@zhanguym/chatroom 1.2.0 → 1.3.2

package/dist/plugins/agent/repository.js

@@ -1,3 +1,4 @@
+import path from "node:path";
 export class AgentRepository {
     database;
     constructor(database) {
@@ -27,23 +28,23 @@ export class AgentRepository {
     }
     insertSession(session) {
         this.database.raw
-            .prepare("INSERT INTO agent_sessions(id, workspace_root, provider, status, created_at, updated_at) VALUES(?,?,?,?,?,?)")
-            .run(session.id, session.workspaceRoot, session.provider, session.status, session.createdAt, session.updatedAt);
+            .prepare("INSERT INTO agent_sessions(id, workspace_id, provider, status, created_at, updated_at) VALUES(?,?,?,?,?,?)")
+            .run(session.id, session.workspaceId, session.provider, session.status, session.createdAt, session.updatedAt);
     }
     updateSession(session) {
         this.database.raw
-            .prepare("UPDATE agent_sessions SET workspace_root=?, provider=?, status=?, created_at=?, updated_at=? WHERE id=?")
-            .run(session.workspaceRoot, session.provider, session.status, session.createdAt, session.updatedAt, session.id);
+            .prepare("UPDATE agent_sessions SET workspace_id=?, provider=?, status=?, created_at=?, updated_at=? WHERE id=?")
+            .run(session.workspaceId, session.provider, session.status, session.createdAt, session.updatedAt, session.id);
     }
     getSession(id) {
         const row = this.database.raw
-            .prepare("SELECT s.*, p.model AS model, p.reasoning_effort, p.reasoning_summary, p.service_tier, p.approval_policy_json, p.approvals_reviewer, p.permission_mode, p.token_usage_json, CASE WHEN EXISTS (SELECT 1 FROM agent_items ai JOIN agent_turns at ON at.id=ai.turn_id WHERE at.session_id=s.id AND ai.type='interaction' AND ai.status='waiting' AND json_extract(ai.payload_json,'$.interaction.kind')='approval') THEN 'approval' WHEN EXISTS (SELECT 1 FROM agent_items ai JOIN agent_turns at ON at.id=ai.turn_id WHERE at.session_id=s.id AND ai.type='interaction' AND ai.status='waiting') THEN 'input' ELSE NULL END AS attention_kind, (SELECT COUNT(*) FROM agent_items ai JOIN agent_turns at ON at.id=ai.turn_id WHERE at.session_id=s.id AND ai.type='interaction' AND ai.status='waiting') AS attention_count FROM agent_sessions s LEFT JOIN agent_session_providers p ON p.session_id=s.id AND p.provider=s.provider WHERE s.id=?")
+            .prepare("SELECT s.*, w.name_override AS workspace_name, w.path AS workspace_path, p.model AS model, p.reasoning_effort, p.reasoning_summary, p.service_tier, p.approval_policy_json, p.approvals_reviewer, p.permission_mode, p.token_usage_json, CASE WHEN EXISTS (SELECT 1 FROM agent_items ai JOIN agent_turns at ON at.id=ai.turn_id WHERE at.session_id=s.id AND ai.type='interaction' AND ai.status='waiting' AND json_extract(ai.payload_json,'$.interaction.kind')='approval') THEN 'approval' WHEN EXISTS (SELECT 1 FROM agent_items ai JOIN agent_turns at ON at.id=ai.turn_id WHERE at.session_id=s.id AND ai.type='interaction' AND ai.status='waiting') THEN 'input' ELSE NULL END AS attention_kind, (SELECT COUNT(*) FROM agent_items ai JOIN agent_turns at ON at.id=ai.turn_id WHERE at.session_id=s.id AND ai.type='interaction' AND ai.status='waiting') AS attention_count FROM agent_sessions s LEFT JOIN workspaces w ON w.id=s.workspace_id LEFT JOIN agent_session_providers p ON p.session_id=s.id AND p.provider=s.provider WHERE s.id=?")
             .get(id);
         return row ? sessionFromRow(row) : null;
     }
     listSessions() {
         return this.database.raw
-            .prepare("SELECT s.*, p.model AS model, p.reasoning_effort, p.reasoning_summary, p.service_tier, p.approval_policy_json, p.approvals_reviewer, p.permission_mode, p.token_usage_json, CASE WHEN EXISTS (SELECT 1 FROM agent_items ai JOIN agent_turns at ON at.id=ai.turn_id WHERE at.session_id=s.id AND ai.type='interaction' AND ai.status='waiting' AND json_extract(ai.payload_json,'$.interaction.kind')='approval') THEN 'approval' WHEN EXISTS (SELECT 1 FROM agent_items ai JOIN agent_turns at ON at.id=ai.turn_id WHERE at.session_id=s.id AND ai.type='interaction' AND ai.status='waiting') THEN 'input' ELSE NULL END AS attention_kind, (SELECT COUNT(*) FROM agent_items ai JOIN agent_turns at ON at.id=ai.turn_id WHERE at.session_id=s.id AND ai.type='interaction' AND ai.status='waiting') AS attention_count FROM agent_sessions s LEFT JOIN agent_session_providers p ON p.session_id=s.id AND p.provider=s.provider ORDER BY s.updated_at DESC")
+            .prepare("SELECT s.*, w.name_override AS workspace_name, w.path AS workspace_path, p.model AS model, p.reasoning_effort, p.reasoning_summary, p.service_tier, p.approval_policy_json, p.approvals_reviewer, p.permission_mode, p.token_usage_json, CASE WHEN EXISTS (SELECT 1 FROM agent_items ai JOIN agent_turns at ON at.id=ai.turn_id WHERE at.session_id=s.id AND ai.type='interaction' AND ai.status='waiting' AND json_extract(ai.payload_json,'$.interaction.kind')='approval') THEN 'approval' WHEN EXISTS (SELECT 1 FROM agent_items ai JOIN agent_turns at ON at.id=ai.turn_id WHERE at.session_id=s.id AND ai.type='interaction' AND ai.status='waiting') THEN 'input' ELSE NULL END AS attention_kind, (SELECT COUNT(*) FROM agent_items ai JOIN agent_turns at ON at.id=ai.turn_id WHERE at.session_id=s.id AND ai.type='interaction' AND ai.status='waiting') AS attention_count FROM agent_sessions s LEFT JOIN workspaces w ON w.id=s.workspace_id LEFT JOIN agent_session_providers p ON p.session_id=s.id AND p.provider=s.provider ORDER BY s.updated_at DESC")
             .all().map(sessionFromRow);
     }
     deleteSession(id) {
@@ -131,7 +132,9 @@ function selectByIds(database, prefix, sessionId, ids) {
 function sessionFromRow(row) {
     return {
         id: row.id,
-        workspaceRoot: row.workspace_root,
+        workspaceId: row.workspace_id,
+        workspaceName: row.workspace_name ??
+            (row.workspace_path ? path.basename(row.workspace_path) : ""),
         tokenUsage: parseJson(row.token_usage_json),
         provider: row.provider,
         model: row.model,

