@xopcai/xopc 0.0.372 → 0.0.374

package/dist/src/gateway/hono/middleware/auth.js

@@ -1,14 +1,16 @@
 import { logAuthEvent } from "../../../utils/logger/audit.js";
 import { createLogger } from "../../../utils/logger/index.js";
 import { init_logger } from "../../../utils/logger.js";
-import { authenticateDeviceAccessToken, getDevice, init_device_access_repository } from "../../../storage/sqlite/device-access-repository.js";
-import { safeEqualSecret } from "../../security/secret-equal.js";
-import { resolveClientIpFromRequest } from "../../client-ip.js";
 import { authPolicyConfig, buckets, resolveAuthRateLimit } from "../../rate-limit/buckets.js";
 import { resolveAuthTracking } from "../../rate-limit/auth-policy.js";
 import { isAuthRateLimitGloballyDisabled } from "../../rate-limit/env-flags.js";
-import "../../rate-limit/index.js";
+import { init_rate_limit } from "../../rate-limit/index.js";
+import { authenticateDeviceAccessToken, getDevice, init_device_access_repository } from "../../../storage/sqlite/device-access-repository.js";
+import { getOrCreateGatewayIdentity, init_gateway_identity_repository } from "../../../storage/sqlite/gateway-identity-repository.js";
+import { safeEqualSecret } from "../../security/secret-equal.js";
+import { resolveClientIpFromRequest } from "../../client-ip.js";
 import { authenticateBrowserSession } from "../../../storage/sqlite/browser-session-repository.js";
+import { PROOF_HEADER, acquireProofBodyBudget, consumeRequestNonce, parseRequestProof, proofDigest, requestProofMessage, verifyRequestProofSignature } from "../../security/device-request-proof.js";
 import { isChromeExtensionOrigin } from "../../security/origin-check.js";
 import { browserCookieRequestAllowed, readBrowserSessionCookie, writeBrowserSessionCookie } from "../../security/browser-session.js";
 import { authorizeTrustedProxy } from "../../trusted-proxy.js";
@@ -16,6 +18,8 @@ import { setGatewayPrincipal } from "../../security/gateway-principal.js";
 import { createMiddleware } from "hono/factory";
 import { getConnInfo } from "@hono/node-server/conninfo";
 //#region src/gateway/hono/middleware/auth.ts
+init_gateway_identity_repository();
+init_rate_limit();
 init_device_access_repository();
 init_logger();
 const log = createLogger("Gateway:Auth");
@@ -250,16 +254,54 @@ function auth(config) {
 				error: "Forbidden",
 				code: "extension_origin_mismatch"
 			}, 403);
-			recordSuccess(rl);
-			setGatewayPrincipal(c, {
-				kind: "device",
-				principalId: deviceIdentity.deviceId,
-				deviceId: deviceIdentity.deviceId,
-				accessSessionId: deviceIdentity.accessSessionId,
-				scopes: deviceIdentity.scopes
-			});
-			await next();
-			return;
+			let releaseBodyBudget = () => {};
+			try {
+				const proofHeader = c.req.header(PROOF_HEADER);
+				if (device?.requestProofVersion || proofHeader) {
+					const proof = parseRequestProof(proofHeader);
+					const url = new URL(c.req.url);
+					if (!device || !proof || Math.abs(Date.now() - proof.timestamp) > 12e4 || !verifyRequestProofSignature(device, proof, requestProofMessage({
+						gatewayId: getOrCreateGatewayIdentity().id,
+						credential: providedCredential,
+						method: c.req.method,
+						target: url.pathname + url.search,
+						headers: (name) => c.req.header(name),
+						proof
+					}))) return c.json({
+						error: "Unauthorized",
+						code: "REQUEST_PROOF_INVALID"
+					}, 401);
+					const release = /^(multipart\/form-data|application\/octet-stream)/i.test(c.req.header("content-type") ?? "") || Number(c.req.header("content-length") ?? 0) > 65536 ? acquireProofBodyBudget(device.id) : () => {};
+					if (!release) {
+						c.header("Retry-After", "1");
+						return c.json({
+							error: "Too Many Requests",
+							code: "REQUEST_CONCURRENCY_LIMIT"
+						}, 429);
+					}
+					releaseBodyBudget = release;
+					if (proofDigest(Buffer.from(await c.req.raw.clone().arrayBuffer())) !== proof.digest) return c.json({
+						error: "Unauthorized",
+						code: "REQUEST_BODY_MISMATCH"
+					}, 401);
+					if (!consumeRequestNonce(device.id, proof)) return c.json({
+						error: "Unauthorized",
+						code: "REQUEST_REPLAYED"
+					}, 401);
+				}
+				recordSuccess(rl);
+				setGatewayPrincipal(c, {
+					kind: "device",
+					principalId: deviceIdentity.deviceId,
+					deviceId: deviceIdentity.deviceId,
+					accessSessionId: deviceIdentity.accessSessionId,
+					scopes: deviceIdentity.scopes
+				});
+				await next();
+				return;
+			} finally {
+				releaseBodyBudget();
+			}
 		}
 		const blocked = checkBlocked(rl);
 		if (blocked.blocked) {

