@xopcai/xopc 0.0.162 → 0.0.164

package/dist/src/auth/oauth/openai-codex.js

@@ -1,4 +1,5 @@
-import { generatePKCE } from "./pkce.js";
+import { __esmMin } from "../../../_virtual/_rolldown/runtime.js";
+import { generatePKCE, init_pkce } from "./pkce.js";
 import { randomBytes } from "node:crypto";
 import http from "node:http";
 //#region src/auth/oauth/openai-codex.ts
@@ -7,15 +8,6 @@ import http from "node:http";
 *
 * Owns callback validation, manual prompt handling, and success/error pages.
 */
-const CLIENT_ID = "app_EMoamEEZ73f0CkXaXp7hrann";
-const AUTHORIZE_URL = "https://auth.openai.com/oauth/authorize";
-const TOKEN_URL = "https://auth.openai.com/oauth/token";
-const CALLBACK_PORT = 1455;
-const CALLBACK_PATH = "/auth/callback";
-const REDIRECT_URI = `http://localhost:${CALLBACK_PORT}${CALLBACK_PATH}`;
-const SCOPE = "openid profile email offline_access";
-const MANUAL_PROMPT_DELAY_MS = 15e3;
-const TOKEN_REQUEST_TIMEOUT_MS = 3e4;
 function xopcOAuthHtml(params) {
 	const color = params.tone === "success" ? "#2563eb" : "#dc2626";
 	const escapedTitle = escapeHtml(params.title);
@@ -299,19 +291,33 @@ async function loginOpenAICodex(callbacks) {
 async function refreshOpenAICodexToken(refreshToken) {
 	return refreshAccessToken(refreshToken);
 }
-const openaiCodexOAuthProvider = {
-	id: "openai-codex",
-	name: "OpenAI Codex",
-	usesCallbackServer: true,
-	async login(callbacks) {
-		return loginOpenAICodex(callbacks);
-	},
-	async refreshToken(credentials) {
-		return refreshOpenAICodexToken(credentials.refresh);
-	},
-	getApiKey(credentials) {
-		return credentials.access;
-	}
-};
+var CLIENT_ID, AUTHORIZE_URL, TOKEN_URL, CALLBACK_PORT, CALLBACK_PATH, REDIRECT_URI, SCOPE, MANUAL_PROMPT_DELAY_MS, TOKEN_REQUEST_TIMEOUT_MS, openaiCodexOAuthProvider;
+var init_openai_codex = __esmMin((() => {
+	init_pkce();
+	CLIENT_ID = "app_EMoamEEZ73f0CkXaXp7hrann";
+	AUTHORIZE_URL = "https://auth.openai.com/oauth/authorize";
+	TOKEN_URL = "https://auth.openai.com/oauth/token";
+	CALLBACK_PORT = 1455;
+	CALLBACK_PATH = "/auth/callback";
+	REDIRECT_URI = `http://localhost:${CALLBACK_PORT}${CALLBACK_PATH}`;
+	SCOPE = "openid profile email offline_access";
+	MANUAL_PROMPT_DELAY_MS = 15e3;
+	TOKEN_REQUEST_TIMEOUT_MS = 3e4;
+	openaiCodexOAuthProvider = {
+		id: "openai-codex",
+		name: "OpenAI Codex",
+		usesCallbackServer: true,
+		async login(callbacks) {
+			return loginOpenAICodex(callbacks);
+		},
+		async refreshToken(credentials) {
+			return refreshOpenAICodexToken(credentials.refresh);
+		},
+		getApiKey(credentials) {
+			return credentials.access;
+		}
+	};
+}));
 //#endregion
-export { loginOpenAICodex, openaiCodexOAuthProvider, refreshOpenAICodexToken };
+init_openai_codex();
+export { init_openai_codex, loginOpenAICodex, openaiCodexOAuthProvider, refreshOpenAICodexToken };

package/dist/src/auth/oauth/pkce.js

@@ -1,3 +1,4 @@
+import { __esmMin } from "../../../_virtual/_rolldown/runtime.js";
 //#region src/auth/oauth/pkce.ts
 /**
 * PKCE utilities using Web Crypto API.
@@ -19,5 +20,7 @@ async function generatePKCE() {
 		challenge: base64urlEncode(new Uint8Array(hashBuffer))
 	};
 }
+var init_pkce = __esmMin((() => {}));
 //#endregion
-export { generatePKCE };
+init_pkce();
+export { generatePKCE, init_pkce };

package/dist/src/auth/oauth/registry.d.ts

@@ -0,0 +1,13 @@
+import type { OAuthProviderInterface } from './types.js';
+export interface OAuthProviderDefinition {
+    displayName: string;
+    oauthOnly?: boolean;
+    provider: OAuthProviderInterface;
+    profileId: string;
+    urlPrompt: string;
+}
+export declare const OAUTH_PROVIDER_DEFINITIONS: Readonly<Record<string, OAuthProviderDefinition>>;
+export declare function getOAuthProviderDefinition(provider: string): OAuthProviderDefinition | undefined;
+export declare function getOAuthProviderInterfaces(): Record<string, OAuthProviderInterface>;
+export declare function getOAuthProviderIds(): string[];
+export declare function isOAuthOnlyProvider(provider: string): boolean;

