@moxxy/cli 0.8.2 → 0.10.0

package/dist/bin.js

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { z as z$1, defineProvider, definePlugin, defineTool, MoxxyError, writeFileAtomic, asTurnId, defineMode, asPluginId, defineChannel, defineTunnelProvider, spawnCliTunnel, isCliTunnelAvailable, createMutex, defineWorkflowExecutor, toFriendlyError, estimateTextTokens, classifyHttpStatus, createStuckLoopDetector, runCompactionIfNeeded, runElisionIfNeeded, collectProviderStream, usageEventFields, isContextOverflowError, emitRequestsAndDetectStuck, executeToolUses, buildSystemPromptWithSkills, projectMessages, defineCompactor, defineCacheStrategy, denyByDefaultResolver, createAllowListResolver, moxxyPath, zodToJsonSchema, runSingleShotTurn, bearerTokenMatches, resolveChannelToken, rotateChannelToken, estimateContextTokens as estimateContextTokens$1, readRequestBody, MOXXY_WS_SUBPROTOCOL, defineEmbedder, bearerGuard, tokenFromWsProtocolHeader, skillFrontmatterSchema, asSkillId, getInstallHint, moxxyHome, defineTranscriber, summarizeTokensByModel, migrateModeName, createDeferredPermissionResolver, classifyNetworkError, addModelTotals, ISOLATION_RANK, moxxyPackageSchema, defineCommand, createCallbackResolver, autoAllowResolver, asSessionId, asToolCallId, defineViewRenderer, DEFAULT_VIEW_TAGS, isSafeViewUrl, evaluateToolRule, summarizeSessionTokensFromEvents, computeElisionState, toolResultStubbed, toolResultStub, toolResultBytes, conversationalStubbed, conversationalStub, asEventId } from '@moxxy/sdk';
+import { z as z$1, defineProvider, definePlugin, defineTool, MoxxyError, writeFileAtomic, asTurnId, defineMode, asPluginId, defineChannel, defineTunnelProvider, spawnCliTunnel, isCliTunnelAvailable, createMutex, defineWorkflowExecutor, toFriendlyError, estimateTextTokens, classifyHttpStatus, createStuckLoopDetector, runCompactionIfNeeded, runElisionIfNeeded, collectProviderStream, usageEventFields, isContextOverflowError, emitRequestsAndDetectStuck, executeToolUses, buildSystemPromptWithSkills, projectMessages, defineCompactor, defineCacheStrategy, denyByDefaultResolver, createAllowListResolver, moxxyPath, zodToJsonSchema, runSingleShotTurn, bearerTokenMatches, resolveChannelToken, rotateChannelToken, estimateContextTokens as estimateContextTokens$1, readRequestBody, MOXXY_WS_SUBPROTOCOL, defineEmbedder, migrateModeName, bearerGuard, tokenFromWsProtocolHeader, skillFrontmatterSchema, asSkillId, getInstallHint, moxxyHome, defineTranscriber, summarizeTokensByModel, createDeferredPermissionResolver, classifyNetworkError, addModelTotals, ISOLATION_RANK, moxxyPackageSchema, defineCommand, createCallbackResolver, autoAllowResolver, asSessionId, asToolCallId, defineViewRenderer, DEFAULT_VIEW_TAGS, isSafeViewUrl, evaluateToolRule, summarizeSessionTokensFromEvents, computeElisionState, toolResultStubbed, toolResultStub, toolResultBytes, conversationalStubbed, conversationalStub, asEventId } from '@moxxy/sdk';
 import * as fs27 from 'fs';
 import fs27__default, { existsSync, promises, ReadStream, readFileSync, statSync, readdirSync, mkdirSync, writeFileSync, unlinkSync, renameSync, watch, createReadStream } from 'fs';
 import * as path3 from 'path';
@@ -1376,6 +1376,13 @@ var init_providers = __esm({
       defs = /* @__PURE__ */ new Map();
       instances = /* @__PURE__ */ new Map();
       active = null;
+      /**
+       * Names the user disabled. Kept name-based (not def-based) so it can be
+       * seeded from preferences BEFORE the plugins register their defs — boot
+       * order doesn't matter. A disabled provider stays registered/listable but
+       * can't be activated.
+       */
+      disabled = /* @__PURE__ */ new Set();
       /**
        * Register a provider def. Throws on duplicate — use `replace()` for
        * explicit overwrite. Matches the semantics of `tools` and `channels`.
