Module xagent 

16F: per-agent dispatch surface — /xagent/{name}/api/v1/...

Closes the THQ dispatch gap: torpi’s proxy forwards /thq/api/agents/{id}/... to {endpoint}/api/v1/... with the CALLER’s Bearer injected, so until now THQ-dispatched sessions ran under the CALLER’s identity (the owner), not the agent’s. This module exposes the same handler surface under a per-agent path prefix and re-keys every request to the agent-user the THQ entry represents.

Mechanism (impersonation by Bearer swap — zero handler duplication):

1. {name} resolves through the boot-time dispatch table (ServerState.thq_dispatch, populated by 16E discovery) to the agent-user’s stable key (= its Kanidm sub, per the 16E pin).
2. The OUTER caller is gate-checked: human admin only (crate::auth::check_dispatch_admin). Agents can never dispatch agents; open mode follows the same open posture as check_auth.
3. The agent’s service token (captured from its per-user .env at boot) is exchanged for a short-lived role=agent access token (RFC 8693, expiry-buffered cache). Open mode passes through unauthenticated, matching check_auth’s open posture.
4. The inner request is rebuilt with Authorization: Bearer <agent> and the caller’s cookie STRIPPED, then the STANDARD handler runs: check_auth authenticates the AGENT, Cedar applies the per-action agent matrix (working set minus DeleteSession), user_key resolves to the agent’s sub, and session bucket / per-user home / MCP loader all resolve to the agent’s own namespace — her own fame, never the caller’s tools.

THQ-side wiring: set each agent-user’s [thq].advertise_url to https://<host>:<port>/xagent/<agent_name> — torpi appends /api/v1/... to the advertised origin, landing here.

Functions

router

The /xagent/{agent}/api/v1 route tree — merged into the main router.

x_create_session

x_destroy_session

x_get_live_session

x_get_session_detail

x_get_session_history

x_health

THQ polls {advertise_url}/api/v1/health for liveness — resolve the agent (unknown → 404 → THQ marks it offline) then answer with the shared health.

x_list_live_sessions

x_list_models

x_list_sessions

x_post_cancel_session

x_post_command_session

x_post_handoff_session

x_resume_session

x_ws_session_handler