package/dist/plugins/agent/runtime-files.d.ts

@@ -2,7 +2,7 @@ import type { ProviderItem } from "./provider.js";
 import type { AgentStore } from "./store.js";
 import type { AgentHistory, AgentSession, AgentTurnInput } from "./types.js";
 export declare function sessionAttachmentPrefix(sessionId: string): string;
-export declare function cleanupSessionFiles(store: AgentStore, history: AgentHistory): Promise<void>;
-export declare function cleanupOrphanAttachments(store: AgentStore, maxAgeMs: number): Promise<void>;
-export declare function prepareProviderItem(session: AgentSession, item: ProviderItem): Promise<ProviderItem>;
-export declare function validateAttachments(session: AgentSession, attachments: AgentTurnInput["attachments"]): Promise<AgentTurnInput["attachments"]>;
+export declare function cleanupSessionFiles(store: AgentStore, history: AgentHistory, workspaceRoot: string | null): Promise<void>;
+export declare function cleanupOrphanAttachments(store: AgentStore, resolveWorkspace: (workspaceId: string) => Promise<string>, maxAgeMs: number): Promise<void>;
+export declare function prepareProviderItem(workspaceRoot: string, item: ProviderItem): Promise<ProviderItem>;
+export declare function validateAttachments(session: AgentSession, workspaceRoot: string, attachments: AgentTurnInput["attachments"]): Promise<AgentTurnInput["attachments"]>;

