/api/mcp/servers/:id/oauth/start", deps.strictRateLimitMiddleware, async (c) => {
-		const id = c.req.param("id");
-		const server = resolveServer(id);
-		if (!server) return c.json({
-			ok: false,
-			error: `Unknown MCP server: ${id}`
-		}, 404);
-		try {
-			const origin = server.xopcPlugin;
-			if (origin) await savePluginAuthBinding(new AgentPluginStore(), origin.id, origin.serverName, { mode: "oauth" });
-			const oauthServer = origin ? resolveServer(id) : server;
-			const payload = await getMcpOAuthManager(oauthServer).start({
-				serverId: id,
-				rawServer: oauthServer,
-				cfg: deps.service.currentConfig
-			});
-			return c.json({
-				ok: true,
-				payload
-			});
-		} catch (err) {
-			return c.json({
-				ok: false,
-				error: err instanceof Error ? err.message : String(err)
-			}, 400);
-		}
-	});
-	authenticated.delete("/api/mcp/servers/:id/oauth", deps.strictRateLimitMiddleware, async (c) => {
-		const id = c.req.param("id");
-		const server = resolveServer(id);
-		if (!server) return c.json({
-			ok: false,
-			error: `Unknown MCP server: ${id}`
-		}, 404);
-		try {
-			const payload = await getMcpOAuthManager(server).disconnect(id, server);
-			return c.json({
-				ok: true,
-				payload
-			});
-		} catch (err) {
-			return c.json({
-				ok: false,
-				error: err instanceof Error ? err.message : String(err)
-			}, 400);
-		}
-	});
-	authenticated.get("/api/mcp/servers/:id/tools", async (c) => {
-		const id = c.req.param("id");
-		const cfg = deps.service.currentConfig;
-		const workspaceDir = getWorkspacePath(cfg) || "./workspace";
-		try {
-			const tools = await listBundleMcpServerToolsForGateway({
-				workspaceDir,
-				cfg,
-				serverId: id
-			});
-			return c.json({
-				ok: true,
-				payload: { tools }
-			});
-		} catch (err) {
-			return c.json({
-				ok: false,
-				error: err instanceof Error ? err.message : String(err)
-			}, 500);
-		}
-	});
-	authenticated.get("/api/mcp/servers/:id/capabilities", async (c) => {
-		const id = c.req.param("id");
-		const cfg = deps.service.currentConfig;
-		const workspaceDir = getWorkspacePath(cfg) || "./workspace";
-		try {
-			const capabilities = await listBundleMcpServerCapabilitiesForGateway({
-				workspaceDir,
-				cfg,
-				serverId: id
-			});
-			return c.json({
-				ok: true,
-				payload: capabilities
-			});
-		} catch (err) {
-			return c.json({
-				ok: false,
-				error: err instanceof Error ? err.message : String(err)
-			}, 500);
-		}
-	});
-	authenticated.post("/api/mcp/servers/:id/test", async (c) => {
-		const id = c.req.param("id");
-		const cfg = deps.service.currentConfig;
-		const workspaceDir = getWorkspacePath(cfg) || "./workspace";
-		const body = await c.req.json().catch(() => ({}));
-		const inlineServer = body && typeof body === "object" && !Array.isArray(body) && body.server && typeof body.server === "object" ? body.server : void 0;
-		if (inlineServer && id.startsWith("plugin/")) return c.json({
-			ok: false,
-			error: "Plugin servers must use their installed configuration"
-		}, 400);
-		const mergedServers = loadMergedBundleMcpConfig({
-			workspaceDir,
-			cfg
-		}).config.mcpServers;
-		const knownServer = inlineServer ?? mergedServers[id];
-		if (!knownServer) return c.json({
-			ok: false,
-			error: `Unknown MCP server: ${id}`
-		}, 404);
-		try {
-			const oauth = await getMcpOAuthManager(knownServer).status(id, knownServer);
-			if (oauth.configured && knownServer.xopcAutoAuth !== true && oauth.status !== "connected") return c.json({
-				ok: false,
-				code: "MCP_AUTHORIZATION_REQUIRED",
-				serverId: id,
-				error: oauth.session?.error ?? "MCP server authorization is required"
-			}, 409);
-			const capabilities = await listBundleMcpServerCapabilitiesForGateway({
-				workspaceDir,
-				cfg: inlineServer ? {
-					...cfg,
-					mcp: {
-						...cfg.mcp,
-						servers: { [id]: canonicalizeConfiguredMcpServer(inlineServer) }
-					}
-				} : cfg,
-				serverId: id
-			});
-			if (capabilities.error) return c.json({
-				ok: false,
-				code: capabilities.error.code,
-				serverId: id,
-				error: capabilities.error.message
-			}, capabilities.error.code === "MCP_AUTHORIZATION_REQUIRED" ? 409 : 502);
-			return c.json({
-				ok: true,
-				payload: {
-					...capabilities,
-					serverId: id
-				}
-			});
-		} catch (err) {
-			return c.json({
-				ok: false,
-				error: err instanceof Error ? err.message : String(err)
-			}, 500);
-		}
-	});
 }
 //#endregion
 export { registerMcpRoutes };

