@nextclaw/server 0.15.21 → 0.15.23

package/dist/index.js

@@ -8,9 +8,9 @@ import { mkdir, open, readFile, readdir, realpath, stat } from "node:fs/promises
 import { basename, dirname, extname, isAbsolute, join, parse, relative, resolve, sep } from "node:path";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import * as NextclawCore from "@nextclaw/core";
-import { ConfigSchema, DEFAULT_WORKSPACE_PATH, buildConfigSchema, createAgentProfile, expandHome, findEffectiveAgentProfile, getDataDir, getPackageVersion, getProviderName, hasSecretRef, isSensitiveConfigPath, loadConfig, mergeExtensionConfigView, normalizeModelThinkingCapability, normalizeProviderModelConfig, probeFeishu, readAgentAvatarContent, removeAgentProfile, resolveEffectiveAgentProfiles, saveConfig, toExtensionConfigView, updateAgentProfile } from "@nextclaw/core";
-import { homedir, platform } from "node:os";
+import { ConfigSchema, DEFAULT_WORKSPACE_PATH, ProviderModelDiscoveryHttpError, buildConfigSchema, createAgentProfile, expandHome, findEffectiveAgentProfile, getDataDir, getPackageVersion, getProviderName, hasSecretRef, isSensitiveConfigPath, loadConfig, mergeExtensionConfigView, normalizeModelThinkingCapability, normalizeProviderModelConfig, probeFeishu, readAgentAvatarContent, removeAgentProfile, resolveEffectiveAgentProfiles, saveConfig, toExtensionConfigView, updateAgentProfile } from "@nextclaw/core";
 import { findBuiltinProviderByName, listBuiltinProviders } from "@nextclaw/runtime";
+import { homedir, platform } from "node:os";
 import { McpInstalledViewService } from "@nextclaw/mcp";
 import { serveStatic } from "hono/serve-static";
 //#region src/features/auth/utils/auth-bridge.utils.ts
@@ -316,13 +316,15 @@ var EventStreamAuthService = class {
 	authenticateExtension = (request) => {
 		const token = readBearerToken(readHeaderValue(request.headers.authorization));
 		const extensionId = readHeaderValue(request.headers["x-nextclaw-extension-id"]);
+		const generation = readHeaderValue(request.headers["x-nextclaw-extension-generation"]);
 		const result = this.deps.extensionAuth?.authenticateEventStreamCredential({
 			extensionId,
+			generation,
 			token
 		});
 		if (!result) return null;
 		return {
-			principalId: `extension:${result.extensionId}`,
+			principalId: `extension:${result.extensionId}:${result.generation}`,
 			grants: [
 				"event-stream:extension-requests",
 				"event-stream:ncp-events",
@@ -330,7 +332,12 @@ var EventStreamAuthService = class {
 			],
 			scopes: {
 				extensionIds: [result.extensionId],
+				extensionGenerations: [`${result.extensionId}:${result.generation}`],
 				channelIds: this.getExtensionChannelIds(result.extensionId)
+			},
+			extension: {
+				id: result.extensionId,
+				generation: result.generation
 			}
 		};
 	};
@@ -364,7 +371,11 @@ function hasScopeValue(principal, key, value) {
 	return Boolean(value && scopeValues(principal, key).includes(value));
 }
 function readExtensionRequestTarget(event) {
-	return readString(readRecord(event.payload).extensionId);
+	const payload = readRecord(event.payload);
+	return {
+		extensionId: readString(payload.extensionId),
+		generation: readString(payload.generation)
+	};
 }
 function parseAgentSessionChannel(sessionId) {
 	if (!sessionId) return null;
@@ -379,7 +390,10 @@ function readNcpEventChannel(event) {
 	return readString(metadata.channelId) ?? readString(metadata.channel) ?? parseAgentSessionChannel(readString(message.sessionId) ?? readString(payload.sessionId));
 }
 function canStreamAppEventToPrincipal(principal, event) {
-	if (event.type === "extension.request") return hasGrant(principal, "event-stream:extension-requests") && hasScopeValue(principal, "extensionIds", readExtensionRequestTarget(event));
+	if (event.type === "extension.request") {
+		const target = readExtensionRequestTarget(event);
+		return hasGrant(principal, "event-stream:extension-requests") && hasScopeValue(principal, "extensionIds", target.extensionId) && hasScopeValue(principal, "extensionGenerations", target.extensionId && target.generation ? `${target.extensionId}:${target.generation}` : null);
+	}
 	if (event.type === "ncp.event") {
 		if (hasGrant(principal, "event-stream:ui-events")) return true;
 		return hasGrant(principal, "event-stream:ncp-events") && hasScopeValue(principal, "channelIds", readNcpEventChannel(event));
@@ -397,6 +411,13 @@ function canStreamAppEventToPrincipal(principal, event) {
 var EventStreamClientRegistry = class {
 	clients = /* @__PURE__ */ new Set();
 	add = (socket, principal) => {
+		const extensionId = principal.extension?.id;
+		if (extensionId) {
+			for (const existing of this.clients) if (existing.principal.extension?.id === extensionId) {
+				this.clients.delete(existing);
+				existing.socket.close();
+			}
+		}
 		const client = {
 			socket,
 			principal
@@ -453,11 +474,14 @@ const ingressKeys = {
 		channelMessageSubmit: createTypedKey("extension.channel.message.submit"),
 		channelCommandList: createTypedKey("extension.channel.command.list"),
 		channelCommandExecute: createTypedKey("extension.channel.command.execute"),
+		runtimeReady: createTypedKey("extension.runtime.ready"),
 		response: createTypedKey("extension.response")
 	},
 	agentRun: {
 		send: createTypedKey("agent-run.send"),
 		abort: createTypedKey("agent-run.abort"),
+		editMessage: createTypedKey("agent-run.edit-message"),
+		continue: createTypedKey("agent-run.continue"),
 		sessionMessageRequest: createTypedKey("agent-run.session-message.request")
 	}
 };
@@ -583,6 +607,10 @@ var AgentsRoutesController = class {
 		const body = await readJson(c.req.raw);
 		if (!body.ok) return c.json(err("INVALID_BODY", "invalid json body"), 400);
 		try {
+			if (typeof body.data.contextTokens === "number") await this.options.kernel.agentContextWindowManager.assertCanSave({
+				agentId: body.data.id,
+				contextTokens: body.data.contextTokens
+			});
 			const agent = createAgent(this.options.configPath, body.data, { initializeAgentHomeDirectory: this.options.initializeAgentHomeDirectory });
 			await this.publishAgentUpdates(["agents.list"]);
 			return c.json(ok(agent));
@@ -595,6 +623,10 @@ var AgentsRoutesController = class {
 		const body = await readJson(c.req.raw);
 		if (!body.ok) return c.json(err("INVALID_BODY", "invalid json body"), 400);
 		try {
+			if (typeof body.data.contextTokens === "number") await this.options.kernel.agentContextWindowManager.assertCanSave({
+				agentId,
+				contextTokens: body.data.contextTokens
+			});
 			const agent = updateAgent(this.options.configPath, agentId, body.data);
 			await this.publishAgentUpdates(["agents.list"]);
 			return c.json(ok(agent));
@@ -667,8 +699,92 @@ var AppRoutesController = class {
 	}));
 	appMeta = (c) => c.json(ok(buildAppMetaView(this.options)));
 	bootstrapStatus = (c) => c.json(ok(this.options.bootstrapStatus?.getStatus() ?? buildFallbackBootstrapStatus()));
+	extensionRuntimeStatus = (c) => c.json(ok(this.options.extensions?.getRuntimeStatus?.() ?? []));
 };
 //#endregion
+//#region src/features/config/providers/server-builtin-provider.provider.ts
+const SERVER_BUILTIN_PROVIDER_OVERRIDES = [{
+	name: "minimax-portal",
+	keywords: ["minimax-portal", "minimax"],
+	envKey: "MINIMAX_PORTAL_TOKEN",
+	displayName: "MiniMax Portal",
+	modelPrefix: "minimax-portal",
+	litellmPrefix: "minimax-portal",
+	skipPrefixes: ["minimax-portal/"],
+	envExtras: [],
+	isGateway: false,
+	isLocal: false,
+	detectByKeyPrefix: "",
+	detectByBaseKeyword: "",
+	defaultApiBase: "https://api.minimax.io/v1",
+	defaultModels: [
+		"minimax-portal/MiniMax-M3",
+		"minimax-portal/MiniMax-M2.5",
+		"minimax-portal/MiniMax-M2.5-highspeed"
+	],
+	modelDiscovery: false,
+	modelConfig: { "minimax-portal/MiniMax-M3": { vision: true } },
+	stripModelPrefix: false,
+	modelOverrides: [],
+	logo: "minimax.svg",
+	apiBaseHelp: {
+		zh: "OAuth Global 默认使用 https://api.minimax.io/v1；OAuth 中国区默认使用 https://api.minimaxi.com/v1。",
+		en: "OAuth Global uses https://api.minimax.io/v1 by default; OAuth CN uses https://api.minimaxi.com/v1."
+	},
+	auth: {
+		kind: "device_code",
+		protocol: "minimax_user_code",
+		displayName: "MiniMax OAuth",
+		baseUrl: "https://api.minimax.io",
+		deviceCodePath: "/oauth/code",
+		tokenPath: "/oauth/token",
+		clientId: "78257093-7e40-4613-99e0-527b14b39113",
+		scope: "group_id profile model.completion",
+		grantType: "urn:ietf:params:oauth:grant-type:user_code",
+		usePkce: true,
+		defaultMethodId: "cn",
+		methods: [{
+			id: "global",
+			label: {
+				zh: "Global（海外）",
+				en: "Global"
+			},
+			hint: {
+				zh: "适用于海外用户，默认 API Base 为 https://api.minimax.io/v1。",
+				en: "For international users. Default API base: https://api.minimax.io/v1."
+			},
+			baseUrl: "https://api.minimax.io",
+			defaultApiBase: "https://api.minimax.io/v1"
+		}, {
+			id: "cn",
+			label: {
+				zh: "中国区（CN）",
+				en: "China Mainland (CN)"
+			},
+			hint: {
+				zh: "适用于中国区用户，默认 API Base 为 https://api.minimaxi.com/v1。",
+				en: "For Mainland China users. Default API base: https://api.minimaxi.com/v1."
+			},
+			baseUrl: "https://api.minimaxi.com",
+			defaultApiBase: "https://api.minimaxi.com/v1"
+		}],
+		note: {
+			zh: "通过浏览器完成 MiniMax OAuth 授权后即可使用，无需手动填写 API Key。",
+			en: "Complete MiniMax OAuth in browser to use this provider without manually entering an API key."
+		}
+	}
+}];
+const SERVER_BUILTIN_PROVIDER_OVERRIDE_MAP = new Map(SERVER_BUILTIN_PROVIDER_OVERRIDES.map((provider) => [provider.name, provider]));
+function listServerBuiltinProviders() {
+	const merged = /* @__PURE__ */ new Map();
+	for (const provider of listBuiltinProviders()) merged.set(provider.name, provider);
+	for (const provider of SERVER_BUILTIN_PROVIDER_OVERRIDES) merged.set(provider.name, provider);
+	return Array.from(merged.values());
+}
+function findServerBuiltinProviderByName(name) {
+	return SERVER_BUILTIN_PROVIDER_OVERRIDE_MAP.get(name) ?? findBuiltinProviderByName(name);
+}
+//#endregion
 //#region src/features/config/utils/extension-channel-config-projection.utils.ts
 const DOCS_BASE_URL = "https://docs.nextclaw.io";
 const CHANNEL_TUTORIAL_URLS = {
@@ -758,1000 +874,569 @@ function mergeProjectedExtensionChannelConfig(config, channelName, mergedChannel
 	});
 }
 //#endregion
-//#region src/features/config/utils/channel-auth.utils.ts
-function cloneChannelConfig(value) {
-	if (!value || typeof value !== "object" || Array.isArray(value)) return;
-	return JSON.parse(JSON.stringify(value));
-}
-function findExtensionChannelBinding(bindings, channelId) {
-	const normalizedChannelId = channelId.trim().toLowerCase();
-	return bindings.find((binding) => binding.channelId.trim().toLowerCase() === normalizedChannelId) ?? null;
-}
-function toPublicChannelAuthPollResult(result) {
+//#region src/features/config/utils/default-provider-config.utils.ts
+function createDefaultProviderConfig(defaultWireApi = "auto", defaultModels = [], modelConfig = {}, providerType, defaultApiBase = null) {
 	return {
-		channel: result.channel,
-		status: result.status,
-		message: result.message,
-		nextPollMs: result.nextPollMs,
-		accountId: result.accountId,
-		notes: result.notes
+		enabled: true,
+		providerType,
+		displayName: "",
+		apiKey: "",
+		apiBase: defaultApiBase,
+		extraHeaders: null,
+		wireApi: defaultWireApi,
+		models: [...defaultModels],
+		modelConfig
 	};
 }
-function applyAuthorizedChannelAuthResult(params) {
-	const { configPath, binding, result } = params;
-	if (result.status !== "authorized" || !result.channelConfig) return;
-	const currentConfig = loadConfigOrDefault(configPath);
-	saveConfig({
-		...currentConfig,
-		channels: {
-			...currentConfig.channels,
-			[binding.channelId]: result.channelConfig
-		}
-	}, configPath);
+function createDefaultProviderConfigFromSpec(spec) {
+	return createDefaultProviderConfig(spec?.defaultWireApi ?? "auto", spec?.defaultModels ?? [], normalizeProviderModelConfig(spec?.modelConfig ?? {}), spec?.name, spec?.defaultApiBase ?? null);
 }
-async function startChannelAuth(params) {
-	const { configPath, channelId, request, bindings } = params;
-	const binding = findExtensionChannelBinding(bindings, channelId);
-	const start = binding?.channel.auth?.start;
-	if (!binding || !start) return null;
-	const configView = getProjectedConfigView(loadConfigOrDefault(configPath), { extensionChannelBindings: bindings });
-	return await start({
-		cfg: configView,
-		extensionId: binding.extensionId,
-		channelId: binding.channelId,
-		channelConfig: cloneChannelConfig(configView.channels?.[binding.channelId]),
-		accountId: request.accountId?.trim() || null,
-		baseUrl: request.baseUrl?.trim() || null,
-		domain: request.domain?.trim() || null
-	});
+//#endregion
+//#region src/features/config/utils/runtime-entry-config.utils.ts
+function normalizeOptionalString$2(value) {
+	if (typeof value !== "string") return null;
+	const trimmed = value.trim();
+	return trimmed.length > 0 ? trimmed : null;
 }
-async function pollChannelAuth(params) {
-	const { configPath, channelId, sessionId, bindings } = params;
-	const binding = findExtensionChannelBinding(bindings, channelId);
-	const poll = binding?.channel.auth?.poll;
-	if (!binding || !poll) return null;
-	const configView = getProjectedConfigView(loadConfigOrDefault(configPath), { extensionChannelBindings: bindings });
-	const result = await poll({
-		cfg: configView,
-		extensionId: binding.extensionId,
-		channelId: binding.channelId,
-		channelConfig: cloneChannelConfig(configView.channels?.[binding.channelId]),
-		sessionId
-	});
-	if (!result) return null;
-	applyAuthorizedChannelAuthResult({
-		configPath,
-		binding,
-		result
-	});
-	return toPublicChannelAuthPollResult(result);
+function normalizePositiveInteger(value) {
+	const parsed = typeof value === "number" ? value : typeof value === "string" ? Number.parseInt(value, 10) : NaN;
+	if (!Number.isFinite(parsed)) return null;
+	const normalized = Math.trunc(parsed);
+	return normalized > 0 ? normalized : null;
 }
-async function connectChannelAuth(params) {
-	const { configPath, channelId, request, bindings } = params;
-	const binding = findExtensionChannelBinding(bindings, channelId);
-	const connect = binding?.channel.auth?.connect;
-	if (!binding || !connect) return null;
-	const configView = getProjectedConfigView(loadConfigOrDefault(configPath), { extensionChannelBindings: bindings });
-	const result = await connect({
-		cfg: configView,
-		extensionId: binding.extensionId,
-		channelId: binding.channelId,
-		channelConfig: cloneChannelConfig(configView.channels?.[binding.channelId]),
-		accountId: request.accountId?.trim() || null,
-		domain: request.domain?.trim() || null,
-		fields: request.fields
-	});
-	applyAuthorizedChannelAuthResult({
-		configPath,
-		binding,
-		result
-	});
-	return toPublicChannelAuthPollResult(result);
+function normalizeStringArray(value) {
+	if (!Array.isArray(value)) return null;
+	const entries = value.map((entry) => normalizeOptionalString$2(entry)).filter((entry) => Boolean(entry));
+	return entries.length > 0 ? entries : null;
+}
+function normalizeUnknownStringRecord(value) {
+	if (!value || typeof value !== "object" || Array.isArray(value)) return null;
+	const entries = Object.entries(value).map(([key, entryValue]) => [key.trim(), normalizeOptionalString$2(entryValue)]).filter(([key, entryValue]) => key.length > 0 && Boolean(entryValue));
+	return entries.length > 0 ? Object.fromEntries(entries) : null;
+}
+function normalizeRuntimeModelSelectionMode(value) {
+	if (value === "nextclaw" || value === "optional" || value === "runtime-default") return value;
+	return null;
+}
+function normalizeRuntimeEntryConfig(type, config) {
+	const runtimeDefaultThinking = normalizeModelThinkingCapability(config.runtimeDefaultThinking);
+	if (type !== "narp-stdio") return {
+		...Object.fromEntries(Object.entries(config).filter(([key]) => key !== "runtimeDefaultThinking")),
+		...runtimeDefaultThinking ? { runtimeDefaultThinking } : {}
+	};
+	const command = normalizeOptionalString$2(config.command);
+	const args = normalizeStringArray(config.args);
+	const cwd = normalizeOptionalString$2(config.cwd);
+	const wireDialect = normalizeOptionalString$2(config.wireDialect) ?? "acp";
+	const processScope = normalizeOptionalString$2(config.processScope) ?? "per-session";
+	const modelSelectionMode = normalizeRuntimeModelSelectionMode(config.modelSelectionMode);
+	const supportedModels = normalizeStringArray(config.supportedModels);
+	const model = normalizeOptionalString$2(config.model);
+	const recommendedModel = normalizeOptionalString$2(config.recommendedModel);
+	return {
+		wireDialect,
+		processScope,
+		...command ? { command } : {},
+		...args ? { args } : {},
+		env: normalizeUnknownStringRecord(config.env) ?? {},
+		...cwd ? { cwd } : {},
+		...modelSelectionMode ? { modelSelectionMode } : {},
+		...model ? { model } : {},
+		...recommendedModel ? { recommendedModel } : {},
+		...supportedModels ? { supportedModels } : {},
+		...runtimeDefaultThinking ? { runtimeDefaultThinking } : {},
+		startupTimeoutMs: normalizePositiveInteger(config.startupTimeoutMs) ?? 8e3,
+		probeTimeoutMs: normalizePositiveInteger(config.probeTimeoutMs) ?? 3e3,
+		requestTimeoutMs: normalizePositiveInteger(config.requestTimeoutMs) ?? 12e4
+	};
 }
 //#endregion
-//#region src/features/config/providers/server-builtin-provider.provider.ts
-const SERVER_BUILTIN_PROVIDER_OVERRIDES = [{
-	name: "minimax-portal",
-	keywords: ["minimax-portal", "minimax"],
-	envKey: "MINIMAX_PORTAL_TOKEN",
-	displayName: "MiniMax Portal",
-	modelPrefix: "minimax-portal",
-	litellmPrefix: "minimax-portal",
-	skipPrefixes: ["minimax-portal/"],
-	envExtras: [],
-	isGateway: false,
-	isLocal: false,
-	detectByKeyPrefix: "",
-	detectByBaseKeyword: "",
-	defaultApiBase: "https://api.minimax.io/v1",
-	defaultModels: [
-		"minimax-portal/MiniMax-M3",
-		"minimax-portal/MiniMax-M2.5",
-		"minimax-portal/MiniMax-M2.5-highspeed"
-	],
-	modelConfig: { "minimax-portal/MiniMax-M3": { vision: true } },
-	stripModelPrefix: false,
-	modelOverrides: [],
-	logo: "minimax.svg",
-	apiBaseHelp: {
-		zh: "OAuth Global 默认使用 https://api.minimax.io/v1；OAuth 中国区默认使用 https://api.minimaxi.com/v1。",
-		en: "OAuth Global uses https://api.minimax.io/v1 by default; OAuth CN uses https://api.minimaxi.com/v1."
-	},
-	auth: {
-		kind: "device_code",
-		protocol: "minimax_user_code",
-		displayName: "MiniMax OAuth",
-		baseUrl: "https://api.minimax.io",
-		deviceCodePath: "/oauth/code",
-		tokenPath: "/oauth/token",
-		clientId: "78257093-7e40-4613-99e0-527b14b39113",
-		scope: "group_id profile model.completion",
-		grantType: "urn:ietf:params:oauth:grant-type:user_code",
-		usePkce: true,
-		defaultMethodId: "cn",
-		methods: [{
-			id: "global",
-			label: {
-				zh: "Global（海外）",
-				en: "Global"
-			},
-			hint: {
-				zh: "适用于海外用户，默认 API Base 为 https://api.minimax.io/v1。",
-				en: "For international users. Default API base: https://api.minimax.io/v1."
-			},
-			baseUrl: "https://api.minimax.io",
-			defaultApiBase: "https://api.minimax.io/v1"
-		}, {
-			id: "cn",
-			label: {
-				zh: "中国区（CN）",
-				en: "China Mainland (CN)"
-			},
-			hint: {
-				zh: "适用于中国区用户，默认 API Base 为 https://api.minimaxi.com/v1。",
-				en: "For Mainland China users. Default API base: https://api.minimaxi.com/v1."
-			},
-			baseUrl: "https://api.minimaxi.com",
-			defaultApiBase: "https://api.minimaxi.com/v1"
-		}],
-		note: {
-			zh: "通过浏览器完成 MiniMax OAuth 授权后即可使用，无需手动填写 API Key。",
-			en: "Complete MiniMax OAuth in browser to use this provider without manually entering an API key."