package/dist/plugins/agent/runtime-files.js

@@ -7,9 +7,10 @@ import { runtimeErrorMessage } from "./runtime-state.js";
 export function sessionAttachmentPrefix(sessionId) {
     return ".chatroom/agent-attachments/" + sessionId + "/";
 }
-export async function cleanupSessionFiles(store, history) {
-    const workspaceRoot = history.session.workspaceRoot;
-    const retained = referencedManagedFiles(store, workspaceRoot, history.session.id);
+export async function cleanupSessionFiles(store, history, workspaceRoot) {
+    if (!workspaceRoot)
+        return;
+    const retained = referencedManagedFiles(store, history.session.workspaceId, history.session.id);
     const attachmentPrefix = sessionAttachmentPrefix(history.session.id);
     const attachmentDirectory = path.join(workspaceRoot, attachmentPrefix);
     try {
@@ -29,14 +30,17 @@ export async function cleanupSessionFiles(store, history) {
         await removeFileWithin(workspaceRoot, filePath).catch(() => undefined);
     }
 }
-export async function cleanupOrphanAttachments(store, maxAgeMs) {
+export async function cleanupOrphanAttachments(store, resolveWorkspace, maxAgeMs) {
     const now = Date.now();
-    const workspaceRoots = new Set(store.listSessions().map((session) => session.workspaceRoot));
-    for (const workspaceRoot of workspaceRoots) {
-        await removeUnreferencedAttachmentFiles(workspaceRoot, referencedManagedFiles(store, workspaceRoot), now, maxAgeMs);
+    const workspaceIds = new Set(store.listSessions().map((session) => session.workspaceId));
+    for (const workspaceId of workspaceIds) {
+        const workspaceRoot = await resolveWorkspace(workspaceId).catch(() => null);
+        if (!workspaceRoot)
+            continue;
+        await removeUnreferencedAttachmentFiles(workspaceRoot, referencedManagedFiles(store, workspaceId), now, maxAgeMs);
     }
 }
-export async function prepareProviderItem(session, item) {
+export async function prepareProviderItem(workspaceRoot, item) {
     if (item.type !== "artifact")
         return item;
     try {
@@ -45,7 +49,7 @@ export async function prepareProviderItem(session, item) {
                 ...item,
                 artifact: {
                     ...item.artifact,
-                    path: (await resolveReadableFileWithin(session.workspaceRoot, item.artifact.path)).relative,
+                    path: (await resolveReadableFileWithin(workspaceRoot, item.artifact.path)).relative,
                 },
             };
         }
@@ -61,7 +65,7 @@ export async function prepareProviderItem(session, item) {
         const content = await readFile(item.artifact.path);
         if (content.byteLength > 32 * 1024 * 1024)
             throw new ChatRoomError("INVALID_INPUT", "Agent artifact is too large");
-        await writeBytesAtomicWithin(session.workspaceRoot, target, content);
+        await writeBytesAtomicWithin(workspaceRoot, target, content);
         return {
             ...item,
             artifact: {
@@ -78,9 +82,9 @@ export async function prepareProviderItem(session, item) {
         };
     }
 }
-export async function validateAttachments(session, attachments) {
+export async function validateAttachments(session, workspaceRoot, attachments) {
     return Promise.all(attachments.map(async (attachment) => {
-        const resolved = await resolveReadableFileWithin(session.workspaceRoot, attachment.path);
+        const resolved = await resolveReadableFileWithin(workspaceRoot, attachment.path);
         if (resolved.relative.startsWith(".chatroom/agent-attachments/") &&
             !resolved.relative.startsWith(sessionAttachmentPrefix(session.id)))
             throw new ChatRoomError("FORBIDDEN", "Agent attachment belongs to another session");
@@ -90,12 +94,12 @@ export async function validateAttachments(session, attachments) {
         };
     }));
 }
-function referencedManagedFiles(store, workspaceRoot, excludedSessionId) {
+function referencedManagedFiles(store, workspaceId, excludedSessionId) {
     const paths = new Set();
     for (const session of store.listSessions()) {
         if (session.id === excludedSessionId)
             continue;
-        if (session.workspaceRoot !== workspaceRoot)
+        if (session.workspaceId !== workspaceId)
             continue;
         const history = store.history(session.id);
         if (!history)

