@nextclaw/server 0.9.3 → 0.10.0

package/dist/index.d.ts

@@ -5,6 +5,284 @@ import { NcpHttpAgentStreamProvider } from '@nextclaw/ncp-http-agent-server';
 import { Hono } from 'hono';
 import { IncomingMessage } from 'node:http';
 
+type MarketplaceItemType = "plugin" | "skill" | "mcp";
+type MarketplaceSort = "relevance" | "updated";
+type MarketplacePluginInstallKind = "npm";
+type MarketplaceSkillInstallKind = "builtin" | "marketplace";
+type MarketplaceMcpInstallKind = "template";
+type MarketplaceInstallKind = MarketplacePluginInstallKind | MarketplaceSkillInstallKind | MarketplaceMcpInstallKind;
+type MarketplaceInstallSpec = {
+    kind: MarketplaceInstallKind;
+    spec: string;
+    command: string;
+};
+type MarketplaceMcpTemplateInput = {
+    id: string;
+    label: string;
+    description?: string;
+    required?: boolean;
+    secret?: boolean;
+    defaultValue?: string;
+};
+type MarketplaceMcpInstallSpec = MarketplaceInstallSpec & {
+    kind: "template";
+    defaultName: string;
+    transportTypes: Array<"stdio" | "http" | "sse">;
+    template: Record<string, unknown>;
+    inputs: MarketplaceMcpTemplateInput[];
+};
+type MarketplaceLocalizedTextMap = Record<string, string>;
+type MarketplaceItemSummary = {
+    id: string;
+    slug: string;
+    type: MarketplaceItemType;
+    name: string;
+    summary: string;
+    summaryI18n: MarketplaceLocalizedTextMap;
+    tags: string[];
+    author: string;
+    install: MarketplaceInstallSpec;
+    updatedAt: string;
+};
+type MarketplaceItemView = MarketplaceItemSummary & {
+    description?: string;
+    descriptionI18n?: MarketplaceLocalizedTextMap;
+    sourceRepo?: string;
+    homepage?: string;
+    publishedAt: string;
+};
+type MarketplaceSkillContentView = {
+    type: "skill";
+    slug: string;
+    name: string;
+    install: MarketplaceInstallSpec;
+    source: "builtin" | "marketplace" | "remote";
+    raw: string;
+    metadataRaw?: string;
+    bodyRaw: string;
+    sourceUrl?: string;
+};
+type MarketplacePluginContentView = {
+    type: "plugin";
+    slug: string;
+    name: string;
+    install: MarketplaceInstallSpec;
+    source: "npm" | "repo" | "remote";
+    raw?: string;
+    bodyRaw?: string;
+    metadataRaw?: string;
+    sourceUrl?: string;
+};
+type MarketplaceMcpContentView = {
+    type: "mcp";
+    slug: string;
+    name: string;
+    install: MarketplaceMcpInstallSpec;
+    source: "marketplace" | "remote";
+    raw: string;
+    metadataRaw?: string;
+    bodyRaw: string;
+    sourceUrl?: string;
+};
+type MarketplaceListView = {
+    total: number;
+    page: number;
+    pageSize: number;
+    totalPages: number;
+    sort: MarketplaceSort;
+    query?: string;
+    items: MarketplaceItemSummary[];
+};
+type MarketplaceRecommendationView = {
+    type: MarketplaceItemType;
+    sceneId: string;
+    title: string;
+    description?: string;
+    total: number;
+    items: MarketplaceItemSummary[];
+};
+type MarketplaceInstalledRecord = {
+    type: MarketplaceItemType;
+    id?: string;
+    spec: string;
+    label?: string;
+    description?: string;
+    descriptionZh?: string;
+    source?: string;
+    installedAt?: string;
+    enabled?: boolean;
+    runtimeStatus?: string;
+    origin?: string;
+    installPath?: string;
+    transport?: "stdio" | "http" | "sse";
+    scope?: {
+        allAgents: boolean;
+        agents: string[];
+    };
+    catalogSlug?: string;
+    vendor?: string;
+    docsUrl?: string;
+    homepage?: string;
+    trustLevel?: "official" | "verified" | "community";
+    toolCount?: number;
+    accessible?: boolean;
+    lastReadyAt?: string;
+    lastDoctorAt?: string;
+    lastError?: string;
+};
+type MarketplaceInstalledView = {
+    type: MarketplaceItemType;
+    total: number;
+    specs: string[];
+    records: MarketplaceInstalledRecord[];
+};
+type MarketplaceInstallSkillParams = {
+    slug: string;
+    kind?: MarketplaceSkillInstallKind;
+    skill?: string;
+    installPath?: string;
+    force?: boolean;
+};
+type MarketplacePluginInstallRequest = {
+    type?: "plugin";
+    spec: string;
+};
+type MarketplaceSkillInstallRequest = {
+    type?: "skill";
+    spec: string;
+    kind?: MarketplaceSkillInstallKind;
+    skill?: string;
+    installPath?: string;
+    force?: boolean;
+};
+type MarketplaceMcpInstallRequest = {
+    type?: "mcp";
+    spec: string;
+    name?: string;
+    enabled?: boolean;
+    allAgents?: boolean;
+    agents?: string[];
+    inputs?: Record<string, string>;
+    template?: MarketplaceMcpInstallSpec;
+};
+type MarketplacePluginInstallResult = {
+    type: "plugin";
+    spec: string;
+    message: string;
+    output?: string;
