@xopcai/xopc 0.0.374 → 0.0.376

package/dist/src/connectors/connected-source-understanding.js

@@ -4,14 +4,15 @@ import { finishContextExtractionRun } from "../storage/sqlite/context-extraction
 import { createContextEvidence, init_context_evidence_repository } from "../storage/sqlite/context-evidence-repository.js";
 import { getKnowledgeSourceItem } from "../storage/sqlite/knowledge-repository.js";
 import { init_sqlite } from "../storage/sqlite/index.js";
+import { getActiveUnderstandingConsent } from "../user-context/sources/consent-repository.js";
+import { getUnderstandingSourceRun } from "../user-context/sources/repository.js";
 import { writeKnowledgeItem } from "../knowledge-memory/repository.js";
 import "../knowledge-memory/index.js";
+import { consentFilteredText } from "../user-context/sources/consent-fields.js";
+import { claimRegisteredExtraction } from "../user-context/extraction/registry.js";
 import { reconcileAssertion } from "../user-model/repository.js";
 import "../user-model/index.js";
-import { claimRegisteredExtraction } from "../user-context/extraction/registry.js";
 import { recordConnectedSourceObservations } from "./connected-source-observations.js";
-import { getActiveUnderstandingConsent } from "../user-context/sources/consent-repository.js";
-import { getUnderstandingSourceRun } from "../user-context/sources/repository.js";
 import { allowsRemoteSourceProcessing } from "../user-context/sources/processing-policy.js";
 import { analyzeUnderstandingSources } from "../work-discovery/analyzer.js";
 import { createHash } from "node:crypto";
@@ -48,68 +49,6 @@ function timestamp(value) {
 	const parsed = Date.parse(value);
 	return Number.isFinite(parsed) ? parsed : void 0;
 }
-const CONSENT_FIELD_KEYS = {
-	title: new Set([
-		"title",
-		"subject",
-		"name",
-		"fullName",
-		"repository"
-	]),
-	content: new Set([
-		"content",
-		"body",
-		"text",
-		"snippet",
-		"description",
-		"summary"
-	]),
-	participants: new Set([
-		"from",
-		"to",
-		"cc",
-		"bcc",
-		"sender",
-		"author",
-		"organizer",
-		"attendees",
-		"participants",
-		"assignee",
-		"owners"
-	]),
-	status: new Set([
-		"status",
-		"state",
-		"labels"
-	]),
-	timestamps: new Set([
-		"createdAt",
-		"updatedAt",
-		"modifiedAt",
-		"start",
-		"end",
-		"created_at",
-		"updated_at",
-		"modified_at"
-	]),
-	owner_activity: new Set([
-		"user",
-		"username",
-		"owner"
-	])
-};
-function consentFilteredText(textValue, allowedFields) {
-	if (!textValue) return void 0;
-	try {
-		const parsed = JSON.parse(textValue);
-		if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) return void 0;
-		const allowedKeys = new Set([...allowedFields].flatMap((field) => [...CONSENT_FIELD_KEYS[field] ?? []]));
-		const filtered = Object.fromEntries(Object.entries(parsed).filter(([key]) => allowedKeys.has(key)));
-		return Object.keys(filtered).length ? JSON.stringify(filtered) : void 0;
-	} catch {
-		return allowedFields.has("content") ? textValue.slice(0, 24e3) : void 0;
-	}
-}
 function itemsAllowedByConsent(items, consent) {
 	if (!consent) return [];
 	const allowed = new Set(consent.allowedFields);
@@ -180,7 +119,27 @@ function candidatePolicy(candidate) {
 	};
 }
 async function deriveConnectedSourceUnderstanding(input) {
-	const sourceItems = [...new Set(input.sourceItemIds)].slice(0, MAX_CONNECTED_ITEMS).flatMap((itemId) => getKnowledgeSourceItem(itemId) ?? []).filter((item) => item.sourceInstanceId === input.sourceInstanceId && item.metadata.agentId === input.agentId && !item.deletedAt);
+	const uniqueIds = [...new Set(input.sourceItemIds)];
+	if (uniqueIds.length > MAX_CONNECTED_ITEMS) {
+		let created = 0, knowledgeCount = 0;
+		let status = "completed";
+		for (let offset = 0; offset < uniqueIds.length; offset += MAX_CONNECTED_ITEMS) {
+			const batch = await deriveConnectedSourceUnderstanding({
+				...input,
+				sourceItemIds: uniqueIds.slice(offset, offset + MAX_CONNECTED_ITEMS),
+				batchOrdinal: offset / MAX_CONNECTED_ITEMS
+			});
+			created += batch.created;
+			knowledgeCount += batch.knowledgeCount;
+			if (batch.status !== "completed") status = "partial";
+		}
