@xopcai/xopc 0.0.388 → 0.0.389

package/dist/src/extensions/index.js

@@ -1,14 +1,14 @@
 import { normalizeExtensionManifest } from "./normalize-manifest.js";
 import { areExtensionsGloballyDisabled, discoverExtensionsFromDisk } from "./discover-extensions.js";
-import { ManifestRegistry } from "./manifest-registry.js";
-import { buildExtensionMetadataSnapshot, resolveExtensionLoaderOptionsFromConfig } from "./extension-metadata-snapshot.js";
-import { collectConfiguredChannelIds, collectConfiguredProviderIds, mergeActivationContext } from "./activation-context.js";
 import { HOOK_EXECUTION_MODES } from "./types/hooks.js";
 import { BUILTIN_PROVIDERS } from "./types/providers.js";
 import { ExtensionRegistryImpl } from "./extension-registry-impl.js";
 import { ExtensionApiImpl, createExtensionLogger, createPathResolver } from "./api.js";
 import { ActivationPlanner } from "./activation-planner.js";
+import { collectConfiguredChannelIds, collectConfiguredProviderIds, mergeActivationContext } from "./activation-context.js";
+import { ManifestRegistry } from "./manifest-registry.js";
 import { ExtensionLoader, normalizeExtensionConfig, resolveExtensionPath } from "./loader.js";
 import { listOnboardChannels, listOnboardProviders, resolveProviderForModel } from "./onboard-helpers.js";
+import { buildExtensionMetadataSnapshot, resolveExtensionLoaderOptionsFromConfig } from "./extension-metadata-snapshot.js";
 import { ExtensionHookRunner, createHookContext, isHookEvent } from "./hooks.js";
 export { ActivationPlanner, BUILTIN_PROVIDERS, ExtensionApiImpl, ExtensionHookRunner, ExtensionLoader, ExtensionRegistryImpl, HOOK_EXECUTION_MODES, ManifestRegistry, areExtensionsGloballyDisabled, buildExtensionMetadataSnapshot, collectConfiguredChannelIds, collectConfiguredProviderIds, createExtensionLogger, createHookContext, createPathResolver, discoverExtensionsFromDisk, isHookEvent, listOnboardChannels, listOnboardProviders, mergeActivationContext, normalizeExtensionConfig, normalizeExtensionManifest, resolveExtensionLoaderOptionsFromConfig, resolveExtensionPath, resolveProviderForModel };

package/dist/src/extensions/install.js

@@ -9,8 +9,8 @@ import { collectExtensionPackageDependencyIssues } from "./package-contract.js";
 import { dirname, isAbsolute, join, resolve, sep } from "path";
 import { cpSync, existsSync, mkdirSync, mkdtempSync, readFileSync, readdirSync, rmSync, writeFileSync } from "fs";
 import { execFileSync } from "node:child_process";
-import AdmZip from "adm-zip";
 import semver from "semver";
+import AdmZip from "adm-zip";
 import { tmpdir } from "os";
 //#region src/extensions/install.ts
 /**

package/dist/src/extensions/loader.js

@@ -6,11 +6,11 @@ import { init_paths, resolveBundledExtensionsDir, resolveExtensionSdkPath, resol
 import { getProviderRegistry, init_plugin_registry } from "../providers/plugin-registry.js";
 import { normalizeExtensionManifest } from "./normalize-manifest.js";
 import { areExtensionsGloballyDisabled, discoverExtensionsFromDisk } from "./discover-extensions.js";
-import { ManifestRegistry } from "./manifest-registry.js";
-import { mergeActivationContext } from "./activation-context.js";
 import { ExtensionRegistryImpl } from "./extension-registry-impl.js";
 import { ExtensionApiImpl, createExtensionLogger, createPathResolver } from "./api.js";
 import { ActivationPlanner } from "./activation-planner.js";
+import { mergeActivationContext } from "./activation-context.js";
+import { ManifestRegistry } from "./manifest-registry.js";
 import { checkEngineCompatibility } from "./engine-check.js";
 import { validateSpeechProviderContracts } from "./speech-provider-contracts.js";
 import { validateMediaUnderstandingProviderContracts } from "./media-provider-contracts.js";

package/dist/src/extensions/sdk/index.js

@@ -1,5 +1,4 @@
 import { ProviderPluginRegistry, getProviderRegistry, init_plugin_registry } from "../../providers/plugin-registry.js";
-import { defineChannelPluginEntry } from "./channel-entry.js";
 import { HOOK_EXECUTION_MODES } from "../types/hooks.js";
 import { TypedEventBus } from "../typed-event-bus.js";
 import { ExtensionRegistryImpl } from "../extension-registry-impl.js";
@@ -8,6 +7,7 @@ import { DEFAULT_SECURITY_CONFIG, checkExtensionDirSafety, checkExtensionPathSaf
 import { SlotRegistry, getSlotRegistry, registerSlotType } from "../slots.js";
 import { ExtensionDiagnostics, ExtensionLoaderCacheImpl, getExtensionCache, getExtensionDiagnostics } from "../diagnostics.js";
 import { ExtensionHookRunner, createHookContext, isHookEvent } from "../hooks.js";
+import { defineChannelPluginEntry } from "./channel-entry.js";
 import { registerExtensionCliProgram } from "./channel-helpers.js";
 import { lazyFunction, lazyModule } from "./lazy.js";
 import { createMockExtensionApi, createTestGateway } from "./testing.js";

