@nextclaw/server 0.13.3 → 0.13.5

package/dist/index.js

@@ -1,17 +1,17 @@
 import { Hono } from "hono";
 import { compress } from "hono/compress";
 import { serve } from "@hono/node-server";
+import { AccessManager, PanelAppError, isPanelAppError, isServiceAppError } from "@nextclaw/kernel";
 import { WebSocket, WebSocketServer } from "ws";
 import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
 import { open, readFile, readdir, realpath, stat } from "node:fs/promises";
 import { dirname, extname, isAbsolute, join, parse, resolve } from "node:path";
-import { createHash, randomBytes, randomUUID, scryptSync, timingSafeEqual } from "node:crypto";
+import { createHash, randomBytes, randomUUID } from "node:crypto";
 import * as NextclawCore from "@nextclaw/core";
 import { ConfigSchema, DEFAULT_WORKSPACE_PATH, buildConfigSchema, createAgentProfile, expandHome, findEffectiveAgentProfile, getDataDir, getPackageVersion, getProviderName, hasSecretRef, isSensitiveConfigPath, loadConfig, mergeExtensionConfigView, normalizeProviderModelConfig, parseThinkingLevel, probeFeishu, readAgentAvatarContent, removeAgentProfile, resolveEffectiveAgentProfiles, saveConfig, toExtensionConfigView, updateAgentProfile } from "@nextclaw/core";
 import { homedir } from "node:os";
 import { findBuiltinProviderByName, listBuiltinProviders } from "@nextclaw/runtime";
 import { McpInstalledViewService } from "@nextclaw/mcp";
-import { PanelAppError, isPanelAppError, isServiceAppError } from "@nextclaw/kernel";
 import { serveStatic } from "hono/serve-static";
 //#region src/features/auth/utils/auth-bridge.utils.ts
 const REMOTE_BRIDGE_DIR = join(getDataDir(), "remote");
@@ -107,7 +107,7 @@ var AuthRoutesController = class {
 		if (!body.ok) return c.json(err("INVALID_BODY", "invalid json body"), 400);
 		if (typeof body.data.username !== "string" || typeof body.data.password !== "string") return c.json(err("INVALID_BODY", "username and password are required"), 400);
 		try {
-			const result = this.authService.setup(c.req.raw, body.data);
+			const result = await this.authService.setup(c.req.raw, body.data);
 			setCookieHeader(c, result.cookie);
 			return c.json(ok(result.status), 201);
 		} catch (error) {
@@ -140,7 +140,7 @@ var AuthRoutesController = class {
 		if (!body.ok) return c.json(err("INVALID_BODY", "invalid json body"), 400);
 		if (typeof body.data.password !== "string") return c.json(err("INVALID_BODY", "password is required"), 400);
 		try {
-			const result = this.authService.updatePassword(c.req.raw, body.data);
+			const result = await this.authService.updatePassword(c.req.raw, body.data);
 			setCookieHeader(c, result.cookie);
 			return c.json(ok(result.status));
 		} catch (error) {
@@ -155,7 +155,7 @@ var AuthRoutesController = class {
 		if (!body.ok) return c.json(err("INVALID_BODY", "invalid json body"), 400);
 		if (typeof body.data.enabled !== "boolean") return c.json(err("INVALID_BODY", "enabled is required"), 400);
 		try {
-			const result = this.authService.updateEnabled(c.req.raw, body.data);
+			const result = await this.authService.updateEnabled(c.req.raw, body.data);
 			setCookieHeader(c, result.cookie);
 			return c.json(ok(result.status));
 		} catch (error) {
@@ -173,36 +173,49 @@ var AuthRoutesController = class {
 	};
 };
 //#endregion
-//#region src/features/auth/services/ui-auth.service.ts
+//#region src/features/auth/utils/access-cookie.utils.ts
 const SESSION_COOKIE_NAME = "nextclaw_ui_session";
-const PASSWORD_MIN_LENGTH = 8;
-function normalizeUsername(value) {
-	return value.trim();
-}
-function parseCookieHeader(rawHeader) {
-	if (!rawHeader) return {};
-	const cookies = {};
+function readAccessSessionTokenFromCookieHeader(rawHeader) {
+	if (!rawHeader) return null;
 	for (const chunk of rawHeader.split(";")) {
 		const [rawKey, ...rawValue] = chunk.split("=");
-		const key = rawKey?.trim();
-		if (!key) continue;
-		cookies[key] = decodeURIComponent(rawValue.join("=").trim());
+		if (rawKey?.trim() === SESSION_COOKIE_NAME) {
+			const value = decodeURIComponent(rawValue.join("=").trim());
+			return value.trim() ? value.trim() : null;
+		}
 	}
-	return cookies;
+	return null;
 }
-function buildSetCookie(params) {
-	const { value, secure, maxAgeSeconds, expires } = params;
+function buildAccessLoginCookie(params) {
+	const { expiresAt, secure, token } = params;
 	const parts = [
-		`${SESSION_COOKIE_NAME}=${encodeURIComponent(value)}`,
+		`${SESSION_COOKIE_NAME}=${encodeURIComponent(token)}`,
 		"Path=/",
 		"HttpOnly",
 		"SameSite=Lax"
 	];
 	if (secure) parts.push("Secure");
-	if (typeof maxAgeSeconds === "number") parts.push(`Max-Age=${Math.max(0, Math.trunc(maxAgeSeconds))}`);
-	if (expires) parts.push(`Expires=${expires}`);
+	if (expiresAt) {
+		const expiresAtMs = Date.parse(expiresAt);
+		if (Number.isFinite(expiresAtMs)) {
+			const maxAgeSeconds = Math.max(0, Math.trunc((expiresAtMs - Date.now()) / 1e3));
+			parts.push(`Max-Age=${maxAgeSeconds}`);
+			parts.push(`Expires=${new Date(expiresAtMs).toUTCString()}`);
+		}
+	}
 	return parts.join("; ");
 }
+function buildAccessLogoutCookie(secure) {
+	return [
+		`${SESSION_COOKIE_NAME}=`,
+		"Path=/",
+		"HttpOnly",
+		"SameSite=Lax",
+		secure ? "Secure" : null,
+		"Max-Age=0",
+		`Expires=${(/* @__PURE__ */ new Date(0)).toUTCString()}`
+	].filter((part) => part !== null).join("; ");
+}
 function resolveSecureRequest(url, protocolHint) {
 	if (protocolHint?.trim().toLowerCase() === "https") return true;
 	try {
@@ -211,232 +224,78 @@ function resolveSecureRequest(url, protocolHint) {
 		return false;
 	}
 }
-function hashPassword(password, salt) {
-	return scryptSync(password, salt, 64).toString("hex");
-}
-function verifyPassword(password, expectedHash, salt) {
-	const actualHashBuffer = Buffer.from(hashPassword(password, salt), "hex");
-	const expectedHashBuffer = Buffer.from(expectedHash, "hex");
-	if (actualHashBuffer.length !== expectedHashBuffer.length) return false;
-	return timingSafeEqual(actualHashBuffer, expectedHashBuffer);
-}
-function createPasswordRecord(password) {
-	const passwordSalt = randomBytes(16).toString("hex");
-	return {
-		passwordHash: hashPassword(password, passwordSalt),
-		passwordSalt
-	};
-}
-function validateUsernameAndPassword(username, password) {
-	if (!username) throw new Error("Username is required.");
-	if (password.trim().length < PASSWORD_MIN_LENGTH) throw new Error(`Password must be at least ${PASSWORD_MIN_LENGTH} characters.`);
-}
+//#endregion
+//#region src/features/auth/services/ui-auth.service.ts
 var UiAuthService = class {
-	sessions = /* @__PURE__ */ new Map();
-	constructor(configPath) {
-		this.configPath = configPath;
+	constructor(accessManager) {
+		this.accessManager = accessManager;
 	}
-	loadCurrentConfig = () => {
-		return loadConfig(this.configPath);
-	};
-	saveCurrentConfig = (config) => {
-		saveConfig(ConfigSchema.parse(config), this.configPath);
-	};
-	readAuthConfig = () => {
-		return this.loadCurrentConfig().ui.auth;
-	};
-	isConfigured = (auth) => {
-		return Boolean(normalizeUsername(auth.username).length > 0 && auth.passwordHash.trim().length > 0 && auth.passwordSalt.trim().length > 0);
-	};
-	isProtectionEnabled = () => {
-		const auth = this.readAuthConfig();
-		return Boolean(auth.enabled && this.isConfigured(auth));
-	};
-	getSessionIdFromCookieHeader = (rawCookieHeader) => {
-		const sessionId = parseCookieHeader(rawCookieHeader)[SESSION_COOKIE_NAME];
-		return sessionId?.trim() ? sessionId.trim() : null;
-	};
-	getValidSession = (sessionId, username) => {
-		if (!sessionId) return null;
-		const session = this.sessions.get(sessionId);
-		if (!session || session.username !== username) return null;
-		return session;
-	};
+	isProtectionEnabled = () => this.accessManager.isPasswordProtectionEnabled();
 	isRequestAuthenticated = (request) => {
-		const auth = this.readAuthConfig();
-		if (!auth.enabled || !this.isConfigured(auth)) return true;
-		const username = normalizeUsername(auth.username);
-		const sessionId = this.getSessionIdFromCookieHeader(request.headers.get("cookie"));
-		return Boolean(this.getValidSession(sessionId, username));
