@xopcai/xopc 0.0.373 → 0.0.375

package/dist/src/connectors/connected-source-understanding.js

@@ -4,14 +4,15 @@ import { finishContextExtractionRun } from "../storage/sqlite/context-extraction
 import { createContextEvidence, init_context_evidence_repository } from "../storage/sqlite/context-evidence-repository.js";
 import { getKnowledgeSourceItem } from "../storage/sqlite/knowledge-repository.js";
 import { init_sqlite } from "../storage/sqlite/index.js";
+import { getActiveUnderstandingConsent } from "../user-context/sources/consent-repository.js";
+import { getUnderstandingSourceRun } from "../user-context/sources/repository.js";
 import { writeKnowledgeItem } from "../knowledge-memory/repository.js";
 import "../knowledge-memory/index.js";
+import { consentFilteredText } from "../user-context/sources/consent-fields.js";
+import { claimRegisteredExtraction } from "../user-context/extraction/registry.js";
 import { reconcileAssertion } from "../user-model/repository.js";
 import "../user-model/index.js";
-import { claimRegisteredExtraction } from "../user-context/extraction/registry.js";
 import { recordConnectedSourceObservations } from "./connected-source-observations.js";
-import { getActiveUnderstandingConsent } from "../user-context/sources/consent-repository.js";
-import { getUnderstandingSourceRun } from "../user-context/sources/repository.js";
 import { allowsRemoteSourceProcessing } from "../user-context/sources/processing-policy.js";
 import { analyzeUnderstandingSources } from "../work-discovery/analyzer.js";
 import { createHash } from "node:crypto";
@@ -48,68 +49,6 @@ function timestamp(value) {
 	const parsed = Date.parse(value);
 	return Number.isFinite(parsed) ? parsed : void 0;
 }
-const CONSENT_FIELD_KEYS = {
-	title: new Set([
-		"title",
-		"subject",
-		"name",
-		"fullName",
-		"repository"
-	]),
-	content: new Set([
-		"content",
-		"body",
-		"text",
-		"snippet",
-		"description",
-		"summary"
-	]),
-	participants: new Set([
-		"from",
-		"to",
-		"cc",
-		"bcc",
-		"sender",
-		"author",
-		"organizer",
-		"attendees",
-		"participants",
-		"assignee",
-		"owners"
-	]),
-	status: new Set([
-		"status",
-		"state",
-		"labels"
-	]),
-	timestamps: new Set([
-		"createdAt",
-		"updatedAt",
-		"modifiedAt",
-		"start",
-		"end",
-		"created_at",
-		"updated_at",
-		"modified_at"
-	]),
-	owner_activity: new Set([
-		"user",
-		"username",
-		"owner"
-	])
-};
-function consentFilteredText(textValue, allowedFields) {
-	if (!textValue) return void 0;
-	try {
-		const parsed = JSON.parse(textValue);
-		if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) return void 0;
-		const allowedKeys = new Set([...allowedFields].flatMap((field) => [...CONSENT_FIELD_KEYS[field] ?? []]));
-		const filtered = Object.fromEntries(Object.entries(parsed).filter(([key]) => allowedKeys.has(key)));
-		return Object.keys(filtered).length ? JSON.stringify(filtered) : void 0;
-	} catch {
-		return allowedFields.has("content") ? textValue.slice(0, 24e3) : void 0;
-	}
-}
 function itemsAllowedByConsent(items, consent) {
 	if (!consent) return [];
 	const allowed = new Set(consent.allowedFields);
@@ -180,7 +119,27 @@ function candidatePolicy(candidate) {
 	};
 }
 async function deriveConnectedSourceUnderstanding(input) {
-	const sourceItems = [...new Set(input.sourceItemIds)].slice(0, MAX_CONNECTED_ITEMS).flatMap((itemId) => getKnowledgeSourceItem(itemId) ?? []).filter((item) => item.sourceInstanceId === input.sourceInstanceId && item.metadata.agentId === input.agentId && !item.deletedAt);
+	const uniqueIds = [...new Set(input.sourceItemIds)];
+	if (uniqueIds.length > MAX_CONNECTED_ITEMS) {
+		let created = 0, knowledgeCount = 0;
+		let status = "completed";
+		for (let offset = 0; offset < uniqueIds.length; offset += MAX_CONNECTED_ITEMS) {
+			const batch = await deriveConnectedSourceUnderstanding({
+				...input,
+				sourceItemIds: uniqueIds.slice(offset, offset + MAX_CONNECTED_ITEMS),
+				batchOrdinal: offset / MAX_CONNECTED_ITEMS
+			});
+			created += batch.created;
+			knowledgeCount += batch.knowledgeCount;
+			if (batch.status !== "completed") status = "partial";
+		}