@@ -1404,10 +1411,32 @@ var init_providers = __esm({
       list() {
         return [...this.defs.values()];
       }
+      /**
+       * Enable/disable a provider by name. Disabling the ACTIVE provider is
+       * refused — switch first, then disable — so a session never ends up with an
+       * active-but-disabled provider. Unknown names are accepted (the set seeds
+       * from preferences before plugins register), except when disabling via a
+       * live toggle is meaningless because the provider is active.
+       */
+      setEnabled(name, enabled) {
+        if (!enabled && this.active === name) {
+          throw new Error(`Cannot disable the active provider "${name}" \u2014 switch providers first.`);
+        }
+        if (enabled)
+          this.disabled.delete(name);
+        else
+          this.disabled.add(name);
+      }
+      isEnabled(name) {
+        return !this.disabled.has(name);
+      }
       setActive(name, config) {
         const def = this.defs.get(name);
         if (!def)
           throw new Error(`Provider not registered: ${name}`);
+        if (this.disabled.has(name)) {
+          throw new Error(`Provider "${name}" is disabled \u2014 enable it first.`);
+        }
         let instance = this.instances.get(name);
         if (!instance) {
           instance = def.createClient(config ?? {});
@@ -3081,6 +3110,7 @@ var init_session = __esm({
       readyProviders;
       credentialResolver;
       mcpAdmin;
+      providerAdmin;
       workflows;
       pluginsAdmin;
       dispatcher;
@@ -3262,7 +3292,8 @@ var init_session = __esm({
             // are the ones the desktop's "Fetch live" affordance targets;
             // they advertise this via the provider-admin factory by
             // setting `supportsLiveModelDiscovery: true` on their def.
-            supportsLiveModelDiscovery: p3.supportsLiveModelDiscovery === true
+            supportsLiveModelDiscovery: p3.supportsLiveModelDiscovery === true,
+            enabled: this.providers.isEnabled(p3.name)
           })),
           activeMode,
           activeModeBadge,
@@ -127441,6 +127472,15 @@ function noteTemperatureUnsupported() {
     console.debug("[openai-codex] ProviderRequest.temperature is not supported by the Codex Responses backend (gpt-5 reasoning models reject sampling params); ignoring it.");
   }
 }
+var maxTokensNoteShown = false;
+function noteMaxTokensUnsupported() {
+  if (maxTokensNoteShown)
+    return;
+  maxTokensNoteShown = true;
+  if (process.env.MOXXY_DEBUG) {
+    console.debug("[openai-codex] ProviderRequest.maxTokens is not supported by the Codex Responses backend (400 Unsupported parameter: max_output_tokens); ignoring it.");
+  }
+}
 function toResponsesBody(req, opts = {}) {
   const instructions = extractSystemText(req.messages, req.system) || DEFAULT_INSTRUCTIONS;
   const body = {
@@ -127458,7 +127498,7 @@ function toResponsesBody(req, opts = {}) {
   if (opts.sessionHint)
     body.prompt_cache_key = opts.sessionHint;
   if (req.maxTokens !== void 0)
-    body.max_output_tokens = req.maxTokens;
+    noteMaxTokensUnsupported();
   if (req.temperature !== void 0)
     noteTemperatureUnsupported();
   return body;
@@ -134374,13 +134414,14 @@ async function createWebSocketTransportServer(opts) {
   const host = opts.host ?? "127.0.0.1";
   const maxConnections = opts.maxConnections ?? DEFAULT_MAX_CONNECTIONS;
   let currentToken = opts.authToken;
+  let currentAllowedOrigins = opts.allowedOrigins ?? [];
   let connections = 0;
   const wss = new import_websocket_server.default({
     host,
     port: opts.port,
     maxPayload: opts.maxPayloadBytes ?? 64 * 1024 * 1024,
     verifyClient: (info) => {
-      if (!checkWsOrigin(info.req, opts.allowedOrigins)) {
+      if (!checkWsOrigin(info.req, currentAllowedOrigins)) {
         console.warn(`[moxxy] ws bridge: rejected browser-origin upgrade (Origin: ${String(info.req.headers.origin)})`);
         return false;
       }
@@ -134420,6 +134461,9 @@ async function createWebSocketTransportServer(opts) {
       for (const client of wss.clients)
         client.terminate();
     },
+    setAllowedOrigins(origins) {
+      currentAllowedOrigins = [...origins];
+    },
     clientCount() {
       return connections;