+		if (!this.isProtectionEnabled()) return true;
+		return this.accessManager.authenticateSession(this.readRequestToken(request)) !== null;
 	};
 	isSocketAuthenticated = (request) => {
-		const auth = this.readAuthConfig();
-		if (!auth.enabled || !this.isConfigured(auth)) return true;
-		const username = normalizeUsername(auth.username);
+		if (!this.isProtectionEnabled()) return true;
 		const rawCookieHeader = Array.isArray(request.headers.cookie) ? request.headers.cookie.join("; ") : request.headers.cookie;
-		const sessionId = this.getSessionIdFromCookieHeader(rawCookieHeader);
-		return Boolean(this.getValidSession(sessionId, username));
+		return this.accessManager.authenticateSession(readAccessSessionTokenFromCookieHeader(rawCookieHeader)) !== null;
 	};
 	getStatus = (request) => {
-		const auth = this.readAuthConfig();
-		const configured = this.isConfigured(auth);
-		const enabled = Boolean(auth.enabled && configured);
-		const username = configured ? normalizeUsername(auth.username) : void 0;
-		return {
-			enabled,
-			configured,
-			authenticated: enabled ? this.isRequestAuthenticated(request) : false,
-			...username ? { username } : {}
-		};
+		return this.accessManager.getPasswordAuthStatus(this.readRequestToken(request));
 	};
-	createSession = (username) => {
-		const sessionId = randomUUID();
-		this.sessions.set(sessionId, {
-			sessionId,
-			username,
-			createdAt: Date.now()
-		});
-		return sessionId;
+	setup = async (request, payload) => {
+		return this.toCookieResult(request, await this.accessManager.setupPasswordAdmin(payload));
 	};
-	clearAllSessions = () => {
-		this.sessions.clear();
+	login = (request, payload) => {
+		return this.toCookieResult(request, this.accessManager.loginWithPassword(payload));
 	};
-	deleteRequestSession = (request) => {
-		const sessionId = this.getSessionIdFromCookieHeader(request.headers.get("cookie"));
-		if (!sessionId) return;
-		this.sessions.delete(sessionId);
+	logout = (request) => {
+		this.accessManager.logout(this.readRequestToken(request));
+	};
+	updatePassword = async (request, payload) => {
+		return this.toOptionalCookieResult(request, await this.accessManager.updatePassword({
+			token: this.readRequestToken(request),
+			password: payload.password
+		}));
 	};
-	buildLoginCookie = (request, sessionId) => {
-		return buildSetCookie({
-			value: sessionId,
-			secure: resolveSecureRequest(request.url, request.headers.get("x-forwarded-proto"))
+	updateEnabled = async (request, payload) => {
+		const result = await this.accessManager.setPasswordAuthEnabled({
+			token: this.readRequestToken(request),
+			enabled: payload.enabled
 		});
+		if (!payload.enabled) return {
+			status: result.status,
+			cookie: this.buildLogoutCookie(request)
+		};
+		return this.toOptionalCookieResult(request, result);
 	};
 	buildTrustedRequestCookieHeader = () => {
-		const auth = this.readAuthConfig();
-		if (!auth.enabled || !this.isConfigured(auth)) return null;
-		const username = normalizeUsername(auth.username);
-		if (!username) return null;
-		const sessionId = this.createSession(username);
-		return `${SESSION_COOKIE_NAME}=${encodeURIComponent(sessionId)}`;
+		const result = this.accessManager.createTrustedSession();
+		return result?.token ? `nextclaw_ui_session=${encodeURIComponent(result.token)}` : null;
 	};
 	buildLogoutCookie = (request) => {
-		return buildSetCookie({
-			value: "",
-			secure: resolveSecureRequest(request.url, request.headers.get("x-forwarded-proto")),
-			maxAgeSeconds: 0,
-			expires: (/* @__PURE__ */ new Date(0)).toUTCString()
-		});
+		return buildAccessLogoutCookie(this.isSecureRequest(request));
 	};
-	setup = (request, payload) => {
-		const config = this.loadCurrentConfig();
-		const currentAuth = config.ui.auth;
-		if (this.isConfigured(currentAuth)) throw new Error("UI authentication is already configured.");
-		const username = normalizeUsername(payload.username);
-		const password = payload.password;
-		validateUsernameAndPassword(username, password);
-		const nextPassword = createPasswordRecord(password);
-		config.ui.auth = {
-			enabled: true,
-			username,
-			...nextPassword
-		};
-		this.saveCurrentConfig(config);
-		this.clearAllSessions();
-		const sessionId = this.createSession(username);
-		return {
-			status: {
-				enabled: true,
-				configured: true,
-				authenticated: true,
-				username
-			},
-			cookie: this.buildLoginCookie(request, sessionId)
-		};
+	readRequestToken = (request) => {
+		return readAccessSessionTokenFromCookieHeader(request.headers.get("cookie"));
 	};
-	login = (request, payload) => {
-		const auth = this.readAuthConfig();
-		if (!auth.enabled || !this.isConfigured(auth)) throw new Error("UI authentication is not enabled.");
-		const username = normalizeUsername(payload.username);
-		if (username !== normalizeUsername(auth.username) || !verifyPassword(payload.password, auth.passwordHash, auth.passwordSalt)) throw new Error("Invalid username or password.");
-		const sessionId = this.createSession(username);
+	toCookieResult = (request, result) => {
+		if (!result.token) throw new Error("Access session token was not created.");
 		return {
-			status: {
-				enabled: true,
-				configured: true,
-				authenticated: true,
-				username
-			},
-			cookie: this.buildLoginCookie(request, sessionId)
+			status: result.status,
+			cookie: buildAccessLoginCookie({
+				token: result.token,
+				secure: this.isSecureRequest(request),
+				expiresAt: result.expiresAt
+			})
 		};
 	};
-	logout = (request) => {
-		this.deleteRequestSession(request);
-	};
-	updatePassword = (request, payload) => {
-		const config = this.loadCurrentConfig();
-		const auth = config.ui.auth;
-		if (!this.isConfigured(auth)) throw new Error("UI authentication is not configured.");
-		if (auth.enabled && !this.isRequestAuthenticated(request)) throw new Error("Authentication required.");
-		validateUsernameAndPassword(normalizeUsername(auth.username), payload.password);
-		const nextPassword = createPasswordRecord(payload.password);
-		config.ui.auth = {
-			...auth,
-			...nextPassword
-		};
-		this.saveCurrentConfig(config);
-		this.clearAllSessions();
-		if (!auth.enabled) return { status: {
-			enabled: false,
-			configured: true,
-			authenticated: false,
-			username: normalizeUsername(auth.username)
-		} };
-		const sessionId = this.createSession(normalizeUsername(auth.username));
-		return {
-			status: {
-				enabled: true,
-				configured: true,
-				authenticated: true,
-				username: normalizeUsername(auth.username)
-			},
-			cookie: this.buildLoginCookie(request, sessionId)
-		};
+	toOptionalCookieResult = (request, result) => {
+		if (!result.token) return { status: result.status };
+		return this.toCookieResult(request, result);
 	};
-	updateEnabled = (request, payload) => {
-		const config = this.loadCurrentConfig();
-		const auth = config.ui.auth;
-		const configured = this.isConfigured(auth);
-		if (Boolean(auth.enabled && configured) && !this.isRequestAuthenticated(request)) throw new Error("Authentication required.");
-		if (payload.enabled && !configured) throw new Error("UI authentication must be configured before it can be enabled.");
-		config.ui.auth = {
-			...auth,
-			enabled: Boolean(payload.enabled)
-		};
-		this.saveCurrentConfig(config);
-		if (!payload.enabled) {
-			this.clearAllSessions();
-			return {
-				status: {
-					enabled: false,
-					configured,
-					authenticated: false,
-					...configured ? { username: normalizeUsername(auth.username) } : {}
-				},
-				cookie: this.buildLogoutCookie(request)
-			};
-		}
-		const username = normalizeUsername(auth.username);
-		const sessionId = this.createSession(username);
-		return {
-			status: {
-				enabled: true,
-				configured: true,
-				authenticated: true,
-				username
-			},
-			cookie: this.buildLoginCookie(request, sessionId)
-		};
+	isSecureRequest = (request) => {
+		return resolveSecureRequest(request.url, request.headers.get("x-forwarded-proto"));
 	};
 };
 //#endregion
@@ -973,23 +832,6 @@ async function connectChannelAuth(params) {
