@nextclaw/kernel 0.2.3 → 0.2.5

package/dist/index.js

@@ -1,15 +1,15 @@
 import { n as getUnsignedUpdateManifest, r as serializeUnsignedUpdateManifest, t as UpdateManifestReader } from "./update-manifest.types-C0qPrjGQ.js";
 import { createRequire } from "node:module";
 import { NcpEventType, sanitizeAssistantReplyTags } from "@nextclaw/ncp";
-import { AgentRouteResolver, BUILTIN_MAIN_AGENT_ID, CLEAR_THINKING_TOKENS, CONTEXT_COMPACTION_METADATA_KEY, ChannelManager, ChannelManager as ChannelManager$1, ConfigSchema, ContextBuilder, ContextCompactionService, ContextWindowBudgetService, CronService, CronTool, DEFAULT_PANELS_DIR, DEFAULT_SERVICE_APPS_DIR, DEFAULT_SESSION_SEARCH_LIMIT, EditFileTool, ExecTool, GatewayTool, InputBudgetPruner, LLMProvider, ListDirTool, LiteLLMProvider, MAX_SESSION_SEARCH_LIMIT, MemoryGetTool, MemorySearchTool, MessageBus, MessageTool, ProviderRegistry, ReadFileTool, RequestedSkillsMetadataReader, SessionSearchManager, SkillsLoader, THINKING_LEVELS, WebFetchTool, WebSearchTool, WriteFileTool, buildCompressingCompactionCheckpoint, buildConfigSchema, buildContextWindowSnapshot, buildMinimalSystemExecutionPrompt, buildReloadPlan, buildSessionRequestToolResult, buildToolCatalogEntries, createAssistantStreamDeltaControlMessage, createAssistantStreamResetControlMessage, createCompletedSessionRequest, createFailedSessionRequest, createRunningSessionRequest, createTypingStopControlMessage, diffConfigPaths, ensureDir, expandHome, findEffectiveAgentProfile, getConfigPath, getDataDir, getDataPath, getSessionsPath, getWorkspacePath, getWorkspacePathFromConfig, loadConfig, mergeExtensionConfigView, modelSupportsVision, normalizeInlineSecretRefs, normalizeToolParams, parseAgentScopedSessionKey, parseThinkingLevel, readCompressedContextCompactionCheckpoint, readOptionalString, readParentSessionId, readSessionProjectRoot, redactConfigObject, resolveConfigSecrets, resolveDefaultAgentProfileId, resolveProviderRuntime, resolveSessionWorkspacePath, resolveThinkingLevel, saveConfig, summarizeSessionRequestTask, toDisposable, toExtensionConfigView } from "@nextclaw/core";
+import { AgentRouteResolver, BUILTIN_MAIN_AGENT_ID, CLEAR_THINKING_TOKENS, CONTEXT_COMPACTION_METADATA_KEY, ChannelManager, ChannelManager as ChannelManager$1, ConfigSchema, ContextBuilder, ContextCompactionService, ContextWindowBudgetService, CronService, CronTool, DEFAULT_PANELS_DIR, DEFAULT_SERVICE_APPS_DIR, DEFAULT_SESSION_SEARCH_LIMIT, EditFileTool, ExecTool, GatewayTool, InputBudgetPruner, LLMProvider, ListDirTool, LiteLLMProvider, MAX_SESSION_SEARCH_LIMIT, MemoryGetTool, MemorySearchTool, MessageBus, MessageTool, ProviderRegistry, ReadFileTool, RequestedSkillsMetadataReader, SessionSearchManager, SkillsLoader, THINKING_LEVELS, WebFetchTool, WebSearchTool, WriteFileTool, buildCompressingCompactionCheckpoint, buildConfigSchema, buildContextWindowSnapshot, buildMinimalSystemExecutionPrompt, buildReloadPlan, buildSessionRequestToolResult, buildToolCatalogEntries, createAssistantStreamDeltaControlMessage, createAssistantStreamResetControlMessage, createCompletedSessionRequest, createFailedSessionRequest, createRunningSessionRequest, createTypingStopControlMessage, diffConfigPaths, ensureDir, expandHome, findEffectiveAgentProfile, getConfigPath, getDataDir, getDataPath, getSessionsPath, getWorkspacePath, getWorkspacePathFromConfig, loadConfig, mergeExtensionConfigView, modelSupportsVision, normalizeInlineSecretRefs, normalizeProviderModelConfig, normalizeToolParams, parseAgentScopedSessionKey, parseThinkingLevel, readCompressedContextCompactionCheckpoint, readOptionalString, readParentSessionId, readSessionProjectRoot, redactConfigObject, resolveConfigSecrets, resolveDefaultAgentProfileId, resolveProviderRuntime, resolveSessionWorkspacePath, resolveThinkingLevel, saveConfig, summarizeSessionRequestTask, toDisposable, toExtensionConfigView } from "@nextclaw/core";
 import { LocalAssetStore, buildAssetContentPath, buildNcpUserContent, buildOpenAiFunctionTool, ncpMessageToOpenAiMessages, validateToolArgs } from "@nextclaw/ncp-agent-runtime";