package/dist/src/extensions/sdk/media.js

@@ -1,7 +1,7 @@
+import { getMediaUnderstandingProvider, listMediaUnderstandingProviders, registerMediaUnderstandingProvider } from "../../media-understanding/registry.js";
 import { ProviderHttpError, assertOkOrThrowHttpError } from "../../media-shared/http/provider-http-errors.js";
 import { SsrfBlockedError, assertSafeUrl } from "../../media-shared/http/ssrf-guard.js";
 import { fetchWithTimeoutGuarded, normalizeBaseUrl, postMultipartRequest } from "../../media-shared/http/provider-http.js";
 import "../../media-shared/http/index.js";
-import { getMediaUnderstandingProvider, listMediaUnderstandingProviders, registerMediaUnderstandingProvider } from "../../media-understanding/registry.js";
 import { buildAudioTranscriptionFormData, createOpenAiCompatibleAudioProvider, registerOpenAiCompatibleAudioProvider, resolveAudioTranscriptionUploadFileName, transcribeOpenAiCompatibleAudio } from "../../media-understanding/openai-compatible-audio.js";
 export { ProviderHttpError, SsrfBlockedError, assertOkOrThrowHttpError, assertSafeUrl, buildAudioTranscriptionFormData, createOpenAiCompatibleAudioProvider, fetchWithTimeoutGuarded, getMediaUnderstandingProvider, listMediaUnderstandingProviders, normalizeBaseUrl, postMultipartRequest, registerMediaUnderstandingProvider, registerOpenAiCompatibleAudioProvider, resolveAudioTranscriptionUploadFileName, transcribeOpenAiCompatibleAudio };

package/dist/src/extensions/update.js

@@ -1,8 +1,8 @@
 import { createLogger } from "../utils/logger/index.js";
 import { init_logger } from "../utils/logger.js";
 import { init_paths, resolveBundledExtensionsDir, resolveExtensionsDir } from "../config/paths.js";
-import { computeExtensionDirectoryIntegrity, getExtensionLockfileManager } from "./lockfile.js";
 import { downloadExtensionStoreZipBuffer, resolveExtensionZipDownloadUrl, resolveExtensionsStoreBaseUrl, verifyStoreArtifactSha256 } from "../agent/skills/marketplace/adapters/store/store-api-client.js";
+import { computeExtensionDirectoryIntegrity, getExtensionLockfileManager } from "./lockfile.js";
 import { loadConfig } from "../config/loader.js";
 import { commitStagedExtensionInstall, finalizeStagedExtensionInstall, rollbackStagedExtensionInstall, stageExtensionNpm, stageExtensionStoreZip } from "./install-transaction.js";
 import { findExtension } from "./marketplace.js";

package/dist/src/gateway/agents-admin.js

@@ -4,8 +4,8 @@ import { init_agent_scope, listAgentEntries, resolveAgentProfileDir, resolveAgen
 import { AGENT_PROFILE_MARKDOWN_SYSTEM_FILES, REQUIRED_AGENT_PROFILE_MARKDOWN_FILE_SET } from "../agent/context/workspace.js";
 import { AgentCatalogService } from "../agent-catalog/service.js";
 import { resolveEffectiveAgentProfile } from "../config/agent-profile.js";
-import { GATEWAY_BUILTIN_TOOL_IDS } from "./agent-builtin-tools.js";
 import { isPathUnderWorkspace, resolveWorkspaceSafePath } from "./workspace-editor-path.js";
+import { GATEWAY_BUILTIN_TOOL_IDS } from "./agent-builtin-tools.js";
 import { resolve } from "node:path";
 import { mkdir, readFile, realpath, stat, unlink, writeFile } from "node:fs/promises";
 //#region src/gateway/agents-admin.ts

package/dist/src/gateway/chat-stream/mapper.js

@@ -1,6 +1,7 @@
 import { parseTurnOutcome } from "../../../packages/gateway-contract/src/turn-outcome.js";
 import { resolveToolActivity } from "../../../packages/gateway-contract/src/tool-activity.js";
 import { isUserTurnDocument } from "../../../packages/gateway-contract/src/user-turn-document.js";
+import { readClarificationPresentation } from "../../../packages/gateway-contract/src/clarifications.js";
 import { init_src } from "../../../packages/gateway-contract/src/index.js";
 import { productDeliveries } from "../../session/compact-history.js";
 import { createPetFeedback } from "./pet-feedback.js";
@@ -98,11 +99,10 @@ var ChatStreamMapper = class {
 				...this.lastAssistantMessageId ? { messageId: this.lastAssistantMessageId } : {}
 			})];
 			case "clarify_request": return [this.make("clarify_request", {
+				...readClarificationPresentation(event),
 				requestId: String(event.requestId ?? ""),
 				kind: event.kind === "approval" ? "approval" : "input",
 				question: String(event.question ?? ""),
-				choices: Array.isArray(event.choices) ? event.choices.filter((x) => typeof x === "string") : void 0,
-				suggestedAnswer: typeof event.suggestedAnswer === "string" ? event.suggestedAnswer : void 0,
 				version: typeof event.version === "number" ? event.version : 1,
 				createdAt: typeof event.createdAt === "number" ? event.createdAt : Date.now(),
 				expiresAt: typeof event.expiresAt === "number" ? event.expiresAt : void 0,