 	return toPublicChannelAuthPollResult(result);
 }
 //#endregion
-//#region src/features/config/utils/default-provider-config.utils.ts
-function createDefaultProviderConfig(defaultWireApi = "auto", defaultModels = [], modelConfig = {}) {
-	return {
-		enabled: true,
-		displayName: "",
-		apiKey: "",
-		apiBase: null,
-		extraHeaders: null,
-		wireApi: defaultWireApi,
-		models: [...defaultModels],
-		modelConfig
-	};
-}
-function createDefaultProviderConfigFromSpec(spec) {
-	return createDefaultProviderConfig(spec?.defaultWireApi ?? "auto", spec?.defaultModels ?? [], normalizeProviderModelConfig(spec?.modelConfig ?? {}));
-}
-//#endregion
 //#region src/features/config/providers/server-builtin-provider.provider.ts
 const SERVER_BUILTIN_PROVIDER_OVERRIDES = [{
 	name: "minimax-portal",
@@ -1005,7 +847,12 @@ const SERVER_BUILTIN_PROVIDER_OVERRIDES = [{
 	detectByKeyPrefix: "",
 	detectByBaseKeyword: "",
 	defaultApiBase: "https://api.minimax.io/v1",
-	defaultModels: ["minimax-portal/MiniMax-M2.5", "minimax-portal/MiniMax-M2.5-highspeed"],
+	defaultModels: [
+		"minimax-portal/MiniMax-M3",
+		"minimax-portal/MiniMax-M2.5",
+		"minimax-portal/MiniMax-M2.5-highspeed"
+	],
+	modelConfig: { "minimax-portal/MiniMax-M3": { vision: true } },
 	stripModelPrefix: false,
 	modelOverrides: [],
 	logo: "minimax.svg",
@@ -1209,15 +1056,33 @@ function readFieldAsString(source, fieldName) {
 function setProviderApiKey({ configPath, provider, accessToken, defaultApiBase }) {
 	const config = loadConfig(configPath);
 	const providers = config.providers;
-	if (!providers[provider]) providers[provider] = createDefaultProviderConfigFromSpec(findServerBuiltinProviderByName(provider));
+	if (!providers[provider]) return;
 	const target = providers[provider];
 	target.apiKey = accessToken;
-	if (!target.apiBase && defaultApiBase) target.apiBase = defaultApiBase;
+	if (defaultApiBase) target.apiBase = defaultApiBase;
 	saveConfig(ConfigSchema.parse(config), configPath);
 }
-async function startProviderAuth(configPath, providerName, options) {
+function resolveProviderAuthTarget(configPath, providerId) {
+	const provider = loadConfig(configPath).providers[providerId];
+	if (!provider) return null;
+	const configuredType = typeof provider.providerType === "string" ? provider.providerType.trim() : "";
+	if (configuredType && findServerBuiltinProviderByName(configuredType)) return {
+		providerId,
+		providerType: configuredType,
+		provider
+	};
+	if (findServerBuiltinProviderByName(providerId)) return {
+		providerId,
+		providerType: providerId,
+		provider
+	};
+	return null;
+}
+async function startProviderAuth(configPath, providerId, options) {
 	cleanupExpiredAuthSessions();
-	const spec = findServerBuiltinProviderByName(providerName);
+	const target = resolveProviderAuthTarget(configPath, providerId);
+	if (!target) return null;
+	const spec = findServerBuiltinProviderByName(target.providerType);
 	if (!spec?.auth || spec.auth.kind !== "device_code") return null;
 	const resolvedMethod = resolveAuthMethod(spec.auth, options?.methodId);
 	const { deviceCodeEndpoint, tokenEndpoint } = resolveDeviceCodeEndpoints(resolvedMethod.baseUrl, resolvedMethod.deviceCodePath, resolvedMethod.tokenPath);
@@ -1291,7 +1156,8 @@ async function startProviderAuth(configPath, providerName, options) {
 	const sessionId = randomUUID();
 	authSessions.set(sessionId, {
 		sessionId,
-		provider: providerName,
+		providerId,
+		providerType: target.providerType,
 		configPath,
 		authorizationCode,
 		tokenCodeField,
@@ -1309,7 +1175,7 @@ async function startProviderAuth(configPath, providerName, options) {
 	const methodLabel = methodConfig ? resolveLocalizedMethodLabel(methodConfig, resolvedMethod.id ?? "") : void 0;
 	const methodHint = methodConfig ? resolveLocalizedMethodHint(methodConfig) : void 0;
 	return {
-		provider: providerName,
+		provider: providerId,
 		kind: "device_code",
 		methodId: resolvedMethod.id,
 		sessionId,
@@ -1321,14 +1187,14 @@ async function startProviderAuth(configPath, providerName, options) {
 	};
 }
 async function pollProviderAuth(params) {
-	const { configPath, providerName, sessionId } = params;
+	const { configPath, providerName: providerId, sessionId } = params;
 	cleanupExpiredAuthSessions();
 	const session = authSessions.get(sessionId);
-	if (!session || session.provider !== providerName || session.configPath !== configPath) return null;
+	if (!session || session.providerId !== providerId || session.configPath !== configPath) return null;
 	if (Date.now() >= session.expiresAtMs) {
 		authSessions.delete(sessionId);
 		return {
-			provider: providerName,
+			provider: providerId,
 			status: "expired",
 			message: "authorization session expired"
 		};
@@ -1357,7 +1223,7 @@ async function pollProviderAuth(params) {
 			payload = {};
 		}
 		if (!response.ok) return {
-			provider: providerName,
+			provider: providerId,
 			status: "error",
 			message: buildMinimaxErrorMessage(payload, raw || response.statusText || "authorization failed")
 		};
@@ -1365,7 +1231,7 @@ async function pollProviderAuth(params) {
 		if (status === "success") {
 			accessToken = payload.access_token?.trim() ?? "";
 			if (!accessToken) return {
-				provider: providerName,
+				provider: providerId,
 				status: "error",
 				message: "provider token response missing access token"
 			};
@@ -1374,7 +1240,7 @@ async function pollProviderAuth(params) {
 			const classified = classifyMiniMaxErrorStatus(message);
 			if (classified === "denied" || classified === "expired") authSessions.delete(sessionId);
 			return {
-				provider: providerName,
+				provider: providerId,
 				status: classified,
 				message
 			};
@@ -1383,7 +1249,7 @@ async function pollProviderAuth(params) {
 			session.intervalMs = nextPollMs;
 			authSessions.set(sessionId, session);
 			return {
-				provider: providerName,
+				provider: providerId,
 				status: "pending",
 				nextPollMs
 			};
@@ -1393,7 +1259,7 @@ async function pollProviderAuth(params) {
 		if (!response.ok) {
 			const errorCode = payload.error?.trim().toLowerCase();
 			if (errorCode === "authorization_pending") return {
-				provider: providerName,
+				provider: providerId,
 				status: "pending",
 				nextPollMs: session.intervalMs
 			};
@@ -1402,7 +1268,7 @@ async function pollProviderAuth(params) {
 				session.intervalMs = nextPollMs;
 				authSessions.set(sessionId, session);
 				return {
-					provider: providerName,
+					provider: providerId,
 					status: "pending",
 					nextPollMs
 				};
@@ -1410,7 +1276,7 @@ async function pollProviderAuth(params) {
 			if (errorCode === "access_denied") {
 				authSessions.delete(sessionId);
 				return {
-					provider: providerName,
+					provider: providerId,
 					status: "denied",
 					message: payload.error_description || "authorization denied"
 				};
@@ -1418,38 +1284,40 @@ async function pollProviderAuth(params) {
 			if (errorCode === "expired_token") {
 				authSessions.delete(sessionId);
 				return {
-					provider: providerName,
+					provider: providerId,
 					status: "expired",
 					message: payload.error_description || "authorization session expired"
 				};
 			}
 			return {
-				provider: providerName,
+				provider: providerId,
 				status: "error",
 				message: payload.error_description || payload.error || response.statusText || "authorization failed"
 			};
 		}
 		accessToken = payload.access_token?.trim() ?? "";
 		if (!accessToken) return {
-			provider: providerName,
+			provider: providerId,
 			status: "error",
 			message: "provider token response missing access token"
 		};
 	}
 	setProviderApiKey({
 		configPath,
-		provider: providerName,
+		provider: providerId,
 		accessToken,
 		defaultApiBase: session.defaultApiBase
 	});
 	authSessions.delete(sessionId);
 	return {
-		provider: providerName,
+		provider: providerId,
 		status: "authorized"
 	};
 }
-async function importProviderAuthFromCli(configPath, providerName) {
-	const spec = findServerBuiltinProviderByName(providerName);
+async function importProviderAuthFromCli(configPath, providerId) {