     },
@@ -134753,7 +134797,7 @@ function isRunnerUp(socketPath = runnerSocketPath()) {
 
 // ../runner/dist/server.js
 init_dist();
-var RUNNER_PROTOCOL_VERSION = 6;
+var RUNNER_PROTOCOL_VERSION = 7;
 var MIN_COMPATIBLE_PROTOCOL_VERSION = 1;
 var RunnerMethod = {
   /** client->server: handshake; returns the initial info snapshot. */
@@ -134778,6 +134822,12 @@ var RunnerMethod = {
   ModeSetActive: "mode.setActive",
   /** client->server: switch the active provider (server resolves credentials). */
   ProviderSetActive: "provider.setActive",
+  /** client->server: enable/disable a provider (v7; persists to preferences). */
+  ProviderSetEnabled: "provider.setEnabled",
+  /** client->server: re-probe every provider's credentials → readyProviders (v7). */
+  ProviderRefreshReady: "provider.refreshReady",
+  /** client->server: patch a stored (runtime-registered) provider's config (v7). */
+  ProviderConfigure: "provider.configure",
   /** client->server: persist an allow-always permission rule. */
   PermissionAddAllow: "permission.addAllow",
   /** client->server: run a registered slash command on the runner. */
@@ -134873,6 +134923,19 @@ var providerSetActiveParamsSchema = z.object({
   name: z.string(),
   config: z.record(z.unknown()).optional()
 });
+var providerSetEnabledParamsSchema = z.object({
+  name: z.string().min(1),
+  enabled: z.boolean()
+});
+var providerConfigureParamsSchema = z.object({
+  name: z.string().min(1),
+  patch: z.object({
+    baseURL: z.string().url().optional(),
+    defaultModel: z.string().min(1).optional(),
+    envVar: z.string().regex(/^[A-Z][A-Z0-9_]*$/).optional(),
+    models: z.array(z.object({ id: z.string().min(1), contextWindow: z.number() }).passthrough()).min(1).optional()
+  })
+});
 var permissionAddAllowParamsSchema = z.object({
   name: z.string(),
   reason: z.string().optional()
@@ -134979,6 +135042,9 @@ var RunnerServer = class {
     peer.handle(RunnerMethod.SetResolver, (raw) => this.handleSetResolver(client, raw));
     peer.handle(RunnerMethod.ModeSetActive, (raw) => this.handleModeSetActive(raw));
     peer.handle(RunnerMethod.ProviderSetActive, (raw) => this.handleProviderSetActive(raw));
+    peer.handle(RunnerMethod.ProviderSetEnabled, (raw) => this.handleProviderSetEnabled(raw));
+    peer.handle(RunnerMethod.ProviderRefreshReady, () => this.handleProviderRefreshReady());
+    peer.handle(RunnerMethod.ProviderConfigure, (raw) => this.handleProviderConfigure(raw));
     peer.handle(RunnerMethod.PermissionAddAllow, (raw) => this.handlePermissionAddAllow(raw));
     peer.handle(RunnerMethod.CommandRun, (raw) => this.handleCommandRun(raw));
     peer.handle(RunnerMethod.Transcribe, (raw) => this.handleTranscribe(raw));
@@ -135054,6 +135120,7 @@ var RunnerServer = class {
           turnId,
           ...error2 ? { error: error2 } : {}
         });
+        this.broadcastInfo();
       }
     });
     return { turnId };
@@ -135118,6 +135185,54 @@ var RunnerServer = class {
     this.broadcastInfo();
     return {};
   }
+  async handleProviderSetEnabled(raw) {
+    const { name, enabled } = providerSetEnabledParamsSchema.parse(raw);
+    if (!this.session.providers.list().some((p3) => p3.name === name)) {
+      throw new Error(`Provider not registered: ${name}`);
+    }
+    this.session.providers.setEnabled(name, enabled);
+    void (async () => {
+      const prefs = await loadPreferences();
+      const current = new Set(prefs.disabledProviders ?? []);
+      if (enabled)
+        current.delete(name);
+      else
+        current.add(name);
+      await savePreferences({ disabledProviders: [...current] });
+    })();
+    this.broadcastInfo();
+    return {};
+  }
+  async handleProviderRefreshReady() {
+    const resolver2 = this.session.credentialResolver;
+    if (resolver2) {
+      const ready = /* @__PURE__ */ new Set();
+      const active = this.session.providers.getActiveName();
+      if (active)
+        ready.add(active);
+      for (const p3 of this.session.providers.list()) {
+        if (ready.has(p3.name))
+          continue;
+        try {
+          await resolver2(p3.name);
+          ready.add(p3.name);
+        } catch {
+        }
+      }
+      this.session.readyProviders = ready;