-		}
-	}
-}];
-const SERVER_BUILTIN_PROVIDER_OVERRIDE_MAP = new Map(SERVER_BUILTIN_PROVIDER_OVERRIDES.map((provider) => [provider.name, provider]));
-function listServerBuiltinProviders() {
-	const merged = /* @__PURE__ */ new Map();
-	for (const provider of listBuiltinProviders()) merged.set(provider.name, provider);
-	for (const provider of SERVER_BUILTIN_PROVIDER_OVERRIDES) merged.set(provider.name, provider);
-	return Array.from(merged.values());
+//#region src/features/config/utils/search-config.utils.ts
+const MASK_MIN_LENGTH$1 = 8;
+const BOCHA_OPEN_URL = "https://open.bocha.cn";
+const TAVILY_DOCS_URL = "https://docs.tavily.com/documentation/api-reference/endpoint/search";
+const EXA_DOCS_URL = "https://exa.ai/docs/reference/search";
+const SEARCH_PROVIDER_NAMES = [
+	"bocha",
+	"tavily",
+	"brave",
+	"exa"
+];
+function normalizeOptionalString$1(value) {
+	if (typeof value !== "string") return null;
+	const trimmed = value.trim();
+	return trimmed.length > 0 ? trimmed : null;
 }
-function findServerBuiltinProviderByName(name) {
-	return SERVER_BUILTIN_PROVIDER_OVERRIDE_MAP.get(name) ?? findBuiltinProviderByName(name);
+function maskApiKey$1(value) {
+	if (!value) return { apiKeySet: false };
+	if (value.length < MASK_MIN_LENGTH$1) return {
+		apiKeySet: true,
+		apiKeyMasked: "****"
+	};
+	return {
+		apiKeySet: true,
+		apiKeyMasked: `${value.slice(0, 2)}****${value.slice(-4)}`
+	};
 }
-//#endregion
-//#region src/features/config/utils/provider-auth.utils.ts
-const authSessions = /* @__PURE__ */ new Map();
-const DEFAULT_AUTH_INTERVAL_MS = 2e3;
-const MAX_AUTH_INTERVAL_MS = 1e4;
-function normalizePositiveInt(value, fallback) {
-	if (typeof value !== "number" || !Number.isFinite(value) || value <= 0) return fallback;
-	return Math.floor(value);
+function clearSecretRef$1(refs, path) {
+	if (!refs[path]) return refs;
+	const nextRefs = { ...refs };
+	delete nextRefs[path];
+	return nextRefs;
 }
-function normalizePositiveFloat(value) {
-	if (typeof value !== "number" || !Number.isFinite(value) || value <= 0) return null;
-	return value;
+function isSearchProviderName(value) {
+	return typeof value === "string" && SEARCH_PROVIDER_NAMES.some((providerName) => providerName === value);
 }
-function toBase64Url(buffer) {
-	return buffer.toString("base64").replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/g, "");
+const SEARCH_PROVIDER_META = [
+	{
+		name: "bocha",
+		displayName: "Bocha Search",
+		description: "China-friendly web search with AI-ready summaries.",
+		docsUrl: BOCHA_OPEN_URL,
+		isDefault: true,
+		supportsSummary: true
+	},
+	{
+		name: "tavily",
+		displayName: "Tavily Search",
+		description: "Research-focused web search with optional synthesized answers.",
+		docsUrl: TAVILY_DOCS_URL,
+		supportsSummary: true
+	},
+	{
+		name: "brave",
+		displayName: "Brave Search",
+		description: "Brave web search API kept as an optional provider.",
+		supportsSummary: false
+	},
+	{
+		name: "exa",
+		displayName: "Exa Search",
+		description: "Semantic web search with extracted page content.",
+		docsUrl: EXA_DOCS_URL,
+		supportsSummary: true
+	}
+];
+function toSearchProviderView(config, providerName, provider) {
+	const apiKeyRefSet = hasSecretRef(config, `search.providers.${providerName}.apiKey`);
+	const masked = maskApiKey$1(provider.apiKey);
+	const view = {
+		enabled: config.search.enabledProviders.includes(providerName),
+		apiKeySet: masked.apiKeySet || apiKeyRefSet,
+		apiKeyMasked: masked.apiKeyMasked ?? (apiKeyRefSet ? "****" : void 0),
+		baseUrl: provider.baseUrl
+	};
+	if ("docsUrl" in provider) view.docsUrl = provider.docsUrl;
+	if ("summary" in provider) view.summary = provider.summary;
+	if ("freshness" in provider) view.freshness = provider.freshness;
+	if ("searchDepth" in provider) view.searchDepth = provider.searchDepth;
+	if ("includeAnswer" in provider) view.includeAnswer = Boolean(provider.includeAnswer);
+	return view;
 }
-function buildPkce() {
-	const verifier = toBase64Url(randomBytes(48));
+function buildSearchView(config) {
 	return {
-		verifier,
-		challenge: toBase64Url(createHash("sha256").update(verifier).digest())
+		provider: config.search.provider,
+		enabledProviders: [...config.search.enabledProviders],
+		defaults: { maxResults: config.search.defaults.maxResults },
+		providers: {
+			bocha: toSearchProviderView(config, "bocha", config.search.providers.bocha),
+			tavily: toSearchProviderView(config, "tavily", config.search.providers.tavily),
+			brave: toSearchProviderView(config, "brave", config.search.providers.brave),
+			exa: toSearchProviderView(config, "exa", config.search.providers.exa)
+		}
 	};
 }
-function withTrailingSlash(value) {
-	return value.endsWith("/") ? value : `${value}/`;
-}
-function cleanupExpiredAuthSessions(now = Date.now()) {
-	for (const [sessionId, session] of authSessions.entries()) if (session.expiresAtMs <= now) authSessions.delete(sessionId);
-}
-function resolveDeviceCodeEndpoints(baseUrl, deviceCodePath, tokenPath) {
+function replaceSearchConfig(config, search, refs = config.secrets.refs) {
 	return {
-		deviceCodeEndpoint: new URL(deviceCodePath, withTrailingSlash(baseUrl)).toString(),
-		tokenEndpoint: new URL(tokenPath, withTrailingSlash(baseUrl)).toString()
+		...config,
+		search,
+		secrets: refs === config.secrets.refs ? config.secrets : {
+			...config.secrets,
+			refs
+		}
 	};
 }
-function resolveAuthNote(params) {
-	return params.zh ?? params.en;
-}
-function resolveLocalizedMethodLabel(method, fallbackId) {
-	return method.label?.zh ?? method.label?.en ?? fallbackId;
+function applyActiveSearchProviderPatch(config, provider) {
+	if (!isSearchProviderName(provider)) return config;
+	return replaceSearchConfig(config, {
+		...config.search,
+		provider
+	});
 }
-function resolveLocalizedMethodHint(method) {
-	return method.hint?.zh ?? method.hint?.en;
+function applyEnabledSearchProvidersPatch(config, enabledProviders) {
+	if (!Array.isArray(enabledProviders)) return config;
+	const nextEnabledProviders = Array.from(new Set(enabledProviders.filter((value) => isSearchProviderName(value))));
+	return replaceSearchConfig(config, {
+		...config.search,
+		enabledProviders: nextEnabledProviders
+	});
 }
-function normalizeMethodId(value) {
-	if (typeof value !== "string") return;
-	const trimmed = value.trim();
-	return trimmed.length > 0 ? trimmed : void 0;
+function applySearchDefaultsPatch(config, defaults) {
+	if (!defaults || !Object.prototype.hasOwnProperty.call(defaults, "maxResults")) return config;
+	const nextMaxResults = defaults.maxResults;
+	if (typeof nextMaxResults === "number" && Number.isFinite(nextMaxResults)) return replaceSearchConfig(config, {
+		...config.search,
+		defaults: {
+			...config.search.defaults,
+			maxResults: Math.max(1, Math.min(50, Math.trunc(nextMaxResults)))
+		}
+	});
+	return config;
 }
-function resolveAuthMethod(auth, requestedMethodId) {
-	const protocol = auth.protocol ?? "rfc8628";
-	const methods = (auth.methods ?? []).filter((entry) => normalizeMethodId(entry.id));
-	const cleanRequestedMethodId = normalizeMethodId(requestedMethodId);
-	if (methods.length === 0) {
-		if (cleanRequestedMethodId) throw new Error(`provider auth method is not supported: ${cleanRequestedMethodId}`);
-		return {
-			protocol,
-			baseUrl: auth.baseUrl,
-			deviceCodePath: auth.deviceCodePath,
-			tokenPath: auth.tokenPath,
-			clientId: auth.clientId,
-			scope: auth.scope,
-			grantType: auth.grantType,
-			usePkce: Boolean(auth.usePkce)
+function applyBochaSearchPatch(config, patch) {
+	if (!patch) return config;
+	let nextRefs = config.secrets.refs;
+	let nextProvider = config.search.providers.bocha;
+	if (Object.prototype.hasOwnProperty.call(patch, "apiKey")) {
+		nextProvider = {
+			...nextProvider,
+			apiKey: patch.apiKey ?? ""
 		};
+		nextRefs = clearSecretRef$1(nextRefs, "search.providers.bocha.apiKey");
 	}
-	let selectedMethod = methods.find((entry) => normalizeMethodId(entry.id) === cleanRequestedMethodId);
-	if (!selectedMethod) {
-		const fallbackMethodId = normalizeMethodId(auth.defaultMethodId) ?? normalizeMethodId(methods[0]?.id);
-		selectedMethod = methods.find((entry) => normalizeMethodId(entry.id) === fallbackMethodId) ?? methods[0];
-	}
-	const methodId = normalizeMethodId(selectedMethod?.id);
-	if (!selectedMethod || !methodId) throw new Error("provider auth method is not configured");
-	if (cleanRequestedMethodId && methodId !== cleanRequestedMethodId) throw new Error(`provider auth method is not supported: ${cleanRequestedMethodId}`);
-	return {
-		id: methodId,
-		protocol,
-		baseUrl: selectedMethod.baseUrl ?? auth.baseUrl,
-		deviceCodePath: selectedMethod.deviceCodePath ?? auth.deviceCodePath,
-		tokenPath: selectedMethod.tokenPath ?? auth.tokenPath,
-		clientId: selectedMethod.clientId ?? auth.clientId,
-		scope: selectedMethod.scope ?? auth.scope,
-		grantType: selectedMethod.grantType ?? auth.grantType,
-		usePkce: selectedMethod.usePkce ?? Boolean(auth.usePkce),
-		defaultApiBase: selectedMethod.defaultApiBase
+	if (Object.prototype.hasOwnProperty.call(patch, "baseUrl")) nextProvider = {
+		...nextProvider,
+		baseUrl: normalizeOptionalString$1(patch.baseUrl) ?? "https://api.bocha.cn/v1/web-search"
+	};
+	if (Object.prototype.hasOwnProperty.call(patch, "docsUrl")) nextProvider = {
+		...nextProvider,
+		docsUrl: normalizeOptionalString$1(patch.docsUrl) ?? BOCHA_OPEN_URL
 	};
+	if (Object.prototype.hasOwnProperty.call(patch, "summary")) nextProvider = {
+		...nextProvider,
+		summary: Boolean(patch.summary)
+	};
+	if (Object.prototype.hasOwnProperty.call(patch, "freshness")) {
+		const freshness = normalizeOptionalString$1(patch.freshness);
+		nextProvider = {
+			...nextProvider,
+			freshness: freshness === "noLimit" || freshness === "oneDay" || freshness === "oneWeek" || freshness === "oneMonth" || freshness === "oneYear" ? freshness : "noLimit"
+		};
+	}
+	return replaceSearchConfig(config, {
+		...config.search,
+		providers: {
+			...config.search.providers,
+			bocha: nextProvider
+		}
+	}, nextRefs);
 }
-function parseExpiresAtMs(value, fallbackFromNowMs) {
-	const normalized = normalizePositiveFloat(value);
-	if (normalized === null) return Date.now() + fallbackFromNowMs;
-	if (normalized >= 0xe8d4a51000) return Math.floor(normalized);
-	if (normalized >= 1e9) return Math.floor(normalized * 1e3);
-	return Date.now() + Math.floor(normalized * 1e3);
+function applyTavilySearchPatch(config, patch) {
+	if (!patch) return config;
+	let nextRefs = config.secrets.refs;
+	let nextProvider = config.search.providers.tavily;
+	if (Object.prototype.hasOwnProperty.call(patch, "apiKey")) {
+		nextProvider = {
+			...nextProvider,
+			apiKey: patch.apiKey ?? ""
+		};
+		nextRefs = clearSecretRef$1(nextRefs, "search.providers.tavily.apiKey");
+	}
+	if (Object.prototype.hasOwnProperty.call(patch, "baseUrl")) nextProvider = {
+		...nextProvider,
+		baseUrl: normalizeOptionalString$1(patch.baseUrl) ?? "https://api.tavily.com/search"
+	};
+	if (Object.prototype.hasOwnProperty.call(patch, "searchDepth")) {
+		const searchDepth = normalizeOptionalString$1(patch.searchDepth);
+		nextProvider = {
+			...nextProvider,
+			searchDepth: searchDepth === "advanced" ? "advanced" : "basic"
+		};
+	}
+	if (Object.prototype.hasOwnProperty.call(patch, "includeAnswer")) nextProvider = {
+		...nextProvider,
+		includeAnswer: Boolean(patch.includeAnswer)
+	};
+	return replaceSearchConfig(config, {
+		...config.search,
+		providers: {
+			...config.search.providers,
+			tavily: nextProvider
+		}
+	}, nextRefs);
 }
-function parsePollIntervalMs(value, fallbackMs) {
-	const normalized = normalizePositiveFloat(value);
-	if (normalized === null) return fallbackMs;
-	if (normalized <= 30) return Math.floor(normalized * 1e3);
-	return Math.floor(normalized);
+function applyBraveSearchPatch(config, patch) {
+	if (!patch) return config;
+	let nextRefs = config.secrets.refs;
+	let nextProvider = config.search.providers.brave;
+	if (Object.prototype.hasOwnProperty.call(patch, "apiKey")) {
+		nextProvider = {
+			...nextProvider,
+			apiKey: patch.apiKey ?? ""
+		};
+		nextRefs = clearSecretRef$1(nextRefs, "search.providers.brave.apiKey");
+	}
+	if (Object.prototype.hasOwnProperty.call(patch, "baseUrl")) nextProvider = {
+		...nextProvider,
+		baseUrl: normalizeOptionalString$1(patch.baseUrl) ?? "https://api.search.brave.com/res/v1/web/search"
+	};
+	return replaceSearchConfig(config, {
+		...config.search,
+		providers: {
+			...config.search.providers,
+			brave: nextProvider
+		}
+	}, nextRefs);
 }
-function buildMinimaxErrorMessage(payload, fallback) {
-	if (!payload || typeof payload !== "object" || Array.isArray(payload)) return fallback;
-	const record = payload;
-	if (typeof record.error_description === "string" && record.error_description.trim()) return record.error_description.trim();
-	if (typeof record.error === "string" && record.error.trim()) return record.error.trim();
-	const baseMessage = record.base_resp?.status_msg;
-	if (typeof baseMessage === "string" && baseMessage.trim()) return baseMessage.trim();
-	return fallback;
+function applyExaSearchPatch(config, patch) {
+	if (!patch) return config;
+	let nextRefs = config.secrets.refs;
+	let nextProvider = config.search.providers.exa;
+	if (Object.prototype.hasOwnProperty.call(patch, "apiKey")) {
+		nextProvider = {
+			...nextProvider,
+			apiKey: patch.apiKey ?? ""
+		};
+		nextRefs = clearSecretRef$1(nextRefs, "search.providers.exa.apiKey");
+	}
+	if (Object.prototype.hasOwnProperty.call(patch, "baseUrl")) nextProvider = {
+		...nextProvider,
+		baseUrl: normalizeOptionalString$1(patch.baseUrl) ?? "https://api.exa.ai/search"
+	};
+	return replaceSearchConfig(config, {
+		...config.search,
+		providers: {
+			...config.search.providers,
+			exa: nextProvider
+		}
+	}, nextRefs);
 }
-function classifyMiniMaxErrorStatus(message) {
-	const normalized = message.toLowerCase();
-	if (normalized.includes("deny") || normalized.includes("rejected")) return "denied";
-	if (normalized.includes("expired") || normalized.includes("timeout") || normalized.includes("timed out")) return "expired";
-	return "error";
+function updateSearch(configPath, patch) {
+	let nextConfig = loadConfig(configPath);
+	nextConfig = applyActiveSearchProviderPatch(nextConfig, patch.provider);
+	nextConfig = applyEnabledSearchProvidersPatch(nextConfig, patch.enabledProviders);
+	nextConfig = applySearchDefaultsPatch(nextConfig, patch.defaults);
+	nextConfig = applyBochaSearchPatch(nextConfig, patch.providers?.bocha);
+	nextConfig = applyTavilySearchPatch(nextConfig, patch.providers?.tavily);
+	nextConfig = applyBraveSearchPatch(nextConfig, patch.providers?.brave);
+	nextConfig = applyExaSearchPatch(nextConfig, patch.providers?.exa);
+	const next = ConfigSchema.parse(nextConfig);
+	saveConfig(next, configPath);
+	return buildSearchView(next);
 }
-function resolveHomePath(inputPath) {
-	const trimmed = inputPath.trim();
-	if (!trimmed) return trimmed;
-	if (trimmed === "~") return homedir();
-	if (trimmed.startsWith("~/")) return resolve(homedir(), trimmed.slice(2));
-	if (isAbsolute(trimmed)) return trimmed;
-	return resolve(trimmed);
+//#endregion
+//#region src/features/config/stores/server-config.store.ts
+const MASK_MIN_LENGTH = 8;
+const EXTRA_SENSITIVE_PATH_PATTERNS = [
+	/authorization/i,
+	/cookie/i,
+	/session/i,
+	/bearer/i
+];
+const PREFERRED_PROVIDER_ORDER_INDEX = new Map([
+	"nextclaw",
+	"openai",
+	"anthropic",
+	"gemini",
+	"openrouter",
+	"dashscope-coding-plan",
+	"dashscope",
+	"deepseek",
+	"minimax",
+	"moonshot",
+	"kimi-coding",
+	"zhipu"
+].map((name, index) => [name, index]));
+const BUILTIN_PROVIDERS = listServerBuiltinProviders();
+const CUSTOM_PROVIDER_PREFIX = "custom-";
+function normalizeOptionalDisplayName(value) {
+	if (typeof value !== "string") return null;
+	const trimmed = value.trim();
+	return trimmed.length > 0 ? trimmed : null;
 }
-function normalizeExpiresAt(value) {
-	if (typeof value === "number" && Number.isFinite(value) && value > 0) return Math.floor(value);
-	if (typeof value === "string" && value.trim()) {
-		const asNumber = Number(value);
-		if (Number.isFinite(asNumber) && asNumber > 0) return Math.floor(asNumber);
-		const parsedTime = Date.parse(value);
-		if (Number.isFinite(parsedTime) && parsedTime > 0) return parsedTime;
+function resolveCustomProviderFallbackDisplayName(name) {
+	if (name.startsWith(CUSTOM_PROVIDER_PREFIX)) {
+		const suffix = name.slice(7);
+		if (/^\d+$/.test(suffix)) return `Custom ${suffix}`;
 	}
-	return null;
+	return name;
 }
-function readFieldAsString(source, fieldName) {
-	if (!fieldName) return null;
-	const rawValue = source[fieldName];
-	if (typeof rawValue !== "string") return null;
-	const trimmed = rawValue.trim();
-	return trimmed.length > 0 ? trimmed : null;
+function resolveProviderInstanceDisplayName(providerId, provider, spec) {
+	return normalizeOptionalDisplayName(provider?.displayName) ?? spec?.displayName ?? (providerId.startsWith(CUSTOM_PROVIDER_PREFIX) ? resolveCustomProviderFallbackDisplayName(providerId) : providerId);
 }
-function setProviderApiKey({ configPath, provider, accessToken, defaultApiBase }) {
-	const config = loadConfig(configPath);
+function findNextCustomProviderName(config) {
 	const providers = config.providers;
-	if (!providers[provider]) return;
-	const target = providers[provider];
-	target.apiKey = accessToken;
-	if (defaultApiBase) target.apiBase = defaultApiBase;
-	saveConfig(ConfigSchema.parse(config), configPath);
+	let index = 1;
+	while (providers[`${CUSTOM_PROVIDER_PREFIX}${index}`]) index += 1;
+	return `${CUSTOM_PROVIDER_PREFIX}${index}`;
 }
-function resolveProviderAuthTarget(configPath, providerId) {
-	const provider = loadConfig(configPath).providers[providerId];
-	if (!provider) return null;
-	const configuredType = typeof provider.providerType === "string" ? provider.providerType.trim() : "";
-	if (configuredType && findServerBuiltinProviderByName(configuredType)) return {
-		providerId,
-		providerType: configuredType,
-		provider
-	};
-	if (findServerBuiltinProviderByName(providerId)) return {
-		providerId,
-		providerType: providerId,
-		provider
-	};
+function normalizeProviderId(value) {
+	if (typeof value !== "string") return null;
+	const trimmed = value.trim();
+	if (!trimmed || trimmed.includes("/")) return null;
+	return trimmed;
+}
+function resolveProviderType(providerId, provider) {
+	const configuredType = normalizeProviderId(provider?.providerType);
+	if (configuredType && findServerBuiltinProviderByName(configuredType)) return configuredType;
+	if (findServerBuiltinProviderByName(providerId)) return providerId;
 	return null;
 }
-async function startProviderAuth(configPath, providerId, options) {
-	cleanupExpiredAuthSessions();
-	const target = resolveProviderAuthTarget(configPath, providerId);
-	if (!target) return null;
-	const spec = findServerBuiltinProviderByName(target.providerType);
-	if (!spec?.auth || spec.auth.kind !== "device_code") return null;
-	const resolvedMethod = resolveAuthMethod(spec.auth, options?.methodId);
-	const { deviceCodeEndpoint, tokenEndpoint } = resolveDeviceCodeEndpoints(resolvedMethod.baseUrl, resolvedMethod.deviceCodePath, resolvedMethod.tokenPath);
-	const pkce = resolvedMethod.usePkce ? buildPkce() : null;
-	let authorizationCode = "";
-	let tokenCodeField = "device_code";
-	let userCode = "";
-	let verificationUri = "";
-	let intervalMs = DEFAULT_AUTH_INTERVAL_MS;
-	let expiresAtMs = Date.now() + 6e5;
-	if (resolvedMethod.protocol === "minimax_user_code") {
-		if (!pkce) throw new Error("MiniMax OAuth requires PKCE");
-		const state = toBase64Url(randomBytes(16));
-		const body = new URLSearchParams({
-			response_type: "code",
-			client_id: resolvedMethod.clientId,
-			scope: resolvedMethod.scope,
-			code_challenge: pkce.challenge,
-			code_challenge_method: "S256",
-			state
-		});
-		const response = await fetch(deviceCodeEndpoint, {
-			method: "POST",
-			headers: {
-				"Content-Type": "application/x-www-form-urlencoded",
-				Accept: "application/json",
-				"x-request-id": randomUUID()
-			},
-			body
-		});
-		const payload = await response.json().catch(() => ({}));
-		if (!response.ok) throw new Error(buildMinimaxErrorMessage(payload, response.statusText || "MiniMax OAuth start failed"));
-		if (payload.state && payload.state !== state) throw new Error("MiniMax OAuth state mismatch");
-		authorizationCode = payload.user_code?.trim() ?? "";
-		userCode = authorizationCode;
-		verificationUri = payload.verification_uri?.trim() ?? "";
-		if (!authorizationCode || !verificationUri) throw new Error("provider auth payload is incomplete");
-		tokenCodeField = "user_code";
-		intervalMs = Math.min(parsePollIntervalMs(payload.interval, DEFAULT_AUTH_INTERVAL_MS), MAX_AUTH_INTERVAL_MS);
-		expiresAtMs = parseExpiresAtMs(payload.expired_in, 6e5);
-	} else {
-		const body = new URLSearchParams({
-			client_id: resolvedMethod.clientId,
-			scope: resolvedMethod.scope
-		});
-		if (pkce) {
-			body.set("code_challenge", pkce.challenge);
-			body.set("code_challenge_method", "S256");
-		}
-		const response = await fetch(deviceCodeEndpoint, {
-			method: "POST",
-			headers: {