+		return {
+			created,
+			knowledgeCount,
+			status
+		};
+	}
+	const sourceItems = uniqueIds.flatMap((itemId) => getKnowledgeSourceItem(itemId) ?? []).filter((item) => item.sourceInstanceId === input.sourceInstanceId && item.metadata.agentId === input.agentId && !item.deletedAt);
 	const items = connectedItemsForUnderstanding(sourceItems);
 	if (!items.length) {
 		log.info({
@@ -206,7 +165,7 @@ async function deriveConnectedSourceUnderstanding(input) {
 	const effectiveProcessingPolicy = input.processingPolicy === "remote_allowed" && consentReceipt?.processingPolicy === "remote_allowed" ? "remote_allowed" : "local_only";
 	const extraction = claimRegisteredExtraction({
 		extractorId: "connector-semantic",
-		sourceRef: `understanding-source-run:${input.sourceRunId}`,
+		sourceRef: `understanding-source-run:${input.sourceRunId}${input.batchOrdinal === void 0 ? "" : `:batch:${input.batchOrdinal}`}`,
 		contentForHash: sourceItems.map((item) => `${item.id}:${item.contentHash}`).join("\n"),
 		processingPolicy: effectiveProcessingPolicy,
 		destination: "remote_model"
@@ -239,9 +198,12 @@ async function deriveConnectedSourceUnderstanding(input) {
 			let assertionId;
 			let candidateCreated = false;
 			for (const [index, evidenceItem] of evidenceItems.entries()) {
+				const sourceItem = sourceItems.find((item) => `knowledge-source://${item.id}` === evidenceItem.evidenceRef);
 				const evidence = createContextEvidence({
 					sourceType: "connector",
 					sourceInstanceId: input.sourceInstanceId,
+					sourceItemId: sourceItem?.id,
+					contentHash: sourceItem?.contentHash,
 					sourceRef: evidenceItem.evidenceRef,
 					redactedExcerpt: evidenceItem.title.slice(0, 600),
 					trustLevel: "owner",
@@ -316,9 +278,12 @@ async function deriveConnectedSourceUnderstanding(input) {
 				const validityDays = thread.horizon === "current" ? 30 : thread.horizon === "ongoing" ? 90 : 365;
 				let goalCreated = false;
 				for (const evidenceItem of goalEvidence) {
+					const sourceItem = sourceItems.find((item) => `knowledge-source://${item.id}` === evidenceItem.evidenceRef);
 					const evidence = createContextEvidence({
 						sourceType: "connector",
 						sourceInstanceId: input.sourceInstanceId,
+						sourceItemId: sourceItem?.id,
+						contentHash: sourceItem?.contentHash,
 						sourceRef: evidenceItem.evidenceRef,
 						redactedExcerpt: evidenceItem.title.slice(0, 600),
 						trustLevel: "owner",
@@ -372,8 +337,33 @@ async function deriveConnectedSourceUnderstanding(input) {
 				}
 				if (goalCreated) created += 1;
 			}
+			const evidence = evidenceRefs.flatMap((ref) => {
+				const evidenceItem = byRef.get(ref);
+				const sourceItem = sourceItems.find((item) => `knowledge-source://${item.id}` === ref);
+				if (!evidenceItem || !sourceItem || !consentReceipt) return [];
+				return [{
+					id: createContextEvidence({
+						sourceType: "connector",
+						sourceInstanceId: input.sourceInstanceId,
+						sourceRef: ref,
+						sourceItemId: sourceItem.id,
+						sourceRunId: input.sourceRunId,
+						contentHash: sourceItem.contentHash,
+						processingPolicy: effectiveProcessingPolicy,
+						redactedExcerpt: evidenceItem.title.slice(0, 600),
+						trustLevel: "untrusted",
+						observedAt: evidenceItem.occurredAt ?? evidenceItem.modifiedAt ?? Date.now()
+					}).id,
+					contentHash: sourceItem.contentHash,
+					consentReceiptId: consentReceipt.id
+				}];
+			});
 			const result = writeKnowledgeItem({
 				kind: "work_thread",
+				claimMode: "reported",
+				verification: evidence.length === evidenceRefs.length ? "supported" : "tentative",
+				evidence,
+				reviewAt: Date.now() + (thread.horizon === "current" ? 14 : 90) * 864e5,
 				scope: { type: "global" },
 				content: `${thread.title}: ${thread.summary}`,
 				canonicalKey: candidateKey,
@@ -383,6 +373,8 @@ async function deriveConnectedSourceUnderstanding(input) {
 				sourceAgentId: input.agentId,
 				source: {
 					sourceRunId: input.sourceRunId,
+					sourceInstanceId: input.sourceInstanceId,
+					consentReceiptId: consentReceipt?.id,
 					evidenceRefs
 				},
 				replaceExisting: true

