@xopcai/xopc 0.0.415 → 0.0.417

package/dist/src/phone/wireless.d.ts

@@ -0,0 +1,80 @@
+import { runAdb } from './adb-command.js';
+import { type DiscoveredPhone, type PhoneDevice } from './contracts.js';
+type Command = typeof runAdb;
+export type WirelessService = {
+    name: string;
+    host: string;
+    port: number;
+    kind: 'pairing' | 'connect';
+};
+export type WirelessStatus = 'waiting' | 'pairing' | 'paired' | 'connecting' | 'connected' | 'timeout' | 'error' | 'cancelled';
+export type WirelessSession = {
+    id: string;
+    status: WirelessStatus;
+    expiresAt: number;
+    qrPayload?: string;
+    device?: DiscoveredPhone;
+    errorCode?: string;
+};
+export declare function validateWirelessHost(host: string): string;
+export declare function parseWirelessServices(output: string): WirelessService[];
+/** Pairing credentials are ephemeral; only verified device identities may be registered. */
+export declare class WirelessPhones {
+    private command;
+    private intervalMs;
+    private lifetimeMs;
+    private controller;
+    private sessions;
+    private identities;
+    constructor(command?: Command, intervalMs?: number, lifetimeMs?: number);
+    services(path: string, signal?: AbortSignal): Promise<WirelessService[]>;
+    discovery(path: string, signal?: AbortSignal): Promise<{
+        mdns: boolean;
+        services: WirelessService[];
+    }>;
+    known(serial: string): {
+        guid: string;
+        hardwareSerial: string;
+        host: string;
+        port: number;
+    };
+    private view;
+    get(owner: string, id: string): WirelessSession;
+    cancel(owner: string, id: string): void;
+    close(): void;
+    create(owner: string, path: string, input?: {
+        host: string;
+        pairingPort: number;
+        code: string;
+        connectPort?: number;
+    }): WirelessSession;
+    private run;
+    connect(path: string, endpoint: {
+        host: string;
+        port: number;
+    }, signal?: AbortSignal, expected?: {
+        guid: string;
+        hardwareSerial?: string;
+    }): Promise<{
+        device: DiscoveredPhone;
+        wireless: {
+            host: string;
+            port: number;
+            hardwareSerial: string;
+            guid: string;
+        };
+    }>;
+    reconnect(path: string, wireless: NonNullable<PhoneDevice['wireless']>, signal?: AbortSignal, endpoint?: {
+        host: string;
+        port: number;
+    }): Promise<{
+        device: DiscoveredPhone;
+        wireless: {
+            host: string;
+            port: number;
+            hardwareSerial: string;
+            guid: string;
+        };
+    }>;
+}
+export {};