-				"Content-Type": "application/x-www-form-urlencoded",
-				Accept: "application/json"
-			},
-			body
-		});
-		const payload = await response.json().catch(() => ({}));
-		if (!response.ok) {
-			const message = payload.error_description || payload.error || response.statusText || "device code auth failed";
-			throw new Error(message);
-		}
-		authorizationCode = payload.device_code?.trim() ?? "";
-		userCode = payload.user_code?.trim() ?? "";
-		verificationUri = payload.verification_uri_complete?.trim() || payload.verification_uri?.trim() || "";
-		if (!authorizationCode || !userCode || !verificationUri) throw new Error("provider auth payload is incomplete");
-		intervalMs = normalizePositiveInt(payload.interval, DEFAULT_AUTH_INTERVAL_MS / 1e3) * 1e3;
-		const expiresInSec = normalizePositiveInt(payload.expires_in, 600);
-		expiresAtMs = Date.now() + expiresInSec * 1e3;
-	}
-	const sessionId = randomUUID();
-	authSessions.set(sessionId, {
-		sessionId,
-		providerId,
-		providerType: target.providerType,
-		configPath,
-		authorizationCode,
-		tokenCodeField,
-		protocol: resolvedMethod.protocol,
-		methodId: resolvedMethod.id,
-		codeVerifier: pkce?.verifier,
-		tokenEndpoint,
-		clientId: resolvedMethod.clientId,
-		grantType: resolvedMethod.grantType,
-		defaultApiBase: resolvedMethod.defaultApiBase ?? spec.defaultApiBase,
-		expiresAtMs,
-		intervalMs
-	});
-	const methodConfig = (spec.auth.methods ?? []).find((entry) => normalizeMethodId(entry.id) === resolvedMethod.id);
-	const methodLabel = methodConfig ? resolveLocalizedMethodLabel(methodConfig, resolvedMethod.id ?? "") : void 0;
-	const methodHint = methodConfig ? resolveLocalizedMethodHint(methodConfig) : void 0;
-	return {
-		provider: providerId,
-		kind: "device_code",
-		methodId: resolvedMethod.id,
-		sessionId,
-		verificationUri,
-		userCode,
-		expiresAt: new Date(expiresAtMs).toISOString(),
-		intervalMs,
-		note: methodHint ?? methodLabel ?? resolveAuthNote(spec.auth.note ?? {})
-	};
-}
-async function pollProviderAuth(params) {
-	const { configPath, providerName: providerId, sessionId } = params;
-	cleanupExpiredAuthSessions();
-	const session = authSessions.get(sessionId);
-	if (!session || session.providerId !== providerId || session.configPath !== configPath) return null;
-	if (Date.now() >= session.expiresAtMs) {
-		authSessions.delete(sessionId);
-		return {
-			provider: providerId,
-			status: "expired",
-			message: "authorization session expired"
-		};
-	}
-	const body = new URLSearchParams({
-		grant_type: session.grantType,
-		client_id: session.clientId
-	});
-	body.set(session.tokenCodeField, session.authorizationCode);
-	if (session.codeVerifier) body.set("code_verifier", session.codeVerifier);
-	const response = await fetch(session.tokenEndpoint, {
-		method: "POST",
-		headers: {
-			"Content-Type": "application/x-www-form-urlencoded",
-			Accept: "application/json"
-		},
-		body
-	});
-	let accessToken = "";
-	if (session.protocol === "minimax_user_code") {
-		const raw = await response.text();
-		let payload = {};
-		if (raw) try {
-			payload = JSON.parse(raw);
-		} catch {
-			payload = {};
-		}
-		if (!response.ok) return {
-			provider: providerId,
-			status: "error",
-			message: buildMinimaxErrorMessage(payload, raw || response.statusText || "authorization failed")
-		};
-		const status = payload.status?.trim().toLowerCase();
-		if (status === "success") {
-			accessToken = payload.access_token?.trim() ?? "";
-			if (!accessToken) return {
-				provider: providerId,
-				status: "error",
-				message: "provider token response missing access token"
-			};
-		} else if (status === "error") {
-			const message = buildMinimaxErrorMessage(payload, "authorization failed");
-			const classified = classifyMiniMaxErrorStatus(message);
-			if (classified === "denied" || classified === "expired") authSessions.delete(sessionId);
-			return {
-				provider: providerId,
-				status: classified,
-				message
-			};
-		} else {
-			const nextPollMs = Math.min(Math.floor(session.intervalMs * 1.5), MAX_AUTH_INTERVAL_MS);
-			session.intervalMs = nextPollMs;
-			authSessions.set(sessionId, session);
-			return {
-				provider: providerId,
-				status: "pending",
-				nextPollMs
-			};
-		}
-	} else {
-		const payload = await response.json().catch(() => ({}));
-		if (!response.ok) {
-			const errorCode = payload.error?.trim().toLowerCase();
-			if (errorCode === "authorization_pending") return {
-				provider: providerId,
-				status: "pending",
-				nextPollMs: session.intervalMs
-			};
-			if (errorCode === "slow_down") {
-				const nextPollMs = Math.min(Math.floor(session.intervalMs * 1.5), MAX_AUTH_INTERVAL_MS);
-				session.intervalMs = nextPollMs;
-				authSessions.set(sessionId, session);
-				return {
-					provider: providerId,
-					status: "pending",
-					nextPollMs
-				};
-			}
-			if (errorCode === "access_denied") {
-				authSessions.delete(sessionId);
-				return {
-					provider: providerId,
-					status: "denied",
-					message: payload.error_description || "authorization denied"
-				};
-			}
-			if (errorCode === "expired_token") {
-				authSessions.delete(sessionId);
-				return {
-					provider: providerId,
-					status: "expired",
-					message: payload.error_description || "authorization session expired"
-				};
-			}
-			return {
-				provider: providerId,
-				status: "error",
-				message: payload.error_description || payload.error || response.statusText || "authorization failed"
-			};
-		}
-		accessToken = payload.access_token?.trim() ?? "";
-		if (!accessToken) return {
-			provider: providerId,
-			status: "error",
-			message: "provider token response missing access token"
-		};
-	}
-	setProviderApiKey({
-		configPath,
-		provider: providerId,
-		accessToken,
-		defaultApiBase: session.defaultApiBase
-	});
-	authSessions.delete(sessionId);
-	return {
-		provider: providerId,
-		status: "authorized"
-	};
-}
-async function importProviderAuthFromCli(configPath, providerId) {
-	const target = resolveProviderAuthTarget(configPath, providerId);
-	if (!target) return null;
-	const spec = findServerBuiltinProviderByName(target.providerType);
-	if (!spec?.auth || spec.auth.kind !== "device_code" || !spec.auth.cliCredential) return null;
-	const credentialPath = resolveHomePath(spec.auth.cliCredential.path);
-	if (!credentialPath) throw new Error("provider cli credential path is empty");
-	let rawContent = "";
-	try {
-		rawContent = await readFile(credentialPath, "utf8");
-	} catch (error) {
-		const message = error instanceof Error ? error.message : String(error);
-		throw new Error(`failed to read CLI credential: ${message}`);
-	}
-	let payload;
-	try {
-		const parsed = JSON.parse(rawContent);
-		if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) throw new Error("credential payload is not an object");
-		payload = parsed;
-	} catch (error) {
-		const message = error instanceof Error ? error.message : String(error);
-		throw new Error(`invalid CLI credential JSON: ${message}`);
-	}
-	const accessToken = readFieldAsString(payload, spec.auth.cliCredential.accessTokenField);
-	if (!accessToken) throw new Error(`CLI credential missing access token field: ${spec.auth.cliCredential.accessTokenField}`);
-	const expiresAtMs = normalizeExpiresAt(spec.auth.cliCredential.expiresAtField ? payload[spec.auth.cliCredential.expiresAtField] : void 0);
-	if (typeof expiresAtMs === "number" && expiresAtMs <= Date.now()) throw new Error("CLI credential has expired, please login again");
-	setProviderApiKey({
-		configPath,
-		provider: providerId,
-		accessToken,
-		defaultApiBase: spec.defaultApiBase
-	});
-	return {
-		provider: providerId,
-		status: "imported",
-		source: "cli",
-		expiresAt: expiresAtMs ? new Date(expiresAtMs).toISOString() : void 0
-	};
-}
-//#endregion
-//#region src/features/config/controllers/config.controller.ts
-var ConfigRoutesController = class {
-	channelConfigApplyTasks = /* @__PURE__ */ new Map();
-	constructor(options) {
-		this.options = options;
-	}
-	getExtensionConfigProjectionOptions = () => {
-		return {
-			extensionChannelBindings: this.options.extensions?.getChannelBindings() ?? [],
-			extensionUiMetadata: this.options.extensions?.getUiMetadata() ?? []
-		};
-	};
-	publishConfigUpdatedPaths = (paths) => {
-		for (const path of paths) emitConfigUpdated(this.options, path);
-	};
-	publishConfigUpdates = async (paths) => {
-		this.publishConfigUpdatedPaths(paths);
-		await this.options.applyLiveConfigReload?.();
-	};
-	publishChannelConfigApplyStatus = (params) => {
-		emitChannelConfigApplyStatus(this.options, params);
-	};
-	enqueueChannelConfigApply = (channel) => {
-		const task = (this.channelConfigApplyTasks.get(channel) ?? Promise.resolve()).catch(() => void 0).then(async () => {
-			this.publishChannelConfigApplyStatus({
-				channel,
-				status: "started"
-			});
-			try {
-				await this.options.applyLiveConfigReload?.();
-				this.publishChannelConfigApplyStatus({
-					channel,
-					status: "succeeded"
-				});
-			} catch (error) {
-				const message = error instanceof Error ? error.message : String(error);
-				this.publishChannelConfigApplyStatus({
-					channel,
-					status: "failed",
-					message
-				});
-				emitUiError(this.options, {
-					code: "CHANNEL_CONFIG_APPLY_FAILED",
-					message: `Failed to apply ${channel} channel config: ${message}`
-				});
-			}
-		}).finally(() => {
-			if (this.channelConfigApplyTasks.get(channel) === task) this.channelConfigApplyTasks.delete(channel);
-		});
-		this.channelConfigApplyTasks.set(channel, task);
-	};
-	getConfig = (c) => {
-		const config = loadConfigOrDefault(this.options.configPath);
-		return c.json(ok(buildConfigView(config, this.getExtensionConfigProjectionOptions())));
-	};
-	getConfigMeta = (c) => {
-		const config = loadConfigOrDefault(this.options.configPath);
-		return c.json(ok(buildConfigMeta(config, this.getExtensionConfigProjectionOptions())));
-	};
-	listProviders = (c) => {
-		const config = loadConfigOrDefault(this.options.configPath);
-		return c.json(ok(buildProvidersView(config)));
-	};
-	listProviderTemplates = (c) => {
-		return c.json(ok(buildProviderTemplatesView()));
-	};
-	getConfigSchema = (c) => {
-		const config = loadConfigOrDefault(this.options.configPath);
-		return c.json(ok(buildConfigSchemaView(config, this.getExtensionConfigProjectionOptions())));
-	};
-	updateConfigModel = async (c) => {
-		const body = await readJson(c.req.raw);
-		if (!body.ok) return c.json(err("INVALID_BODY", "invalid json body"), 400);
-		const hasModel = typeof body.data.model === "string";
-		if (!hasModel) return c.json(err("INVALID_BODY", "model is required"), 400);
-		const view = updateModel(this.options.configPath, {
-			model: body.data.model,
-			workspace: body.data.workspace
-		});
-		const changedPaths = [];
-		if (hasModel) changedPaths.push("agents.defaults.model");
-		if (typeof body.data.workspace === "string") changedPaths.push("agents.defaults.workspace");
-		await this.publishConfigUpdates(changedPaths);
-		return c.json(ok({
-			model: view.agents.defaults.model,
-			workspace: view.agents.defaults.workspace
-		}));
-	};
-	updateConfigSearch = async (c) => {
-		const body = await readJson(c.req.raw);
-		if (!body.ok) return c.json(err("INVALID_BODY", "invalid json body"), 400);
-		const result = updateSearch(this.options.configPath, body.data);
-		await this.publishConfigUpdates(["search"]);
-		return c.json(ok(result));
-	};
-	updateProvider = async (c) => {
-		const providerId = c.req.param("providerId");
-		const body = await readJson(c.req.raw);
-		if (!body.ok) return c.json(err("INVALID_BODY", "invalid json body"), 400);
-		const result = updateProvider(this.options.configPath, providerId, body.data);
-		if (!result) return c.json(err("NOT_FOUND", `unknown provider: ${providerId}`), 404);
-		await this.publishConfigUpdates([`providers.${providerId}`]);
-		return c.json(ok(result));
-	};
-	createProvider = async (c) => {
-		const body = await readJson(c.req.raw);
-		if (!body.ok) return c.json(err("INVALID_BODY", "invalid json body"), 400);
-		const result = createProvider(this.options.configPath, body.data);
-		if (!result) return c.json(err("PROVIDER_EXISTS", "provider already exists"), 409);
-		await this.publishConfigUpdates([`providers.${result.providerId}`]);
-		return c.json(ok({
-			providerId: result.providerId,
-			provider: result.provider
-		}));
-	};
-	deleteProvider = async (c) => {
-		const providerId = c.req.param("providerId");
-		if (deleteProvider(this.options.configPath, providerId) === null) return c.json(err("NOT_FOUND", `provider not found: ${providerId}`), 404);
-		await this.publishConfigUpdates([`providers.${providerId}`]);
-		return c.json(ok({
-			deleted: true,
-			providerId
-		}));
-	};
-	testProviderConnection = async (c) => {
-		const provider = c.req.param("providerId");
-		const body = await readJson(c.req.raw);
-		if (!body.ok) return c.json(err("INVALID_BODY", "invalid json body"), 400);
-		const result = await testProviderConnection(this.options.configPath, provider, body.data, this.options.kernel.llmProviders);
-		if (!result) return c.json(err("NOT_FOUND", `unknown provider: ${provider}`), 404);
-		return c.json(ok(result));
-	};
-	startProviderAuth = async (c) => {
-		const provider = c.req.param("providerId");
-		let payload = {};
-		const rawBody = await c.req.raw.text();
-		if (rawBody.trim().length > 0) try {
-			payload = JSON.parse(rawBody);
-		} catch {
-			return c.json(err("INVALID_BODY", "invalid json body"), 400);
-		}
-		const methodId = typeof payload.methodId === "string" ? payload.methodId.trim() : void 0;
-		try {
-			const result = await startProviderAuth(this.options.configPath, provider, { methodId });
-			if (!result) return c.json(err("NOT_SUPPORTED", `provider auth is not supported: ${provider}`), 404);
-			return c.json(ok(result));
-		} catch (error) {
-			const message = error instanceof Error ? error.message : String(error);
-			return c.json(err("AUTH_START_FAILED", message), 400);
-		}
-	};
-	pollProviderAuth = async (c) => {
-		const provider = c.req.param("providerId");
-		const body = await readJson(c.req.raw);
-		if (!body.ok) return c.json(err("INVALID_BODY", "invalid json body"), 400);
-		const sessionId = typeof body.data.sessionId === "string" ? body.data.sessionId.trim() : "";
-		if (!sessionId) return c.json(err("INVALID_BODY", "sessionId is required"), 400);
-		const result = await pollProviderAuth({
-			configPath: this.options.configPath,
-			providerName: provider,
-			sessionId
-		});
-		if (!result) return c.json(err("NOT_FOUND", "provider auth session not found"), 404);
-		if (result.status === "authorized") await this.publishConfigUpdates([`providers.${provider}`]);
-		return c.json(ok(result));
-	};
-	importProviderAuthFromCli = async (c) => {
-		const provider = c.req.param("providerId");
-		try {
-			const result = await importProviderAuthFromCli(this.options.configPath, provider);
-			if (!result) return c.json(err("NOT_SUPPORTED", `provider cli auth import is not supported: ${provider}`), 404);
-			await this.publishConfigUpdates([`providers.${provider}`]);
-			return c.json(ok(result));
-		} catch (error) {
-			const message = error instanceof Error ? error.message : String(error);
-			return c.json(err("AUTH_IMPORT_FAILED", message), 400);
-		}
-	};
-	updateChannel = async (c) => {
-		const channel = c.req.param("channel");
-		const body = await readJson(c.req.raw);
-		if (!body.ok) return c.json(err("INVALID_BODY", "invalid json body"), 400);
-		const result = updateChannel(this.options.configPath, channel, body.data, this.getExtensionConfigProjectionOptions());
-		if (!result) return c.json(err("NOT_FOUND", `unknown channel: ${channel}`), 404);
-		this.publishConfigUpdatedPaths([`channels.${channel}`]);
-		this.enqueueChannelConfigApply(channel);
-		return c.json(ok(result));
-	};
-	startChannelAuth = async (c) => {
-		const channel = c.req.param("channel");
-		let payload = {};
-		const rawBody = await c.req.raw.text();
-		if (rawBody.trim().length > 0) try {
-			payload = JSON.parse(rawBody);
-		} catch {
-			return c.json(err("INVALID_BODY", "invalid json body"), 400);
-		}
-		try {
-			const result = await startChannelAuth({
-				configPath: this.options.configPath,
-				channelId: channel,
-				request: {
-					accountId: typeof payload.accountId === "string" ? payload.accountId : void 0,
-					baseUrl: typeof payload.baseUrl === "string" ? payload.baseUrl : void 0,
-					domain: typeof payload.domain === "string" ? payload.domain : void 0
-				},
-				bindings: this.options.extensions?.getChannelBindings() ?? []
-			});
-			if (!result) return c.json(err("NOT_SUPPORTED", `channel auth is not supported: ${channel}`), 404);
-			return c.json(ok(result));
-		} catch (error) {
-			const message = error instanceof Error ? error.message : String(error);
-			return c.json(err("AUTH_START_FAILED", message), 400);
-		}
-	};
-	pollChannelAuth = async (c) => {
-		const channel = c.req.param("channel");
-		const body = await readJson(c.req.raw);
-		if (!body.ok) return c.json(err("INVALID_BODY", "invalid json body"), 400);
-		const sessionId = typeof body.data.sessionId === "string" ? body.data.sessionId.trim() : "";
-		if (!sessionId) return c.json(err("INVALID_BODY", "sessionId is required"), 400);
-		const result = await pollChannelAuth({
-			configPath: this.options.configPath,
-			channelId: channel,
-			sessionId,
-			bindings: this.options.extensions?.getChannelBindings() ?? []
-		});
-		if (!result) return c.json(err("NOT_FOUND", "channel auth session not found"), 404);
-		if (result.status === "authorized") await this.publishConfigUpdates([`channels.${channel}`]);
-		return c.json(ok(result));
-	};
-	connectChannelAuth = async (c) => {
-		const channel = c.req.param("channel");
-		const body = await readJson(c.req.raw);
-		if (!body.ok) return c.json(err("INVALID_BODY", "invalid json body"), 400);
-		const fields = body.data.fields && typeof body.data.fields === "object" && !Array.isArray(body.data.fields) ? body.data.fields : {};
-		try {
-			const result = await connectChannelAuth({
-				configPath: this.options.configPath,
-				channelId: channel,
-				request: {
-					accountId: typeof body.data.accountId === "string" ? body.data.accountId : void 0,
-					domain: typeof body.data.domain === "string" ? body.data.domain : void 0,
-					fields
-				},
-				bindings: this.options.extensions?.getChannelBindings() ?? []
-			});
-			if (!result) return c.json(err("NOT_SUPPORTED", `channel auth connect is not supported: ${channel}`), 404);
-			if (result.status === "authorized") await this.publishConfigUpdates([`channels.${channel}`]);
-			return c.json(ok(result));
-		} catch (error) {
-			const message = error instanceof Error ? error.message : String(error);
-			return c.json(err("AUTH_CONNECT_FAILED", message), 400);
+function findNextProviderId(config, baseProviderId) {
+	const providers = config.providers;
+	let providerId = baseProviderId;
+	let index = 2;
+	while (providers[providerId]) {
+		providerId = `${baseProviderId}-${index}`;
+		index += 1;
+	}
+	return providerId;
+}
+function resolveProviderDisplayNameSuffix(providerId, baseProviderId) {
+	if (providerId === baseProviderId) return "";
+	const suffix = providerId.slice(baseProviderId.length + 1).trim();
+	return suffix ? ` ${suffix}` : "";
+}
+function buildProviderScopedModels(providerId, models) {
+	return normalizeModelList(models).map((model) => {
+		const slashIndex = model.indexOf("/");
+		const modelSuffix = slashIndex >= 0 ? model.slice(slashIndex + 1).trim() : model;
+		return modelSuffix ? `${providerId}/${modelSuffix}` : "";
+	}).filter(Boolean);
+}
+function clearSecretRefsByPrefix(refs, pathPrefix) {
+	return Object.fromEntries(Object.entries(refs).filter(([key]) => key !== pathPrefix && !key.startsWith(`${pathPrefix}.`)));
+}
+function matchesExtraSensitivePath(path) {
+	return path !== "session" && !path.startsWith("session.") && EXTRA_SENSITIVE_PATH_PATTERNS.some((pattern) => pattern.test(path));
+}
+function matchHint(path, hints) {
+	const direct = hints[path];
+	if (direct) return direct;
+	const segments = path.split(".");
+	for (const [hintKey, hint] of Object.entries(hints)) {
+		if (!hintKey.includes("*")) continue;
+		const hintSegments = hintKey.split(".");
+		if (hintSegments.length !== segments.length) continue;
+		let match = true;
+		for (let index = 0; index < segments.length; index += 1) if (hintSegments[index] !== "*" && hintSegments[index] !== segments[index]) {
+			match = false;
+			break;
 		}
-	};
-	updateSecrets = async (c) => {
-		const body = await readJson(c.req.raw);
-		if (!body.ok) return c.json(err("INVALID_BODY", "invalid json body"), 400);
-		const result = updateSecrets(this.options.configPath, body.data);
-		await this.publishConfigUpdates(["secrets"]);
-		return c.json(ok(result));
-	};
-	updateRuntime = async (c) => {
-		const body = await readJson(c.req.raw);
-		if (!body.ok || !body.data || typeof body.data !== "object") return c.json(err("INVALID_BODY", "invalid json body"), 400);
-		const result = updateRuntime(this.options.configPath, body.data);
-		const changedPaths = [];