+		return {
+			created,
+			knowledgeCount,
+			status
+		};
+	}
+	const sourceItems = uniqueIds.flatMap((itemId) => getKnowledgeSourceItem(itemId) ?? []).filter((item) => item.sourceInstanceId === input.sourceInstanceId && item.metadata.agentId === input.agentId && !item.deletedAt);
 	const items = connectedItemsForUnderstanding(sourceItems);
 	if (!items.length) {
 		log.info({
@@ -206,7 +165,7 @@ async function deriveConnectedSourceUnderstanding(input) {
 	const effectiveProcessingPolicy = input.processingPolicy === "remote_allowed" && consentReceipt?.processingPolicy === "remote_allowed" ? "remote_allowed" : "local_only";
 	const extraction = claimRegisteredExtraction({
 		extractorId: "connector-semantic",
-		sourceRef: `understanding-source-run:${input.sourceRunId}`,
+		sourceRef: `understanding-source-run:${input.sourceRunId}${input.batchOrdinal === void 0 ? "" : `:batch:${input.batchOrdinal}`}`,
 		contentForHash: sourceItems.map((item) => `${item.id}:${item.contentHash}`).join("\n"),
 		processingPolicy: effectiveProcessingPolicy,
 		destination: "remote_model"
@@ -239,9 +198,12 @@ async function deriveConnectedSourceUnderstanding(input) {
 			let assertionId;
 			let candidateCreated = false;
 			for (const [index, evidenceItem] of evidenceItems.entries()) {
+				const sourceItem = sourceItems.find((item) => `knowledge-source://${item.id}` === evidenceItem.evidenceRef);
 				const evidence = createContextEvidence({
 					sourceType: "connector",
 					sourceInstanceId: input.sourceInstanceId,
+					sourceItemId: sourceItem?.id,
+					contentHash: sourceItem?.contentHash,
 					sourceRef: evidenceItem.evidenceRef,
 					redactedExcerpt: evidenceItem.title.slice(0, 600),
 					trustLevel: "owner",
@@ -316,9 +278,12 @@ async function deriveConnectedSourceUnderstanding(input) {
 				const validityDays = thread.horizon === "current" ? 30 : thread.horizon === "ongoing" ? 90 : 365;
 				let goalCreated = false;
 				for (const evidenceItem of goalEvidence) {
+					const sourceItem = sourceItems.find((item) => `knowledge-source://${item.id}` === evidenceItem.evidenceRef);
 					const evidence = createContextEvidence({
 						sourceType: "connector",
 						sourceInstanceId: input.sourceInstanceId,
+						sourceItemId: sourceItem?.id,
+						contentHash: sourceItem?.contentHash,
 						sourceRef: evidenceItem.evidenceRef,
 						redactedExcerpt: evidenceItem.title.slice(0, 600),
 						trustLevel: "owner",
@@ -372,8 +337,33 @@ async function deriveConnectedSourceUnderstanding(input) {
 				}
 				if (goalCreated) created += 1;
 			}
+			const evidence = evidenceRefs.flatMap((ref) => {
+				const evidenceItem = byRef.get(ref);
+				const sourceItem = sourceItems.find((item) => `knowledge-source://${item.id}` === ref);
+				if (!evidenceItem || !sourceItem || !consentReceipt) return [];
+				return [{
+					id: createContextEvidence({
+						sourceType: "connector",
+						sourceInstanceId: input.sourceInstanceId,
+						sourceRef: ref,
+						sourceItemId: sourceItem.id,
+						sourceRunId: input.sourceRunId,
+						contentHash: sourceItem.contentHash,
+						processingPolicy: effectiveProcessingPolicy,
+						redactedExcerpt: evidenceItem.title.slice(0, 600),
+						trustLevel: "untrusted",
+						observedAt: evidenceItem.occurredAt ?? evidenceItem.modifiedAt ?? Date.now()
+					}).id,
+					contentHash: sourceItem.contentHash,
+					consentReceiptId: consentReceipt.id
+				}];
+			});
 			const result = writeKnowledgeItem({
 				kind: "work_thread",
+				claimMode: "reported",
+				verification: evidence.length === evidenceRefs.length ? "supported" : "tentative",
+				evidence,
+				reviewAt: Date.now() + (thread.horizon === "current" ? 14 : 90) * 864e5,
 				scope: { type: "global" },
 				content: `${thread.title}: ${thread.summary}`,
 				canonicalKey: candidateKey,
@@ -383,6 +373,8 @@ async function deriveConnectedSourceUnderstanding(input) {
 				sourceAgentId: input.agentId,
 				source: {
 					sourceRunId: input.sourceRunId,
+					sourceInstanceId: input.sourceInstanceId,
+					consentReceiptId: consentReceipt?.id,
 					evidenceRefs
 				},
 				replaceExisting: true