package/dist/src/phone/wireless.js

@@ -0,0 +1,244 @@
+import { PhoneError, init_contracts } from "./contracts.js";
+import { runAdb } from "./adb-command.js";
+import { parseAdbDevices } from "./adb-driver.js";
+import { randomBytes, randomUUID } from "node:crypto";
+import { isIP } from "node:net";
+import { setTimeout } from "node:timers/promises";
+//#region src/phone/wireless.ts
+init_contracts();
+function validateWirelessHost(host) {
+	if (isIP(host) !== 4 || !/^(10\.|192\.168\.|172\.(1[6-9]|2\d|3[01])\.|169\.254\.)/.test(host)) throw new PhoneError("PHONE_WIRELESS_ADDRESS", "Enter the phone’s private IPv4 address on the Gateway network");
+	return host;
+}
+function parseWirelessServices(output) {
+	return output.split(/\r?\n/).flatMap((line) => {
+		const match = /^\s*(\S+)\s+_adb-tls-(pairing|connect)\._tcp\.?\s+(\d+\.\d+\.\d+\.\d+):(\d+)\s*$/.exec(line);
+		if (!match) return [];
+		const port = Number(match[4]);
+		try {
+			validateWirelessHost(match[3]);
+		} catch {
+			return [];
+		}
+		return port > 0 && port <= 65535 ? [{
+			name: match[1].replace(/\._adb-tls-(?:pairing|connect)\._tcp(?:\.local)?\.?$/, ""),
+			kind: match[2],
+			host: match[3],
+			port
+		}] : [];
+	});
+}
+/** Pairing credentials are ephemeral; only verified device identities may be registered. */
+var WirelessPhones = class {
+	controller = new AbortController();
+	sessions = /* @__PURE__ */ new Map();
+	identities = /* @__PURE__ */ new Map();
+	constructor(command = runAdb, intervalMs = 1500, lifetimeMs = 9e4) {
+		this.command = command;
+		this.intervalMs = intervalMs;
+		this.lifetimeMs = lifetimeMs;
+	}
+	async services(path, signal) {
+		signal = AbortSignal.any([this.controller.signal, ...signal ? [signal] : []]);
+		return parseWirelessServices((await this.command(path, ["mdns", "services"], signal, 5e3)).toString());
+	}
+	async discovery(path, signal) {
+		await this.command(path, ["version"], signal, 5e3);
+		try {
+			const check = (await this.command(path, ["mdns", "check"], signal, 5e3)).toString();
+			const mdns = !/unavailable|disabled|not available|not running|error/i.test(check);
+			return {
+				mdns,
+				services: mdns ? await this.services(path, signal) : []
+			};
+		} catch {
+			signal?.throwIfAborted();
+			return {
+				mdns: false,
+				services: []
+			};
+		}
+	}
+	known(serial) {
+		return this.identities.get(serial);
+	}
+	view(session) {
+		return {
+			id: session.id,
+			status: session.status,
+			expiresAt: session.expiresAt,
+			...session.status === "waiting" ? { qrPayload: session.qrPayload } : {},
+			device: session.device,
+			errorCode: session.errorCode
+		};
+	}
+	get(owner, id) {
+		const session = this.sessions.get(id);
+		if (!session || session.owner !== owner) throw new PhoneError("PHONE_PAIRING_NOT_FOUND", "Pairing session expired", 404);
+		return this.view(session);
+	}
+	cancel(owner, id) {
+		this.get(owner, id);
+		const session = this.sessions.get(id);
+		session.controller.abort();
+		session.secret = "";
+		session.qrPayload = void 0;
+		session.status = "cancelled";
+		this.sessions.delete(id);
+	}
+	close() {
+		this.controller.abort();
+		this.controller = new AbortController();
+		for (const session of this.sessions.values()) session.controller.abort();
+		this.sessions.clear();
+		this.identities.clear();
+	}
+	create(owner, path, input) {
+		if (input) validateWirelessHost(input.host);
+		for (const [id, session] of this.sessions) if (session.owner === owner || session.expiresAt < Date.now()) {
+			session.controller.abort();
+			session.secret = "";
+			this.sessions.delete(id);
+		}
+		if (this.sessions.size >= 8) throw new PhoneError("PHONE_PAIRING_BUSY", "Too many pairing sessions", 409);
+		const name = `studio-${randomBytes(8).toString("hex")}`;
+		const secret = input?.code ?? randomBytes(16).toString("hex");
+		const session = {
+			id: randomUUID(),
+			owner,
+			path,
+			name: input ? void 0 : name,
+			secret,
+			qrPayload: input ? void 0 : `WIFI:T:ADB;S:${name};P:${secret};;`,
+			status: input ? "pairing" : "waiting",
+			paired: false,
+			expiresAt: Date.now() + this.lifetimeMs,
+			controller: new AbortController(),
+			host: input?.host,
+			connectPort: input?.connectPort
+		};
+		this.sessions.set(session.id, session);
+		session.task = this.run(session, input?.pairingPort);
+		return this.view(session);
+	}
+	async run(session, pairingPort) {
+		const deadline = AbortSignal.timeout(Math.max(1, session.expiresAt - Date.now()));
+		const signal = AbortSignal.any([session.controller.signal, deadline]);
+		try {
+			while (!signal.aborted) {
+				const services = await this.services(session.path, signal).catch(() => {
+					signal.throwIfAborted();
+					return [];
+				});
+				if (!session.paired) {
+					const pair = pairingPort && session.host ? {
+						host: session.host,
+						port: pairingPort
+					} : services.find((item) => item.kind === "pairing" && item.name === session.name);
+					if (pair) {
+						session.status = "pairing";