package/dist/src/gateway/hono/routes/personal-agent.js

@@ -1,6 +1,7 @@
 import { getDevice, init_device_access_repository } from "../../../storage/sqlite/device-access-repository.js";
 import { getPersonalRequest, init_request_repository, listPersonalRequests } from "../../../personal-agent/request-repository.js";
 import { getPersonalAgent } from "../../../personal-agent/repository.js";
+import { writeAgentAvatarFromBase64 } from "../../agents-admin.js";
 import { TaskOriginRepository } from "../../../tasks/task-origin-repository.js";
 import { cancelPersonalRequest, personalRequestSnapshot, publishPersonalRequest } from "../../../personal-agent/request-service.js";
 import { PersonalOnboardingDraftSchema, PersonalOnboardingStepSchema, finishPersonalWelcome, getPersonalOnboarding, savePersonalOnboarding } from "../../../personal-agent/onboarding.js";
@@ -12,6 +13,14 @@ import { z } from "zod";
 //#region src/gateway/hono/routes/personal-agent.ts
 init_device_access_repository();
 init_request_repository();
+const AvatarSchema = z.object({
+	base64: z.string().min(1).max(7e5),
+	mimeType: z.enum([
+		"image/png",
+		"image/jpeg",
+		"image/webp"
+	])
+}).strict();
 const CreateSchema = z.object({
 	model: z.string().trim().min(3).optional(),
 	displayName: z.string().trim().min(1).max(60).optional(),
@@ -54,6 +63,32 @@ function registerPersonalAgentRoutes(authenticated, deps) {
 		return platform === "harmonyos" || platform === "ios" || platform === "android" ? "local-owner" : null;
 	};
 	registerProactivityRoutes(authenticated, deps, owner);
+	authenticated.put("/api/personal-agent/avatar", deps.strictRateLimitMiddleware, async (c) => {
+		const ownerId = owner(c);
+		if (!ownerId) return c.json({
+			ok: false,
+			error: "Owner access is required"
+		}, 403);
+		const record = getPersonalAgent(ownerId);
+		if (!record || record.state !== "ready") return c.json({
+			ok: false,
+			error: "Personal AI is not ready"
+		}, 409);
+		const input = AvatarSchema.safeParse(await c.req.json().catch(() => null));
+		if (!input.success) return c.json({
+			ok: false,
+			error: "Invalid avatar"
+		}, 400);
+		const result = await writeAgentAvatarFromBase64(record.agentId, input.data.base64, input.data.mimeType);
+		if (result.ok === false) return c.json({
+			ok: false,
+			error: result.error
+		}, result.status ?? 400);
+		return c.json({
+			ok: true,
+			payload: { agentId: record.agentId }
+		});
+	});
 	authenticated.get("/api/personal-agent", async (c) => {
 		const ownerId = owner(c);
 		if (!ownerId) return c.json({