package/dist/src/connectors/content-enrichment.js

@@ -1,8 +1,8 @@
 import { getConnectorConnection, getConnectorInstallation } from "../storage/sqlite/connector-repository.js";
 import { getKnowledgeSourceItem, listKnowledgeSourceItems, upsertKnowledgeSourceItems } from "../storage/sqlite/knowledge-repository.js";
 import { init_sqlite } from "../storage/sqlite/index.js";
-import { ComposioSessionsAdapter } from "./composio-sessions.js";
 import { ConnectedKnowledgePipeline } from "../knowledge/connected-knowledge-pipeline.js";
+import { ComposioSessionsAdapter } from "./composio-sessions.js";
 import { sanitizeConnectedSourceValue } from "./connected-source-sanitization.js";
 import { tmpdir } from "node:os";
 import { isAbsolute, join, relative, sep } from "node:path";

package/dist/src/connectors/health.js

@@ -1,4 +1,5 @@
 import { init_connector_repository, listConnectorConnections } from "../storage/sqlite/connector-repository.js";
+import { getWorkspacePath } from "../config/workspace-path-helpers.js";
 import { currentAccountConnections } from "./account-access.js";
 import { getConnectorInstance } from "./instances.js";
 import { describeCliAction, verifyCliConnection } from "./cli/runtime.js";
@@ -8,7 +9,7 @@ function classifyConnectorHealthError(error) {
 	const message = error instanceof Error ? error.message : String(error);
 	if (/timed out|timeout/i.test(message)) return "timeout";
 	if (/ECONN|ENOTFOUND|network|fetch failed/i.test(message)) return "network_failed";
-	if (/401|unauthorized|forbidden|permission denied/i.test(message)) return "unauthorized";
+	if (/401|unauthorized|forbidden|permission denied|needs sign-in|needs-auth/i.test(message)) return "unauthorized";
 	if (/missing|required|credential|api key|token/i.test(message)) return "missing_secret";
 	if (/tools|listTools/i.test(message)) return "tools_list_failed";
 	if (/spawn|command|start|connect/i.test(message)) return "startup_failed";
@@ -88,7 +89,39 @@ async function testConnectorInstance(config, serverId) {
 			};
 		}
 	}
-	throw new Error("MCP diagnostics are provided by xopc mcp list.");
+	if (instance.materialized.type === "mcp") {
+		const base = {
+			serverId,
+			toolCount: 0,
+			resourceCount: 0,
+			promptCount: 0,
+			tools: [],
+			resources: [],
+			prompts: []
+		};
+		try {
+			const { discoverMcpTools } = await import("../agent/mcp/tool-catalog.js");
+			const tools = await discoverMcpTools(config, getWorkspacePath(config) || process.cwd(), serverId);
+			return {
+				...base,
+				ok: true,
+				status: "ok",
+				toolCount: tools.length,
+				tools: tools.map((tool) => ({
+					name: tool.name,
+					description: tool.description
+				}))
+			};
+		} catch (error) {
+			return {
+				...base,
+				ok: false,
+				status: classifyConnectorHealthError(error),
+				error: error instanceof Error ? error.message : String(error)
+			};
+		}
+	}
+	throw new Error(`Connector type "${instance.materialized.type}" does not support health checks.`);
 }
 //#endregion
 export { testConnectorInstance };

package/dist/src/connectors/learning-coordinator.js

@@ -6,13 +6,13 @@ import { getConnectorInstallation, listConnectorConnections, upsertConnectorConn
 import { pruneBoundedKnowledgeSourceItems } from "../storage/sqlite/knowledge-repository.js";
 import { getConnectorSyncPolicyForConnection } from "../storage/sqlite/connector-sync-policy-repository.js";
 import { init_sqlite } from "../storage/sqlite/index.js";
+import { getActiveUnderstandingConsent, grantUnderstandingConsent } from "../user-context/sources/consent-repository.js";
+import { getConnectorUnderstandingSourceRun, getOrCreateConnectorUnderstandingSourceRun, getUnderstandingSourceGrant, listUnderstandingSourceGrants, updateUnderstandingSourceGrantCheckpoint, updateUnderstandingSourceRun, upsertUnderstandingSourceGrant } from "../user-context/sources/repository.js";
 import { connectorIdentityKey, normalizeConnectorIdentity } from "./connector-identity.js";
 import { ComposioSessionsAdapter } from "./composio-sessions.js";
 import { buildConnectorLearningArguments, getConnectorLearningPlan } from "./learning-recipes.js";
 import { getConnectorDefinition } from "./catalog.js";
 import { ingestComposioConnectedSource } from "./connected-source-ingestion.js";
-import { getActiveUnderstandingConsent, grantUnderstandingConsent } from "../user-context/sources/consent-repository.js";
-import { getConnectorUnderstandingSourceRun, getOrCreateConnectorUnderstandingSourceRun, getUnderstandingSourceGrant, listUnderstandingSourceGrants, updateUnderstandingSourceGrantCheckpoint, updateUnderstandingSourceRun, upsertUnderstandingSourceGrant } from "../user-context/sources/repository.js";
 import { deriveConnectedSourceUnderstanding } from "./connected-source-understanding.js";
 import { listConnectedContentCandidates, readConnectedContent } from "./content-enrichment.js";
 //#region src/connectors/learning-coordinator.ts