package/dist/src/auth/oauth/registry.js

@@ -0,0 +1,65 @@
+import { __esmMin } from "../../../_virtual/_rolldown/runtime.js";
+import { anthropicOAuthProvider, init_anthropic } from "./anthropic.js";
+import { githubCopilotOAuthProvider, init_github_copilot } from "./github-copilot.js";
+import { antigravityOAuthProvider } from "./google-oauth/google-antigravity.js";
+import { init_google_antigravity } from "./google-antigravity.js";
+import { geminiCliOAuthProvider } from "./google-oauth/google-gemini-cli.js";
+import { init_google_gemini_cli } from "./google-gemini-cli.js";
+import { init_kimi_coding, kimiCodingOAuthProvider } from "./kimi-coding.js";
+import { init_minimax_cn, minimaxCnOAuthProvider } from "./minimax-cn.js";
+import { init_minimax, minimaxOAuthProvider } from "./minimax.js";
+import { init_openai_codex, openaiCodexOAuthProvider } from "./openai-codex.js";
+import { init_xopc_cloud, xopcCloudOAuthProvider } from "./xopc-cloud.js";
+//#region src/auth/oauth/registry.ts
+function definition(provider, displayName = provider.name) {
+	return {
+		displayName,
+		provider,
+		profileId: `${provider.id}:default`,
+		urlPrompt: "🌐 Please open this URL in your browser:\n"
+	};
+}
+function getOAuthProviderDefinition(provider) {
+	return OAUTH_PROVIDER_DEFINITIONS[provider];
+}
+function getOAuthProviderInterfaces() {
+	return Object.fromEntries(Object.entries(OAUTH_PROVIDER_DEFINITIONS).map(([id, value]) => [id, value.provider]));
+}
+function getOAuthProviderIds() {
+	return Object.keys(OAUTH_PROVIDER_DEFINITIONS);
+}
+function isOAuthOnlyProvider(provider) {
+	return OAUTH_PROVIDER_DEFINITIONS[provider]?.oauthOnly === true;
+}
+var OAUTH_PROVIDER_DEFINITIONS;
+var init_registry = __esmMin((() => {
+	init_anthropic();
+	init_github_copilot();
+	init_google_antigravity();
+	init_google_gemini_cli();
+	init_kimi_coding();
+	init_minimax_cn();
+	init_minimax();
+	init_openai_codex();
+	init_xopc_cloud();
+	OAUTH_PROVIDER_DEFINITIONS = {
+		"xopc-cloud": {
+			...definition(xopcCloudOAuthProvider),
+			oauthOnly: true
+		},
+		anthropic: definition(anthropicOAuthProvider, "Anthropic (Claude)"),
+		minimax: definition(minimaxOAuthProvider, "MiniMax (幂维智能)"),
+		"minimax-cn": {
+			...definition(minimaxCnOAuthProvider, "MiniMax CN"),
+			urlPrompt: "🌐 请在浏览器中打开以下 URL:\n"
+		},
+		"kimi-coding": definition(kimiCodingOAuthProvider, "Kimi For Coding (月之暗面)"),
+		"github-copilot": definition(githubCopilotOAuthProvider),
+		"google-gemini-cli": definition(geminiCliOAuthProvider),
+		"google-antigravity": definition(antigravityOAuthProvider),
+		"openai-codex": definition(openaiCodexOAuthProvider)
+	};
+}));
+//#endregion
+init_registry();
+export { OAUTH_PROVIDER_DEFINITIONS, getOAuthProviderDefinition, getOAuthProviderIds, getOAuthProviderInterfaces, init_registry, isOAuthOnlyProvider };

package/dist/src/auth/oauth/xopc-cloud.d.ts

@@ -0,0 +1,2 @@
+import type { OAuthProviderInterface } from './types.js';
+export declare const xopcCloudOAuthProvider: OAuthProviderInterface;