package/dist/src/gateway/hono/middleware/logger.js

@@ -1,10 +1,11 @@
 import { createLogger } from "../../../utils/logger/index.js";
 import { init_logger } from "../../../utils/logger.js";
+import { getClientIpFromHeaders, init_loopback } from "../../security/loopback.js";
 import { resolveClientIpFromRequest } from "../../client-ip.js";
-import { getClientIpFromHeaders } from "../../security/loopback.js";
 import { createMiddleware } from "hono/factory";
 import { getConnInfo } from "@hono/node-server/conninfo";
 //#region src/gateway/hono/middleware/logger.ts
+init_loopback();
 init_logger();
 const log = createLogger("Gateway:HTTP");
 function resolveRemoteAddress(c) {

package/dist/src/gateway/hono/middleware/public-device-rate-limit.d.ts

@@ -0,0 +1,16 @@
+import type { Context } from 'hono';
+export type PairingPublicRouteOptions = {
+    getTrustedProxyContext?: () => {
+        trustedProxies?: string[];
+        allowRealIpFallback?: boolean;
+    };
+};
+export declare function pairingClientKey(c: Context, options?: PairingPublicRouteOptions): string;
+/** Shared local-hop budgets allow normal mobile polling while bounding pre-auth work. */
+export declare function publicDeviceRateLimit(family: string, options?: PairingPublicRouteOptions): import("hono").MiddlewareHandler<any, string, {}, Response & import("hono").TypedResponse<{
+    ok: false;
+    error: {
+        code: string;
+        message: string;
+    };
+}, 429, "json">>;

package/dist/src/gateway/hono/middleware/public-device-rate-limit.js

@@ -0,0 +1,43 @@
+import { buckets } from "../../rate-limit/buckets.js";
+import { init_rate_limit } from "../../rate-limit/index.js";
+import { resolveClientIpFromRequest } from "../../client-ip.js";
+import { createMiddleware } from "hono/factory";
+import { getConnInfo } from "@hono/node-server/conninfo";
+//#region src/gateway/hono/middleware/public-device-rate-limit.ts
+init_rate_limit();
+function pairingClientKey(c, options) {
+	let remoteAddress;
+	try {
+		remoteAddress = getConnInfo(c).remote.address;
+	} catch {
+		remoteAddress = void 0;
+	}
+	const proxy = options?.getTrustedProxyContext?.();
+	return resolveClientIpFromRequest({
+		remoteAddress,
+		getHeader: (name) => c.req.header(name),
+		trustedProxies: proxy?.trustedProxies,
+		allowRealIpFallback: proxy?.allowRealIpFallback
+	});
+}
+/** Shared local-hop budgets allow normal mobile polling while bounding pre-auth work. */
+function publicDeviceRateLimit(family, options) {
+	return createMiddleware(async (c, next) => {
+		const source = buckets.publicDeviceSource().consume(`${family}:${pairingClientKey(c, options)}`);
+		const total = buckets.publicDeviceGlobal().consume(family);
+		if (!source.allowed || !total.allowed) {
+			const retry = Math.max(source.retryAfterMs, total.retryAfterMs);
+			c.header("Retry-After", String(Math.max(1, Math.ceil(retry / 1e3))));
+			return c.json({
+				ok: false,
+				error: {
+					code: "RATE_LIMITED",
+					message: "Too many requests"
+				}
+			}, 429);
+		}
+		return next();
+	});
+}
+//#endregion
+export { pairingClientKey, publicDeviceRateLimit };

package/dist/src/gateway/hono/middleware/strict-rate-limit.js

@@ -1,8 +1,8 @@
 import { createLogger } from "../../../utils/logger/index.js";
 import { init_logger } from "../../../utils/logger.js";
-import { resolveClientIpFromRequest } from "../../client-ip.js";
 import { buckets } from "../../rate-limit/buckets.js";
-import "../../rate-limit/index.js";
+import { init_rate_limit } from "../../rate-limit/index.js";
+import { resolveClientIpFromRequest } from "../../client-ip.js";
 import { createMiddleware } from "hono/factory";
 import { getConnInfo } from "@hono/node-server/conninfo";
 //#region src/gateway/hono/middleware/strict-rate-limit.ts
@@ -10,6 +10,7 @@ import { getConnInfo } from "@hono/node-server/conninfo";
 * Per-client request-rate gate for sensitive admin/mutation endpoints.
 * Backed by `buckets.strictApi()` — see {@link ../../rate-limit/buckets.ts}.
 */
+init_rate_limit();
 init_logger();
 const log = createLogger("Hono:StrictRateLimit");
 function resolveClientIp(c, deps) {