+	const target = resolveProviderAuthTarget(configPath, providerId);
+	if (!target) return null;
+	const spec = findServerBuiltinProviderByName(target.providerType);
 	if (!spec?.auth || spec.auth.kind !== "device_code" || !spec.auth.cliCredential) return null;
 	const credentialPath = resolveHomePath(spec.auth.cliCredential.path);
 	if (!credentialPath) throw new Error("provider cli credential path is empty");
@@ -1475,12 +1343,12 @@ async function importProviderAuthFromCli(configPath, providerName) {
 	if (typeof expiresAtMs === "number" && expiresAtMs <= Date.now()) throw new Error("CLI credential has expired, please login again");
 	setProviderApiKey({
 		configPath,
-		provider: providerName,
+		provider: providerId,
 		accessToken,
 		defaultApiBase: spec.defaultApiBase
 	});
 	return {
-		provider: providerName,
+		provider: providerId,
 		status: "imported",
 		source: "cli",
 		expiresAt: expiresAtMs ? new Date(expiresAtMs).toISOString() : void 0
@@ -1546,6 +1414,13 @@ var ConfigRoutesController = class {
 		const config = loadConfigOrDefault(this.options.configPath);
 		return c.json(ok(buildConfigMeta(config, this.getExtensionConfigProjectionOptions())));
 	};
+	listProviders = (c) => {
+		const config = loadConfigOrDefault(this.options.configPath);
+		return c.json(ok(buildProvidersView(config)));
+	};
+	listProviderTemplates = (c) => {
+		return c.json(ok(buildProviderTemplatesView()));
+	};
 	getConfigSchema = (c) => {
 		const config = loadConfigOrDefault(this.options.configPath);
 		return c.json(ok(buildConfigSchemaView(config, this.getExtensionConfigProjectionOptions())));
@@ -1576,35 +1451,36 @@ var ConfigRoutesController = class {
 		return c.json(ok(result));
 	};
 	updateProvider = async (c) => {
-		const provider = c.req.param("provider");
+		const providerId = c.req.param("providerId");
 		const body = await readJson(c.req.raw);
 		if (!body.ok) return c.json(err("INVALID_BODY", "invalid json body"), 400);
-		const result = updateProvider(this.options.configPath, provider, body.data);
-		if (!result) return c.json(err("NOT_FOUND", `unknown provider: ${provider}`), 404);
-		await this.publishConfigUpdates([`providers.${provider}`]);
+		const result = updateProvider(this.options.configPath, providerId, body.data);
+		if (!result) return c.json(err("NOT_FOUND", `unknown provider: ${providerId}`), 404);
+		await this.publishConfigUpdates([`providers.${providerId}`]);
 		return c.json(ok(result));
 	};
 	createProvider = async (c) => {
 		const body = await readJson(c.req.raw);
 		if (!body.ok) return c.json(err("INVALID_BODY", "invalid json body"), 400);
-		const result = createCustomProvider(this.options.configPath, body.data);
-		await this.publishConfigUpdates([`providers.${result.name}`]);
+		const result = createProvider(this.options.configPath, body.data);
+		if (!result) return c.json(err("PROVIDER_EXISTS", "provider already exists"), 409);
+		await this.publishConfigUpdates([`providers.${result.providerId}`]);
 		return c.json(ok({
-			name: result.name,
+			providerId: result.providerId,
 			provider: result.provider
 		}));
 	};
 	deleteProvider = async (c) => {
-		const provider = c.req.param("provider");
-		if (deleteCustomProvider(this.options.configPath, provider) === null) return c.json(err("NOT_FOUND", `custom provider not found: ${provider}`), 404);
-		await this.publishConfigUpdates([`providers.${provider}`]);
+		const providerId = c.req.param("providerId");
+		if (deleteProvider(this.options.configPath, providerId) === null) return c.json(err("NOT_FOUND", `provider not found: ${providerId}`), 404);
+		await this.publishConfigUpdates([`providers.${providerId}`]);
 		return c.json(ok({
 			deleted: true,
-			provider
+			providerId
 		}));
 	};
 	testProviderConnection = async (c) => {
-		const provider = c.req.param("provider");
+		const provider = c.req.param("providerId");
 		const body = await readJson(c.req.raw);
 		if (!body.ok) return c.json(err("INVALID_BODY", "invalid json body"), 400);
 		const result = await testProviderConnection(this.options.configPath, provider, body.data, this.options.kernel.llmProviders);
@@ -1612,7 +1488,7 @@ var ConfigRoutesController = class {
 		return c.json(ok(result));
 	};
 	startProviderAuth = async (c) => {
-		const provider = c.req.param("provider");
+		const provider = c.req.param("providerId");
 		let payload = {};
 		const rawBody = await c.req.raw.text();
 		if (rawBody.trim().length > 0) try {
@@ -1631,7 +1507,7 @@ var ConfigRoutesController = class {
 		}
 	};
 	pollProviderAuth = async (c) => {
-		const provider = c.req.param("provider");
+		const provider = c.req.param("providerId");
 		const body = await readJson(c.req.raw);
 		if (!body.ok) return c.json(err("INVALID_BODY", "invalid json body"), 400);
 		const sessionId = typeof body.data.sessionId === "string" ? body.data.sessionId.trim() : "";
@@ -1646,7 +1522,7 @@ var ConfigRoutesController = class {
 		return c.json(ok(result));
 	};
 	importProviderAuthFromCli = async (c) => {
-		const provider = c.req.param("provider");
+		const provider = c.req.param("providerId");
 		try {
 			const result = await importProviderAuthFromCli(this.options.configPath, provider);
 			if (!result) return c.json(err("NOT_SUPPORTED", `provider cli auth import is not supported: ${provider}`), 404);
@@ -2013,11 +1889,6 @@ const PREFERRED_PROVIDER_ORDER_INDEX = new Map([
 ].map((name, index) => [name, index]));
 const BUILTIN_PROVIDERS = listServerBuiltinProviders();
 const BUILTIN_PROVIDER_NAMES = new Set(BUILTIN_PROVIDERS.map((spec) => spec.name));
-const CUSTOM_PROVIDER_WIRE_API_OPTIONS = [
-	"auto",
-	"chat",
-	"responses"
-];
 const CUSTOM_PROVIDER_PREFIX = "custom-";
 const PROVIDER_TEST_MAX_TOKENS = 16;
 function normalizeOptionalDisplayName(value) {
@@ -2035,13 +1906,8 @@ function resolveCustomProviderFallbackDisplayName(name) {
 	}
 	return name;
 }
-function resolveProviderDisplayName(providerName, provider, spec) {
-	const configDisplayName = normalizeOptionalDisplayName(provider?.displayName);
-	if (isCustomProviderName(providerName)) return configDisplayName ?? resolveCustomProviderFallbackDisplayName(providerName);
-	return spec?.displayName ?? configDisplayName ?? spec?.name;
-}
-function listCustomProviderNames(config) {
-	return Object.keys(config.providers).filter((name) => isCustomProviderName(name));
+function resolveProviderInstanceDisplayName(providerId, provider, spec) {
+	return normalizeOptionalDisplayName(provider?.displayName) ?? spec?.displayName ?? (providerId.startsWith(CUSTOM_PROVIDER_PREFIX) ? resolveCustomProviderFallbackDisplayName(providerId) : providerId);
 }
 function findNextCustomProviderName(config) {
 	const providers = config.providers;
@@ -2049,16 +1915,39 @@ function findNextCustomProviderName(config) {
 	while (providers[`${CUSTOM_PROVIDER_PREFIX}${index}`]) index += 1;
 	return `${CUSTOM_PROVIDER_PREFIX}${index}`;
 }
-function ensureProviderConfig(config, providerName) {
+function normalizeProviderId(value) {
+	if (typeof value !== "string") return null;
+	const trimmed = value.trim();
+	if (!trimmed || trimmed.includes("/")) return null;
+	return trimmed;
+}
+function resolveProviderType(providerId, provider) {
+	const configuredType = normalizeProviderId(provider?.providerType);
+	if (configuredType && findServerBuiltinProviderByName(configuredType)) return configuredType;
+	if (findServerBuiltinProviderByName(providerId)) return providerId;
+	return null;
+}
+function findNextProviderId(config, baseProviderId) {
 	const providers = config.providers;
-	const existing = providers[providerName];
-	if (existing) return existing;
-	if (isCustomProviderName(providerName)) return null;
-	const spec = findServerBuiltinProviderByName(providerName);
-	if (!spec) return null;
-	const created = createDefaultProviderConfigFromSpec(spec);
-	providers[providerName] = created;
-	return created;
+	let providerId = baseProviderId;
+	let index = 2;
+	while (providers[providerId]) {
+		providerId = `${baseProviderId}-${index}`;
+		index += 1;
+	}
+	return providerId;
+}
+function resolveProviderDisplayNameSuffix(providerId, baseProviderId) {
