@xopcai/xopc 0.0.162 → 0.0.163

package/dist/src/agent/tools/image-generate-tool.d.ts

@@ -5,8 +5,10 @@ import type { ToolModelConfig } from '../image/tool-model-config.js';
 export { parseImageDataUrl };
 export declare function resolveImageGenerationModelConfigForTool(params: {
     cfg?: Config;
+    agentId: string;
 }): ToolModelConfig | null;
 export declare function createImageGenerateTool(options: {
     config?: Config;
     workspace: string;
+    agentId: string;
 }): AgentTool<any, Record<string, unknown>> | null;

package/dist/src/agent/tools/image-generate-tool.js

@@ -37,7 +37,7 @@ const ALLOWED_RESOLUTIONS = [
 const ImageGenerateToolSchema = Type.Object({
 	action: Type.Optional(Type.String({ description: "Optional: \"generate\" (default) or \"list\" available image-generation providers." })),
 	prompt: Type.Optional(Type.String({ description: "Image generation prompt." })),
-	model: Type.Optional(Type.String({ description: "Optional provider/model override, e.g. openai/gpt-image-1 / dashscope/wan2.7-image-pro / minimax/image-01." })),
+	model: Type.Optional(Type.String({ description: "Optional provider/model override, e.g. openai/gpt-image-2 / dashscope/wan2.7-image-pro / minimax/image-01." })),
 	filename: Type.Optional(Type.String({ description: "Optional basename hint for saved files." })),
 	size: Type.Optional(Type.String({ description: "Optional pixel size, e.g. 1024x1024." })),
 	aspectRatio: Type.Optional(Type.String({ description: "Optional aspect ratio, e.g. 16:9 / 9:16 / 1:1." })),
@@ -126,20 +126,23 @@ async function loadInputImages(params) {
 	return out;
 }
 function resolveImageGenerationModelConfigForTool(params) {
-	const explicit = params.cfg ? getAgentDefaultImageGenerationModelConfig(params.cfg) : void 0;
+	const explicit = params.cfg ? getAgentDefaultImageGenerationModelConfig(params.cfg, params.agentId) : void 0;
 	if (explicit?.primary?.trim()) return {
 		primary: explicit.primary.trim(),
 		...explicit.fallbacks?.length ? { fallbacks: explicit.fallbacks } : {},
 		...explicit.timeoutMs ? { timeoutMs: explicit.timeoutMs } : {},
 		...explicit.autoProviderFallback ? { autoProviderFallback: true } : {}
 	};
-	const providers = listImageGenerationProvidersSummary(params.cfg);
+	const providers = listImageGenerationProvidersSummary();
 	const candidates = [];
 	for (const providerSummary of providers) {
-		const provider = getImageGenerationProvider(providerSummary.id, params.cfg);
+		const provider = getImageGenerationProvider(providerSummary.id);
 		let configured = false;
 		try {
-			configured = provider?.isConfigured?.({ cfg: params.cfg }) ?? false;
+			configured = provider?.isConfigured?.({
+				cfg: params.cfg,
+				agentId: params.agentId
+			}) ?? false;
 		} catch {
 			configured = false;
 		}
@@ -169,7 +172,10 @@ async function saveGeneratedImages(params) {
 	return out;
 }
 function createImageGenerateTool(options) {
-	const imageGenerationModelConfig = resolveImageGenerationModelConfigForTool({ cfg: options.config });
+	const imageGenerationModelConfig = resolveImageGenerationModelConfigForTool({
+		cfg: options.config,
+		agentId: options.agentId
+	});
 	if (!imageGenerationModelConfig) return null;
 	const effectiveCfg = applyImageGenerationModelConfigDefaults(options.config, imageGenerationModelConfig) ?? options.config;
 	return {
@@ -181,7 +187,7 @@ function createImageGenerateTool(options) {
 			const params = args;
 			const action = (readStringParam(params, "action") || "generate").toLowerCase();
 			if (action === "list") {
-				const providers = listImageGenerationProvidersSummary(effectiveCfg);
+				const providers = listImageGenerationProvidersSummary();
 				return {
 					content: [{
 						type: "text",
@@ -234,6 +240,7 @@ function createImageGenerateTool(options) {
 			try {
 				const result = await generateImage({
 					cfg: effectiveCfg,
+					agentId: options.agentId,
 					modelConfig: imageGenerationModelConfig,
 					prompt,
 					...modelOverride ? { modelOverride } : {},

package/dist/src/auth/sync-provider-auth.d.ts

@@ -2,12 +2,15 @@
  * Synchronous checks that mirror CredentialResolver.resolveApiKey sources
  * used by isProviderConfiguredSync (fallback candidate filtering).
  */
+import type { Config } from '../config/schema.js';
 /**
  * Synchronous API key / OAuth access for {@link Agent} `getApiKey` (pi-agent requires sync).
  * Order: default agent auth-profiles → global auth-profiles → OAuth token file.
  * Does not read standard env vars or models.json registry — callers chain `getApiKeySync` after this.
  */
 export declare function resolveProviderApiKeySync(provider: string): string | undefined;
+/** Resolve one agent's private credential, then the shared credential and OAuth token. */
+export declare function resolveProviderApiKeyForAgentSync(provider: string, agentId?: string, config?: Config): string | undefined;
 /**
  * True if credentials exist in auth profiles (global or agent) or OAuth store,
  * matching async CredentialResolver resolution (excluding env — callers check env separately).

package/dist/src/auth/sync-provider-auth.js

@@ -88,6 +88,17 @@ function resolveProviderApiKeySync(provider) {
 	if (fromGlobal) return fromGlobal;
 	return readOAuthAccessTokenSync(normalized);
 }
+/** Resolve one agent's private credential, then the shared credential and OAuth token. */
+function resolveProviderApiKeyForAgentSync(provider, agentId, config) {
+	const normalized = provider.toLowerCase();
+	if (agentId?.trim()) {
+		const fromAgent = readApiKeyFromProfilesFile(resolveAgentAuthProfilesPath(config ?? loadConfig(), agentId.trim()), normalized);
+		if (fromAgent) return fromAgent;
+	}
+	const fromGlobal = readApiKeyFromProfilesFile(resolveAuthProfilesPath(), normalized);
+	if (fromGlobal) return fromGlobal;
+	return readOAuthAccessTokenSync(normalized);
+}
 /**
 * True if credentials exist in auth profiles (global or agent) or OAuth store,
 * matching async CredentialResolver resolution (excluding env — callers check env separately).
@@ -106,4 +117,4 @@ var init_sync_provider_auth = __esmMin((() => {
 }));
 //#endregion
 init_sync_provider_auth();
-export { hasProviderAuthOnDiskSync, init_sync_provider_auth, resolveProviderApiKeySync };
+export { hasProviderAuthOnDiskSync, init_sync_provider_auth, resolveProviderApiKeyForAgentSync, resolveProviderApiKeySync };

package/dist/src/cli/commands/models.js

@@ -15,14 +15,11 @@ init_credentials();
 init_schema();
 init_providers();
 const IMAGE_GENERATION_IDS = new Set([
-	"gpt-image-1",
-	"dall-e-3",
-	"dall-e-2",
+	"gpt-image-2",
+	"gpt-image-1.5",
 	"wan2.6-t2i",
 	"wan2.7-image-pro",
 	"wan2.7-image",
-	"wan2.1-t2i-turbo",
-	"wan2.1-t2i-plus",
 	"image-01",
 	"image-01-live"
 ]);