+						const output = (await this.command(session.path, [
+							"pair",
+							`${pair.host}:${pair.port}`,
+							session.secret
+						], signal, 25e3)).toString();
+						if (!/Successfully paired/i.test(output)) throw new PhoneError("PHONE_PAIRING_FAILED", "Pairing failed");
+						signal.throwIfAborted();
+						session.pairedGuid = /\[guid=([^\]]+)\]/i.exec(output)?.[1];
+						session.paired = true;
+						session.host = pair.host;
+						session.status = "paired";
+						session.secret = "";
+						session.qrPayload = void 0;
+					}
+				}
+				if (session.paired) {
+					const candidates = session.connectPort ? [{
+						host: session.host,
+						port: session.connectPort
+					}] : services.filter((item) => item.kind === "connect" && item.host === session.host && (!session.pairedGuid || item.name === session.pairedGuid || item.name.startsWith(`${session.pairedGuid}-`)));
+					for (const endpoint of candidates) {
+						session.status = "connecting";
+						try {
+							const result = await this.connect(session.path, endpoint, signal, session.pairedGuid ? { guid: session.pairedGuid } : void 0);
+							signal.throwIfAborted();
+							session.device = result.device;
+							session.status = "connected";
+							return;
+						} catch {
+							signal.throwIfAborted();
+							session.status = "paired";
+						}
+					}
+				}
+				await setTimeout(this.intervalMs, void 0, { signal });
+			}
+		} catch (error) {
+			if (session.controller.signal.aborted) return;
+			session.status = deadline.aborted ? "timeout" : "error";
+			session.errorCode = deadline.aborted ? session.paired ? "PHONE_CONNECT_TIMEOUT" : "PHONE_PAIRING_TIMEOUT" : error instanceof PhoneError ? error.code : "PHONE_PAIRING_FAILED";
+		} finally {
+			session.secret = "";
+			session.qrPayload = void 0;
+		}
+	}
+	async connect(path, endpoint, signal, expected) {
+		signal = AbortSignal.any([this.controller.signal, ...signal ? [signal] : []]);
+		validateWirelessHost(endpoint.host);
+		if (!Number.isInteger(endpoint.port) || endpoint.port < 1 || endpoint.port > 65535) throw new PhoneError("PHONE_WIRELESS_PORT", "Enter a valid connection port");
+		const serial = `${endpoint.host}:${endpoint.port}`;
+		const output = (await this.command(path, ["connect", serial], signal, 1e4)).toString();
+		if (!/^(?:already )?connected to /im.test(output)) throw new PhoneError("PHONE_CONNECT_FAILED", "Unable to connect; check wireless debugging and connection port");
+		const devices = parseAdbDevices((await this.command(path, ["devices", "-l"], signal)).toString());
+		let device = devices.find((item) => item.serial === serial && item.state === "device");
+		if (!device) {
+			const names = (await this.services(path, signal)).filter((item) => item.kind === "connect" && item.host === endpoint.host && item.port === endpoint.port).map((item) => item.name);
+			device = devices.find((item) => item.state === "device" && names.some((name) => item.serial === `${name}._adb-tls-connect._tcp` || item.serial === `${name}._adb-tls-connect._tcp.local.`));
+		}
+		if (!device) throw new PhoneError("PHONE_DEVICE_OFFLINE", "Phone is not online and authorized");
+		const hardwareSerial = (await this.command(path, [
+			"-s",
+			device.serial,
+			"shell",
+			"getprop",
+			"ro.serialno"
+		], signal)).toString().trim();
+		const guid = (await this.command(path, [
+			"-s",
+			device.serial,
+			"shell",
+			"getprop",
+			"persist.adb.wifi.guid"
+		], signal)).toString().trim();
+		if (!hardwareSerial || !guid || hardwareSerial.length > 200 || guid.length > 200 || expected && (expected.hardwareSerial && expected.hardwareSerial !== hardwareSerial || expected.guid !== guid)) throw new PhoneError("PHONE_WIRELESS_IDENTITY", "Phone identity changed; pair the intended device again");
+		signal?.throwIfAborted();
+		const wireless = {
+			host: endpoint.host,
+			port: endpoint.port,
+			hardwareSerial,
+			guid
+		};
+		if (this.identities.size >= 100) this.identities.delete(this.identities.keys().next().value);
+		this.identities.set(device.serial, wireless);
+		return {
+			device,
+			wireless
+		};
+	}
+	async reconnect(path, wireless, signal, endpoint) {
+		signal = AbortSignal.any([this.controller.signal, ...signal ? [signal] : []]);
+		if (endpoint) return this.connect(path, endpoint, signal, wireless);
+		const candidates = (await this.services(path, signal).catch(() => {
+			signal?.throwIfAborted();
+			return [];
+		})).filter((item) => item.kind === "connect" && (item.name === wireless.guid || item.name.startsWith(`${wireless.guid}-`)));
+		for (const item of [...candidates, wireless]) try {
+			return await this.connect(path, item, signal, wireless);
+		} catch {
+			signal?.throwIfAborted();
+		}
+		throw new PhoneError("PHONE_RECONNECT_FAILED", "Enable wireless debugging on the same network, or enter its current connection address");
+	}
+};
+//#endregion
+export { WirelessPhones, parseWirelessServices, validateWirelessHost };