package/dist/src/connectors/content-enrichment.js

@@ -1,8 +1,8 @@
 import { getConnectorConnection, getConnectorInstallation } from "../storage/sqlite/connector-repository.js";
 import { getKnowledgeSourceItem, listKnowledgeSourceItems, upsertKnowledgeSourceItems } from "../storage/sqlite/knowledge-repository.js";
 import { init_sqlite } from "../storage/sqlite/index.js";
-import { ComposioSessionsAdapter } from "./composio-sessions.js";
 import { ConnectedKnowledgePipeline } from "../knowledge/connected-knowledge-pipeline.js";
+import { ComposioSessionsAdapter } from "./composio-sessions.js";
 import { sanitizeConnectedSourceValue } from "./connected-source-sanitization.js";
 import { tmpdir } from "node:os";
 import { isAbsolute, join, relative, sep } from "node:path";

package/dist/src/connectors/learning-coordinator.js

@@ -6,13 +6,13 @@ import { getConnectorInstallation, listConnectorConnections, upsertConnectorConn
 import { pruneBoundedKnowledgeSourceItems } from "../storage/sqlite/knowledge-repository.js";
 import { getConnectorSyncPolicyForConnection } from "../storage/sqlite/connector-sync-policy-repository.js";
 import { init_sqlite } from "../storage/sqlite/index.js";
+import { getActiveUnderstandingConsent, grantUnderstandingConsent } from "../user-context/sources/consent-repository.js";
+import { getConnectorUnderstandingSourceRun, getOrCreateConnectorUnderstandingSourceRun, getUnderstandingSourceGrant, listUnderstandingSourceGrants, updateUnderstandingSourceGrantCheckpoint, updateUnderstandingSourceRun, upsertUnderstandingSourceGrant } from "../user-context/sources/repository.js";
 import { connectorIdentityKey, normalizeConnectorIdentity } from "./connector-identity.js";
 import { ComposioSessionsAdapter } from "./composio-sessions.js";
 import { buildConnectorLearningArguments, getConnectorLearningPlan } from "./learning-recipes.js";
 import { getConnectorDefinition } from "./catalog.js";
 import { ingestComposioConnectedSource } from "./connected-source-ingestion.js";
-import { getActiveUnderstandingConsent, grantUnderstandingConsent } from "../user-context/sources/consent-repository.js";
-import { getConnectorUnderstandingSourceRun, getOrCreateConnectorUnderstandingSourceRun, getUnderstandingSourceGrant, listUnderstandingSourceGrants, updateUnderstandingSourceGrantCheckpoint, updateUnderstandingSourceRun, upsertUnderstandingSourceGrant } from "../user-context/sources/repository.js";
 import { deriveConnectedSourceUnderstanding } from "./connected-source-understanding.js";
 import { listConnectedContentCandidates, readConnectedContent } from "./content-enrichment.js";
 //#region src/connectors/learning-coordinator.ts