package/dist/src/gateway/chat-stream/protocol.d.ts

@@ -1,3 +1,4 @@
+import type { ClarificationPresentation } from '@xopcai/gateway-contract';
 import type { AgentStreamToolExecutionMetadata, ToolActivity, TurnOutcome } from '@xopcai/gateway-contract';
 import type { TaskUpdateTrigger } from '../../storage/sqlite/session-input-repository.js';
 export type ChatStreamStatus = 'success' | 'error' | 'cancelled' | 'suspended';
@@ -207,12 +208,10 @@ export type TtsAudioEvent = ChatStreamEnvelope<'tts_audio', {
     attachTo?: 'last_assistant';
     messageId?: string;
 }>;
-export type ClarifyRequestEvent = ChatStreamEnvelope<'clarify_request', {
+export type ClarifyRequestEvent = ChatStreamEnvelope<'clarify_request', ClarificationPresentation & {
     requestId: string;
     kind: 'input' | 'approval';
     question: string;
-    choices?: string[];
-    suggestedAnswer?: string;
     version: number;
     createdAt: number;
     expiresAt?: number;

package/dist/src/gateway/clarify-runtime.d.ts

@@ -1,7 +1,9 @@
 export type ClarificationChannelRuntime = {
     answerChoice(requestId: string, choiceIndex: number, idempotencyKey: string): boolean;
+    answerDecision(requestId: string, decision: 'approve' | 'deny', idempotencyKey: string): boolean;
     answerText(conversationId: string, text: string, idempotencyKey: string): boolean;
 };
 export declare function registerClarificationChannelRuntime(next: ClarificationChannelRuntime | null): void;
 export declare function answerClarificationChoiceFromChannel(requestId: string, choiceIndex: number, idempotencyKey: string): boolean;
 export declare function answerClarificationTextFromChannel(conversationId: string, text: string, idempotencyKey: string): boolean;
+export declare function answerClarificationDecisionFromChannel(requestId: string, decision: 'approve' | 'deny', idempotencyKey: string): boolean;

package/dist/src/gateway/clarify-runtime.js

@@ -9,5 +9,8 @@ function answerClarificationChoiceFromChannel(requestId, choiceIndex, idempotenc
 function answerClarificationTextFromChannel(conversationId, text, idempotencyKey) {
 	return runtime?.answerText(conversationId, text, idempotencyKey) ?? false;
 }
+function answerClarificationDecisionFromChannel(requestId, decision, idempotencyKey) {
+	return runtime?.answerDecision(requestId, decision, idempotencyKey) ?? false;
+}
 //#endregion
-export { answerClarificationChoiceFromChannel, answerClarificationTextFromChannel, registerClarificationChannelRuntime };
+export { answerClarificationChoiceFromChannel, answerClarificationDecisionFromChannel, answerClarificationTextFromChannel, registerClarificationChannelRuntime };

package/dist/src/gateway/device-routes.js

@@ -1,6 +1,6 @@
-import { getTailscaleExposureState } from "./tailscale-lifecycle.js";
-import { resolveReverseProxyPublicUrl } from "./public-url.js";
 import { getTunnelService } from "../tunnel/tunnel-service.js";
+import { resolveReverseProxyPublicUrl } from "./public-url.js";
+import { getTailscaleExposureState } from "./tailscale-lifecycle.js";
 import crypto from "node:crypto";
 //#region src/gateway/device-routes.ts
 function secureUrl(value) {

package/dist/src/gateway/ephemeral-clarification-waiter.d.ts

@@ -1,3 +1,4 @@
+import { type ClarificationSubmission } from '@xopcai/gateway-contract';
 import type { ClarifyRequestPayload } from '../agent/tools/clarify-tool.js';
 export type ClarificationStreamEvent = {
     type: string;
@@ -11,7 +12,7 @@ export declare class EphemeralClarificationWaiter {
         request: ClarifyRequestPayload;
         beforeResponse?: () => boolean;
     }): Promise<string>;
-    answer(requestId: string, answer: string): boolean;
+    answer(requestId: string, answer: ClarificationSubmission): boolean;
     cancelForRun(runId: string): void;
     dispose(): void;
 }