+    }
+    this.broadcastInfo();
+    return {};
+  }
+  async handleProviderConfigure(raw) {
+    const { name, patch } = providerConfigureParamsSchema.parse(raw);
+    const admin = this.session.providerAdmin;
+    if (!admin)
+      throw new Error("provider admin not supported on this runner");
+    await admin.configure(name, patch);
+    this.broadcastInfo();
+    return {};
+  }
   async handlePermissionAddAllow(raw) {
     const { name, reason } = permissionAddAllowParamsSchema.parse(raw);
     await this.session.permissions.addAllow({ name, ...reason ? { reason } : {} });
@@ -135393,6 +135508,7 @@ var RemoteSession = class {
   requirements;
   permissions;
   mcpAdmin;
+  providerAdmin;
   workflows;
   /**
    * Turns that completed before their `runTurn` stream was registered. A fast
@@ -135406,6 +135522,8 @@ var RemoteSession = class {
   permissionResolver = null;
   approvalResolver = null;
   info = null;
+  /** Subscribers to `info.changed` pushes (see {@link onInfoChanged}). */
+  infoListeners = /* @__PURE__ */ new Set();
   /**
    * The protocol version the SERVER reported at attach. Defaults to our own
    * version until the handshake resolves. Version-specific client methods (the
@@ -135431,6 +135549,12 @@ var RemoteSession = class {
     });
     this.peer.on(RunnerNotification.InfoChanged, (params) => {
       this.info = params.info;
+      for (const fn of this.infoListeners) {
+        try {
+          fn(this.info);
+        } catch {
+        }
+      }
     });
     this.peer.on(RunnerNotification.ReplayStart, (params) => {
       const { fromSeq } = params;
@@ -135468,6 +135592,7 @@ var RemoteSession = class {
     this.requirements = { check: () => ({ ready: false, issues: [] }) };
     this.permissions = this.makePermissionsView();
     this.mcpAdmin = this.makeMcpAdminView();
+    this.providerAdmin = this.makeProviderAdminView();
     this.workflows = this.makeWorkflowsView();
   }
   /**
@@ -135533,6 +135658,16 @@ var RemoteSession = class {
   getInfo() {
     return this.requireInfo();
   }
+  /**
+   * Subscribe to runner `info.changed` pushes (registry snapshot changes —
+   * provider/mode/MCP/workflow mutations, including ones made by tools inside
+   * a turn). Fires after the local `getInfo()` mirror has been updated, so a
+   * listener can re-read it synchronously. Returns an unsubscribe fn.
+   */
+  onInfoChanged(fn) {
+    this.infoListeners.add(fn);
+    return () => this.infoListeners.delete(fn);
+  }
   async *runTurn(prompt, opts = {}) {
     const result = await this.peer.request(RunnerMethod.RunTurn, {
       prompt,
@@ -135736,6 +135871,27 @@ var RemoteSession = class {
       detach: (name) => this.peer.request(RunnerMethod.McpDetach, { name })
     };
   }
+  // Provider management (protocol v7): backs the desktop's interactive
+  // Settings → Providers tab. Gated on the SERVER's reported version so a v7
+  // client attached to an older runner (a desktop whose JS hot-update outran
+  // its bundled CLI) gets a clear "update the CLI" error instead of a raw
+  // method-not-found.
+  makeProviderAdminView() {
+    return {
+      setEnabled: async (name, enabled) => {
+        this.requireServerProtocol(7, "Enabling/disabling a provider");
+        await this.peer.request(RunnerMethod.ProviderSetEnabled, { name, enabled });
+      },
+      refreshReady: async () => {
+        this.requireServerProtocol(7, "Re-probing provider credentials");
+        await this.peer.request(RunnerMethod.ProviderRefreshReady, {});
+      },
+      configure: async (name, patch) => {
+        this.requireServerProtocol(7, "Configuring a provider");
+        await this.peer.request(RunnerMethod.ProviderConfigure, { name, patch });
+      }
+    };
+  }
   makeWorkflowsView() {
     return {
       list: () => this.peer.request(RunnerMethod.WorkflowList),
@@ -135994,6 +136150,17 @@ var REMOTE_ALLOWED_COMMANDS = /* @__PURE__ */ new Set([
   "session.setMode",
   "session.newSession",
   "session.runCommand",
+  // Multi-session conversations: list/create/switch/rename are conversation-
+  // scoped — the same trust class as `session.newSession` (already allowed),
+  // and what a paired phone needs to mirror the desktop's session list.