+};
+type MarketplaceSkillInstallResult = {
+    type: "skill";
+    spec: string;
+    message: string;
+    output?: string;
+};
+type MarketplaceMcpInstallResult = {
+    type: "mcp";
+    spec: string;
+    name: string;
+    message: string;
+    output?: string;
+};
+type MarketplacePluginManageAction = "enable" | "disable" | "uninstall";
+type MarketplaceSkillManageAction = "uninstall";
+type MarketplaceMcpManageAction = "enable" | "disable" | "remove";
+type MarketplacePluginManageRequest = {
+    type?: "plugin";
+    action: MarketplacePluginManageAction;
+    id?: string;
+    spec?: string;
+};
+type MarketplaceSkillManageRequest = {
+    type?: "skill";
+    action: MarketplaceSkillManageAction;
+    id?: string;
+    spec?: string;
+};
+type MarketplaceMcpManageRequest = {
+    type?: "mcp";
+    action: MarketplaceMcpManageAction;
+    id?: string;
+    spec?: string;
+};
+type MarketplacePluginManageResult = {
+    type: "plugin";
+    action: MarketplacePluginManageAction;
+    id: string;
+    message: string;
+    output?: string;
+};
+type MarketplaceSkillManageResult = {
+    type: "skill";
+    action: MarketplaceSkillManageAction;
+    id: string;
+    message: string;
+    output?: string;
+};
+type MarketplaceMcpManageResult = {
+    type: "mcp";
+    action: MarketplaceMcpManageAction;
+    id: string;
+    message: string;
+    output?: string;
+};
+type MarketplaceMcpDoctorResult = {
+    name: string;
+    enabled: boolean;
+    transport: "stdio" | "http" | "sse";
+    accessible: boolean;
+    toolCount: number;
+    error?: string;
+};
+type MarketplaceInstaller = {
+    installPlugin?: (spec: string) => Promise<{
+        message: string;
+        output?: string;
+    }>;
+    installSkill?: (params: MarketplaceInstallSkillParams) => Promise<{
+        message: string;
+        output?: string;
+    }>;
+    enablePlugin?: (id: string) => Promise<{
+        message: string;
+        output?: string;
+    }>;
+    disablePlugin?: (id: string) => Promise<{
+        message: string;
+        output?: string;
+    }>;
+    uninstallPlugin?: (id: string) => Promise<{
+        message: string;
+        output?: string;
+    }>;
+    uninstallSkill?: (slug: string) => Promise<{
+        message: string;
+        output?: string;
+    }>;
+    installMcp?: (params: MarketplaceMcpInstallRequest) => Promise<{
+        name: string;
+        message: string;
+        output?: string;
+    }>;
+    enableMcp?: (name: string) => Promise<{
+        message: string;
+        output?: string;
+    }>;
+    disableMcp?: (name: string) => Promise<{
+        message: string;
+        output?: string;
+    }>;
+    removeMcp?: (name: string) => Promise<{
+        message: string;
+        output?: string;
+    }>;
+    doctorMcp?: (name: string) => Promise<MarketplaceMcpDoctorResult>;
+};
+type MarketplaceApiConfig = {
+    apiBaseUrl?: string;
+    installer?: MarketplaceInstaller;
+};
+
 type ApiError = {
     code: string;
     message: string;
@@ -190,6 +468,7 @@ type SessionEntryView = {
     updatedAt: string;
     label?: string;
     preferredModel?: string;
+    preferredThinking?: ThinkingLevel | null;
     sessionType: string;
     sessionTypeMutable: boolean;
     messageCount: number;
@@ -379,9 +658,20 @@ type ChatCapabilitiesView = {
     stopSupported: boolean;
     stopReason?: string;
 };
+type ChatSessionTypeCtaView = {
+    kind: string;
+    label?: string;
+    href?: string;
+};
 type ChatSessionTypeOptionView = {
     value: string;
     label: string;
+    ready?: boolean;
+    reason?: string | null;
+    reasonMessage?: string | null;
+    supportedModels?: string[];
+    recommendedModel?: string | null;
+    cta?: ChatSessionTypeCtaView | null;
 };
 type ChatSessionTypesView = {
     defaultType: string;
@@ -634,184 +924,6 @@ type ConfigActionExecuteResult = {
     patch?: Record<string, unknown>;
     nextActions?: string[];
 };
-type MarketplaceItemType = "plugin" | "skill";
-type MarketplaceSort = "relevance" | "updated";
-type MarketplacePluginInstallKind = "npm";
-type MarketplaceSkillInstallKind = "builtin" | "marketplace";
-type MarketplaceInstallKind = MarketplacePluginInstallKind | MarketplaceSkillInstallKind;
-type MarketplaceInstallSpec = {
-    kind: MarketplaceInstallKind;
-    spec: string;
-    command: string;
-};
-type MarketplaceLocalizedTextMap = Record<string, string>;
-type MarketplaceItemSummary = {
-    id: string;
-    slug: string;
-    type: MarketplaceItemType;
-    name: string;
-    summary: string;
-    summaryI18n: MarketplaceLocalizedTextMap;
-    tags: string[];
-    author: string;
-    install: MarketplaceInstallSpec;
-    updatedAt: string;