package/dist/plugins/agent/runtime.d.ts

@@ -14,6 +14,7 @@ export declare class AgentRuntime {
     private closed;
     private readonly providers;
     constructor(store: AgentStore, workspaces: WorkspaceAccess, events: RuntimeEventBus, providers: AgentProvider[]);
+    refreshMcpServers(): Promise<void>;
     providerStatuses(): Promise<AgentProviderStatus[]>;
     providerDetails(providerId: AgentProviderId): Promise<AgentProviderDetails>;
     models(providerId: AgentProviderId): Promise<AgentModel[]>;
@@ -33,6 +34,7 @@ export declare class AgentRuntime {
     interrupt(sessionId: string): Promise<void>;
     respondInteraction(sessionId: string, itemId: string, response: AgentInteractionResponse): Promise<AgentItem>;
     deleteSession(sessionId: string): Promise<void>;
+    deleteSessions(sessionIds: readonly string[]): Promise<void>;
     private deleteSessionUnlocked;
     switchProvider(sessionId: string, targetProvider: AgentProviderId, patch?: Partial<AgentSessionConfig>): Promise<AgentSession>;
     private switchProviderUnlocked;

package/dist/plugins/agent/runtime.js

@@ -30,6 +30,12 @@ export class AgentRuntime {
         }
         this.store.reconcileInterrupted(new Date().toISOString());
     }
+    async refreshMcpServers() {
+        const results = await Promise.allSettled([...this.providers.values()].map((provider) => provider.refreshMcpServers?.()));
+        const failures = results.filter((result) => result.status === "rejected");
+        if (failures.length)
+            throw new AggregateError(failures.map((failure) => failure.reason), "Failed to refresh MCP servers for one or more Agent providers");
+    }
     async providerStatuses() {
         return Promise.all([...this.providers.values()].map(async (provider) => ({
             id: provider.id,
@@ -67,8 +73,8 @@ export class AgentRuntime {
         return update;
     }
     async createSession(input) {
-        const workspace = await this.workspaces.info(input.workspaceRoot);
-        const workspaceRoot = workspace.root;
+        const workspace = await this.workspaces.info(input.workspaceId);
+        const workspaceRoot = workspace.path;
         const provider = this.requireProvider(input.provider);
         const providerStatus = await provider.probe();
         if (!providerStatus.installed)
@@ -87,7 +93,8 @@ export class AgentRuntime {
         const now = new Date().toISOString();
         const session = {
             id: "agent_" + randomUUID(),
-            workspaceRoot,
+            workspaceId: workspace.id,
+            workspaceName: workspace.name,
             provider: input.provider,
             ...config,
             tokenUsage: null,
@@ -122,7 +129,8 @@ export class AgentRuntime {
         const text = input.text.trim();
         if (!text && input.attachments.length === 0)
             throw new ChatRoomError("INVALID_INPUT", "Agent message is empty");
-        const attachments = await validateAttachments(session, input.attachments);
+        const workspaceRoot = await this.workspaces.resolve(session.workspaceId);
+        const attachments = await validateAttachments(session, workspaceRoot, input.attachments);
         await this.validateInputModalities(session, text, attachments);
         const providerSession = await this.providerSession(session);
         const active = this.beginTurn(session, providerSession, source, session.serviceTier, { text, attachments });
@@ -160,7 +168,8 @@ export class AgentRuntime {
             const text = input.text.trim();
             if (!text && input.attachments.length === 0)
                 throw new ChatRoomError("INVALID_INPUT", "Agent message is empty");
-            const attachments = await validateAttachments(session, input.attachments);
+            const workspaceRoot = await this.workspaces.resolve(session.workspaceId);
+            const attachments = await validateAttachments(session, workspaceRoot, input.attachments);
             await this.validateInputModalities(session, text, attachments);
             if (this.activeTurns.get(sessionId) !== active)
                 throw new ChatRoomError("CONFLICT", "Agent turn ended before steering");
@@ -412,6 +421,34 @@ export class AgentRuntime {
     async deleteSession(sessionId) {
         return this.withSessionMutation(sessionId, () => this.deleteSessionUnlocked(sessionId));
     }
+    async deleteSessions(sessionIds) {
+        const ids = [...new Set(sessionIds)];
+        if (ids.length === 0)
+            throw new ChatRoomError("INVALID_INPUT", "Select at least one Agent session");
+        if (ids.length > 100)
+            throw new ChatRoomError("INVALID_INPUT", "Cannot delete more than 100 Agent sessions at once");