package/dist/src/extensions/activation-context.js

@@ -1,5 +1,5 @@
-import { PROVIDER_ENV_MAP, init_env_keys } from "../providers/env-keys.js";
 import { getAgentDefaultModelRef, init_schema } from "../config/schema.js";
+import { PROVIDER_ENV_MAP, init_env_keys } from "../providers/env-keys.js";
 import { init_providers, isProviderConfiguredSync } from "../providers/index.js";
 import { collectSttProviderConfigEntries } from "../voice/stt/config-slice.js";
 import { mergeSttConfigFromAppConfig } from "../voice/stt/config.js";

package/dist/src/gateway/file-path-classifier.js

@@ -1,7 +1,7 @@
 import { init_paths_state, resolveStateDir } from "../config/paths-state.js";
 import { init_agent_scope, resolveAgentProfileDir } from "../agent/agent-scope.js";
-import { init_paths, resolveConfigPath, resolveSkillsDir } from "../config/paths.js";
 import { extractProfileAgentId } from "../config/agent-profile.js";
+import { init_paths, resolveConfigPath, resolveSkillsDir } from "../config/paths.js";
 import { isBareProfileMarkdownFileName, resolveProfileMarkdownPathIfBareName } from "../agent/tools/tool-paths.js";
 import { isPathUnderWorkspace } from "./workspace-editor-path.js";
 import { homedir } from "node:os";

package/dist/src/gateway/hono/lib/config-payload.d.ts

@@ -250,6 +250,11 @@ export declare function buildSafeWebConfigPayload(service: GatewayService, optio
             searchTimeoutMs: number;
             writeStrategy: "local-first" | "external-first" | "local-only" | "external-only" | "write-through";
             allowExternalWrites: boolean;
+            learning?: {
+                idleFlushMs: number;
+                maxBatchChars: number;
+                maxDailyBatches: number;
+            };
             allowedProviderIds?: string[];
             autoWriteKinds?: string[];
         };

package/dist/src/gateway/hono/lib/config-payload.js

@@ -1,10 +1,10 @@
 import { normalizeAgentId } from "../../../agent-catalog/id.js";
 import { AgentCatalogRepository, init_repository } from "../../../agent-catalog/repository.js";
 import { init_agent_scope, listAgentEntries, resolveDefaultAgentId } from "../../../agent/agent-scope.js";
-import { resolveModelsJsonPath } from "../../../config/paths.js";
-import { CredentialResolver, init_credentials } from "../../../auth/credentials.js";
 import { ContextPlanningConfigSchema, KnowledgeMemoryConfigSchema, UserModelConfigSchema, init_config } from "../../../user-context/config.js";
+import { resolveModelsJsonPath } from "../../../config/paths.js";
 import { init_models_json, loadModelsJson } from "../../../config/models-json.js";
+import { CredentialResolver, init_credentials } from "../../../auth/credentials.js";
 import { getProviderRegistry, init_plugin_registry } from "../../../providers/plugin-registry.js";
 import { getAllProviders, init_providers, isProviderConfigured } from "../../../providers/index.js";
 import { resolveShareConfig } from "../../../share/share-config.js";

package/dist/src/gateway/hono/routes/config-patch/misc.js

@@ -1,9 +1,9 @@
 import { BindingsSchema, init_binding_schema } from "../../../../routing/binding-schema.js";
 import { AgentCatalogService } from "../../../../agent-catalog/service.js";
-import { CredentialResolver, init_credentials } from "../../../../auth/credentials.js";
-import { ComputerConfigSchema, init_config } from "../../../../computer/config.js";
-import { ContextPlanningConfigSchema, HomeIntelligenceConfigSchema, KnowledgeMemoryConfigSchema, UserContextConfigSchema, UserModelConfigSchema, init_config as init_config$1 } from "../../../../user-context/config.js";
+import { ContextPlanningConfigSchema, HomeIntelligenceConfigSchema, KnowledgeMemoryConfigSchema, UserContextConfigSchema, UserModelConfigSchema, init_config } from "../../../../user-context/config.js";
+import { ComputerConfigSchema, init_config as init_config$1 } from "../../../../computer/config.js";
 import { BrowserConfigSchema, McpConfigSchema, VoiceConfigSchema, init_schema } from "../../../../config/schema.js";
+import { CredentialResolver, init_credentials } from "../../../../auth/credentials.js";
 import { canonicalizeConfiguredMcpServer } from "../../../../config/mcp-config-normalize.js";
 import { mergeGatewaySkillsMarketplacePatch, mergeSessionConfigPatch, mergeUpdateConfigPatch } from "../../../../config/web-patch.js";
 import { assertGatewayAuthConfigured, resolveGatewayAuth } from "../../../auth.js";
@@ -14,11 +14,11 @@ import { assertGatewayRuntimeConfig } from "../../../runtime-config.js";
 import { mergeRealtimeVoiceConfigPatch, mergeSttConfigPatch, mergeTtsConfigPatch } from "../../lib/safe-voice-config.js";
 import { PATCH_OK, patchError } from "./result.js";
 //#region src/gateway/hono/routes/config-patch/misc.ts
-init_config();
+init_config$1();
 init_schema();
 init_binding_schema();
 init_credentials();
-init_config$1();
+init_config();
 async function applyMiscPatch(config, body) {
 	if (body.update !== void 0 && typeof body.update === "object" && body.update !== null) {
 		const updateResult = mergeUpdateConfigPatch(config, body.update);