-};
-type MarketplaceItemView = MarketplaceItemSummary & {
-    description?: string;
-    descriptionI18n?: MarketplaceLocalizedTextMap;
-    sourceRepo?: string;
-    homepage?: string;
-    publishedAt: string;
-};
-type MarketplaceSkillContentView = {
-    type: "skill";
-    slug: string;
-    name: string;
-    install: MarketplaceInstallSpec;
-    source: "builtin" | "marketplace" | "remote";
-    raw: string;
-    metadataRaw?: string;
-    bodyRaw: string;
-    sourceUrl?: string;
-};
-type MarketplacePluginContentView = {
-    type: "plugin";
-    slug: string;
-    name: string;
-    install: MarketplaceInstallSpec;
-    source: "npm" | "repo" | "remote";
-    raw?: string;
-    bodyRaw?: string;
-    metadataRaw?: string;
-    sourceUrl?: string;
-};
-type MarketplaceListView = {
-    total: number;
-    page: number;
-    pageSize: number;
-    totalPages: number;
-    sort: MarketplaceSort;
-    query?: string;
-    items: MarketplaceItemSummary[];
-};
-type MarketplaceRecommendationView = {
-    type: MarketplaceItemType;
-    sceneId: string;
-    title: string;
-    description?: string;
-    total: number;
-    items: MarketplaceItemSummary[];
-};
-type MarketplaceInstalledRecord = {
-    type: MarketplaceItemType;
-    id?: string;
-    spec: string;
-    label?: string;
-    description?: string;
-    descriptionZh?: string;
-    source?: string;
-    installedAt?: string;
-    enabled?: boolean;
-    runtimeStatus?: string;
-    origin?: string;
-    installPath?: string;
-};
-type MarketplaceInstalledView = {
-    type: MarketplaceItemType;
-    total: number;
-    specs: string[];
-    records: MarketplaceInstalledRecord[];
-};
-type MarketplaceInstallSkillParams = {
-    slug: string;
-    kind?: MarketplaceSkillInstallKind;
-    skill?: string;
-    installPath?: string;
-    force?: boolean;
-};
-type MarketplacePluginInstallRequest = {
-    type?: "plugin";
-    spec: string;
-};
-type MarketplaceSkillInstallRequest = {
-    type?: "skill";
-    spec: string;
-    kind?: MarketplaceSkillInstallKind;
-    skill?: string;
-    installPath?: string;
-    force?: boolean;
-};
-type MarketplacePluginInstallResult = {
-    type: "plugin";
-    spec: string;
-    message: string;
-    output?: string;
-};
-type MarketplaceSkillInstallResult = {
-    type: "skill";
-    spec: string;
-    message: string;
-    output?: string;
-};
-type MarketplacePluginManageAction = "enable" | "disable" | "uninstall";
-type MarketplaceSkillManageAction = "uninstall";
-type MarketplacePluginManageRequest = {
-    type?: "plugin";
-    action: MarketplacePluginManageAction;
-    id?: string;
-    spec?: string;
-};
-type MarketplaceSkillManageRequest = {
-    type?: "skill";
-    action: MarketplaceSkillManageAction;
-    id?: string;
-    spec?: string;
-};
-type MarketplacePluginManageResult = {
-    type: "plugin";
-    action: MarketplacePluginManageAction;
-    id: string;
-    message: string;
-    output?: string;
-};
-type MarketplaceSkillManageResult = {
-    type: "skill";
-    action: MarketplaceSkillManageAction;
-    id: string;
-    message: string;
-    output?: string;
-};
-type MarketplaceInstaller = {
-    installPlugin?: (spec: string) => Promise<{
-        message: string;
-        output?: string;
-    }>;
-    installSkill?: (params: MarketplaceInstallSkillParams) => Promise<{
-        message: string;
-        output?: string;
-    }>;
-    enablePlugin?: (id: string) => Promise<{
-        message: string;
-        output?: string;
-    }>;
-    disablePlugin?: (id: string) => Promise<{
-        message: string;
-        output?: string;
-    }>;
-    uninstallPlugin?: (id: string) => Promise<{
-        message: string;
-        output?: string;
-    }>;
-    uninstallSkill?: (slug: string) => Promise<{
-        message: string;
-        output?: string;
-    }>;
-};
-type MarketplaceApiConfig = {
-    apiBaseUrl?: string;
-    installer?: MarketplaceInstaller;
-};
 type UiServerEvent = {
     type: "config.updated";
     payload: {
@@ -879,6 +991,7 @@ declare class UiAuthService {
     private clearAllSessions;
     private deleteRequestSession;
     private buildLoginCookie;
+    buildTrustedRequestCookieHeader(): string | null;
     buildLogoutCookie(request: Request): string;
     setup(request: Request, payload: AuthSetupRequest): {
         status: AuthStatusView;
@@ -956,4 +1069,8 @@ declare function deleteSession(configPath: string, key: string): boolean;
 declare function updateRuntime(configPath: string, patch: RuntimeConfigUpdate): Pick<ConfigView, "agents" | "bindings" | "session">;
 declare function updateSecrets(configPath: string, patch: SecretsConfigUpdate): SecretsView;
 