package/dist/src/projects/capabilities/write.js

@@ -2,7 +2,7 @@ import { ProjectCreateInputSchema, ProjectDeleteInputSchema, ProjectDeleteOutput
 import { init_src } from "../../../packages/gateway-contract/src/index.js";
 import { getSessionMetadata } from "../../storage/sqlite/session-read-repository.js";
 import { ensureSessionRecord } from "../../storage/sqlite/session-repository.js";
-import { init_sqlite } from "../../storage/sqlite/index.js";
+import "../../storage/sqlite/index.js";
 import { CapabilityError } from "../../capabilities/runtime/errors.js";
 import { defineAtomicCapability } from "../../capabilities/runtime/dispatcher.js";
 import { ProjectWorkspaceConflictError, ProjectWorkspaceMissingError } from "../workspace-project.js";
@@ -11,7 +11,6 @@ import { isValidProjectAgentId, normalizeProjectAgentId } from "../project-agent
 import { inferSuggestedProjectDefaultAgentId } from "../project-agent-suggestion.js";
 //#region src/projects/capabilities/write.ts
 init_src();
-init_sqlite();
 function projectMutation(execute) {
 	try {
 		return execute();

package/dist/src/projects/project-service.js

@@ -1,6 +1,6 @@
 import { init_transaction, runSqliteWriteTransaction } from "../storage/sqlite/transaction.js";
 import { getSessionMetadata } from "../storage/sqlite/session-read-repository.js";
-import { init_sqlite } from "../storage/sqlite/index.js";
+import "../storage/sqlite/index.js";
 import { changedFieldsFromPatch, emitActivity, systemActivityActor, systemActivitySource } from "../activity/emitter.js";
 import { ExecutionEnvironmentStore } from "../execution-environments/store.js";
 import { ProjectStore } from "./project-store.js";
@@ -12,7 +12,6 @@ import { listPendingProjectUnderstandingRuns } from "../work-discovery/repositor
 import { inferProjectExecutionMode } from "./project-kind.js";
 import { bindSessionToProject, listProjectConversationIds, unbindSessionFromProject } from "./session-bind.js";
 //#region src/projects/project-service.ts
-init_sqlite();
 init_transaction();
 var ProjectDeletionBlockedError = class extends Error {
 	constructor() {

package/dist/src/projects/workspace.js

@@ -1,11 +1,10 @@
 import { isXopcDatabaseOpen } from "../storage/sqlite/connection.js";
 import { getSessionMetadata } from "../storage/sqlite/session-read-repository.js";
-import { init_sqlite } from "../storage/sqlite/index.js";
+import "../storage/sqlite/index.js";
 import { resolveEffectiveAgentProfileForSession } from "../config/agent-profile.js";
 import { projectWorkspacePath } from "../session/session-workspace.js";
 import { ProjectStore } from "./project-store.js";
 //#region src/projects/workspace.ts
-init_sqlite();
 function resolveProjectWorkspacePath(config, conversationId, project) {
 	const projectWorkspace = projectWorkspacePath(project);
 	if (projectWorkspace) return projectWorkspace;

package/dist/src/providers/presentation.js

@@ -239,7 +239,7 @@ function modelToCatalogView(model) {
 		...model.contextWindow ? { contextWindow: model.contextWindow } : {},
 		...model.maxTokens ? { maxTokens: model.maxTokens } : {},
 		vision: input.includes("image"),
-		recommended: !isDedicatedComputerModel(model) && isRecommendedModel(model.provider, model.id)
+		recommended: !("phoneUse" in model && model.phoneUse) && !isDedicatedComputerModel(model) && isRecommendedModel(model.provider, model.id)
 	};
 }
 function presetModelToCatalogView(provider, model) {
@@ -267,7 +267,7 @@ function sortModelsForPicker(models) {
 	});
 }
 function getRecommendedModelsForProvider(provider, limit = 4) {
-	const fromRegistry = sortModelsForPicker(getModelsByProvider(provider)).filter((model) => !isDedicatedComputerModel(model) && isRecommendedModel(provider, model.id)).slice(0, limit).map(modelToCatalogView);
+	const fromRegistry = sortModelsForPicker(getModelsByProvider(provider)).filter((model) => !("phoneUse" in model && model.phoneUse) && !isDedicatedComputerModel(model) && isRecommendedModel(provider, model.id)).slice(0, limit).map(modelToCatalogView);
 	if (fromRegistry.length > 0) return fromRegistry;
 	const preset = getDomesticProviderPreset(provider);
 	if (!preset) return [];