+  // `sessions.remove` is deliberately NOT here: it deletes on-disk state
+  // (the runner's session JSONL + the chat NDJSON transcript), a destructive
+  // host mutation in the same class as `desks.remove`, which is also
+  // host-only.
+  "sessions.list",
+  "sessions.create",
+  "sessions.setActive",
+  "sessions.rename",
   // Voice input (capability-probed; transcribe fails coded without a transcriber).
   "session.hasTranscriber",
   "session.transcribe",
@@ -136129,6 +136296,20 @@ var ipcInputSchemas = {
     id: z.string().min(1).max(256),
     name: z.string().min(1).max(200)
   }),
+  // Sessions: create/rename persist the name into the desks JSON (bound it
+  // like desks.create/rename); setActive spawns a runner and remove deletes
+  // the session's on-disk logs, so their ids are bounded too. These commands
+  // are also served to remote (WS) clients, so the bounds are load-bearing.
+  "sessions.create": z.object({
+    deskId: z.string().min(1).max(256).optional(),
+    name: z.string().min(1).max(200).optional()
+  }).optional(),
+  "sessions.setActive": z.object({ id: z.string().min(1).max(256) }),
+  "sessions.remove": z.object({ id: z.string().min(1).max(256) }),
+  "sessions.rename": z.object({
+    id: z.string().min(1).max(256),
+    name: z.string().min(1).max(200)
+  }),
   // Whitelist the fields a renderer may write — `version` is managed by
   // the main process; unknown keys are rejected (.strict()).
   "prefs.update": z.object({
@@ -136136,7 +136317,8 @@ var ipcInputSchemas = {
     clerkUserId: z.string().max(256).nullable().optional(),
     clerkDisplayName: z.string().max(256).nullable().optional(),
     signedInAt: z.number().nullable().optional(),
-    mobileGatewayEnabled: z.boolean().optional()
+    mobileGatewayEnabled: z.boolean().optional(),
+    theme: z.enum(["light", "dark", "system"]).optional()
   }).strict(),
   // Mobile-gateway control. Both no-arg variants pin the payload to "nothing"
   // so a hostile caller can't smuggle args; setEnabled is a strict boolean.
@@ -136524,14 +136706,41 @@ function isWildcardHost(host) {
   const h3 = host.trim().toLowerCase();
   return h3 === "0.0.0.0" || h3 === "::" || h3 === "[::]";
 }
+var VIRTUAL_IFACE = /^(?:utun|tun|tap|ppp|ipsec|wg|zt|ts|tailscale|vmnet|vnic|bridge|docker|veth|awdl|llw|ap|anpi)\d*$/i;
+function isLinkLocalV4(ip) {
+  return ip.startsWith("169.254.");
+}
+function isRfc1918(ip) {
+  if (ip.startsWith("10.") || ip.startsWith("192.168."))