-export { type AgentBindingView, type AgentProfileView, type ApiError, type ApiResponse, type AppMetaView, type AuthEnabledUpdateRequest, type AuthLoginRequest, type AuthPasswordUpdateRequest, type AuthSetupRequest, type AuthStatusView, type BindingPeerView, type BochaFreshnessValue, type ChannelSpecView, type ChatCapabilitiesView, type ChatCommandOptionView, type ChatCommandView, type ChatCommandsView, type ChatRunListView, type ChatRunState, type ChatRunView, type ChatSessionTypeOptionView, type ChatSessionTypesView, type ChatTurnRequest, type ChatTurnResult, type ChatTurnStopRequest, type ChatTurnStopResult, type ChatTurnStreamEvent, type ChatTurnView, type ConfigActionExecuteRequest, type ConfigActionExecuteResult, type ConfigActionManifest, type ConfigActionType, type ConfigMetaView, type ConfigSchemaResponse, type ConfigUiHint, type ConfigUiHints, type ConfigView, type CronActionResult, type CronEnableRequest, type CronJobStateView, type CronJobView, type CronListView, type CronPayloadView, type CronRunRequest, type CronScheduleView, DEFAULT_SESSION_TYPE, type MarketplaceApiConfig, type MarketplaceInstallKind, type MarketplaceInstallSkillParams, type MarketplaceInstallSpec, type MarketplaceInstalledRecord, type MarketplaceInstalledView, type MarketplaceInstaller, type MarketplaceItemSummary, type MarketplaceItemType, type MarketplaceItemView, type MarketplaceListView, type MarketplaceLocalizedTextMap, type MarketplacePluginContentView, type MarketplacePluginInstallKind, type MarketplacePluginInstallRequest, type MarketplacePluginInstallResult, type MarketplacePluginManageAction, type MarketplacePluginManageRequest, type MarketplacePluginManageResult, type MarketplaceRecommendationView, type MarketplaceSkillContentView, type MarketplaceSkillInstallKind, type MarketplaceSkillInstallRequest, type MarketplaceSkillInstallResult, type MarketplaceSkillManageAction, type MarketplaceSkillManageRequest, type MarketplaceSkillManageResult, type MarketplaceSort, type ProviderAuthImportResult, type ProviderAuthPollRequest, type ProviderAuthPollResult, type ProviderAuthStartRequest, type ProviderAuthStartResult, type ProviderConfigUpdate, type ProviderConfigView, type ProviderConnectionTestRequest, type ProviderConnectionTestResult, type ProviderCreateRequest, type ProviderCreateResult, type ProviderDeleteResult, type ProviderSpecView, type RuntimeConfigUpdate, type SearchConfigUpdate, type SearchConfigView, type SearchProviderConfigView, type SearchProviderName, type SearchProviderSpecView, type SecretProviderEnvView, type SecretProviderExecView, type SecretProviderFileView, type SecretProviderView, type SecretRefView, type SecretSourceView, type SecretsConfigUpdate, type SecretsView, type SessionConfigView, type SessionEntryView, type SessionEventView, type SessionHistoryView, type SessionMessageView, type SessionPatchUpdate, SessionPatchValidationError, type SessionsListView, type UiChatRuntime, type UiNcpAgent, type UiNcpSessionListView, type UiNcpSessionMessagesView, type UiServerEvent, type UiServerHandle, type UiServerOptions, buildConfigMeta, buildConfigSchemaView, buildConfigView, createCustomProvider, createUiRouter, deleteCustomProvider, deleteSession, executeConfigAction, getSessionHistory, listSessions, loadConfigOrDefault, patchSession, startUiServer, testProviderConnection, updateChannel, updateModel, updateProvider, updateRuntime, updateSearch, updateSecrets };
+declare function getUiBridgeSecretPath(): string;
+declare function readUiBridgeSecret(): string | null;
+declare function ensureUiBridgeSecret(): string;
+
+export { type AgentBindingView, type AgentProfileView, type ApiError, type ApiResponse, type AppMetaView, type AuthEnabledUpdateRequest, type AuthLoginRequest, type AuthPasswordUpdateRequest, type AuthSetupRequest, type AuthStatusView, type BindingPeerView, type BochaFreshnessValue, type ChannelSpecView, type ChatCapabilitiesView, type ChatCommandOptionView, type ChatCommandView, type ChatCommandsView, type ChatRunListView, type ChatRunState, type ChatRunView, type ChatSessionTypeCtaView, type ChatSessionTypeOptionView, type ChatSessionTypesView, type ChatTurnRequest, type ChatTurnResult, type ChatTurnStopRequest, type ChatTurnStopResult, type ChatTurnStreamEvent, type ChatTurnView, type ConfigActionExecuteRequest, type ConfigActionExecuteResult, type ConfigActionManifest, type ConfigActionType, type ConfigMetaView, type ConfigSchemaResponse, type ConfigUiHint, type ConfigUiHints, type ConfigView, type CronActionResult, type CronEnableRequest, type CronJobStateView, type CronJobView, type CronListView, type CronPayloadView, type CronRunRequest, type CronScheduleView, DEFAULT_SESSION_TYPE, type MarketplaceApiConfig, type MarketplaceInstallKind, type MarketplaceInstallSkillParams, type MarketplaceInstallSpec, type MarketplaceInstalledRecord, type MarketplaceInstalledView, type MarketplaceInstaller, type MarketplaceItemSummary, type MarketplaceItemType, type MarketplaceItemView, type MarketplaceListView, type MarketplaceLocalizedTextMap, type MarketplaceMcpContentView, type MarketplaceMcpDoctorResult, type MarketplaceMcpInstallKind, type MarketplaceMcpInstallRequest, type MarketplaceMcpInstallResult, type MarketplaceMcpInstallSpec, type MarketplaceMcpManageAction, type MarketplaceMcpManageRequest, type MarketplaceMcpManageResult, type MarketplaceMcpTemplateInput, type MarketplacePluginContentView, type MarketplacePluginInstallKind, type MarketplacePluginInstallRequest, type MarketplacePluginInstallResult, type MarketplacePluginManageAction, type MarketplacePluginManageRequest, type MarketplacePluginManageResult, type MarketplaceRecommendationView, type MarketplaceSkillContentView, type MarketplaceSkillInstallKind, type MarketplaceSkillInstallRequest, type MarketplaceSkillInstallResult, type MarketplaceSkillManageAction, type MarketplaceSkillManageRequest, type MarketplaceSkillManageResult, type MarketplaceSort, type ProviderAuthImportResult, type ProviderAuthPollRequest, type ProviderAuthPollResult, type ProviderAuthStartRequest, type ProviderAuthStartResult, type ProviderConfigUpdate, type ProviderConfigView, type ProviderConnectionTestRequest, type ProviderConnectionTestResult, type ProviderCreateRequest, type ProviderCreateResult, type ProviderDeleteResult, type ProviderSpecView, type RuntimeConfigUpdate, type SearchConfigUpdate, type SearchConfigView, type SearchProviderConfigView, type SearchProviderName, type SearchProviderSpecView, type SecretProviderEnvView, type SecretProviderExecView, type SecretProviderFileView, type SecretProviderView, type SecretRefView, type SecretSourceView, type SecretsConfigUpdate, type SecretsView, type SessionConfigView, type SessionEntryView, type SessionEventView, type SessionHistoryView, type SessionMessageView, type SessionPatchUpdate, SessionPatchValidationError, type SessionsListView, type UiChatRuntime, type UiNcpAgent, type UiNcpSessionListView, type UiNcpSessionMessagesView, type UiServerEvent, type UiServerHandle, type UiServerOptions, buildConfigMeta, buildConfigSchemaView, buildConfigView, createCustomProvider, createUiRouter, deleteCustomProvider, deleteSession, ensureUiBridgeSecret, executeConfigAction, getSessionHistory, getUiBridgeSecretPath, listSessions, loadConfigOrDefault, patchSession, readUiBridgeSecret, startUiServer, testProviderConnection, updateChannel, updateModel, updateProvider, updateRuntime, updateSearch, updateSecrets };