package/dist/src/gateway/hono/routes/connectors.js

@@ -8,6 +8,7 @@ import { getConnectorSyncPolicy, upsertConnectorSyncPolicy } from "../../../stor
 import { init_sqlite } from "../../../storage/sqlite/index.js";
 import { AgentCatalogRepository, init_repository } from "../../../agent-catalog/repository.js";
 import { init_agent_scope, resolveDefaultAgentId } from "../../../agent/agent-scope.js";
+import { listUnderstandingSourceGrants, revokeUnderstandingSourceGrant } from "../../../user-context/sources/repository.js";
 import { activateComposioBackend, addComposioBackend, ensureComposioBackend, getComposioBackend, listComposioBackends, removeComposioBackend } from "../../../connectors/composio-backends.js";
 import { getAuthorizationAttempt } from "../../../connectors/authorization-attempts.js";
 import { ComposioSessionsAdapter, resolveComposioApiKey } from "../../../connectors/composio-sessions.js";
@@ -27,7 +28,6 @@ import { composioLogoResponse } from "../../../connectors/composio-logo.js";
 import { inspectManagedComposioStatus } from "../../../connectors/composio-managed-client.js";
 import { appendComposioTriggerEvent, listComposioTriggerEvents } from "../../../connectors/composio-triggers.js";
 import { ingestLocalFolderSource } from "../../../connectors/connected-source-ingestion.js";
-import { listUnderstandingSourceGrants, revokeUnderstandingSourceGrant } from "../../../user-context/sources/repository.js";
 import { testConnectorInstance } from "../../../connectors/health.js";
 import { setConnectorEnabled } from "../../../connectors/lifecycle.js";
 import { projectComposioConnectionStatus } from "../../../connectors/runtime-status.js";
@@ -822,7 +822,7 @@ function registerConnectorRoutes(authenticated, deps) {
 			}, error instanceof ConfigPersistenceError ? 500 : 400);
 		}
 	});
-	authenticated.post("/api/connectors/:id/test", async (c) => {
+	authenticated.post("/api/connectors/:id/test", strictRateLimitMiddleware, async (c) => {
 		const instanceId = c.req.param("id");
 		const config = service.currentConfig;
 		const instance = getConnectorInstance(config, instanceId);
@@ -830,9 +830,9 @@ function registerConnectorRoutes(authenticated, deps) {
 			ok: false,
 			error: `Connector instance not found: ${instanceId}`
 		}, 404);
-		if (instance.materialized.type !== "cli") return c.json({
+		if (instance.materialized.type !== "cli" && instance.materialized.type !== "mcp") return c.json({
 			ok: false,
-			error: `Connector type "${instance.materialized.type}" does not support CLI health checks. Use xopc mcp list for MCP diagnostics.`
+			error: `Connector type "${instance.materialized.type}" does not support health checks.`
 		}, 400);
 		try {
 			const result = await testConnectorInstance(config, instance.instanceId);

package/dist/src/gateway/hono/routes/context-sources.js

@@ -3,10 +3,10 @@ import { getConnectorAccount } from "../../../storage/sqlite/connector-account-r
 import { countKnowledgeSourceItems, deleteKnowledgeSourceItems } from "../../../storage/sqlite/knowledge-repository.js";
 import { init_sqlite } from "../../../storage/sqlite/index.js";
 import { init_agent_scope, resolveDefaultAgentId } from "../../../agent/agent-scope.js";
-import { listUserModelObservations } from "../../../user-model/observation-repository.js";
-import "../../../user-model/index.js";
 import { getActiveUnderstandingConsent } from "../../../user-context/sources/consent-repository.js";
 import { getUnderstandingSourceGrant, listUnderstandingSourceGrants, listUnderstandingSourceRuns, revokeUnderstandingSourceGrant, updateUnderstandingSourceGrantPolicies } from "../../../user-context/sources/repository.js";
+import { listUserModelObservations } from "../../../user-model/observation-repository.js";
+import "../../../user-model/index.js";
 import { listConnectedContentCandidates, readConnectedContent } from "../../../connectors/content-enrichment.js";
 import { listUnderstandingSourceDefinitions } from "../../../user-context/sources/catalog.js";
 //#region src/gateway/hono/routes/context-sources.ts