+        // Validate every target before changing anything, so active/unknown sessions
+        // cannot cause an avoidable partial batch deletion.
+        for (const id of ids) {
+            this.requireSession(id);
+            if (this.sessionMutations.has(id))
+                throw new ChatRoomError("CONFLICT", "An Agent session is already being modified");
+            if (this.activeTurns.has(id))
+                throw new ChatRoomError("CONFLICT", "Cannot delete a running Agent session");
+        }
+        // Acquire all locks synchronously before the first await, preventing a turn
+        // or another mutation from starting for any member of this batch.
+        for (const id of ids)
+            this.sessionMutations.add(id);
+        try {
+            for (const id of ids)
+                await this.deleteSessionUnlocked(id);
+        }
+        finally {
+            for (const id of ids)
+                this.sessionMutations.delete(id);
+        }
+    }
     async deleteSessionUnlocked(sessionId) {
         if (this.activeTurns.has(sessionId))
             throw new ChatRoomError("CONFLICT", "Cannot delete a running Agent session");
@@ -421,7 +458,9 @@ export class AgentRuntime {
             await providerSession.close().catch(() => undefined);
             this.providerSessions.delete(sessionId);
         }
-        await cleanupSessionFiles(this.store, history);
+        await cleanupSessionFiles(this.store, history, await this.workspaces
+            .resolve(history.session.workspaceId)
+            .catch(() => null));
         this.store.deleteSession(sessionId);
         this.invalidateSession(sessionId, { deleted: true });
     }
@@ -434,8 +473,8 @@ export class AgentRuntime {
             throw new ChatRoomError("CONFLICT", "Wait for the current turn to finish before switching agents");
         if (session.provider === targetProvider)
             return this.configureSessionUnlocked(sessionId, patch);
-        const workspace = await this.workspaces.info(session.workspaceRoot);
-        const workspaceRoot = workspace.root;
+        const workspace = await this.workspaces.info(session.workspaceId);
+        const workspaceRoot = workspace.path;
         const provider = this.requireProvider(targetProvider);
         const providerStatus = await provider.probe();
         if (!providerStatus.installed)
@@ -569,7 +608,7 @@ export class AgentRuntime {
         }
         if (event.type === "item.updated") {
             const existing = active.items.get(event.providerItemId);
-            const payload = await prepareProviderItem(session, event.item);
+            const payload = await prepareProviderItem(await this.workspaces.resolve(session.workspaceId), event.item);
             const updated = materializeProviderItem(active.turn.id, event.providerItemId, existing?.sequence ?? active.nextSequence++, existing?.status ?? "running", payload, existing);
             active.items.set(event.providerItemId, updated);
             const bounded = this.boundCommandOutput(active, event.providerItemId, updated);
@@ -624,7 +663,7 @@ export class AgentRuntime {
         }
         if (event.type === "item.completed") {
             const existing = active.items.get(event.providerItemId);
-            const providerItem = await prepareProviderItem(session, event.item);
+            const providerItem = await prepareProviderItem(await this.workspaces.resolve(session.workspaceId), event.item);
             const completed = materializeProviderItem(active.turn.id, event.providerItemId, existing?.sequence ?? active.nextSequence++, event.failed ? "failed" : "completed", providerItem, existing);
             active.items.set(event.providerItemId, completed);
             const bounded = this.boundCommandOutput(active, event.providerItemId, completed);
@@ -713,8 +752,8 @@ export class AgentRuntime {
         });
     }
     async providerSession(session) {
-        const workspace = await this.workspaces.info(session.workspaceRoot);
-        const workspaceRoot = workspace.root;
+        const workspace = await this.workspaces.info(session.workspaceId);
+        const workspaceRoot = workspace.path;
         const existing = this.providerSessions.get(session.id);
         if (existing)
             return existing;
@@ -767,7 +806,7 @@ export class AgentRuntime {
         return session;
     }
     async cleanupOrphanAttachments(maxAgeMs = 7 * 24 * 60 * 60 * 1000) {
-        await cleanupOrphanAttachmentFiles(this.store, maxAgeMs);
+        await cleanupOrphanAttachmentFiles(this.store, (workspaceId) => this.workspaces.resolve(workspaceId), maxAgeMs);
     }
     async withSessionMutation(sessionId, action) {
         if (this.sessionMutations.has(sessionId))