package/dist/index.js

@@ -4,9 +4,9 @@ import { compress } from "hono/compress";
 import { cors } from "hono/cors";
 import { serve } from "@hono/node-server";
 import { WebSocketServer, WebSocket } from "ws";
-import { existsSync, readFileSync } from "fs";
+import { existsSync as existsSync2, readFileSync as readFileSync2 } from "fs";
 import { readFile as readFile2, stat } from "fs/promises";
-import { join } from "path";
+import { join as join2 } from "path";
 
 // src/ui/auth.service.ts
 import { ConfigSchema, loadConfig, saveConfig } from "@nextclaw/core";
@@ -179,6 +179,18 @@ var UiAuthService = class {
       secure: resolveSecureRequest(request.url, request.headers.get("x-forwarded-proto"))
     });
   }
+  buildTrustedRequestCookieHeader() {
+    const auth = this.readAuthConfig();
+    if (!auth.enabled || !this.isConfigured(auth)) {
+      return null;
+    }
+    const username = normalizeUsername(auth.username);
+    if (!username) {
+      return null;
+    }
+    const sessionId = this.createSession(username);
+    return `${SESSION_COOKIE_NAME}=${encodeURIComponent(sessionId)}`;
+  }
   buildLogoutCookie(request) {
     return buildSetCookie({
       value: "",
@@ -393,6 +405,39 @@ var AppRoutesController = class {
   appMeta = (c) => c.json(ok(buildAppMetaView(this.options)));
 };
 
+// src/ui/auth-bridge.ts
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from "fs";
+import { join } from "path";
+import { randomBytes as randomBytes2 } from "crypto";
+import { getDataDir } from "@nextclaw/core";
+var REMOTE_BRIDGE_DIR = join(getDataDir(), "remote");
+var REMOTE_BRIDGE_SECRET_PATH = join(REMOTE_BRIDGE_DIR, "ui-bridge-secret");
+function getUiBridgeSecretPath() {
+  return REMOTE_BRIDGE_SECRET_PATH;
+}
+function readUiBridgeSecret() {
+  if (!existsSync(REMOTE_BRIDGE_SECRET_PATH)) {
+    return null;
+  }
+  try {
+    const raw = readFileSync(REMOTE_BRIDGE_SECRET_PATH, "utf-8").trim();
+    return raw.length > 0 ? raw : null;
+  } catch {
+    return null;
+  }
+}
+function ensureUiBridgeSecret() {
+  const existing = readUiBridgeSecret();
+  if (existing) {
+    return existing;
+  }
+  mkdirSync(REMOTE_BRIDGE_DIR, { recursive: true });
+  const secret = randomBytes2(24).toString("hex");
+  writeFileSync(REMOTE_BRIDGE_SECRET_PATH, `${secret}
+`, "utf-8");
+  return secret;
+}
+
 // src/ui/router/auth.controller.ts
 function isAuthenticationRequiredError(message) {
   return message === "Authentication required.";
@@ -492,6 +537,16 @@ var AuthRoutesController = class {
       return c.json(err(code, message), status);
     }
   };
+  issueBridgeSession = (c) => {
+    const providedSecret = c.req.header("x-nextclaw-ui-bridge-secret")?.trim();
+    const expectedSecret = ensureUiBridgeSecret();
+    if (!providedSecret || providedSecret !== expectedSecret) {
+      return c.json(err("FORBIDDEN", "Invalid bridge secret."), 403);
+    }
+    return c.json(ok({
+      cookie: this.authService.buildTrustedRequestCookieHeader()
+    }));
+  };
 };
 
 // src/ui/router/chat.controller.ts
@@ -512,7 +567,7 @@ import {
   SessionManager,
   getWorkspacePathFromConfig,
   normalizeThinkingLevels,
-  parseThinkingLevel as parseThinkingLevel2
+  parseThinkingLevel as parseThinkingLevel3
 } from "@nextclaw/core";
 
 // src/ui/provider-overrides.ts
@@ -639,6 +694,18 @@ function applySessionPreferencePatch(params) {
   return nextMetadata;
 }
 
+// src/ui/session-list-metadata.ts
+import { parseThinkingLevel as parseThinkingLevel2 } from "@nextclaw/core";
+function readSessionListMetadata(metadata) {
+  const rawLabel = typeof metadata.label === "string" ? metadata.label.trim() : "";
+  const rawPreferredModel = typeof metadata.preferred_model === "string" ? metadata.preferred_model.trim() : "";
+  return {
+    label: rawLabel || void 0,
+    preferredModel: rawPreferredModel || void 0,
+    preferredThinking: parseThinkingLevel2(metadata.preferred_thinking) ?? null
+  };
+}
+
 // src/ui/config.ts
 var MASK_MIN_LENGTH = 8;
 var EXTRA_SENSITIVE_PATH_PATTERNS = [/authorization/i, /cookie/i, /session/i, /bearer/i];
@@ -991,7 +1058,7 @@ function normalizeModelThinkingConfig(input) {
     if (supported.length === 0) {
       continue;
     }
-    const defaultLevel = parseThinkingLevel2(rawValue.default);
+    const defaultLevel = parseThinkingLevel3(rawValue.default);
     if (defaultLevel && supported.includes(defaultLevel)) {
       normalized[model] = { supported, default: defaultLevel };
     } else {
@@ -1578,8 +1645,7 @@ function listSessions(configPath, query) {
     const messages = session?.messages ?? [];
     const lastMessage = messages.length > 0 ? messages[messages.length - 1] : null;
     const metadata = item.metadata && typeof item.metadata === "object" ? item.metadata : {};
-    const label = typeof metadata.label === "string" ? metadata.label.trim() : "";
-    const preferredModel = typeof metadata.preferred_model === "string" ? metadata.preferred_model.trim() : "";
+    const { label, preferredModel, preferredThinking } = readSessionListMetadata(metadata);
     const createdAt = typeof item.created_at === "string" ? item.created_at : (/* @__PURE__ */ new Date(0)).toISOString();
     const updatedAt = typeof item.updated_at === "string" ? item.updated_at : createdAt;
     const sessionType = readSessionType({
@@ -1594,8 +1660,9 @@ function listSessions(configPath, query) {
       key,
       createdAt,
       updatedAt,
-      label: label || void 0,
-      preferredModel: preferredModel || void 0,
+      label,
+      preferredModel,
+      preferredThinking,
       sessionType,
       sessionTypeMutable,
       messageCount: messages.length,
@@ -2429,7 +2496,7 @@ var ChatRoutesController = class {
 };
 
