@xopcai/xopc 0.0.426 → 0.0.427

package/dist/src/automations/domain/validation.d.ts

@@ -40,6 +40,7 @@ export declare const AutomationActionSchema: z.ZodDiscriminatedUnion<[z.ZodObjec
     kind: z.ZodLiteral<"agent">;
     agentId: z.ZodPipe<z.ZodOptional<z.ZodNullable<z.ZodString>>, z.ZodTransform<string, string>>;
     instruction: z.ZodString;
+    mcpSourceId: z.ZodOptional<z.ZodString>;
     workingDirectory: z.ZodPipe<z.ZodOptional<z.ZodNullable<z.ZodString>>, z.ZodTransform<string, string>>;
     model: z.ZodPipe<z.ZodOptional<z.ZodNullable<z.ZodString>>, z.ZodTransform<string, string>>;
     timeoutSeconds: z.ZodOptional<z.ZodNumber>;
@@ -182,6 +183,11 @@ export declare const AutomationDeliveryPolicySchema: z.ZodObject<{
     destinations: z.ZodDefault<z.ZodArray<z.ZodDiscriminatedUnion<[z.ZodObject<{
         key: z.ZodString;
         kind: z.ZodLiteral<"gateway_event">;
+    }, z.core.$strict>, z.ZodObject<{
+        key: z.ZodString;
+        kind: z.ZodLiteral<"weixin">;
+        conversationId: z.ZodString;
+        principalId: z.ZodString;
     }, z.core.$strict>, z.ZodObject<{
         key: z.ZodString;
         kind: z.ZodLiteral<"webhook">;
@@ -250,6 +256,7 @@ export declare const AutomationSchema: z.ZodObject<{
         kind: z.ZodLiteral<"agent">;
         agentId: z.ZodPipe<z.ZodOptional<z.ZodNullable<z.ZodString>>, z.ZodTransform<string, string>>;
         instruction: z.ZodString;
+        mcpSourceId: z.ZodOptional<z.ZodString>;
         workingDirectory: z.ZodPipe<z.ZodOptional<z.ZodNullable<z.ZodString>>, z.ZodTransform<string, string>>;
         model: z.ZodPipe<z.ZodOptional<z.ZodNullable<z.ZodString>>, z.ZodTransform<string, string>>;
         timeoutSeconds: z.ZodOptional<z.ZodNumber>;
@@ -381,6 +388,11 @@ export declare const AutomationSchema: z.ZodObject<{
         destinations: z.ZodDefault<z.ZodArray<z.ZodDiscriminatedUnion<[z.ZodObject<{
             key: z.ZodString;
             kind: z.ZodLiteral<"gateway_event">;
+        }, z.core.$strict>, z.ZodObject<{
+            key: z.ZodString;
+            kind: z.ZodLiteral<"weixin">;
+            conversationId: z.ZodString;
+            principalId: z.ZodString;
         }, z.core.$strict>, z.ZodObject<{
             key: z.ZodString;
             kind: z.ZodLiteral<"webhook">;
@@ -439,6 +451,7 @@ export declare const CreateAutomationSchema: z.ZodObject<{
         kind: z.ZodLiteral<"agent">;
         agentId: z.ZodPipe<z.ZodOptional<z.ZodNullable<z.ZodString>>, z.ZodTransform<string, string>>;
         instruction: z.ZodString;
+        mcpSourceId: z.ZodOptional<z.ZodString>;
         workingDirectory: z.ZodPipe<z.ZodOptional<z.ZodNullable<z.ZodString>>, z.ZodTransform<string, string>>;
         model: z.ZodPipe<z.ZodOptional<z.ZodNullable<z.ZodString>>, z.ZodTransform<string, string>>;
         timeoutSeconds: z.ZodOptional<z.ZodNumber>;
@@ -585,6 +598,11 @@ export declare const CreateAutomationSchema: z.ZodObject<{
         destinations: z.ZodDefault<z.ZodArray<z.ZodDiscriminatedUnion<[z.ZodObject<{
             key: z.ZodString;
             kind: z.ZodLiteral<"gateway_event">;
+        }, z.core.$strict>, z.ZodObject<{
+            key: z.ZodString;
+            kind: z.ZodLiteral<"weixin">;
+            conversationId: z.ZodString;
+            principalId: z.ZodString;
         }, z.core.$strict>, z.ZodObject<{
             key: z.ZodString;
             kind: z.ZodLiteral<"webhook">;
@@ -655,6 +673,7 @@ export declare const UpdateAutomationSchema: z.ZodObject<{
         kind: z.ZodLiteral<"agent">;
         agentId: z.ZodPipe<z.ZodOptional<z.ZodNullable<z.ZodString>>, z.ZodTransform<string, string>>;
         instruction: z.ZodString;
+        mcpSourceId: z.ZodOptional<z.ZodString>;
         workingDirectory: z.ZodPipe<z.ZodOptional<z.ZodNullable<z.ZodString>>, z.ZodTransform<string, string>>;
         model: z.ZodPipe<z.ZodOptional<z.ZodNullable<z.ZodString>>, z.ZodTransform<string, string>>;
         timeoutSeconds: z.ZodOptional<z.ZodNumber>;
@@ -827,6 +846,11 @@ export declare const UpdateAutomationSchema: z.ZodObject<{
         destinations: z.ZodDefault<z.ZodArray<z.ZodDiscriminatedUnion<[z.ZodObject<{
             key: z.ZodString;
             kind: z.ZodLiteral<"gateway_event">;
+        }, z.core.$strict>, z.ZodObject<{
+            key: z.ZodString;
+            kind: z.ZodLiteral<"weixin">;
+            conversationId: z.ZodString;
+            principalId: z.ZodString;
         }, z.core.$strict>, z.ZodObject<{
             key: z.ZodString;
             kind: z.ZodLiteral<"webhook">;