package/dist/src/providers/xopc-cloud-model-source.js

@@ -1,3 +1,4 @@
+import { PhoneModelMetadataSchema, init_contracts } from "../phone/contracts.js";
 import { init_model_policy, isDedicatedComputerProfile } from "../computer/model-policy.js";
 import { ImageGenerationCapabilitiesSchema, init_models_json } from "../config/models-json.js";
 import { voiceManifestSchema } from "../../packages/realtime-protocol/src/voice-catalog.js";
@@ -5,6 +6,7 @@ import { init_voice } from "../../packages/realtime-protocol/src/voice.js";
 import { init_xopc_cloud_config, resolveXopcModelRouterUrl } from "./xopc-cloud-config.js";
 import { getProviderAuthService, init_provider_auth_service } from "./provider-auth-service.js";
 //#region src/providers/xopc-cloud-model-source.ts
+init_contracts();
 init_models_json();
 init_voice();
 init_model_policy();
@@ -58,7 +60,9 @@ var XopcCloudModelSource = class {
 			const stt = kind === "stt" ? parseSttCapabilities(model.xopc?.capabilities) : void 0;
 			const tts = kind === "tts" ? parseTtsCapabilities(model.xopc?.capabilities, model.xopc?.defaultVoice) : void 0;
 			const voice = voiceManifestSchema.safeParse(model.xopc?.voice);
+			const phone = PhoneModelMetadataSchema.safeParse(model.xopc?.capabilities?.phoneUse);
 			const catalogModel = {
+				...phone.success ? { phoneUse: phone.data } : {},
 				...voice.success ? { voice: voice.data } : {},
 				...["gui-plus-2026-02-26", "structured-tools-v1"].includes(String(model.xopc?.capabilities?.computerUse?.profile)) ? { computerUse: { profile: model.xopc.capabilities.computerUse.profile } } : {},
 				id: model.id,
@@ -90,7 +94,7 @@ var XopcCloudModelSource = class {
 				baseUrl: this.routerUrl,
 				api: "openai-completions",
 				etag: response.headers.get("x-xopc-model-catalog-version"),
-				recommendedModel: models.find((model) => model.id === "auto")?.id ?? models.find((model) => !isDedicatedComputerProfile(model.computerUse?.profile))?.id ?? null,
+				recommendedModel: models.find((model) => model.id === "auto")?.id ?? models.find((model) => !model.phoneUse && !isDedicatedComputerProfile(model.computerUse?.profile))?.id ?? null,
 				...Object.keys(recommended).length > 0 ? { recommended } : {},
 				...search ? { search } : {},
 				lastSuccessAt: Date.now()
@@ -144,7 +148,7 @@ function parseRecommendations(value, models) {
 }
 function modelMatchesRecommendation(model, capability) {
 	switch (capability) {
-		case "vision": return model.kind === "language" && model.input.includes("image") && !isDedicatedComputerProfile(model.computerUse?.profile);
+		case "vision": return model.kind === "language" && model.input.includes("image") && !model.phoneUse && !isDedicatedComputerProfile(model.computerUse?.profile);
 		case "image-generation": return model.kind === "image" && model.operations.includes("images.generate");
 		case "stt": return model.kind === "stt" && model.operations.includes("audio.transcription");
 		case "tts": return model.kind === "tts" && model.operations.includes("audio.speech");

package/dist/src/realtime/runtime.d.ts

@@ -6,6 +6,9 @@ import { RealtimeTicketStore } from './tickets.js';
 export declare class RealtimeRuntime {
     private readonly endpointTools?;
     private readonly isPrincipalActive;
+    private readonly setupAuthorities;
+    /** Configuration writes require a live endpoint authenticated with Gateway administrator scope. */
+    canConfigureEndpoint(endpointId: string): boolean;
     readonly broker: RealtimeBroker;
     readonly tickets: RealtimeTicketStore;
     private readonly preauthBudget;