-		if (body.data.agents?.defaults && Object.prototype.hasOwnProperty.call(body.data.agents.defaults, "contextTokens")) changedPaths.push("agents.defaults.contextTokens");
-		if (body.data.agents?.defaults && Object.prototype.hasOwnProperty.call(body.data.agents.defaults, "engine")) changedPaths.push("agents.defaults.engine");
-		if (body.data.agents?.defaults && Object.prototype.hasOwnProperty.call(body.data.agents.defaults, "engineConfig")) changedPaths.push("agents.defaults.engineConfig");
-		if (body.data.agents?.runtimes && Object.prototype.hasOwnProperty.call(body.data.agents.runtimes, "entries")) changedPaths.push("agents.runtimes.entries");
-		if (body.data.companion && Object.prototype.hasOwnProperty.call(body.data.companion, "enabled")) changedPaths.push("companion.enabled");
-		changedPaths.push("agents.list", "bindings", "session");
-		await this.publishConfigUpdates(changedPaths);
-		return c.json(ok(result));
-	};
-	executeAction = async (c) => {
-		const actionId = c.req.param("actionId");
-		const body = await readJson(c.req.raw);
-		if (!body.ok) return c.json(err("INVALID_BODY", "invalid json body"), 400);
-		const result = await executeConfigAction(this.options.configPath, actionId, body.data ?? {});
-		if (!result.ok) return c.json(err(result.code, result.message, result.details), 400);
-		return c.json(ok(result.data));
-	};
-};
-//#endregion
-//#region src/features/config/utils/default-provider-config.utils.ts
-function createDefaultProviderConfig(defaultWireApi = "auto", defaultModels = [], modelConfig = {}, providerType, defaultApiBase = null) {
-	return {
-		enabled: true,
-		providerType,
-		displayName: "",
-		apiKey: "",
-		apiBase: defaultApiBase,
-		extraHeaders: null,
-		wireApi: defaultWireApi,
-		models: [...defaultModels],
-		modelConfig
-	};
+		if (match) return hint;
+	}
 }
-function createDefaultProviderConfigFromSpec(spec) {
-	return createDefaultProviderConfig(spec?.defaultWireApi ?? "auto", spec?.defaultModels ?? [], normalizeProviderModelConfig(spec?.modelConfig ?? {}), spec?.name, spec?.defaultApiBase ?? null);
+function isSensitivePath(path, hints) {
+	if (hints) {
+		const hint = matchHint(path, hints);
+		if (hint?.sensitive !== void 0) return Boolean(hint.sensitive);
+	}
+	return isSensitiveConfigPath(path) || matchesExtraSensitivePath(path);
 }
-//#endregion
-//#region src/features/config/utils/runtime-entry-config.utils.ts
-function normalizeOptionalString$2(value) {
-	if (typeof value !== "string") return null;
-	const trimmed = value.trim();
-	return trimmed.length > 0 ? trimmed : null;
+function sanitizePublicConfigValue(value, prefix, hints) {
+	if (Array.isArray(value)) {
+		const nextPath = prefix ? `${prefix}[]` : "[]";
+		return value.map((entry) => sanitizePublicConfigValue(entry, nextPath, hints));
+	}
+	if (!value || typeof value !== "object") return value;
+	const output = {};
+	for (const [key, val] of Object.entries(value)) {
+		const nextPath = prefix ? `${prefix}.${key}` : key;
+		if (isSensitivePath(nextPath, hints)) continue;
+		output[key] = sanitizePublicConfigValue(val, nextPath, hints);
+	}
+	return output;
 }
-function normalizePositiveInteger(value) {
-	const parsed = typeof value === "number" ? value : typeof value === "string" ? Number.parseInt(value, 10) : NaN;
-	if (!Number.isFinite(parsed)) return null;
-	const normalized = Math.trunc(parsed);
-	return normalized > 0 ? normalized : null;
+function isObject(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
-function normalizeStringArray(value) {
-	if (!Array.isArray(value)) return null;
-	const entries = value.map((entry) => normalizeOptionalString$2(entry)).filter((entry) => Boolean(entry));
-	return entries.length > 0 ? entries : null;
+function deepMerge(base, patch) {
+	if (!isObject(base) || !isObject(patch)) return patch;
+	const result = { ...base };
+	for (const [key, value] of Object.entries(patch)) {
+		const previous = result[key];
+		result[key] = deepMerge(previous, value);
+	}
+	return result;
 }
-function normalizeUnknownStringRecord(value) {
-	if (!value || typeof value !== "object" || Array.isArray(value)) return null;
-	const entries = Object.entries(value).map(([key, entryValue]) => [key.trim(), normalizeOptionalString$2(entryValue)]).filter(([key, entryValue]) => key.length > 0 && Boolean(entryValue));
-	return entries.length > 0 ? Object.fromEntries(entries) : null;
+function getPathValue(source, path) {
+	if (!source || typeof source !== "object") return;
+	const segments = path.split(".");
+	let current = source;
+	for (const segment of segments) {
+		if (!current || typeof current !== "object") return;
+		current = current[segment];
+	}
+	return current;
 }
-function normalizeRuntimeModelSelectionMode(value) {
-	if (value === "nextclaw" || value === "optional" || value === "runtime-default") return value;
-	return null;
+function setPathValue(target, path, value) {
+	const segments = path.split(".");
+	if (segments.length === 0) return;
+	let current = target;
+	for (let index = 0; index < segments.length - 1; index += 1) {
+		const segment = segments[index];
+		const next = current[segment];
+		if (!isObject(next)) current[segment] = {};
+		current = current[segment];
+	}
+	current[segments[segments.length - 1]] = value;
 }
-function normalizeRuntimeEntryConfig(type, config) {
-	const runtimeDefaultThinking = normalizeModelThinkingCapability(config.runtimeDefaultThinking);
-	if (type !== "narp-stdio") return {
-		...Object.fromEntries(Object.entries(config).filter(([key]) => key !== "runtimeDefaultThinking")),
-		...runtimeDefaultThinking ? { runtimeDefaultThinking } : {}
+function isMissingRequiredValue(value) {
+	if (value === void 0 || value === null) return true;
+	if (typeof value === "string") return value.trim().length === 0;
+	if (Array.isArray(value)) return value.length === 0;
+	return false;
+}
+function resolveRuntimeConfig(config, draftConfig) {
+	if (!draftConfig || Object.keys(draftConfig).length === 0) return config;
+	const merged = deepMerge(config, draftConfig);
+	return ConfigSchema.parse(merged);
+}
+function getActionById(config, actionId) {
+	return buildConfigSchemaView(config).actions.find((item) => item.id === actionId) ?? null;
+}
+function messageOrDefault(action, kind, fallback) {
+	const text = kind === "success" ? action.success?.message : action.failure?.message;
+	return text?.trim() ? text : fallback;
+}
+async function runFeishuVerifyAction(params) {
+	const { config, action } = params;
+	const appId = String(config.channels.feishu.appId ?? "").trim();
+	const appSecret = String(config.channels.feishu.appSecret ?? "").trim();
+	if (!appId || !appSecret) return {
+		ok: false,
+		status: "failed",
+		message: messageOrDefault(action, "failure", "Verification failed: missing credentials"),
+		data: { error: "missing credentials (appId, appSecret)" },
+		nextActions: []
 	};
-	const command = normalizeOptionalString$2(config.command);
-	const args = normalizeStringArray(config.args);
-	const cwd = normalizeOptionalString$2(config.cwd);
-	const wireDialect = normalizeOptionalString$2(config.wireDialect) ?? "acp";
-	const processScope = normalizeOptionalString$2(config.processScope) ?? "per-session";
-	const modelSelectionMode = normalizeRuntimeModelSelectionMode(config.modelSelectionMode);
-	const supportedModels = normalizeStringArray(config.supportedModels);
-	const model = normalizeOptionalString$2(config.model);
-	const recommendedModel = normalizeOptionalString$2(config.recommendedModel);
+	const result = await probeFeishu(appId, appSecret);
+	if (!result.ok) return {
+		ok: false,
+		status: "failed",
+		message: `${messageOrDefault(action, "failure", "Verification failed")}: ${result.error}`,
+		data: {
+			error: result.error,
+			appId: result.appId ?? appId
+		},
+		nextActions: []
+	};
+	const responseData = {
+		appId: result.appId,
+		botName: result.botName ?? null,
+		botOpenId: result.botOpenId ?? null
+	};
+	const patch = {};
+	for (const [targetPath, sourcePath] of Object.entries(action.resultMap ?? {})) {
+		const mappedValue = sourcePath.startsWith("response.data.") ? responseData[sourcePath.slice(14)] : void 0;
+		if (mappedValue !== void 0) setPathValue(patch, targetPath, mappedValue);
+	}
 	return {
-		wireDialect,
-		processScope,
-		...command ? { command } : {},
-		...args ? { args } : {},
-		env: normalizeUnknownStringRecord(config.env) ?? {},
-		...cwd ? { cwd } : {},
-		...modelSelectionMode ? { modelSelectionMode } : {},
-		...model ? { model } : {},
-		...recommendedModel ? { recommendedModel } : {},
-		...supportedModels ? { supportedModels } : {},
-		...runtimeDefaultThinking ? { runtimeDefaultThinking } : {},
-		startupTimeoutMs: normalizePositiveInteger(config.startupTimeoutMs) ?? 8e3,
-		probeTimeoutMs: normalizePositiveInteger(config.probeTimeoutMs) ?? 3e3,
-		requestTimeoutMs: normalizePositiveInteger(config.requestTimeoutMs) ?? 12e4
+		ok: true,
+		status: "success",
+		message: messageOrDefault(action, "success", "Verified. Please finish Feishu event subscription and app publishing before using."),
+		data: responseData,
+		patch: Object.keys(patch).length > 0 ? patch : void 0,
+		nextActions: []
 	};
 }
-//#endregion
-//#region src/features/config/utils/search-config.utils.ts
-const MASK_MIN_LENGTH$1 = 8;
-const BOCHA_OPEN_URL = "https://open.bocha.cn";
-const TAVILY_DOCS_URL = "https://docs.tavily.com/documentation/api-reference/endpoint/search";
-const SEARCH_PROVIDER_NAMES = [
-	"bocha",
-	"tavily",
-	"brave"
-];
-function normalizeOptionalString$1(value) {
-	if (typeof value !== "string") return null;
-	const trimmed = value.trim();
-	return trimmed.length > 0 ? trimmed : null;
+const ACTION_HANDLERS = { "channels.feishu.verifyConnection": runFeishuVerifyAction };
+function buildUiHints(config, options) {
+	return buildConfigSchemaView(config, options).uiHints;
 }
-function maskApiKey$1(value) {
+function maskApiKey(value) {
 	if (!value) return { apiKeySet: false };
-	if (value.length < MASK_MIN_LENGTH$1) return {
+	if (value.length < MASK_MIN_LENGTH) return {
 		apiKeySet: true,
 		apiKeyMasked: "****"
 	};
@@ -1760,949 +1445,1412 @@ function maskApiKey$1(value) {
 		apiKeyMasked: `${value.slice(0, 2)}****${value.slice(-4)}`
 	};
 }
-function clearSecretRef$1(refs, path) {
-	if (!refs[path]) return refs;
-	const nextRefs = { ...refs };
-	delete nextRefs[path];
+function normalizeModelList(input) {
+	if (!input || input.length === 0) return [];
+	const deduped = /* @__PURE__ */ new Set();
+	for (const item of input) {
+		if (typeof item !== "string") continue;
+		const trimmed = item.trim();
+		if (!trimmed) continue;
+		deduped.add(trimmed);
+	}
+	return [...deduped];
+}
+function toProviderView(config, provider, providerId, uiHints, spec) {
+	const providerType = resolveProviderType(providerId, provider);
+	const apiKeyRefSet = hasSecretRef(config, `providers.${providerId}.apiKey`);
+	const masked = maskApiKey(provider.apiKey);
+	const extraHeaders = provider.extraHeaders && Object.keys(provider.extraHeaders).length > 0 ? sanitizePublicConfigValue(provider.extraHeaders, `providers.${providerId}.extraHeaders`, uiHints) : null;
+	const supportsWireApi = Boolean(spec?.supportsWireApi) || providerType === null;
+	return {
+		providerId,
+		providerType,
+		isBuiltInType: providerType !== null,
+		isCustom: providerType === null,
+		enabled: provider.enabled !== false,
+		displayName: resolveProviderInstanceDisplayName(providerId, provider, spec),
+		apiKeyRequired: !spec?.anonymousApiKey,
+		apiKeySet: masked.apiKeySet || apiKeyRefSet,
+		apiKeyMasked: masked.apiKeyMasked ?? (apiKeyRefSet ? "****" : void 0),
+		apiBase: provider.apiBase ?? null,
+		extraHeaders: extraHeaders && Object.keys(extraHeaders).length > 0 ? extraHeaders : null,
+		models: normalizeModelList(provider.models ?? []),
+		modelConfig: normalizeProviderModelConfig(provider.modelConfig ?? {}),
+		wireApi: supportsWireApi ? provider.wireApi ?? spec?.defaultWireApi ?? "auto" : void 0
+	};
+}
+function buildConfigView(config, options) {
+	const uiHints = buildUiHints(config, options);
+	const projectedChannels = getProjectedChannelMap(config, options);
+	const providers = {};
+	for (const [providerId, provider] of Object.entries(config.providers)) {
+		const providerConfig = provider;
+		providers[providerId] = toProviderView(config, providerConfig, providerId, uiHints, findServerBuiltinProviderByName(resolveProviderType(providerId, providerConfig) ?? ""));
+	}
+	return {
+		companion: sanitizePublicConfigValue(config.companion, "companion", uiHints),
+		agents: sanitizePublicConfigValue(config.agents, "agents", uiHints),
+		providers,
+		search: buildSearchView(config),
+		channels: sanitizePublicConfigValue(projectedChannels, "channels", uiHints),
+		bindings: sanitizePublicConfigValue(config.bindings, "bindings", uiHints),
+		session: sanitizePublicConfigValue(config.session, "session", uiHints),
+		tools: sanitizePublicConfigValue(config.tools, "tools", uiHints),
+		gateway: sanitizePublicConfigValue(config.gateway, "gateway", uiHints),
+		ui: sanitizePublicConfigValue(config.ui, "ui", uiHints),
+		secrets: {
+			enabled: config.secrets.enabled,
+			defaults: { ...config.secrets.defaults },
+			providers: { ...config.secrets.providers },
+			refs: { ...config.secrets.refs }
+		}
+	};
+}
+function normalizeRuntimeEntries(entries) {
+	if (!entries || typeof entries !== "object" || Array.isArray(entries)) return {};
+	const normalized = {};
+	for (const [rawId, rawEntry] of Object.entries(entries)) {
+		const id = rawId.trim();
+		if (!id || !rawEntry || typeof rawEntry !== "object" || Array.isArray(rawEntry)) continue;
+		const entry = rawEntry;
+		const type = normalizeOptionalString(entry.type);
+		if (!type) continue;
+		const normalizedIcon = normalizeRuntimeEntryIcon(entry.icon);
+		normalized[id] = {
+			enabled: typeof entry.enabled === "boolean" ? entry.enabled : true,
+			...normalizeOptionalString(entry.label) ? { label: normalizeOptionalString(entry.label) ?? void 0 } : {},
+			...normalizedIcon ? { icon: normalizedIcon } : {},
+			type,
+			config: normalizeRuntimeEntryConfig(type, entry.config && typeof entry.config === "object" && !Array.isArray(entry.config) ? entry.config : {})
+		};
+	}
+	return normalized;
+}
+function normalizeRuntimeEntryIcon(value) {
+	if (typeof value === "string") {
+		const src = value.trim();
+		return src ? {
+			kind: "image",
+			src
+		} : null;
+	}
+	if (!value || typeof value !== "object" || Array.isArray(value)) return null;
+	const src = normalizeOptionalString(value.src);
+	if (!src) return null;
+	const alt = normalizeOptionalString(value.alt);
+	return {
+		kind: "image",
+		src,
+		...alt ? { alt } : {}
+	};
+}
+function clearSecretRef(refs, path) {
+	const { [path]: _removed, ...nextRefs } = refs;
 	return nextRefs;
 }
-function isSearchProviderName(value) {
-	return typeof value === "string" && SEARCH_PROVIDER_NAMES.some((providerName) => providerName === value);
+function buildConfigMeta(config, options) {
+	return {
+		search: SEARCH_PROVIDER_META,
+		channels: buildProjectedChannelMeta(config, options)
+	};
 }
-const SEARCH_PROVIDER_META = [
-	{
-		name: "bocha",
-		displayName: "Bocha Search",
-		description: "China-friendly web search with AI-ready summaries.",
-		docsUrl: BOCHA_OPEN_URL,
-		isDefault: true,
-		supportsSummary: true
-	},
-	{
-		name: "tavily",
-		displayName: "Tavily Search",
-		description: "Research-focused web search with optional synthesized answers.",
-		docsUrl: TAVILY_DOCS_URL,
-		supportsSummary: true
-	},
-	{
-		name: "brave",
-		displayName: "Brave Search",
-		description: "Brave web search API kept as an optional provider.",
-		supportsSummary: false
+function buildProviderTemplatesView() {
+	return { providerTemplates: BUILTIN_PROVIDERS.map((spec) => {
+		return {
+			id: spec.name,
+			providerType: spec.name,
+			displayName: spec.displayName ?? spec.name,
+			apiProtocol: spec.apiProtocol,
+			modelPrefix: spec.modelPrefix,
+			keywords: spec.keywords,
+			envKey: spec.envKey,
+			isGateway: spec.isGateway,
+			isLocal: spec.isLocal,
+			apiKeyRequired: !spec.anonymousApiKey,
+			defaultApiBase: spec.defaultApiBase,
+			logo: spec.logo,
+			apiBaseHelp: spec.apiBaseHelp,
+			auth: spec.auth ? {
+				kind: spec.auth.kind,
+				displayName: spec.auth.displayName,
+				note: spec.auth.note,
+				methods: spec.auth.methods?.map((method) => ({
+					id: method.id,
+					label: method.label,
+					hint: method.hint
+				})),
+				defaultMethodId: spec.auth.defaultMethodId,
+				supportsCliImport: Boolean(spec.auth.cliCredential)
+			} : void 0,
+			defaultModels: normalizeModelList(spec.defaultModels ?? []),
+			supportsModelDiscovery: Boolean(spec.modelDiscovery),
+			modelConfig: normalizeProviderModelConfig(spec.modelConfig ?? {}),
+			supportsWireApi: spec.supportsWireApi,
+			wireApiOptions: spec.wireApiOptions,
+			defaultWireApi: spec.defaultWireApi
+		};
+	}).sort((left, right) => {
+		const leftRank = PREFERRED_PROVIDER_ORDER_INDEX.get(left.id);
+		const rightRank = PREFERRED_PROVIDER_ORDER_INDEX.get(right.id);
+		if (leftRank !== void 0 && rightRank !== void 0) return leftRank - rightRank;
+		if (leftRank !== void 0) return -1;
+		if (rightRank !== void 0) return 1;
+		return left.id.localeCompare(right.id);
+	}) };
+}
+function buildProvidersView(config) {
+	const uiHints = buildUiHints(config);
+	const providers = {};
+	for (const [providerId, provider] of Object.entries(config.providers)) {
+		const providerConfig = provider;
+		providers[providerId] = toProviderView(config, providerConfig, providerId, uiHints, findServerBuiltinProviderByName(resolveProviderType(providerId, providerConfig) ?? ""));
 	}
-];
-function toSearchProviderView(config, providerName, provider) {
-	const apiKeyRefSet = hasSecretRef(config, `search.providers.${providerName}.apiKey`);
-	const masked = maskApiKey$1(provider.apiKey);
-	const view = {
-		enabled: config.search.enabledProviders.includes(providerName),
-		apiKeySet: masked.apiKeySet || apiKeyRefSet,
-		apiKeyMasked: masked.apiKeyMasked ?? (apiKeyRefSet ? "****" : void 0),
-		baseUrl: provider.baseUrl
-	};
-	if ("docsUrl" in provider) view.docsUrl = provider.docsUrl;
-	if ("summary" in provider) view.summary = provider.summary;
-	if ("freshness" in provider) view.freshness = provider.freshness;
-	if ("searchDepth" in provider) view.searchDepth = provider.searchDepth;
-	if ("includeAnswer" in provider) view.includeAnswer = Boolean(provider.includeAnswer);
-	return view;
+	return { providers };
 }
-function buildSearchView(config) {
+function buildConfigSchemaView(_config, options) {
+	const base = buildConfigSchema({ version: getPackageVersion() });
+	const extensionUiHints = buildExtensionChannelUiHints(options);
+	if (Object.keys(extensionUiHints).length === 0) return base;
 	return {
-		provider: config.search.provider,
-		enabledProviders: [...config.search.enabledProviders],
-		defaults: { maxResults: config.search.defaults.maxResults },
-		providers: {
-			bocha: toSearchProviderView(config, "bocha", config.search.providers.bocha),
-			tavily: toSearchProviderView(config, "tavily", config.search.providers.tavily),
-			brave: toSearchProviderView(config, "brave", config.search.providers.brave)
+		...base,
+		uiHints: {
+			...base.uiHints,
+			...extensionUiHints
 		}
 	};
 }
-function replaceSearchConfig(config, search, refs = config.secrets.refs) {
-	return {
-		...config,
-		search,
-		secrets: refs === config.secrets.refs ? config.secrets : {
-			...config.secrets,
-			refs
+async function executeConfigAction(configPath, actionId, request) {
+	const baseConfig = loadConfigOrDefault(configPath);
+	const action = getActionById(baseConfig, actionId);
+	if (!action) return {
+		ok: false,
+		code: "ACTION_NOT_FOUND",
+		message: `unknown action: ${actionId}`
+	};
+	if (request.scope && request.scope !== action.scope) return {
+		ok: false,
+		code: "ACTION_SCOPE_MISMATCH",
+		message: `scope mismatch: expected ${action.scope}, got ${request.scope}`,
+		details: {
+			expectedScope: action.scope,
+			requestScope: request.scope
 		}
 	};
+	const runtimeConfig = resolveRuntimeConfig(baseConfig, request.draftConfig);
+	for (const requiredPath of action.requires ?? []) if (isMissingRequiredValue(getPathValue(runtimeConfig, requiredPath))) return {
+		ok: false,
+		code: "ACTION_PRECONDITION_FAILED",
+		message: `required field missing: ${requiredPath}`,
+		details: { path: requiredPath }
+	};
+	const handler = ACTION_HANDLERS[action.id];
+	if (!handler) return {
+		ok: false,
+		code: "ACTION_EXECUTION_FAILED",
+		message: `action handler not found for type ${action.type}`
+	};
+	return {
+		ok: true,
+		data: await handler({
+			config: runtimeConfig,
+			action
+		})
+	};
 }
-function applyActiveSearchProviderPatch(config, provider) {
-	if (!isSearchProviderName(provider)) return config;
-	return replaceSearchConfig(config, {
-		...config.search,
-		provider
-	});
+function loadConfigOrDefault(configPath) {
+	return loadConfig(configPath);
 }
-function applyEnabledSearchProvidersPatch(config, enabledProviders) {
-	if (!Array.isArray(enabledProviders)) return config;