+	if (providerId === baseProviderId) return "";
+	const suffix = providerId.slice(baseProviderId.length + 1).trim();
+	return suffix ? ` ${suffix}` : "";
+}
+function buildProviderScopedModels(providerId, models) {
+	return normalizeModelList(models).map((model) => {
+		const slashIndex = model.indexOf("/");
+		const modelSuffix = slashIndex >= 0 ? model.slice(slashIndex + 1).trim() : model;
+		return modelSuffix ? `${providerId}/${modelSuffix}` : "";
+	}).filter(Boolean);
 }
 function clearSecretRefsByPrefix(refs, pathPrefix) {
 	return Object.fromEntries(Object.entries(refs).filter(([key]) => key !== pathPrefix && !key.startsWith(`${pathPrefix}.`)));
@@ -2223,13 +2112,18 @@ function normalizeModelList(input) {
 	}
 	return [...deduped];
 }
-function toProviderView(config, provider, providerName, uiHints, spec) {
-	const apiKeyRefSet = hasSecretRef(config, `providers.${providerName}.apiKey`);
+function toProviderView(config, provider, providerId, uiHints, spec) {
+	const providerType = resolveProviderType(providerId, provider);
+	const apiKeyRefSet = hasSecretRef(config, `providers.${providerId}.apiKey`);
 	const masked = maskApiKey(provider.apiKey);
-	const extraHeaders = provider.extraHeaders && Object.keys(provider.extraHeaders).length > 0 ? sanitizePublicConfigValue(provider.extraHeaders, `providers.${providerName}.extraHeaders`, uiHints) : null;
+	const extraHeaders = provider.extraHeaders && Object.keys(provider.extraHeaders).length > 0 ? sanitizePublicConfigValue(provider.extraHeaders, `providers.${providerId}.extraHeaders`, uiHints) : null;
 	const view = {
+		providerId,
+		providerType,
+		isBuiltInType: providerType !== null,
+		isCustom: providerType === null,
 		enabled: provider.enabled !== false,
-		displayName: resolveProviderDisplayName(providerName, provider, spec),
+		displayName: resolveProviderInstanceDisplayName(providerId, provider, spec),
 		apiKeySet: masked.apiKeySet || apiKeyRefSet,
 		apiKeyMasked: masked.apiKeyMasked ?? (apiKeyRefSet ? "****" : void 0),
 		apiBase: provider.apiBase ?? null,
@@ -2237,14 +2131,17 @@ function toProviderView(config, provider, providerName, uiHints, spec) {
 		models: normalizeModelList(provider.models ?? []),
 		modelConfig: normalizeProviderModelConfig(provider.modelConfig ?? {})
 	};
-	if (Boolean(spec?.supportsWireApi) || isCustomProviderName(providerName)) view.wireApi = provider.wireApi ?? spec?.defaultWireApi ?? "auto";
+	if (Boolean(spec?.supportsWireApi) || providerType === null) view.wireApi = provider.wireApi ?? spec?.defaultWireApi ?? "auto";
 	return view;
 }
 function buildConfigView(config, options) {
 	const uiHints = buildUiHints(config, options);
 	const projectedChannels = getProjectedChannelMap(config, options);
 	const providers = {};
-	for (const [name, provider] of Object.entries(config.providers)) providers[name] = toProviderView(config, provider, name, uiHints, findServerBuiltinProviderByName(name));
+	for (const [providerId, provider] of Object.entries(config.providers)) {
+		const providerConfig = provider;
+		providers[providerId] = toProviderView(config, providerConfig, providerId, uiHints, findServerBuiltinProviderByName(resolveProviderType(providerId, providerConfig) ?? ""));
+	}
 	return {
 		companion: sanitizePublicConfigValue(config.companion, "companion", uiHints),
 		agents: sanitizePublicConfigValue(config.agents, "agents", uiHints),
@@ -2323,13 +2220,18 @@ function clearSecretRef(refs, path) {
 	return nextRefs;
 }
 function buildConfigMeta(config, options) {
-	const configProviders = config.providers;
-	const builtinProviders = BUILTIN_PROVIDERS.map((spec) => {
-		const providerConfig = configProviders[spec.name];
+	return {
+		search: SEARCH_PROVIDER_META,
+		channels: buildProjectedChannelMeta(config, options)
+	};
+}
+function buildProviderTemplatesView() {
+	return { providerTemplates: BUILTIN_PROVIDERS.map((spec) => {
 		return {
-			name: spec.name,
-			displayName: resolveProviderDisplayName(spec.name, providerConfig, spec),
-			isCustom: false,
+			id: spec.name,
+			providerType: spec.name,
+			displayName: spec.displayName ?? spec.name,
+			apiProtocol: spec.apiProtocol,
 			modelPrefix: spec.modelPrefix,
 			keywords: spec.keywords,
 			envKey: spec.envKey,
@@ -2357,43 +2259,22 @@ function buildConfigMeta(config, options) {
 			defaultWireApi: spec.defaultWireApi
 		};
 	}).sort((left, right) => {
-		const leftRank = PREFERRED_PROVIDER_ORDER_INDEX.get(left.name);
-		const rightRank = PREFERRED_PROVIDER_ORDER_INDEX.get(right.name);
+		const leftRank = PREFERRED_PROVIDER_ORDER_INDEX.get(left.id);
+		const rightRank = PREFERRED_PROVIDER_ORDER_INDEX.get(right.id);
 		if (leftRank !== void 0 && rightRank !== void 0) return leftRank - rightRank;
 		if (leftRank !== void 0) return -1;
 		if (rightRank !== void 0) return 1;
-		return left.name.localeCompare(right.name);
-	});
-	return {
-		providers: [...listCustomProviderNames(config).sort((left, right) => left.localeCompare(right, void 0, {
-			numeric: true,
-			sensitivity: "base"
-		})).map((name) => {
-			const providerConfig = configProviders[name];
-			const displayName = resolveProviderDisplayName(name, providerConfig);
-			return {
-				name,
-				displayName,
-				isCustom: true,
-				modelPrefix: name,
-				keywords: normalizeModelList([name, displayName ?? ""]),
-				envKey: "OPENAI_API_KEY",
-				isGateway: false,
-				isLocal: false,
-				defaultApiBase: void 0,
-				logo: void 0,
-				apiBaseHelp: void 0,
-				auth: void 0,
-				defaultModels: [],
-				modelConfig: {},
-				supportsWireApi: true,
-				wireApiOptions: CUSTOM_PROVIDER_WIRE_API_OPTIONS,
-				defaultWireApi: "auto"
-			};
-		}), ...builtinProviders],
-		search: SEARCH_PROVIDER_META,
-		channels: buildProjectedChannelMeta(config, options)
-	};
+		return left.id.localeCompare(right.id);
+	}) };
+}
+function buildProvidersView(config) {
+	const uiHints = buildUiHints(config);
+	const providers = {};
+	for (const [providerId, provider] of Object.entries(config.providers)) {
+		const providerConfig = provider;
+		providers[providerId] = toProviderView(config, providerConfig, providerId, uiHints, findServerBuiltinProviderByName(resolveProviderType(providerId, providerConfig) ?? ""));
+	}
+	return { providers };
 }
 function buildConfigSchemaView(_config, options) {
 	const base = buildConfigSchema({ version: getPackageVersion() });
@@ -2456,60 +2337,67 @@ function updateModel(configPath, patch) {
 	saveConfig(next, configPath);
 	return buildConfigView(next);
 }
-function updateProvider(configPath, providerName, patch) {
+function updateProvider(configPath, providerId, patch) {
 	const config = loadConfigOrDefault(configPath);
-	const provider = ensureProviderConfig(config, providerName);
+	const provider = config.providers[providerId];
 	if (!provider) return null;
-	const spec = findServerBuiltinProviderByName(providerName);
-	const isCustom = isCustomProviderName(providerName);
-	if (Object.prototype.hasOwnProperty.call(patch, "displayName") && isCustom) provider.displayName = normalizeOptionalDisplayName(patch.displayName) ?? "";
+	const currentProviderType = resolveProviderType(providerId, provider);
+	const spec = findServerBuiltinProviderByName((Object.prototype.hasOwnProperty.call(patch, "providerType") ? normalizeProviderId(patch.providerType) : currentProviderType) ?? "");
+	if (Object.prototype.hasOwnProperty.call(patch, "providerType")) provider.providerType = spec?.name ?? null;
+	if (Object.prototype.hasOwnProperty.call(patch, "displayName")) provider.displayName = normalizeOptionalDisplayName(patch.displayName) ?? "";
 	if (Object.prototype.hasOwnProperty.call(patch, "enabled")) provider.enabled = patch.enabled !== false;
 	if (Object.prototype.hasOwnProperty.call(patch, "apiKey")) {
 		provider.apiKey = patch.apiKey ?? "";
-		config.secrets.refs = clearSecretRef(config.secrets.refs, `providers.${providerName}.apiKey`);
+		config.secrets.refs = clearSecretRef(config.secrets.refs, `providers.${providerId}.apiKey`);
 	}
 	if (Object.prototype.hasOwnProperty.call(patch, "apiBase")) provider.apiBase = patch.apiBase ?? null;