package/dist/src/gateway/hono/routes/lazy-bundles.js

@@ -407,6 +407,7 @@ const AUTHENTICATED_LAZY_ROUTE_BUNDLES = [
 			"/api/user-model",
 			"/api/knowledge-memory",
 			"/api/memory-maintenance",
+			"/api/memory-learning",
 			"/api/turns"
 		]),
 		load: async () => {
@@ -440,7 +441,7 @@ const AUTHENTICATED_LAZY_ROUTE_BUNDLES = [
 	},
 	{
 		id: "mcp",
-		match: (path) => path === "/api/mcp/servers",
+		match: (path) => path === "/api/mcp/servers" || /^\/api\/mcp\/servers\/[^/]+\/(tools|probe|auth)$/.test(path) || /^\/api\/mcp\/auth\/[^/]+(?:\/redirect)?$/.test(path),
 		load: async () => {
 			const { registerMcpRoutes } = await import("./mcp.js");
 			return { register: registerMcpRoutes };

package/dist/src/gateway/hono/routes/mcp.js

@@ -1,8 +1,97 @@
+import { getWorkspacePath } from "../../../config/workspace-path-helpers.js";
 import { isManagedConnectorServer } from "../../../connectors/materialize.js";
 import { loadMergedMcpConfig } from "../../../agent/mcp/config.js";
-import { getWorkspacePath } from "../../../config/workspace-path-helpers.js";
+import { getGatewayPrincipal } from "../../security/gateway-principal.js";
+import { discoverMcpTools } from "../../../agent/mcp/tool-catalog.js";
+import { cancelMcpAuthorization, getMcpAuthorization, probeMcpConnection, startMcpAuthorization, submitMcpRedirect } from "../../../agent/mcp/connection-setup.js";
 //#region src/gateway/hono/routes/mcp.ts
 function registerMcpRoutes(app, deps) {
+	app.post("/api/mcp/servers/:id/probe", deps.strictRateLimitMiddleware, async (c) => {
+		const config = deps.service.currentConfig;
+		const id = c.req.param("id");
+		if (!Object.hasOwn(config.mcp?.servers ?? {}, id)) return c.json({
+			ok: false,
+			error: "MCP server not found."
+		}, 404);
+		const result = await probeMcpConnection(config, getWorkspacePath(config) || process.cwd(), id);
+		return c.json({
+			ok: true,
+			payload: result
+		});
+	});
+	app.post("/api/mcp/servers/:id/auth", deps.strictRateLimitMiddleware, async (c) => {
+		const config = deps.service.currentConfig;
+		const id = c.req.param("id");
+		if (!Object.hasOwn(config.mcp?.servers ?? {}, id)) return c.json({
+			ok: false,
+			error: "MCP server not found."
+		}, 404);
+		try {
+			const attempt = startMcpAuthorization(config, getWorkspacePath(config) || process.cwd(), id, getGatewayPrincipal(c).principalId);
+			return c.json({
+				ok: true,
+				payload: attempt
+			});
+		} catch (error) {
+			return c.json({
+				ok: false,
+				error: error instanceof Error ? error.message : String(error)
+			}, 400);
+		}
+	});
+	app.get("/api/mcp/auth/:id", (c) => {
+		const attempt = getMcpAuthorization(c.req.param("id"), getGatewayPrincipal(c).principalId, deps.service.currentConfig);
+		return attempt ? c.json({
+			ok: true,
+			payload: attempt
+		}) : c.json({
+			ok: false,
+			error: "Sign-in not found or expired."
+		}, 404);
+	});
+	app.post("/api/mcp/auth/:id/redirect", deps.strictRateLimitMiddleware, async (c) => {
+		const body = await c.req.json().catch(() => null);
+		try {
+			return typeof body?.url === "string" && body.url.length < 16384 && submitMcpRedirect(c.req.param("id"), getGatewayPrincipal(c).principalId, body.url, deps.service.currentConfig) ? c.json({ ok: true }) : c.json({
+				ok: false,
+				error: "The callback address does not match this sign-in."
+			}, 400);
+		} catch {
+			return c.json({
+				ok: false,
+				error: "Invalid callback address."
+			}, 400);
+		}
+	});
+	app.delete("/api/mcp/auth/:id", (c) => {
+		return cancelMcpAuthorization(c.req.param("id"), getGatewayPrincipal(c).principalId) ? c.json({ ok: true }) : c.json({
+			ok: false,
+			error: "Sign-in not found."
+		}, 404);
+	});
+	app.post("/api/mcp/servers/:id/tools", deps.strictRateLimitMiddleware, async (c) => {
+		const cfg = deps.service.currentConfig;
+		const id = c.req.param("id");
+		if (!Object.hasOwn(cfg.mcp?.servers ?? {}, id)) return c.json({
+			ok: false,
+			error: "MCP server not found."
+		}, 404);
+		try {
+			const tools = await discoverMcpTools(cfg, getWorkspacePath(cfg) || process.cwd(), id);
+			return c.json({
+				ok: true,
+				payload: {
+					serverId: id,
+					tools
+				}
+			});
+		} catch (error) {
+			return c.json({
+				ok: false,
+				error: error instanceof Error ? error.message : String(error)
+			}, 502);
+		}
+	});
 	app.get("/api/mcp/servers", (c) => {
 		const cfg = deps.service.currentConfig;
 		const merged = loadMergedMcpConfig({