-	const nextEnabledProviders = Array.from(new Set(enabledProviders.filter((value) => isSearchProviderName(value))));
-	return replaceSearchConfig(config, {
-		...config.search,
-		enabledProviders: nextEnabledProviders
-	});
+function createProviderForUpdate(providerId) {
+	const spec = findServerBuiltinProviderByName(providerId);
+	if (!spec) return null;
+	return createDefaultProviderConfigFromSpec(spec);
 }
-function applySearchDefaultsPatch(config, defaults) {
-	if (!defaults || !Object.prototype.hasOwnProperty.call(defaults, "maxResults")) return config;
-	const nextMaxResults = defaults.maxResults;
-	if (typeof nextMaxResults === "number" && Number.isFinite(nextMaxResults)) return replaceSearchConfig(config, {
-		...config.search,
-		defaults: {
-			...config.search.defaults,
-			maxResults: Math.max(1, Math.min(50, Math.trunc(nextMaxResults)))
-		}
-	});
-	return config;
+function updateModel(configPath, patch) {
+	const config = loadConfigOrDefault(configPath);
+	if (typeof patch.model === "string") config.agents.defaults.model = patch.model;
+	if (typeof patch.workspace === "string") config.agents.defaults.workspace = normalizeOptionalString(patch.workspace) ?? DEFAULT_WORKSPACE_PATH;
+	const next = ConfigSchema.parse(config);
+	saveConfig(next, configPath);
+	return buildConfigView(next);
 }
-function applyBochaSearchPatch(config, patch) {
-	if (!patch) return config;
-	let nextRefs = config.secrets.refs;
-	let nextProvider = config.search.providers.bocha;
+function updateProvider(configPath, providerId, patch) {
+	const config = loadConfigOrDefault(configPath);
+	const providers = config.providers;
+	const provider = providers[providerId] ?? createProviderForUpdate(providerId);
+	if (!provider) return null;
+	providers[providerId] = provider;
+	const spec = findServerBuiltinProviderByName((Object.prototype.hasOwnProperty.call(patch, "providerType") ? normalizeProviderId(patch.providerType) : resolveProviderType(providerId, provider)) ?? "");
+	if (Object.prototype.hasOwnProperty.call(patch, "providerType")) provider.providerType = spec?.name ?? null;
+	if (Object.prototype.hasOwnProperty.call(patch, "displayName")) provider.displayName = normalizeOptionalDisplayName(patch.displayName) ?? "";
+	if (Object.prototype.hasOwnProperty.call(patch, "enabled")) provider.enabled = patch.enabled !== false;
 	if (Object.prototype.hasOwnProperty.call(patch, "apiKey")) {
-		nextProvider = {
-			...nextProvider,
-			apiKey: patch.apiKey ?? ""
-		};
-		nextRefs = clearSecretRef$1(nextRefs, "search.providers.bocha.apiKey");
+		provider.apiKey = patch.apiKey ?? "";
+		config.secrets.refs = clearSecretRef(config.secrets.refs, `providers.${providerId}.apiKey`);
 	}
-	if (Object.prototype.hasOwnProperty.call(patch, "baseUrl")) nextProvider = {
-		...nextProvider,
-		baseUrl: normalizeOptionalString$1(patch.baseUrl) ?? "https://api.bocha.cn/v1/web-search"
+	if (Object.prototype.hasOwnProperty.call(patch, "apiBase")) provider.apiBase = patch.apiBase ?? null;
+	if (Object.prototype.hasOwnProperty.call(patch, "extraHeaders")) provider.extraHeaders = patch.extraHeaders ?? null;
+	if (Object.prototype.hasOwnProperty.call(patch, "wireApi") && (spec?.supportsWireApi || !spec)) provider.wireApi = patch.wireApi ?? spec?.defaultWireApi ?? "auto";
+	if (Object.prototype.hasOwnProperty.call(patch, "models")) provider.models = normalizeModelList(patch.models ?? []);
+	if (Object.prototype.hasOwnProperty.call(patch, "modelConfig")) provider.modelConfig = normalizeProviderModelConfig(patch.modelConfig ?? {});
+	const next = ConfigSchema.parse(config);
+	saveConfig(next, configPath);
+	const uiHints = buildUiHints(next);
+	const updated = next.providers[providerId];
+	return toProviderView(next, updated, providerId, uiHints, spec ?? void 0);
+}
+function createProvider(configPath, patch = {}) {
+	const config = loadConfigOrDefault(configPath);
+	const providers = config.providers;
+	const requestedProviderType = normalizeProviderId(patch.providerType);
+	const spec = requestedProviderType ? findServerBuiltinProviderByName(requestedProviderType) : void 0;
+	const fallbackProviderId = spec ? spec.name : findNextCustomProviderName(config);
+	const requestedProviderId = normalizeProviderId(patch.providerId);
+	if (requestedProviderId && providers[requestedProviderId]) return null;
+	const providerId = requestedProviderId ? requestedProviderId : findNextProviderId(config, fallbackProviderId);
+	const generatedDisplayName = spec ? `${spec.displayName}${resolveProviderDisplayNameSuffix(providerId, spec.name)}` : resolveCustomProviderFallbackDisplayName(providerId);
+	const defaultModels = spec ? buildProviderScopedModels(providerId, spec.defaultModels ?? []) : [];
+	providers[providerId] = {
+		enabled: patch.enabled !== false,
+		providerType: spec?.name ?? null,
+		displayName: normalizeOptionalDisplayName(patch.displayName) ?? generatedDisplayName,
+		apiKey: normalizeOptionalString(patch.apiKey) ?? "",
+		apiBase: normalizeOptionalString(patch.apiBase) ?? spec?.defaultApiBase ?? null,
+		extraHeaders: normalizeHeaders(patch.extraHeaders ?? null),
+		wireApi: patch.wireApi ?? spec?.defaultWireApi ?? "auto",
+		models: Object.prototype.hasOwnProperty.call(patch, "models") ? normalizeModelList(patch.models ?? []) : defaultModels,
+		modelConfig: normalizeProviderModelConfig(patch.modelConfig ?? spec?.modelConfig ?? {})
 	};
-	if (Object.prototype.hasOwnProperty.call(patch, "docsUrl")) nextProvider = {
-		...nextProvider,
-		docsUrl: normalizeOptionalString$1(patch.docsUrl) ?? BOCHA_OPEN_URL
+	const next = ConfigSchema.parse(config);
+	saveConfig(next, configPath);
+	const uiHints = buildUiHints(next);
+	const created = next.providers[providerId];
+	return {
+		providerId,
+		provider: toProviderView(next, created, providerId, uiHints, spec)
 	};
-	if (Object.prototype.hasOwnProperty.call(patch, "summary")) nextProvider = {
-		...nextProvider,
-		summary: Boolean(patch.summary)
+}
+function deleteProvider(configPath, providerId) {
+	const config = loadConfigOrDefault(configPath);
+	const providers = config.providers;
+	if (!providers[providerId]) return null;
+	delete providers[providerId];
+	config.secrets.refs = clearSecretRefsByPrefix(config.secrets.refs, `providers.${providerId}`);
+	saveConfig(ConfigSchema.parse(config), configPath);
+	return true;
+}
+function normalizeOptionalString(value) {
+	if (typeof value !== "string") return null;
+	const trimmed = value.trim();
+	return trimmed.length > 0 ? trimmed : null;
+}
+function normalizeHeaders(input) {
+	if (!input) return null;
+	const entries = Object.entries(input).map(([key, value]) => [key.trim(), String(value ?? "").trim()]).filter(([key, value]) => key.length > 0 && value.length > 0);
+	if (entries.length === 0) return null;
+	return Object.fromEntries(entries);
+}
+function updateChannel(configPath, channelName, patch, options) {
+	const config = loadConfigOrDefault(configPath);
+	const normalizedOptions = normalizeExtensionProjectionOptions(options);
+	const channel = getProjectedChannelConfig(config, channelName, normalizedOptions);
+	if (!channel) return null;
+	for (const key of Object.keys(patch)) {
+		const path = `channels.${channelName}.${key}`;
+		if (isSensitivePath(path)) config.secrets.refs = clearSecretRef(config.secrets.refs, path);
+	}
+	const mergedChannel = {
+		...channel,
+		...patch
 	};
-	if (Object.prototype.hasOwnProperty.call(patch, "freshness")) {
-		const freshness = normalizeOptionalString$1(patch.freshness);
-		nextProvider = {
-			...nextProvider,
-			freshness: freshness === "noLimit" || freshness === "oneDay" || freshness === "oneWeek" || freshness === "oneMonth" || freshness === "oneYear" ? freshness : "noLimit"
-		};
+	const mergedExtensionConfig = mergeProjectedExtensionChannelConfig(config, channelName, mergedChannel, normalizedOptions);
+	if (mergedExtensionConfig) {
+		const next = ConfigSchema.parse(mergedExtensionConfig);
+		saveConfig(next, configPath);
+		return sanitizePublicConfigValue(getProjectedChannelConfig(next, channelName, normalizedOptions) ?? {}, `channels.${channelName}`, buildUiHints(next, normalizedOptions));
 	}
-	return replaceSearchConfig(config, {
-		...config.search,
-		providers: {
-			...config.search.providers,
-			bocha: nextProvider
-		}
-	}, nextRefs);
+	config.channels[channelName] = mergedChannel;
+	const next = ConfigSchema.parse(config);
+	saveConfig(next, configPath);
+	return sanitizePublicConfigValue(getProjectedChannelConfig(next, channelName, normalizedOptions) ?? {}, `channels.${channelName}`, buildUiHints(next, normalizedOptions));
 }
-function applyTavilySearchPatch(config, patch) {
-	if (!patch) return config;
-	let nextRefs = config.secrets.refs;
-	let nextProvider = config.search.providers.tavily;
-	if (Object.prototype.hasOwnProperty.call(patch, "apiKey")) {
-		nextProvider = {
-			...nextProvider,
-			apiKey: patch.apiKey ?? ""
+function applyRuntimeAgentDefaultsPatch(defaults, defaultsPatch) {
+	if (!defaultsPatch) return defaults;
+	let next = defaults;
+	if (Object.prototype.hasOwnProperty.call(defaultsPatch, "contextTokens")) {
+		const nextContextTokens = defaultsPatch.contextTokens;
+		if (typeof nextContextTokens === "number" && Number.isFinite(nextContextTokens)) next = {
+			...next,
+			contextTokens: Math.trunc(nextContextTokens)
 		};
-		nextRefs = clearSecretRef$1(nextRefs, "search.providers.tavily.apiKey");
 	}
-	if (Object.prototype.hasOwnProperty.call(patch, "baseUrl")) nextProvider = {
-		...nextProvider,
-		baseUrl: normalizeOptionalString$1(patch.baseUrl) ?? "https://api.tavily.com/search"
+	if (Object.prototype.hasOwnProperty.call(defaultsPatch, "engine")) next = {
+		...next,
+		engine: normalizeOptionalString(defaultsPatch.engine) ?? "native"
 	};
-	if (Object.prototype.hasOwnProperty.call(patch, "searchDepth")) {
-		const searchDepth = normalizeOptionalString$1(patch.searchDepth);
-		nextProvider = {
-			...nextProvider,
-			searchDepth: searchDepth === "advanced" ? "advanced" : "basic"
+	if (Object.prototype.hasOwnProperty.call(defaultsPatch, "engineConfig")) {
+		const nextEngineConfig = defaultsPatch.engineConfig;
+		if (nextEngineConfig && typeof nextEngineConfig === "object" && !Array.isArray(nextEngineConfig)) next = {
+			...next,
+			engineConfig: { ...nextEngineConfig }
 		};
 	}
-	if (Object.prototype.hasOwnProperty.call(patch, "includeAnswer")) nextProvider = {
-		...nextProvider,
-		includeAnswer: Boolean(patch.includeAnswer)
-	};
-	return replaceSearchConfig(config, {
-		...config.search,
-		providers: {
-			...config.search.providers,
-			tavily: nextProvider
-		}
-	}, nextRefs);
+	return next;
 }
-function applyBraveSearchPatch(config, patch) {
-	if (!patch) return config;
-	let nextRefs = config.secrets.refs;
-	let nextProvider = config.search.providers.brave;
-	if (Object.prototype.hasOwnProperty.call(patch, "apiKey")) {
-		nextProvider = {
-			...nextProvider,
-			apiKey: patch.apiKey ?? ""
+function updateRuntime(configPath, patch) {
+	const config = loadConfigOrDefault(configPath);
+	if (patch.companion && Object.prototype.hasOwnProperty.call(patch.companion, "enabled")) config.companion.enabled = Boolean(patch.companion.enabled);
+	config.agents.defaults = applyRuntimeAgentDefaultsPatch(config.agents.defaults, patch.agents?.defaults);
+	if (patch.agents && Object.prototype.hasOwnProperty.call(patch.agents, "list")) config.agents.list = (patch.agents.list ?? []).map((entry) => {
+		const normalizedEngine = normalizeOptionalString(entry.engine);
+		const hasEngineConfig = entry.engineConfig && typeof entry.engineConfig === "object" && !Array.isArray(entry.engineConfig);
+		return {
+			...entry,
+			default: Boolean(entry.default),
+			...normalizedEngine ? { engine: normalizedEngine } : {},
+			...hasEngineConfig ? { engineConfig: { ...entry.engineConfig } } : {}
 		};
-		nextRefs = clearSecretRef$1(nextRefs, "search.providers.brave.apiKey");
-	}
-	if (Object.prototype.hasOwnProperty.call(patch, "baseUrl")) nextProvider = {
-		...nextProvider,
-		baseUrl: normalizeOptionalString$1(patch.baseUrl) ?? "https://api.search.brave.com/res/v1/web/search"
+	});
+	if (patch.agents?.runtimes && Object.prototype.hasOwnProperty.call(patch.agents.runtimes, "entries")) config.agents.runtimes.entries = normalizeRuntimeEntries(patch.agents.runtimes.entries);
+	if (Object.prototype.hasOwnProperty.call(patch, "bindings")) config.bindings = patch.bindings ?? [];
+	if (patch.session) config.session = {
+		...config.session,
+		...patch.session
+	};
+	const next = ConfigSchema.parse(config);
+	saveConfig(next, configPath);
+	const view = buildConfigView(next);
+	return {
+		companion: view.companion,
+		agents: view.agents,
+		bindings: view.bindings ?? [],
+		session: view.session ?? {}
 	};
-	return replaceSearchConfig(config, {
-		...config.search,
-		providers: {
-			...config.search.providers,
-			brave: nextProvider
-		}
-	}, nextRefs);
 }
-function updateSearch(configPath, patch) {
-	const nextConfig = applyBraveSearchPatch(applyTavilySearchPatch(applyBochaSearchPatch(applySearchDefaultsPatch(applyEnabledSearchProvidersPatch(applyActiveSearchProviderPatch(loadConfig(configPath), patch.provider), patch.enabledProviders), patch.defaults), patch.providers?.bocha), patch.providers?.tavily), patch.providers?.brave);
-	const next = ConfigSchema.parse(nextConfig);
+function updateSecrets(configPath, patch) {
+	const config = loadConfigOrDefault(configPath);
+	if (Object.prototype.hasOwnProperty.call(patch, "enabled")) config.secrets.enabled = Boolean(patch.enabled);
+	if (patch.defaults) {
+		const nextDefaults = { ...config.secrets.defaults };
+		for (const source of [
+			"env",
+			"file",
+			"exec"
+		]) {
+			if (!Object.prototype.hasOwnProperty.call(patch.defaults, source)) continue;
+			const value = patch.defaults[source];
+			if (typeof value === "string" && value.trim()) nextDefaults[source] = value.trim();
+			else delete nextDefaults[source];
+		}
+		config.secrets.defaults = nextDefaults;
+	}
+	if (Object.prototype.hasOwnProperty.call(patch, "providers")) config.secrets.providers = patch.providers ?? {};
+	if (Object.prototype.hasOwnProperty.call(patch, "refs")) config.secrets.refs = patch.refs ?? {};
+	const next = ConfigSchema.parse(config);
 	saveConfig(next, configPath);
-	return buildSearchView(next);
+	return {
+		enabled: next.secrets.enabled,
+		defaults: { ...next.secrets.defaults },
+		providers: { ...next.secrets.providers },
+		refs: { ...next.secrets.refs }
+	};
 }
 //#endregion
-//#region src/features/config/stores/server-config.store.ts
-const MASK_MIN_LENGTH = 8;
-const EXTRA_SENSITIVE_PATH_PATTERNS = [
-	/authorization/i,
-	/cookie/i,
-	/session/i,
-	/bearer/i
-];
-const PREFERRED_PROVIDER_ORDER_INDEX = new Map([
-	"nextclaw",
-	"openai",
-	"anthropic",
-	"gemini",
-	"openrouter",
-	"dashscope-coding-plan",
-	"dashscope",
-	"deepseek",
-	"minimax",
-	"moonshot",
-	"kimi-coding",
-	"zhipu"
-].map((name, index) => [name, index]));
-const BUILTIN_PROVIDERS = listServerBuiltinProviders();
-const BUILTIN_PROVIDER_NAMES = new Set(BUILTIN_PROVIDERS.map((spec) => spec.name));
-const CUSTOM_PROVIDER_PREFIX = "custom-";
+//#region src/features/config/services/provider-connectivity.service.ts
 const PROVIDER_TEST_MAX_TOKENS = 16;
-function normalizeOptionalDisplayName(value) {
-	if (typeof value !== "string") return null;
-	const trimmed = value.trim();
-	return trimmed.length > 0 ? trimmed : null;
+var ProviderConnectivityService = class {
+	constructor(configPath, providerManager) {
+		this.configPath = configPath;
+		this.providerManager = providerManager;
+	}
+	normalizeOptionalString = (value) => {
+		if (typeof value !== "string") return null;
+		const trimmed = value.trim();
+		return trimmed.length > 0 ? trimmed : null;
+	};
+	normalizeHeaders = (input) => {
+		if (!input) return null;
+		const entries = Object.entries(input).map(([key, value]) => [key.trim(), String(value ?? "").trim()]).filter(([key, value]) => key.length > 0 && value.length > 0);
+		return entries.length > 0 ? Object.fromEntries(entries) : null;
+	};
+	normalizeModelList = (input) => {
+		const models = /* @__PURE__ */ new Set();
+		for (const value of input ?? []) {
+			const model = typeof value === "string" ? value.trim() : "";
+			if (model) models.add(model);
+		}
+		return [...models];
+	};
+	resolveProviderType = (providerId, provider) => {
+		const configuredType = this.normalizeOptionalString(provider?.providerType);
+		if (configuredType && findServerBuiltinProviderByName(configuredType)) return configuredType;
+		return findServerBuiltinProviderByName(providerId) ? providerId : null;
+	};
+	resolveRuntimeDraft = (providerId, provider, patch) => {
+		const providerType = this.resolveProviderType(providerId, provider);
+		const spec = findServerBuiltinProviderByName(providerType ?? "");
+		return {
+			providerType,
+			spec,
+			apiKey: Object.prototype.hasOwnProperty.call(patch, "apiKey") ? this.normalizeOptionalString(patch.apiKey) ?? this.normalizeOptionalString(spec?.anonymousApiKey) : this.normalizeOptionalString(provider.apiKey) ?? this.normalizeOptionalString(spec?.anonymousApiKey),
+			apiBase: Object.prototype.hasOwnProperty.call(patch, "apiBase") ? this.normalizeOptionalString(patch.apiBase) ?? spec?.defaultApiBase ?? null : this.normalizeOptionalString(provider.apiBase) ?? spec?.defaultApiBase ?? null,
+			extraHeaders: Object.prototype.hasOwnProperty.call(patch, "extraHeaders") ? this.normalizeHeaders(patch.extraHeaders ?? null) : this.normalizeHeaders(provider.extraHeaders ?? null),
+			wireApi: spec?.supportsWireApi || !spec ? patch.wireApi ?? provider.wireApi ?? spec?.defaultWireApi ?? "auto" : null
+		};
+	};
+	buildScopedModel = (providerName, model, spec) => {
+		const trimmed = model.trim();
+		if (!trimmed || trimmed.includes("/") || !findServerBuiltinProviderByName(providerName)) return trimmed;
+		const prefix = (spec?.modelPrefix ?? providerName).trim();
+		return prefix ? `${prefix}/${trimmed}` : trimmed;
+	};
+	rewriteProviderRoutePrefix = (providerId, targetPrefix, model) => {
+		const prefix = `${providerId}/`;
+		if (!model.startsWith(prefix)) return model;
+		const stripped = model.slice(prefix.length).trim();
+		return stripped ? targetPrefix ? `${targetPrefix}/${stripped}` : stripped : model;
+	};
+	resolveTestModel = (config, providerId, requestedModel, provider, spec) => {
+		if (requestedModel) return this.rewriteProviderRoutePrefix(providerId, spec?.name ?? null, requestedModel);
+		const providerModels = this.normalizeModelList(provider.models).map((modelId) => {
+			const providerModel = this.rewriteProviderRoutePrefix(providerId, null, modelId);
+			return spec ? this.buildScopedModel(spec.name, providerModel, spec) : providerModel;
+		}).filter(Boolean);
+		if (providerModels.length > 0) return providerModels[0] ?? null;
+		const defaultModel = this.normalizeOptionalString(config.agents.defaults.model);
+		if (defaultModel) {
+			const routedProvider = getProviderName(config, defaultModel);
+			if (!routedProvider || routedProvider === providerId) return this.rewriteProviderRoutePrefix(providerId, spec?.name ?? null, defaultModel);
+		}
+		return spec ? this.normalizeModelList(spec.defaultModels)[0] ?? defaultModel : null;
+	};
+	readProvider = (providerId) => {
+		const config = loadConfigOrDefault(this.configPath);
+		const provider = config.providers[providerId];
+		return provider ? {
+			config,
+			provider
+		} : null;
+	};
+	testConnection = async (providerId, patch) => {
+		const resolved = this.readProvider(providerId);
+		if (!resolved) return null;
+		const { config, provider } = resolved;
+		const { providerType, spec, apiKey, apiBase, extraHeaders, wireApi } = this.resolveRuntimeDraft(providerId, provider, patch);
+		if (!apiKey && !spec?.isLocal) return {
+			success: false,
+			provider: providerId,
+			latencyMs: 0,
+			message: "API key is required before testing the connection."
+		};
+		const model = this.resolveTestModel(config, providerId, this.normalizeOptionalString(patch.model), provider, spec);
+		if (!model) return {
+			success: false,
+			provider: providerId,
+			latencyMs: 0,
+			message: "No test model found. Configure provider models or set a default model for this provider, then try again."
+		};
+		const startedAtMs = Date.now();
+		if (!this.providerManager) return {
+			success: false,
+			provider: providerId,
+			model,
+			latencyMs: Date.now() - startedAtMs,
+			message: "Provider manager is unavailable."
+		};
+		try {
+			await this.providerManager.testConnection({
+				providerName: providerType,
+				apiKey,
+				apiBase,
+				defaultModel: model,
+				extraHeaders,
+				wireApi,
+				messages: [{
+					role: "user",
+					content: "ping"
+				}],
+				maxTokens: PROVIDER_TEST_MAX_TOKENS
+			});
+			return {
+				success: true,
+				provider: providerId,
+				model,
+				latencyMs: Date.now() - startedAtMs,
+				message: "Connection test passed."
+			};
+		} catch (error) {
+			const message = error instanceof Error ? error.message : String(error);
+			return {
+				success: false,
+				provider: providerId,
+				model,
+				latencyMs: Date.now() - startedAtMs,
+				message: message.replace(/\s+/g, " ").trim() || "Connection test failed."