package/dist/src/auth/oauth/xopc-cloud.js

@@ -0,0 +1,101 @@
+import { __esmMin } from "../../../_virtual/_rolldown/runtime.js";
+import { hostname } from "node:os";
+import { setTimeout } from "node:timers/promises";
+//#region src/auth/oauth/xopc-cloud.ts
+function consoleUrl() {
+	return (process.env.XOPC_CONSOLE_URL ?? DEFAULT_CONSOLE_URL).replace(/\/+$/, "");
+}
+async function readJson(response) {
+	const body = await response.json().catch(() => null);
+	return body && typeof body === "object" ? body : {};
+}
+function credentials(body) {
+	if (typeof body.access_token !== "string" || body.access_token.length === 0 || typeof body.refresh_token !== "string" || body.refresh_token.length === 0 || typeof body.expires_in !== "number" || !Number.isFinite(body.expires_in) || body.expires_in <= 0) throw new Error("XOPC OAuth token response is incomplete");
+	return {
+		access: body.access_token,
+		refresh: body.refresh_token,
+		expires: Date.now() + body.expires_in * 1e3,
+		scope: typeof body.scope === "string" ? body.scope.split(" ").filter(Boolean) : []
+	};
+}
+async function tokenRequest(body, signal) {
+	return fetch(`${consoleUrl()}/oauth/token`, {
+		method: "POST",
+		headers: {
+			"content-type": "application/x-www-form-urlencoded",
+			accept: "application/json"
+		},
+		body,
+		signal: signal ?? AbortSignal.timeout(3e4)
+	});
+}
+async function login(callbacks) {
+	const response = await fetch(`${consoleUrl()}/oauth/device_authorization`, {
+		method: "POST",
+		headers: {
+			"content-type": "application/x-www-form-urlencoded",
+			accept: "application/json"
+		},
+		body: new URLSearchParams({
+			client_id: CLIENT_ID,
+			scope: DEFAULT_SCOPE,
+			device_name: hostname() || "XOPC client",
+			client_type: "cli"
+		}),
+		signal: callbacks.signal ?? AbortSignal.timeout(3e4)
+	});
+	const body = await readJson(response);
+	if (!response.ok) throw new Error(body.error_description ?? body.error ?? "XOPC OAuth authorization failed");
+	const deviceCode = typeof body.device_code === "string" ? body.device_code : "";
+	const userCode = typeof body.user_code === "string" ? body.user_code : "";
+	const verificationUri = typeof body.verification_uri_complete === "string" ? body.verification_uri_complete : typeof body.verification_uri === "string" ? body.verification_uri : "";
+	if (!deviceCode || !userCode || !verificationUri) throw new Error("XOPC OAuth response is incomplete");
+	const intervalMs = Math.max(1, Number(body.interval) || 5) * 1e3;
+	const expiresAt = Date.now() + Math.max(1, Number(body.expires_in) || 600) * 1e3;
+	callbacks.onDeviceCode({
+		userCode,
+		verificationUri,
+		intervalSeconds: intervalMs / 1e3,
+		expiresInSeconds: Math.floor((expiresAt - Date.now()) / 1e3)
+	});
+	while (Date.now() < expiresAt) {
+		if (callbacks.signal?.aborted) throw callbacks.signal.reason ?? /* @__PURE__ */ new Error("OAuth login cancelled");
+		await setTimeout(intervalMs, void 0, callbacks.signal ? { signal: callbacks.signal } : void 0);
+		const token = await tokenRequest(new URLSearchParams({
+			grant_type: "urn:ietf:params:oauth:grant-type:device_code",
+			client_id: CLIENT_ID,
+			device_code: deviceCode
+		}), callbacks.signal);
+		const tokenBody = await readJson(token);
+		if (token.ok) return credentials(tokenBody);
+		if (tokenBody.error === "authorization_pending" || tokenBody.error === "slow_down") continue;
+		throw new Error(tokenBody.error_description ?? tokenBody.error ?? "XOPC OAuth token exchange failed");
+	}
+	throw new Error("XOPC OAuth authorization expired");
+}
+async function refreshToken(current) {
+	const response = await tokenRequest(new URLSearchParams({
+		grant_type: "refresh_token",
+		client_id: CLIENT_ID,
+		refresh_token: current.refresh
+	}));
+	const body = await readJson(response);
+	if (!response.ok) throw new Error(body.error_description ?? body.error ?? "XOPC OAuth refresh failed");
+	return credentials(body);
+}
+var CLIENT_ID, DEFAULT_CONSOLE_URL, DEFAULT_SCOPE, xopcCloudOAuthProvider;
+var init_xopc_cloud = __esmMin((() => {
+	CLIENT_ID = "xopc-native";
+	DEFAULT_CONSOLE_URL = "https://console.xopc.ai";
+	DEFAULT_SCOPE = "models:read models:invoke account:usage offline_access";
+	xopcCloudOAuthProvider = {
+		id: "xopc-cloud",
+		name: "XOPC Model Service",
+		login,
+		refreshToken,
+		getApiKey: (value) => value.access
+	};
+}));
+//#endregion
+init_xopc_cloud();
+export { init_xopc_cloud, xopcCloudOAuthProvider };

package/dist/src/auth/sync-provider-auth.d.ts

@@ -2,12 +2,15 @@
  * Synchronous checks that mirror CredentialResolver.resolveApiKey sources
  * used by isProviderConfiguredSync (fallback candidate filtering).
  */
+import type { Config } from '../config/schema.js';
 /**
  * Synchronous API key / OAuth access for {@link Agent} `getApiKey` (pi-agent requires sync).
  * Order: default agent auth-profiles → global auth-profiles → OAuth token file.
  * Does not read standard env vars or models.json registry — callers chain `getApiKeySync` after this.
  */
 export declare function resolveProviderApiKeySync(provider: string): string | undefined;
+/** Resolve one agent's private credential, then the shared credential and OAuth token. */
+export declare function resolveProviderApiKeyForAgentSync(provider: string, agentId?: string, config?: Config): string | undefined;
 /**
  * True if credentials exist in auth profiles (global or agent) or OAuth store,
  * matching async CredentialResolver resolution (excluding env — callers check env separately).