package/dist/src/cli/commands/onboard/model.js

@@ -301,7 +301,7 @@ function resolvePresetEnvCredential(preset) {
 	}
 }
 async function setupDomesticPreset(config, ctx, preset) {
-	console.log(`\n🇨🇳 ${preset.displayName}\n`);
+	console.log(`\n${preset.onboardingIcon ?? "🇨🇳"} ${preset.displayName}\n`);
 	console.log(preset.description);
 	if (preset.quirks?.length) for (const quirk of preset.quirks) console.log(colors.gray(`Note: ${quirk}`));
 	const baseUrlChoice = await select({
@@ -336,13 +336,14 @@ async function setupDomesticPreset(config, ctx, preset) {
 		headers: preset.headers
 	});
 	const modelChoices = discoveredChoices.length > 0 ? discoveredChoices : getModelsForProvider(preset.id);
+	if (preset.requiresModelDiscovery && modelChoices.length === 0) throw new Error(`No models are available from ${preset.displayName}. Ask an administrator to publish a model, then retry.`);
 	const modelRef = await select({
 		message: "Model:",
 		choices: modelChoices.map((choice) => ({
 			...choice,
 			name: modelChoiceName(choice)
 		})),
-		default: `${preset.id}/${preset.defaultModel}`
+		default: preset.defaultModel ? `${preset.id}/${preset.defaultModel}` : modelChoices[0]?.value
 	});
 	const modelId = modelRef.split("/").slice(1).join("/");
 	if (await confirm({

package/dist/src/cli/commands/setup-shared/types.d.ts

@@ -7,7 +7,7 @@
  */
 export type SetupAction = 'add' | 'set' | 'remove' | 'noop';
 export interface SetupError {
-    /** Dot path of the offending field, when known (e.g. `providers.openai.apiKey`). */
+    /** Dot path of the offending field, when known (e.g. `providers.openai.baseUrl`). */
     path?: string;
     message: string;
 }