package/dist/src/gateway/ephemeral-clarification-waiter.js

@@ -1,12 +1,19 @@
+import { normalizeClarificationQuestion, normalizeClarificationSubmission, readClarificationPresentation } from "../../packages/gateway-contract/src/clarifications.js";
+import { init_src } from "../../packages/gateway-contract/src/index.js";
 //#region src/gateway/ephemeral-clarification-waiter.ts
+init_src();
 /** In-memory waiter exclusively for caller-owned ephemeral runs such as side chat. */
 var EphemeralClarificationWaiter = class {
 	pending = /* @__PURE__ */ new Map();
 	start(input) {
+		const request = normalizeClarificationQuestion(input.request);
 		const requestId = crypto.randomUUID();
+		const expiresAt = request.kind === "approval" ? Date.now() + 10 * 6e4 : void 0;
 		return new Promise((resolve, reject) => {
 			this.pending.set(requestId, {
 				runId: input.runId,
+				request,
+				expiresAt,
 				resolve,
 				reject,
 				beforeResponse: input.beforeResponse
@@ -14,10 +21,10 @@ var EphemeralClarificationWaiter = class {
 			input.publish({
 				type: "clarify_request",
 				requestId,
-				kind: input.request.kind ?? "input",
-				question: input.request.question,
-				choices: input.request.choices,
-				suggestedAnswer: input.request.suggestedAnswer,
+				...readClarificationPresentation(request),
+				kind: request.kind ?? "input",
+				question: request.question,
+				expiresAt,
 				version: 1,
 				createdAt: Date.now()
 			});
@@ -25,9 +32,15 @@ var EphemeralClarificationWaiter = class {
 	}
 	answer(requestId, answer) {
 		const pending = this.pending.get(requestId);
-		if (!pending || pending.beforeResponse?.() === false) return false;
+		if (!pending || pending.beforeResponse?.() === false || pending.expiresAt !== void 0 && pending.expiresAt <= Date.now()) return false;
+		let normalized;
+		try {
+			normalized = normalizeClarificationSubmission(pending.request, answer);
+		} catch {
+			return false;
+		}
 		this.pending.delete(requestId);
-		pending.resolve(answer.trim());
+		pending.resolve(normalized.answer);
 		return true;
 	}
 	cancelForRun(runId) {

package/dist/src/gateway/file-path-classifier.js

@@ -1,9 +1,9 @@
 import { init_paths_state, resolveStateDir } from "../config/paths-state.js";
 import { init_agent_scope, resolveAgentProfileDir } from "../agent/agent-scope.js";
-import { init_paths, resolveConfigPath, resolveSkillsDir } from "../config/paths.js";
 import { extractProfileAgentId } from "../config/agent-profile.js";
-import { isPathUnderWorkspace } from "./workspace-editor-path.js";
+import { init_paths, resolveConfigPath, resolveSkillsDir } from "../config/paths.js";
 import { isBareProfileMarkdownFileName, resolveProfileMarkdownPathIfBareName } from "../agent/tools/tool-paths.js";
+import { isPathUnderWorkspace } from "./workspace-editor-path.js";
 import { homedir } from "node:os";
 import { basename, isAbsolute, resolve } from "node:path";
 import { stat } from "node:fs/promises";

package/dist/src/gateway/global-defaults-admin.js

@@ -2,8 +2,8 @@ import { AgentDefaultsSchema } from "../agent-config/schema.js";
 import { init_agent_config } from "../agent-config/index.js";
 import { AgentCatalogRepository, init_repository } from "../agent-catalog/repository.js";
 import { AgentCatalogService } from "../agent-catalog/service.js";
-import { validateComputerModelChange } from "../computer/model-config.js";
 import { GATEWAY_BUILTIN_TOOLS } from "./agent-builtin-tools.js";
+import { validateComputerModelChange } from "../computer/model-config.js";
 import { isDeepStrictEqual } from "node:util";
 //#region src/gateway/global-defaults-admin.ts
 init_agent_config();

package/dist/src/gateway/hono/app.js

@@ -3,12 +3,12 @@ import { init_logger } from "../../utils/logger.js";
 import { init_host, resolveAllowedBrowserOrigins, resolveGatewayServiceListenPort } from "../host.js";
 import { init_device_access_repository, listDevices } from "../../storage/sqlite/device-access-repository.js";
 import { ENDPOINT_MAX_FILE_BYTES, init_src } from "../../../packages/endpoint-tools-protocol/src/index.js";
-import { BROWSER_EXTENSION_ID } from "../../browser/extension-identity.js";
 import { resolveGatewayEffectiveHost } from "../../config/gateway-bind.js";
+import { loadTunnelState } from "../../tunnel/tunnel-state.js";
+import { resolveReverseProxyPublicUrl } from "../public-url.js";
 import { maxSessionInputRequestBodyBytes } from "../chat-limits.js";
+import { BROWSER_EXTENSION_ID } from "../../browser/extension-identity.js";
 import { isLoopbackIpAddress, isTrustedProxyAddress } from "../client-ip.js";
-import { resolveReverseProxyPublicUrl } from "../public-url.js";
-import { loadTunnelState } from "../../tunnel/tunnel-state.js";
 import { buildGatewayConsoleCspHeader } from "../security/csp.js";
 import { checkBrowserOrigin, isChromeExtensionOrigin } from "../security/origin-check.js";
 import { auth } from "./middleware/auth.js";