+			};
+		}
+	};
+	discoverModels = async (providerId, patch) => {
+		const resolved = this.readProvider(providerId);
+		if (!resolved) return null;
+		if (!this.providerManager) throw new Error("Provider manager is unavailable.");
+		const { providerType, apiKey, apiBase, extraHeaders } = this.resolveRuntimeDraft(providerId, resolved.provider, patch);
+		const result = await this.providerManager.discoverModels({
+			providerName: providerType,
+			apiKey,
+			apiBase,
+			extraHeaders
+		});
+		return {
+			provider: providerId,
+			models: result.models,
+			source: result.source,
+			fetchedAt: (/* @__PURE__ */ new Date()).toISOString()
+		};
+	};
+};
+//#endregion
+//#region src/features/config/utils/channel-auth.utils.ts
+function cloneChannelConfig(value) {
+	if (!value || typeof value !== "object" || Array.isArray(value)) return;
+	return JSON.parse(JSON.stringify(value));
 }
-function isCustomProviderName(name) {
-	return name.trim().length > 0 && !BUILTIN_PROVIDER_NAMES.has(name);
+function findExtensionChannelBinding(bindings, channelId) {
+	const normalizedChannelId = channelId.trim().toLowerCase();
+	return bindings.find((binding) => binding.channelId.trim().toLowerCase() === normalizedChannelId) ?? null;
 }
-function resolveCustomProviderFallbackDisplayName(name) {
-	if (name.startsWith(CUSTOM_PROVIDER_PREFIX)) {
-		const suffix = name.slice(7);
-		if (/^\d+$/.test(suffix)) return `Custom ${suffix}`;
-	}
-	return name;
+function toPublicChannelAuthPollResult(result) {
+	return {
+		channel: result.channel,
+		status: result.status,
+		message: result.message,
+		nextPollMs: result.nextPollMs,
+		accountId: result.accountId,
+		notes: result.notes
+	};
 }
-function resolveProviderInstanceDisplayName(providerId, provider, spec) {
-	return normalizeOptionalDisplayName(provider?.displayName) ?? spec?.displayName ?? (providerId.startsWith(CUSTOM_PROVIDER_PREFIX) ? resolveCustomProviderFallbackDisplayName(providerId) : providerId);
+function applyAuthorizedChannelAuthResult(params) {
+	const { configPath, binding, result } = params;
+	if (result.status !== "authorized" || !result.channelConfig) return;
+	const currentConfig = loadConfigOrDefault(configPath);
+	saveConfig({
+		...currentConfig,
+		channels: {
+			...currentConfig.channels,
+			[binding.channelId]: result.channelConfig
+		}
+	}, configPath);
 }
-function findNextCustomProviderName(config) {
-	const providers = config.providers;
-	let index = 1;
-	while (providers[`${CUSTOM_PROVIDER_PREFIX}${index}`]) index += 1;
-	return `${CUSTOM_PROVIDER_PREFIX}${index}`;
+async function startChannelAuth(params) {
+	const { configPath, channelId, request, bindings } = params;
+	const binding = findExtensionChannelBinding(bindings, channelId);
+	const start = binding?.channel.auth?.start;
+	if (!binding || !start) return null;
+	const configView = getProjectedConfigView(loadConfigOrDefault(configPath), { extensionChannelBindings: bindings });
+	return await start({
+		cfg: configView,
+		extensionId: binding.extensionId,
+		channelId: binding.channelId,
+		channelConfig: cloneChannelConfig(configView.channels?.[binding.channelId]),
+		accountId: request.accountId?.trim() || null,
+		baseUrl: request.baseUrl?.trim() || null,
+		domain: request.domain?.trim() || null
+	});
 }
-function normalizeProviderId(value) {
-	if (typeof value !== "string") return null;
-	const trimmed = value.trim();
-	if (!trimmed || trimmed.includes("/")) return null;
-	return trimmed;
+async function pollChannelAuth(params) {
+	const { configPath, channelId, sessionId, bindings } = params;
+	const binding = findExtensionChannelBinding(bindings, channelId);
+	const poll = binding?.channel.auth?.poll;
+	if (!binding || !poll) return null;
+	const configView = getProjectedConfigView(loadConfigOrDefault(configPath), { extensionChannelBindings: bindings });
+	const result = await poll({
+		cfg: configView,
+		extensionId: binding.extensionId,
+		channelId: binding.channelId,
+		channelConfig: cloneChannelConfig(configView.channels?.[binding.channelId]),
+		sessionId
+	});
+	if (!result) return null;
+	applyAuthorizedChannelAuthResult({
+		configPath,
+		binding,
+		result
+	});
+	return toPublicChannelAuthPollResult(result);
 }
-function resolveProviderType(providerId, provider) {
-	const configuredType = normalizeProviderId(provider?.providerType);
-	if (configuredType && findServerBuiltinProviderByName(configuredType)) return configuredType;
-	if (findServerBuiltinProviderByName(providerId)) return providerId;
-	return null;
+async function connectChannelAuth(params) {
+	const { configPath, channelId, request, bindings } = params;
+	const binding = findExtensionChannelBinding(bindings, channelId);
+	const connect = binding?.channel.auth?.connect;
+	if (!binding || !connect) return null;
+	const configView = getProjectedConfigView(loadConfigOrDefault(configPath), { extensionChannelBindings: bindings });
+	const result = await connect({
+		cfg: configView,
+		extensionId: binding.extensionId,
+		channelId: binding.channelId,
+		channelConfig: cloneChannelConfig(configView.channels?.[binding.channelId]),
+		accountId: request.accountId?.trim() || null,
+		domain: request.domain?.trim() || null,
+		fields: request.fields
+	});
+	applyAuthorizedChannelAuthResult({
+		configPath,
+		binding,
+		result
+	});
+	return toPublicChannelAuthPollResult(result);
 }
-function findNextProviderId(config, baseProviderId) {
-	const providers = config.providers;
-	let providerId = baseProviderId;
-	let index = 2;
-	while (providers[providerId]) {
-		providerId = `${baseProviderId}-${index}`;
-		index += 1;
-	}
-	return providerId;
+//#endregion
+//#region src/features/config/utils/provider-auth.utils.ts
+const authSessions = /* @__PURE__ */ new Map();
+const DEFAULT_AUTH_INTERVAL_MS = 2e3;
+const MAX_AUTH_INTERVAL_MS = 1e4;
+function normalizePositiveInt(value, fallback) {
+	if (typeof value !== "number" || !Number.isFinite(value) || value <= 0) return fallback;
+	return Math.floor(value);
 }
-function resolveProviderDisplayNameSuffix(providerId, baseProviderId) {
-	if (providerId === baseProviderId) return "";
-	const suffix = providerId.slice(baseProviderId.length + 1).trim();
-	return suffix ? ` ${suffix}` : "";
+function normalizePositiveFloat(value) {
+	if (typeof value !== "number" || !Number.isFinite(value) || value <= 0) return null;
+	return value;
 }
-function buildProviderScopedModels(providerId, models) {
-	return normalizeModelList(models).map((model) => {
-		const slashIndex = model.indexOf("/");
-		const modelSuffix = slashIndex >= 0 ? model.slice(slashIndex + 1).trim() : model;
-		return modelSuffix ? `${providerId}/${modelSuffix}` : "";
-	}).filter(Boolean);
+function toBase64Url(buffer) {
+	return buffer.toString("base64").replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/g, "");
 }
-function clearSecretRefsByPrefix(refs, pathPrefix) {
-	return Object.fromEntries(Object.entries(refs).filter(([key]) => key !== pathPrefix && !key.startsWith(`${pathPrefix}.`)));
+function buildPkce() {
+	const verifier = toBase64Url(randomBytes(48));
+	return {
+		verifier,
+		challenge: toBase64Url(createHash("sha256").update(verifier).digest())
+	};
 }
-function matchesExtraSensitivePath(path) {
-	return path !== "session" && !path.startsWith("session.") && EXTRA_SENSITIVE_PATH_PATTERNS.some((pattern) => pattern.test(path));
+function withTrailingSlash(value) {
+	return value.endsWith("/") ? value : `${value}/`;
 }
-function matchHint(path, hints) {
-	const direct = hints[path];
-	if (direct) return direct;
-	const segments = path.split(".");
-	for (const [hintKey, hint] of Object.entries(hints)) {
-		if (!hintKey.includes("*")) continue;
-		const hintSegments = hintKey.split(".");
-		if (hintSegments.length !== segments.length) continue;
-		let match = true;
-		for (let index = 0; index < segments.length; index += 1) if (hintSegments[index] !== "*" && hintSegments[index] !== segments[index]) {
-			match = false;
-			break;
-		}
-		if (match) return hint;
-	}
+function cleanupExpiredAuthSessions(now = Date.now()) {
+	for (const [sessionId, session] of authSessions.entries()) if (session.expiresAtMs <= now) authSessions.delete(sessionId);
 }
-function isSensitivePath(path, hints) {
-	if (hints) {
-		const hint = matchHint(path, hints);
-		if (hint?.sensitive !== void 0) return Boolean(hint.sensitive);
-	}
-	return isSensitiveConfigPath(path) || matchesExtraSensitivePath(path);
+function resolveDeviceCodeEndpoints(baseUrl, deviceCodePath, tokenPath) {
+	return {
+		deviceCodeEndpoint: new URL(deviceCodePath, withTrailingSlash(baseUrl)).toString(),
+		tokenEndpoint: new URL(tokenPath, withTrailingSlash(baseUrl)).toString()
+	};
 }
-function sanitizePublicConfigValue(value, prefix, hints) {
-	if (Array.isArray(value)) {
-		const nextPath = prefix ? `${prefix}[]` : "[]";
-		return value.map((entry) => sanitizePublicConfigValue(entry, nextPath, hints));
-	}
-	if (!value || typeof value !== "object") return value;
-	const output = {};
-	for (const [key, val] of Object.entries(value)) {
-		const nextPath = prefix ? `${prefix}.${key}` : key;
-		if (isSensitivePath(nextPath, hints)) continue;
-		output[key] = sanitizePublicConfigValue(val, nextPath, hints);
-	}
-	return output;
+function resolveAuthNote(params) {
+	return params.zh ?? params.en;
 }
-function isObject(value) {
-	return typeof value === "object" && value !== null && !Array.isArray(value);
+function resolveLocalizedMethodLabel(method, fallbackId) {
+	return method.label?.zh ?? method.label?.en ?? fallbackId;
 }
-function deepMerge(base, patch) {
-	if (!isObject(base) || !isObject(patch)) return patch;
-	const result = { ...base };
-	for (const [key, value] of Object.entries(patch)) {
-		const previous = result[key];
-		result[key] = deepMerge(previous, value);
-	}
-	return result;
+function resolveLocalizedMethodHint(method) {
+	return method.hint?.zh ?? method.hint?.en;
 }
-function getPathValue(source, path) {
-	if (!source || typeof source !== "object") return;
-	const segments = path.split(".");
-	let current = source;
-	for (const segment of segments) {
-		if (!current || typeof current !== "object") return;
-		current = current[segment];
-	}
-	return current;
+function normalizeMethodId(value) {
+	if (typeof value !== "string") return;
+	const trimmed = value.trim();
+	return trimmed.length > 0 ? trimmed : void 0;
 }
-function setPathValue(target, path, value) {
-	const segments = path.split(".");
-	if (segments.length === 0) return;
-	let current = target;
-	for (let index = 0; index < segments.length - 1; index += 1) {
-		const segment = segments[index];
-		const next = current[segment];
-		if (!isObject(next)) current[segment] = {};
-		current = current[segment];
+function resolveAuthMethod(auth, requestedMethodId) {
+	const protocol = auth.protocol ?? "rfc8628";
+	const methods = (auth.methods ?? []).filter((entry) => normalizeMethodId(entry.id));
+	const cleanRequestedMethodId = normalizeMethodId(requestedMethodId);
+	if (methods.length === 0) {
+		if (cleanRequestedMethodId) throw new Error(`provider auth method is not supported: ${cleanRequestedMethodId}`);
+		return {
+			protocol,
+			baseUrl: auth.baseUrl,
+			deviceCodePath: auth.deviceCodePath,
+			tokenPath: auth.tokenPath,
+			clientId: auth.clientId,
+			scope: auth.scope,
+			grantType: auth.grantType,
+			usePkce: Boolean(auth.usePkce)
+		};
 	}
-	current[segments[segments.length - 1]] = value;
+	let selectedMethod = methods.find((entry) => normalizeMethodId(entry.id) === cleanRequestedMethodId);
+	if (!selectedMethod) {
+		const fallbackMethodId = normalizeMethodId(auth.defaultMethodId) ?? normalizeMethodId(methods[0]?.id);
+		selectedMethod = methods.find((entry) => normalizeMethodId(entry.id) === fallbackMethodId) ?? methods[0];
+	}
+	const methodId = normalizeMethodId(selectedMethod?.id);
+	if (!selectedMethod || !methodId) throw new Error("provider auth method is not configured");
+	if (cleanRequestedMethodId && methodId !== cleanRequestedMethodId) throw new Error(`provider auth method is not supported: ${cleanRequestedMethodId}`);
+	return {
+		id: methodId,
+		protocol,
+		baseUrl: selectedMethod.baseUrl ?? auth.baseUrl,
+		deviceCodePath: selectedMethod.deviceCodePath ?? auth.deviceCodePath,
+		tokenPath: selectedMethod.tokenPath ?? auth.tokenPath,
+		clientId: selectedMethod.clientId ?? auth.clientId,
+		scope: selectedMethod.scope ?? auth.scope,
+		grantType: selectedMethod.grantType ?? auth.grantType,
+		usePkce: selectedMethod.usePkce ?? Boolean(auth.usePkce),
+		defaultApiBase: selectedMethod.defaultApiBase
+	};
 }
-function isMissingRequiredValue(value) {
-	if (value === void 0 || value === null) return true;
-	if (typeof value === "string") return value.trim().length === 0;
-	if (Array.isArray(value)) return value.length === 0;
-	return false;
+function parseExpiresAtMs(value, fallbackFromNowMs) {
+	const normalized = normalizePositiveFloat(value);
+	if (normalized === null) return Date.now() + fallbackFromNowMs;
+	if (normalized >= 0xe8d4a51000) return Math.floor(normalized);
+	if (normalized >= 1e9) return Math.floor(normalized * 1e3);
+	return Date.now() + Math.floor(normalized * 1e3);
 }
-function resolveRuntimeConfig(config, draftConfig) {
-	if (!draftConfig || Object.keys(draftConfig).length === 0) return config;
-	const merged = deepMerge(config, draftConfig);
-	return ConfigSchema.parse(merged);
+function parsePollIntervalMs(value, fallbackMs) {
+	const normalized = normalizePositiveFloat(value);
+	if (normalized === null) return fallbackMs;
+	if (normalized <= 30) return Math.floor(normalized * 1e3);
+	return Math.floor(normalized);
 }
-function getActionById(config, actionId) {
-	return buildConfigSchemaView(config).actions.find((item) => item.id === actionId) ?? null;
+function buildMinimaxErrorMessage(payload, fallback) {
+	if (!payload || typeof payload !== "object" || Array.isArray(payload)) return fallback;
+	const record = payload;
+	if (typeof record.error_description === "string" && record.error_description.trim()) return record.error_description.trim();
+	if (typeof record.error === "string" && record.error.trim()) return record.error.trim();
+	const baseMessage = record.base_resp?.status_msg;
+	if (typeof baseMessage === "string" && baseMessage.trim()) return baseMessage.trim();
+	return fallback;
 }
-function messageOrDefault(action, kind, fallback) {
-	const text = kind === "success" ? action.success?.message : action.failure?.message;
-	return text?.trim() ? text : fallback;
+function classifyMiniMaxErrorStatus(message) {
+	const normalized = message.toLowerCase();
+	if (normalized.includes("deny") || normalized.includes("rejected")) return "denied";
+	if (normalized.includes("expired") || normalized.includes("timeout") || normalized.includes("timed out")) return "expired";
+	return "error";
 }
-async function runFeishuVerifyAction(params) {
-	const { config, action } = params;
-	const appId = String(config.channels.feishu.appId ?? "").trim();
-	const appSecret = String(config.channels.feishu.appSecret ?? "").trim();
-	if (!appId || !appSecret) return {
-		ok: false,
-		status: "failed",
-		message: messageOrDefault(action, "failure", "Verification failed: missing credentials"),
-		data: { error: "missing credentials (appId, appSecret)" },
-		nextActions: []
-	};
-	const result = await probeFeishu(appId, appSecret);
-	if (!result.ok) return {
-		ok: false,
-		status: "failed",
-		message: `${messageOrDefault(action, "failure", "Verification failed")}: ${result.error}`,
-		data: {
-			error: result.error,
-			appId: result.appId ?? appId
-		},
-		nextActions: []
-	};
-	const responseData = {
-		appId: result.appId,
-		botName: result.botName ?? null,
-		botOpenId: result.botOpenId ?? null
-	};
-	const patch = {};
-	for (const [targetPath, sourcePath] of Object.entries(action.resultMap ?? {})) {
-		const mappedValue = sourcePath.startsWith("response.data.") ? responseData[sourcePath.slice(14)] : void 0;
-		if (mappedValue !== void 0) setPathValue(patch, targetPath, mappedValue);
+function resolveHomePath(inputPath) {
+	const trimmed = inputPath.trim();
+	if (!trimmed) return trimmed;
+	if (trimmed === "~") return homedir();
+	if (trimmed.startsWith("~/")) return resolve(homedir(), trimmed.slice(2));
+	if (isAbsolute(trimmed)) return trimmed;
+	return resolve(trimmed);
+}
+function normalizeExpiresAt(value) {
+	if (typeof value === "number" && Number.isFinite(value) && value > 0) return Math.floor(value);
+	if (typeof value === "string" && value.trim()) {
+		const asNumber = Number(value);
+		if (Number.isFinite(asNumber) && asNumber > 0) return Math.floor(asNumber);
+		const parsedTime = Date.parse(value);
+		if (Number.isFinite(parsedTime) && parsedTime > 0) return parsedTime;
 	}
-	return {
-		ok: true,
-		status: "success",
-		message: messageOrDefault(action, "success", "Verified. Please finish Feishu event subscription and app publishing before using."),
-		data: responseData,
-		patch: Object.keys(patch).length > 0 ? patch : void 0,
-		nextActions: []
-	};
+	return null;
 }
-const ACTION_HANDLERS = { "channels.feishu.verifyConnection": runFeishuVerifyAction };
-function buildUiHints(config, options) {
-	return buildConfigSchemaView(config, options).uiHints;
+function readFieldAsString(source, fieldName) {
+	if (!fieldName) return null;
+	const rawValue = source[fieldName];
+	if (typeof rawValue !== "string") return null;
+	const trimmed = rawValue.trim();
+	return trimmed.length > 0 ? trimmed : null;
 }
-function maskApiKey(value) {
-	if (!value) return { apiKeySet: false };
-	if (value.length < MASK_MIN_LENGTH) return {
-		apiKeySet: true,
-		apiKeyMasked: "****"
+function setProviderApiKey({ configPath, provider, accessToken, defaultApiBase }) {
+	const config = loadConfig(configPath);
+	const providers = config.providers;
+	if (!providers[provider]) return;
+	const target = providers[provider];
+	target.apiKey = accessToken;
+	if (defaultApiBase) target.apiBase = defaultApiBase;
+	saveConfig(ConfigSchema.parse(config), configPath);
+}
+function resolveProviderAuthTarget(configPath, providerId) {
+	const provider = loadConfig(configPath).providers[providerId];
+	if (!provider) return null;
+	const configuredType = typeof provider.providerType === "string" ? provider.providerType.trim() : "";
+	if (configuredType && findServerBuiltinProviderByName(configuredType)) return {
+		providerId,
+		providerType: configuredType,
+		provider
 	};
-	return {
-		apiKeySet: true,
-		apiKeyMasked: `${value.slice(0, 2)}****${value.slice(-4)}`
+	if (findServerBuiltinProviderByName(providerId)) return {
+		providerId,
+		providerType: providerId,
+		provider
 	};
+	return null;
 }
-function normalizeModelList(input) {
-	if (!input || input.length === 0) return [];
-	const deduped = /* @__PURE__ */ new Set();
-	for (const item of input) {
-		if (typeof item !== "string") continue;
-		const trimmed = item.trim();
-		if (!trimmed) continue;
-		deduped.add(trimmed);
+async function startProviderAuth(configPath, providerId, options) {
+	cleanupExpiredAuthSessions();
+	const target = resolveProviderAuthTarget(configPath, providerId);
+	if (!target) return null;
+	const spec = findServerBuiltinProviderByName(target.providerType);
+	if (!spec?.auth || spec.auth.kind !== "device_code") return null;
+	const resolvedMethod = resolveAuthMethod(spec.auth, options?.methodId);
+	const { deviceCodeEndpoint, tokenEndpoint } = resolveDeviceCodeEndpoints(resolvedMethod.baseUrl, resolvedMethod.deviceCodePath, resolvedMethod.tokenPath);
+	const pkce = resolvedMethod.usePkce ? buildPkce() : null;
+	let authorizationCode = "";
+	let tokenCodeField = "device_code";
+	let userCode = "";
+	let verificationUri = "";
+	let intervalMs = DEFAULT_AUTH_INTERVAL_MS;
+	let expiresAtMs = Date.now() + 6e5;
+	if (resolvedMethod.protocol === "minimax_user_code") {
+		if (!pkce) throw new Error("MiniMax OAuth requires PKCE");
+		const state = toBase64Url(randomBytes(16));
+		const body = new URLSearchParams({
+			response_type: "code",
+			client_id: resolvedMethod.clientId,
+			scope: resolvedMethod.scope,
+			code_challenge: pkce.challenge,
+			code_challenge_method: "S256",
+			state
+		});
+		const response = await fetch(deviceCodeEndpoint, {
+			method: "POST",
+			headers: {
+				"Content-Type": "application/x-www-form-urlencoded",
+				Accept: "application/json",
+				"x-request-id": randomUUID()
+			},
+			body
+		});
+		const payload = await response.json().catch(() => ({}));
+		if (!response.ok) throw new Error(buildMinimaxErrorMessage(payload, response.statusText || "MiniMax OAuth start failed"));
+		if (payload.state && payload.state !== state) throw new Error("MiniMax OAuth state mismatch");
+		authorizationCode = payload.user_code?.trim() ?? "";
+		userCode = authorizationCode;
+		verificationUri = payload.verification_uri?.trim() ?? "";
+		if (!authorizationCode || !verificationUri) throw new Error("provider auth payload is incomplete");
+		tokenCodeField = "user_code";
+		intervalMs = Math.min(parsePollIntervalMs(payload.interval, DEFAULT_AUTH_INTERVAL_MS), MAX_AUTH_INTERVAL_MS);
+		expiresAtMs = parseExpiresAtMs(payload.expired_in, 6e5);
+	} else {
+		const body = new URLSearchParams({
+			client_id: resolvedMethod.clientId,
+			scope: resolvedMethod.scope
+		});
+		if (pkce) {
+			body.set("code_challenge", pkce.challenge);
+			body.set("code_challenge_method", "S256");
+		}
+		const response = await fetch(deviceCodeEndpoint, {
+			method: "POST",
+			headers: {
+				"Content-Type": "application/x-www-form-urlencoded",
+				Accept: "application/json"
+			},
+			body
+		});
+		const payload = await response.json().catch(() => ({}));
+		if (!response.ok) {
+			const message = payload.error_description || payload.error || response.statusText || "device code auth failed";
+			throw new Error(message);
+		}
+		authorizationCode = payload.device_code?.trim() ?? "";
+		userCode = payload.user_code?.trim() ?? "";
+		verificationUri = payload.verification_uri_complete?.trim() || payload.verification_uri?.trim() || "";
+		if (!authorizationCode || !userCode || !verificationUri) throw new Error("provider auth payload is incomplete");
+		intervalMs = normalizePositiveInt(payload.interval, DEFAULT_AUTH_INTERVAL_MS / 1e3) * 1e3;
+		const expiresInSec = normalizePositiveInt(payload.expires_in, 600);
+		expiresAtMs = Date.now() + expiresInSec * 1e3;
 	}
-	return [...deduped];
-}
-function toProviderView(config, provider, providerId, uiHints, spec) {
-	const providerType = resolveProviderType(providerId, provider);
-	const apiKeyRefSet = hasSecretRef(config, `providers.${providerId}.apiKey`);
-	const masked = maskApiKey(provider.apiKey);
-	const extraHeaders = provider.extraHeaders && Object.keys(provider.extraHeaders).length > 0 ? sanitizePublicConfigValue(provider.extraHeaders, `providers.${providerId}.extraHeaders`, uiHints) : null;
-	const supportsWireApi = Boolean(spec?.supportsWireApi) || providerType === null;
-	return {
+	const sessionId = randomUUID();
+	authSessions.set(sessionId, {
+		sessionId,
 		providerId,
-		providerType,
-		isBuiltInType: providerType !== null,
-		isCustom: providerType === null,
-		enabled: provider.enabled !== false,
-		displayName: resolveProviderInstanceDisplayName(providerId, provider, spec),
-		apiKeyRequired: !spec?.anonymousApiKey,
-		apiKeySet: masked.apiKeySet || apiKeyRefSet,
-		apiKeyMasked: masked.apiKeyMasked ?? (apiKeyRefSet ? "****" : void 0),
-		apiBase: provider.apiBase ?? null,
-		extraHeaders: extraHeaders && Object.keys(extraHeaders).length > 0 ? extraHeaders : null,
-		models: normalizeModelList(provider.models ?? []),
-		modelConfig: normalizeProviderModelConfig(provider.modelConfig ?? {}),
-		wireApi: supportsWireApi ? provider.wireApi ?? spec?.defaultWireApi ?? "auto" : void 0
+		providerType: target.providerType,
+		configPath,
+		authorizationCode,
+		tokenCodeField,
+		protocol: resolvedMethod.protocol,
+		methodId: resolvedMethod.id,
+		codeVerifier: pkce?.verifier,
+		tokenEndpoint,
+		clientId: resolvedMethod.clientId,
+		grantType: resolvedMethod.grantType,
+		defaultApiBase: resolvedMethod.defaultApiBase ?? spec.defaultApiBase,
+		expiresAtMs,
+		intervalMs
+	});
+	const methodConfig = (spec.auth.methods ?? []).find((entry) => normalizeMethodId(entry.id) === resolvedMethod.id);
+	const methodLabel = methodConfig ? resolveLocalizedMethodLabel(methodConfig, resolvedMethod.id ?? "") : void 0;
+	const methodHint = methodConfig ? resolveLocalizedMethodHint(methodConfig) : void 0;
+	return {
+		provider: providerId,
+		kind: "device_code",
+		methodId: resolvedMethod.id,
+		sessionId,