+    return true;
+  const m3 = /^172\.(\d{1,3})\./.exec(ip);
+  return m3 !== null && Number(m3[1]) >= 16 && Number(m3[1]) <= 31;
+}
+function isCgnat(ip) {
+  const m3 = /^100\.(\d{1,3})\./.exec(ip);
+  return m3 !== null && Number(m3[1]) >= 64 && Number(m3[1]) <= 127;
+}
 function lanHost(fallback) {
-  for (const list of Object.values(os5__default.networkInterfaces())) {
+  let best = null;
+  for (const [name, list] of Object.entries(os5__default.networkInterfaces())) {
     for (const ni of list ?? []) {
-      if (ni.family === "IPv4" && !ni.internal)
-        return ni.address;
+      if (ni.family !== "IPv4" || ni.internal)
+        continue;
+      const virtual = VIRTUAL_IFACE.test(name);
+      let rank;
+      if (isLinkLocalV4(ni.address))
+        rank = 5;
+      else if (isRfc1918(ni.address))
+        rank = virtual ? 3 : 1;
+      else if (isCgnat(ni.address))
+        rank = 4;
+      else
+        rank = virtual ? 4 : 2;
+      if (!best || rank < best.rank)
+        best = { address: ni.address, rank };
     }
   }
-  return fallback;
+  return best?.address ?? fallback;
 }
 function advertisedHost(bindHost) {
   if (isWildcardHost(bindHost))
@@ -136547,6 +136756,20 @@ function buildConnectUrl(opts) {
   }
   return `ws://${opts.localHost}:${opts.port}/?t=${t2}`;
 }
+function connectUrlOrigin(url2) {
+  const u2 = new URL(url2);
+  const secure = u2.protocol === "wss:" || u2.protocol === "https:";
+  return `${secure ? "https" : "http"}://${u2.host}`;
+}
+function advertisedOrigins(bindHost, port) {
+  return [
+    .../* @__PURE__ */ new Set([
+      connectUrlOrigin(`ws://${advertisedHost(bindHost)}:${port}`),
+      `http://127.0.0.1:${port}`,
+      `http://localhost:${port}`
+    ])
+  ];
+}
 
 // ../plugin-channel-mobile/dist/tunnel.js
 function normalizeTunnelChoice(raw) {
@@ -136631,10 +136854,12 @@ var MobileChannel = class {
     this.host = host;
     host.register();
     host.wire();
+    const localOrigins = advertisedOrigins(this.bindHost, this.port);
     const server = await startWsBridge(bus, {
       port: this.port,
       host: this.bindHost,
       authToken: this.token,
+      allowedOrigins: localOrigins,
       // Back-compat ONLY: the QR this channel prints embeds the token as `?t=`
       // (pairing payload); current apps strip it and authenticate via the
       // Sec-WebSocket-Protocol bearer entry, but older installed builds still
@@ -136649,6 +136874,7 @@ var MobileChannel = class {
       try {
         this.tunnel = await provider.open({ port: this.port, host: this.bindHost });
         tunnelUrl = this.tunnel.url;
+        server.setAllowedOrigins([...localOrigins, connectUrlOrigin(tunnelUrl)]);
         this.logger?.info?.("mobile tunnel open", { provider: provider.name, url: tunnelUrl });
       } catch (err) {
         this.logger?.warn?.("mobile tunnel failed; using the local URL", {
@@ -137963,6 +138189,51 @@ var testProviderInput = z$1.object({
   baseURL: z$1.string().url().describe("Vendor API base URL to probe, e.g. https://api.deepseek.com."),
   keyName: z$1.string().regex(/^[A-Z][A-Z0-9_]*$/).describe("NAME of the vault secret holding the API key (e.g. DEEPSEEK_API_KEY). The key is resolved from the vault inside the tool \u2014 never ask the user for the plaintext key and never pass one as a tool argument. Have them store it first: /vault set <NAME> <key>.")
 });
+function buildProviderAdminPluginWithApi(opts) {
+  const { providerRegistry, configPath } = opts;
+  const api = {
+    configure: async (name, patch) => {
+      const cfg = await readProvidersConfig(configPath);
+      const entry = cfg.providers.find((p3) => p3.name === name);
+      if (!entry) {
+        throw new MoxxyError({
+          code: "CONFIG_INVALID",
+          message: `provider-admin: no stored provider named "${name}" \u2014 only runtime-registered (providers.json) providers are configurable; built-ins are code.`
+        });
+      }
+      const next = {
+        ...entry,
+        ...patch.baseURL ? { baseURL: patch.baseURL } : {},
+        ...patch.defaultModel ? { defaultModel: patch.defaultModel } : {},
+        ...patch.envVar ? { envVar: patch.envVar } : {},
+        ...patch.models && patch.models.length > 0 ? { models: patch.models } : {}
+      };
+      if (!next.models.some((m3) => m3.id === next.defaultModel)) {
+        throw new MoxxyError({
+          code: "CONFIG_INVALID",
+          message: `provider-admin: defaultModel "${next.defaultModel}" is not in the models list (${next.models.map((m3) => m3.id).join(", ")}).`
+        });