-import { createHash, createHmac, randomBytes, randomUUID, timingSafeEqual } from "node:crypto";
+import { createHash, createHmac, randomBytes, randomUUID, scryptSync, timingSafeEqual } from "node:crypto";
 import { EventBus, Ingress, eventKeys, ingressKeys } from "@nextclaw/shared";
 import { catchError, from, lastValueFrom, tap } from "rxjs";
-import { appendFileSync, constants, existsSync, mkdirSync, readFileSync, readdirSync, rmSync, writeFileSync } from "node:fs";
+import { appendFileSync, chmodSync, constants, existsSync, mkdirSync, readFileSync, readdirSync, renameSync, rmSync, writeFileSync } from "node:fs";
+import { basename, delimiter, dirname, extname, isAbsolute, join, normalize, relative, resolve } from "node:path";
 import { spawn } from "node:child_process";
 import { access, appendFile, mkdir, readFile, readdir, rename, rm, stat, unlink, writeFile } from "node:fs/promises";
-import { basename, delimiter, dirname, extname, isAbsolute, join, normalize, relative, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 import { BUILTIN_PROVIDER_PLUGINS } from "@nextclaw/runtime";
 import { McpRegistryService, McpServerLifecycleManager } from "@nextclaw/mcp";
@@ -887,6 +887,308 @@ var AgentRuntimeManager = class {
 	};
 };
 //#endregion
+//#region src/utils/access-token.utils.ts
+function createAccessSessionToken() {
+	return randomBytes(32).toString("base64url");
+}
+function hashAccessSessionToken(token) {
+	return createHash("sha256").update(token).digest("hex");
+}
+//#endregion
+//#region src/stores/access-session.store.ts
+const ACCESS_SESSION_STATE_VERSION = 1;
+const ACCESS_SESSION_STATE_KIND = "nextclaw.access.sessions";
+function createEmptyState() {
+	return {
+		kind: ACCESS_SESSION_STATE_KIND,
+		version: ACCESS_SESSION_STATE_VERSION,
+		sessions: []
+	};
+}
+function isAccessPrincipal(value) {
+	if (!value || typeof value !== "object") return false;
+	const record = value;
+	return typeof record.id === "string" && record.id.trim().length > 0 && record.role === "admin";
+}
+function parseAccessSessionRecord(value) {
+	if (!value || typeof value !== "object") return null;
+	const record = value;
+	if (typeof record.tokenHash !== "string" || !record.tokenHash.trim() || !isAccessPrincipal(record.principal) || typeof record.createdAt !== "string" || typeof record.expiresAt !== "string") return null;
+	return {
+		tokenHash: record.tokenHash,
+		principal: record.principal,
+		createdAt: record.createdAt,
+		expiresAt: record.expiresAt
+	};
+}
+function parseAccessSessionState(value) {
+	if (!value || typeof value !== "object") return createEmptyState();
+	const record = value;
+	if (record.kind !== ACCESS_SESSION_STATE_KIND || record.version !== ACCESS_SESSION_STATE_VERSION || !Array.isArray(record.sessions)) return createEmptyState();
+	return {
+		kind: ACCESS_SESSION_STATE_KIND,
+		version: ACCESS_SESSION_STATE_VERSION,
+		sessions: record.sessions.map(parseAccessSessionRecord).filter((session) => session !== null)
+	};
+}
+function isSessionActive(session, nowMs) {
+	const expiresAtMs = Date.parse(session.expiresAt);
+	return Number.isFinite(expiresAtMs) && expiresAtMs > nowMs;
+}
+var AccessSessionStore = class {
+	constructor(storePath) {
+		this.storePath = storePath;
+	}
+	findPrincipalByToken = (token, now) => {
+		const normalizedToken = token?.trim();
+		if (!normalizedToken) return null;
+		const tokenHash = hashAccessSessionToken(normalizedToken);
+		const nowMs = now.getTime();
+		return this.readState().sessions.find((entry) => entry.tokenHash === tokenHash && isSessionActive(entry, nowMs))?.principal ?? null;
+	};
+	saveSession = (session, now) => {
+		const activeSessions = this.readState().sessions.filter((entry) => entry.tokenHash !== session.tokenHash && isSessionActive(entry, now.getTime()));
+		this.writeState({
+			kind: ACCESS_SESSION_STATE_KIND,
+			version: ACCESS_SESSION_STATE_VERSION,
+			sessions: [...activeSessions, session]
+		});
+	};