package/dist/src/automations/domain/validation.js

@@ -71,6 +71,7 @@ const AutomationActionSchema = z.discriminatedUnion("kind", [
 		kind: z.literal("agent"),
 		agentId: optionalTrimmedString(64),
 		instruction: nonEmptyString.max(5e4),
+		mcpSourceId: nonEmptyString.max(200).optional(),
 		workingDirectory: optionalTrimmedString(4096),
 		model: optionalTrimmedString(100),
 		timeoutSeconds: z.number().int().min(1).max(86400).optional()
@@ -126,6 +127,12 @@ const AutomationDeliveryPolicySchema = z.object({
 			key: nonEmptyString.max(100),
 			kind: z.literal("gateway_event")
 		}).strict(),
+		z.object({
+			key: nonEmptyString.max(100),
+			kind: z.literal("weixin"),
+			conversationId: z.string().uuid(),
+			principalId: nonEmptyString.max(500)
+		}).strict(),
 		z.object({
 			key: nonEmptyString.max(100),
 			kind: z.literal("webhook"),

package/dist/src/automations/draft/automation-draft-validator.d.ts

@@ -16,6 +16,11 @@ export declare function buildAutomationDraftResponse(draft: GeneratedAutomationD
             destinations: ({
                 key: string;
                 kind: "gateway_event";
+            } | {
+                key: string;
+                kind: "weixin";
+                conversationId: string;
+                principalId: string;
             } | {
                 key: string;
                 kind: "webhook";
@@ -39,6 +44,7 @@ export declare function buildAutomationDraftResponse(draft: GeneratedAutomationD
             kind: "agent";
             instruction: string;
             agentId?: string;
+            mcpSourceId?: string;
             workingDirectory?: string;
             model?: string;
             timeoutSeconds?: number;

package/dist/src/automations/index.js

@@ -9,7 +9,7 @@ import { computeNextAutomationRunAtMs, computeNextScheduleRunAtMs, timerDelayUnt
 import { DEFAULT_AUTOMATION_TIMEOUT_SECONDS, DEFAULT_BROWSER_AUTOMATION_TIMEOUT_SECONDS, defaultAutomationTimeoutSeconds, resolveAutomationTimeoutSeconds } from "./domain/defaults.js";
 import { AutomationActionExecutor } from "./service/action-executor.js";
 import "./delivery/index.js";
-import { AutomationAlreadyExistsError, AutomationAlreadyRunningError, AutomationInvalidAgentError, AutomationInvalidScheduleError, AutomationService } from "./service/automation-service.js";
+import { AutomationAlreadyExistsError, AutomationAlreadyRunningError, AutomationInvalidAgentError, AutomationInvalidScheduleError, AutomationInvalidSourceError, AutomationService } from "./service/automation-service.js";
 import "./domain/index.js";
 import "./service/index.js";
-export { AutomationActionExecutor, AutomationActionSchema, AutomationAlreadyExistsError, AutomationAlreadyRunningError, AutomationDeliveryPolicySchema, AutomationDeliveryRouter, AutomationEventDispatcher, AutomationInvalidAgentError, AutomationInvalidScheduleError, AutomationManagementSchema, AutomationReliabilitySchema, AutomationSafetyPolicySchema, AutomationScheduleSchema, AutomationSchema, AutomationService, AutomationStateSchema, AutomationTriggerSchema, CreateAutomationSchema, DEFAULT_AUTOMATION_TIMEOUT_SECONDS, DEFAULT_BROWSER_AUTOMATION_TIMEOUT_SECONDS, UpdateAutomationSchema, automationEventPublisher, claimAutomationEventDeliveries, claimAutomationEventsForProjection, completeAutomationEventDelivery, completeAutomationEventProjection, computeNextAutomationRunAtMs, computeNextScheduleRunAtMs, defaultAutomationTimeoutSeconds, deferAutomationEventDelivery, expireAutomationEventProjectionLeases, failAutomationEventProjection, getAutomationEventDeliveryRunId, getAutomationEventForRun, getAutomationEventQueueMetrics, getAutomationResultDeliveryMetrics, ingestAutomationEvent, listAutomationEventRecords, listAutomationEvents, listAutomationResultDeliveries, listBusinessEventDefinitions, markAutomationEventDeliveryQueued, reconcileAutomationEventDeliveries, registerBusinessEvent, releaseAutomationEventDelivery, releaseAutomationEventProjection, replayAutomationEvent, resolveAutomationTimeoutSeconds, resolveAutomationWebhookSecret, retryAutomationResultDelivery, skipAutomationEventDelivery, timerDelayUntil, validateCatalogedBusinessEvent };
+export { AutomationActionExecutor, AutomationActionSchema, AutomationAlreadyExistsError, AutomationAlreadyRunningError, AutomationDeliveryPolicySchema, AutomationDeliveryRouter, AutomationEventDispatcher, AutomationInvalidAgentError, AutomationInvalidScheduleError, AutomationInvalidSourceError, AutomationManagementSchema, AutomationReliabilitySchema, AutomationSafetyPolicySchema, AutomationScheduleSchema, AutomationSchema, AutomationService, AutomationStateSchema, AutomationTriggerSchema, CreateAutomationSchema, DEFAULT_AUTOMATION_TIMEOUT_SECONDS, DEFAULT_BROWSER_AUTOMATION_TIMEOUT_SECONDS, UpdateAutomationSchema, automationEventPublisher, claimAutomationEventDeliveries, claimAutomationEventsForProjection, completeAutomationEventDelivery, completeAutomationEventProjection, computeNextAutomationRunAtMs, computeNextScheduleRunAtMs, defaultAutomationTimeoutSeconds, deferAutomationEventDelivery, expireAutomationEventProjectionLeases, failAutomationEventProjection, getAutomationEventDeliveryRunId, getAutomationEventForRun, getAutomationEventQueueMetrics, getAutomationResultDeliveryMetrics, ingestAutomationEvent, listAutomationEventRecords, listAutomationEvents, listAutomationResultDeliveries, listBusinessEventDefinitions, markAutomationEventDeliveryQueued, reconcileAutomationEventDeliveries, registerBusinessEvent, releaseAutomationEventDelivery, releaseAutomationEventProjection, replayAutomationEvent, resolveAutomationTimeoutSeconds, resolveAutomationWebhookSecret, retryAutomationResultDelivery, skipAutomationEventDelivery, timerDelayUntil, validateCatalogedBusinessEvent };