+      }
+      const def = buildProviderDef(next);
+      const hadDef = providerRegistry.list().some((p3) => p3.name === name);
+      if (hadDef)
+        providerRegistry.replace(def);
+      else
+        providerRegistry.register(def);
+      try {
+        await upsertStoredProvider(next, configPath);
+      } catch (err) {
+        const prev = buildProviderDef(entry);
+        if (hadDef)
+          providerRegistry.replace(prev);
+        else
+          providerRegistry.unregister(name);
+        throw err;
+      }
+    }
+  };
+  return { plugin: buildProviderAdminPlugin(opts), api };
+}
 function buildProviderAdminPlugin(opts) {
   const { providerRegistry, configPath } = opts;
   return definePlugin({
@@ -143953,20 +144224,25 @@ function formatCatalog(entries, emptyLabel) {
 }
 async function draftWorkflow(provider, model, intent, signal, opts = {}) {
   let accumulated = "";
+  let truncated = false;
+  const ceiling = provider.models.find((m3) => m3.id === model)?.maxOutputTokens;
+  const budget = Math.min(opts.maxTokens ?? DEFAULT_MAX_TOKENS, ceiling ?? Number.POSITIVE_INFINITY);
   for await (const event of provider.stream({
     model,
     system: buildSystemPrompt(opts),
     messages: [{ role: "user", content: [{ type: "text", text: `Build a workflow for: ${intent}` }] }],
-    maxTokens: opts.maxTokens ?? DEFAULT_MAX_TOKENS,
+    maxTokens: budget,
     signal
   })) {
     if (event.type === "text_delta")
       accumulated += event.delta;
+    if (event.type === "message_end")
+      truncated = event.stopReason === "max_tokens";
     if (event.type === "error")
       throw new Error(`workflow_create: provider error: ${event.message}`);
   }
   const raw = extractYamlBlock(accumulated);
-  return { raw, parse: parseWorkflowYaml(raw) };
+  return { raw, parse: parseWorkflowYaml(raw), truncated };
 }
 function extractYamlBlock(s2) {
   const fence = /```(?:ya?ml)?\n([\s\S]*?)```/.exec(s2);
@@ -144045,7 +144321,7 @@ function createTool(deps) {
       if (!drafted.parse.ok || !drafted.parse.workflow) {
         throw new MoxxyError({
           code: "TOOL_ERROR",
-          message: `workflow_create: the model did not produce a valid workflow (${drafted.parse.errors.join("; ")}). Try a more specific intent.`
+          message: drafted.truncated ? "workflow_create: the draft hit the output-token limit before the YAML was complete. Try a simpler intent, or split the workflow into smaller ones." : `workflow_create: the model did not produce a valid workflow (${drafted.parse.errors.join("; ")}). Try a more specific intent.`
         });
       }
       const created = await deps.store.create(drafted.parse.workflow, scope);
@@ -145218,10 +145494,11 @@ function buildBuiltinsCore(args) {
     // ~/.moxxy/providers.json; the plugin's onInit re-registers them on
     // every boot. Pairs with the `add-provider` skill which walks the
     // model through gathering baseURL + models + key.
-    {
-      name: "@moxxy/plugin-provider-admin",
-      plugin: buildProviderAdminPlugin({ providerRegistry: session.providers })
-    },
+    (() => {
+      const { plugin: plugin4, api } = buildProviderAdminPluginWithApi({ providerRegistry: session.providers });
+      session.providerAdmin = api;
+      return { name: "@moxxy/plugin-provider-admin", plugin: plugin4 };
+    })(),
     // Admin tools (mcp_add_server, mcp_list_servers, mcp_remove_server,
     // mcp_test_server) plus the boot-time lazy attach. Passing the
     // session's live tool registry enables both hot-attach for runtime
@@ -145720,6 +145997,10 @@ async function activateProvider(args) {
   } else {
     for (let i2 = 0; i2 < candidates.length; i2++) {
       const candidate = candidates[i2];
+      if (!session.providers.isEnabled(candidate)) {
+        logger.warn("skipping disabled provider", { provider: candidate });
+        continue;
+      }
       const interactive = i2 === 0 && !skipKeyPrompt && process.stdin.isTTY === true;
       try {
         const resolved = await resolveProviderCredentials(candidate, vault, {
@@ -145928,6 +146209,13 @@ async function setupSessionWithConfig(opts) {
   });
   await selectEmbedder(session, rawConfig.embeddings, logger);
   for (const iso2 of session.isolators.list()) security.registry.register(iso2);
+  try {
+    const bootPrefs = await loadPreferences();
+    for (const name of bootPrefs.disabledProviders ?? []) {
+      session.providers.setEnabled(name, false);
+    }
+  } catch {
+  }
   const { credentialResolver } = await activateProvider({
     session,
     config,