package/dist/src/config/index.js

@@ -1,7 +1,7 @@
 import { ENV_VARS, XOPC_DB_FILENAME, resolveHomeDir, resolveStateDir, resolveXopcDatabasePath } from "./paths-state.js";
 import { TelegramAccountConfigSchema, TelegramConfigSchema, TelegramGroupConfigSchema, TelegramTopicConfigSchema } from "../../extensions/telegram/src/config-schema.js";
 import { WeixinAccountConfigSchema, WeixinConfigSchema } from "../../extensions/weixin/src/config-schema.js";
-import { AgentImageGenerationModelSchema, AgentModelRefSchema, AgentModelsSchema, AgentTypedModelRoleSchema, AgentsConfigSchema, BindingMatchSchema, BindingRuleSchema, BindingsConfigSchema, BrowserConfigSchema, ChannelsConfigSchema, CodeIntelligenceConfigSchema, CommandsConfigSchema, ConfigSchema, ConnectorsConfigSchema, ExperimentalConfigSchema, ExtensionSecurityConfigSchema, ExtensionSlotsConfigSchema, ExtensionsConfigSchema, GatewayAuthRateLimitSchema, GatewayAuthSchema, GatewayBindModeSchema, GatewayChannelConnectDeferModeSchema, GatewayConfigSchema, GatewayModeSchema, GatewayRemoteSchema, GatewaySecuritySchema, GatewayTailscaleConsentSchema, GatewayTailscaleSchema, GatewayTlsSchema, GatewayTrustedProxySchema, GoalNotificationEventSchema, GoalNotificationTargetSchema, GoalNotificationsConfigSchema, GoalsConfigSchema, HeartbeatConfigSchema, McpConfigSchema, McpServerSchema, MediaUnderstandingCapabilitiesSchema, MediaUnderstandingModelSchema, MessagesConfigSchema, ModelsDevConfigSchema, ProviderAuthConfigSchema, ProviderAzureConfigSchema, ProviderRequestOverridesSchema, ProvidersConfigSchema, STTConfigSchema, STTFallbackConfigSchema, STTProviderConfigSchema, SearchProviderEntrySchema, SessionConfigSchema, SessionDmScopeSchema, SessionResetByTypeSchema, SessionResetConfigSchema, SessionResetModeSchema, SessionScopeSchema, SessionStorageConfigSchema, TTSConfigSchema, TTSEdgeConfigSchema, TTSFallbackConfigSchema, TTSModelOverridesConfigSchema, TTSProviderConfigSchema, TTSSummarizationConfigSchema, ToolsConfigSchema, ToolsMediaAudioConfigSchema, ToolsMediaConfigSchema, TuiConfigSchema, TunnelConfigSchema, TunnelConsentSchema, UpdateAutoConfigSchema, UpdateConfigSchema, VoiceConfigSchema, VoiceRefinementConfigSchema, WebSearchConfigSchema, WebToolsConfigSchema, WebsiteBlocklistSchema, WorkspaceConfigSchema, WorkspaceImportConfigSchema, getAgentDefaultImageGenerationModelConfig, getAgentDefaultImageModelConfig, getAgentDefaultModelRef, init_schema, parseModelRef } from "./schema.js";
+import { AgentImageGenerationModelSchema, AgentModelRefSchema, AgentModelsSchema, AgentTypedModelRoleSchema, AgentsConfigSchema, BindingMatchSchema, BindingRuleSchema, BindingsConfigSchema, BrowserConfigSchema, ChannelsConfigSchema, CodeIntelligenceConfigSchema, CommandsConfigSchema, ConfigSchema, ConnectorsConfigSchema, ExperimentalConfigSchema, ExtensionSecurityConfigSchema, ExtensionSlotsConfigSchema, ExtensionsConfigSchema, GatewayAuthRateLimitSchema, GatewayAuthSchema, GatewayBindModeSchema, GatewayChannelConnectDeferModeSchema, GatewayConfigSchema, GatewayModeSchema, GatewayRemoteSchema, GatewaySecuritySchema, GatewayTailscaleConsentSchema, GatewayTailscaleSchema, GatewayTlsSchema, GatewayTrustedProxySchema, GoalNotificationEventSchema, GoalNotificationTargetSchema, GoalNotificationsConfigSchema, GoalsConfigSchema, HeartbeatConfigSchema, McpConfigSchema, McpServerSchema, MediaUnderstandingCapabilitiesSchema, MediaUnderstandingModelSchema, MessagesConfigSchema, ModelCatalogConfigSchema, ModelsDevConfigSchema, ProviderAuthConfigSchema, ProviderAzureConfigSchema, ProviderRequestOverridesSchema, ProvidersConfigSchema, STTConfigSchema, STTFallbackConfigSchema, STTProviderConfigSchema, SearchProviderEntrySchema, SessionConfigSchema, SessionDmScopeSchema, SessionResetByTypeSchema, SessionResetConfigSchema, SessionResetModeSchema, SessionScopeSchema, SessionStorageConfigSchema, TTSConfigSchema, TTSEdgeConfigSchema, TTSFallbackConfigSchema, TTSModelOverridesConfigSchema, TTSProviderConfigSchema, TTSSummarizationConfigSchema, ToolsConfigSchema, ToolsMediaAudioConfigSchema, ToolsMediaConfigSchema, TuiConfigSchema, TunnelConfigSchema, TunnelConsentSchema, UpdateAutoConfigSchema, UpdateConfigSchema, VoiceConfigSchema, VoiceRefinementConfigSchema, WebSearchConfigSchema, WebToolsConfigSchema, WebsiteBlocklistSchema, WorkspaceConfigSchema, WorkspaceImportConfigSchema, getAgentDefaultImageGenerationModelConfig, getAgentDefaultImageModelConfig, getAgentDefaultModelRef, init_schema, parseModelRef } from "./schema.js";
 import { applyConfigOverrides, getConfigOverrides, resetConfigOverrides, setConfigOverride, unsetConfigOverride } from "./runtime-overrides.js";
 import { expandWorkspacePathString, init_workspace_path, normalizeWorkspaceDir, resolveWorkspaceRoot } from "./workspace-path.js";
 import { resolveDefaultAgentWorkspaceDir } from "./workspace-defaults.js";
@@ -27,4 +27,4 @@ init_workspace_path();
 init_models_json();
 init_resolve_config_value();
 //#endregion
-export { AgentImageGenerationModelSchema, AgentModelRefSchema, AgentModelsSchema, AgentTypedModelRoleSchema, AgentsConfigSchema, BASE_RELOAD_RULES, BindingMatchSchema, BindingRuleSchema, BindingsConfigSchema, BrowserConfigSchema, ChannelsConfigSchema, CodeIntelligenceConfigSchema, CommandsConfigSchema, ConfigHotReloader, ConfigSchema, ConnectorsConfigSchema, CustomModelSchema, ENV_VARS, ExperimentalConfigSchema, ExtensionSecurityConfigSchema, ExtensionSlotsConfigSchema, ExtensionsConfigSchema, FILENAMES, GatewayAuthRateLimitSchema, GatewayAuthSchema, GatewayBindModeSchema, GatewayChannelConnectDeferModeSchema, GatewayConfigSchema, GatewayModeSchema, GatewayRemoteSchema, GatewaySecuritySchema, GatewayTailscaleConsentSchema, GatewayTailscaleSchema, GatewayTlsSchema, GatewayTrustedProxySchema, GoalNotificationEventSchema, GoalNotificationTargetSchema, GoalNotificationsConfigSchema, GoalsConfigSchema, HeartbeatConfigSchema, McpConfigSchema, McpServerSchema, MediaUnderstandingCapabilitiesSchema, MediaUnderstandingModelSchema, MessagesConfigSchema, ModelOverrideSchema, ModelsDevConfigSchema, ModelsJsonSchema, OpenAICompatSchema, OpenAICompletionsCompatSchema, OpenAIResponsesCompatSchema, OpenRouterRoutingSchema, ProfileManager, ProviderAuthConfigSchema, ProviderAzureConfigSchema, ProviderConfigSchema, ProviderRequestOverridesSchema, ProvidersConfigSchema, STTConfigSchema, STTFallbackConfigSchema, STTProviderConfigSchema, SearchProviderEntrySchema, SessionConfigSchema, SessionDmScopeSchema, SessionResetByTypeSchema, SessionResetConfigSchema, SessionResetModeSchema, SessionScopeSchema, SessionStorageConfigSchema, TTSConfigSchema, TTSEdgeConfigSchema, TTSFallbackConfigSchema, TTSModelOverridesConfigSchema, TTSProviderConfigSchema, TTSSummarizationConfigSchema, TelegramAccountConfigSchema, TelegramConfigSchema, TelegramGroupConfigSchema, TelegramTopicConfigSchema, ToolsConfigSchema, ToolsMediaAudioConfigSchema, ToolsMediaConfigSchema, TuiConfigSchema, TunnelConfigSchema, TunnelConsentSchema, USER_MEMORY_FILENAME, USER_PROFILE_FILENAME, UpdateAutoConfigSchema, UpdateConfigSchema, VercelGatewayRoutingSchema, VoiceConfigSchema, VoiceRefinementConfigSchema, WORKSPACE_FILES, WebSearchConfigSchema, WebToolsConfigSchema, WebsiteBlocklistSchema, WeixinAccountConfigSchema, WeixinConfigSchema, WorkspaceConfigSchema, WorkspaceImportConfigSchema, XOPC_DB_FILENAME, applyConfigOverrides, buildReloadPlan, canonicalizeConfiguredMcpServer, clearConfigValueCache, createProfile, deleteProfile, diffConfigPaths, existsSync, expandWorkspacePathString, extractProfileAgentId, formatThinkingLevels, getAgentDefaultImageGenerationModelConfig, getAgentDefaultImageModelConfig, getAgentDefaultModelRef, getAllowedCommands, getCacheStats, getConfigOverrides, getCurrentProfile, getDefaultModelValues, resolveModelsJsonPath