package/dist/src/automations/mcp-source.d.ts

@@ -0,0 +1,60 @@
+import type { ExtensionFactory } from '@earendil-works/pi-coding-agent';
+import { z } from 'zod';
+import type { Config } from '../config/schema.js';
+import type { NativeMcpConfig } from '../agent/mcp/native-mcp.js';
+export declare const AutomationMcpSourceInput: z.ZodObject<{
+    serverId: z.ZodString;
+    toolNames: z.ZodArray<z.ZodString>;
+    toolInputs: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodRecord<z.ZodString, z.ZodJSONSchema>>>;
+}, z.core.$strict>;
+type Source = {
+    id: string;
+    agentId: string;
+    serverId: string;
+    revision: string;
+    workspaceDir: string;
+    tools: Array<{
+        name: string;
+        digest: string;
+        argumentsHash?: string;
+    }>;
+    createdAtMs: number;
+};
+export declare class AutomationMcpSourceError extends Error {
+}
+export declare function getAutomationMcpSource(id: string, agentId: string): Source;
+export declare function assertAutomationMcpSource(source: Source, config: Config): void;
+/** Discovery is outside SQLite write transactions; the saved reference contains no credentials. */
+export declare function prepareAutomationMcpSource(input: unknown, context: {
+    conversationId?: string;
+    agentId?: string;
+    canConfigure: boolean;
+    readConfig: () => Config;
+    workspaceDir: string;
+    signal?: AbortSignal;
+}): Promise<{
+    sourceId: string;
+    serverId: string;
+    agentId: string;
+    toolNames: string[];
+    fixedInputs: {
+        [k: string]: Record<string, z.core.util.JSONType>;
+    };
+    verified: boolean;
+    accountIdentityVerified: boolean;
+    instruction: string;
+}>;
+/** A run cannot succeed from a model answer alone or silently select a different service. */
+export declare function withAutomationMcpSource<T>(input: {
+    runId: string;
+    conversationId: string;
+    sourceId: string;
+    agentId: string;
+    readConfig: () => Config;
+    signal: AbortSignal;
+}, operation: () => Promise<T>): Promise<T>;
+export declare function boundAutomationMcpSource(runId: string, conversationId: string): Source | undefined;
+export declare function restrictAutomationMcpConfig(runId: string, conversationId: string, loaded: NativeMcpConfig): NativeMcpConfig;
+/** Native pi still executes tools. The guard pins the current contract at each actual call. */
+export declare function createAutomationMcpSourceGuard(runId: string): ExtensionFactory;
+export {};