package/dist/src/gateway/hono/oauth-async.js

@@ -1,8 +1,8 @@
 import { createLogger } from "../../utils/logger/index.js";
 import { init_logger } from "../../utils/logger.js";
+import { init_host, isLoopbackHost } from "../host.js";
 import { getOAuthProviderInterfaces, init_registry } from "../../auth/oauth/registry.js";
 import { CredentialResolver, init_credentials } from "../../auth/credentials.js";
-import { isLoopbackHost } from "../host.js";
 import { resolveReverseProxyPublicUrl } from "../public-url.js";
 import { buildCapabilityPlansForConfig } from "../../capabilities/readiness/from-config.js";
 import "../../capabilities/readiness/index.js";
@@ -18,6 +18,7 @@ import { Hono } from "hono";
 */
 init_registry();
 init_credentials();
+init_host();
 init_logger();
 const log = createLogger("OAuthAsync");
 function buildOAuthCompletionReadiness(config, catalog) {

package/dist/src/gateway/hono/routes/browser.js

@@ -1,16 +1,17 @@
 import { deleteBrowserTabBinding, getBrowserTabBinding, init_browser_tab_binding_repository, setBrowserTabBinding } from "../../../storage/sqlite/browser-tab-binding-repository.js";
 import { browserTabBindingRequestSchema } from "../../../../packages/gateway-contract/src/browser-tab-binding.js";
 import { init_src } from "../../../../packages/gateway-contract/src/index.js";
+import { init_loopback, isLoopbackClientIp } from "../../security/loopback.js";
 import { getDevice, init_device_access_repository } from "../../../storage/sqlite/device-access-repository.js";
 import "../../../../packages/browser-control-contract/src/index.js";
 import { createBrowserDriver } from "../../../browser/drivers/create-driver.js";
 import { checkBrowserReadiness } from "../../../browser/readiness.js";
-import { isLoopbackClientIp } from "../../security/loopback.js";
 import { getGatewayPrincipal } from "../../security/gateway-principal.js";
 import { getConnInfo } from "@hono/node-server/conninfo";
 //#region src/gateway/hono/routes/browser.ts
 /** Browser Control status and driver diagnostics. */
 init_src();
+init_loopback();
 init_device_access_repository();
 init_browser_tab_binding_repository();
 async function extensionStatus(service, includeLocalArtifacts) {

package/dist/src/gateway/hono/routes/config.js

@@ -1,4 +1,4 @@
-import { enumerateLanGatewayCandidates } from "../../host.js";
+import { enumerateLanGatewayCandidates, init_host } from "../../host.js";
 import { getTunnelService } from "../../../tunnel/tunnel-service.js";
 import { buildSafeWebConfigPayload } from "../lib/config-payload.js";
 import { applyChannelsPatch } from "./config-patch/channels.js";
@@ -6,6 +6,7 @@ import { applyGatewayPatch } from "./config-patch/gateway.js";
 import { applyMiscPatch, validateGatewayAfterPatch } from "./config-patch/misc.js";
 import "./config-patch/index.js";
 //#region src/gateway/hono/routes/config.ts
+init_host();
 function localeFromRequest(c) {
 	return c.req.query("locale") ?? c.req.header("X-XOPC-Locale") ?? c.req.header("Accept-Language")?.split(",")[0];
 }

package/dist/src/gateway/hono/routes/device-pairing-approval.d.ts

@@ -1,10 +1,5 @@
-import type { Context, Hono } from 'hono';
-export type PairingPublicRouteOptions = {
-    getTrustedProxyContext?: () => {
-        trustedProxies?: string[];
-        allowRealIpFallback?: boolean;
-    };
-};
-export declare function pairingClientKey(c: Context, options?: PairingPublicRouteOptions): string;
+import type { Hono } from 'hono';
+import { type PairingPublicRouteOptions } from '../middleware/public-device-rate-limit.js';
+export { pairingClientKey, type PairingPublicRouteOptions } from '../middleware/public-device-rate-limit.js';
 export declare function registerPairingApprovalPublicRoutes(app: Hono, options?: PairingPublicRouteOptions): void;
 export declare function registerPairingApprovalAdminRoutes(app: Hono): void;