 // src/ui/provider-auth.ts
-import { createHash, randomBytes as randomBytes2, randomUUID as randomUUID2 } from "crypto";
+import { createHash, randomBytes as randomBytes3, randomUUID as randomUUID2 } from "crypto";
 import { readFile } from "fs/promises";
 import { homedir } from "os";
 import { isAbsolute, resolve } from "path";
@@ -2457,7 +2524,7 @@ function toBase64Url(buffer) {
   return buffer.toString("base64").replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/g, "");
 }
 function buildPkce() {
-  const verifier = toBase64Url(randomBytes2(48));
+  const verifier = toBase64Url(randomBytes3(48));
   const challenge = toBase64Url(createHash("sha256").update(verifier).digest());
   return { verifier, challenge };
 }
@@ -2674,7 +2741,7 @@ async function startProviderAuth(configPath, providerName, options) {
     if (!pkce) {
       throw new Error("MiniMax OAuth requires PKCE");
     }
-    const state = toBase64Url(randomBytes2(16));
+    const state = toBase64Url(randomBytes3(16));
     const body = new URLSearchParams({
       response_type: "code",
       client_id: resolvedMethod.clientId,
@@ -3708,6 +3775,13 @@ async function fetchAllSkillMarketplaceItems(params) {
     query: params.query
   });
 }
+async function fetchAllMcpMarketplaceItems(params) {
+  return fetchAllMarketplaceItems({
+    baseUrl: params.baseUrl,
+    path: "/api/v1/mcp/items",
+    query: params.query
+  });
+}
 function sanitizeMarketplaceListItems(items) {
   return items.map((item) => sanitizeMarketplaceItem(item));
 }
@@ -3715,6 +3789,216 @@ function sanitizeMarketplaceItemView(item) {
   return sanitizeMarketplaceItem(item);
 }
 