package/dist/src/automations/mcp-source.js

@@ -0,0 +1,173 @@
+import { getSessionMetadata } from "../storage/sqlite/session-read-repository.js";
+import { init_session_repository } from "../storage/sqlite/session-repository.js";
+import { connectorPrincipalForSession } from "../connectors/principal.js";
+import { DurableState } from "../storage/sqlite/durable-state.js";
+import { isManagedConnectorServer } from "../connectors/materialize.js";
+import { discoverMcpTools } from "../agent/mcp/tool-catalog.js";
+import { mcpConfigRevision } from "../agent/mcp/connection-drafts.js";
+import { createHash } from "node:crypto";
+import { z } from "zod";
+//#region src/automations/mcp-source.ts
+init_session_repository();
+const AutomationMcpSourceInput = z.object({
+	serverId: z.string().min(1).max(64),
+	toolNames: z.array(z.string().min(1).max(300)).min(1).max(10),
+	toolInputs: z.record(z.string(), z.record(z.string(), z.json())).optional()
+}).strict();
+const sources = new DurableState("automation.mcp-source.v1");
+const executions = /* @__PURE__ */ new Map();
+var AutomationMcpSourceError = class extends Error {};
+const fail = (message) => {
+	throw new AutomationMcpSourceError(message);
+};
+const serverFor = (config, id) => Object.hasOwn(config.mcp?.servers ?? {}, id) ? config.mcp.servers[id] : void 0;
+const toolDigest = (tool) => mcpConfigRevision({
+	name: tool.name,
+	schema: tool.inputSchema,
+	annotations: tool.annotations
+});
+function getAutomationMcpSource(id, agentId) {
+	const source = sources.get(id);
+	if (!source || source.agentId !== agentId) return fail("The prepared MCP source is missing or belongs to another assistant. Prepare it again for the selected assistant.");
+	return source;
+}
+function assertAutomationMcpSource(source, config) {
+	const server = serverFor(config, source.serverId);
+	if (!server || server.enabled === false || mcpConfigRevision(server) !== source.revision) fail("The selected MCP source changed, was removed or is disabled. Reconnect and verify that source; no alternative source will be used.");
+}
+/** Discovery is outside SQLite write transactions; the saved reference contains no credentials. */
+async function prepareAutomationMcpSource(input, context) {
+	const args = AutomationMcpSourceInput.parse(input);
+	const session = context.conversationId ? getSessionMetadata(context.conversationId) : void 0;
+	if (!context.canConfigure || !session || session.agentId !== context.agentId || !connectorPrincipalForSession(context.conversationId).isLocalOwner) return fail("An active owner conversation is required to prepare an automation source.");
+	const config = structuredClone(context.readConfig()), server = serverFor(config, args.serverId);
+	if (!server?.url || server.enabled === false || isManagedConnectorServer(server) || server.xopcPlugin) return fail("This workflow supports an enabled custom HTTP MCP connection. Managed connectors and account-specific bindings require their own adapter.");
+	const catalog = await discoverMcpTools(config, context.workspaceDir, args.serverId, { signal: context.signal });
+	const selected = [...new Set(args.toolNames)].sort().map((name) => {
+		const tool = catalog.find((item) => item.name === name);
+		if (!tool || tool.exposure === "hidden" || tool.annotations?.readOnlyHint !== true || tool.annotations.destructiveHint === true) return fail("Select discovered, exposed MCP tools explicitly annotated read-only. No tool permissions will be widened.");
+		return {
+			name,
+			digest: toolDigest(tool),
+			argumentsHash: mcpConfigRevision(args.toolInputs?.[name] ?? {})
+		};
+	});
+	const fields = {
+		agentId: context.agentId,
+		serverId: args.serverId,
+		revision: mcpConfigRevision(server),
+		workspaceDir: context.workspaceDir,
+		tools: selected
+	};
+	const id = `mcp-source-${createHash("sha256").update(JSON.stringify(fields)).digest("hex")}`;
+	const source = {
+		...fields,
+		id,
+		createdAtMs: Date.now()
+	};
+	assertAutomationMcpSource(source, context.readConfig());
+	if (!sources.get(id)) sources.set(id, source);
+	return {
+		sourceId: id,
+		serverId: source.serverId,
+		agentId: source.agentId,
+		toolNames: selected.map((tool) => tool.name),
+		fixedInputs: Object.fromEntries(selected.map((tool) => [tool.name, args.toolInputs?.[tool.name] ?? {}])),
+		verified: false,
+		accountIdentityVerified: false,
+		instruction: "Create a disabled agent automation with action.mcpSourceId set to sourceId. Run an actual trial, inspect its terminal result, then enable the same object only when authorized. This pins the selected server and grant reference, not an independently verified remote account identity. Do not enable explicit-account workflows without their identity adapter."
+	};
+}
+/** A run cannot succeed from a model answer alone or silently select a different service. */
+async function withAutomationMcpSource(input, operation) {
+	const source = getAutomationMcpSource(input.sourceId, input.agentId);
+	assertAutomationMcpSource(source, input.readConfig());
+	const catalog = await discoverMcpTools(input.readConfig(), source.workspaceDir, source.serverId, { signal: input.signal });
+	assertAutomationMcpSource(source, input.readConfig());
+	if (source.tools.some((expected) => !catalog.some((tool) => tool.name === expected.name && tool.exposure !== "hidden" && toolDigest(tool) === expected.digest))) return fail("The selected MCP tool contract changed. Verify a new source before running again.");
+	if (executions.has(input.runId)) return fail("This source-bound run is already executing.");
+	const execution = {
+		source,
+		conversationId: input.conversationId,
+		readConfig: input.readConfig,
+		signal: input.signal,
+		successful: /* @__PURE__ */ new Set(),
+		failed: false
+	};
+	executions.set(input.runId, execution);
+	try {
+		const result = await operation();
+		input.signal.throwIfAborted();
+		assertAutomationMcpSource(source, input.readConfig());
+		if (execution.failed || source.tools.some((tool) => !execution.successful.has(tool.name))) return fail("The selected MCP read did not complete successfully in this run. An assistant answer is not verified source data.");
+		return result;
+	} finally {
+		executions.delete(input.runId);
+	}
+}
+function boundAutomationMcpSource(runId, conversationId) {
+	const execution = executions.get(runId);
+	if (execution && execution.conversationId !== conversationId) return fail("The MCP source belongs to a different execution conversation.");
+	return execution?.source;
+}
+function restrictAutomationMcpConfig(runId, conversationId, loaded) {
+	const source = boundAutomationMcpSource(runId, conversationId);
+	if (!source) return loaded;
+	const entry = loaded.servers.find((server) => server.name === source.serverId && server.config.enabled !== false);
+	if (!entry) return fail("The selected MCP source is not available to this execution.");
+	return {
+		...loaded,
+		errors: [],
+		automationSourceRunId: runId,
+		servers: [{
+			...entry,
+			config: {
+				...entry.config,
+				exposure: entry.config.exposure === "hidden" ? "hidden" : "deferred"
+			}
+		}]
+	};
+}
+/** Native pi still executes tools. The guard pins the current contract at each actual call. */
+function createAutomationMcpSourceGuard(runId) {
+	return (pi) => {
+		pi.on("tool_call", (event) => {
+			const execution = executions.get(runId);
+			if (!execution || execution.signal.aborted) return {
+				block: true,
+				reason: "The bound automation execution ended."
+			};
+			try {
+				assertAutomationMcpSource(execution.source, execution.readConfig());
+				if (event.toolName === "tool_search") return;
+				const expected = execution.source.tools.find((tool) => tool.name === event.toolName);
+				const actual = pi.getAllTools().find((tool) => tool.name === event.toolName);
+				if (!expected || !actual || actual.exposure === "hidden" || toolDigest({
+					name: actual.name,
+					inputSchema: actual.parameters,
+					annotations: actual.annotations
+				}) !== expected.digest || mcpConfigRevision(event.input ?? {}) !== (expected.argumentsHash ?? mcpConfigRevision({}))) {
+					execution.failed = true;
+					return {
+						block: true,
+						reason: "This tool is outside the pinned MCP read contract."
+					};
+				}
+			} catch {
+				execution.failed = true;
+				return {
+					block: true,
+					reason: "The selected MCP source changed. No alternative source is allowed."
+				};
+			}
+		});
+		pi.on("tool_result", (event) => {
+			const execution = executions.get(runId);
+			if (!execution || !execution.source.tools.some((tool) => tool.name === event.toolName)) return;
+			if (event.isError) execution.failed = true;
+			else execution.successful.add(event.toolName);
+		});
+	};
+}
+//#endregion
+export { AutomationMcpSourceError, AutomationMcpSourceInput, assertAutomationMcpSource, boundAutomationMcpSource, createAutomationMcpSourceGuard, getAutomationMcpSource, prepareAutomationMcpSource, restrictAutomationMcpConfig, withAutomationMcpSource };