package/dist/src/gateway/hono/routes/device-pairing-approval.js

@@ -1,32 +1,17 @@
 import { devicePairingCompleteSchema, devicePairingProofSchema, devicePairingRequestSchema } from "../../../../packages/gateway-contract/src/device-pairing.js";
 import { init_src } from "../../../../packages/gateway-contract/src/index.js";
-import { getOrCreateGatewayIdentity, init_gateway_identity_repository, signGatewayPayload } from "../../../storage/sqlite/gateway-identity-repository.js";
-import { resolveClientIpFromRequest } from "../../client-ip.js";
 import { buckets } from "../../rate-limit/buckets.js";
-import "../../rate-limit/index.js";
+import { init_rate_limit } from "../../rate-limit/index.js";
+import { getOrCreateGatewayIdentity, init_gateway_identity_repository, signGatewayPayload } from "../../../storage/sqlite/gateway-identity-repository.js";
+import { pairingClientKey, publicDeviceRateLimit } from "../middleware/public-device-rate-limit.js";
 import { DevicePairingError, cancelDevicePairingSetup, decideDevicePairingRequest, operateDevicePairingRequest, readDevicePairingSetup, submitDevicePairingRequest } from "../../../storage/sqlite/device-pairing-approval.js";
 import os from "node:os";
 import { z } from "zod";
 import { bodyLimit } from "hono/body-limit";
-import { getConnInfo } from "@hono/node-server/conninfo";
 //#region src/gateway/hono/routes/device-pairing-approval.ts
 init_src();
 init_gateway_identity_repository();
-function pairingClientKey(c, options) {
-	let remoteAddress;
-	try {
-		remoteAddress = getConnInfo(c).remote.address;
-	} catch {
-		remoteAddress = void 0;
-	}
-	const proxy = options?.getTrustedProxyContext?.();
-	return resolveClientIpFromRequest({
-		remoteAddress,
-		getHeader: (name) => c.req.header(name),
-		trustedProxies: proxy?.trustedProxies,
-		allowRealIpFallback: proxy?.allowRealIpFallback
-	});
-}
+init_rate_limit();
 function pairingBlocked(c, key) {
 	const blocked = buckets.pairingExchange().check(key);
 	if (!blocked.blocked) return void 0;
@@ -63,7 +48,7 @@ function registerPairingApprovalPublicRoutes(app, options) {
 		"cancel"
 	]) {
 		const path = action === "request" ? "/api/device-pairing/requests" : `/api/device-pairing/requests/:id/${action}`;
-		app.post(path, bodyLimit({ maxSize: 4 * 1024 }), async (c) => {
+		app.post(path, publicDeviceRateLimit("pairing", options), bodyLimit({ maxSize: 4 * 1024 }), async (c) => {
 			const clientKey = pairingClientKey(c, options);
 			const blocked = pairingBlocked(c, clientKey);
 			if (blocked) return blocked;