package/dist/src/gateway/hono/routes/memory-learning.d.ts

@@ -0,0 +1,3 @@
+import type { Hono } from 'hono';
+import type { AuthenticatedRouteDeps } from './deps.js';
+export declare function registerMemoryLearningRoutes(app: Hono, deps: AuthenticatedRouteDeps): void;

package/dist/src/gateway/hono/routes/memory-learning.js

@@ -0,0 +1,76 @@
+import { getSqliteDatabase, init_transaction } from "../../../storage/sqlite/transaction.js";
+import { getSessionMetadata } from "../../../storage/sqlite/session-read-repository.js";
+import { init_session_repository } from "../../../storage/sqlite/session-repository.js";
+import { getSessionConfig, init_config_repository } from "../../../storage/sqlite/config-repository.js";
+import { bindOwnerIdentity } from "../../../user-context/identity-bindings.js";
+import { canUseKnowledge, knowledgeExclusion } from "../../../knowledge-memory/usage-policy.js";
+import { getKnowledgeItem } from "../../../knowledge-memory/repository.js";
+import { init_config, resolveKnowledgeReadPolicy } from "../../../user-context/config.js";
+import { enqueueConversationLearning, learningStatus } from "../../../memory-learning/repository.js";
+import "../../../knowledge-memory/index.js";
+import { resolveEffectiveAgentProfileForSession } from "../../../config/agent-profile.js";
+//#region src/gateway/hono/routes/memory-learning.ts
+init_config_repository();
+init_transaction();
+init_session_repository();
+init_config();
+function registerMemoryLearningRoutes(app, deps) {
+	app.get("/api/memory-learning/status", (c) => c.json(learningStatus(deps.service.currentConfig)));
+	app.get("/api/memory-learning/jobs/:id", (c) => {
+		const job = getSqliteDatabase().prepare(`SELECT job_id AS id, state, attempts, error_code AS errorCode,
+      created_at AS createdAt, updated_at AS updatedAt FROM memory_learning_jobs WHERE job_id = ? AND principal_id = 'local-owner'`).get(c.req.param("id"));
+		return job ? c.json({ job }) : c.json({ error: "Learning job not found" }, 404);
+	});
+	app.post("/api/memory-learning/rebuild", deps.strictRateLimitMiddleware, async (c) => {
+		const input = await c.req.json().catch(() => null);
+		if (!input || typeof input.conversationId !== "string") return c.json({ error: "conversationId is required" }, 400);
+		if (!getSessionMetadata(input.conversationId)) return c.json({ error: "Conversation not found" }, 404);
+		const jobId = enqueueConversationLearning(deps.service.currentConfig, input.conversationId, getSessionConfig(input.conversationId)?.workingDirectoryOverride ?? resolveEffectiveAgentProfileForSession(input.conversationId).resolvedWorkspacePath, true);
+		return jobId ? c.json({ jobId }, 202) : c.json({
+			queued: false,
+			reason: "not_eligible_or_already_queued"
+		});
+	});
+	app.post("/api/memory-learning/owner-identities", deps.strictRateLimitMiddleware, async (c) => {
+		const input = await c.req.json().catch(() => null);
+		if (!input || ![
+			"channel",
+			"accountId",
+			"peerId"
+		].every((key) => typeof input[key] === "string" && input[key].trim())) return c.json({ error: "channel, accountId and peerId are required" }, 400);
+		bindOwnerIdentity(input);
+		return c.json({ ok: true });
+	});
+	app.get("/api/memory-learning/owner-identities", (c) => c.json({ identities: getSqliteDatabase().prepare(`
+    SELECT channel, account_id AS accountId, peer_id AS peerId, verified_at AS verifiedAt
+    FROM owner_identity_bindings WHERE principal_id = 'local-owner' AND revoked_at IS NULL ORDER BY verified_at DESC`).all() }));
+	app.delete("/api/memory-learning/owner-identities", deps.strictRateLimitMiddleware, async (c) => {
+		const input = await c.req.json().catch(() => null);
+		if (!input || ![
+			"channel",
+			"accountId",
+			"peerId"
+		].every((key) => typeof input[key] === "string")) return c.json({ error: "Identity fields are required" }, 400);
+		getSqliteDatabase().prepare("UPDATE owner_identity_bindings SET revoked_at = ? WHERE channel = ? AND account_id = ? AND peer_id = ?").run(Date.now(), input.channel, input.accountId, input.peerId);
+		return c.json({ ok: true });
+	});
+	app.get("/api/knowledge-memory/:id/evidence", (c) => {
+		const item = getKnowledgeItem(c.req.param("id"));
+		const context = {
+			agentId: c.req.query("agentId") ?? item?.sourceAgentId ?? "main",
+			workspaceId: c.req.query("workspaceId") ?? (item?.scope.type === "workspace" ? item.scope.id : ""),
+			conversationId: c.req.query("conversationId") ?? item?.sourceConversationId ?? "",
+			projectId: c.req.query("projectId") ?? (item?.scope.type === "project" ? item.scope.id : void 0)
+		};
+		if (!item || !canUseKnowledge(item, context, resolveKnowledgeReadPolicy(deps.service.currentConfig.userContext.knowledgeMemory))) return c.json({
+			error: "Knowledge evidence not available",
+			reason: item ? knowledgeExclusion(item, context, resolveKnowledgeReadPolicy(deps.service.currentConfig.userContext.knowledgeMemory)) : "not_found"
+		}, 404);
+		const evidence = getSqliteDatabase().prepare(`SELECT e.source_type AS sourceType, e.source_ref AS sourceRef,
+      e.observed_at AS observedAt, e.redacted_excerpt AS excerpt FROM knowledge_evidence_links l
+      JOIN context_evidence e ON e.evidence_id = l.evidence_id WHERE l.knowledge_id = ?`).all(item.id);
+		return c.json({ evidence });
+	});
+}
+//#endregion
+export { registerMemoryLearningRoutes };