package/dist/src/automations/service/action-executor.js

@@ -6,6 +6,7 @@ import { init_model_usage, withModelUsageOrigin } from "../../providers/model-us
 import { init_session_key, resolveConversationId } from "../../routing/session-key.js";
 import { getAutomationRunRequest, listAutomationRuns } from "../storage/automation-run-repository.js";
 import "../storage/index.js";
+import { withAutomationMcpSource } from "../mcp-source.js";
 import { resolveAutomationTimeoutSeconds } from "../domain/defaults.js";
 //#region src/automations/service/action-executor.ts
 init_session_repository();
@@ -279,7 +280,7 @@ var AutomationActionExecutor = class {
 			}),
 			"</automation_handoff>"
 		].join("\n") : "";
-		const response = await agentService.turnDispatcher.processDirect(buildSafetyInstruction(automation, [appendTriggerContext(action.instruction, context.triggerEvent), handoff].filter(Boolean).join("\n\n")), conversationId, {
+		const process = () => agentService.turnDispatcher.processDirect(buildSafetyInstruction(automation, [appendTriggerContext(action.instruction, context.triggerEvent), handoff].filter(Boolean).join("\n\n")), conversationId, {
 			type: "system",
 			source: "automation"
 		}, void 0, void 0, {
@@ -287,6 +288,19 @@ var AutomationActionExecutor = class {
 			runId: run.id,
 			deadlineAtMs
 		});
+		if (action.mcpSourceId && !this.deps.getConfig) return {
+			status: "failed",
+			error: "The selected MCP source cannot be checked in this runtime.",
+			conversationId
+		};
+		const response = action.mcpSourceId ? await withAutomationMcpSource({
+			runId: run.id,
+			conversationId,
+			sourceId: action.mcpSourceId,
+			agentId,
+			readConfig: this.deps.getConfig,
+			signal
+		}, process) : await process();
 		const model = agentService.getModelForSession?.(conversationId);
 		return {
 			status: "succeeded",