package/dist/src/auth/sync-provider-auth.js

@@ -2,6 +2,7 @@ import { __esmMin } from "../../_virtual/_rolldown/runtime.js";
 import { getDefaultAgentId, init_resolve_route } from "../routing/resolve-route.js";
 import { init_paths, resolveAgentAuthProfilesPath, resolveAuthProfilesPath, resolveOAuthPath } from "../config/paths.js";
 import { init_loader, loadConfig } from "../config/loader.js";
+import { init_registry, isOAuthOnlyProvider } from "./oauth/registry.js";
 import { existsSync, readFileSync } from "node:fs";
 //#region src/auth/sync-provider-auth.ts
 /**
@@ -81,6 +82,7 @@ function readOAuthAccessTokenSync(provider) {
 */
 function resolveProviderApiKeySync(provider) {
 	const normalized = provider.toLowerCase();
+	if (isOAuthOnlyProvider(normalized)) return readOAuthAccessTokenSync(normalized);
 	const cfg = loadConfig();
 	const fromAgent = readApiKeyFromProfilesFile(resolveAgentAuthProfilesPath(cfg, getDefaultAgentId(cfg)), normalized);
 	if (fromAgent) return fromAgent;
@@ -88,11 +90,24 @@ function resolveProviderApiKeySync(provider) {
 	if (fromGlobal) return fromGlobal;
 	return readOAuthAccessTokenSync(normalized);
 }
+/** Resolve one agent's private credential, then the shared credential and OAuth token. */
+function resolveProviderApiKeyForAgentSync(provider, agentId, config) {
+	const normalized = provider.toLowerCase();
+	if (isOAuthOnlyProvider(normalized)) return readOAuthAccessTokenSync(normalized);
+	if (agentId?.trim()) {
+		const fromAgent = readApiKeyFromProfilesFile(resolveAgentAuthProfilesPath(config ?? loadConfig(), agentId.trim()), normalized);
+		if (fromAgent) return fromAgent;
+	}
+	const fromGlobal = readApiKeyFromProfilesFile(resolveAuthProfilesPath(), normalized);
+	if (fromGlobal) return fromGlobal;
+	return readOAuthAccessTokenSync(normalized);
+}
 /**
 * True if credentials exist in auth profiles (global or agent) or OAuth store,
 * matching async CredentialResolver resolution (excluding env — callers check env separately).
 */
 function hasProviderAuthOnDiskSync(provider) {
+	if (isOAuthOnlyProvider(provider.toLowerCase())) return hasOAuthTokenSync(provider);
 	const cfg = loadConfig();
 	if (hasApiKeyInProfilesFile(resolveAgentAuthProfilesPath(cfg, getDefaultAgentId(cfg)), provider)) return true;
 	if (hasApiKeyInProfilesFile(resolveAuthProfilesPath(), provider)) return true;
@@ -103,7 +118,8 @@ var init_sync_provider_auth = __esmMin((() => {
 	init_paths();
 	init_loader();
 	init_resolve_route();
+	init_registry();
 }));
 //#endregion
 init_sync_provider_auth();
-export { hasProviderAuthOnDiskSync, init_sync_provider_auth, resolveProviderApiKeySync };
+export { hasProviderAuthOnDiskSync, init_sync_provider_auth, resolveProviderApiKeyForAgentSync, resolveProviderApiKeySync };

package/dist/src/cli/commands/models.js

@@ -15,14 +15,11 @@ init_credentials();
 init_schema();
 init_providers();
 const IMAGE_GENERATION_IDS = new Set([
-	"gpt-image-1",
-	"dall-e-3",
-	"dall-e-2",
+	"gpt-image-2",
+	"gpt-image-1.5",
 	"wan2.6-t2i",
 	"wan2.7-image-pro",
 	"wan2.7-image",
-	"wan2.1-t2i-turbo",
-	"wan2.1-t2i-plus",
 	"image-01",
 	"image-01-live"
 ]);

package/dist/src/cli/commands/onboard/model.js

@@ -301,7 +301,7 @@ function resolvePresetEnvCredential(preset) {
 	}
 }
 async function setupDomesticPreset(config, ctx, preset) {
-	console.log(`\n🇨🇳 ${preset.displayName}\n`);
+	console.log(`\n${preset.onboardingIcon ?? "🇨🇳"} ${preset.displayName}\n`);
 	console.log(preset.description);
 	if (preset.quirks?.length) for (const quirk of preset.quirks) console.log(colors.gray(`Note: ${quirk}`));
 	const baseUrlChoice = await select({
@@ -336,13 +336,14 @@ async function setupDomesticPreset(config, ctx, preset) {
 		headers: preset.headers
 	});
 	const modelChoices = discoveredChoices.length > 0 ? discoveredChoices : getModelsForProvider(preset.id);
+	if (preset.requiresModelDiscovery && modelChoices.length === 0) throw new Error(`No models are available from ${preset.displayName}. Ask an administrator to publish a model, then retry.`);
 	const modelRef = await select({
 		message: "Model:",
 		choices: modelChoices.map((choice) => ({
 			...choice,
 			name: modelChoiceName(choice)
 		})),
-		default: `${preset.id}/${preset.defaultModel}`
+		default: preset.defaultModel ? `${preset.id}/${preset.defaultModel}` : modelChoices[0]?.value
 	});
 	const modelId = modelRef.split("/").slice(1).join("/");
 	if (await confirm({

package/dist/src/cli/commands/setup-shared/types.d.ts

@@ -7,7 +7,7 @@
  */
 export type SetupAction = 'add' | 'set' | 'remove' | 'noop';
 export interface SetupError {
-    /** Dot path of the offending field, when known (e.g. `providers.openai.apiKey`). */
+    /** Dot path of the offending field, when known (e.g. `providers.openai.baseUrl`). */
     path?: string;
     message: string;
 }

package/dist/src/cli/utils/oauth-providers.d.ts

@@ -1,29 +1,6 @@
-/**
- * OAuth Provider Configuration
- *
- * Centralized OAuth provider definitions for CLI commands.
- * Used by both auth.ts and onboard.ts to avoid duplication.
- */
-import type { OAuthProviderInterface } from '../../auth/oauth/types.js';
-export interface OAuthProviderConfig {
-    displayName: string;
-    provider: OAuthProviderInterface;
-    profileId: string;
-    urlPrompt: string;
-}
-/**
- * Map of provider IDs to their OAuth configuration.
- */
-export declare const OAUTH_PROVIDERS: Record<string, OAuthProviderConfig>;
-/**
- * Get supported OAuth provider IDs.
- */
+import { type OAuthProviderDefinition } from '../../auth/oauth/registry.js';
+export type OAuthProviderConfig = OAuthProviderDefinition;
+export declare const OAUTH_PROVIDERS: Readonly<Record<string, OAuthProviderDefinition>>;
 export declare function getSupportedOAuthProviders(): string[];
-/**
- * Check if a provider supports OAuth.
- */
 export declare function supportsOAuth(provider: string): boolean;
-/**
- * Get OAuth provider config by ID.
- */
 export declare function getOAuthProvider(provider: string): OAuthProviderConfig | undefined;