+		verificationUri,
+		userCode,
+		expiresAt: new Date(expiresAtMs).toISOString(),
+		intervalMs,
+		note: methodHint ?? methodLabel ?? resolveAuthNote(spec.auth.note ?? {})
 	};
 }
-function buildConfigView(config, options) {
-	const uiHints = buildUiHints(config, options);
-	const projectedChannels = getProjectedChannelMap(config, options);
-	const providers = {};
-	for (const [providerId, provider] of Object.entries(config.providers)) {
-		const providerConfig = provider;
-		providers[providerId] = toProviderView(config, providerConfig, providerId, uiHints, findServerBuiltinProviderByName(resolveProviderType(providerId, providerConfig) ?? ""));
+async function pollProviderAuth(params) {
+	const { configPath, providerName: providerId, sessionId } = params;
+	cleanupExpiredAuthSessions();
+	const session = authSessions.get(sessionId);
+	if (!session || session.providerId !== providerId || session.configPath !== configPath) return null;
+	if (Date.now() >= session.expiresAtMs) {
+		authSessions.delete(sessionId);
+		return {
+			provider: providerId,
+			status: "expired",
+			message: "authorization session expired"
+		};
 	}
-	return {
-		companion: sanitizePublicConfigValue(config.companion, "companion", uiHints),
-		agents: sanitizePublicConfigValue(config.agents, "agents", uiHints),
-		providers,
-		search: buildSearchView(config),
-		channels: sanitizePublicConfigValue(projectedChannels, "channels", uiHints),
-		bindings: sanitizePublicConfigValue(config.bindings, "bindings", uiHints),
-		session: sanitizePublicConfigValue(config.session, "session", uiHints),
-		tools: sanitizePublicConfigValue(config.tools, "tools", uiHints),
-		gateway: sanitizePublicConfigValue(config.gateway, "gateway", uiHints),
-		ui: sanitizePublicConfigValue(config.ui, "ui", uiHints),
-		secrets: {
-			enabled: config.secrets.enabled,
-			defaults: { ...config.secrets.defaults },
-			providers: { ...config.secrets.providers },
-			refs: { ...config.secrets.refs }
+	const body = new URLSearchParams({
+		grant_type: session.grantType,
+		client_id: session.clientId
+	});
+	body.set(session.tokenCodeField, session.authorizationCode);
+	if (session.codeVerifier) body.set("code_verifier", session.codeVerifier);
+	const response = await fetch(session.tokenEndpoint, {
+		method: "POST",
+		headers: {
+			"Content-Type": "application/x-www-form-urlencoded",
+			Accept: "application/json"
+		},
+		body
+	});
+	let accessToken = "";
+	if (session.protocol === "minimax_user_code") {
+		const raw = await response.text();
+		let payload = {};
+		if (raw) try {
+			payload = JSON.parse(raw);
+		} catch {
+			payload = {};
+		}
+		if (!response.ok) return {
+			provider: providerId,
+			status: "error",
+			message: buildMinimaxErrorMessage(payload, raw || response.statusText || "authorization failed")
+		};
+		const status = payload.status?.trim().toLowerCase();
+		if (status === "success") {
+			accessToken = payload.access_token?.trim() ?? "";
+			if (!accessToken) return {
+				provider: providerId,
+				status: "error",
+				message: "provider token response missing access token"
+			};
+		} else if (status === "error") {
+			const message = buildMinimaxErrorMessage(payload, "authorization failed");
+			const classified = classifyMiniMaxErrorStatus(message);
+			if (classified === "denied" || classified === "expired") authSessions.delete(sessionId);
+			return {
+				provider: providerId,
+				status: classified,
+				message
+			};
+		} else {
+			const nextPollMs = Math.min(Math.floor(session.intervalMs * 1.5), MAX_AUTH_INTERVAL_MS);
+			session.intervalMs = nextPollMs;
+			authSessions.set(sessionId, session);
+			return {
+				provider: providerId,
+				status: "pending",
+				nextPollMs
+			};
 		}
-	};
-}
-function normalizeRuntimeEntries(entries) {
-	if (!entries || typeof entries !== "object" || Array.isArray(entries)) return {};
-	const normalized = {};
-	for (const [rawId, rawEntry] of Object.entries(entries)) {
-		const id = rawId.trim();
-		if (!id || !rawEntry || typeof rawEntry !== "object" || Array.isArray(rawEntry)) continue;
-		const entry = rawEntry;
-		const type = normalizeOptionalString(entry.type);
-		if (!type) continue;
-		const normalizedIcon = normalizeRuntimeEntryIcon(entry.icon);
-		normalized[id] = {
-			enabled: typeof entry.enabled === "boolean" ? entry.enabled : true,
-			...normalizeOptionalString(entry.label) ? { label: normalizeOptionalString(entry.label) ?? void 0 } : {},
-			...normalizedIcon ? { icon: normalizedIcon } : {},
-			type,
-			config: normalizeRuntimeEntryConfig(type, entry.config && typeof entry.config === "object" && !Array.isArray(entry.config) ? entry.config : {})
+	} else {
+		const payload = await response.json().catch(() => ({}));
+		if (!response.ok) {
+			const errorCode = payload.error?.trim().toLowerCase();
+			if (errorCode === "authorization_pending") return {
+				provider: providerId,
+				status: "pending",
+				nextPollMs: session.intervalMs
+			};
+			if (errorCode === "slow_down") {
+				const nextPollMs = Math.min(Math.floor(session.intervalMs * 1.5), MAX_AUTH_INTERVAL_MS);
+				session.intervalMs = nextPollMs;
+				authSessions.set(sessionId, session);
+				return {
+					provider: providerId,
+					status: "pending",
+					nextPollMs
+				};
+			}
+			if (errorCode === "access_denied") {
+				authSessions.delete(sessionId);
+				return {
+					provider: providerId,
+					status: "denied",
+					message: payload.error_description || "authorization denied"
+				};
+			}
+			if (errorCode === "expired_token") {
+				authSessions.delete(sessionId);
+				return {
+					provider: providerId,
+					status: "expired",
+					message: payload.error_description || "authorization session expired"
+				};
+			}
+			return {
+				provider: providerId,
+				status: "error",
+				message: payload.error_description || payload.error || response.statusText || "authorization failed"
+			};
+		}
+		accessToken = payload.access_token?.trim() ?? "";
+		if (!accessToken) return {
+			provider: providerId,
+			status: "error",
+			message: "provider token response missing access token"
 		};
 	}
-	return normalized;
-}
-function normalizeRuntimeEntryIcon(value) {
-	if (typeof value === "string") {
-		const src = value.trim();
-		return src ? {
-			kind: "image",
-			src
-		} : null;
-	}
-	if (!value || typeof value !== "object" || Array.isArray(value)) return null;
-	const src = normalizeOptionalString(value.src);
-	if (!src) return null;
-	const alt = normalizeOptionalString(value.alt);
+	setProviderApiKey({
+		configPath,
+		provider: providerId,
+		accessToken,
+		defaultApiBase: session.defaultApiBase
+	});
+	authSessions.delete(sessionId);
 	return {
-		kind: "image",
-		src,
-		...alt ? { alt } : {}
+		provider: providerId,
+		status: "authorized"
 	};
 }
-function clearSecretRef(refs, path) {
-	const { [path]: _removed, ...nextRefs } = refs;
-	return nextRefs;
-}
-function buildConfigMeta(config, options) {
+async function importProviderAuthFromCli(configPath, providerId) {
+	const target = resolveProviderAuthTarget(configPath, providerId);
+	if (!target) return null;
+	const spec = findServerBuiltinProviderByName(target.providerType);
+	if (!spec?.auth || spec.auth.kind !== "device_code" || !spec.auth.cliCredential) return null;
+	const credentialPath = resolveHomePath(spec.auth.cliCredential.path);
+	if (!credentialPath) throw new Error("provider cli credential path is empty");
+	let rawContent = "";
+	try {
+		rawContent = await readFile(credentialPath, "utf8");
+	} catch (error) {
+		const message = error instanceof Error ? error.message : String(error);
+		throw new Error(`failed to read CLI credential: ${message}`);
+	}
+	let payload;
+	try {
+		const parsed = JSON.parse(rawContent);
+		if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) throw new Error("credential payload is not an object");
+		payload = parsed;
+	} catch (error) {
+		const message = error instanceof Error ? error.message : String(error);
+		throw new Error(`invalid CLI credential JSON: ${message}`);
+	}
+	const accessToken = readFieldAsString(payload, spec.auth.cliCredential.accessTokenField);
+	if (!accessToken) throw new Error(`CLI credential missing access token field: ${spec.auth.cliCredential.accessTokenField}`);
+	const expiresAtMs = normalizeExpiresAt(spec.auth.cliCredential.expiresAtField ? payload[spec.auth.cliCredential.expiresAtField] : void 0);
+	if (typeof expiresAtMs === "number" && expiresAtMs <= Date.now()) throw new Error("CLI credential has expired, please login again");
+	setProviderApiKey({
+		configPath,
+		provider: providerId,
+		accessToken,
+		defaultApiBase: spec.defaultApiBase
+	});
 	return {
-		search: SEARCH_PROVIDER_META,
-		channels: buildProjectedChannelMeta(config, options)
+		provider: providerId,
+		status: "imported",
+		source: "cli",
+		expiresAt: expiresAtMs ? new Date(expiresAtMs).toISOString() : void 0
 	};
 }
-function buildProviderTemplatesView() {
-	return { providerTemplates: BUILTIN_PROVIDERS.map((spec) => {
+//#endregion
+//#region src/features/config/controllers/config.controller.ts
+var ConfigRoutesController = class {
+	channelConfigApplyTasks = /* @__PURE__ */ new Map();
+	providerConnectivity;
+	constructor(options) {
+		this.options = options;
+		this.providerConnectivity = new ProviderConnectivityService(options.configPath, options.kernel.llmProviders);
+	}
+	getExtensionConfigProjectionOptions = () => {
 		return {
-			id: spec.name,
-			providerType: spec.name,
-			displayName: spec.displayName ?? spec.name,
-			apiProtocol: spec.apiProtocol,
-			modelPrefix: spec.modelPrefix,
-			keywords: spec.keywords,
-			envKey: spec.envKey,
-			isGateway: spec.isGateway,
-			isLocal: spec.isLocal,
-			apiKeyRequired: !spec.anonymousApiKey,
-			defaultApiBase: spec.defaultApiBase,
-			logo: spec.logo,
-			apiBaseHelp: spec.apiBaseHelp,
-			auth: spec.auth ? {
-				kind: spec.auth.kind,
-				displayName: spec.auth.displayName,
-				note: spec.auth.note,
-				methods: spec.auth.methods?.map((method) => ({
-					id: method.id,
-					label: method.label,
-					hint: method.hint
-				})),
-				defaultMethodId: spec.auth.defaultMethodId,
-				supportsCliImport: Boolean(spec.auth.cliCredential)
-			} : void 0,
-			defaultModels: normalizeModelList(spec.defaultModels ?? []),
-			modelConfig: normalizeProviderModelConfig(spec.modelConfig ?? {}),
-			supportsWireApi: spec.supportsWireApi,
-			wireApiOptions: spec.wireApiOptions,
-			defaultWireApi: spec.defaultWireApi
+			extensionChannelBindings: this.options.extensions?.getChannelBindings() ?? [],
+			extensionUiMetadata: this.options.extensions?.getUiMetadata() ?? []
 		};
-	}).sort((left, right) => {
-		const leftRank = PREFERRED_PROVIDER_ORDER_INDEX.get(left.id);
-		const rightRank = PREFERRED_PROVIDER_ORDER_INDEX.get(right.id);
-		if (leftRank !== void 0 && rightRank !== void 0) return leftRank - rightRank;
-		if (leftRank !== void 0) return -1;
-		if (rightRank !== void 0) return 1;
-		return left.id.localeCompare(right.id);
-	}) };
-}
-function buildProvidersView(config) {
-	const uiHints = buildUiHints(config);
-	const providers = {};
-	for (const [providerId, provider] of Object.entries(config.providers)) {
-		const providerConfig = provider;
-		providers[providerId] = toProviderView(config, providerConfig, providerId, uiHints, findServerBuiltinProviderByName(resolveProviderType(providerId, providerConfig) ?? ""));
-	}
-	return { providers };
-}
-function buildConfigSchemaView(_config, options) {
-	const base = buildConfigSchema({ version: getPackageVersion() });
-	const extensionUiHints = buildExtensionChannelUiHints(options);
-	if (Object.keys(extensionUiHints).length === 0) return base;
-	return {
-		...base,
-		uiHints: {
-			...base.uiHints,
-			...extensionUiHints
-		}
 	};
-}
-async function executeConfigAction(configPath, actionId, request) {
-	const baseConfig = loadConfigOrDefault(configPath);
-	const action = getActionById(baseConfig, actionId);
-	if (!action) return {
-		ok: false,
-		code: "ACTION_NOT_FOUND",
-		message: `unknown action: ${actionId}`
+	publishConfigUpdatedPaths = (paths) => {
+		for (const path of paths) emitConfigUpdated(this.options, path);
+	};
+	publishConfigUpdates = async (paths) => {
+		this.publishConfigUpdatedPaths(paths);
+		await this.options.applyLiveConfigReload?.();
+	};
+	publishChannelConfigApplyStatus = (params) => {
+		emitChannelConfigApplyStatus(this.options, params);
+	};
+	enqueueChannelConfigApply = (channel) => {
+		const task = (this.channelConfigApplyTasks.get(channel) ?? Promise.resolve()).catch(() => void 0).then(async () => {
+			this.publishChannelConfigApplyStatus({
+				channel,
+				status: "started"
+			});
+			try {
+				await this.options.applyLiveConfigReload?.();
+				this.publishChannelConfigApplyStatus({
+					channel,
+					status: "succeeded"
+				});
+			} catch (error) {
+				const message = error instanceof Error ? error.message : String(error);
+				this.publishChannelConfigApplyStatus({
+					channel,
+					status: "failed",
+					message
+				});
+				emitUiError(this.options, {
+					code: "CHANNEL_CONFIG_APPLY_FAILED",
+					message: `Failed to apply ${channel} channel config: ${message}`
+				});
+			}
+		}).finally(() => {
+			if (this.channelConfigApplyTasks.get(channel) === task) this.channelConfigApplyTasks.delete(channel);
+		});
+		this.channelConfigApplyTasks.set(channel, task);
+	};
+	getConfig = (c) => {
+		const config = loadConfigOrDefault(this.options.configPath);
+		return c.json(ok(buildConfigView(config, this.getExtensionConfigProjectionOptions())));
 	};
-	if (request.scope && request.scope !== action.scope) return {
-		ok: false,
-		code: "ACTION_SCOPE_MISMATCH",
-		message: `scope mismatch: expected ${action.scope}, got ${request.scope}`,
-		details: {
-			expectedScope: action.scope,
-			requestScope: request.scope
-		}
+	getConfigMeta = (c) => {
+		const config = loadConfigOrDefault(this.options.configPath);
+		return c.json(ok(buildConfigMeta(config, this.getExtensionConfigProjectionOptions())));
 	};
-	const runtimeConfig = resolveRuntimeConfig(baseConfig, request.draftConfig);
-	for (const requiredPath of action.requires ?? []) if (isMissingRequiredValue(getPathValue(runtimeConfig, requiredPath))) return {
-		ok: false,
-		code: "ACTION_PRECONDITION_FAILED",
-		message: `required field missing: ${requiredPath}`,
-		details: { path: requiredPath }
+	listProviders = (c) => {
+		const config = loadConfigOrDefault(this.options.configPath);
+		return c.json(ok(buildProvidersView(config)));
 	};
-	const handler = ACTION_HANDLERS[action.id];
-	if (!handler) return {
-		ok: false,
-		code: "ACTION_EXECUTION_FAILED",
-		message: `action handler not found for type ${action.type}`
+	listProviderTemplates = (c) => {
+		return c.json(ok(buildProviderTemplatesView()));
 	};
-	return {
-		ok: true,
-		data: await handler({
-			config: runtimeConfig,
-			action
-		})
+	listProviderModelCatalog = (c) => {
+		return c.json(ok(this.options.kernel.providerModelCatalog.getSnapshot()));
 	};
-}
-function loadConfigOrDefault(configPath) {
-	return loadConfig(configPath);
-}
-function createProviderForUpdate(providerId) {
-	const spec = findServerBuiltinProviderByName(providerId);
-	if (!spec) return null;
-	return createDefaultProviderConfigFromSpec(spec);
-}
-function updateModel(configPath, patch) {
-	const config = loadConfigOrDefault(configPath);
-	if (typeof patch.model === "string") config.agents.defaults.model = patch.model;
-	if (typeof patch.workspace === "string") config.agents.defaults.workspace = normalizeOptionalString(patch.workspace) ?? DEFAULT_WORKSPACE_PATH;
-	const next = ConfigSchema.parse(config);
-	saveConfig(next, configPath);
-	return buildConfigView(next);
-}
-function updateProvider(configPath, providerId, patch) {
-	const config = loadConfigOrDefault(configPath);
-	const providers = config.providers;
-	const provider = providers[providerId] ?? createProviderForUpdate(providerId);
-	if (!provider) return null;
-	providers[providerId] = provider;
-	const spec = findServerBuiltinProviderByName((Object.prototype.hasOwnProperty.call(patch, "providerType") ? normalizeProviderId(patch.providerType) : resolveProviderType(providerId, provider)) ?? "");
-	if (Object.prototype.hasOwnProperty.call(patch, "providerType")) provider.providerType = spec?.name ?? null;
-	if (Object.prototype.hasOwnProperty.call(patch, "displayName")) provider.displayName = normalizeOptionalDisplayName(patch.displayName) ?? "";
-	if (Object.prototype.hasOwnProperty.call(patch, "enabled")) provider.enabled = patch.enabled !== false;
-	if (Object.prototype.hasOwnProperty.call(patch, "apiKey")) {
-		provider.apiKey = patch.apiKey ?? "";
-		config.secrets.refs = clearSecretRef(config.secrets.refs, `providers.${providerId}.apiKey`);
-	}
-	if (Object.prototype.hasOwnProperty.call(patch, "apiBase")) provider.apiBase = patch.apiBase ?? null;
-	if (Object.prototype.hasOwnProperty.call(patch, "extraHeaders")) provider.extraHeaders = patch.extraHeaders ?? null;
-	if (Object.prototype.hasOwnProperty.call(patch, "wireApi") && (spec?.supportsWireApi || !spec)) provider.wireApi = patch.wireApi ?? spec?.defaultWireApi ?? "auto";
-	if (Object.prototype.hasOwnProperty.call(patch, "models")) provider.models = normalizeModelList(patch.models ?? []);
-	if (Object.prototype.hasOwnProperty.call(patch, "modelConfig")) provider.modelConfig = normalizeProviderModelConfig(patch.modelConfig ?? {});
-	const next = ConfigSchema.parse(config);
-	saveConfig(next, configPath);
-	const uiHints = buildUiHints(next);
-	const updated = next.providers[providerId];
-	return toProviderView(next, updated, providerId, uiHints, spec ?? void 0);
-}
-function createProvider(configPath, patch = {}) {
-	const config = loadConfigOrDefault(configPath);
-	const providers = config.providers;
-	const requestedProviderType = normalizeProviderId(patch.providerType);
-	const spec = requestedProviderType ? findServerBuiltinProviderByName(requestedProviderType) : void 0;
-	const fallbackProviderId = spec ? spec.name : findNextCustomProviderName(config);
-	const requestedProviderId = normalizeProviderId(patch.providerId);
-	if (requestedProviderId && providers[requestedProviderId]) return null;
-	const providerId = requestedProviderId ? requestedProviderId : findNextProviderId(config, fallbackProviderId);
-	const generatedDisplayName = spec ? `${spec.displayName}${resolveProviderDisplayNameSuffix(providerId, spec.name)}` : resolveCustomProviderFallbackDisplayName(providerId);
-	const defaultModels = spec ? buildProviderScopedModels(providerId, spec.defaultModels ?? []) : [];
-	providers[providerId] = {
-		enabled: patch.enabled !== false,
-		providerType: spec?.name ?? null,
-		displayName: normalizeOptionalDisplayName(patch.displayName) ?? generatedDisplayName,
-		apiKey: normalizeOptionalString(patch.apiKey) ?? "",
-		apiBase: normalizeOptionalString(patch.apiBase) ?? spec?.defaultApiBase ?? null,
-		extraHeaders: normalizeHeaders(patch.extraHeaders ?? null),
-		wireApi: patch.wireApi ?? spec?.defaultWireApi ?? "auto",
-		models: Object.prototype.hasOwnProperty.call(patch, "models") ? normalizeModelList(patch.models ?? []) : defaultModels,
-		modelConfig: normalizeProviderModelConfig(patch.modelConfig ?? spec?.modelConfig ?? {})
+	getConfigSchema = (c) => {
+		const config = loadConfigOrDefault(this.options.configPath);
+		return c.json(ok(buildConfigSchemaView(config, this.getExtensionConfigProjectionOptions())));
 	};
-	const next = ConfigSchema.parse(config);
-	saveConfig(next, configPath);
-	const uiHints = buildUiHints(next);
-	const created = next.providers[providerId];
-	return {
-		providerId,
-		provider: toProviderView(next, created, providerId, uiHints, spec)
+	updateConfigModel = async (c) => {
+		const body = await readJson(c.req.raw);
+		if (!body.ok) return c.json(err("INVALID_BODY", "invalid json body"), 400);
+		const hasModel = typeof body.data.model === "string";
+		if (!hasModel) return c.json(err("INVALID_BODY", "model is required"), 400);
+		const view = updateModel(this.options.configPath, {
+			model: body.data.model,
+			workspace: body.data.workspace
+		});
+		const changedPaths = [];
+		if (hasModel) changedPaths.push("agents.defaults.model");
+		if (typeof body.data.workspace === "string") changedPaths.push("agents.defaults.workspace");
+		await this.publishConfigUpdates(changedPaths);
+		return c.json(ok({
+			model: view.agents.defaults.model,
+			workspace: view.agents.defaults.workspace
+		}));
 	};
-}
-function deleteProvider(configPath, providerId) {
-	const config = loadConfigOrDefault(configPath);
-	const providers = config.providers;
-	if (!providers[providerId]) return null;
-	delete providers[providerId];
-	config.secrets.refs = clearSecretRefsByPrefix(config.secrets.refs, `providers.${providerId}`);
-	saveConfig(ConfigSchema.parse(config), configPath);
-	return true;
-}
-function normalizeOptionalString(value) {
-	if (typeof value !== "string") return null;
-	const trimmed = value.trim();
-	return trimmed.length > 0 ? trimmed : null;
-}
-function normalizeHeaders(input) {
-	if (!input) return null;
-	const entries = Object.entries(input).map(([key, value]) => [key.trim(), String(value ?? "").trim()]).filter(([key, value]) => key.length > 0 && value.length > 0);
-	if (entries.length === 0) return null;
-	return Object.fromEntries(entries);
-}
-function buildScopedProviderModel(providerName, model, spec) {
-	const trimmed = model.trim();
-	if (!trimmed) return "";
-	if (trimmed.includes("/")) return trimmed;
-	if (isCustomProviderName(providerName)) return trimmed;
-	const prefix = (spec?.modelPrefix ?? providerName).trim();
-	if (!prefix) return trimmed;
-	return `${prefix}/${trimmed}`;
-}
-function rewriteProviderRoutePrefix(providerId, targetPrefix, model) {
-	const prefix = `${providerId}/`;
-	if (!model.startsWith(prefix)) return model;
-	const stripped = model.slice(prefix.length).trim();
-	return stripped ? targetPrefix ? `${targetPrefix}/${stripped}` : stripped : model;
-}
-function resolveTestModel(config, providerId, requestedModel, provider, spec) {
-	if (requestedModel) return rewriteProviderRoutePrefix(providerId, spec?.name ?? null, requestedModel);
-	const providerModels = normalizeModelList(provider.models ?? []).map((modelId) => {
-		const providerModel = rewriteProviderRoutePrefix(providerId, null, modelId);
-		return spec ? buildScopedProviderModel(spec.name, providerModel, spec) : providerModel;
-	}).filter((modelId) => modelId.length > 0);
-	if (providerModels.length > 0) return providerModels[0];
-	const defaultModel = normalizeOptionalString(config.agents.defaults.model);
-	if (defaultModel) {
-		const routedProvider = getProviderName(config, defaultModel);
-		if (!routedProvider || routedProvider === providerId) return rewriteProviderRoutePrefix(providerId, spec?.name ?? null, defaultModel);
-	}
-	if (!spec) return null;
-	return normalizeModelList(spec?.defaultModels ?? [])[0] ?? null ?? defaultModel ?? null;
-}
-function stringifyError(error) {
-	return (error instanceof Error ? error.message : String(error)).replace(/\s+/g, " ").trim();
-}
-async function testProviderConnection(configPath, providerId, patch, providerManager) {
-	const config = loadConfigOrDefault(configPath);
-	const provider = config.providers[providerId];
-	if (!provider) return null;
-	const providerType = resolveProviderType(providerId, provider);
-	const spec = findServerBuiltinProviderByName(providerType ?? "");
-	const hasApiKeyPatch = Object.prototype.hasOwnProperty.call(patch, "apiKey");
-	const providedApiKey = normalizeOptionalString(patch.apiKey);
-	const currentApiKey = normalizeOptionalString(provider.apiKey);
-	const apiKey = (hasApiKeyPatch ? providedApiKey : currentApiKey) ?? normalizeOptionalString(spec?.anonymousApiKey);
-	const hasApiBasePatch = Object.prototype.hasOwnProperty.call(patch, "apiBase");
-	const patchedApiBase = normalizeOptionalString(patch.apiBase);
-	const currentApiBase = normalizeOptionalString(provider.apiBase);
-	const apiBase = hasApiBasePatch ? patchedApiBase ?? spec?.defaultApiBase ?? null : currentApiBase ?? spec?.defaultApiBase ?? null;
-	const extraHeaders = Object.prototype.hasOwnProperty.call(patch, "extraHeaders") ? normalizeHeaders(patch.extraHeaders ?? null) : normalizeHeaders(provider.extraHeaders ?? null);
-	const wireApi = spec?.supportsWireApi || !spec ? patch.wireApi ?? provider.wireApi ?? spec?.defaultWireApi ?? "auto" : null;
-	if (!apiKey && !spec?.isLocal) return {
-		success: false,
-		provider: providerId,
-		latencyMs: 0,
-		message: "API key is required before testing the connection."