package/dist/src/automations/service/automation-service.d.ts

@@ -1,9 +1,12 @@
+import type { AutomationDeliveryPolicy } from '../domain/types.js';
 import type { Automation, AutomationDeps, AutomationEvent, AutomationMetrics, AutomationProductEventRun, AutomationRun, AutomationRunEvent } from '../domain/types.js';
 import { type CreateAutomationInput, type UpdateAutomationInput } from '../domain/validation.js';
 export declare class AutomationInvalidScheduleError extends Error {
 }
 export declare class AutomationInvalidAgentError extends Error {
 }
+export declare class AutomationInvalidSourceError extends Error {
+}
 export declare class AutomationAlreadyRunningError extends Error {
     readonly automationId: string;
     readonly runningRunId?: string;
@@ -31,11 +34,13 @@ export declare class AutomationService {
         maxConcurrentRuns?: number;
     }): Promise<void>;
     stop(): Promise<void>;
+    bindConversationDelivery(conversationId: string | undefined, input: unknown): AutomationDeliveryPolicy;
     create(input: CreateAutomationInput): Promise<Automation>;
     /** SQLite-only creation; scheduling starts after the caller commits. */
     createAtomically(input: CreateAutomationInput): Automation;
     private applyCreate;
     private assertExecutionAgent;
+    private assertMcpSource;
     private prepareSchedule;
     private pinBrowserVersion;
     list(options?: {