package/dist/src/cli/utils/oauth-providers.js

@@ -1,89 +1,15 @@
-import { anthropicOAuthProvider } from "../../auth/oauth/anthropic.js";
-import { minimaxOAuthProvider } from "../../auth/oauth/minimax.js";
-import { minimaxCnOAuthProvider } from "../../auth/oauth/minimax-cn.js";
-import { kimiCodingOAuthProvider } from "../../auth/oauth/kimi-coding.js";
-import { githubCopilotOAuthProvider } from "../../auth/oauth/github-copilot.js";
-import { geminiCliOAuthProvider } from "../../auth/oauth/google-oauth/google-gemini-cli.js";
-import { antigravityOAuthProvider } from "../../auth/oauth/google-oauth/google-antigravity.js";
-import { openaiCodexOAuthProvider } from "../../auth/oauth/openai-codex.js";
-import "../../auth/oauth/index.js";
+import { OAUTH_PROVIDER_DEFINITIONS, getOAuthProviderDefinition, init_registry } from "../../auth/oauth/registry.js";
 //#region src/cli/utils/oauth-providers.ts
-/**
-* OAuth Provider Configuration
-*
-* Centralized OAuth provider definitions for CLI commands.
-* Used by both auth.ts and onboard.ts to avoid duplication.
-*/
-/**
-* Map of provider IDs to their OAuth configuration.
-*/
-const OAUTH_PROVIDERS = {
-	anthropic: {
-		displayName: "Anthropic (Claude)",
-		provider: anthropicOAuthProvider,
-		profileId: "anthropic:default",
-		urlPrompt: "🌐 Please open this URL in your browser:\n"
-	},
-	minimax: {
-		displayName: "MiniMax (幂维智能)",
-		provider: minimaxOAuthProvider,
-		profileId: "minimax:default",
-		urlPrompt: "🌐 Please open this URL in your browser:\n"
-	},
-	"minimax-cn": {
-		displayName: "MiniMax CN",
-		provider: minimaxCnOAuthProvider,
-		profileId: "minimax-cn:default",
-		urlPrompt: "🌐 请在浏览器中打开以下 URL:\n"
-	},
-	"kimi-coding": {
-		displayName: "Kimi For Coding (月之暗面)",
-		provider: kimiCodingOAuthProvider,
-		profileId: "kimi-coding:default",
-		urlPrompt: "🌐 Please open this URL in your browser:\n"
-	},
-	"github-copilot": {
-		displayName: "GitHub Copilot",
-		provider: githubCopilotOAuthProvider,
-		profileId: "github-copilot:default",
-		urlPrompt: "🌐 Please open this URL in your browser:\n"
-	},
-	"google-gemini-cli": {
-		displayName: "Google Gemini CLI",
-		provider: geminiCliOAuthProvider,
-		profileId: "google-gemini-cli:default",
-		urlPrompt: "🌐 Please open this URL in your browser:\n"
-	},
-	"google-antigravity": {
-		displayName: "Google Antigravity",
-		provider: antigravityOAuthProvider,
-		profileId: "google-antigravity:default",
-		urlPrompt: "🌐 Please open this URL in your browser:\n"
-	},
-	"openai-codex": {
-		displayName: "OpenAI Codex",
-		provider: openaiCodexOAuthProvider,
-		profileId: "openai-codex:default",
-		urlPrompt: "🌐 Please open this URL in your browser:\n"
-	}
-};
-/**
-* Get supported OAuth provider IDs.
-*/
+init_registry();
+const OAUTH_PROVIDERS = OAUTH_PROVIDER_DEFINITIONS;
 function getSupportedOAuthProviders() {
-	return Object.keys(OAUTH_PROVIDERS);
+	return Object.keys(OAUTH_PROVIDER_DEFINITIONS);
 }
-/**
-* Check if a provider supports OAuth.
-*/
 function supportsOAuth(provider) {
-	return provider in OAUTH_PROVIDERS;
+	return Boolean(getOAuthProviderDefinition(provider));
 }
-/**
-* Get OAuth provider config by ID.
-*/
 function getOAuthProvider(provider) {
-	return OAUTH_PROVIDERS[provider];
+	return getOAuthProviderDefinition(provider);
 }
 //#endregion
 export { OAUTH_PROVIDERS, getOAuthProvider, getSupportedOAuthProviders, supportsOAuth };