+// src/ui/router/marketplace/mcp.controller.ts
+import { McpInstalledViewService } from "@nextclaw/mcp";
+var McpMarketplaceController = class {
+  constructor(options, marketplaceBaseUrl) {
+    this.options = options;
+    this.marketplaceBaseUrl = marketplaceBaseUrl;
+  }
+  getInstalled = (c) => {
+    const service = new McpInstalledViewService({
+      getConfig: () => loadConfigOrDefault(this.options.configPath)
+    });
+    const records = service.listInstalled().map((record) => ({
+      type: "mcp",
+      id: record.name,
+      spec: record.catalogSlug ?? record.name,
+      label: record.displayName ?? record.name,
+      enabled: record.enabled,
+      runtimeStatus: record.enabled ? "enabled" : "disabled",
+      transport: record.transport,
+      scope: record.scope,
+      catalogSlug: record.catalogSlug,
+      vendor: record.vendor,
+      docsUrl: record.docsUrl,
+      homepage: record.homepage,
+      trustLevel: record.trustLevel,
+      source: record.source,
+      installedAt: record.installedAt,
+      toolCount: record.toolCount,
+      accessible: record.accessible,
+      lastReadyAt: record.lastReadyAt,
+      lastDoctorAt: record.lastReadyAt,
+      lastError: record.lastError
+    }));
+    return c.json(ok({
+      type: "mcp",
+      total: records.length,
+      specs: records.map((record) => record.spec),
+      records
+    }));
+  };
+  listItems = async (c) => {
+    const query = c.req.query();
+    const result = await fetchAllMcpMarketplaceItems({
+      baseUrl: this.marketplaceBaseUrl,
+      query: {
+        q: query.q,
+        tag: query.tag,
+        sort: query.sort,
+        page: query.page,
+        pageSize: query.pageSize
+      }
+    });
+    if (!result.ok) {
+      return c.json(err("MARKETPLACE_UNAVAILABLE", result.message), result.status);
+    }
+    const items = sanitizeMarketplaceListItems(result.data.items).map((item) => normalizeMarketplaceItemForUi(item));
+    const pageSize = Math.min(100, toPositiveInt(query.pageSize, 20));
+    const requestedPage = toPositiveInt(query.page, 1);
+    const totalPages = items.length === 0 ? 0 : Math.ceil(items.length / pageSize);
+    const currentPage = totalPages === 0 ? 1 : Math.min(requestedPage, totalPages);
+    return c.json(ok({
+      total: items.length,
+      page: currentPage,
+      pageSize,
+      totalPages,
+      sort: result.data.sort,
+      query: result.data.query,
+      items: items.slice((currentPage - 1) * pageSize, currentPage * pageSize)
+    }));
+  };
+  getItem = async (c) => {
+    const slug = encodeURIComponent(c.req.param("slug"));
+    const result = await fetchMarketplaceData({
+      baseUrl: this.marketplaceBaseUrl,
+      path: `/api/v1/mcp/items/${slug}`
+    });
+    if (!result.ok) {
+      return c.json(err("MARKETPLACE_UNAVAILABLE", result.message), result.status);
+    }
+    return c.json(ok(normalizeMarketplaceItemForUi(sanitizeMarketplaceItemView(result.data))));
+  };
+  getItemContent = async (c) => {
+    const slug = encodeURIComponent(c.req.param("slug"));
+    const result = await fetchMarketplaceData({
+      baseUrl: this.marketplaceBaseUrl,
+      path: `/api/v1/mcp/items/${slug}/content`
+    });
+    if (!result.ok) {
+      return c.json(err("MARKETPLACE_UNAVAILABLE", result.message), result.status);
+    }
+    return c.json(ok(result.data));
+  };
+  install = async (c) => {
+    const body = await readJson(c.req.raw);
+    if (!body.ok || !body.data || typeof body.data !== "object") {
+      return c.json(err("INVALID_BODY", "invalid json body"), 400);
+    }
+    if (body.data.type && body.data.type !== "mcp") {
+      return c.json(err("INVALID_BODY", "body.type does not match route type"), 400);
+    }
+    const slug = typeof body.data.spec === "string" ? body.data.spec.trim() : "";
+    if (!slug) {
+      return c.json(err("INVALID_BODY", "non-empty spec is required"), 400);
+    }
+    const installer = this.options.marketplace?.installer;
+    if (!installer?.installMcp) {
+      return c.json(err("NOT_AVAILABLE", "mcp installer is not configured"), 503);
+    }
+    const itemResult = await fetchMarketplaceData({
+      baseUrl: this.marketplaceBaseUrl,
+      path: `/api/v1/mcp/items/${encodeURIComponent(slug)}`
+    });
+    if (!itemResult.ok) {
+      return c.json(err("MARKETPLACE_UNAVAILABLE", itemResult.message), itemResult.status);
+    }
+    const template = itemResult.data.install;
+    if (template.kind !== "template") {
+      return c.json(err("MARKETPLACE_CONTRACT_MISMATCH", `unsupported mcp install kind: ${template.kind}`), 502);
+    }
+    try {
+      const result = await installer.installMcp({
+        ...body.data,
+        template
+      });
+      this.options.publish({ type: "config.updated", payload: { path: "mcp" } });
+      return c.json(ok({
+        type: "mcp",
+        spec: slug,
+        name: result.name,
+        message: result.message,
+        output: result.output
+      }));
+    } catch (error) {
+      return c.json(err("INSTALL_FAILED", error instanceof Error ? error.message : String(error)), 400);
+    }
+  };
+  manage = async (c) => {
+    const body = await readJson(c.req.raw);
+    if (!body.ok || !body.data || typeof body.data !== "object") {
+      return c.json(err("INVALID_BODY", "invalid json body"), 400);
+    }
+    if (body.data.type && body.data.type !== "mcp") {
+      return c.json(err("INVALID_BODY", "body.type does not match route type"), 400);
+    }
+    const target = typeof body.data.id === "string" && body.data.id.trim().length > 0 ? body.data.id.trim() : typeof body.data.spec === "string" && body.data.spec.trim().length > 0 ? body.data.spec.trim() : "";
+    if (!target) {
+      return c.json(err("INVALID_BODY", "non-empty id/spec is required"), 400);
+    }
+    const installer = this.options.marketplace?.installer;
+    if (!installer) {
+      return c.json(err("NOT_AVAILABLE", "marketplace installer is not configured"), 503);
+    }
+    try {
+      const action = body.data.action;
+      const result = action === "enable" ? await installer.enableMcp?.(target) : action === "disable" ? await installer.disableMcp?.(target) : await installer.removeMcp?.(target);
+      if (!result) {
+        return c.json(err("NOT_AVAILABLE", `mcp ${action} is not configured`), 503);
+      }
+      this.options.publish({ type: "config.updated", payload: { path: "mcp" } });
+      return c.json(ok({
+        type: "mcp",
+        action,
+        id: target,
+        message: result.message,
+        output: result.output
+      }));
+    } catch (error) {
+      return c.json(err("MANAGE_FAILED", error instanceof Error ? error.message : String(error)), 400);
+    }
+  };
+  doctor = async (c) => {
+    const body = await readJson(c.req.raw);
+    if (!body.ok || !body.data || typeof body.data !== "object") {
+      return c.json(err("INVALID_BODY", "invalid json body"), 400);
+    }
+    const target = typeof body.data.name === "string" && body.data.name.trim().length > 0 ? body.data.name.trim() : typeof body.data.id === "string" && body.data.id.trim().length > 0 ? body.data.id.trim() : typeof body.data.spec === "string" && body.data.spec.trim().length > 0 ? body.data.spec.trim() : "";
+    if (!target) {
+      return c.json(err("INVALID_BODY", "name/id/spec is required"), 400);
+    }
+    const installer = this.options.marketplace?.installer;
+    if (!installer?.doctorMcp) {
+      return c.json(err("NOT_AVAILABLE", "mcp doctor is not configured"), 503);
+    }
+    try {
+      const result = await installer.doctorMcp(target);
+      return c.json(ok(result));
+    } catch (error) {
+      return c.json(err("DOCTOR_FAILED", error instanceof Error ? error.message : String(error)), 400);
+    }
+  };
+  getRecommendations = async (c) => {
+    const query = c.req.query();
+    const result = await fetchMarketplaceData({
+      baseUrl: this.marketplaceBaseUrl,
+      path: "/api/v1/mcp/recommendations",
+      query: {
+        scene: query.scene,
+        limit: query.limit
+      }
+    });
+    if (!result.ok) {
+      return c.json(err("MARKETPLACE_UNAVAILABLE", result.message), result.status);
+    }
+    return c.json(ok({
+      ...result.data,
+      items: sanitizeMarketplaceListItems(result.data.items).map((item) => normalizeMarketplaceItemForUi(item))
+    }));
+  };
+};
+
 // src/ui/router/marketplace/installed.ts
 import * as NextclawCore3 from "@nextclaw/core";
 import { buildPluginStatusReport } from "@nextclaw/openclaw-compat";
@@ -4313,6 +4597,32 @@ var PluginMarketplaceController = class {
   };
 };
 