 	if (Object.prototype.hasOwnProperty.call(patch, "extraHeaders")) provider.extraHeaders = patch.extraHeaders ?? null;
-	if (Object.prototype.hasOwnProperty.call(patch, "wireApi") && (spec?.supportsWireApi || isCustom)) provider.wireApi = patch.wireApi ?? spec?.defaultWireApi ?? "auto";
+	if (Object.prototype.hasOwnProperty.call(patch, "wireApi") && (spec?.supportsWireApi || !spec)) provider.wireApi = patch.wireApi ?? spec?.defaultWireApi ?? "auto";
 	if (Object.prototype.hasOwnProperty.call(patch, "models")) provider.models = normalizeModelList(patch.models ?? []);
 	if (Object.prototype.hasOwnProperty.call(patch, "modelConfig")) provider.modelConfig = normalizeProviderModelConfig(patch.modelConfig ?? {});
 	const next = ConfigSchema.parse(config);
 	saveConfig(next, configPath);
 	const uiHints = buildUiHints(next);
-	const updated = next.providers[providerName];
-	return toProviderView(next, updated, providerName, uiHints, spec ?? void 0);
+	const updated = next.providers[providerId];
+	return toProviderView(next, updated, providerId, uiHints, spec ?? void 0);
 }
-function createCustomProvider(configPath, patch = {}) {
+function createProvider(configPath, patch = {}) {
 	const config = loadConfigOrDefault(configPath);
-	const providerName = findNextCustomProviderName(config);
 	const providers = config.providers;
-	const generatedDisplayName = resolveCustomProviderFallbackDisplayName(providerName);
-	providers[providerName] = {
+	const requestedProviderType = normalizeProviderId(patch.providerType);
+	const spec = requestedProviderType ? findServerBuiltinProviderByName(requestedProviderType) : void 0;
+	const fallbackProviderId = spec ? spec.name : findNextCustomProviderName(config);
+	const requestedProviderId = normalizeProviderId(patch.providerId);
+	if (requestedProviderId && providers[requestedProviderId]) return null;
+	const providerId = requestedProviderId ? requestedProviderId : findNextProviderId(config, fallbackProviderId);
+	const generatedDisplayName = spec ? `${spec.displayName}${resolveProviderDisplayNameSuffix(providerId, spec.name)}` : resolveCustomProviderFallbackDisplayName(providerId);
+	const defaultModels = spec ? buildProviderScopedModels(providerId, spec.defaultModels ?? []) : [];
+	providers[providerId] = {
 		enabled: patch.enabled !== false,
+		providerType: spec?.name ?? null,
 		displayName: normalizeOptionalDisplayName(patch.displayName) ?? generatedDisplayName,
 		apiKey: normalizeOptionalString(patch.apiKey) ?? "",
-		apiBase: normalizeOptionalString(patch.apiBase),
+		apiBase: normalizeOptionalString(patch.apiBase) ?? spec?.defaultApiBase ?? null,
 		extraHeaders: normalizeHeaders(patch.extraHeaders ?? null),
-		wireApi: patch.wireApi ?? "auto",
-		models: normalizeModelList(patch.models ?? []),
-		modelConfig: normalizeProviderModelConfig(patch.modelConfig ?? {})
+		wireApi: patch.wireApi ?? spec?.defaultWireApi ?? "auto",
+		models: Object.prototype.hasOwnProperty.call(patch, "models") ? normalizeModelList(patch.models ?? []) : defaultModels,
+		modelConfig: normalizeProviderModelConfig(patch.modelConfig ?? spec?.modelConfig ?? {})
 	};
 	const next = ConfigSchema.parse(config);
 	saveConfig(next, configPath);
 	const uiHints = buildUiHints(next);
-	const created = next.providers[providerName];
+	const created = next.providers[providerId];
 	return {
-		name: providerName,
-		provider: toProviderView(next, created, providerName, uiHints)
+		providerId,
+		provider: toProviderView(next, created, providerId, uiHints, spec)
 	};
 }
-function deleteCustomProvider(configPath, providerName) {
-	if (!isCustomProviderName(providerName)) return null;
+function deleteProvider(configPath, providerId) {
 	const config = loadConfigOrDefault(configPath);
 	const providers = config.providers;
-	if (!providers[providerName]) return null;
-	delete providers[providerName];
-	config.secrets.refs = clearSecretRefsByPrefix(config.secrets.refs, `providers.${providerName}`);
+	if (!providers[providerId]) return null;
+	delete providers[providerId];
+	config.secrets.refs = clearSecretRefsByPrefix(config.secrets.refs, `providers.${providerId}`);
 	saveConfig(ConfigSchema.parse(config), configPath);
 	return true;
 }
@@ -2549,32 +2437,35 @@ function buildScopedProviderModel(providerName, model, spec) {
 	if (!prefix) return trimmed;
 	return `${prefix}/${trimmed}`;
 }
-function resolveTestModel(config, providerName, requestedModel, provider, spec) {
-	if (requestedModel) {
-		if (isCustomProviderName(providerName)) {
-			const prefix = `${providerName}/`;
-			if (requestedModel.startsWith(prefix)) return requestedModel.slice(prefix.length) || null;
-		}
-		return requestedModel;
-	}
-	const providerModels = normalizeModelList(provider.models ?? []).map((modelId) => buildScopedProviderModel(providerName, modelId, spec)).filter((modelId) => modelId.length > 0);
+function stripProviderIdPrefix(providerId, model) {
+	const prefix = `${providerId}/`;
+	if (!model.startsWith(prefix)) return model;
+	return model.slice(prefix.length).trim() || model;
+}
+function resolveTestModel(config, providerId, requestedModel, provider, spec) {
+	if (requestedModel) return spec ? requestedModel.replace(`${providerId}/`, `${spec.name}/`) : stripProviderIdPrefix(providerId, requestedModel);
+	const providerModels = normalizeModelList(provider.models ?? []).map((modelId) => {
+		const providerModel = stripProviderIdPrefix(providerId, modelId);
+		return spec ? buildScopedProviderModel(spec.name, providerModel, spec) : providerModel;
+	}).filter((modelId) => modelId.length > 0);
 	if (providerModels.length > 0) return providerModels[0];
 	const defaultModel = normalizeOptionalString(config.agents.defaults.model);
 	if (defaultModel) {
 		const routedProvider = getProviderName(config, defaultModel);
-		if (!routedProvider || routedProvider === providerName) return defaultModel;
+		if (!routedProvider || routedProvider === providerId) return spec ? defaultModel.replace(`${providerId}/`, `${spec.name}/`) : stripProviderIdPrefix(providerId, defaultModel);
 	}
-	if (isCustomProviderName(providerName)) return null;
+	if (!spec) return null;
 	return normalizeModelList(spec?.defaultModels ?? [])[0] ?? null ?? defaultModel ?? null;
 }
 function stringifyError(error) {
 	return (error instanceof Error ? error.message : String(error)).replace(/\s+/g, " ").trim();
 }
-async function testProviderConnection(configPath, providerName, patch, providerManager) {
+async function testProviderConnection(configPath, providerId, patch, providerManager) {
 	const config = loadConfigOrDefault(configPath);
-	const provider = ensureProviderConfig(config, providerName);
+	const provider = config.providers[providerId];
 	if (!provider) return null;
-	const spec = findServerBuiltinProviderByName(providerName);
+	const providerType = resolveProviderType(providerId, provider);
+	const spec = findServerBuiltinProviderByName(providerType ?? "");
 	const hasApiKeyPatch = Object.prototype.hasOwnProperty.call(patch, "apiKey");
 	const providedApiKey = normalizeOptionalString(patch.apiKey);
 	const currentApiKey = normalizeOptionalString(provider.apiKey);
@@ -2584,32 +2475,31 @@ async function testProviderConnection(configPath, providerName, patch, providerM
 	const currentApiBase = normalizeOptionalString(provider.apiBase);
 	const apiBase = hasApiBasePatch ? patchedApiBase ?? spec?.defaultApiBase ?? null : currentApiBase ?? spec?.defaultApiBase ?? null;
 	const extraHeaders = Object.prototype.hasOwnProperty.call(patch, "extraHeaders") ? normalizeHeaders(patch.extraHeaders ?? null) : normalizeHeaders(provider.extraHeaders ?? null);
-	const isCustom = isCustomProviderName(providerName);
-	const wireApi = spec?.supportsWireApi || isCustom ? patch.wireApi ?? provider.wireApi ?? spec?.defaultWireApi ?? "auto" : null;
+	const wireApi = spec?.supportsWireApi || !spec ? patch.wireApi ?? provider.wireApi ?? spec?.defaultWireApi ?? "auto" : null;
 	if (!apiKey && !spec?.isLocal) return {
 		success: false,
-		provider: providerName,
+		provider: providerId,
 		latencyMs: 0,
 		message: "API key is required before testing the connection."