+	deleteToken = (token) => {
+		const normalizedToken = token?.trim();
+		if (!normalizedToken) return;
+		const tokenHash = hashAccessSessionToken(normalizedToken);
+		this.writeState({
+			kind: ACCESS_SESSION_STATE_KIND,
+			version: ACCESS_SESSION_STATE_VERSION,
+			sessions: this.readState().sessions.filter((session) => session.tokenHash !== tokenHash)
+		});
+	};
+	clear = () => {
+		this.writeState(createEmptyState());
+	};
+	readState = () => {
+		if (!existsSync(this.storePath)) return createEmptyState();
+		try {
+			return parseAccessSessionState(JSON.parse(readFileSync(this.storePath, "utf-8")));
+		} catch {
+			return createEmptyState();
+		}
+	};
+	writeState = (state) => {
+		mkdirSync(dirname(this.storePath), { recursive: true });
+		const temporaryPath = `${this.storePath}.${process.pid}.tmp`;
+		writeFileSync(temporaryPath, JSON.stringify(state, null, 2), { mode: 384 });
+		renameSync(temporaryPath, this.storePath);
+		chmodSync(this.storePath, 384);
+	};
+};
+//#endregion
+//#region src/utils/access-password.utils.ts
+function createAccessPasswordRecord(password) {
+	const passwordSalt = randomBytes(16).toString("hex");
+	return {
+		passwordHash: scryptAccessPassword(password, passwordSalt),
+		passwordSalt
+	};
+}
+function verifyAccessPassword(password, expectedHash, salt) {
+	const actualHashBuffer = Buffer.from(scryptAccessPassword(password, salt), "hex");
+	const expectedHashBuffer = Buffer.from(expectedHash, "hex");
+	if (actualHashBuffer.length !== expectedHashBuffer.length) return false;
+	return timingSafeEqual(actualHashBuffer, expectedHashBuffer);
+}
+function scryptAccessPassword(password, salt) {
+	return scryptSync(password, salt, 64).toString("hex");
+}
+//#endregion
+//#region src/managers/access.manager.ts
+const PASSWORD_MIN_LENGTH = 8;
+const DEFAULT_ACCESS_SESSION_TTL_MS = 720 * 60 * 60 * 1e3;
+function normalizeUsername(value) {
+	return value.trim();
+}
+function validateUsernameAndPassword(username, password) {
+	if (!username) throw new Error("Username is required.");
+	if (password.trim().length < PASSWORD_MIN_LENGTH) throw new Error(`Password must be at least ${PASSWORD_MIN_LENGTH} characters.`);
+}
+function resolveAccessSessionStorePath(options) {
+	const { configPath, homeDir, sessionStorePath } = options;
+	if (sessionStorePath?.trim()) return sessionStorePath.trim();
+	if (homeDir?.trim()) return resolve(homeDir.trim(), "access", "access-sessions.json");
+	if (configPath?.trim()) return resolve(dirname(configPath.trim()), "access", "access-sessions.json");
+	return resolve(getDataDir(), "access", "access-sessions.json");
+}
+var AccessManager = class {
+	sessions;
+	configPath;
+	sessionTtlMs;
+	now;
+	constructor(options = {}) {
+		this.options = options;
+		this.configPath = options.configManager?.configPath ?? options.configPath ?? getConfigPath();
+		this.sessions = new AccessSessionStore(resolveAccessSessionStorePath({
+			...options,
+			configPath: this.configPath
+		}));
+		this.sessionTtlMs = Math.max(1, Math.trunc(options.sessionTtlMs ?? DEFAULT_ACCESS_SESSION_TTL_MS));
+		this.now = options.now ?? (() => /* @__PURE__ */ new Date());
+	}
+	isPasswordProtectionEnabled = () => {
+		const auth = this.readAuthConfig();
+		return Boolean(auth.enabled && this.isConfigured(auth));
+	};
+	authenticateSession = (token) => {
+		const auth = this.readAuthConfig();
+		if (!auth.enabled || !this.isConfigured(auth)) return {
+			id: "admin",
+			role: "admin"
+		};
+		return this.sessions.findPrincipalByToken(token, this.now());
+	};
+	getPasswordAuthStatus = (token) => {
+		const auth = this.readAuthConfig();
+		const configured = this.isConfigured(auth);
+		const enabled = Boolean(auth.enabled && configured);
+		const username = configured ? normalizeUsername(auth.username) : void 0;
+		return {
+			enabled,
+			configured,
+			authenticated: enabled ? this.sessions.findPrincipalByToken(token, this.now()) !== null : false,
+			username
+		};
+	};
+	setupPasswordAdmin = async (input) => {