package/dist/plugins/agent/types.d.ts

@@ -155,7 +155,8 @@ export interface AgentSessionAttention {
 }
 export interface AgentSession extends AgentSessionConfig {
     id: string;
-    workspaceRoot: string;
+    workspaceId: string;
+    workspaceName: string;
     provider: AgentProviderId;
     status: AgentSessionStatus;
     attention: AgentSessionAttention | null;
@@ -314,7 +315,7 @@ export interface AgentTurnInput {
     attachments: AgentAttachment[];
 }
 export interface CreateAgentSessionInput extends Partial<AgentSessionConfig> {
-    workspaceRoot: string;
+    workspaceId: string;
     provider: AgentProviderId;
     model: string | null;
 }

package/dist/plugins/cloud/v2/tunnel-client.js

@@ -199,18 +199,13 @@ export class V2TunnelClient {
                 const sender = new CreditSender(frame.id, (buffer) => this.send(buffer), () => response.pause(), () => response.resume(), () => {
                     state.responseEnded = true;
                     this.finishIfIdle(frame.id);
-                });
+                }, () => (this.socket?.bufferedAmount ?? 0) < 1024 * 1024);
                 state.sender = sender;
                 this.send(metaFrame(2 /* Op.META */, frame.id, {
                     status: response.statusCode ?? 502,
                     headers: responseHeaders(response.headers),
                 }));
                 response.on("data", (chunk) => {
-                    state.responseBytes += chunk.length;
-                    if (state.responseBytes > 128 * 1024 * 1024) {
-                        this.abort(frame.id);
-                        return;
-                    }
                     try {
                         sender.enqueue(chunk);
                     }
@@ -232,7 +227,6 @@ export class V2TunnelClient {
                 pendingCredit: 0,
                 drainArmed: false,
                 requestBytes: 0,
-                responseBytes: 0,
                 requestEnded: false,
                 responseEnded: false,
             };

package/dist/plugins/plugin-manager.d.ts

@@ -6,6 +6,11 @@ export declare class PluginManager {
     private readonly active;
     constructor(context: PluginContext, plugins: InternalPlugin[]);
     start(): Promise<void>;
-    registerMcp(server: McpServer): void;
+    defineMcp(toolControl: import("#mcp/server/tool-control").McpToolControl, options?: {
+        agentMode?: boolean;
+    }): void;
+    registerMcp(server: McpServer, toolControl?: import("#mcp/server/tool-control").McpToolControl, options?: {
+        agentMode?: boolean;
+    }): void;
     stop(): Promise<void>;
 }

package/dist/plugins/plugin-manager.js

@@ -36,11 +36,18 @@ export class PluginManager {
             throw error;
         }
     }
-    registerMcp(server) {
+    defineMcp(toolControl, options = {}) {
         for (const plugin of this.active) {
             if (!plugin.registerMcp)
                 continue;
-            plugin.registerMcp(new PluginMcpRegistrar(server, this.context.operations, plugin.id, this.context.mcpTools));
+            plugin.registerMcp(new PluginMcpRegistrar(null, this.context.operations, plugin.id, toolControl, options));
+        }
+    }
+    registerMcp(server, toolControl = this.context.mcpTools, options = {}) {
+        for (const plugin of this.active) {
+            if (!plugin.registerMcp)
+                continue;
+            plugin.registerMcp(new PluginMcpRegistrar(server, this.context.operations, plugin.id, toolControl, options));
         }
     }
     async stop() {

package/dist/plugins/types.d.ts

@@ -7,6 +7,7 @@ import type { CustomMcpManager } from "#mcp/custom/manager";
 import type { RuntimeEventBus } from "#app/event-bus";
 import type { ExternalAccessRegistry } from "#app/external-access-registry";
 import type { LogWriter } from "#core/logging/types";
+import type { AgentMcpConnection } from "#plugins/agent/mcp-gateway";
 import type { ServiceRegistry } from "#app/service-registry";
 export interface PluginContext {
     config: ChatRoomConfig;
@@ -14,6 +15,9 @@ export interface PluginContext {
     operations: OperationLog;
     mcpTools: McpToolControl;
     customMcp: CustomMcpManager;
+    agentMcp: AgentMcpConnection;
+    agentMcpTools: import("#mcp/server/tool-control").McpToolControl;
+    agentCustomMcp: CustomMcpManager;
     events: RuntimeEventBus;
     externalAccess: ExternalAccessRegistry;
     services: ServiceRegistry;