package/dist/src/daemon/constants.js

@@ -1,10 +1,10 @@
+import { __esmMin } from "../../_virtual/_rolldown/runtime.js";
 import os from "node:os";
 import path from "node:path";
 //#region src/daemon/constants.ts
 /**
 * Daemon Constants - Service labels, paths, and configuration values
 */
-const SERVICE_BASE_LABEL = "ai.xopc.gateway";
 function resolveGatewayLaunchAgentLabel(profile) {
 	const normalized = normalizeProfile(profile);
 	return normalized ? `${SERVICE_BASE_LABEL}.${normalized}` : SERVICE_BASE_LABEL;
@@ -39,12 +39,17 @@ function normalizeProfile(profile) {
 	if (!trimmed || trimmed.toLowerCase() === "default") return null;
 	return trimmed;
 }
-const DEFAULT_GATEWAY_PORT = 18790;
-const LAUNCH_AGENT_THROTTLE_INTERVAL_SECONDS = 10;
-const LAUNCH_AGENT_EXIT_TIMEOUT_SECONDS = 20;
-const SYSTEMD_RESTART_SEC = 5;
-const SYSTEMD_START_LIMIT_BURST = 5;
-const SYSTEMD_START_LIMIT_INTERVAL_SEC = 60;
-const SERVICE_VERSION_ENV_KEY = "XOPC_SERVICE_VERSION";
+var SERVICE_BASE_LABEL, DEFAULT_GATEWAY_PORT, LAUNCH_AGENT_THROTTLE_INTERVAL_SECONDS, LAUNCH_AGENT_EXIT_TIMEOUT_SECONDS, SYSTEMD_RESTART_SEC, SYSTEMD_START_LIMIT_BURST, SYSTEMD_START_LIMIT_INTERVAL_SEC, SERVICE_VERSION_ENV_KEY;
+var init_constants = __esmMin((() => {
+	SERVICE_BASE_LABEL = "ai.xopc.gateway";
+	DEFAULT_GATEWAY_PORT = 18790;
+	LAUNCH_AGENT_THROTTLE_INTERVAL_SECONDS = 10;
+	LAUNCH_AGENT_EXIT_TIMEOUT_SECONDS = 20;
+	SYSTEMD_RESTART_SEC = 5;
+	SYSTEMD_START_LIMIT_BURST = 5;
+	SYSTEMD_START_LIMIT_INTERVAL_SEC = 60;
+	SERVICE_VERSION_ENV_KEY = "XOPC_SERVICE_VERSION";
+}));
 //#endregion
-export { DEFAULT_GATEWAY_PORT, LAUNCH_AGENT_EXIT_TIMEOUT_SECONDS, LAUNCH_AGENT_THROTTLE_INTERVAL_SECONDS, SERVICE_VERSION_ENV_KEY, SYSTEMD_RESTART_SEC, SYSTEMD_START_LIMIT_BURST, SYSTEMD_START_LIMIT_INTERVAL_SEC, formatGatewayServiceDescription, resolveGatewayLaunchAgentLabel, resolveGatewaySystemdServiceName, resolveGatewayWindowsTaskName, resolveLaunchAgentPlistPath, resolveSystemdUnitPath };
+init_constants();
+export { DEFAULT_GATEWAY_PORT, LAUNCH_AGENT_EXIT_TIMEOUT_SECONDS, LAUNCH_AGENT_THROTTLE_INTERVAL_SECONDS, SERVICE_VERSION_ENV_KEY, SYSTEMD_RESTART_SEC, SYSTEMD_START_LIMIT_BURST, SYSTEMD_START_LIMIT_INTERVAL_SEC, formatGatewayServiceDescription, init_constants, resolveGatewayLaunchAgentLabel, resolveGatewaySystemdServiceName, resolveGatewayWindowsTaskName, resolveLaunchAgentPlistPath, resolveSystemdUnitPath };

package/dist/src/daemon/index.js

@@ -1,4 +1,7 @@
-import { DEFAULT_GATEWAY_PORT, LAUNCH_AGENT_EXIT_TIMEOUT_SECONDS, LAUNCH_AGENT_THROTTLE_INTERVAL_SECONDS, SERVICE_VERSION_ENV_KEY, SYSTEMD_RESTART_SEC, SYSTEMD_START_LIMIT_BURST, SYSTEMD_START_LIMIT_INTERVAL_SEC, formatGatewayServiceDescription, resolveGatewayLaunchAgentLabel, resolveGatewaySystemdServiceName, resolveGatewayWindowsTaskName, resolveLaunchAgentPlistPath, resolveSystemdUnitPath } from "./constants.js";
+import { DEFAULT_GATEWAY_PORT, LAUNCH_AGENT_EXIT_TIMEOUT_SECONDS, LAUNCH_AGENT_THROTTLE_INTERVAL_SECONDS, SERVICE_VERSION_ENV_KEY, SYSTEMD_RESTART_SEC, SYSTEMD_START_LIMIT_BURST, SYSTEMD_START_LIMIT_INTERVAL_SEC, formatGatewayServiceDescription, init_constants, resolveGatewayLaunchAgentLabel, resolveGatewaySystemdServiceName, resolveGatewayWindowsTaskName, resolveLaunchAgentPlistPath, resolveSystemdUnitPath } from "./constants.js";
 import { describeGatewayServiceRestart, getPlatformName, getServiceLabel, isDaemonAvailable, isDaemonAvailableAsync, resolveGatewayService, startGatewayService } from "./service.js";
 import { buildGatewayInstallArgs, buildGatewayInstallPlan, validateInstallPlanProgram } from "./install-plan.js";
+//#region src/daemon/index.ts
+init_constants();
+//#endregion
 export { DEFAULT_GATEWAY_PORT, LAUNCH_AGENT_EXIT_TIMEOUT_SECONDS, LAUNCH_AGENT_THROTTLE_INTERVAL_SECONDS, SERVICE_VERSION_ENV_KEY, SYSTEMD_RESTART_SEC, SYSTEMD_START_LIMIT_BURST, SYSTEMD_START_LIMIT_INTERVAL_SEC, buildGatewayInstallArgs, buildGatewayInstallPlan, describeGatewayServiceRestart, formatGatewayServiceDescription, getPlatformName, getServiceLabel, isDaemonAvailable, isDaemonAvailableAsync, resolveGatewayLaunchAgentLabel, resolveGatewayService, resolveGatewaySystemdServiceName, resolveGatewayWindowsTaskName, resolveLaunchAgentPlistPath, resolveSystemdUnitPath, startGatewayService, validateInstallPlanProgram };