package/dist/src/gateway/hono/routes/devices.js

@@ -1,13 +1,14 @@
 import { browserPairingInvitationPayloadSchema, devicePairingTargetKindSchema, formatBrowserPairingInvitation, formatMobilePairingInvitation } from "../../../../packages/gateway-contract/src/device-pairing.js";
 import { init_src } from "../../../../packages/gateway-contract/src/index.js";
-import { init_device_access_repository, listDevices, revokeDevice, rotateDeviceRefreshToken } from "../../../storage/sqlite/device-access-repository.js";
+import { buckets } from "../../rate-limit/buckets.js";
+import { init_rate_limit } from "../../rate-limit/index.js";
+import { DeviceRefreshRateLimitError, init_device_access_repository, listDevices, revokeDevice, rotateDeviceRefreshToken } from "../../../storage/sqlite/device-access-repository.js";
 import { getGatewayIdentityPublicKeyRaw, getOrCreateGatewayIdentity, init_gateway_identity_repository, signGatewayPayload } from "../../../storage/sqlite/gateway-identity-repository.js";
 import { createDevicePairingSetup, init_device_pairing_repository, isDevicePairingSetupActive } from "../../../storage/sqlite/device-pairing-repository.js";
 import { resolveSecureDeviceRoutes } from "../../device-routes.js";
-import { buckets } from "../../rate-limit/buckets.js";
-import "../../rate-limit/index.js";
 import { getGatewayPrincipal } from "../../security/gateway-principal.js";
-import { pairingClientKey, registerPairingApprovalAdminRoutes, registerPairingApprovalPublicRoutes } from "./device-pairing-approval.js";
+import { pairingClientKey, publicDeviceRateLimit } from "../middleware/public-device-rate-limit.js";
+import { registerPairingApprovalAdminRoutes, registerPairingApprovalPublicRoutes } from "./device-pairing-approval.js";
 import os from "node:os";
 import { z } from "zod";
 import { bodyLimit } from "hono/body-limit";
@@ -16,18 +17,20 @@ init_src();
 init_device_access_repository();
 init_device_pairing_repository();
 init_gateway_identity_repository();
+init_rate_limit();
 const refreshRequestSchema = z.strictObject({
 	refreshToken: z.string().min(1).max(256),
 	timestamp: z.number().int().positive(),
 	nonce: z.string().min(16).max(128),
 	requestId: z.string().uuid(),
 	nextRefreshToken: z.string().min(80).max(256),
-	signature: z.string().min(1).max(256)
+	signature: z.string().min(1).max(256),
+	requestProofVersion: z.literal(1).optional()
 });
 const pairingProbeSchema = z.strictObject({ pairingId: z.string().uuid() });
 const pairingSetupSchema = z.strictObject({ targetKind: devicePairingTargetKindSchema });
 function registerDeviceAuthPublicRoutes(app, options) {
-	app.post("/api/gateway-identity/challenge", bodyLimit({ maxSize: 512 }), async (c) => {
+	app.post("/api/gateway-identity/challenge", publicDeviceRateLimit("challenge", options), bodyLimit({ maxSize: 512 }), async (c) => {
 		const budget = buckets.identityChallenge().consume("gateway");
 		if (!budget.allowed) {
 			c.header("Retry-After", String(Math.ceil(budget.retryAfterMs / 1e3)));
@@ -40,6 +43,8 @@ function registerDeviceAuthPublicRoutes(app, options) {
 			purpose: "gateway-route-v1",
 			gatewayId: identity.id,
 			nonce: parsed.data.nonce,
+			serverTime: Date.now(),
+			requestProofVersion: 1,
 			expiresAt: Date.now() + 3e4
 		})).toString("base64url");
 		c.header("Cache-Control", "no-store");
@@ -49,7 +54,7 @@ function registerDeviceAuthPublicRoutes(app, options) {
 		});
 	});
 	registerPairingApprovalPublicRoutes(app, options);
-	app.post("/api/device-auth/refresh", async (c) => {
+	app.post("/api/device-auth/refresh", publicDeviceRateLimit("refresh", options), bodyLimit({ maxSize: 4096 }), async (c) => {
 		const parsed = refreshRequestSchema.safeParse(await c.req.json().catch(() => null));
 		if (!parsed.success) return c.json({
 			ok: false,
@@ -66,6 +71,7 @@ function registerDeviceAuthPublicRoutes(app, options) {
 				requestId: parsed.data.requestId,
 				nonce: parsed.data.nonce,
 				expiresAt: Date.now() + 3e4,
+				requestProofVersion: parsed.data.requestProofVersion ?? 0,
 				tokens
 			})).toString("base64url");
 			return c.json({
@@ -74,16 +80,26 @@ function registerDeviceAuthPublicRoutes(app, options) {
 				signature: signGatewayPayload(signedPayload)
 			});
 		} catch (error) {
+			if (error instanceof DeviceRefreshRateLimitError) {
+				c.header("Retry-After", String(Math.max(1, Math.ceil(error.retryAfterMs / 1e3))));
+				return c.json({
+					ok: false,
+					error: {
+						code: "RATE_LIMITED",
+						message: "Too many requests"
+					}
+				}, 429);
+			}
 			return c.json({
 				ok: false,
 				error: {
 					code: "REFRESH_DENIED",
-					message: error instanceof Error ? error.message : "Refresh denied"
+					message: "Refresh denied"
 				}
 			}, 401);
 		}
 	});
-	app.post("/api/device-pairing/probe", bodyLimit({ maxSize: 512 }), async (c) => {
+	app.post("/api/device-pairing/probe", publicDeviceRateLimit("pairing", options), bodyLimit({ maxSize: 512 }), async (c) => {
 		const clientKey = pairingClientKey(c, options);
 		const blocked = buckets.pairingExchange().check(clientKey);
 		if (blocked.blocked) {

package/dist/src/gateway/hono/routes/endpoint-tools.js

@@ -71,6 +71,7 @@ function registerEndpointToolRoutes(authenticated, deps) {
 				...lastSeenAt ? { lastSeenAt } : {},
 				access: access ? {
 					scopes: access.scopes,
+					requestProofVersion: access.requestProofVersion,
 					createdAt: access.createdAt,
 					...access.lastSeenAt ? { lastSeenAt: access.lastSeenAt } : {},
 					...access.revokedAt ? { revokedAt: access.revokedAt } : {}