package/dist/src/config/index.js

@@ -1,7 +1,7 @@
 import { ENV_VARS, XOPC_DB_FILENAME, resolveHomeDir, resolveStateDir, resolveXopcDatabasePath } from "./paths-state.js";
 import { TelegramAccountConfigSchema, TelegramConfigSchema, TelegramGroupConfigSchema, TelegramTopicConfigSchema } from "../../extensions/telegram/src/config-schema.js";
 import { WeixinAccountConfigSchema, WeixinConfigSchema } from "../../extensions/weixin/src/config-schema.js";
-import { AgentImageGenerationModelSchema, AgentModelRefSchema, AgentModelsSchema, AgentTypedModelRoleSchema, AgentsConfigSchema, BindingMatchSchema, BindingRuleSchema, BindingsConfigSchema, BrowserConfigSchema, ChannelsConfigSchema, CodeIntelligenceConfigSchema, CommandsConfigSchema, ConfigSchema, ConnectorsConfigSchema, ExperimentalConfigSchema, ExtensionSecurityConfigSchema, ExtensionSlotsConfigSchema, ExtensionsConfigSchema, GatewayAuthRateLimitSchema, GatewayAuthSchema, GatewayBindModeSchema, GatewayChannelConnectDeferModeSchema, GatewayConfigSchema, GatewayModeSchema, GatewayRemoteSchema, GatewaySecuritySchema, GatewayTailscaleConsentSchema, GatewayTailscaleSchema, GatewayTlsSchema, GatewayTrustedProxySchema, GoalNotificationEventSchema, GoalNotificationTargetSchema, GoalNotificationsConfigSchema, GoalsConfigSchema, HeartbeatConfigSchema, McpConfigSchema, McpServerSchema, MediaUnderstandingCapabilitiesSchema, MediaUnderstandingModelSchema, MessagesConfigSchema, ModelsDevConfigSchema, ProviderAuthConfigSchema, ProviderAzureConfigSchema, ProviderRequestOverridesSchema, ProvidersConfigSchema, STTConfigSchema, STTFallbackConfigSchema, STTProviderConfigSchema, SearchProviderEntrySchema, SessionConfigSchema, SessionDmScopeSchema, SessionResetByTypeSchema, SessionResetConfigSchema, SessionResetModeSchema, SessionScopeSchema, SessionStorageConfigSchema, TTSConfigSchema, TTSEdgeConfigSchema, TTSFallbackConfigSchema, TTSModelOverridesConfigSchema, TTSProviderConfigSchema, TTSSummarizationConfigSchema, ToolsConfigSchema, ToolsMediaAudioConfigSchema, ToolsMediaConfigSchema, TuiConfigSchema, TunnelConfigSchema, TunnelConsentSchema, UpdateAutoConfigSchema, UpdateConfigSchema, VoiceConfigSchema, VoiceRefinementConfigSchema, WebSearchConfigSchema, WebToolsConfigSchema, WebsiteBlocklistSchema, WorkspaceConfigSchema, WorkspaceImportConfigSchema, getAgentDefaultImageGenerationModelConfig, getAgentDefaultImageModelConfig, getAgentDefaultModelRef, init_schema, parseModelRef } from "./schema.js";
+import { AgentImageGenerationModelSchema, AgentModelRefSchema, AgentModelsSchema, AgentTypedModelRoleSchema, AgentsConfigSchema, BindingMatchSchema, BindingRuleSchema, BindingsConfigSchema, BrowserConfigSchema, ChannelsConfigSchema, CodeIntelligenceConfigSchema, CommandsConfigSchema, ConfigSchema, ConnectorsConfigSchema, ExperimentalConfigSchema, ExtensionSecurityConfigSchema, ExtensionSlotsConfigSchema, ExtensionsConfigSchema, GatewayAuthRateLimitSchema, GatewayAuthSchema, GatewayBindModeSchema, GatewayChannelConnectDeferModeSchema, GatewayConfigSchema, GatewayModeSchema, GatewayRemoteSchema, GatewaySecuritySchema, GatewayTailscaleConsentSchema, GatewayTailscaleSchema, GatewayTlsSchema, GatewayTrustedProxySchema, GoalNotificationEventSchema, GoalNotificationTargetSchema, GoalNotificationsConfigSchema, GoalsConfigSchema, HeartbeatConfigSchema, McpConfigSchema, McpServerSchema, MediaUnderstandingCapabilitiesSchema, MediaUnderstandingModelSchema, MessagesConfigSchema, ModelCatalogConfigSchema, ModelsDevConfigSchema, ProviderAuthConfigSchema, ProviderAzureConfigSchema, ProviderRequestOverridesSchema, ProvidersConfigSchema, STTConfigSchema, STTFallbackConfigSchema, STTProviderConfigSchema, SearchProviderEntrySchema, SessionConfigSchema, SessionDmScopeSchema, SessionResetByTypeSchema, SessionResetConfigSchema, SessionResetModeSchema, SessionScopeSchema, SessionStorageConfigSchema, TTSConfigSchema, TTSEdgeConfigSchema, TTSFallbackConfigSchema, TTSModelOverridesConfigSchema, TTSProviderConfigSchema, TTSSummarizationConfigSchema, ToolsConfigSchema, ToolsMediaAudioConfigSchema, ToolsMediaConfigSchema, TuiConfigSchema, TunnelConfigSchema, TunnelConsentSchema, UpdateAutoConfigSchema, UpdateConfigSchema, VoiceConfigSchema, VoiceRefinementConfigSchema, WebSearchConfigSchema, WebToolsConfigSchema, WebsiteBlocklistSchema, WorkspaceConfigSchema, WorkspaceImportConfigSchema, getAgentDefaultImageGenerationModelConfig, getAgentDefaultImageModelConfig, getAgentDefaultModelRef, init_schema, parseModelRef } from "./schema.js";