as getModelsJsonPath, getProfileManager, getProfileNameFromDir, getSwitchCommand, getWorkspacePath, hasBundledExtensionManifest, isKnownCliMcpTypeAlias, listAgentProfileMarkdownDirs, listAgentWorkspaceDirs, listProfiles, listThinkingLevels, loadConfig, loadModelsJson, matchReloadRule, modelsJsonExists, normalizeConfiguredMcpServers, normalizeElevatedMode, normalizeReasoningLevel, normalizeThinkLevel, normalizeVerboseLevel, normalizeWorkspaceDir, parseModelRef, resetConfigOverrides, resolveAgentAuthProfilesPath, resolveAgentDir, resolveAgentDir$1 as resolveAgentDirFromConfig, resolveAgentHomeDir, resolveAgentHomeDir$1 as resolveAgentHomeDirFromConfig, resolveAgentProfileDir, resolveAgentProfileMarkdownPath, resolveAgentWorkspaceDir, resolveAuthProfilesPath, resolveBinDir, resolveBundledExtensionsDir, resolveBundledSkillsDir, resolveConfigPath, resolveConfigValue, resolveCredentialsDir, resolveDefaultAgentWorkspaceDir, resolveEffectiveAgentManifestForAgent, resolveEffectiveAgentManifestForSession, resolveEffectiveAgentProfile, resolveEffectiveAgentProfileForSession, resolveExtensionSdkPath, resolveExtensionsDir, resolveExtensionsLockPath, resolveHeaders, resolveHomeDir, resolveInboxDir, resolveInboxMessagePath, resolveInboxPendingDir, resolveInboxProcessedDir, resolveLogPath, resolveLogsDir, resolveModelsJsonPath, resolveNodeBinDir, resolveNodeBinPath, resolveNodeToolsDir, resolveNpmBinPath, resolveOAuthPath, resolvePidPath, resolveProfileStateDir, resolveSkillPath, resolveSkillsCachePath, resolveSkillsDir, resolveSkillsLockPath, resolveSocketPath, resolveStateDir, resolveStatusPath, resolveToolsDir, resolveUserDir, resolveUserMemoryPath, resolveUserProfilePath, resolveWorkspaceExtensionsDir, resolveWorkspaceFile, resolveWorkspaceRoot, resolveWorkspaceStateDir, resolveWorkspaceStatePath, resolveXopcBinPath, resolveXopcDatabasePath, resolveXopcMcpTransportAlias, saveConfig, saveModelsJson, setConfigOverride, testApiKeyResolution, thinkLevelToNumber, unsetConfigOverride, validateModelsConfig };
+export { AgentImageGenerationModelSchema, AgentModelRefSchema, AgentModelsSchema, AgentTypedModelRoleSchema, AgentsConfigSchema, BASE_RELOAD_RULES, BindingMatchSchema, BindingRuleSchema, BindingsConfigSchema, BrowserConfigSchema, ChannelsConfigSchema, CodeIntelligenceConfigSchema, CommandsConfigSchema, ConfigHotReloader, ConfigSchema, ConnectorsConfigSchema, CustomModelSchema, ENV_VARS, ExperimentalConfigSchema, ExtensionSecurityConfigSchema, ExtensionSlotsConfigSchema, ExtensionsConfigSchema, FILENAMES, GatewayAuthRateLimitSchema, GatewayAuthSchema, GatewayBindModeSchema, GatewayChannelConnectDeferModeSchema, GatewayConfigSchema, GatewayModeSchema, GatewayRemoteSchema, GatewaySecuritySchema, GatewayTailscaleConsentSchema, GatewayTailscaleSchema, GatewayTlsSchema, GatewayTrustedProxySchema, GoalNotificationEventSchema, GoalNotificationTargetSchema, GoalNotificationsConfigSchema, GoalsConfigSchema, HeartbeatConfigSchema, McpConfigSchema, McpServerSchema, MediaUnderstandingCapabilitiesSchema, MediaUnderstandingModelSchema, MessagesConfigSchema, ModelCatalogConfigSchema, ModelOverrideSchema, ModelsDevConfigSchema, ModelsJsonSchema, OpenAICompatSchema, OpenAICompletionsCompatSchema, OpenAIResponsesCompatSchema, OpenRouterRoutingSchema, ProfileManager, ProviderAuthConfigSchema, ProviderAzureConfigSchema, ProviderConfigSchema, ProviderRequestOverridesSchema, ProvidersConfigSchema, STTConfigSchema, STTFallbackConfigSchema, STTProviderConfigSchema, SearchProviderEntrySchema, SessionConfigSchema, SessionDmScopeSchema, SessionResetByTypeSchema, SessionResetConfigSchema, SessionResetModeSchema, SessionScopeSchema, SessionStorageConfigSchema, TTSConfigSchema, TTSEdgeConfigSchema, TTSFallbackConfigSchema, TTSModelOverridesConfigSchema, TTSProviderConfigSchema, TTSSummarizationConfigSchema, TelegramAccountConfigSchema, TelegramConfigSchema, TelegramGroupConfigSchema, TelegramTopicConfigSchema, ToolsConfigSchema, ToolsMediaAudioConfigSchema, ToolsMediaConfigSchema, TuiConfigSchema, TunnelConfigSchema, TunnelConsentSchema, USER_MEMORY_FILENAME, USER_PROFILE_FILENAME, UpdateAutoConfigSchema, UpdateConfigSchema, VercelGatewayRoutingSchema, VoiceConfigSchema, VoiceRefinementConfigSchema, WORKSPACE_FILES, WebSearchConfigSchema, WebToolsConfigSchema, WebsiteBlocklistSchema, WeixinAccountConfigSchema, WeixinConfigSchema, WorkspaceConfigSchema, WorkspaceImportConfigSchema, XOPC_DB_FILENAME, applyConfigOverrides, buildReloadPlan, canonicalizeConfiguredMcpServer, clearConfigValueCache, createProfile, deleteProfile, diffConfigPaths, existsSync, expandWorkspacePathString, extractProfileAgentId, formatThinkingLevels, getAgentDefaultImageGenerationModelConfig, getAgentDefaultImageModelConfig, getAgentDefaultModelRef, getAllowedCommands, getCacheStats, getConfigOverrides, getCurrentProfile, getDefaultModelValues, resolveModelsJsonPath as getModelsJsonPath, getProfileManager, getProfileNameFromDir, getSwitchCommand, getWorkspacePath, hasBundledExtensionManifest, isKnownCliMcpTypeAlias, listAgentProfileMarkdownDirs, listAgentWorkspaceDirs, listProfiles, listThinkingLevels, loadConfig, loadModelsJson, matchReloadRule, modelsJsonExists, normalizeConfiguredMcpServers, normalizeElevatedMode, normalizeReasoningLevel, normalizeThinkLevel, normalizeVerboseLevel, normalizeWorkspaceDir, parseModelRef, resetConfigOverrides, resolveAgentAuthProfilesPath, resolveAgentDir, resolveAgentDir$1 as resolveAgentDirFromConfig, resolveAgentHomeDir, resolveAgentHomeDir$1 as resolveAgentHomeDirFromConfig, resolveAgentProfileDir, resolveAgentProfileMarkdownPath, resolveAgentWorkspaceDir, resolveAuthProfilesPath, resolveBinDir, resolveBundledExtensionsDir, resolveBundledSkillsDir, resolveConfigPath, resolveConfigValue, resolveCredentialsDir, resolveDefaultAgentWorkspaceDir, resolveEffectiveAgentManifestForAgent, resolveEffectiveAgentManifestForSession, resolveEffectiveAgentProfile, resolveEffectiveAgentProfileForSession, resolveExtensionSdkPath, resolveExtensionsDir, resolveExtensionsLockPath, resolveHeaders, resolveHomeDir, resolveInboxDir, resolveInboxMessagePath, resolveInboxPendingDir, resolveInboxProcessedDir, resolveLogPath, resolveLogsDir, resolveModelsJsonPath, resolveNodeBinDir, resolveNodeBinPath, resolveNodeToolsDir, resolveNpmBinPath, resolveOAuthPath, resolvePidPath, resolveProfileStateDir, resolveSkillPath, resolveSkillsCachePath, resolveSkillsDir, resolveSkillsLockPath, resolveSocketPath, resolveStateDir, resolveStatusPath, resolveToolsDir, resolveUserDir, resolveUserMemoryPath, resolveUserProfilePath, resolveWorkspaceExtensionsDir, resolveWorkspaceFile, resolveWorkspaceRoot, resolveWorkspaceStateDir, resolveWorkspaceStatePath, resolveXopcBinPath, resolveXopcDatabasePath, resolveXopcMcpTransportAlias, saveConfig, saveModelsJson, setConfigOverride, testApiKeyResolution, thinkLevelToNumber, unsetConfigOverride, validateModelsConfig };