package/dist/src/realtime/runtime.js

@@ -1,6 +1,6 @@
 import { createLogger } from "../utils/logger/index.js";
 import { init_logger } from "../utils/logger.js";
-import { hasGatewayScope, init_gateway_scopes } from "../gateway/security/gateway-scopes.js";
+import { hasGatewayScope } from "../gateway/security/gateway-scopes.js";
 import { EndpointToolPolicyError } from "../endpoint-tools/policy.js";
 import { REALTIME_CAPABILITIES, REALTIME_HEARTBEAT_INTERVAL_MS, REALTIME_HEARTBEAT_TIMEOUT_MS, REALTIME_HELLO_TIMEOUT_MS, REALTIME_MAX_CLIENT_FRAME_BYTES, parseClientRealtimeJsonFrame, parseClientRealtimeMessage } from "../../packages/realtime-protocol/src/index.js";
 import { verifyDeviceConnectionProof } from "../gateway/security/device-request-proof.js";
@@ -13,7 +13,6 @@ import { createRequire } from "node:module";
 import crypto from "node:crypto";
 //#region src/realtime/runtime.ts
 init_logger();
-init_gateway_scopes();
 const log = createLogger("Realtime");
 const { WebSocketServer } = createRequire(import.meta.url)("ws");
 const REALTIME_WS_PATH = "/api/realtime/v1/ws";
@@ -42,6 +41,12 @@ function isAuthorizedTopic(topic, scopes) {
 	return false;
 }
 var RealtimeRuntime = class {
+	setupAuthorities = /* @__PURE__ */ new Map();
+	/** Configuration writes require a live endpoint authenticated with Gateway administrator scope. */
+	canConfigureEndpoint(endpointId) {
+		const grant = this.setupAuthorities.get(endpointId);
+		return Boolean(!this.closed && grant && grant.connected() && this.isPrincipalActive(grant.principalId) && this.endpointTools?.registry.isCurrentConnection(endpointId, grant.connectionId));
+	}
 	broker = new RealtimeBroker(void 0, (error, topic) => {
 		log.warn({
 			err: error,
@@ -97,6 +102,7 @@ var RealtimeRuntime = class {
 		this.topicCleanupTimers.clear();
 		this.wss.close();
 		this.socketsByPrincipal.clear();
+		this.setupAuthorities.clear();
 	}
 	disconnectPrincipal(principalId) {
 		this.tickets.revokePrincipal(principalId);
@@ -222,7 +228,7 @@ var RealtimeRuntime = class {
 					return;
 				}
 				const pendingClaim = this.tickets.peek(message.payload.ticket);
-				if (!pendingClaim || pendingClaim.deviceId && !verifyDeviceConnectionProof(pendingClaim.deviceId, message.payload.ticket, new URL(request.url, "http://localhost").pathname + new URL(request.url, "http://localhost").search, typeof request.headers["x-xopc-proof"] === "string" ? request.headers["x-xopc-proof"] : void 0)) {
+				if (!pendingClaim || pendingClaim.deviceId && !verifyDeviceConnectionProof(pendingClaim.deviceId, message.payload.ticket, new URL(request.url, "http://localhost").pathname + new URL(request.url, "http://localhost").search, typeof request.headers["x-xopc-proof"] === "string" ? request.headers["x-xopc-proof"] : message.payload.connectionProof)) {
 					socket.close(4401, "Realtime authentication failed");
 					return;
 				}
@@ -257,6 +263,12 @@ var RealtimeRuntime = class {
 					try {
 						const registration = this.endpointTools.connect(message.payload.endpoint, connectionId, transport);
 						endpointId = message.payload.endpoint.endpointId;
+						this.setupAuthorities.delete(endpointId);
+						if (hasGatewayScope(claim.scopes, "gateway.admin")) this.setupAuthorities.set(endpointId, {
+							connectionId,
+							principalId: claim.principalId,
+							connected: () => socket.readyState === 1
+						});
 						endpointReady = {
 							endpointId,
 							turnToken: registration.turnToken
@@ -325,6 +337,7 @@ var RealtimeRuntime = class {
 			writer.close();
 			for (const handle of subscriptions.values()) handle.unsubscribe();
 			subscriptions.clear();
+			if (endpointId && this.setupAuthorities.get(endpointId)?.connectionId === connectionId) this.setupAuthorities.delete(endpointId);
 			guardConnection("endpoint_remove", () => {
 				if (endpointId && connectionId) this.endpointTools?.remove(endpointId, connectionId);
 			});