package/dist/src/daemon/install-plan.js

@@ -1,7 +1,7 @@
 import { PACKAGE_VERSION, init_package_version } from "../package-version.js";
 import { createLogger } from "../utils/logger/index.js";
 import { init_logger } from "../utils/logger.js";
-import { SERVICE_VERSION_ENV_KEY, formatGatewayServiceDescription } from "./constants.js";
+import { SERVICE_VERSION_ENV_KEY, formatGatewayServiceDescription, init_constants } from "./constants.js";
 import { homedir } from "node:os";
 import path from "node:path";
 import { existsSync } from "node:fs";
@@ -14,6 +14,7 @@ import { fileURLToPath } from "node:url";
 * supports binary runtime detection, and --foreground arg passing.
 */
 init_logger();
+init_constants();
 init_package_version();
 const log = createLogger("InstallPlan");
 function resolveDefaultConfigPath() {

package/dist/src/daemon/launchd.js

@@ -1,6 +1,6 @@
 import { createLogger } from "../utils/logger/index.js";
 import { init_logger } from "../utils/logger.js";
-import { resolveGatewayLaunchAgentLabel, resolveLaunchAgentPlistPath as resolveLaunchAgentPlistPath$1 } from "./constants.js";
+import { init_constants, resolveGatewayLaunchAgentLabel, resolveLaunchAgentPlistPath as resolveLaunchAgentPlistPath$1 } from "./constants.js";
 import os from "node:os";
 import path from "node:path";
 import { existsSync } from "node:fs";
@@ -18,6 +18,7 @@ import { mkdir, readFile, rm, writeFile } from "node:fs/promises";
 * - launchctl kickstart -k for restart
 */
 init_logger();
+init_constants();
 const log = createLogger("LaunchdService");
 function resolveGuiDomain() {
 	return `gui/${typeof process.getuid === "function" ? process.getuid() : 501}`;

package/dist/src/daemon/schtasks.js

@@ -1,6 +1,6 @@
 import { createLogger } from "../utils/logger/index.js";
 import { init_logger } from "../utils/logger.js";
-import { resolveGatewayWindowsTaskName } from "./constants.js";
+import { init_constants, resolveGatewayWindowsTaskName } from "./constants.js";
 import os from "node:os";
 import path from "node:path";
 import { mkdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";
@@ -15,6 +15,7 @@ import { spawn, spawnSync } from "node:child_process";
 * - Proper start/stop/restart lifecycle
 */
 init_logger();
+init_constants();
 const log = createLogger("SchtasksService");
 function resolveProfileFromEnv(env) {
 	return env?.XOPC_PROFILE?.trim() || void 0;

package/dist/src/daemon/service-audit.js

@@ -1,5 +1,5 @@
 import { PACKAGE_VERSION, init_package_version } from "../package-version.js";
-import { SERVICE_VERSION_ENV_KEY } from "./constants.js";
+import { SERVICE_VERSION_ENV_KEY, init_constants } from "./constants.js";
 import { existsSync } from "node:fs";
 import { readFile } from "node:fs/promises";
 //#region src/daemon/service-audit.ts
@@ -14,6 +14,7 @@ import { readFile } from "node:fs/promises";
 * - Platform-specific configuration issues
 */
 init_package_version();
+init_constants();
 /** Audit installed service configuration against current config and version */
 async function auditGatewayServiceConfig(params) {
 	const { service, env = process.env, expectedToken, expectedPort, currentVersion = PACKAGE_VERSION } = params;

package/dist/src/daemon/service.js

@@ -1,7 +1,7 @@
 import { PACKAGE_VERSION, init_package_version } from "../package-version.js";
 import { createLogger } from "../utils/logger/index.js";
 import { init_logger } from "../utils/logger.js";
-import { SERVICE_VERSION_ENV_KEY } from "./constants.js";
+import { SERVICE_VERSION_ENV_KEY, init_constants } from "./constants.js";
 import { existsSync } from "node:fs";
 //#region src/daemon/service.ts
 /**
@@ -14,6 +14,7 @@ import { existsSync } from "node:fs";
 */
 init_logger();
 init_package_version();
+init_constants();
 const log = createLogger("DaemonService");
 let _isDaemonAvailable = null;
 async function resolveGatewayService() {