package/dist/src/gateway/hono/routes/models.js

@@ -1,11 +1,11 @@
-import { resolveModelsJsonPath } from "../../../config/paths.js";
-import { CredentialResolver, init_credentials } from "../../../auth/credentials.js";
 import { resolveEffectiveAgentConfigForAgent } from "../../../config/agent-profile.js";
 import { init_resolve_config_value, testApiKeyResolution } from "../../../config/resolve-config-value.js";
+import { resolveModelsJsonPath } from "../../../config/paths.js";
 import { computerModelProfile, init_model_policy, isDedicatedComputerModel } from "../../../computer/model-policy.js";
 import { init_models_json, loadModelsJson, saveModelsJson, validateModelsConfig } from "../../../config/models-json.js";
 import { getModelCatalogStore, init_model_catalog_store } from "../../../providers/model-catalog-store.js";
 import { getModelRegistry } from "../../../providers/model-registry.js";
+import { CredentialResolver, init_credentials } from "../../../auth/credentials.js";
 import "../../../providers/constants.js";
 import { getProviderRegistry, init_plugin_registry } from "../../../providers/plugin-registry.js";
 import { PROVIDER_META, getAllModels, getAllProviders, getAvailableModels, getProviderAuthState, init_providers, isProviderConfigured, isProviderConfiguredSync } from "../../../providers/index.js";

package/dist/src/gateway/hono/routes/observability.js

@@ -1,5 +1,5 @@
-import { CredentialResolver, init_credentials } from "../../../auth/credentials.js";
 import { TracingConfigSchema, init_config } from "../../../observability/config.js";
+import { CredentialResolver, init_credentials } from "../../../auth/credentials.js";
 import { configureTracing, localStore, testLangfuse, tracingConfig, tracingStatus } from "../../../observability/runtime.js";
 import { z } from "zod";
 import { Hono } from "hono";

package/dist/src/gateway/hono/routes/projects.js

@@ -9,9 +9,9 @@ import { ActivityService } from "../../../activity/service.js";
 import "../../../activity/index.js";
 import { CapabilityError } from "../../../capabilities/runtime/errors.js";
 import "../../../capabilities/runtime/dispatcher.js";
-import { resolveEffectiveAgentProfile } from "../../../config/agent-profile.js";
 import { listKnowledgeItems, writeKnowledgeItem } from "../../../knowledge-memory/repository.js";
 import "../../../knowledge-memory/index.js";
+import { resolveEffectiveAgentProfile } from "../../../config/agent-profile.js";
 import { TaskReadModelProjector } from "../../../tasks/task-read-model-projector.js";
 import { ProjectWorkspaceConflictError, ProjectWorkspaceMissingError } from "../../../projects/workspace-project.js";
 import { inferProjectExecutionMode, inferProjectKind } from "../../../projects/project-kind.js";