package/dist/src/remote-access/exposure-guards.js

@@ -1,8 +1,7 @@
-import { init_host, isLoopbackHost } from "../gateway/host.js";
+import { isLoopbackHost } from "../gateway/host.js";
 import { resolveGatewayBindMode } from "../config/gateway-bind.js";
 import { resolveGatewayListenPlan } from "../gateway/listen.js";
 //#region src/remote-access/exposure-guards.ts
-init_host();
 function collectExposureConflicts(cfg) {
 	const conflicts = [];
 	const tailscaleMode = cfg.gateway?.tailscale?.mode ?? "off";

package/dist/src/runtime-tools/archive.js

@@ -1,8 +1,8 @@
 import { RuntimeError } from "./errors.js";
 import { isAbsolute, join, posix, relative, resolve } from "node:path";
 import { spawn } from "node:child_process";
-import { lstat, mkdir, readdir, readlink, rename, rm, stat } from "node:fs/promises";
 import AdmZip from "adm-zip";
+import { lstat, mkdir, readdir, readlink, rename, rm, stat } from "node:fs/promises";
 //#region src/runtime-tools/archive.ts
 const MAX_ARCHIVE_ENTRIES = 5e4;
 const MAX_TAR_OUTPUT_BYTES = 16 * 1024 * 1024;

package/dist/src/runtime-tools/catalog.d.ts

@@ -1,5 +1,5 @@
 import type { RuntimeKind } from './types.js';
-export declare const RUNTIME_CATALOG_VERSION = "2026-08-23";
+export declare const RUNTIME_CATALOG_VERSION = "2026-10-25";
 export declare const DEFAULT_RUNTIME_VERSIONS: Record<RuntimeKind, string>;
 export type RuntimePlatform = 'darwin-arm64' | 'darwin-x64' | 'win32-x64' | 'linux-x64-gnu' | 'linux-arm64-gnu';
 export interface RuntimeAsset {

package/dist/src/runtime-tools/catalog.js

@@ -1,7 +1,7 @@
 //#region src/runtime-tools/catalog.ts
-const RUNTIME_CATALOG_VERSION = "2026-08-23";
+const RUNTIME_CATALOG_VERSION = "2026-10-25";
 const DEFAULT_RUNTIME_VERSIONS = {
-	node: "22.23.2",
+	node: "26.12.1",
 	uv: "0.8.12",
 	python: "3.12.11"
 };

package/dist/src/session/config-store.js

@@ -2,9 +2,8 @@ import { createLogger } from "../utils/logger/index.js";
 import { init_logger } from "../utils/logger.js";
 import { requireXopcDatabase } from "../storage/sqlite/connection.js";
 import { deleteSessionConfig, getSessionConfig, hasSessionConfig, setSessionConfig, updateSessionConfig } from "../storage/sqlite/config-repository.js";
-import { init_sqlite } from "../storage/sqlite/index.js";
+import "../storage/sqlite/index.js";
 //#region src/session/config-store.ts
-init_sqlite();
 init_logger();
 const log = createLogger("SessionConfigStore");
 var SessionConfigStore = class {

package/dist/src/session/init-session-turn.js

@@ -1,7 +1,7 @@
 import { createLogger } from "../utils/logger/index.js";
 import { init_logger } from "../utils/logger.js";
 import { requireXopcDatabase } from "../storage/sqlite/connection.js";
-import { init_sqlite } from "../storage/sqlite/index.js";
+import "../storage/sqlite/index.js";
 import { SessionConfigSchema, init_schema } from "../config/schema.js";
 import { isPersonalConversation } from "../personal-agent/repository.js";
 import { evaluateSessionFreshness, resolveSessionResetPolicy } from "./reset-policy.js";
@@ -13,7 +13,6 @@ import { randomUUID } from "node:crypto";
 //#region src/session/init-session-turn.ts
 init_schema();
 init_logger();
-init_sqlite();
 const log = createLogger("InitSessionTurn");
 async function initSessionTurn(opts) {
 	requireXopcDatabase();