 	};
-	const model = resolveTestModel(config, providerName, normalizeOptionalString(patch.model), provider, spec ?? void 0);
+	const model = resolveTestModel(config, providerId, normalizeOptionalString(patch.model), provider, spec ?? void 0);
 	if (!model) return {
 		success: false,
-		provider: providerName,
+		provider: providerId,
 		latencyMs: 0,
 		message: "No test model found. Configure provider models or set a default model for this provider, then try again."
 	};
 	const startedAtMs = Date.now();
 	if (!providerManager) return {
 		success: false,
-		provider: providerName,
+		provider: providerId,
 		model,
 		latencyMs: Date.now() - startedAtMs,
 		message: "Provider manager is unavailable."
 	};
 	try {
 		await providerManager.testConnection({
-			providerName,
+			providerName: providerType,
 			apiKey,
 			apiBase,
 			defaultModel: model,
@@ -2623,7 +2513,7 @@ async function testProviderConnection(configPath, providerName, patch, providerM
 		});
 		return {
 			success: true,
-			provider: providerName,
+			provider: providerId,
 			model,
 			latencyMs: Date.now() - startedAtMs,
 			message: "Connection test passed."
@@ -2631,7 +2521,7 @@ async function testProviderConnection(configPath, providerName, patch, providerM
 	} catch (error) {
 		return {
 			success: false,
-			provider: providerName,
+			provider: providerId,
 			model,
 			latencyMs: Date.now() - startedAtMs,
 			message: stringifyError(error) || "Connection test failed."
@@ -3447,6 +3337,8 @@ var McpMarketplaceController = class {
 //#endregion
 //#region src/features/marketplace/utils/marketplace-installed.utils.ts
 const getWorkspacePathFromConfig = NextclawCore.getWorkspacePathFromConfig;
+const MARKETPLACE_INSTALL_STATE_FILE = ".nextclaw-install.json";
+const LEGACY_MARKETPLACE_INSTALL_STATE_FILE = ".nextclaw-marketplace.json";
 function createSkillsLoader(workspace) {
 	const ctor = NextclawCore.SkillsLoader;
 	if (!ctor) return null;
@@ -3460,14 +3352,21 @@ function collectInstalledSkillRecords(options) {
 		const metadata = skillsLoader?.getSkillMetadata?.(skill);
 		const description = readNonEmptyString(metadata?.description);
 		const descriptionZh = readNonEmptyString(metadata?.description_zh) ?? readNonEmptyString(metadata?.descriptionZh) ?? readNonEmptyString(MARKETPLACE_ZH_COPY_BY_SLUG[skill.name]?.description);
+		const marketplaceState = readMarketplaceSkillInstallState(dirname(skill.path));
+		const origin = marketplaceState ? "marketplace" : void 0;
+		const catalogSlug = marketplaceState?.slug;
+		const installedAt = marketplaceState?.installedAt;
 		return {
 			type: "skill",
 			id: skill.name,
 			spec: skill.name,
 			label: skill.name,
-			...description ? { description } : {},
-			...descriptionZh ? { descriptionZh } : {},
+			description,
+			descriptionZh,
 			source: skill.source,
+			origin,
+			catalogSlug,
+			installedAt,
 			enabled,
 			runtimeStatus: enabled ? "enabled" : "disabled"
 		};
@@ -3477,6 +3376,20 @@ function collectInstalledSkillRecords(options) {
 		records
 	};
 }
+function readMarketplaceSkillInstallState(destinationDir) {
+	const statePath = [MARKETPLACE_INSTALL_STATE_FILE, LEGACY_MARKETPLACE_INSTALL_STATE_FILE].map((file) => join(destinationDir, file)).find((path) => existsSync(path));
+	if (!statePath) return null;
+	try {
+		const parsed = JSON.parse(readFileSync(statePath, "utf8"));
+		if (parsed.schemaVersion !== 1 || parsed.type !== "skill" || parsed.source !== "marketplace" || typeof parsed.slug !== "string") return null;
+		return {
+			slug: parsed.slug,
+			installedAt: typeof parsed.installedAt === "string" ? parsed.installedAt : void 0
+		};
+	} catch {
+		return null;
+	}
+}
 function collectSkillMarketplaceInstalledView(options) {
 	const installed = collectInstalledSkillRecords(options);
 	return {
@@ -3531,9 +3444,24 @@ async function manageMarketplaceSkill(params) {
 	const { body, options } = params;
 	const action = body.action;
 	const targetId = typeof body.id === "string" && body.id.trim().length > 0 ? body.id.trim() : typeof body.spec === "string" && body.spec.trim().length > 0 ? body.spec.trim() : "";
-	if (action !== "uninstall" || !targetId) throw new Error("INVALID_BODY:skill manage requires uninstall action and non-empty id/spec");
+	if (action !== "update" && action !== "uninstall" || !targetId) throw new Error("INVALID_BODY:skill manage requires update/uninstall action and non-empty id/spec");
 	const installer = options.marketplace?.installer;
 	if (!installer) throw new Error("NOT_AVAILABLE:marketplace installer is not configured");
+	if (action === "update") {
+		if (!installer.updateSkill) throw new Error("NOT_AVAILABLE:skill update is not configured");
+		const result = await installer.updateSkill({
+			slug: targetId,
+			force: body.force
+		});
+		emitConfigUpdated(options, "skills");
+		return {
+			type: "skill",
+			action,
+			id: targetId,
+			message: result.message,
+			output: result.output
+		};
+	}
 	if (!installer.uninstallSkill) throw new Error("NOT_AVAILABLE:skill uninstall is not configured");
 	const result = await installer.uninstallSkill(targetId);
 	emitConfigUpdated(options, "skills");
@@ -4402,6 +4330,13 @@ var ServiceAppsRoutesController = class {
 			return this.handleServiceAppError(c, error);
 		}
 	};
+	deleteServiceApp = async (c) => {
+		try {
+			return c.json(ok(await this.params.serviceAppManager.deleteServiceApp(c.req.param("appId"))));
+		} catch (error) {
+			return this.handleServiceAppError(c, error);
+		}
+	};
 	requireBridgeSession = (c) => {
 		const token = c.req.raw.headers.get(PANEL_BRIDGE_SESSION_HEADER)?.trim();
 		if (!token) throw new Error("panel app bridge session is required");
@@ -4825,182 +4760,8 @@ var UiRouteRegistry = class {
 			ncpAsset.getAssetContent
 		]]);
 	};
-	register = () => {
-		const { agents, app, auth, config, cron, ncpAsset, ncpSession, panelApps, serviceApps, remote, runtimeControl, runtimeUpdate, serverPath } = this.controllers;
-		this.mountRoutes([
-			[
-				"get",
-				"/api/health",
-				app.health
-			],
-			[
-				"get",
-				"/api/app/meta",
-				app.appMeta
-			],
-			[
-				"get",
-				"/api/runtime/bootstrap-status",
-				app.bootstrapStatus
-			],
-			[
-				"get",
-				"/api/auth/status",
-				auth.getStatus
-			],
-			[
-				"post",
-				"/api/auth/setup",
-				auth.setup
-			],
-			[
-				"post",
-				"/api/auth/login",
-				auth.login
-			],
-			[
-				"post",
-				"/api/auth/logout",
-				auth.logout
-			],
-			[
-				"put",
-				"/api/auth/password",
-				auth.updatePassword
-			],
-			[
-				"put",
-				"/api/auth/enabled",
-				auth.updateEnabled
-			],
-			[
-				"post",
-				"/api/auth/bridge",
-				auth.issueBridgeSession
-			],
-			[
-				"get",
-				"/api/agents",
-				agents.listAgents
-			],
-			[
-				"post",
-				"/api/agents",
-				agents.createAgent
-			],
-			[
-				"put",
-				"/api/agents/:agentId",
-				agents.updateAgent
-			],
-			[
-				"delete",
-				"/api/agents/:agentId",
-				agents.deleteAgent
-			],
-			[
-				"get",
-				"/api/agents/:agentId/avatar",
-				agents.getAgentAvatar
-			]
-		]);
-		this.mountRoutes([
-			[
-				"get",
-				"/api/config",
-				config.getConfig
-			],
-			[
-				"get",
-				"/api/config/meta",
-				config.getConfigMeta
-			],
-			[
-				"get",
-				"/api/config/schema",
-				config.getConfigSchema
-			],
-			[
-				"put",
-				"/api/config/model",
-				config.updateConfigModel
-			],
-			[
-				"put",
-				"/api/config/search",
-				config.updateConfigSearch
-			],
-			[
-				"put",