+// src/ui/router/marketplace/routes.ts
+function mountMarketplaceRoutes(app, controllers) {
+  app.get("/api/marketplace/plugins/installed", controllers.plugin.getInstalled);
+  app.get("/api/marketplace/plugins/items", controllers.plugin.listItems);
+  app.get("/api/marketplace/plugins/items/:slug", controllers.plugin.getItem);
+  app.get("/api/marketplace/plugins/items/:slug/content", controllers.plugin.getItemContent);
+  app.post("/api/marketplace/plugins/install", controllers.plugin.install);
+  app.post("/api/marketplace/plugins/manage", controllers.plugin.manage);
+  app.get("/api/marketplace/plugins/recommendations", controllers.plugin.getRecommendations);
+  app.get("/api/marketplace/skills/installed", controllers.skill.getInstalled);
+  app.get("/api/marketplace/skills/items", controllers.skill.listItems);
+  app.get("/api/marketplace/skills/items/:slug", controllers.skill.getItem);
+  app.get("/api/marketplace/skills/items/:slug/content", controllers.skill.getItemContent);
+  app.post("/api/marketplace/skills/install", controllers.skill.install);
+  app.post("/api/marketplace/skills/manage", controllers.skill.manage);
+  app.get("/api/marketplace/skills/recommendations", controllers.skill.getRecommendations);
+  app.get("/api/marketplace/mcp/installed", controllers.mcp.getInstalled);
+  app.get("/api/marketplace/mcp/items", controllers.mcp.listItems);
+  app.get("/api/marketplace/mcp/items/:slug", controllers.mcp.getItem);
+  app.get("/api/marketplace/mcp/items/:slug/content", controllers.mcp.getItemContent);
+  app.post("/api/marketplace/mcp/install", controllers.mcp.install);
+  app.post("/api/marketplace/mcp/manage", controllers.mcp.manage);
+  app.post("/api/marketplace/mcp/doctor", controllers.mcp.doctor);
+  app.get("/api/marketplace/mcp/recommendations", controllers.mcp.getRecommendations);
+}
+
 // src/ui/router/marketplace/skill.controller.ts
 async function installMarketplaceSkill(params) {
   const spec = typeof params.body.spec === "string" ? params.body.spec.trim() : "";
@@ -4620,6 +4930,7 @@ function createUiRouter(options) {
   const ncpSessionController = new NcpSessionRoutesController(options);
   const pluginMarketplaceController = new PluginMarketplaceController(options, marketplaceBaseUrl);
   const skillMarketplaceController = new SkillMarketplaceController(options, marketplaceBaseUrl);
+  const mcpMarketplaceController = new McpMarketplaceController(options, marketplaceBaseUrl);
   app.notFound((c) => c.json(err("NOT_FOUND", "endpoint not found"), 404));
   app.use("/api/*", async (c, next) => {
     const path = c.req.path;
@@ -4642,6 +4953,7 @@ function createUiRouter(options) {
   app.post("/api/auth/logout", authController.logout);
   app.put("/api/auth/password", authController.updatePassword);
   app.put("/api/auth/enabled", authController.updateEnabled);
+  app.post("/api/auth/bridge", authController.issueBridgeSession);
   app.get("/api/config", configController.getConfig);
   app.get("/api/config/meta", configController.getConfigMeta);
   app.get("/api/config/schema", configController.getConfigSchema);
@@ -4688,20 +5000,11 @@ function createUiRouter(options) {
   app.delete("/api/cron/:id", cronController.deleteJob);
   app.put("/api/cron/:id/enable", cronController.enableJob);
   app.post("/api/cron/:id/run", cronController.runJob);
-  app.get("/api/marketplace/plugins/installed", pluginMarketplaceController.getInstalled);
-  app.get("/api/marketplace/plugins/items", pluginMarketplaceController.listItems);
-  app.get("/api/marketplace/plugins/items/:slug", pluginMarketplaceController.getItem);
-  app.get("/api/marketplace/plugins/items/:slug/content", pluginMarketplaceController.getItemContent);
-  app.post("/api/marketplace/plugins/install", pluginMarketplaceController.install);
-  app.post("/api/marketplace/plugins/manage", pluginMarketplaceController.manage);
-  app.get("/api/marketplace/plugins/recommendations", pluginMarketplaceController.getRecommendations);
-  app.get("/api/marketplace/skills/installed", skillMarketplaceController.getInstalled);
-  app.get("/api/marketplace/skills/items", skillMarketplaceController.listItems);
-  app.get("/api/marketplace/skills/items/:slug", skillMarketplaceController.getItem);
-  app.get("/api/marketplace/skills/items/:slug/content", skillMarketplaceController.getItemContent);
-  app.post("/api/marketplace/skills/install", skillMarketplaceController.install);
-  app.post("/api/marketplace/skills/manage", skillMarketplaceController.manage);
-  app.get("/api/marketplace/skills/recommendations", skillMarketplaceController.getRecommendations);
+  mountMarketplaceRoutes(app, {
+    plugin: pluginMarketplaceController,
+    skill: skillMarketplaceController,
+    mcp: mcpMarketplaceController
+  });
   return app;
 }
 
@@ -4745,13 +5048,13 @@ function startUiServer(options) {
     })
   );
   const staticDir = options.staticDir;
-  if (staticDir && existsSync(join(staticDir, "index.html"))) {
-    const indexHtml = readFileSync(join(staticDir, "index.html"), "utf-8");
+  if (staticDir && existsSync2(join2(staticDir, "index.html"))) {
+    const indexHtml = readFileSync2(join2(staticDir, "index.html"), "utf-8");
     app.use(
       "/*",
       serveStatic({
         root: staticDir,
-        join,
+        join: join2,
         getContent: async (path) => {
           try {
             return await readFile2(path);
@@ -4826,11 +5129,14 @@ export {
   createUiRouter,
   deleteCustomProvider,
   deleteSession,
+  ensureUiBridgeSecret,
   executeConfigAction,
   getSessionHistory,
+  getUiBridgeSecretPath,
   listSessions,
   loadConfigOrDefault,
   patchSession,
+  readUiBridgeSecret,
   startUiServer,
   testProviderConnection,
   updateChannel,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nextclaw/server",
-  "version": "0.9.3",
+  "version": "0.10.0",
   "private": false,
   "description": "Nextclaw UI/API server.",
   "type": "module",
@@ -18,11 +18,12 @@
     "@hono/node-server": "^1.13.3",
     "hono": "^4.6.2",
     "ws": "^8.18.0",
-    "@nextclaw/ncp": "0.3.1",
     "@nextclaw/core": "0.9.2",
-    "@nextclaw/runtime": "0.2.2",
     "@nextclaw/ncp-http-agent-server": "0.3.1",
-    "@nextclaw/openclaw-compat": "0.3.4"
+    "@nextclaw/mcp": "0.1.1",
+    "@nextclaw/ncp": "0.3.1",
+    "@nextclaw/openclaw-compat": "0.3.5",
+    "@nextclaw/runtime": "0.2.2"
   },
   "devDependencies": {
     "@types/node": "^20.17.6",