package/dist/src/config/models-json.d.ts

@@ -292,6 +292,9 @@ export declare const ProviderConfigSchema: z.ZodObject<{
             supportsStrictMode: z.ZodOptional<z.ZodBoolean>;
         }, z.core.$strip>, z.ZodObject<{}, z.core.$strip>]>>;
     }, z.core.$strip>>>;
+    modelDiscovery: z.ZodOptional<z.ZodObject<{
+        enabled: z.ZodBoolean;
+    }, z.core.$strict>>;
 }, z.core.$strip>;
 export declare const ModelsJsonSchema: z.ZodObject<{
     providers: z.ZodRecord<z.ZodString, z.ZodObject<{
@@ -412,6 +415,9 @@ export declare const ModelsJsonSchema: z.ZodObject<{
                 supportsStrictMode: z.ZodOptional<z.ZodBoolean>;
             }, z.core.$strip>, z.ZodObject<{}, z.core.$strip>]>>;
         }, z.core.$strip>>>;
+        modelDiscovery: z.ZodOptional<z.ZodObject<{
+            enabled: z.ZodBoolean;
+        }, z.core.$strict>>;
     }, z.core.$strip>>;
 }, z.core.$strip>;
 export type OpenRouterRouting = z.infer<typeof OpenRouterRoutingSchema>;

package/dist/src/config/models-json.js

@@ -46,11 +46,6 @@ function validateModelsConfig(config) {
 				message: "baseUrl is required when defining custom models",
 				severity: "error"
 			});
-			if (!providerConfig.apiKey) errors.push({
-				path: `providers.${providerName}.apiKey`,
-				message: "apiKey is required when defining custom models",
-				severity: "error"
-			});
 		}
 		if (!hasModels && !hasBaseUrl && !hasModelOverrides && !providerConfig.apiKey) errors.push({
 			path: `providers.${providerName}`,
@@ -247,7 +242,8 @@ var init_models_json = __esmMin((() => {
 		headers: z.record(z.string(), z.string()).optional(),
 		authHeader: z.boolean().optional(),
 		models: z.array(CustomModelSchema).optional(),
-		modelOverrides: z.record(z.string(), ModelOverrideSchema).optional()
+		modelOverrides: z.record(z.string(), ModelOverrideSchema).optional(),
+		modelDiscovery: z.object({ enabled: z.boolean() }).strict().optional()
 	});
 	ModelsJsonSchema = z.object({ providers: z.record(z.string(), ProviderConfigSchema) });
 	PROVIDER_ID_REGEX = /^[a-z0-9]([a-z0-9-_]*[a-z0-9])?$/;