package/dist/plugins/web/http/agent-api-router.js

@@ -19,7 +19,7 @@ export function createAgentApiRouter(agents) {
     router.post("/agents/sessions", asyncRoute(async (req, res) => {
         const body = bodyRecord(req.body);
         res.json(await agents.createSession({
-            workspaceRoot: requireString(body.workspaceRoot, "workspaceRoot"),
+            workspaceId: requireString(body.workspaceId, "workspaceId"),
             provider: requireProvider(requireString(body.provider, "provider")),
             model: null,
             reasoningEffort: null,
@@ -76,6 +76,20 @@ export function createAgentApiRouter(agents) {
         const body = bodyRecord(req.body);
         res.json(await agents.switchProvider(requireString(req.params.sessionId, "sessionId"), requireProvider(requireString(body.provider, "provider")), parseConfig(body)));
     }));
+    const bulkDeleteSessions = asyncRoute(async (req, res) => {
+        const body = bodyRecord(req.body);
+        if (!Array.isArray(body.sessionIds) || body.sessionIds.length === 0)
+            throw new ChatRoomError("INVALID_INPUT", "sessionIds must be a non-empty array");
+        if (body.sessionIds.length > 100)
+            throw new ChatRoomError("INVALID_INPUT", "Cannot delete more than 100 Agent sessions at once");
+        const sessionIds = body.sessionIds.map((id) => requireString(id, "sessionIds[]"));
+        await agents.deleteSessions(sessionIds);
+        res.status(204).end();
+    });
+    // POST is the primary batch action for maximum compatibility with clients
+    // and intermediaries that mishandle bodies on DELETE requests.
+    router.post("/agents/sessions/bulk-delete", bulkDeleteSessions);
+    router.delete("/agents/sessions", bulkDeleteSessions);
     router.delete("/agents/sessions/:sessionId", asyncRoute(async (req, res) => {
         await agents.deleteSession(requireString(req.params.sessionId, "sessionId"));
         res.status(204).end();

package/dist/plugins/web/http/git-api-router.js

@@ -3,77 +3,77 @@ import { asyncRoute, bodyRecord, requireString, requireStringArray, } from "#pre
 export function createGitApiRouter(application) {
     const router = Router();
     router.get("/git/status", asyncRoute(async (req, res) => {
-        const root = await resolveRoot(application, req.query.root);
+        const root = await resolveRoot(application, req.query.workspaceId);
         res.json(await application.git.status(root));
     }));
     router.get("/git/diff", asyncRoute(async (req, res) => {
-        const root = await resolveRoot(application, req.query.root);
+        const root = await resolveRoot(application, req.query.workspaceId);
         const filePath = typeof req.query.path === "string" ? req.query.path : undefined;
         res.json(await application.git.diff(root, filePath));
     }));
     router.get("/git/branches", asyncRoute(async (req, res) => {
-        const root = await resolveRoot(application, req.query.root);
+        const root = await resolveRoot(application, req.query.workspaceId);
         res.json(await application.git.branches(root));
     }));
     router.get("/git/log", asyncRoute(async (req, res) => {
-        const root = await resolveRoot(application, req.query.root);
+        const root = await resolveRoot(application, req.query.workspaceId);
         const requested = Number(req.query.limit ?? 30);
         const limit = Number.isFinite(requested) ? requested : 30;
         res.json(await application.git.log(root, limit));
     }));
     router.post("/git/stage", asyncRoute(async (req, res) => {
         const body = bodyRecord(req.body);
-        const root = await resolveRoot(application, body.root);
+        const root = await resolveRoot(application, body.workspaceId);
         const paths = requireStringArray(body.paths, "paths");
         res.json(await mutate(application, "git.stage", root, { paths }, () => application.git.stage(root, paths)));
     }));
     router.post("/git/unstage", asyncRoute(async (req, res) => {
         const body = bodyRecord(req.body);
-        const root = await resolveRoot(application, body.root);
+        const root = await resolveRoot(application, body.workspaceId);
         const paths = requireStringArray(body.paths, "paths");
         res.json(await mutate(application, "git.unstage", root, { paths }, () => application.git.unstage(root, paths)));
     }));
     router.post("/git/restore", asyncRoute(async (req, res) => {
         const body = bodyRecord(req.body);
-        const root = await resolveRoot(application, body.root);
+        const root = await resolveRoot(application, body.workspaceId);
         const filePath = requireString(body.path, "path");
         res.json(await mutate(application, "git.restore", root, { path: filePath }, () => application.git.restore(root, filePath)));
     }));
     router.post("/git/commit", asyncRoute(async (req, res) => {
         const body = bodyRecord(req.body);
-        const root = await resolveRoot(application, body.root);
+        const root = await resolveRoot(application, body.workspaceId);
         const message = requireString(body.message, "message");
         res.json(await mutate(application, "git.commit", root, { message }, () => application.git.commit(root, message)));
     }));
     router.post("/git/branches", asyncRoute(async (req, res) => {
         const body = bodyRecord(req.body);
-        const root = await resolveRoot(application, body.root);
+        const root = await resolveRoot(application, body.workspaceId);
         const name = requireString(body.name, "name");
         res.json(await mutate(application, "git.branch.create", root, { name }, () => application.git.createBranch(root, name)));
     }));
     router.post("/git/switch", asyncRoute(async (req, res) => {
         const body = bodyRecord(req.body);
-        const root = await resolveRoot(application, body.root);
+        const root = await resolveRoot(application, body.workspaceId);
         const name = requireString(body.name, "name");
         res.json(await mutate(application, "git.branch.switch", root, { name }, () => application.git.switchBranch(root, name)));
     }));
     router.delete("/git/branches", asyncRoute(async (req, res) => {
         const body = bodyRecord(req.body);
-        const root = await resolveRoot(application, body.root);
+        const root = await resolveRoot(application, body.workspaceId);
         const name = requireString(body.name, "name");
         res.json(await mutate(application, "git.branch.delete", root, { name }, () => application.git.deleteBranch(root, name)));
     }));
     for (const action of ["fetch", "pull", "push"]) {
         router.post(`/git/${action}`, asyncRoute(async (req, res) => {
             const body = bodyRecord(req.body);
-            const root = await resolveRoot(application, body.root);
+            const root = await resolveRoot(application, body.workspaceId);
             res.json(await mutate(application, `git.${action}`, root, {}, () => application.git[action](root)));
         }));
     }
     return router;
 }
 async function resolveRoot(application, value) {
-    return application.workspaces.resolve(requireString(value, "root"));
+    return application.workspaces.resolve(requireString(value, "workspaceId"));
 }
 function mutate(application, action, root, input, operation) {
     return application.operations.run({