+		const config = this.loadCurrentConfig();
+		const currentAuth = config.ui.auth;
+		if (this.isConfigured(currentAuth)) throw new Error("UI authentication is already configured.");
+		const username = normalizeUsername(input.username);
+		validateUsernameAndPassword(username, input.password);
+		const nextPassword = createAccessPasswordRecord(input.password);
+		config.ui.auth = {
+			enabled: true,
+			username,
+			passwordHash: nextPassword.passwordHash,
+			passwordSalt: nextPassword.passwordSalt
+		};
+		await this.saveCurrentConfig(config, "setup password access");
+		this.sessions.clear();
+		return this.createLoginResult(username, true);
+	};
+	loginWithPassword = (input) => {
+		const auth = this.readAuthConfig();
+		if (!auth.enabled || !this.isConfigured(auth)) throw new Error("UI authentication is not enabled.");
+		const username = normalizeUsername(input.username);
+		if (username !== normalizeUsername(auth.username) || !verifyAccessPassword(input.password, auth.passwordHash, auth.passwordSalt)) throw new Error("Invalid username or password.");
+		return this.createLoginResult(username, true);
+	};
+	logout = (token) => {
+		this.sessions.deleteToken(token);
+	};
+	updatePassword = async (input) => {
+		const config = this.loadCurrentConfig();
+		const auth = config.ui.auth;
+		if (!this.isConfigured(auth)) throw new Error("UI authentication is not configured.");
+		if (auth.enabled && this.sessions.findPrincipalByToken(input.token, this.now()) === null) throw new Error("Authentication required.");
+		const username = normalizeUsername(auth.username);
+		validateUsernameAndPassword(username, input.password);
+		const nextPassword = createAccessPasswordRecord(input.password);
+		config.ui.auth = {
+			enabled: auth.enabled,
+			username: auth.username,
+			passwordHash: nextPassword.passwordHash,
+			passwordSalt: nextPassword.passwordSalt
+		};
+		await this.saveCurrentConfig(config, "update password access");
+		this.sessions.clear();
+		if (!auth.enabled) return { status: {
+			enabled: false,
+			configured: true,
+			authenticated: false,
+			username
+		} };
+		return this.createLoginResult(username, true);
+	};
+	setPasswordAuthEnabled = async (input) => {
+		const config = this.loadCurrentConfig();
+		const auth = config.ui.auth;
+		const configured = this.isConfigured(auth);
+		if (Boolean(auth.enabled && configured) && this.sessions.findPrincipalByToken(input.token, this.now()) === null) throw new Error("Authentication required.");
+		if (input.enabled && !configured) throw new Error("UI authentication must be configured before it can be enabled.");
+		config.ui.auth = {
+			enabled: Boolean(input.enabled),
+			username: auth.username,
+			passwordHash: auth.passwordHash,
+			passwordSalt: auth.passwordSalt
+		};
+		await this.saveCurrentConfig(config, "update password access enabled");
+		if (!input.enabled) {
+			this.sessions.clear();
+			return { status: {
+				enabled: false,
+				configured,
+				authenticated: false,
+				username: configured ? normalizeUsername(auth.username) : void 0
+			} };
+		}
+		return this.createLoginResult(normalizeUsername(auth.username), true);
+	};
+	createTrustedSession = () => {
+		const auth = this.readAuthConfig();
+		if (!auth.enabled || !this.isConfigured(auth)) return null;
+		return this.createLoginResult(normalizeUsername(auth.username), true);
+	};
+	loadCurrentConfig = () => {
+		return this.options.configManager?.loadConfig() ?? loadConfig(this.configPath);
+	};
+	saveCurrentConfig = async (config, note) => {
+		const parsed = ConfigSchema.parse(config);
+		if (this.options.configManager) {
+			await this.options.configManager.applyConfig(parsed, note);
+			return;
+		}
+		saveConfig(parsed, this.configPath);
+	};
+	readAuthConfig = () => {
+		return this.loadCurrentConfig().ui.auth;
+	};
+	isConfigured = (auth) => {
+		return Boolean(normalizeUsername(auth.username).length > 0 && auth.passwordHash.trim().length > 0 && auth.passwordSalt.trim().length > 0);
+	};
+	createLoginResult = (username, authenticated) => {