package/dist/src/daemon/systemd.js

@@ -1,6 +1,6 @@
 import { createLogger } from "../utils/logger/index.js";
 import { init_logger } from "../utils/logger.js";
-import { resolveGatewaySystemdServiceName, resolveSystemdUnitPath } from "./constants.js";
+import { init_constants, resolveGatewaySystemdServiceName, resolveSystemdUnitPath } from "./constants.js";
 import os from "node:os";
 import path from "node:path";
 import { existsSync } from "node:fs";
@@ -17,6 +17,7 @@ import { access, constants as constants$1, mkdir, readFile, rm, writeFile } from
 * - network-online.target dependency
 */
 init_logger();
+init_constants();
 const log = createLogger("SystemdService");
 function resolveProfileFromEnv(env) {
 	return env?.XOPC_PROFILE?.trim() || void 0;

package/dist/src/extensions/agent-plugins/validation.js

@@ -2,8 +2,8 @@ import { dirname, isAbsolute, join, relative, resolve } from "node:path";
 import { existsSync, lstatSync, readFileSync, readdirSync, realpathSync, statSync } from "node:fs";
 import { createHash } from "node:crypto";
 import { z } from "zod";
-import yaml from "js-yaml";
 import { validateHeaderName, validateHeaderValue } from "node:http";
+import yaml from "js-yaml";
 //#region src/extensions/agent-plugins/validation.ts
 const PLUGIN_SCHEMA = "https://agent-plugins.org/schemas/1.0.0/plugin.schema.json";
 const MCP_SCHEMA = "https://agent-plugins.org/schemas/1.0.0/mcp.schema.json";

package/dist/src/gateway/agents-admin.js

@@ -1,10 +1,10 @@
 import { normalizeAgentId, validateAgentIdForNewAgent } from "../agent-catalog/id.js";
 import { AgentCatalogRepository, init_repository } from "../agent-catalog/repository.js";
 import { init_agent_scope, listAgentEntries, resolveAgentProfileDir, resolveAgentWorkspaceDir, resolveDefaultAgentId, resolveUserPath } from "../agent/agent-scope.js";
-import { AGENT_PROFILE_MARKDOWN_SYSTEM_FILES, REQUIRED_AGENT_PROFILE_MARKDOWN_FILE_SET } from "../agent/context/workspace.js";
-import { AgentCatalogService } from "../agent-catalog/service.js";
 import { resolveEffectiveAgentProfile } from "../config/agent-profile.js";
+import { AGENT_PROFILE_MARKDOWN_SYSTEM_FILES, REQUIRED_AGENT_PROFILE_MARKDOWN_FILE_SET } from "../agent/context/workspace.js";
 import { isPathUnderWorkspace, resolveWorkspaceSafePath } from "./workspace-editor-path.js";
+import { AgentCatalogService } from "../agent-catalog/service.js";
 import { GATEWAY_BUILTIN_TOOL_IDS } from "./agent-builtin-tools.js";
 import { resolve } from "node:path";
 import { mkdir, readFile, realpath, stat, unlink, writeFile } from "node:fs/promises";

package/dist/src/gateway/client-ip.js

@@ -1,6 +1,7 @@
-import { isLoopbackHost } from "./host.js";
+import { init_host, isLoopbackHost } from "./host.js";
 import net from "node:net";
 //#region src/gateway/client-ip.ts
+init_host();
 function stripIpv6Brackets(value) {
 	if (value.startsWith("[") && value.endsWith("]")) return value.slice(1, -1);
 	return value;

package/dist/src/gateway/file-path-classifier.js

@@ -1,7 +1,7 @@
 import { init_paths_state, resolveStateDir } from "../config/paths-state.js";
 import { init_agent_scope, resolveAgentProfileDir } from "../agent/agent-scope.js";
-import { init_paths, resolveConfigPath, resolveSkillsDir } from "../config/paths.js";
 import { extractProfileAgentId } from "../config/agent-profile.js";
+import { init_paths, resolveConfigPath, resolveSkillsDir } from "../config/paths.js";
 import { isBareProfileMarkdownFileName, resolveProfileMarkdownPathIfBareName } from "../agent/tools/tool-paths.js";
 import { isPathUnderWorkspace } from "./workspace-editor-path.js";
 import { homedir } from "node:os";

package/dist/src/gateway/hono/app.js

@@ -1,8 +1,8 @@
 import { createLogger } from "../../utils/logger/index.js";
 import { init_logger } from "../../utils/logger.js";
+import { init_host, resolveAllowedBrowserOrigins, resolveGatewayServiceListenPort } from "../host.js";
 import { init_device_access_repository, listDevices } from "../../storage/sqlite/device-access-repository.js";
 import { ENDPOINT_MAX_FILE_BYTES, init_src } from "../../../packages/endpoint-tools-protocol/src/index.js";
-import { resolveAllowedBrowserOrigins, resolveGatewayServiceListenPort } from "../host.js";
 import { resolveGatewayEffectiveHost } from "../../config/gateway-bind.js";
 import { loadTunnelState } from "../../tunnel/tunnel-state.js";
 import { resolveReverseProxyPublicUrl } from "../public-url.js";
@@ -34,6 +34,7 @@ import { getConnInfo } from "@hono/node-server/conninfo";
 //#region src/gateway/hono/app.ts
 init_src();
 init_logger();
+init_host();
 init_device_access_repository();
 const log = createLogger("Gateway:App");
 /**