package/dist/src/config/schema.d.ts

@@ -934,6 +934,11 @@ export declare const GatewayConfigSchema: z.ZodDefault<z.ZodObject<{
 export declare const ModelsDevConfigSchema: z.ZodDefault<z.ZodObject<{
     enabled: z.ZodDefault<z.ZodBoolean>;
 }, z.core.$strip>>;
+export declare const ModelCatalogConfigSchema: z.ZodDefault<z.ZodObject<{
+    enabled: z.ZodDefault<z.ZodBoolean>;
+    refreshOnStartup: z.ZodDefault<z.ZodBoolean>;
+    intervalHours: z.ZodDefault<z.ZodNumber>;
+}, z.core.$strict>>;
 export declare const STTProviderConfigSchema: z.ZodObject<{
     apiKey: z.ZodOptional<z.ZodString>;
     model: z.ZodOptional<z.ZodString>;
@@ -1247,15 +1252,14 @@ export declare const ProviderRequestOverridesSchema: z.ZodObject<{
 }, z.core.$strict>;
 /**
  * Generic per-vendor provider config — used by image / audio / video
- * capability providers via `cfg.providers.<id>`. Kept loose (`.strict()` but
- * everything optional) so adding a new vendor never requires a config
- * migration.
+ * capability providers via `cfg.providers.<id>`.
  */
 export declare const ProviderAuthConfigSchema: z.ZodObject<{
-    apiKey: z.ZodOptional<z.ZodString>;
     baseUrl: z.ZodOptional<z.ZodString>;
-    region: z.ZodOptional<z.ZodString>;
-    imageBaseUrl: z.ZodOptional<z.ZodString>;
+    region: z.ZodOptional<z.ZodEnum<{
+        cn: "cn";
+        intl: "intl";
+    }>>;
     request: z.ZodOptional<z.ZodObject<{
         timeoutMs: z.ZodOptional<z.ZodNumber>;
         headers: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
@@ -1268,15 +1272,16 @@ export declare const ProviderAuthConfigSchema: z.ZodObject<{
 }, z.core.$strict>;
 export type ProviderAuthConfig = z.infer<typeof ProviderAuthConfigSchema>;
 /**
- * `cfg.providers.<id>` is keyed by provider id (`openai`, `dashscope`,
- * `minimax`, `google`, `fal`, …). Every entry is optional and validated by
+ * `cfg.providers.<id>` stores non-secret connection settings. Credentials
+ * live in the credential store or environment. Every entry is validated by
  * {@link ProviderAuthConfigSchema}.
  */
 export declare const ProvidersConfigSchema: z.ZodRecord<z.ZodString, z.ZodObject<{
-    apiKey: z.ZodOptional<z.ZodString>;
     baseUrl: z.ZodOptional<z.ZodString>;
-    region: z.ZodOptional<z.ZodString>;
-    imageBaseUrl: z.ZodOptional<z.ZodString>;
+    region: z.ZodOptional<z.ZodEnum<{
+        cn: "cn";
+        intl: "intl";
+    }>>;
     request: z.ZodOptional<z.ZodObject<{
         timeoutMs: z.ZodOptional<z.ZodNumber>;
         headers: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
@@ -2330,10 +2335,11 @@ export declare const ConfigSchema: z.ZodDefault<z.ZodObject<{
     }, z.core.$strict>>;
     extensions: z.ZodDefault<z.ZodType<Record<string, unknown>, unknown, z.core.$ZodTypeInternals<Record<string, unknown>, unknown>>>;
     providers: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
-        apiKey: z.ZodOptional<z.ZodString>;
         baseUrl: z.ZodOptional<z.ZodString>;
-        region: z.ZodOptional<z.ZodString>;
-        imageBaseUrl: z.ZodOptional<z.ZodString>;
+        region: z.ZodOptional<z.ZodEnum<{
+            cn: "cn";
+            intl: "intl";
+        }>>;
         request: z.ZodOptional<z.ZodObject<{
             timeoutMs: z.ZodOptional<z.ZodNumber>;
             headers: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
@@ -2347,6 +2353,11 @@ export declare const ConfigSchema: z.ZodDefault<z.ZodObject<{
     modelsDev: z.ZodDefault<z.ZodObject<{
         enabled: z.ZodDefault<z.ZodBoolean>;
     }, z.core.$strip>>;
+    modelCatalog: z.ZodDefault<z.ZodObject<{
+        enabled: z.ZodDefault<z.ZodBoolean>;
+        refreshOnStartup: z.ZodDefault<z.ZodBoolean>;
+        intervalHours: z.ZodDefault<z.ZodNumber>;
+    }, z.core.$strict>>;
     messages: z.ZodOptional<z.ZodObject<{
         tts: z.ZodOptional<z.ZodObject<{
             enabled: z.ZodDefault<z.ZodBoolean>;
@@ -2446,6 +2457,6 @@ export interface ParsedModelRef {
 }
 export declare function getAgentDefaultModelRef(config: Config): string | undefined;
 export declare function getAgentDefaultImageModelConfig(config: Config): AgentModelConfig | undefined;
-export declare function getAgentDefaultImageGenerationModelConfig(config: Config): AgentImageGenerationModelConfig | undefined;
+export declare function getAgentDefaultImageGenerationModelConfig(config: Config, agentId: string): AgentImageGenerationModelConfig | undefined;
 /** `provider/model` or null when invalid. */
 export declare function parseModelRef(ref: string): ParsedModelRef | null;