package/dist/src/gateway/hono/lib/config-payload.d.ts

@@ -221,7 +221,7 @@ export declare function buildSafeWebConfigPayload(service: GatewayService, optio
         userModel: {
             enabled: boolean;
             writePolicy: "allow" | "deny";
-            sensitiveWritePolicy: "allow" | "confirm" | "deny";
+            sensitiveWritePolicy: "allow" | "deny" | "confirm";
             showMemoryReferences: boolean;
             processingPolicy: "local_only" | "remote_allowed";
             extraction: {

package/dist/src/gateway/hono/lib/config-payload.js

@@ -1,19 +1,19 @@
 import { normalizeAgentId } from "../../../agent-catalog/id.js";
 import { AgentCatalogRepository, init_repository } from "../../../agent-catalog/repository.js";
 import { init_agent_scope, listAgentEntries, resolveDefaultAgentId } from "../../../agent/agent-scope.js";
-import { resolveModelsJsonPath } from "../../../config/paths.js";
 import { ContextPlanningConfigSchema, KnowledgeMemoryConfigSchema, UserModelConfigSchema, init_config } from "../../../user-context/config.js";
+import { resolveModelsJsonPath } from "../../../config/paths.js";
 import { init_models_json, loadModelsJson } from "../../../config/models-json.js";
 import { CredentialResolver, init_credentials } from "../../../auth/credentials.js";
 import { getProviderRegistry, init_plugin_registry } from "../../../providers/plugin-registry.js";
 import { getAllProviders, init_providers, isProviderConfigured } from "../../../providers/index.js";
-import { buildChannelCatalogForConfig, buildChannelCatalogFromSnapshot, getChannelSetupStatus } from "../../../channels/catalog/channel-catalog-service.js";
+import { resolveShareConfig } from "../../../share/share-config.js";
+import { maskTunnelSecretForWeb } from "../../../tunnel/env.js";
 import { normalizeConfiguredMcpServers } from "../../../config/mcp-config-normalize.js";
+import { buildChannelCatalogForConfig, buildChannelCatalogFromSnapshot, getChannelSetupStatus } from "../../../channels/catalog/channel-catalog-service.js";
 import { resolveSessionConfigForWeb, resolveUpdateConfigForWeb } from "../../../config/web-patch.js";
 import { GENERIC_MASKED_SECRET, maskSecretLength } from "./mask-secret-length.js";
 import { safeToolsWebForGet } from "../../config-tools-web.js";
-import { maskTunnelSecretForWeb } from "../../../tunnel/env.js";
-import { resolveShareConfig } from "../../../share/share-config.js";
 import { buildSafeProvidersConfigForWeb } from "./safe-providers-config.js";
 import { maskRealtimeVoiceConfigForWeb, maskSttConfigForWeb, maskTtsConfigForWeb } from "./safe-voice-config.js";
 //#region src/gateway/hono/lib/config-payload.ts

package/dist/src/gateway/hono/lib/config-write-lock.d.ts

@@ -0,0 +1,2 @@
+/** Keep HTTP read/merge/write sequences together, including the legacy configuration endpoint. */
+export declare function withGatewayConfigWriteLock<T>(service: object, operation: () => Promise<T>): Promise<T>;

package/dist/src/gateway/hono/lib/config-write-lock.js

@@ -0,0 +1,14 @@
+//#region src/gateway/hono/lib/config-write-lock.ts
+const writes = /* @__PURE__ */ new WeakMap();
+/** Keep HTTP read/merge/write sequences together, including the legacy configuration endpoint. */
+async function withGatewayConfigWriteLock(service, operation) {
+	const next = (writes.get(service) ?? Promise.resolve()).catch(() => {}).then(operation);
+	writes.set(service, next);
+	try {
+		return await next;
+	} finally {
+		if (writes.get(service) === next) writes.delete(service);
+	}
+}
+//#endregion
+export { withGatewayConfigWriteLock };

package/dist/src/gateway/hono/routes/agent-stream.js

@@ -1,4 +1,5 @@
 import { parseUserTurnDocument, userTurnDocumentRefIds } from "../../../../packages/gateway-contract/src/user-turn-document.js";
+import { clarificationResponseCommandSchema } from "../../../../packages/gateway-contract/src/clarifications.js";
 import { init_src } from "../../../../packages/gateway-contract/src/index.js";
 import { parseTurnContextRefs } from "../../../agent/source-context/types.js";
 import { validateWebchatAttachments, validateWebchatContent } from "../../chat-limits.js";
@@ -165,11 +166,8 @@ function registerAgentStreamRoutes(authenticated, deps) {
 	authenticated.post("/api/clarifications/:id/responses", chatRateLimitMiddleware, async (c) => {
 		const id = c.req.param("id")?.trim() ?? "";
 		const body = await c.req.json().catch(() => null);
-		const record = body && typeof body === "object" ? body : {};
-		const action = record.action;
-		const expectedVersion = record.expectedVersion;
-		const idempotencyKey = typeof record.idempotencyKey === "string" ? record.idempotencyKey.trim() : "";
-		if (!id || !idempotencyKey || typeof expectedVersion !== "number" || !Number.isInteger(expectedVersion) || action !== "answer" && action !== "agent_decide" && action !== "cancel") return c.json({
+		const command = clarificationResponseCommandSchema.safeParse(body);
+		if (!id || !command.success) return c.json({
 			ok: false,
 			error: {
 				code: "BAD_REQUEST",
@@ -178,10 +176,7 @@ function registerAgentStreamRoutes(authenticated, deps) {
 		}, 400);
 		const result = service.resolveClarificationResponse({
 			id,
-			expectedVersion,
-			idempotencyKey,
-			action,
-			answer: typeof record.answer === "string" ? record.answer : void 0
+			...command.data
 		});
 		if (result.ok === true) return c.json({
 			ok: true,