+		const session = this.createSession(username);
+		return {
+			status: {
+				enabled: true,
+				configured: true,
+				authenticated,
+				username
+			},
+			token: session.token,
+			expiresAt: session.record.expiresAt
+		};
+	};
+	createSession = (username) => {
+		const token = createAccessSessionToken();
+		const now = this.now();
+		const expiresAt = new Date(now.getTime() + this.sessionTtlMs).toISOString();
+		const record = {
+			tokenHash: hashAccessSessionToken(token),
+			principal: {
+				id: username,
+				role: "admin"
+			},
+			createdAt: now.toISOString(),
+			expiresAt
+		};
+		this.sessions.saveSession(record, now);
+		return {
+			token,
+			record
+		};
+	};
+};
+//#endregion
 //#region src/managers/automation.manager.ts
 var AutomationManager = class extends CronService {
 	constructor(options) {
@@ -993,6 +1295,10 @@ var ConfigManager = class {
 	getConfigSchema = (params = {}) => buildConfigSchema({ version: params.version });
 	applyRawConfig = async (params) => this.mutateRawConfig(params, (_snapshot, parsed) => parsed);
 	patchRawConfig = async (params) => this.mutateRawConfig(params, (snapshot, patch) => mergeDeep(snapshot.config, patch));
+	applyConfig = async (nextConfig, note) => this.applyConfigChange({
+		nextConfig,
+		note
+	});
 	scheduleReload = (reason) => {
 		if (this.reloadTimer) clearTimeout(this.reloadTimer);
 		this.reloadTimer = setTimeout(() => {
@@ -1577,6 +1883,7 @@ var ExtensionLifecycleService = class {
 //#endregion
 //#region src/features/extension-runtime/services/extension-manifest-discovery.service.ts
 const EXTENSION_MANIFEST_FILE = "nextclaw.extension.json";
+const PACKAGED_EXTENSION_DIR_ENV = "NEXTCLAW_PACKAGED_EXTENSION_DIR";
 const BUILTIN_EXTENSION_PACKAGES = [
 	"@nextclaw/channel-extension-dingtalk",
 	"@nextclaw/channel-extension-discord",
@@ -1667,12 +1974,17 @@ function resolveBuiltinExtensionManifestRoots() {
 	} catch {}
 	return uniquePaths(roots);
 }
+function resolvePackagedExtensionManifestRoots(explicitDir = process.env[PACKAGED_EXTENSION_DIR_ENV]) {
+	const configured = explicitDir?.trim();
+	return configured ? [resolve(configured)] : [];
+}
 function resolveExtensionManifestRoots(params) {
 	const devExtensionsDir = resolveDevFirstPartyExtensionDir();
 	return uniquePaths([
 		join(getDataPath(), "extensions"),
 		join(params.workspace, ".nextclaw", "extensions"),
 		...devExtensionsDir ? [devExtensionsDir] : [],
+		...resolvePackagedExtensionManifestRoots(),
 		...resolveBuiltinExtensionManifestRoots()
 	]);
 }
@@ -2297,8 +2609,10 @@ var LlmProviderManager = class {
 	testConnection = async (input) => {
 		await this.createProvider({
 			providerName: input.providerName,
+			providerId: input.providerName,
 			provider: {
 				enabled: true,
+				providerType: input.providerName,
 				displayName: "",
 				apiKey: input.apiKey ?? "",
 				apiBase: input.apiBase ?? null,
@@ -2319,90 +2633,131 @@ var LlmProviderManager = class {
 	resolveRoute = (model) => {
 		if (!this.config) return null;
 		const effectiveModel = normalizedModel(model) ?? this.config.agents.defaults.model;
-		const { provider, name } = this.resolveProvider(effectiveModel);
+		const route = this.resolveProvider(effectiveModel);
+		const { provider, name } = route;
 		const providerSpec = name ? this.providerRegistry.findProviderByName(name) : void 0;
+		const specModelConfig = normalizeProviderModelConfig(providerSpec?.modelConfig ?? {});
+		const providerModelConfig = this.normalizeProviderModelConfigForRoute(provider?.modelConfig ?? {}, route.providerId, name);
 		return {
-			model: effectiveModel,
+			model: route.model,
+			providerId: route.providerId,
 			providerName: name,
 			provider,
-			apiBase: provider?.apiBase ?? providerSpec?.defaultApiBase ?? null
+			apiBase: provider?.apiBase ?? providerSpec?.defaultApiBase ?? null,
+			modelConfig: {
+				...specModelConfig,
+				...providerModelConfig
+			}
 		};
 	};
 	resolveProvider = (model) => {
 		const providers = this.config?.providers;