package/dist/src/config/schema.js

@@ -26,9 +26,9 @@ function getAgentDefaultModelRef(config) {
 	applyModels(agent.models);
 	return modelRef;
 }
-function getAgentDefaultModelsConfig(config) {
+function getAgentDefaultModelsConfig(config, requestedAgentId) {
 	const list = Array.isArray(config.agents?.list) ? config.agents.list : [];
-	const defaultId = config.agents?.default?.trim() || list.find((entry) => entry.default === true)?.id?.trim() || list[0]?.id;
+	const defaultId = requestedAgentId?.trim() || config.agents?.default?.trim() || list.find((entry) => entry.default === true)?.id?.trim() || list[0]?.id;
 	const agent = list.find((entry) => entry.enabled !== false && entry.id === defaultId) ?? list[0];
 	if (!agent) return void 0;
 	let modelConfig;
@@ -51,8 +51,8 @@ function getAgentDefaultModelsConfig(config) {
 function getAgentDefaultImageModelConfig(config) {
 	return getAgentDefaultModelsConfig(config)?.imageModel;
 }
-function getAgentDefaultImageGenerationModelConfig(config) {
-	return getAgentDefaultModelsConfig(config)?.imageGenerationModel;
+function getAgentDefaultImageGenerationModelConfig(config, agentId) {
+	return getAgentDefaultModelsConfig(config, agentId)?.imageGenerationModel;
 }
 /** `provider/model` or null when invalid. */
 function parseModelRef(ref) {
@@ -64,7 +64,7 @@ function parseModelRef(ref) {
 		model: trimmed.slice(idx + 1).trim()
 	};
 }
-var AgentModelRefSchema, AgentImageGenerationModelSchema, AgentTypedModelRoleSchema, AgentTypedModelRolesSchema, AgentModelsSchema, AgentsConfigSchema, BrowserCloudConfigSchema, BrowserExtensionConfigSchema, BrowserCloakConfigSchema, BrowserConfigSchema, BindingMatchSchema, BindingRuleSchema, BindingsConfigSchema, SessionDmScopeSchema, SessionStorageConfigSchema, SessionResetModeSchema, SessionResetConfigSchema, SessionResetByTypeSchema, SessionScopeSchema, SessionConfigSchema, ChannelsConfigSchema, SearchProviderEntrySchema, WebSearchConfigSchema, WebsiteBlocklistSchema, WebToolsConfigSchema, ToolsConfigSchema, GatewayAuthRateLimitSchema, GatewaySecuritySchema, GatewayTrustedProxySchema, GatewayAuthSchema, GatewayTailscaleConsentSchema, GatewayTailscaleSchema, GatewayRemoteSchema, GatewayTlsSchema, GatewayModeSchema, HeartbeatConfigSchema, GatewayChannelConnectDeferModeSchema, TunnelConsentSchema, TunnelConfigSchema, WorkspaceImportConfigSchema, WorkspaceConfigSchema, GatewayBindModeSchema, GatewayConfigSchema, ModelsDevConfigSchema, SttProviderConfigCatchallSchema, STTProviderConfigSchema, STTFallbackConfigSchema, MediaUnderstandingCapabilitiesSchema, MediaUnderstandingModelSchema, STTConfigSchema, TtsProviderConfigCatchallSchema, TTSProviderConfigSchema, TTSFallbackConfigSchema, TTSModelOverridesConfigSchema, TTSEdgeConfigSchema, TTSSummarizationConfigSchema, TTSConfigSchema, VoiceRefinementConfigSchema, VoiceConfigSchema, MessagesConfigSchema, ToolsMediaAudioConfigSchema, ToolsMediaConfigSchema, ProviderAzureConfigSchema, ProviderRequestOverridesSchema, ProviderAuthConfigSchema, ProvidersConfigSchema, ExtensionSecurityConfigSchema, ExtensionSlotsConfigSchema, ExtensionsConfigSchema, UpdateAutoConfigSchema, GoalNotificationEventSchema, GoalNotificationTargetSchema, GoalNotificationsConfigSchema, GoalsConfigSchema, UpdateConfigSchema, CommandsConfigSchema, TuiConfigSchema, McpHttpUrlSchema, ConnectorSecretReferenceSchema, McpConfigScalarSchema, McpServerSchema, McpConfigSchema, CodeIntelligenceConfigSchema, ConnectorsConfigSchema, ExperimentalConfigSchema, ConfigSchema;
+var AgentModelRefSchema, AgentImageGenerationModelSchema, AgentTypedModelRoleSchema, AgentTypedModelRolesSchema, AgentModelsSchema, AgentsConfigSchema, BrowserCloudConfigSchema, BrowserExtensionConfigSchema, BrowserCloakConfigSchema, BrowserConfigSchema, BindingMatchSchema, BindingRuleSchema, BindingsConfigSchema, SessionDmScopeSchema, SessionStorageConfigSchema, SessionResetModeSchema, SessionResetConfigSchema, SessionResetByTypeSchema, SessionScopeSchema, SessionConfigSchema, ChannelsConfigSchema, SearchProviderEntrySchema, WebSearchConfigSchema, WebsiteBlocklistSchema, WebToolsConfigSchema, ToolsConfigSchema, GatewayAuthRateLimitSchema, GatewaySecuritySchema, GatewayTrustedProxySchema, GatewayAuthSchema, GatewayTailscaleConsentSchema, GatewayTailscaleSchema, GatewayRemoteSchema, GatewayTlsSchema, GatewayModeSchema, HeartbeatConfigSchema, GatewayChannelConnectDeferModeSchema, TunnelConsentSchema, TunnelConfigSchema, WorkspaceImportConfigSchema, WorkspaceConfigSchema, GatewayBindModeSchema, GatewayConfigSchema, ModelsDevConfigSchema, ModelCatalogConfigSchema, SttProviderConfigCatchallSchema, STTProviderConfigSchema, STTFallbackConfigSchema, MediaUnderstandingCapabilitiesSchema, MediaUnderstandingModelSchema, STTConfigSchema, TtsProviderConfigCatchallSchema, TTSProviderConfigSchema, TTSFallbackConfigSchema, TTSModelOverridesConfigSchema, TTSEdgeConfigSchema, TTSSummarizationConfigSchema, TTSConfigSchema, VoiceRefinementConfigSchema, VoiceConfigSchema, MessagesConfigSchema, ToolsMediaAudioConfigSchema, ToolsMediaConfigSchema, ProviderAzureConfigSchema, ProviderRequestOverridesSchema, ProviderAuthConfigSchema, ProvidersConfigSchema, ExtensionSecurityConfigSchema, ExtensionSlotsConfigSchema, ExtensionsConfigSchema, UpdateAutoConfigSchema, GoalNotificationEventSchema, GoalNotificationTargetSchema, GoalNotificationsConfigSchema, GoalsConfigSchema, UpdateConfigSchema, CommandsConfigSchema, TuiConfigSchema, McpHttpUrlSchema, ConnectorSecretReferenceSchema, McpConfigScalarSchema, McpServerSchema, McpConfigSchema, CodeIntelligenceConfigSchema, ConnectorsConfigSchema, ExperimentalConfigSchema, ConfigSchema;
 var init_schema = __esmMin((() => {
 	init_schema$1();
 	init_preset_chain();
@@ -645,6 +645,15 @@ strict: z.boolean().optional() }).optional();
 		skillsStoreBaseUrl: "https://store.xopc.ai"
 	});
 	ModelsDevConfigSchema = z.object({ enabled: z.boolean().default(true) }).default({ enabled: true });
+	ModelCatalogConfigSchema = z.object({
+		enabled: z.boolean().default(true),
+		refreshOnStartup: z.boolean().default(true),
+		intervalHours: z.number().min(.25).default(6)
+	}).strict().default({
+		enabled: true,
+		refreshOnStartup: true,
+		intervalHours: 6
+	});
 	SttProviderConfigCatchallSchema = z.union([
 		z.string(),
 		z.number(),
@@ -804,14 +813,10 @@ tts: TTSConfigSchema.optional() }).optional();
 		headers: z.record(z.string(), z.string()).optional()
 	}).strict();
 	ProviderAuthConfigSchema = z.object({
-		/** Static API key (api-key / azure-key modes). */
-		apiKey: z.string().optional(),
 		/** Override the default REST base URL. */
 		baseUrl: z.string().url().optional(),
-		/** Vendor region (DashScope: `beijing` / `singapore`; AWS: region id). */
-		region: z.string().optional(),
-		/** Image-only base URL override (DashScope splits image vs LLM). */
-		imageBaseUrl: z.string().url().optional(),
+		/** Provider deployment region. */
+		region: z.enum(["cn", "intl"]).optional(),
 		/** Per-vendor request overrides. */
 		request: ProviderRequestOverridesSchema.optional(),
 		/** Azure OpenAI deployment overrides; only consumed by OpenAI image provider. */
@@ -1015,6 +1020,7 @@ workDiscoveryOnboarding: z.boolean().default(true) }).strict().default({ workDis
 		/** Per-vendor capability provider config (image / audio / video). */
 		providers: ProvidersConfigSchema.optional(),
 		modelsDev: ModelsDevConfigSchema,
+		modelCatalog: ModelCatalogConfigSchema,
 		/** Delivery / presentation concerns (currently `tts`). */
 		messages: MessagesConfigSchema,
 		/** User-facing voice input behavior beyond provider selection. */
@@ -1168,9 +1174,14 @@ workDiscoveryOnboarding: z.boolean().default(true) }).strict().default({ workDis
 			slots: {}
 		},
 		modelsDev: { enabled: true },
+		modelCatalog: {
+			enabled: true,
+			refreshOnStartup: true,
+			intervalHours: 6
+		},
 		tui: {}
 	});
 }));
 //#endregion
 init_schema();
-export { AgentImageGenerationModelSchema, AgentModelRefSchema, AgentModelsSchema, AgentTypedModelRoleSchema, AgentsConfigSchema, BindingMatchSchema, BindingRuleSchema, BindingsConfigSchema, BrowserConfigSchema, ChannelsConfigSchema, CodeIntelligenceConfigSchema, CommandsConfigSchema, ConfigSchema, ConnectorsConfigSchema, ExperimentalConfigSchema, ExtensionSecurityConfigSchema, ExtensionSlotsConfigSchema, ExtensionsConfigSchema, GatewayAuthRateLimitSchema, GatewayAuthSchema, GatewayBindModeSchema, GatewayChannelConnectDeferModeSchema, GatewayConfigSchema, GatewayModeSchema, GatewayRemoteSchema, GatewaySecuritySchema, GatewayTailscaleConsentSchema, GatewayTailscaleSchema, GatewayTlsSchema, GatewayTrustedProxySchema, GoalNotificationEventSchema, GoalNotificationTargetSchema, GoalNotificationsConfigSchema, GoalsConfigSchema, HeartbeatConfigSchema, McpConfigSchema, McpServerSchema, MediaUnderstandingCapabilitiesSchema, MediaUnderstandingModelSchema, MessagesConfigSchema, ModelsDevConfigSchema, ProviderAuthConfigSchema, ProviderAzureConfigSchema, ProviderRequestOverridesSchema, ProvidersConfigSchema, STTConfigSchema, STTFallbackConfigSchema, STTProviderConfigSchema, SearchProviderEntrySchema, SessionConfigSchema, SessionDmScopeSchema, SessionResetByTypeSchema, SessionResetConfigSchema, SessionResetModeSchema, SessionScopeSchema, SessionStorageConfigSchema, TTSConfigSchema, TTSEdgeConfigSchema, TTSFallbackConfigSchema, TTSModelOverridesConfigSchema, TTSProviderConfigSchema, TTSSummarizationConfigSchema, TelegramAccountConfigSchema, TelegramConfigSchema, TelegramGroupConfigSchema, TelegramTopicConfigSchema, ToolsConfigSchema, ToolsMediaAudioConfigSchema, ToolsMediaConfigSchema, TuiConfigSchema, TunnelConfigSchema, TunnelConsentSchema, UpdateAutoConfigSchema, UpdateConfigSchema, VoiceConfigSchema, VoiceRefinementConfigSchema, WebSearchConfigSchema, WebToolsConfigSchema, WebsiteBlocklistSchema, WeixinAccountConfigSchema, WeixinConfigSchema, WorkspaceConfigSchema, WorkspaceImportConfigSchema, getAgentDefaultImageGenerationModelConfig, getAgentDefaultImageModelConfig, getAgentDefaultModelRef, init_schema, parseModelRef };
+export { AgentImageGenerationModelSchema, AgentModelRefSchema, AgentModelsSchema, AgentTypedModelRoleSchema, AgentsConfigSchema, BindingMatchSchema, BindingRuleSchema, BindingsConfigSchema, BrowserConfigSchema, ChannelsConfigSchema, CodeIntelligenceConfigSchema, CommandsConfigSchema, ConfigSchema, ConnectorsConfigSchema, ExperimentalConfigSchema, ExtensionSecurityConfigSchema, ExtensionSlotsConfigSchema, ExtensionsConfigSchema, GatewayAuthRateLimitSchema, GatewayAuthSchema, GatewayBindModeSchema, GatewayChannelConnectDeferModeSchema, GatewayConfigSchema, GatewayModeSchema, GatewayRemoteSchema, GatewaySecuritySchema, GatewayTailscaleConsentSchema, GatewayTailscaleSchema, GatewayTlsSchema, GatewayTrustedProxySchema, GoalNotificationEventSchema, GoalNotificationTargetSchema, GoalNotificationsConfigSchema, GoalsConfigSchema, HeartbeatConfigSchema, McpConfigSchema, McpServerSchema, MediaUnderstandingCapabilitiesSchema, MediaUnderstandingModelSchema, MessagesConfigSchema, ModelCatalogConfigSchema, ModelsDevConfigSchema, ProviderAuthConfigSchema, ProviderAzureConfigSchema, ProviderRequestOverridesSchema, ProvidersConfigSchema, STTConfigSchema, STTFallbackConfigSchema, STTProviderConfigSchema, SearchProviderEntrySchema, SessionConfigSchema, SessionDmScopeSchema, SessionResetByTypeSchema, SessionResetConfigSchema, SessionResetModeSchema, SessionScopeSchema, SessionStorageConfigSchema, TTSConfigSchema, TTSEdgeConfigSchema, TTSFallbackConfigSchema, TTSModelOverridesConfigSchema, TTSProviderConfigSchema, TTSSummarizationConfigSchema, TelegramAccountConfigSchema, TelegramConfigSchema, TelegramGroupConfigSchema, TelegramTopicConfigSchema, ToolsConfigSchema, ToolsMediaAudioConfigSchema, ToolsMediaConfigSchema, TuiConfigSchema, TunnelConfigSchema, TunnelConsentSchema, UpdateAutoConfigSchema, UpdateConfigSchema, VoiceConfigSchema, VoiceRefinementConfigSchema, WebSearchConfigSchema, WebToolsConfigSchema, WebsiteBlocklistSchema, WeixinAccountConfigSchema, WeixinConfigSchema, WorkspaceConfigSchema, WorkspaceImportConfigSchema, getAgentDefaultImageGenerationModelConfig, getAgentDefaultImageModelConfig, getAgentDefaultModelRef, init_schema, parseModelRef };