package/dist/src/gateway/hono/lib/config-payload.d.ts

@@ -250,6 +250,11 @@ export declare function buildSafeWebConfigPayload(service: GatewayService, optio
             searchTimeoutMs: number;
             writeStrategy: "local-first" | "external-first" | "local-only" | "external-only" | "write-through";
             allowExternalWrites: boolean;
+            learning?: {
+                idleFlushMs: number;
+                maxBatchChars: number;
+                maxDailyBatches: number;
+            };
             allowedProviderIds?: string[];
             autoWriteKinds?: string[];
         };

package/dist/src/gateway/hono/lib/config-payload.js

@@ -1,7 +1,7 @@
+import { ContextPlanningConfigSchema, KnowledgeMemoryConfigSchema, UserModelConfigSchema, init_config } from "../../../user-context/config.js";
 import { normalizeAgentId } from "../../../agent-catalog/id.js";
 import { AgentCatalogRepository, init_repository } from "../../../agent-catalog/repository.js";
 import { init_agent_scope, listAgentEntries, resolveDefaultAgentId } from "../../../agent/agent-scope.js";
-import { ContextPlanningConfigSchema, KnowledgeMemoryConfigSchema, UserModelConfigSchema, init_config } from "../../../user-context/config.js";
 import { resolveModelsJsonPath } from "../../../config/paths.js";
 import { init_models_json, loadModelsJson } from "../../../config/models-json.js";
 import { CredentialResolver, init_credentials } from "../../../auth/credentials.js";

package/dist/src/gateway/hono/middleware/auth.d.ts

@@ -13,12 +13,10 @@ export interface AuthConfig {
 export declare function auth(config?: AuthConfig): import("hono").MiddlewareHandler<any, string, {}, (Response & import("hono").TypedResponse<{
     error: string;
     code: string;
-    message: string;
-    retryAfter: number;
-}, 429, "json">) | (Response & import("hono").TypedResponse<{
+}, 401, "json">) | (Response & import("hono").TypedResponse<{
     error: string;
     code: string;
-}, 401, "json">) | (Response & import("hono").TypedResponse<{
+}, 403, "json">) | (Response & import("hono").TypedResponse<{
     error: string;
     code: string;
-}, 403, "json">)>;
+}, 429, "json">)>;