package/dist/src/gateway/hono/routes/models.js

@@ -9,6 +9,7 @@ import { getModelRegistry } from "../../../providers/model-registry.js";
 import "../../../providers/constants.js";
 import { getProviderRegistry, init_plugin_registry } from "../../../providers/plugin-registry.js";
 import { PROVIDER_META, getAllModels, getAllProviders, getAvailableModels, getProviderAuthState, init_providers, isProviderConfigured, isProviderConfiguredSync } from "../../../providers/index.js";
+import { XopcCloudAccountError, XopcCloudAccountService } from "../../../providers/xopc-cloud-account-service.js";
 import { buildCapabilityPlansForConfig } from "../../../capabilities/readiness/from-config.js";
 import "../../../capabilities/readiness/index.js";
 import { getModelThinking } from "../../../providers/model-thinking.js";
@@ -23,7 +24,6 @@ import { dismissXopcCloudOnboarding, getXopcCloudOnboardingStatus } from "../../
 import { getDomesticProviderPreset, getDomesticProviderPresetIds } from "../../../providers/domestic-presets.js";
 import { auditModelReferences } from "../../../providers/model-reference-auditor.js";
 import { getOnboardingFeaturedProviders, getProviderHint, getRecommendedModelsForProvider, isRecommendedModel, sortModelsForPicker, sortProvidersForPicker } from "../../../providers/presentation.js";
-import { XopcCloudAccountError, XopcCloudAccountService } from "../../../providers/xopc-cloud-account-service.js";
 //#region src/gateway/hono/routes/models.ts
 init_model_policy();
 init_models_json();

package/dist/src/gateway/hono/routes/personal-agent.js

@@ -40,6 +40,7 @@ const OnboardingSchema = z.object({
 	draft: PersonalOnboardingDraftSchema
 }).strict();
 const ProfileSchema = z.object({
+	voiceCallPreferences: z.object({ openingGreetingEnabled: z.boolean() }).strict().optional(),
 	revision: z.number().int().positive(),
 	displayName: z.string().trim().min(1).max(60),
 	appearance: PersonalAppearanceSchema,
@@ -348,7 +349,7 @@ function registerPersonalAgentRoutes(authenticated, deps) {
 			ok: false,
 			error: "Invalid profile"
 		}, 400);
-		const { revision, displayName, appearance, preferences, voicePreference } = parsed.data;
+		const { revision, displayName, appearance, preferences, voicePreference, voiceCallPreferences } = parsed.data;
 		if (voicePreference) {
 			const { resolveStreamingTts } = await import("../../../voice/realtime/runtime.js");
 			const route = resolveStreamingTts(deps.service.currentConfig);
@@ -364,7 +365,7 @@ function registerPersonalAgentRoutes(authenticated, deps) {
 				error: "Selected voice is unavailable"
 			}, 400);
 		}
-		const updated = await patchPersonalProfile(deps.service, ownerId, revision, displayName, preferences, appearance, voicePreference);
+		const updated = await patchPersonalProfile(deps.service, ownerId, revision, displayName, preferences, appearance, voicePreference, voiceCallPreferences);
 		return updated ? c.json({
 			ok: true,
 			payload: updated

package/dist/src/gateway/hono/routes/public-gateway.js

@@ -25,18 +25,18 @@ function secretsEqual(actual, expected) {
 }
 function registerPublicGatewayRoutes(app, service) {
 	app.get("/health", (c) => {
-		return c.json(service.getHealth());
+		const health = service.getHealth();
+		return c.json({
+			status: health.ready ? "ok" : "starting",
+			ready: health.ready
+		});
 	});
 	/** Public liveness probe (no auth) — minimal payload for CLI / load balancers. */
 	app.get("/api/health", (c) => {
 		const health = service.getHealth();
 		return c.json({
 			status: health.ready ? "ok" : "starting",
-			ready: health.ready,
-			httpListening: health.httpListening,
-			version: health.version,
-			uptime: health.uptime,
-			startupDurationMs: health.startupDurationMs
+			ready: health.ready
 		});
 	});
 	app.post("/api/connectors/composio/webhook", async (c) => {