 		if (!providers) return {
 			provider: null,
-			name: null
+			name: null,
+			providerId: null,
+			model
 		};
 		const specs = this.providerRegistry.listProviderSpecs();
 		const modelLower = model.toLowerCase();
 		const modelPrefix = modelLower.includes("/") ? modelLower.slice(0, modelLower.indexOf("/")) : "";
 		if (modelPrefix) {
-			const prefixed = this.matchPrefixedProvider(providers, modelPrefix);
+			const prefixed = this.matchPrefixedProvider(providers, modelPrefix, model);
 			if (prefixed) return prefixed;
 		}
-		const keywordMatches = specs.map((spec) => ({
-			name: spec.name,
-			provider: providers[spec.name],
-			spec
-		})).filter((entry) => entry.provider?.enabled !== false && Boolean(entry.provider?.apiKey)).filter((entry) => entry.spec.keywords.some((keyword) => modelLower.includes(keyword)));
+		const keywordMatches = Object.entries(providers).map(([providerId, provider]) => {
+			const providerType = this.resolveProviderType(providerId, provider);
+			return {
+				name: providerType,
+				providerId,
+				provider,
+				spec: providerType ? this.providerRegistry.findProviderByName(providerType) : void 0
+			};
+		}).filter((entry) => Boolean(entry.name && entry.spec)).filter((entry) => entry.provider?.enabled !== false && Boolean(entry.provider?.apiKey)).filter((entry) => entry.spec.keywords.some((keyword) => modelLower.includes(keyword)));
 		if (keywordMatches.length === 1) {
 			const match = keywordMatches[0];
+			const providerId = match.providerId;
 			return {
 				provider: match.provider ?? null,
-				name: match.name
+				name: match.name,
+				providerId,
+				model: this.rewriteModelForTemplate(model, providerId, match.name)
 			};
 		}
 		if (keywordMatches.length > 1) return {
 			provider: null,
-			name: null
+			name: null,
+			providerId: null,
+			model
 		};
 		const builtinNames = new Set(specs.map((spec) => spec.name));
 		const enabledProviders = Object.entries(providers).filter(([, provider]) => provider.enabled !== false && Boolean(provider.apiKey));
 		const enabledBuiltin = enabledProviders.filter(([name]) => builtinNames.has(name));
 		if (enabledBuiltin.length === 1) {
 			const [name, provider] = enabledBuiltin[0];
+			const providerType = this.resolveProviderType(name, provider);
 			return {
 				provider,
-				name
+				name: providerType,
+				providerId: name,
+				model: this.rewriteModelForTemplate(model, name, providerType)
 			};
 		}
 		const enabledCustom = enabledProviders.filter(([name]) => !builtinNames.has(name));
 		if (enabledCustom.length === 1) {
 			const [name, provider] = enabledCustom[0];
+			const providerType = this.resolveProviderType(name, provider);
 			return {
 				provider,
-				name
+				name: providerType,
+				providerId: name,
+				model: this.rewriteModelForTemplate(model, name, providerType)
 			};
 		}
 		return {
 			provider: null,
-			name: null
+			name: null,
+			providerId: null,
+			model
 		};
 	};
-	matchPrefixedProvider = (providers, modelPrefix) => {
-		for (const spec of this.providerRegistry.listProviderSpecs()) {
-			const provider = providers[spec.name];
-			const aliases = [spec.name, spec.modelPrefix ?? ""].map((value) => value.trim().toLowerCase()).filter(Boolean);
-			if (provider && aliases.includes(modelPrefix)) return provider.enabled !== false ? {
-				provider,
-				name: spec.name
-			} : {
-				provider: null,
-				name: null
-			};
-		}
+	matchPrefixedProvider = (providers, modelPrefix, model) => {
 		const customProvider = Object.entries(providers).find(([name]) => name.toLowerCase() === modelPrefix);
 		if (!customProvider) return null;
-		const [name, provider] = customProvider;
-		return provider.enabled !== false ? {
-			provider,
-			name
-		} : {
+		const [providerId, provider] = customProvider;
+		if (provider.enabled === false) return {
 			provider: null,
-			name: null
+			name: null,
+			providerId,
+			model
+		};
+		const providerType = this.resolveProviderType(providerId, provider);
+		return {
+			provider,