package/dist/src/gateway/hono/routes/agents.js

@@ -2,8 +2,8 @@ import { AgentEntrySchema, AgentModelsOverrideSchema, AgentProfileSchema, Runtim
 import { init_agent_config } from "../../../agent-config/index.js";
 import { normalizeAgentId } from "../../../agent-catalog/id.js";
 import { init_agent_scope } from "../../../agent/agent-scope.js";
-import { getVoiceModelsConfig } from "../../../config/voice.js";
 import { createGatewayAgent, deleteAgentAvatarFile, deleteGatewayAgent, getGatewayAgentEffectiveConfig, listAgentProfileFiles, listGatewayAgents, readAgentAvatarFile, readAgentProfileFile, resolveAgentAvatarImage, updateGatewayAgent, writeAgentAvatarFromBase64, writeAgentProfileFile } from "../../agents-admin.js";
+import { getVoiceModelsConfig } from "../../../config/voice.js";
 //#region src/gateway/hono/routes/agents.ts
 init_agent_config();
 init_agent_scope();

package/dist/src/gateway/hono/routes/auth-registry-extensions.js

@@ -1,6 +1,6 @@
 import { getAllModels, getAvailableModels, init_providers } from "../../../providers/index.js";
-import { mergeActivationContext } from "../../../extensions/activation-context.js";
 import { ActivationPlanner } from "../../../extensions/activation-planner.js";
+import { mergeActivationContext } from "../../../extensions/activation-context.js";
 import { validateExtensionConfig } from "../../../extensions/config-validation.js";
 import { fetchRegistry, listExtensions, searchExtensions } from "../../../extensions/marketplace.js";
 import { createOAuthAsyncHandler } from "../oauth-async.js";

package/dist/src/gateway/hono/routes/commands-skills.js

@@ -1,15 +1,15 @@
 import { init_agent_scope, resolveDefaultAgentId } from "../../../agent/agent-scope.js";
-import { ProjectService } from "../../../projects/project-service.js";
-import { isRegisteredProvider } from "../../../agent/skills/marketplace/registry.js";
-import "../../../agent/skills/skills-marketplace.js";
 import { resolveEffectiveAgentProfile } from "../../../config/agent-profile.js";
 import { effectiveWorkspacePathForSession, projectWorkspacePath } from "../../../session/session-workspace.js";
 import { getProjectForSession } from "../../../projects/workspace.js";
+import { ProjectService } from "../../../projects/project-service.js";
+import { isRegisteredProvider } from "../../../agent/skills/marketplace/registry.js";
+import "../../../agent/skills/skills-marketplace.js";
 import "../../../projects/index.js";
+import { isSkillInstallTarget } from "../../../agent/skills/install-target.js";
 import { commandRegistry } from "../../../chat-commands/registry.js";
 import { buildReviewContext, resolveGitRoot } from "../../../review/review-git.js";
 import "../../../chat-commands/index.js";
-import { isSkillInstallTarget } from "../../../agent/skills/install-target.js";
 //#region src/gateway/hono/routes/commands-skills.ts
 init_agent_scope();
 function parseMarketplaceProviderQuery(raw) {

package/dist/src/gateway/hono/routes/config-patch/gateway.js

@@ -1,8 +1,8 @@
 import { init_public_url, validatePublicUrl } from "../../../../config/public-url.js";
 import { isValidIPv4 } from "../../../../config/gateway-bind.js";
-import { isMaskedSecretPatchValue } from "../../lib/mask-secret-length.js";
 import { mergeShareConfigPatch } from "../../../../share/share-config.js";
 import { mergeSiteShareConfigPatch } from "../../../../share/site-share-config.js";
+import { isMaskedSecretPatchValue } from "../../lib/mask-secret-length.js";
 import { PATCH_OK, patchError } from "./result.js";
 //#region src/gateway/hono/routes/config-patch/gateway.ts
 init_public_url();