package/dist/src/session/resolve-session.js

@@ -4,7 +4,7 @@ import { requireXopcDatabase } from "../storage/sqlite/connection.js";
 import { getSessionMetadata } from "../storage/sqlite/session-read-repository.js";
 import { findConversationIdByTranscriptId } from "../storage/sqlite/session-repository.js";
 import { getSessionConfig } from "../storage/sqlite/config-repository.js";
-import { init_sqlite } from "../storage/sqlite/index.js";
+import "../storage/sqlite/index.js";
 import { SessionConfigSchema, init_schema } from "../config/schema.js";
 import { isPersonalConversation } from "../personal-agent/repository.js";
 import { normalizeThinkLevel, normalizeVerboseLevel } from "../agent/transcript/thinking-types.js";
@@ -15,7 +15,6 @@ import { randomUUID } from "node:crypto";
 //#region src/session/resolve-session.ts
 init_schema();
 init_logger();
-init_sqlite();
 const log = createLogger("ResolveSession");
 async function resolveConversationIdForRequest(opts) {
 	requireXopcDatabase();

package/dist/src/session/store.js

@@ -9,9 +9,9 @@ import "./types.js";
 import { estimateTokensFromMessages } from "../storage/sqlite/row-mappers.js";
 import { getSessionMetadata } from "../storage/sqlite/session-read-repository.js";
 import { deleteSessionRecord, ensureSessionRecord, findConversationIdByTranscriptId, getGlobalSessionStats, listSessionMetadata, listSessionsByAgent, patchSessionMetadata, resetSessionRecord } from "../storage/sqlite/session-repository.js";
-import { appendCompactionBoundaryIfUnchanged, appendTranscriptEntry, archiveFailedModelAttempts, init_transcript_repository, listCompactionBoundaries, loadCompactionSourceSnapshot, loadLlmMessagesForSession, loadTranscriptHistoryRowsForSession, loadTranscriptRowsForSession, paginateTranscriptMessages, replaceTranscriptRows, restoreBeforeCompactionBoundary, searchSessionTranscript } from "../storage/sqlite/transcript-repository.js";
+import { appendCompactionBoundaryIfUnchanged, appendTranscriptEntry, archiveFailedModelAttempts, listCompactionBoundaries, loadCompactionSourceSnapshot, loadLlmMessagesForSession, loadTranscriptHistoryRowsForSession, loadTranscriptRowsForSession, paginateTranscriptMessages, replaceTranscriptRows, restoreBeforeCompactionBoundary, searchSessionTranscript } from "../storage/sqlite/transcript-repository.js";
 import { getSessionConfig, setSessionConfig } from "../storage/sqlite/config-repository.js";
-import { init_sqlite } from "../storage/sqlite/index.js";
+import "../storage/sqlite/index.js";
 import { init_agent_session_key, resolveAgentIdFromConversationId } from "../routing/agent-session-key.js";
 import { resolveUserContextSessionAccess } from "../user-context/access-policy.js";
 import { resolveEffectiveAgentProfile } from "../config/agent-profile.js";
@@ -33,9 +33,7 @@ import { findSessionMessages } from "./session-find.js";
 init_paths_state();
 init_agent_session_key();
 init_logger();
-init_sqlite();
 init_session_context_for_llm();
-init_transcript_repository();
 const log = createLogger("SessionStore");
 const INDEX_VERSION = "1.0";
 function isTranscriptMessageRole(row, role) {

package/dist/src/share/share-rate-limit.js

@@ -1,9 +1,8 @@
 import { createLogger } from "../utils/logger/index.js";
 import { init_logger } from "../utils/logger.js";
 import { buckets } from "../gateway/rate-limit/buckets.js";
-import { init_rate_limit } from "../gateway/rate-limit/index.js";
+import "../gateway/rate-limit/index.js";
 //#region src/share/share-rate-limit.ts
-init_rate_limit();
 init_logger();
 const log = createLogger("ShareRateLimit");
 /**

package/dist/src/share/share-url.js

@@ -1,7 +1,6 @@
-import { enumerateLanGatewayCandidates, init_host } from "../gateway/host.js";
+import { enumerateLanGatewayCandidates } from "../gateway/host.js";
 import { getTunnelService } from "../tunnel/tunnel-service.js";
 //#region src/share/share-url.ts
-init_host();
 function resolveShareUrl(token, ctx) {
 	const tunnelPublicUrl = activeTunnelPublicUrl();
 	const { gatewayHost, gatewayPort, reverseProxyPublicUrl } = ctx;