package/dist/src/gateway/hono/routes/session-command-handler.js

@@ -10,6 +10,7 @@ import { parseSlashCommand } from "../../../chat-commands/command-parse.js";
 import { commandRegistry } from "../../../chat-commands/registry.js";
 import "../../../chat-commands/index.js";
 import { isVoiceLikeAttachment } from "../../../channels/attachments/voice-stt-webchat.js";
+import { deviceTurnSourceContext, endpointClaimBelongsToPrincipal } from "../../../endpoint-tools/turn-context.js";
 import { SessionCommandError, getSessionInputReceipt, isConversationDeleted, retrySessionPreparation } from "../../../storage/sqlite/session-creation-repository.js";
 import { getGatewayPrincipal } from "../../security/gateway-principal.js";
 import { browserPageContextToAgentContext } from "../../../agent/source-context/browser-page.js";
@@ -55,6 +56,13 @@ async function handleSessionCommand(c, deps, materialize = false) {
 				message: "Endpoint connection is not active"
 			}
 		}, 401);
+		if (origin?.success && !endpointClaimBelongsToPrincipal(deps.service.endpointTools.registry, origin.data.endpointId, principal)) return c.json({
+			ok: false,
+			error: {
+				code: "FORBIDDEN",
+				message: "Endpoint does not belong to the authenticated device"
+			}
+		}, 403);
 		if (!origin && principal.kind !== "owner") return c.json({
 			ok: false,
 			error: {
@@ -105,7 +113,9 @@ async function handleSessionCommand(c, deps, materialize = false) {
 	try {
 		const payload = await receiveSessionCommand(deps.service, id.data, principal.principalId, command, async () => {
 			if (!("input" in command)) return [];
-			const contexts = (command.input.browserContexts ?? []).map(browserPageContextToAgentContext);
+			const endpoint = command.origin.type === "endpoint" ? deps.service.endpointTools.registry.get(command.origin.endpointId) : void 0;
+			const contexts = endpoint ? [deviceTurnSourceContext(endpoint, command.input.endpointContext)] : [];
+			contexts.push(...(command.input.browserContexts ?? []).map(browserPageContextToAgentContext));
 			if (command.input.appContext) contexts.push(await deps.service.prepareSessionAppContext(command.input.appContext, principal, id.data, command.clientMessageId));
 			return contexts;
 		});

package/dist/src/gateway/hono/routes/session-input-handler.d.ts

@@ -74,7 +74,7 @@ export declare function submitSessionInput(c: Context, deps: AuthenticatedRouteD
                 }[];
                 contextSnapshots?: {
                     refId?: string;
-                    kind: import("../../../agent/source-context/types.js").SessionSourceBinding["kind"] | "task" | "file" | "session" | "mcp_resource" | "browser_tab" | "browser_page" | "app_context" | "user_assertion";
+                    kind: import("../../../agent/source-context/types.js").SessionSourceBinding["kind"] | "task" | "file" | "session" | "browser_tab" | "browser_page" | "app_context" | "user_assertion" | "device_context";
                     sourceId: string;
                     version: string;
                     title: string;
@@ -159,6 +159,12 @@ export declare function replaceLatestSessionTurn(c: Context, deps: Authenticated
         code: string;
         message: string;
     };
+}, 403, "json">) | (Response & import("hono").TypedResponse<{
+    ok: false;
+    error: {
+        code: string;
+        message: string;
+    };
 }, 409, "json">) | (Response & import("hono").TypedResponse<{
     ok: false;
     error: {
@@ -219,7 +225,7 @@ export declare function replaceLatestSessionTurn(c: Context, deps: Authenticated
                 }[];
                 contextSnapshots?: {
                     refId?: string;
-                    kind: import("../../../agent/source-context/types.js").SessionSourceBinding["kind"] | "task" | "file" | "session" | "mcp_resource" | "browser_tab" | "browser_page" | "app_context" | "user_assertion";
+                    kind: import("../../../agent/source-context/types.js").SessionSourceBinding["kind"] | "task" | "file" | "session" | "browser_tab" | "browser_page" | "app_context" | "user_assertion" | "device_context";
                     sourceId: string;
                     version: string;
                     title: string;