package/dist/src/automations/service/automation-service.js

@@ -1,19 +1,28 @@
 import { createLogger } from "../../utils/logger/index.js";
 import { init_logger } from "../../utils/logger.js";
 import { init_transaction, runSqliteWriteTransaction } from "../../storage/sqlite/transaction.js";
-import { AutomationSchema, CreateAutomationSchema, UpdateAutomationSchema } from "../domain/validation.js";
+import { getSessionMetadata } from "../../storage/sqlite/session-read-repository.js";
+import { init_session_repository } from "../../storage/sqlite/session-repository.js";
+import { normalizeAgentId } from "../../agent-catalog/id.js";
+import { init_agent_scope } from "../../agent/agent-scope.js";
+import { AutomationDeliveryPolicySchema, AutomationSchema, CreateAutomationSchema, UpdateAutomationSchema } from "../domain/validation.js";
 import { deleteAutomation, getAutomation, getDeletedAutomationRevision, listAutomations, saveAutomation, saveAutomations } from "../storage/automation-repository.js";
 import { appendAutomationRunEvent, getAutomationRun, getAutomationRunRequest, listAutomationRunEvents, listAutomationRuns, listAutomationRunsForProductEvent, listUnfinishedAutomationRuns, markAllAutomationRunsRead, markAutomationRunRead, pruneAutomationHistory, saveAutomationRun, saveAutomationRunRequest, touchAutomationRunLease } from "../storage/automation-run-repository.js";
 import "../storage/index.js";
 import { getAutomationEventDeliveryRunId, getAutomationEventForRun, getAutomationEventQueueMetrics, ingestAutomationEvent, listAutomationEventRecords, markAutomationEventDeliveryQueued, replayAutomationEvent } from "../events/event-repository.js";
 import { AutomationEventDispatcher } from "../events/event-dispatcher.js";
 import { AutomationDeliveryRouter, getAutomationResultDeliveryMetrics, listAutomationResultDeliveries, retryAutomationResultDelivery } from "../delivery/delivery-router.js";
+import { mcpConfigRevision } from "../../agent/mcp/connection-drafts.js";
+import { assertAutomationMcpSource, getAutomationMcpSource } from "../mcp-source.js";
+import { weixinPrivateIdentity } from "../../agent/mcp/weixin-setup-scope.js";
 import { computeNextAutomationRunAtMs, timerDelayUntil } from "../domain/schedule.js";
 import { AutomationActionExecutor } from "./action-executor.js";
 import "../delivery/index.js";
 import { randomUUID } from "node:crypto";
 //#region src/automations/service/automation-service.ts
+init_session_repository();
 init_logger();
+init_agent_scope();
 init_transaction();
 const log = createLogger("AutomationService");
 const DEFAULT_MAX_CONCURRENT_RUNS = 5;
@@ -22,6 +31,7 @@ const RUN_LEASE_DURATION_MS = 3e4;
 const RETRY_BASE_DELAY_MS = 1e3;
 var AutomationInvalidScheduleError = class extends Error {};
 var AutomationInvalidAgentError = class extends Error {};
+var AutomationInvalidSourceError = class extends Error {};
 var AutomationAlreadyRunningError = class extends Error {
 	constructor(automationId, runningRunId) {
 		super(`Automation is already running: ${automationId}`);
@@ -44,6 +54,10 @@ var AutomationService = class {
 		onDeadLetter: (input) => this.deps.onReliabilityAttention?.(input)
 	});
 	deliveryRouter = new AutomationDeliveryRouter({
+		deliverWeixin: (conversationId, principalId, run) => {
+			if (!this.deps.onWeixinRunCompleted) throw new Error("Weixin delivery is unavailable.");
+			return this.deps.onWeixinRunCompleted(conversationId, principalId, run);
+		},
 		deliverGatewayEvent: (run, context) => {
 			if (!this.deps.onRunCompleted) throw new Error("Notification service is unavailable. Delivery will retry.");
 			return this.deps.onRunCompleted(run, context);
@@ -89,6 +103,25 @@ var AutomationService = class {
 		await this.deliveryRouter.stop();
 		log.info("Automation service stopped");
 	}
+	bindConversationDelivery(conversationId, input) {
+		const delivery = AutomationDeliveryPolicySchema.parse(input);
+		if (!conversationId || getSessionMetadata(conversationId)?.sourceChannel !== "weixin") return delivery;
+		const scope = this.deps.getConfig && weixinPrivateIdentity(conversationId, this.deps.getConfig());
+		if (!scope) throw new AutomationInvalidSourceError("A paired Weixin conversation is required for this notification.");
+		const destinations = delivery.destinations.filter((item) => item.kind !== "weixin");
+		if (delivery.destinations.some((item) => item.kind === "weixin" && (item.conversationId !== conversationId || item.principalId !== scope.principalId))) throw new AutomationInvalidSourceError("Notifications cannot be redirected to another Weixin identity.");
+		let key = "weixin";
+		while (destinations.some((item) => item.key === key)) key = `_${key}`;
+		return {
+			...delivery,
+			destinations: [...destinations, {
+				key,
+				kind: "weixin",
+				conversationId,
+				principalId: scope.principalId
+			}]
+		};
+	}
 	async create(input) {
 		const automation = this.createAtomically(input);
 		this.refreshSchedule();
@@ -121,6 +154,7 @@ var AutomationService = class {
 		this.assertExecutionAgent(automation);
 		this.prepareSchedule(automation, now);
 		this.pinBrowserVersion(automation);
+		this.assertMcpSource(automation);
 		if (getAutomation(automation.id)) throw new AutomationAlreadyExistsError(automation.id);
 		automation.updatedAtMs = Math.max(automation.updatedAtMs, (getDeletedAutomationRevision(automation.id) ?? -1) + 1);
 		automation.state.nextRunAtMs = computeNextAutomationRunAtMs(automation, now);
@@ -131,6 +165,20 @@ var AutomationService = class {
 		if (automation.action.kind !== "agent" || !automation.action.agentId || !this.deps.isAgentAvailable) return;
 		if (!this.deps.isAgentAvailable(automation.action.agentId)) throw new AutomationInvalidAgentError("Execution assistant is unavailable. Choose an available assistant or use the default.");
 	}
+	assertMcpSource(automation) {
+		if (automation.action.kind !== "agent" || !automation.action.mcpSourceId || !automation.enabled) return;
+		try {
+			const source = getAutomationMcpSource(automation.action.mcpSourceId, normalizeAgentId(automation.action.agentId || this.deps.getDefaultAgentId?.() || "main"));
+			if (!this.deps.getConfig) throw new Error("The selected MCP source cannot be checked in this runtime.");
+			assertAutomationMcpSource(source, this.deps.getConfig());
+			if (!listAutomationRuns({
+				automationId: automation.id,
+				limit: 500
+			}).some((run) => run.status === "succeeded" && mcpConfigRevision(run.actionSnapshot) === mcpConfigRevision(automation.action))) throw new Error("Run and verify this exact source-bound action before enabling its schedule. Save a disabled draft first.");
+		} catch (error) {
+			throw new AutomationInvalidSourceError(error instanceof Error ? error.message : "The MCP source is unavailable.");
+		}
+	}
 	prepareSchedule(automation, now) {
 		if (automation.trigger.kind !== "schedule") return;
 		const schedule = automation.trigger.schedule;
@@ -193,9 +241,11 @@ var AutomationService = class {
 				...parsed.state ?? {}
 			}
 		});
+		if (current.action.kind === "agent" && current.action.mcpSourceId && next.action.kind === "agent" && !next.action.mcpSourceId) next.action.mcpSourceId = current.action.mcpSourceId;
 		if (parsed.action) this.assertExecutionAgent(next);
 		if (parsed.trigger || parsed.enabled === true && next.trigger.kind === "schedule" && next.trigger.schedule.kind === "once") this.prepareSchedule(next, now);
 		this.pinBrowserVersion(next);
+		this.assertMcpSource(next);
 		if ("enabled" in parsed || "trigger" in parsed) next.state.nextRunAtMs = computeNextAutomationRunAtMs(next, now);
 		saveAutomation(next);
 		return next;
@@ -844,4 +894,4 @@ function readAutomationEventFromRunEvent(event) {
 	};
 }
 //#endregion
-export { AutomationAlreadyExistsError, AutomationAlreadyRunningError, AutomationInvalidAgentError, AutomationInvalidScheduleError, AutomationService };
+export { AutomationAlreadyExistsError, AutomationAlreadyRunningError, AutomationInvalidAgentError, AutomationInvalidScheduleError, AutomationInvalidSourceError, AutomationService };