package/dist/src/gateway/hono/routes/config-patch/misc.js

@@ -1,7 +1,7 @@
 import { BindingsSchema, init_binding_schema } from "../../../../routing/binding-schema.js";
 import { AgentCatalogService } from "../../../../agent-catalog/service.js";
-import { ComputerConfigSchema, init_config } from "../../../../computer/config.js";
-import { ContextPlanningConfigSchema, HomeIntelligenceConfigSchema, KnowledgeMemoryConfigSchema, UserContextConfigSchema, UserModelConfigSchema, init_config as init_config$1 } from "../../../../user-context/config.js";
+import { ContextPlanningConfigSchema, HomeIntelligenceConfigSchema, KnowledgeMemoryConfigSchema, UserContextConfigSchema, UserModelConfigSchema, init_config } from "../../../../user-context/config.js";
+import { ComputerConfigSchema, init_config as init_config$1 } from "../../../../computer/config.js";
 import { BrowserConfigSchema, McpConfigSchema, VoiceConfigSchema, init_schema } from "../../../../config/schema.js";
 import { CredentialResolver, init_credentials } from "../../../../auth/credentials.js";
 import { canonicalizeConfiguredMcpServer } from "../../../../config/mcp-config-normalize.js";
@@ -14,11 +14,11 @@ import { assertGatewayRuntimeConfig } from "../../../runtime-config.js";
 import { mergeRealtimeVoiceConfigPatch, mergeSttConfigPatch, mergeTtsConfigPatch } from "../../lib/safe-voice-config.js";
 import { PATCH_OK, patchError } from "./result.js";
 //#region src/gateway/hono/routes/config-patch/misc.ts
-init_config();
+init_config$1();
 init_schema();
 init_binding_schema();
 init_credentials();
-init_config$1();
+init_config();
 async function applyMiscPatch(config, body) {
 	if (body.update !== void 0 && typeof body.update === "object" && body.update !== null) {
 		const updateResult = mergeUpdateConfigPatch(config, body.update);

package/dist/src/gateway/hono/routes/config.js

@@ -1,6 +1,7 @@
 import { enumerateLanGatewayCandidates, init_host } from "../../host.js";
 import { getTunnelService } from "../../../tunnel/tunnel-service.js";
 import { buildSafeWebConfigPayload } from "../lib/config-payload.js";
+import { withGatewayConfigWriteLock } from "../lib/config-write-lock.js";
 import { applyChannelsPatch } from "./config-patch/channels.js";
 import { applyGatewayPatch } from "./config-patch/gateway.js";
 import { applyMiscPatch, validateGatewayAfterPatch } from "./config-patch/misc.js";
@@ -34,9 +35,10 @@ function registerConfigRoutes(authenticated, deps) {
 			payload: { candidates: enumerateLanGatewayCandidates(port) }
 		});
 	});
-	authenticated.patch("/api/config", strictRateLimitMiddleware, async (c) => {
+	authenticated.patch("/api/config", strictRateLimitMiddleware, async (c) => withGatewayConfigWriteLock(service, async () => {
 		const body = await c.req.json();
-		const config = service.currentConfig;
+		const expectedConfig = structuredClone(service.currentConfig);
+		const config = structuredClone(expectedConfig);
 		applyChannelsPatch(config, body);
 		const gatewayResult = applyGatewayPatch(config, body);
 		if (gatewayResult.ok === false) return c.json({
@@ -62,17 +64,17 @@ function registerConfigRoutes(authenticated, deps) {
 				error: `Failed to stop tunnel before clearing key: ${message}`
 			}, 500);
 		}
-		const result = await service.saveConfig(config);
+		const result = await service.saveConfig(config, expectedConfig);
 		if (!result.saved) return c.json({
 			ok: false,
 			error: result.error
-		}, 500);
+		}, result.conflict ? 409 : 500);
 		const safeConfig = await buildSafeWebConfigPayload(service, { locale: localeFromRequest(c) });
 		return c.json({
 			ok: true,
 			payload: { config: safeConfig }
 		});
-	});
+	}));
 	const revealGatewayAuthSecretHandler = async (c) => {
 		const field = await resolveRevealGatewayAuthField(c);
 		if (!field) return c.json({

package/dist/src/gateway/hono/routes/connectors.js

@@ -8,6 +8,7 @@ import { getConnectorSyncPolicy, upsertConnectorSyncPolicy } from "../../../stor
 import { init_sqlite } from "../../../storage/sqlite/index.js";
 import { AgentCatalogRepository, init_repository } from "../../../agent-catalog/repository.js";
 import { init_agent_scope, resolveDefaultAgentId } from "../../../agent/agent-scope.js";
+import { listUnderstandingSourceGrants, revokeUnderstandingSourceGrant } from "../../../user-context/sources/repository.js";
 import { activateComposioBackend, addComposioBackend, ensureComposioBackend, getComposioBackend, listComposioBackends, removeComposioBackend } from "../../../connectors/composio-backends.js";
 import { getAuthorizationAttempt } from "../../../connectors/authorization-attempts.js";
 import { ComposioSessionsAdapter, resolveComposioApiKey } from "../../../connectors/composio-sessions.js";
@@ -26,7 +27,6 @@ import { startConnectorAuthorization } from "../../../connectors/auth-provider-r
 import { composioLogoResponse } from "../../../connectors/composio-logo.js";
 import { inspectManagedComposioStatus } from "../../../connectors/composio-managed-client.js";
 import { appendComposioTriggerEvent, listComposioTriggerEvents } from "../../../connectors/composio-triggers.js";
-import { listUnderstandingSourceGrants, revokeUnderstandingSourceGrant } from "../../../user-context/sources/repository.js";
 import { ingestLocalFolderSource } from "../../../connectors/connected-source-ingestion.js";
 import { testConnectorInstance } from "../../../connectors/health.js";
 import { setConnectorEnabled } from "../../../connectors/lifecycle.js";