-				"/api/config/providers/:provider",
-				config.updateProvider
-			],
-			[
-				"post",
-				"/api/config/providers",
-				config.createProvider
-			],
-			[
-				"delete",
-				"/api/config/providers/:provider",
-				config.deleteProvider
-			],
-			[
-				"post",
-				"/api/config/providers/:provider/test",
-				config.testProviderConnection
-			],
-			[
-				"post",
-				"/api/config/providers/:provider/auth/start",
-				config.startProviderAuth
-			],
-			[
-				"post",
-				"/api/config/providers/:provider/auth/poll",
-				config.pollProviderAuth
-			],
-			[
-				"post",
-				"/api/config/providers/:provider/auth/import-cli",
-				config.importProviderAuthFromCli
-			],
-			[
-				"put",
-				"/api/config/channels/:channel",
-				config.updateChannel
-			],
-			[
-				"post",
-				"/api/config/channels/:channel/auth/start",
-				config.startChannelAuth
-			],
-			[
-				"post",
-				"/api/config/channels/:channel/auth/connect",
-				config.connectChannelAuth
-			],
-			[
-				"post",
-				"/api/config/channels/:channel/auth/poll",
-				config.pollChannelAuth
-			],
-			[
-				"put",
-				"/api/config/secrets",
-				config.updateSecrets
-			],
-			[
-				"put",
-				"/api/config/runtime",
-				config.updateRuntime
-			],
-			[
-				"post",
-				"/api/config/actions/:actionId/execute",
-				config.executeAction
-			]
-		]);
+	mountResourceRoutes = () => {
+		const { ncpSession, panelApps, serviceApps, serverPath } = this.controllers;
 		this.mountRoutes([
 			[
 				"get",
@@ -5122,6 +4883,11 @@ var UiRouteRegistry = class {
 				"/api/service-apps/:appId",
 				serviceApps.getServiceApp
 			],
+			[
+				"delete",
+				"/api/service-apps/:appId",
+				serviceApps.deleteServiceApp
+			],
 			[
 				"get",
 				"/api/service-actions",
@@ -5163,6 +4929,194 @@ var UiRouteRegistry = class {
 				serverPath.read
 			]
 		]);
+	};
+	register = () => {
+		const { agents, app, auth, config, cron, ncpAsset, remote, runtimeControl, runtimeUpdate } = this.controllers;
+		this.mountRoutes([
+			[
+				"get",
+				"/api/health",
+				app.health
+			],
+			[
+				"get",
+				"/api/app/meta",
+				app.appMeta
+			],
+			[
+				"get",
+				"/api/runtime/bootstrap-status",
+				app.bootstrapStatus
+			],
+			[
+				"get",
+				"/api/auth/status",
+				auth.getStatus
+			],
+			[
+				"post",
+				"/api/auth/setup",
+				auth.setup
+			],
+			[
+				"post",
+				"/api/auth/login",
+				auth.login
+			],
+			[
+				"post",
+				"/api/auth/logout",
+				auth.logout
+			],
+			[
+				"put",
+				"/api/auth/password",
+				auth.updatePassword
+			],
+			[
+				"put",
+				"/api/auth/enabled",
+				auth.updateEnabled
+			],
+			[
+				"post",
+				"/api/auth/bridge",
+				auth.issueBridgeSession
+			],
+			[
+				"get",
+				"/api/agents",
+				agents.listAgents
+			],
+			[
+				"post",
+				"/api/agents",
+				agents.createAgent
+			],
+			[
+				"put",
+				"/api/agents/:agentId",
+				agents.updateAgent
+			],
+			[
+				"delete",
+				"/api/agents/:agentId",
+				agents.deleteAgent
+			],
+			[
+				"get",
+				"/api/agents/:agentId/avatar",
+				agents.getAgentAvatar
+			]
+		]);
+		this.mountRoutes([
+			[
+				"get",
+				"/api/config",
+				config.getConfig
+			],
+			[
+				"get",
+				"/api/config/meta",
+				config.getConfigMeta
+			],
+			[
+				"get",
+				"/api/config/schema",
+				config.getConfigSchema
+			],
+			[
+				"get",
+				"/api/providers",
+				config.listProviders
+			],
+			[
+				"get",
+				"/api/provider-templates",
+				config.listProviderTemplates
+			],
+			[
+				"post",
+				"/api/providers",
+				config.createProvider
+			],
+			[
+				"put",
+				"/api/providers/:providerId",
+				config.updateProvider
+			],
+			[
+				"delete",
+				"/api/providers/:providerId",
+				config.deleteProvider
+			],
+			[
+				"post",
+				"/api/providers/:providerId/test",
+				config.testProviderConnection
+			],
+			[
+				"post",
+				"/api/providers/:providerId/auth/start",
+				config.startProviderAuth
+			],
+			[
+				"post",
+				"/api/providers/:providerId/auth/poll",
+				config.pollProviderAuth
+			],
+			[
+				"post",
+				"/api/providers/:providerId/auth/import-cli",
+				config.importProviderAuthFromCli
+			],
+			[
+				"put",
+				"/api/config/model",
+				config.updateConfigModel
+			],
+			[
+				"put",
+				"/api/config/search",
+				config.updateConfigSearch
+			],
+			[
+				"put",
+				"/api/config/channels/:channel",
+				config.updateChannel
+			],
+			[
+				"post",
+				"/api/config/channels/:channel/auth/start",
+				config.startChannelAuth
+			],
+			[
+				"post",
+				"/api/config/channels/:channel/auth/connect",
+				config.connectChannelAuth
+			],
+			[
+				"post",
+				"/api/config/channels/:channel/auth/poll",
+				config.pollChannelAuth
+			],
+			[
+				"put",
+				"/api/config/secrets",
+				config.updateSecrets
+			],
+			[
+				"put",
+				"/api/config/runtime",
+				config.updateRuntime
+			],
+			[
+				"post",
+				"/api/config/actions/:actionId/execute",
+				config.executeAction
+			]
+		]);
+		this.mountResourceRoutes();
 		this.mountNcpAgentRoutes(this.options.kernel, ncpAsset);
 		this.mountRoutes([
 			[
@@ -5317,7 +5271,7 @@ var UiRouteRegistry = class {
 function createUiRouter(options, authServiceOverride) {
 	const app = new Hono();
 	const marketplaceBaseUrl = normalizeMarketplaceBaseUrl(options);
-	const authService = authServiceOverride ?? options.authService ?? new UiAuthService(options.configPath);
+	const authService = authServiceOverride ?? options.authService ?? new UiAuthService(options.kernel.accessManager ?? new AccessManager({ configPath: options.configPath }));
 	const controllers = createUiRouteControllers(options, authService, marketplaceBaseUrl);
 	app.notFound((c) => c.json(err("NOT_FOUND", "endpoint not found"), 404));
 	app.use("/api/*", async (c, next) => {
@@ -5431,7 +5385,7 @@ async function startUiServer(gateway) {
 	const app = new Hono();
 	app.use("/*", compress());
 	const corsPolicy = corsOrigins ?? DEFAULT_CORS_ORIGINS;
-	const authService = new UiAuthService(gateway.configPath);
+	const authService = new UiAuthService(gateway.kernel.accessManager ?? new AccessManager({ configPath: gateway.configPath }));
 	app.use("/api/*", async (c, next) => {
 		const allowOrigin = resolveAllowedCorsOrigin(c.req.header("origin")?.trim() ?? null, corsPolicy);
 		const allowHeaders = c.req.header("access-control-request-headers")?.trim() ?? null;
@@ -5479,6 +5433,6 @@ async function startUiServer(gateway) {
 	};
 }
 //#endregion
-export { ConfigRoutesController, PanelAppsRoutesController, RuntimeControlRoutesController, ServiceAppsRoutesController, buildConfigMeta, buildConfigSchemaView, buildConfigView, createCustomProvider, createUiRouter, deleteCustomProvider, ensureUiBridgeSecret, executeConfigAction, getUiBridgeSecretPath, loadConfigOrDefault, readUiBridgeSecret, startUiServer, testProviderConnection, updateChannel, updateModel, updateProvider, updateRuntime, updateSearch, updateSecrets };
+export { ConfigRoutesController, PanelAppsRoutesController, RuntimeControlRoutesController, ServiceAppsRoutesController, buildConfigMeta, buildConfigSchemaView, buildConfigView, buildProviderTemplatesView, buildProvidersView, createProvider, createUiRouter, deleteProvider, ensureUiBridgeSecret, executeConfigAction, getUiBridgeSecretPath, loadConfigOrDefault, readUiBridgeSecret, startUiServer, testProviderConnection, updateChannel, updateModel, updateProvider, updateRuntime, updateSearch, updateSecrets };
 
 //# sourceMappingURL=index.js.map