 import { applyConfigOverrides, getConfigOverrides, resetConfigOverrides, setConfigOverride, unsetConfigOverride } from "./runtime-overrides.js";
 import { expandWorkspacePathString, init_workspace_path, normalizeWorkspaceDir, resolveWorkspaceRoot } from "./workspace-path.js";
 import { resolveDefaultAgentWorkspaceDir } from "./workspace-defaults.js";
@@ -27,4 +27,4 @@ init_workspace_path();
 init_models_json();
 init_resolve_config_value();
 //#endregion
-export { AgentImageGenerationModelSchema, AgentModelRefSchema, AgentModelsSchema, AgentTypedModelRoleSchema, AgentsConfigSchema, BASE_RELOAD_RULES, BindingMatchSchema, BindingRuleSchema, BindingsConfigSchema, BrowserConfigSchema, ChannelsConfigSchema, CodeIntelligenceConfigSchema, CommandsConfigSchema, ConfigHotReloader, ConfigSchema, ConnectorsConfigSchema, CustomModelSchema, ENV_VARS, ExperimentalConfigSchema, ExtensionSecurityConfigSchema, ExtensionSlotsConfigSchema, ExtensionsConfigSchema, FILENAMES, GatewayAuthRateLimitSchema, GatewayAuthSchema, GatewayBindModeSchema, GatewayChannelConnectDeferModeSchema, GatewayConfigSchema, GatewayModeSchema, GatewayRemoteSchema, GatewaySecuritySchema, GatewayTailscaleConsentSchema, GatewayTailscaleSchema, GatewayTlsSchema, GatewayTrustedProxySchema, GoalNotificationEventSchema, GoalNotificationTargetSchema, GoalNotificationsConfigSchema, GoalsConfigSchema, HeartbeatConfigSchema, McpConfigSchema, McpServerSchema, MediaUnderstandingCapabilitiesSchema, MediaUnderstandingModelSchema, MessagesConfigSchema, ModelOverrideSchema, ModelsDevConfigSchema, ModelsJsonSchema, OpenAICompatSchema, OpenAICompletionsCompatSchema, OpenAIResponsesCompatSchema, OpenRouterRoutingSchema, ProfileManager, ProviderAuthConfigSchema, ProviderAzureConfigSchema, ProviderConfigSchema, ProviderRequestOverridesSchema, ProvidersConfigSchema, STTConfigSchema, STTFallbackConfigSchema, STTProviderConfigSchema, SearchProviderEntrySchema, SessionConfigSchema, SessionDmScopeSchema, SessionResetByTypeSchema, SessionResetConfigSchema, SessionResetModeSchema, SessionScopeSchema, SessionStorageConfigSchema, TTSConfigSchema, TTSEdgeConfigSchema, TTSFallbackConfigSchema, TTSModelOverridesConfigSchema, TTSProviderConfigSchema, TTSSummarizationConfigSchema, TelegramAccountConfigSchema, TelegramConfigSchema, TelegramGroupConfigSchema, TelegramTopicConfigSchema, ToolsConfigSchema, ToolsMediaAudioConfigSchema, ToolsMediaConfigSchema, TuiConfigSchema, TunnelConfigSchema, TunnelConsentSchema, USER_MEMORY_FILENAME, USER_PROFILE_FILENAME, UpdateAutoConfigSchema, UpdateConfigSchema, VercelGatewayRoutingSchema, VoiceConfigSchema, VoiceRefinementConfigSchema, WORKSPACE_FILES, WebSearchConfigSchema, WebToolsConfigSchema, WebsiteBlocklistSchema, WeixinAccountConfigSchema, WeixinConfigSchema, WorkspaceConfigSchema, WorkspaceImportConfigSchema, XOPC_DB_FILENAME, applyConfigOverrides, buildReloadPlan, canonicalizeConfiguredMcpServer, clearConfigValueCache, createProfile, deleteProfile, diffConfigPaths, existsSync, expandWorkspacePathString, extractProfileAgentId, formatThinkingLevels, getAgentDefaultImageGenerationModelConfig, getAgentDefaultImageModelConfig, getAgentDefaultModelRef, getAllowedCommands, getCacheStats, getConfigOverrides, getCurrentProfile, getDefaultModelValues, resolveModelsJsonPath as getModelsJsonPath, getProfileManager, getProfileNameFromDir, getSwitchCommand, getWorkspacePath, hasBundledExtensionManifest, isKnownCliMcpTypeAlias, listAgentProfileMarkdownDirs, listAgentWorkspaceDirs, listProfiles, listThinkingLevels, loadConfig, loadModelsJson, matchReloadRule, modelsJsonExists, normalizeConfiguredMcpServers, normalizeElevatedMode, normalizeReasoningLevel, normalizeThinkLevel, normalizeVerboseLevel, normalizeWorkspaceDir, parseModelRef, resetConfigOverrides, resolveAgentAuthProfilesPath, resolveAgentDir, resolveAgentDir$1 as resolveAgentDirFromConfig, resolveAgentHomeDir, resolveAgentHomeDir$1 as