package/dist/src/gateway/hono/routes/context-sources.js

@@ -3,10 +3,10 @@ import { getConnectorAccount } from "../../../storage/sqlite/connector-account-r
 import { countKnowledgeSourceItems, deleteKnowledgeSourceItems } from "../../../storage/sqlite/knowledge-repository.js";
 import { init_sqlite } from "../../../storage/sqlite/index.js";
 import { init_agent_scope, resolveDefaultAgentId } from "../../../agent/agent-scope.js";
-import { listUserModelObservations } from "../../../user-model/observation-repository.js";
 import { getActiveUnderstandingConsent } from "../../../user-context/sources/consent-repository.js";
-import "../../../user-model/index.js";
 import { getUnderstandingSourceGrant, listUnderstandingSourceGrants, listUnderstandingSourceRuns, revokeUnderstandingSourceGrant, updateUnderstandingSourceGrantPolicies } from "../../../user-context/sources/repository.js";
+import { listUserModelObservations } from "../../../user-model/observation-repository.js";
+import "../../../user-model/index.js";
 import { listConnectedContentCandidates, readConnectedContent } from "../../../connectors/content-enrichment.js";
 import { listUnderstandingSourceDefinitions } from "../../../user-context/sources/catalog.js";
 //#region src/gateway/hono/routes/context-sources.ts

package/dist/src/gateway/hono/routes/endpoint-tools.js

@@ -5,9 +5,9 @@ import { endpointPrincipalRegistrationSchema, endpointSessionBindingRequestSchem
 import { createEndpointPrincipal, getEndpointPrincipal, listEndpointPrincipals, revokeEndpointPrincipal } from "../../../storage/sqlite/endpoint-principal-repository.js";
 import { listEndpointToolInvocationAuditPage } from "../../../storage/sqlite/endpoint-tool-invocation-repository.js";
 import { init_sqlite } from "../../../storage/sqlite/index.js";
+import { getEndpointDeviceSettings, renameEndpointDevice } from "../../../storage/sqlite/endpoint-device-settings-repository.js";
 import { parseEndpointPublicKey } from "../../../endpoint-tools/auth.js";
 import { ENDPOINT_UPLOAD_MAX_BYTES, EndpointUploadError } from "../../../endpoint-tools/upload-service.js";
-import { getEndpointDeviceSettings, renameEndpointDevice } from "../../../storage/sqlite/endpoint-device-settings-repository.js";
 import { getGatewayPrincipal } from "../../security/gateway-principal.js";
 import { z } from "zod";
 //#region src/gateway/hono/routes/endpoint-tools.ts

package/dist/src/gateway/hono/routes/home.js

@@ -3,9 +3,9 @@ import { init_src } from "../../../../packages/gateway-contract/src/index.js";
 import { acknowledgeHomeAttention } from "../../../storage/sqlite/home-attention-repository.js";
 import { decideConnectorApproval } from "../../../storage/sqlite/connector-repository.js";
 import { init_sqlite } from "../../../storage/sqlite/index.js";
-import { resumeApprovedConnectorAction } from "../../../connectors/approval-resume.js";
 import { listGatewayAgents } from "../../agents-admin.js";
 import { HomeQueryService, buildHomeWorkbench, decisionFromTask } from "../../../tasks/home-query-service.js";
+import { resumeApprovedConnectorAction } from "../../../connectors/approval-resume.js";
 import { HomeOpportunityActionError, HomeOpportunityNotFoundError } from "../../../home-intelligence/application-service.js";
 //#region src/gateway/hono/routes/home.ts
 init_src();

package/dist/src/gateway/hono/routes/lazy-bundles.js

@@ -449,7 +449,7 @@ const AUTHENTICATED_LAZY_ROUTE_BUNDLES = [
 	},
 	{
 		id: "mcp",
-		match: (path) => path === "/api/mcp/servers" || /^\/api\/mcp\/servers\/[^/]+\/(tools|probe|auth)$/.test(path) || /^\/api\/mcp\/auth\/[^/]+(?:\/redirect)?$/.test(path),
+		match: (path) => path === "/api/mcp/servers" || /^\/api\/mcp\/servers\/[^/]+$/.test(path) || path === "/api/mcp/drafts" || /^\/api\/mcp\/drafts\/[^/]+(?:\/(?:probe|commit|tools|auth(?:\/redirect)?))?$/.test(path) || /^\/api\/mcp\/servers\/[^/]+\/(tools|probe|auth)$/.test(path) || /^\/api\/mcp\/auth\/[^/]+(?:\/redirect)?$/.test(path),
 		load: async () => {
 			const { registerMcpRoutes } = await import("./mcp.js");
 			return { register: registerMcpRoutes };