package/dist/src/gateway/hono/routes/shares.js

@@ -1,3 +1,4 @@
+import { getClientIpFromHeaders, init_loopback } from "../../security/loopback.js";
 import { loadCompactionSourceSnapshot } from "../../../storage/sqlite/transcript-repository.js";
 import { init_sqlite } from "../../../storage/sqlite/index.js";
 import { FileServiceError } from "../../../files/file-service.js";
@@ -16,7 +17,6 @@ import { resolveReverseProxyPublicUrl } from "../../public-url.js";
 import { audienceDefaults, cleanupStagedSite, decideShareKind, forgetStagedSite, makeDescription, makeTitle, probeShareTarget, rememberStagedSite, stageSingleHtmlAsSite } from "../../../share/share-auto.js";
 import { deleteThumbnail, placeholderSvg, readThumbnail, scheduleThumbnail, thumbnailContentType, thumbnailExists } from "../../../share/share-thumbnail.js";
 import { getGatewayFileSpaceService } from "../../file-space-service.js";
-import { getClientIpFromHeaders } from "../../security/loopback.js";
 import { SHARED_HTML_CSP } from "../../security/csp.js";
 import { getGatewayPrincipal } from "../../security/gateway-principal.js";
 import { renderFolderLandingPage, renderShareExpiredPage, renderShareLandingPage, renderSnapshotShareLandingPage } from "../../../share/share-landing.js";
@@ -31,6 +31,7 @@ import { createHash } from "node:crypto";
 import { stat } from "node:fs/promises";
 import { Readable } from "node:stream";
 //#region src/gateway/hono/routes/shares.ts
+init_loopback();
 init_sqlite();
 function getShareUrlContext(service) {
 	const gateway = service.currentConfig.gateway;

package/dist/src/gateway/hono/routes/usage.js

@@ -1,4 +1,5 @@
-import { getAiUsageEventView, listAiUsageEvents, listAiUsageTrace, summarizeAiUsage } from "../../../storage/sqlite/ai-usage-repository.js";
+import { getAiUsageEventView, listAiUsageEvents, listAiUsageTrace, pendingAiUsageCloudReceiptIds, summarizeAiUsage } from "../../../storage/sqlite/ai-usage-repository.js";
+import { reconcileCloudUsageReceipt } from "../../../usage/cloud-receipts.js";
 import { z } from "zod";
 import { Hono } from "hono";
 //#region src/gateway/hono/routes/usage.ts
@@ -41,14 +42,23 @@ function registerUsageRoutes(authenticated, _deps) {
 		if (error instanceof z.ZodError || error.message.startsWith("invalid_usage_")) return c.json({ error: "invalid_usage_query" }, 400);
 		throw error;
 	});
-	app.get("/summary", (c) => c.json(summarizeAiUsage(parseFilters(c.req.query()))));
-	app.get("/events", (c) => {
+	const refreshReceipts = async (query) => {
+		await Promise.all(pendingAiUsageCloudReceiptIds(query).map(reconcileCloudUsageReceipt));
+	};
+	app.get("/summary", async (c) => {
+		const query = parseFilters(c.req.query());
+		await refreshReceipts(query);
+		return c.json(summarizeAiUsage(query));
+	});
+	app.get("/events", async (c) => {
 		const limit = z.coerce.number().int().min(1).max(200).optional().parse(c.req.query("limit"));
-		return c.json(listAiUsageEvents({
+		const query = {
 			...parseFilters(c.req.query()),
 			limit,
 			before: parseCursor(c.req.query("cursor"))
-		}));
+		};
+		await refreshReceipts(query);
+		return c.json(listAiUsageEvents(query));
 	});
 	app.get("/events/:id", (c) => {
 		const event = getAiUsageEventView(c.req.param("id"));

package/dist/src/gateway/hono/routes/voice.js

@@ -184,6 +184,7 @@ function registerVoiceRoutes(authenticated, deps) {
 			ok: true,
 			payload: {
 				enabled,
+				openingGreeting: true,
 				capabilities: {
 					dictation: availability(Boolean(stt)),
 					assistant: availability(Boolean(stt && tts)),

package/dist/src/gateway/host.js

@@ -1,4 +1,5 @@
-import "../daemon/constants.js";
+import { __esmMin } from "../../_virtual/_rolldown/runtime.js";
+import { init_constants } from "../daemon/constants.js";
 import { networkInterfaces } from "node:os";
 //#region src/gateway/host.ts
 /** True when the bind address is local-only (127.x, localhost, ::1). */
@@ -13,8 +14,6 @@ function isAllInterfacesHost(host) {
 	const normalized = host.trim();
 	return normalized === "0.0.0.0" || normalized === "::" || normalized === "*";
 }
-/** Vite dev server origins for the gateway console (`web/` defaults to port 3000). */
-const GATEWAY_DEV_CONSOLE_ORIGINS = ["http://localhost:3000", "http://127.0.0.1:3000"];
 /** Non-internal IPv4 addresses that can serve this gateway on the local network. */
 function enumerateLanGatewayCandidates(port) {
 	const seen = /* @__PURE__ */ new Set();
@@ -86,5 +85,11 @@ function resolveAllowedBrowserOrigins(params) {
 	if (reverseProxyOrigin && !origins.includes(reverseProxyOrigin)) origins.push(reverseProxyOrigin);
 	return origins;
 }
+var GATEWAY_DEV_CONSOLE_ORIGINS;
+var init_host = __esmMin((() => {
+	init_constants();
+	GATEWAY_DEV_CONSOLE_ORIGINS = ["http://localhost:3000", "http://127.0.0.1:3000"];
+}));
 //#endregion
-export { GATEWAY_DEV_CONSOLE_ORIGINS, buildDefaultCorsOrigins, enumerateLanGatewayCandidates, isAllInterfacesHost, isLoopbackHost, originFromGatewayPublicUrl, resolveAllowedBrowserOrigins, resolveEffectiveGatewayPort, resolveGatewayCorsOrigins, resolveGatewayServiceListenPort };
+init_host();
+export { GATEWAY_DEV_CONSOLE_ORIGINS, buildDefaultCorsOrigins, enumerateLanGatewayCandidates, init_host, isAllInterfacesHost, isLoopbackHost, originFromGatewayPublicUrl, resolveAllowedBrowserOrigins, resolveEffectiveGatewayPort, resolveGatewayCorsOrigins, resolveGatewayServiceListenPort };