+			name: providerType,
+			providerId,
+			model: this.rewriteModelForTemplate(model, providerId, providerType)
 		};
 	};
+	resolveProviderType = (providerId, provider) => {
+		const configuredType = typeof provider.providerType === "string" ? provider.providerType.trim() : "";
+		if (configuredType && this.providerRegistry.findProviderByName(configuredType)) return configuredType;
+		return this.providerRegistry.findProviderByName(providerId) ? providerId : null;
+	};
+	rewriteModelForTemplate = (model, providerId, providerType) => {
+		const prefix = `${providerId}/`;
+		if (!model.startsWith(prefix)) return model;
+		const suffix = model.slice(prefix.length).trim();
+		if (!suffix) return model;
+		return providerType ? `${providerType}/${suffix}` : suffix;
+	};
+	normalizeProviderModelConfigForRoute = (modelConfig, providerId, providerType) => {
+		const normalized = normalizeProviderModelConfig(modelConfig ?? {});
+		if (!providerId || !providerType) return normalized;
+		const rewritten = {};
+		for (const [model, config] of Object.entries(normalized)) rewritten[this.rewriteModelForTemplate(model, providerId, providerType)] = config;
+		return rewritten;
+	};
 	getOrCreateProvider = (route) => {
 		if (!route.provider?.apiKey && !route.model.startsWith("bedrock/")) return this.missingProvider;
 		const cacheKey = this.buildCacheKey(route);
@@ -2429,7 +2784,7 @@ var LlmProviderManager = class {
 			supportsVision: modelSupportsVision({
 				model: route?.model,
 				providerName: route?.providerName,
-				modelConfig: route?.provider?.modelConfig
+				modelConfig: route?.modelConfig
 			})
 		});
 	};
@@ -2437,6 +2792,7 @@ var LlmProviderManager = class {
 		const routeProvider = route.provider;
 		return [
 			route.providerName ?? "",
+			route.providerId ?? "",
 			routeProvider?.apiKey ?? "",
 			route.apiBase ?? "",
 			routeProvider?.wireApi ?? "",
@@ -4585,6 +4941,18 @@ var ServiceActionGrantStore = class {
 		if (Object.keys(callerGrants.actions).length === 0) delete data.grants[callerKey];
 		await this.save(data);
 	};
+	revokeActionsByPrefix = async (actionIdPrefix) => {
+		const data = await this.load();
+		let changed = false;
+		for (const [callerKey, callerGrants] of Object.entries(data.grants)) {
+			for (const actionId of Object.keys(callerGrants.actions)) if (actionId.startsWith(actionIdPrefix)) {
+				delete callerGrants.actions[actionId];
+				changed = true;
+			}
+			if (Object.keys(callerGrants.actions).length === 0) delete data.grants[callerKey];
+		}
+		if (changed) await this.save(data);
+	};
 	load = async () => {
 		try {
 			return normalizeStoreData(JSON.parse(await readFile(this.storePath, "utf8")));
@@ -4790,6 +5158,16 @@ var ServiceAppManager = class {
 		await this.runtimeService.restart(record.id);
 		return await this.getServiceApp(appId);
 	};
+	deleteServiceApp = async (appId) => {
+		const { record } = await this.requireServiceApp(appId);
+		await this.runtimeService.restart(record.id);
+		await rm(record.dirPath, { recursive: true });
+		await this.createGrantStore().revokeActionsByPrefix(`${record.id}.`);
+		return {
+			deleted: true,
+			id: record.id
+		};
+	};
 	dispose = async () => {
 		await this.runtimeService.dispose();
 	};
@@ -8153,6 +8531,7 @@ var NextclawKernel = class {
 	llmProviders = new LlmProviderManager();
 	llmUsage = new LlmUsageManager();
 	configManager;
+	accessManager;
 	agents;
 	control;
 	skills;
@@ -8192,6 +8571,10 @@ var NextclawKernel = class {
 			channels: this.channels,
 			providerManager: this.llmProviders
 		});
+		this.accessManager = new AccessManager({
+			configManager: this.configManager,
+			homeDir: options.homeDir
+		});
 		this.sessionManager = new SessionManager({
 			configManager: this.configManager,
 			eventBus: this.eventBus,
@@ -8867,6 +9250,6 @@ function resolveLegacyEventType(message) {
 	return `message.${role || "other"}`;
 }
 //#endregion