package/dist/src/gateway/hono/app.js

@@ -12,7 +12,7 @@ import { buildGatewayConsoleCspHeader } from "../security/csp.js";
 import { checkBrowserOrigin } from "../security/origin-check.js";
 import { auth } from "./middleware/auth.js";
 import { operatorScopes } from "./middleware/scopes.js";
-import { createChannelRateLimitMiddleware, createStrictRateLimitMiddleware } from "./middleware/strict-rate-limit.js";
+import { createChannelRateLimitMiddleware, createStrictRateLimitMiddleware, createXopcCloudPollRateLimitMiddleware } from "./middleware/strict-rate-limit.js";
 import { logContextMiddleware } from "./middleware/log-context.js";
 import { logger } from "./middleware/logger.js";
 import { routeErrorMiddleware } from "./middleware/route-errors.js";
@@ -204,16 +204,22 @@ function createHonoApp(config) {
 		})
 	}));
 	authenticated.use(operatorScopes());
+	const strictRateLimitMiddleware = createStrictRateLimitMiddleware({ getTrustedProxyContext: () => ({
+		trustedProxies: service.currentConfig.gateway?.trustedProxies,
+		allowRealIpFallback: service.currentConfig.gateway?.allowRealIpFallback === true
+	}) });
+	const channelRateLimitMiddleware = createChannelRateLimitMiddleware({ getTrustedProxyContext: () => ({
+		trustedProxies: service.currentConfig.gateway?.trustedProxies,
+		allowRealIpFallback: service.currentConfig.gateway?.allowRealIpFallback === true
+	}) });
 	registerAuthenticatedRoutes(app, authenticated, {
 		service,
-		strictRateLimitMiddleware: createStrictRateLimitMiddleware({ getTrustedProxyContext: () => ({
-			trustedProxies: service.currentConfig.gateway?.trustedProxies,
-			allowRealIpFallback: service.currentConfig.gateway?.allowRealIpFallback === true
-		}) }),
-		channelRateLimitMiddleware: createChannelRateLimitMiddleware({ getTrustedProxyContext: () => ({
+		strictRateLimitMiddleware,
+		xopcCloudPollRateLimitMiddleware: createXopcCloudPollRateLimitMiddleware({ getTrustedProxyContext: () => ({
 			trustedProxies: service.currentConfig.gateway?.trustedProxies,
 			allowRealIpFallback: service.currentConfig.gateway?.allowRealIpFallback === true
 		}) }),
+		channelRateLimitMiddleware,
 		sseConfig: {
 			service,
 			maxSseConnections: service.currentConfig.gateway.maxSseConnections

package/dist/src/gateway/hono/lib/safe-providers-config.d.ts

@@ -1,13 +1,10 @@
 import type { Config } from '../../../config/schema.js';
 /**
  * Per-vendor slice of {@link Config.providers} safe for GET `/api/config`.
- * Secrets are never sent verbatim; `apiKey` is length-preserving bullets when set, else empty.
  */
 export type SafeProviderAuthEntry = {
-    apiKey: string;
     region?: string;
     baseUrl?: string;
-    imageBaseUrl?: string;
 };
 /**
  * Build a redacted `providersConfig` map for the gateway console (image / audio / video keys).

package/dist/src/gateway/hono/lib/safe-providers-config.js

@@ -1,4 +1,3 @@
-import { maskSecretLength } from "./mask-secret-length.js";
 //#region src/gateway/hono/lib/safe-providers-config.ts
 /**
 * Build a redacted `providersConfig` map for the gateway console (image / audio / video keys).
@@ -10,10 +9,9 @@ function buildSafeProvidersConfigForWeb(providers) {
 		if (!id) continue;
 		if (!raw || typeof raw !== "object" || Array.isArray(raw)) continue;
 		const o = raw;
-		const entry = { apiKey: typeof o.apiKey === "string" && o.apiKey.trim() ? maskSecretLength(o.apiKey) : "" };
+		const entry = {};
 		if (typeof o.region === "string" && o.region.trim()) entry.region = o.region.trim();
 		if (typeof o.baseUrl === "string" && o.baseUrl.trim()) entry.baseUrl = o.baseUrl.trim();
-		if (typeof o.imageBaseUrl === "string" && o.imageBaseUrl.trim()) entry.imageBaseUrl = o.imageBaseUrl.trim();
 		out[id] = entry;
 	}
 	return out;

package/dist/src/gateway/hono/middleware/strict-rate-limit.d.ts

@@ -12,6 +12,10 @@ export declare function createStrictRateLimitMiddleware(deps: StrictRateLimitDep
     error: string;
     code: string;
 }, 429, "json">>;
+export declare function createXopcCloudPollRateLimitMiddleware(deps: StrictRateLimitDeps): import("hono").MiddlewareHandler<any, string, {}, Response & import("hono").TypedResponse<{
+    error: string;
+    code: string;
+}, 429, "json">>;
 export declare function createChannelRateLimitMiddleware(deps: StrictRateLimitDeps): import("hono").MiddlewareHandler<any, string, {}, Response & import("hono").TypedResponse<{
     error: string;
     code: string;

package/dist/src/gateway/hono/middleware/strict-rate-limit.js

@@ -63,6 +63,13 @@ function createStrictRateLimitMiddleware(deps) {
 		reason: "strict_rate_limit_exceeded"
 	});
 }
+function createXopcCloudPollRateLimitMiddleware(deps) {
+	return createClientRateLimitMiddleware(deps, {
+		limiter: () => buckets.xopcCloudPoll(),
+		exceededMessage: "XOPC Cloud polling rate limit exceeded",
+		reason: "xopc_cloud_poll_rate_limit_exceeded"
+	});
+}
 function createChannelRateLimitMiddleware(deps) {
 	return createClientRateLimitMiddleware(deps, {
 		limiter: () => buckets.channelApi(),
@@ -71,4 +78,4 @@ function createChannelRateLimitMiddleware(deps) {
 	});
 }
 //#endregion
-export { createChannelRateLimitMiddleware, createStrictRateLimitMiddleware };
+export { createChannelRateLimitMiddleware, createStrictRateLimitMiddleware, createXopcCloudPollRateLimitMiddleware };

package/dist/src/gateway/hono/routes/config-patch/misc.js

@@ -72,17 +72,8 @@ async function applyMiscPatch(config, body) {
 			if (!raw || typeof raw !== "object" || Array.isArray(raw)) continue;
 			const next = cfgProviders[vendorId] ?? {};
 			const patch = raw;
-			for (const field of [
-				"apiKey",
-				"baseUrl",
-				"region",
-				"imageBaseUrl"
-			]) if (patch[field] === null || patch[field] === "") delete next[field];
-			else if (typeof patch[field] === "string") {
-				const trimmed = patch[field].trim();
-				if (field === "apiKey" && isMaskedSecretPatchValue(trimmed)) continue;
-				next[field] = trimmed;
-			}
+			for (const field of ["baseUrl", "region"]) if (patch[field] === null || patch[field] === "") delete next[field];
+			else if (typeof patch[field] === "string") next[field] = patch[field].trim();
 			if (patch.azure === null) delete next.azure;
 			else if (patch.azure && typeof patch.azure === "object" && !Array.isArray(patch.azure)) next.azure = {
 				...next.azure ?? {},

package/dist/src/gateway/hono/routes/deps.d.ts

@@ -4,6 +4,7 @@ import type { SSEHandlerConfig } from '../sse.js';
 export interface AuthenticatedRouteDeps {
     service: GatewayService;
     strictRateLimitMiddleware: MiddlewareHandler;
+    xopcCloudPollRateLimitMiddleware: MiddlewareHandler;
     channelRateLimitMiddleware?: MiddlewareHandler;
     sseConfig: SSEHandlerConfig;
 }

package/dist/src/gateway/hono/routes/lazy-bundles.js

@@ -92,6 +92,14 @@ const AUTHENTICATED_LAZY_ROUTE_BUNDLES = [
 			return { register: registerDreamingRoutes };
 		}
 	},
+	{
+		id: "image-generation",
+		match: (path) => startsWithAny(path, ["/api/image-generation"]) || /^\/api\/agents\/[^/]+\/image-generation(?:\/setup)?$/.test(path),
+		load: async () => {
+			const { registerModelsRoutes } = await import("./models.js");
+			return { register: registerModelsRoutes };
+		}
+	},
 	{
 		id: "agents",
 		match: (path) => startsWithAny(path, [
@@ -135,8 +143,7 @@ const AUTHENTICATED_LAZY_ROUTE_BUNDLES = [
 		match: (path) => startsWithAny(path, [
 			"/api/models",
 			"/api/models-json",
-			"/api/providers",
-			"/api/image"
+			"/api/providers"
 		]),
 		load: async () => {
 			const { registerModelsRoutes } = await import("./models.js");