package/dist/src/automations/service/index.js

@@ -1,3 +1,3 @@
 import { AutomationActionExecutor } from "./action-executor.js";
-import { AutomationAlreadyExistsError, AutomationAlreadyRunningError, AutomationInvalidAgentError, AutomationInvalidScheduleError, AutomationService } from "./automation-service.js";
-export { AutomationActionExecutor, AutomationAlreadyExistsError, AutomationAlreadyRunningError, AutomationInvalidAgentError, AutomationInvalidScheduleError, AutomationService };
+import { AutomationAlreadyExistsError, AutomationAlreadyRunningError, AutomationInvalidAgentError, AutomationInvalidScheduleError, AutomationInvalidSourceError, AutomationService } from "./automation-service.js";
+export { AutomationActionExecutor, AutomationAlreadyExistsError, AutomationAlreadyRunningError, AutomationInvalidAgentError, AutomationInvalidScheduleError, AutomationInvalidSourceError, AutomationService };

package/dist/src/browser/setup/repository.d.ts

@@ -1,5 +1,6 @@
 import type { BrowserSetup } from './types.js';
 export declare function readBrowserSetup(id: string): BrowserSetup | undefined;
+export declare function listConversationBrowserSetups(conversationId: string): BrowserSetup[];
 export declare function findBrowserSetup(conversationId: string, agentId: string): BrowserSetup | undefined;
 export declare function createBrowserSetup(conversationId: string, agentId: string, configRevision: string): BrowserSetup;
 export declare function saveBrowserSetup(next: BrowserSetup, expectedRevision: number): BrowserSetup;

package/dist/src/browser/setup/repository.js

@@ -1,11 +1,16 @@
 import { getSqliteDatabase, init_transaction, runSqliteWriteTransaction } from "../../storage/sqlite/transaction.js";
+import { getSessionMetadata, init_session_read_repository } from "../../storage/sqlite/session-read-repository.js";
 import { randomUUID } from "node:crypto";
 //#region src/browser/setup/repository.ts
 init_transaction();
+init_session_read_repository();
 function readBrowserSetup(id) {
 	const row = getSqliteDatabase().prepare("SELECT payload_json FROM browser_setup_runs WHERE id = ?").get(id);
 	return row ? JSON.parse(row.payload_json) : void 0;
 }
+function listConversationBrowserSetups(conversationId) {
+	return getSqliteDatabase().prepare("SELECT payload_json FROM browser_setup_runs WHERE conversation_id = ?").all(conversationId).map((row) => JSON.parse(row.payload_json));
+}
 function findBrowserSetup(conversationId, agentId) {
 	const row = getSqliteDatabase().prepare("SELECT payload_json FROM browser_setup_runs WHERE conversation_id = ? AND agent_id = ? ORDER BY updated_at DESC, rowid DESC LIMIT 1").get(conversationId, agentId);
 	return row ? JSON.parse(row.payload_json) : void 0;
@@ -19,6 +24,7 @@ function createBrowserSetup(conversationId, agentId, configRevision) {
 			id: randomUUID(),
 			conversationId,
 			agentId,
+			transcriptId: getSessionMetadata(conversationId)?.transcriptId,
 			configRevision,
 			state: "plan_ready",
 			revision: 1,
@@ -39,4 +45,4 @@ function saveBrowserSetup(next, expectedRevision) {
 	return next;
 }
 //#endregion
-export { createBrowserSetup, findBrowserSetup, readBrowserSetup, saveBrowserSetup };
+export { createBrowserSetup, findBrowserSetup, listConversationBrowserSetups, readBrowserSetup, saveBrowserSetup };

package/dist/src/browser/setup/service.d.ts

@@ -31,7 +31,10 @@ export interface BrowserSetupDeps {
 export declare class BrowserSetupService {
     private readonly deps;
     private readonly preparing;
+    private readonly preparationSettled;
     constructor(deps: BrowserSetupDeps);
+    private scopeCurrent;
+    cancelConversation(conversationId: string): Promise<void>;
     private policyRevision;
     endpoints(): {
         endpointId: string;