-export { AgentManager, AgentRunClient, AgentRuntimeRegistry, AutomationManager, BuiltinNarpRuntimeProviderService, CONTEXT_COMPACTION_TIMELINE_KIND, ChannelManager, CommandRegistry, ConfigManager, ContextCompactionPreflightService, ContextWindowPreviewManager, DEFAULT_AGENT_RUNTIME_ENTRY_ID, ExtensionManager, GatewayInboundProcessor, LlmProviderManager, LlmUsageManager, LlmUsageStore, McpManager, NARP_HTTP_RUNTIME_KIND, NARP_STDIO_RUNTIME_KIND, NEXTCLAW_TIMELINE_KIND_METADATA_KEY, NcpAgentSessionJournalStore, NextclawKernel, PANEL_APP_AGENT_CAPABILITIES, PanelAppAssetTokenService, PanelAppError, PanelAppManager, ProviderManagerNcpLLMApi, ServiceAppError, ServiceAppManager, SessionManager, SessionRequestManager, SkillManager, UpdateManifestReader, buildAgentRunSendPayload, buildContextCompactionTimelineNcpMessage, buildLlmUsageSummary, buildLocalizedTextMap, buildSessionOrchestrationSection, createAgentRuntimeSessionRequestDispatcher, createAssetTools, createContextWindowSignature, createLlmUsageRecord, dispatchAgentRuntimeSessionRequest, dispatchChannelReplyRoute, dispatchPromptOverNcp, getUnsignedUpdateManifest, hasLlmUsageTelemetry, isContextCompactionTimelineMessage, isContextWindowSnapshot, isPanelAppAgentCapability, isPanelAppError, isReplyCapableChannel, isServiceAppError, listExtensionChannelIds, normalizeAgentRuntimeSessionTypeIcon, normalizeLlmUsageModel, normalizeOptionalString, parseSkillFrontmatter, projectNcpMessagesWithContextCompaction, readContextWindowEventSessionId, readLearningLoopRuntimeConfig, readMetadataModel, readMetadataThinking, resolveAgentRuntimeEntries, resolveChannelReplyRoute, resolveEffectiveModel, resolveLegacyEventType, resolveNextclawNcpRunContext, resolveSessionChannelContext, runGatewayInboundLoop, sanitizeLlmUsage, serializeUnsignedUpdateManifest, shouldRefreshContextWindowDuringStream, shouldRefreshContextWindowImmediately, stripSkillFrontmatter, syncSessionThinkingPreference, toNcpMessages, upsertContextCompactionTimelineMessage, waitForAgentRuntimeSessionReply };
+export { AccessManager, AgentManager, AgentRunClient, AgentRuntimeRegistry, AutomationManager, BuiltinNarpRuntimeProviderService, CONTEXT_COMPACTION_TIMELINE_KIND, ChannelManager, CommandRegistry, ConfigManager, ContextCompactionPreflightService, ContextWindowPreviewManager, DEFAULT_AGENT_RUNTIME_ENTRY_ID, ExtensionManager, GatewayInboundProcessor, LlmProviderManager, LlmUsageManager, LlmUsageStore, McpManager, NARP_HTTP_RUNTIME_KIND, NARP_STDIO_RUNTIME_KIND, NEXTCLAW_TIMELINE_KIND_METADATA_KEY, NcpAgentSessionJournalStore, NextclawKernel, PANEL_APP_AGENT_CAPABILITIES, PanelAppAssetTokenService, PanelAppError, PanelAppManager, ProviderManagerNcpLLMApi, ServiceAppError, ServiceAppManager, SessionManager, SessionRequestManager, SkillManager, UpdateManifestReader, buildAgentRunSendPayload, buildContextCompactionTimelineNcpMessage, buildLlmUsageSummary, buildLocalizedTextMap, buildSessionOrchestrationSection, createAgentRuntimeSessionRequestDispatcher, createAssetTools, createContextWindowSignature, createLlmUsageRecord, dispatchAgentRuntimeSessionRequest, dispatchChannelReplyRoute, dispatchPromptOverNcp, getUnsignedUpdateManifest, hasLlmUsageTelemetry, isContextCompactionTimelineMessage, isContextWindowSnapshot, isPanelAppAgentCapability, isPanelAppError, isReplyCapableChannel, isServiceAppError, listExtensionChannelIds, normalizeAgentRuntimeSessionTypeIcon, normalizeLlmUsageModel, normalizeOptionalString, parseSkillFrontmatter, projectNcpMessagesWithContextCompaction, readContextWindowEventSessionId, readLearningLoopRuntimeConfig, readMetadataModel, readMetadataThinking, resolveAgentRuntimeEntries, resolveChannelReplyRoute, resolveEffectiveModel, resolveLegacyEventType, resolveNextclawNcpRunContext, resolveSessionChannelContext, runGatewayInboundLoop, sanitizeLlmUsage, serializeUnsignedUpdateManifest, shouldRefreshContextWindowDuringStream, shouldRefreshContextWindowImmediately, stripSkillFrontmatter, syncSessionThinkingPreference, toNcpMessages, upsertContextCompactionTimelineMessage, waitForAgentRuntimeSessionReply };
 
 //# sourceMappingURL=index.js.map