package/dist/src/gateway/hono/middleware/auth.js

@@ -1,14 +1,16 @@
 import { logAuthEvent } from "../../../utils/logger/audit.js";
 import { createLogger } from "../../../utils/logger/index.js";
 import { init_logger } from "../../../utils/logger.js";
-import { authenticateDeviceAccessToken, getDevice, init_device_access_repository } from "../../../storage/sqlite/device-access-repository.js";
-import { safeEqualSecret } from "../../security/secret-equal.js";
-import { resolveClientIpFromRequest } from "../../client-ip.js";
 import { authPolicyConfig, buckets, resolveAuthRateLimit } from "../../rate-limit/buckets.js";
 import { resolveAuthTracking } from "../../rate-limit/auth-policy.js";
 import { isAuthRateLimitGloballyDisabled } from "../../rate-limit/env-flags.js";
-import "../../rate-limit/index.js";
+import { init_rate_limit } from "../../rate-limit/index.js";
+import { authenticateDeviceAccessToken, getDevice, init_device_access_repository } from "../../../storage/sqlite/device-access-repository.js";
+import { getOrCreateGatewayIdentity, init_gateway_identity_repository } from "../../../storage/sqlite/gateway-identity-repository.js";
+import { safeEqualSecret } from "../../security/secret-equal.js";
+import { resolveClientIpFromRequest } from "../../client-ip.js";
 import { authenticateBrowserSession } from "../../../storage/sqlite/browser-session-repository.js";
+import { PROOF_HEADER, acquireProofBodyBudget, consumeRequestNonce, parseRequestProof, proofDigest, requestProofMessage, verifyRequestProofSignature } from "../../security/device-request-proof.js";
 import { isChromeExtensionOrigin } from "../../security/origin-check.js";
 import { browserCookieRequestAllowed, readBrowserSessionCookie, writeBrowserSessionCookie } from "../../security/browser-session.js";
 import { authorizeTrustedProxy } from "../../trusted-proxy.js";
@@ -16,6 +18,8 @@ import { setGatewayPrincipal } from "../../security/gateway-principal.js";
 import { createMiddleware } from "hono/factory";
 import { getConnInfo } from "@hono/node-server/conninfo";
 //#region src/gateway/hono/middleware/auth.ts
+init_gateway_identity_repository();
+init_rate_limit();
 init_device_access_repository();
 init_logger();
 const log = createLogger("Gateway:Auth");
@@ -250,16 +254,54 @@ function auth(config) {
 				error: "Forbidden",
 				code: "extension_origin_mismatch"
 			}, 403);
-			recordSuccess(rl);
-			setGatewayPrincipal(c, {
-				kind: "device",
-				principalId: deviceIdentity.deviceId,
-				deviceId: deviceIdentity.deviceId,
-				accessSessionId: deviceIdentity.accessSessionId,
-				scopes: deviceIdentity.scopes
-			});
-			await next();
-			return;
+			let releaseBodyBudget = () => {};
+			try {
+				const proofHeader = c.req.header(PROOF_HEADER);
+				if (device?.requestProofVersion || proofHeader) {
+					const proof = parseRequestProof(proofHeader);
+					const url = new URL(c.req.url);
+					if (!device || !proof || Math.abs(Date.now() - proof.timestamp) > 12e4 || !verifyRequestProofSignature(device, proof, requestProofMessage({
+						gatewayId: getOrCreateGatewayIdentity().id,
+						credential: providedCredential,
+						method: c.req.method,
+						target: url.pathname + url.search,
+						headers: (name) => c.req.header(name),
+						proof
+					}))) return c.json({
+						error: "Unauthorized",
+						code: "REQUEST_PROOF_INVALID"
+					}, 401);
+					const release = /^(multipart\/form-data|application\/octet-stream)/i.test(c.req.header("content-type") ?? "") || Number(c.req.header("content-length") ?? 0) > 65536 ? acquireProofBodyBudget(device.id) : () => {};
+					if (!release) {
+						c.header("Retry-After", "1");
+						return c.json({
+							error: "Too Many Requests",
+							code: "REQUEST_CONCURRENCY_LIMIT"
+						}, 429);
+					}
+					releaseBodyBudget = release;
+					if (proofDigest(Buffer.from(await c.req.raw.clone().arrayBuffer())) !== proof.digest) return c.json({
+						error: "Unauthorized",
+						code: "REQUEST_BODY_MISMATCH"
+					}, 401);
+					if (!consumeRequestNonce(device.id, proof)) return c.json({
+						error: "Unauthorized",
+						code: "REQUEST_REPLAYED"
+					}, 401);
+				}
+				recordSuccess(rl);
+				setGatewayPrincipal(c, {
+					kind: "device",
+					principalId: deviceIdentity.deviceId,
+					deviceId: deviceIdentity.deviceId,
+					accessSessionId: deviceIdentity.accessSessionId,
+					scopes: deviceIdentity.scopes
+				});
+				await next();
+				return;
+			} finally {
+				releaseBodyBudget();
+			}
 		}
 		const blocked = checkBlocked(rl);
 		if (blocked.blocked) {

package/dist/src/gateway/hono/middleware/logger.js

@@ -1,10 +1,11 @@
 import { createLogger } from "../../../utils/logger/index.js";
 import { init_logger } from "../../../utils/logger.js";
+import { getClientIpFromHeaders, init_loopback } from "../../security/loopback.js";
 import { resolveClientIpFromRequest } from "../../client-ip.js";
-import { getClientIpFromHeaders } from "../../security/loopback.js";
 import { createMiddleware } from "hono/factory";
 import { getConnInfo } from "@hono/node-server/conninfo";
 //#region src/gateway/hono/middleware/logger.ts
+init_loopback();
 init_logger();
 const log = createLogger("Gateway:HTTP");
 function resolveRemoteAddress(c) {

package/dist/src/gateway/hono/middleware/public-device-rate-limit.d.ts

@@ -0,0 +1,16 @@
+import type { Context } from 'hono';
+export type PairingPublicRouteOptions = {
+    getTrustedProxyContext?: () => {
+        trustedProxies?: string[];
+        allowRealIpFallback?: boolean;
+    };
+};
+export declare function pairingClientKey(c: Context, options?: PairingPublicRouteOptions): string;
+/** Shared local-hop budgets allow normal mobile polling while bounding pre-auth work. */
+export declare function publicDeviceRateLimit(family: string, options?: PairingPublicRouteOptions): import("hono").MiddlewareHandler<any, string, {}, Response & import("hono").TypedResponse<{
+    ok: false;
+    error: {
+        code: string;
+        message: string;
+    };
+}, 429, "json">>;