package/dist/src/gateway/index.js

@@ -1,11 +1,11 @@
-import { buildDefaultCorsOrigins, isAllInterfacesHost, isLoopbackHost, resolveEffectiveGatewayPort, resolveGatewayServiceListenPort } from "./host.js";
+import { buckets } from "./rate-limit/buckets.js";
+import { buildDefaultCorsOrigins, init_host, isAllInterfacesHost, isLoopbackHost, resolveEffectiveGatewayPort, resolveGatewayServiceListenPort } from "./host.js";
+import { isGatewayStrictSecurityEnabled } from "./rate-limit/env-flags.js";
+import { init_rate_limit } from "./rate-limit/index.js";
 import { defaultGatewayBindMode, isContainerEnvironment, resolveGatewayBindHost, resolveGatewayBindHostSync, resolveGatewayBindMode, resolveGatewayEffectiveHost } from "../config/gateway-bind.js";
 import { GatewayLockError, acquireGatewayLock } from "./lock.js";
 import { assertGatewayAuthConfigured, extractToken, resolveGatewayAuth, validateToken } from "./auth.js";
 import { resolveGatewayListenHost, resolveGatewayListenPlan } from "./listen.js";
-import { buckets } from "./rate-limit/buckets.js";
-import { isGatewayStrictSecurityEnabled } from "./rate-limit/env-flags.js";
-import "./rate-limit/index.js";
 import { assertGatewayRuntimeConfig } from "./runtime-config.js";
 import { restartGatewayProcessWithFreshPid } from "./respawn.js";
 import { GatewayService } from "./service.js";
@@ -16,4 +16,8 @@ import { checkPortAvailable, forceFreePortAndWait, listPortListeners, parseLsofO
 import { apiError, apiOk } from "./protocol.js";
 import "./hono/index.js";
 import { assertSecureGatewayHttpUrl, assertSecureWebSocketUrl, isInsecurePrivateWsAllowed, isSecureWebSocketUrl } from "./ws-security.js";
+//#region src/gateway/index.ts
+init_host();
+init_rate_limit();
+//#endregion
 export { GatewayLockError, GatewayServer, GatewayService, acquireGatewayLock, apiError, apiOk, assertGatewayAuthConfigured, assertGatewayRuntimeConfig, assertSecureGatewayHttpUrl, assertSecureWebSocketUrl, buckets, buildDefaultCorsOrigins, checkPortAvailable, createHonoApp, defaultGatewayBindMode, extractToken, forceFreePortAndWait, isAllInterfacesHost, isContainerEnvironment, isGatewayStrictSecurityEnabled, isInsecurePrivateWsAllowed, isLoopbackHost, isSecureWebSocketUrl, listPortListeners, parseLsofOutput, resolveEffectiveGatewayPort, resolveGatewayAuth, resolveGatewayBindHost, resolveGatewayBindHostSync, resolveGatewayBindMode, resolveGatewayEffectiveHost, resolveGatewayListenHost, resolveGatewayListenPlan, resolveGatewayServiceListenPort, restartGatewayProcessWithFreshPid, runGatewayLoop, validateToken };

package/dist/src/gateway/listen.js

@@ -1,6 +1,7 @@
-import { buildDefaultCorsOrigins, isAllInterfacesHost, isLoopbackHost } from "./host.js";
+import { buildDefaultCorsOrigins, init_host, isAllInterfacesHost, isLoopbackHost } from "./host.js";
 import { resolveGatewayBindHostSync, resolveGatewayBindMode, resolveGatewayCustomBindHost } from "../config/gateway-bind.js";
 //#region src/gateway/listen.ts
+init_host();
 /** Resolve the effective HTTP listen host (CLI bind override > config bind). */
 function resolveGatewayListenHost(params) {
 	return resolveGatewayBindHostSync({