+	updateConfigSearch = async (c) => {
+		const body = await readJson(c.req.raw);
+		if (!body.ok) return c.json(err("INVALID_BODY", "invalid json body"), 400);
+		const result = updateSearch(this.options.configPath, body.data);
+		await this.publishConfigUpdates(["search"]);
+		return c.json(ok(result));
+	};
+	updateProvider = async (c) => {
+		const providerId = c.req.param("providerId");
+		const body = await readJson(c.req.raw);
+		if (!body.ok) return c.json(err("INVALID_BODY", "invalid json body"), 400);
+		const result = updateProvider(this.options.configPath, providerId, body.data);
+		if (!result) return c.json(err("NOT_FOUND", `unknown provider: ${providerId}`), 404);
+		await this.publishConfigUpdates([`providers.${providerId}`]);
+		return c.json(ok(result));
+	};
+	createProvider = async (c) => {
+		const body = await readJson(c.req.raw);
+		if (!body.ok) return c.json(err("INVALID_BODY", "invalid json body"), 400);
+		const result = createProvider(this.options.configPath, body.data);
+		if (!result) return c.json(err("PROVIDER_EXISTS", "provider already exists"), 409);
+		await this.publishConfigUpdates([`providers.${result.providerId}`]);
+		return c.json(ok({
+			providerId: result.providerId,
+			provider: result.provider
+		}));
+	};
+	deleteProvider = async (c) => {
+		const providerId = c.req.param("providerId");
+		if (deleteProvider(this.options.configPath, providerId) === null) return c.json(err("NOT_FOUND", `provider not found: ${providerId}`), 404);
+		await this.publishConfigUpdates([`providers.${providerId}`]);
+		return c.json(ok({
+			deleted: true,
+			providerId
+		}));
+	};
+	testProviderConnection = async (c) => {
+		const provider = c.req.param("providerId");
+		const body = await readJson(c.req.raw);
+		if (!body.ok) return c.json(err("INVALID_BODY", "invalid json body"), 400);
+		const result = await this.providerConnectivity.testConnection(provider, body.data);
+		if (!result) return c.json(err("NOT_FOUND", `unknown provider: ${provider}`), 404);
+		return c.json(ok(result));
+	};
+	discoverProviderModels = async (c) => {
+		const provider = c.req.param("providerId");
+		const body = await readJson(c.req.raw);
+		if (!body.ok) return c.json(err("INVALID_BODY", "invalid json body"), 400);
+		try {
+			const result = await this.providerConnectivity.discoverModels(provider, body.data);
+			if (!result) return c.json(err("NOT_FOUND", `unknown provider: ${provider}`), 404);
+			return c.json(ok(result));
+		} catch (error) {
+			const message = error instanceof Error ? error.message : String(error);
+			const details = error instanceof ProviderModelDiscoveryHttpError ? { upstreamStatus: error.upstreamStatus } : void 0;
+			return c.json(err("PROVIDER_MODEL_DISCOVERY_FAILED", message, details), 502);
+		}
+	};
+	startProviderAuth = async (c) => {
+		const provider = c.req.param("providerId");
+		let payload = {};
+		const rawBody = await c.req.raw.text();
+		if (rawBody.trim().length > 0) try {
+			payload = JSON.parse(rawBody);
+		} catch {
+			return c.json(err("INVALID_BODY", "invalid json body"), 400);
+		}
+		const methodId = typeof payload.methodId === "string" ? payload.methodId.trim() : void 0;
+		try {
+			const result = await startProviderAuth(this.options.configPath, provider, { methodId });
+			if (!result) return c.json(err("NOT_SUPPORTED", `provider auth is not supported: ${provider}`), 404);
+			return c.json(ok(result));
+		} catch (error) {
+			const message = error instanceof Error ? error.message : String(error);
+			return c.json(err("AUTH_START_FAILED", message), 400);
+		}
+	};
+	pollProviderAuth = async (c) => {
+		const provider = c.req.param("providerId");
+		const body = await readJson(c.req.raw);
+		if (!body.ok) return c.json(err("INVALID_BODY", "invalid json body"), 400);
+		const sessionId = typeof body.data.sessionId === "string" ? body.data.sessionId.trim() : "";
+		if (!sessionId) return c.json(err("INVALID_BODY", "sessionId is required"), 400);
+		const result = await pollProviderAuth({
+			configPath: this.options.configPath,
+			providerName: provider,
+			sessionId
+		});
+		if (!result) return c.json(err("NOT_FOUND", "provider auth session not found"), 404);
+		if (result.status === "authorized") await this.publishConfigUpdates([`providers.${provider}`]);
+		return c.json(ok(result));
 	};
-	const model = resolveTestModel(config, providerId, normalizeOptionalString(patch.model), provider, spec ?? void 0);
-	if (!model) return {
-		success: false,
-		provider: providerId,
-		latencyMs: 0,
-		message: "No test model found. Configure provider models or set a default model for this provider, then try again."
+	importProviderAuthFromCli = async (c) => {
+		const provider = c.req.param("providerId");
+		try {
+			const result = await importProviderAuthFromCli(this.options.configPath, provider);
+			if (!result) return c.json(err("NOT_SUPPORTED", `provider cli auth import is not supported: ${provider}`), 404);
+			await this.publishConfigUpdates([`providers.${provider}`]);
+			return c.json(ok(result));
+		} catch (error) {
+			const message = error instanceof Error ? error.message : String(error);
+			return c.json(err("AUTH_IMPORT_FAILED", message), 400);
+		}
 	};
-	const startedAtMs = Date.now();
-	if (!providerManager) return {
-		success: false,
-		provider: providerId,
-		model,
-		latencyMs: Date.now() - startedAtMs,
-		message: "Provider manager is unavailable."
+	updateChannel = async (c) => {
+		const channel = c.req.param("channel");
+		const body = await readJson(c.req.raw);
+		if (!body.ok) return c.json(err("INVALID_BODY", "invalid json body"), 400);
+		const result = updateChannel(this.options.configPath, channel, body.data, this.getExtensionConfigProjectionOptions());
+		if (!result) return c.json(err("NOT_FOUND", `unknown channel: ${channel}`), 404);
+		this.publishConfigUpdatedPaths([`channels.${channel}`]);
+		this.enqueueChannelConfigApply(channel);
+		return c.json(ok(result));
 	};
-	try {
-		await providerManager.testConnection({
-			providerName: providerType,
-			apiKey,
-			apiBase,
-			defaultModel: model,
-			extraHeaders,
-			wireApi,
-			messages: [{
-				role: "user",
-				content: "ping"
-			}],
-			maxTokens: PROVIDER_TEST_MAX_TOKENS
-		});
-		return {
-			success: true,
-			provider: providerId,
-			model,
-			latencyMs: Date.now() - startedAtMs,
-			message: "Connection test passed."
-		};
-	} catch (error) {
-		return {
-			success: false,
-			provider: providerId,
-			model,
-			latencyMs: Date.now() - startedAtMs,
-			message: stringifyError(error) || "Connection test failed."
-		};
-	}
-}
-function updateChannel(configPath, channelName, patch, options) {
-	const config = loadConfigOrDefault(configPath);
-	const normalizedOptions = normalizeExtensionProjectionOptions(options);
-	const channel = getProjectedChannelConfig(config, channelName, normalizedOptions);
-	if (!channel) return null;
-	for (const key of Object.keys(patch)) {
-		const path = `channels.${channelName}.${key}`;
-		if (isSensitivePath(path)) config.secrets.refs = clearSecretRef(config.secrets.refs, path);
-	}
-	const mergedChannel = {
-		...channel,
-		...patch
+	startChannelAuth = async (c) => {
+		const channel = c.req.param("channel");
+		let payload = {};
+		const rawBody = await c.req.raw.text();
+		if (rawBody.trim().length > 0) try {
+			payload = JSON.parse(rawBody);
+		} catch {
+			return c.json(err("INVALID_BODY", "invalid json body"), 400);
+		}
+		try {
+			const result = await startChannelAuth({
+				configPath: this.options.configPath,
+				channelId: channel,
+				request: {
+					accountId: typeof payload.accountId === "string" ? payload.accountId : void 0,
+					baseUrl: typeof payload.baseUrl === "string" ? payload.baseUrl : void 0,
+					domain: typeof payload.domain === "string" ? payload.domain : void 0
+				},
+				bindings: this.options.extensions?.getChannelBindings() ?? []
+			});
+			if (!result) return c.json(err("NOT_SUPPORTED", `channel auth is not supported: ${channel}`), 404);
+			return c.json(ok(result));
+		} catch (error) {
+			const message = error instanceof Error ? error.message : String(error);
+			return c.json(err("AUTH_START_FAILED", message), 400);
+		}
 	};
-	const mergedExtensionConfig = mergeProjectedExtensionChannelConfig(config, channelName, mergedChannel, normalizedOptions);
-	if (mergedExtensionConfig) {
-		const next = ConfigSchema.parse(mergedExtensionConfig);
-		saveConfig(next, configPath);
-		return sanitizePublicConfigValue(getProjectedChannelConfig(next, channelName, normalizedOptions) ?? {}, `channels.${channelName}`, buildUiHints(next, normalizedOptions));
-	}
-	config.channels[channelName] = mergedChannel;
-	const next = ConfigSchema.parse(config);
-	saveConfig(next, configPath);
-	return sanitizePublicConfigValue(getProjectedChannelConfig(next, channelName, normalizedOptions) ?? {}, `channels.${channelName}`, buildUiHints(next, normalizedOptions));
-}
-function applyRuntimeAgentDefaultsPatch(defaults, defaultsPatch) {
-	if (!defaultsPatch) return defaults;
-	let next = defaults;
-	if (Object.prototype.hasOwnProperty.call(defaultsPatch, "contextTokens")) {
-		const nextContextTokens = defaultsPatch.contextTokens;
-		if (typeof nextContextTokens === "number" && Number.isFinite(nextContextTokens)) next = {
-			...next,
-			contextTokens: Math.max(1e3, Math.trunc(nextContextTokens))
-		};
-	}
-	if (Object.prototype.hasOwnProperty.call(defaultsPatch, "engine")) next = {
-		...next,
-		engine: normalizeOptionalString(defaultsPatch.engine) ?? "native"
+	pollChannelAuth = async (c) => {
+		const channel = c.req.param("channel");
+		const body = await readJson(c.req.raw);
+		if (!body.ok) return c.json(err("INVALID_BODY", "invalid json body"), 400);
+		const sessionId = typeof body.data.sessionId === "string" ? body.data.sessionId.trim() : "";
+		if (!sessionId) return c.json(err("INVALID_BODY", "sessionId is required"), 400);
+		const result = await pollChannelAuth({
+			configPath: this.options.configPath,
+			channelId: channel,
+			sessionId,
+			bindings: this.options.extensions?.getChannelBindings() ?? []
+		});
+		if (!result) return c.json(err("NOT_FOUND", "channel auth session not found"), 404);
+		if (result.status === "authorized") await this.publishConfigUpdates([`channels.${channel}`]);
+		return c.json(ok(result));
 	};
-	if (Object.prototype.hasOwnProperty.call(defaultsPatch, "engineConfig")) {
-		const nextEngineConfig = defaultsPatch.engineConfig;
-		if (nextEngineConfig && typeof nextEngineConfig === "object" && !Array.isArray(nextEngineConfig)) next = {
-			...next,
-			engineConfig: { ...nextEngineConfig }
-		};
-	}
-	return next;
-}
-function updateRuntime(configPath, patch) {
-	const config = loadConfigOrDefault(configPath);
-	if (patch.companion && Object.prototype.hasOwnProperty.call(patch.companion, "enabled")) config.companion.enabled = Boolean(patch.companion.enabled);
-	config.agents.defaults = applyRuntimeAgentDefaultsPatch(config.agents.defaults, patch.agents?.defaults);
-	if (patch.agents && Object.prototype.hasOwnProperty.call(patch.agents, "list")) config.agents.list = (patch.agents.list ?? []).map((entry) => {
-		const normalizedEngine = normalizeOptionalString(entry.engine);
-		const hasEngineConfig = entry.engineConfig && typeof entry.engineConfig === "object" && !Array.isArray(entry.engineConfig);
-		return {
-			...entry,
-			default: Boolean(entry.default),
-			...normalizedEngine ? { engine: normalizedEngine } : {},
-			...hasEngineConfig ? { engineConfig: { ...entry.engineConfig } } : {}
-		};
-	});
-	if (patch.agents?.runtimes && Object.prototype.hasOwnProperty.call(patch.agents.runtimes, "entries")) config.agents.runtimes.entries = normalizeRuntimeEntries(patch.agents.runtimes.entries);
-	if (Object.prototype.hasOwnProperty.call(patch, "bindings")) config.bindings = patch.bindings ?? [];
-	if (patch.session) config.session = {
-		...config.session,
-		...patch.session
+	connectChannelAuth = async (c) => {
+		const channel = c.req.param("channel");
+		const body = await readJson(c.req.raw);
+		if (!body.ok) return c.json(err("INVALID_BODY", "invalid json body"), 400);
+		const fields = body.data.fields && typeof body.data.fields === "object" && !Array.isArray(body.data.fields) ? body.data.fields : {};
+		try {
+			const result = await connectChannelAuth({
+				configPath: this.options.configPath,
+				channelId: channel,
+				request: {
+					accountId: typeof body.data.accountId === "string" ? body.data.accountId : void 0,
+					domain: typeof body.data.domain === "string" ? body.data.domain : void 0,
+					fields
+				},
+				bindings: this.options.extensions?.getChannelBindings() ?? []
+			});
+			if (!result) return c.json(err("NOT_SUPPORTED", `channel auth connect is not supported: ${channel}`), 404);
+			if (result.status === "authorized") await this.publishConfigUpdates([`channels.${channel}`]);
+			return c.json(ok(result));
+		} catch (error) {
+			const message = error instanceof Error ? error.message : String(error);
+			return c.json(err("AUTH_CONNECT_FAILED", message), 400);
+		}
 	};
-	const next = ConfigSchema.parse(config);
-	saveConfig(next, configPath);
-	const view = buildConfigView(next);
-	return {
-		companion: view.companion,
-		agents: view.agents,
-		bindings: view.bindings ?? [],
-		session: view.session ?? {}
+	updateSecrets = async (c) => {
+		const body = await readJson(c.req.raw);
+		if (!body.ok) return c.json(err("INVALID_BODY", "invalid json body"), 400);
+		const result = updateSecrets(this.options.configPath, body.data);
+		await this.publishConfigUpdates(["secrets"]);
+		return c.json(ok(result));
 	};
-}
-function updateSecrets(configPath, patch) {
-	const config = loadConfigOrDefault(configPath);
-	if (Object.prototype.hasOwnProperty.call(patch, "enabled")) config.secrets.enabled = Boolean(patch.enabled);
-	if (patch.defaults) {
-		const nextDefaults = { ...config.secrets.defaults };
-		for (const source of [
-			"env",
-			"file",
-			"exec"
-		]) {
-			if (!Object.prototype.hasOwnProperty.call(patch.defaults, source)) continue;
-			const value = patch.defaults[source];
-			if (typeof value === "string" && value.trim()) nextDefaults[source] = value.trim();
-			else delete nextDefaults[source];
+	updateRuntime = async (c) => {
+		const body = await readJson(c.req.raw);
+		if (!body.ok || !body.data || typeof body.data !== "object") return c.json(err("INVALID_BODY", "invalid json body"), 400);
+		try {
+			const contextTokens = body.data.agents?.defaults?.contextTokens;
+			if (typeof contextTokens === "number") await this.options.kernel.agentContextWindowManager.assertDefaultCanSave(contextTokens);
+			const result = updateRuntime(this.options.configPath, body.data);
+			const changedPaths = [];
+			if (body.data.agents?.defaults && Object.prototype.hasOwnProperty.call(body.data.agents.defaults, "contextTokens")) changedPaths.push("agents.defaults.contextTokens");
+			if (body.data.agents?.defaults && Object.prototype.hasOwnProperty.call(body.data.agents.defaults, "engine")) changedPaths.push("agents.defaults.engine");
+			if (body.data.agents?.defaults && Object.prototype.hasOwnProperty.call(body.data.agents.defaults, "engineConfig")) changedPaths.push("agents.defaults.engineConfig");
+			if (body.data.agents?.runtimes && Object.prototype.hasOwnProperty.call(body.data.agents.runtimes, "entries")) changedPaths.push("agents.runtimes.entries");
+			if (body.data.companion && Object.prototype.hasOwnProperty.call(body.data.companion, "enabled")) changedPaths.push("companion.enabled");
+			changedPaths.push("agents.list", "bindings", "session");
+			await this.publishConfigUpdates(changedPaths);
+			return c.json(ok(result));
+		} catch (error) {
+			return c.json(err("RUNTIME_CONFIG_UPDATE_FAILED", error instanceof Error ? error.message : String(error)), 400);
 		}
-		config.secrets.defaults = nextDefaults;
-	}
-	if (Object.prototype.hasOwnProperty.call(patch, "providers")) config.secrets.providers = patch.providers ?? {};
-	if (Object.prototype.hasOwnProperty.call(patch, "refs")) config.secrets.refs = patch.refs ?? {};
-	const next = ConfigSchema.parse(config);
-	saveConfig(next, configPath);
-	return {
-		enabled: next.secrets.enabled,
-		defaults: { ...next.secrets.defaults },
-		providers: { ...next.secrets.providers },
-		refs: { ...next.secrets.refs }
 	};
-}
+	executeAction = async (c) => {
+		const actionId = c.req.param("actionId");
+		const body = await readJson(c.req.raw);
+		if (!body.ok) return c.json(err("INVALID_BODY", "invalid json body"), 400);
+		const result = await executeConfigAction(this.options.configPath, actionId, body.data ?? {});
+		if (!result.ok) return c.json(err(result.code, result.message, result.details), 400);
+		return c.json(ok(result.data));
+	};
+};
 //#endregion
 //#region src/features/cron/controllers/cron.controller.ts
 const CRON_LIST_MAX_LIMIT = 100;
@@ -2844,7 +2992,7 @@ var CronRoutesController = class {
 		const allJobs = this.options.cron.listJobs(true).map((job) => buildCronJobView(job));
 		const enabled = allJobs.filter((job) => job.enabled).length;
 		const normalizedQuery = query.query?.trim().toLowerCase() ?? "";
-		const filteredJobs = allJobs.filter((job) => matchesCronListStatus(job, status) && matchesCronListQuery(job, normalizedQuery));
+		const filteredJobs = allJobs.filter((job) => matchesCronListStatus(job, status) && matchesCronListQuery(job, normalizedQuery)).sort((a, b) => b.createdAt.localeCompare(a.createdAt) || a.id.localeCompare(b.id));
 		const offset = offsetResult.value ?? 0;
 		const jobs = limitResult.value === null ? filteredJobs : filteredJobs.slice(offset, offset + limitResult.value);
 		return c.json(ok({
@@ -5612,6 +5760,14 @@ function readStreamPayload(url) {
 function isAbortPayload(value) {
 	return isRecord(value) && typeof value.sessionId === "string" && value.sessionId.trim().length > 0;
 }
+function isContinuePayload(value) {
+	return isRecord(value) && typeof value.sessionId === "string" && value.sessionId.trim().length > 0;
+}
+function isEditMessagePayload(value) {
+	if (!isRecord(value) || typeof value.sessionId !== "string" || !value.sessionId.trim() || typeof value.messageId !== "string" || !value.messageId.trim() || !isRecord(value.message)) return false;
+	const message = value.message;
+	return typeof message.id === "string" && message.id.trim().length > 0 && message.role === "user" && Array.isArray(message.parts) && message.parts.length > 0;
+}
 var UiRouteRegistry = class {
 	constructor(app, options, controllers) {
 		this.app = app;
@@ -5645,6 +5801,24 @@ var UiRouteRegistry = class {
 			}, { source: "ui-http" });
 			return c.json(ok({ accepted: true }));
 		});
+		this.app.post(`${basePath}/edit-message`, async (c) => {
+			const body = await readJson(c.req.raw);
+			if (!body.ok || !isEditMessagePayload(body.data)) return c.json(err("INVALID_BODY", "A valid sessionId, messageId, and user message are required."), 400);
+			const handle = await kernel.ingress.handle({
+				type: ingressKeys.agentRun.editMessage,
+				payload: body.data
+			}, { source: "ui-http" });
+			return c.json(ok(handle));
+		});
+		this.app.post(`${basePath}/continue`, async (c) => {
+			const body = await readJson(c.req.raw);
+			if (!body.ok || !isContinuePayload(body.data)) return c.json(err("INVALID_BODY", "sessionId is required."), 400);
+			const handle = await kernel.ingress.handle({
+				type: ingressKeys.agentRun.continue,
+				payload: body.data
+			}, { source: "ui-http" });
+			return c.json(ok(handle));
+		});
 	};
 	mountNcpAgentRoutes = (kernel, ncpAsset) => {
 		this.mountAgentRunRoutes(NCP_AGENT_BASE_PATH, kernel);
@@ -5956,6 +6130,11 @@ var UiRouteRegistry = class {
 				"/api/runtime/bootstrap-status",
 				app.bootstrapStatus
 			],
+			[
+				"get",
+				"/api/runtime/extensions",
+				app.extensionRuntimeStatus
+			],
 			[
 				"get",
 				"/api/auth/status",
@@ -6043,6 +6222,11 @@ var UiRouteRegistry = class {
 				"/api/provider-templates",
 				config.listProviderTemplates
 			],
+			[
+				"get",
+				"/api/provider-model-catalog",
+				config.listProviderModelCatalog
+			],
 			[
 				"post",
 				"/api/providers",
@@ -6063,6 +6247,11 @@ var UiRouteRegistry = class {
 				"/api/providers/:providerId/test",
 				config.testProviderConnection
 			],
+			[
+				"post",
+				"/api/providers/:providerId/models/discover",
+				config.discoverProviderModels
+			],
 			[
 				"post",
 				"/api/providers/:providerId/auth/start",
@@ -6481,6 +6670,6 @@ async function startUiServer(gateway) {
 	};
 }
 //#endregion
-export { ConfigRoutesController, InboxDeliveriesRoutesController, PanelAppsRoutesController, RuntimeControlRoutesController, ServiceAppsRoutesController, buildConfigMeta, buildConfigSchemaView, buildConfigView, buildProviderTemplatesView, buildProvidersView, createProvider, createUiRouter, deleteProvider, ensureUiBridgeSecret, executeConfigAction, getUiBridgeSecretPath, loadConfigOrDefault, readUiBridgeSecret, startUiServer, testProviderConnection, updateChannel, updateModel, updateProvider, updateRuntime, updateSearch, updateSecrets };
+export { ConfigRoutesController, InboxDeliveriesRoutesController, PanelAppsRoutesController, RuntimeControlRoutesController, ServiceAppsRoutesController, buildConfigMeta, buildConfigSchemaView, buildConfigView, buildProviderTemplatesView, buildProvidersView, createProvider, createUiRouter, deleteProvider, ensureUiBridgeSecret, executeConfigAction, getUiBridgeSecretPath, loadConfigOrDefault, readUiBridgeSecret, startUiServer, updateChannel, updateModel, updateProvider, updateRuntime, updateSearch, updateSecrets };
 
 //# sourceMappingURL=index.js.map