package/dist/plugins/web/http/rtc-api-router.js

@@ -28,6 +28,7 @@ const HEADER_NAMES = new Set([
     "if-none-match",
     "if-modified-since",
     "x-chatroom-mime-type",
+    "x-chatroom-upload-size",
 ]);
 const RESPONSE_HEADERS = new Set([
     "content-type",
@@ -36,6 +37,8 @@ const RESPONSE_HEADERS = new Set([
     "content-range",
     "accept-ranges",
     "cache-control",
+    "content-security-policy",
+    "x-content-type-options",
     "etag",
     "last-modified",
 ]);

package/dist/plugins/web/http/runtime-api-router.js

@@ -13,6 +13,28 @@ export function createRuntimeApiRouter(application, eventBus, runtimeStatus) {
             throw new ChatRoomError("INVALID_INPUT", "enabled must be a boolean");
         res.json(application.mcpTools.setEnabled(requireString(req.params.toolName, "toolName"), body.enabled));
     });
+    router.get("/agent-mcp/tools", (_req, res) => {
+        res.json(application.agentMcpTools.list());
+    });
+    router.patch("/agent-mcp/tools/:toolName", async (req, res) => {
+        const body = bodyRecord(req.body);
+        if (typeof body.enabled !== "boolean")
+            throw new ChatRoomError("INVALID_INPUT", "enabled must be a boolean");
+        const updated = application.agentMcpTools.setEnabled(requireString(req.params.toolName, "toolName"), body.enabled);
+        await application.agents.refreshMcpServers();
+        res.json(updated);
+    });
+    router.get("/agent-mcp/servers", (_req, res) => {
+        res.json(application.agentCustomMcp.list());
+    });
+    router.patch("/agent-mcp/servers/:id", async (req, res) => {
+        const body = bodyRecord(req.body);
+        if (typeof body.enabled !== "boolean")
+            throw new ChatRoomError("INVALID_INPUT", "enabled must be a boolean");
+        const updated = await application.agentCustomMcp.update(requireString(req.params.id, "id"), { enabled: body.enabled });
+        await application.agents.refreshMcpServers();
+        res.json(updated);
+    });
     router.get("/events", (_req, res) => {
         res.status(200);
         res.setHeader("Content-Type", "text/event-stream");