resolveAgentHomeDirFromConfig, resolveAgentProfileDir, resolveAgentProfileMarkdownPath, resolveAgentWorkspaceDir, resolveAuthProfilesPath, resolveBinDir, resolveBundledExtensionsDir, resolveBundledSkillsDir, resolveConfigPath, resolveConfigValue, resolveCredentialsDir, resolveDefaultAgentWorkspaceDir, resolveEffectiveAgentManifestForAgent, resolveEffectiveAgentManifestForSession, resolveEffectiveAgentProfile, resolveEffectiveAgentProfileForSession, resolveExtensionSdkPath, resolveExtensionsDir, resolveExtensionsLockPath, resolveHeaders, resolveHomeDir, resolveInboxDir, resolveInboxMessagePath, resolveInboxPendingDir, resolveInboxProcessedDir, resolveLogPath, resolveLogsDir, resolveModelsJsonPath, resolveNodeBinDir, resolveNodeBinPath, resolveNodeToolsDir, resolveNpmBinPath, resolveOAuthPath, resolvePidPath, resolveProfileStateDir, resolveSkillPath, resolveSkillsCachePath, resolveSkillsDir, resolveSkillsLockPath, resolveSocketPath, resolveStateDir, resolveStatusPath, resolveToolsDir, resolveUserDir, resolveUserMemoryPath, resolveUserProfilePath, resolveWorkspaceExtensionsDir, resolveWorkspaceFile, resolveWorkspaceRoot, resolveWorkspaceStateDir, resolveWorkspaceStatePath, resolveXopcBinPath, resolveXopcDatabasePath, resolveXopcMcpTransportAlias, saveConfig, saveModelsJson, setConfigOverride, testApiKeyResolution, thinkLevelToNumber, unsetConfigOverride, validateModelsConfig };
+export { AgentImageGenerationModelSchema, AgentModelRefSchema, AgentModelsSchema, AgentTypedModelRoleSchema, AgentsConfigSchema, BASE_RELOAD_RULES, BindingMatchSchema, BindingRuleSchema, BindingsConfigSchema, BrowserConfigSchema, ChannelsConfigSchema, CodeIntelligenceConfigSchema, CommandsConfigSchema, ConfigHotReloader, ConfigSchema, ConnectorsConfigSchema, CustomModelSchema, ENV_VARS, ExperimentalConfigSchema, ExtensionSecurityConfigSchema, ExtensionSlotsConfigSchema, ExtensionsConfigSchema, FILENAMES, GatewayAuthRateLimitSchema, GatewayAuthSchema, GatewayBindModeSchema, GatewayChannelConnectDeferModeSchema, GatewayConfigSchema, GatewayModeSchema, GatewayRemoteSchema, GatewaySecuritySchema, GatewayTailscaleConsentSchema, GatewayTailscaleSchema, GatewayTlsSchema, GatewayTrustedProxySchema, GoalNotificationEventSchema, GoalNotificationTargetSchema, GoalNotificationsConfigSchema, GoalsConfigSchema, HeartbeatConfigSchema, McpConfigSchema, McpServerSchema, MediaUnderstandingCapabilitiesSchema, MediaUnderstandingModelSchema, MessagesConfigSchema, ModelCatalogConfigSchema, ModelOverrideSchema, ModelsDevConfigSchema, ModelsJsonSchema, OpenAICompatSchema, OpenAICompletionsCompatSchema, OpenAIResponsesCompatSchema, OpenRouterRoutingSchema, ProfileManager, ProviderAuthConfigSchema, ProviderAzureConfigSchema, ProviderConfigSchema, ProviderRequestOverridesSchema, ProvidersConfigSchema, STTConfigSchema, STTFallbackConfigSchema, STTProviderConfigSchema, SearchProviderEntrySchema, SessionConfigSchema, SessionDmScopeSchema, SessionResetByTypeSchema, SessionResetConfigSchema, SessionResetModeSchema, SessionScopeSchema, SessionStorageConfigSchema, TTSConfigSchema, TTSEdgeConfigSchema, TTSFallbackConfigSchema, TTSModelOverridesConfigSchema, TTSProviderConfigSchema, TTSSummarizationConfigSchema, TelegramAccountConfigSchema, TelegramConfigSchema, TelegramGroupConfigSchema, TelegramTopicConfigSchema, ToolsConfigSchema, ToolsMediaAudioConfigSchema, ToolsMediaConfigSchema, TuiConfigSchema, TunnelConfigSchema, TunnelConsentSchema, USER_MEMORY_FILENAME, USER_PROFILE_FILENAME, UpdateAutoConfigSchema, UpdateConfigSchema, VercelGatewayRoutingSchema, VoiceConfigSchema, VoiceRefinementConfigSchema, WORKSPACE_FILES, WebSearchConfigSchema, WebToolsConfigSchema, WebsiteBlocklistSchema, WeixinAccountConfigSchema, WeixinConfigSchema, WorkspaceConfigSchema, WorkspaceImportConfigSchema, XOPC_DB_FILENAME, applyConfigOverrides, buildReloadPlan, canonicalizeConfiguredMcpServer, clearConfigValueCache, createProfile, deleteProfile, diffConfigPaths, existsSync, expandWorkspacePathString, extractProfileAgentId, formatThinkingLevels, getAgentDefaultImageGenerationModelConfig, getAgentDefaultImageModelConfig, getAgentDefaultModelRef, getAllowedCommands, getCacheStats, getConfigOverrides, getCurrentProfile, getDefaultModelValues, resolveModelsJsonPath as getModelsJsonPath, getProfileManager, getProfileNameFromDir, getSwitchCommand, getWorkspacePath, hasBundledExtensionManifest, isKnownCliMcpTypeAlias, listAgentProfileMarkdownDirs, listAgentWorkspaceDirs, listProfiles, listThinkingLevels, loadConfig, loadModelsJson, matchReloadRule, modelsJsonExists, normalizeConfiguredMcpServers, normalizeElevatedMode, normalizeReasoningLevel, normalizeThinkLevel, normalizeVerboseLevel, normalizeWorkspaceDir, parseModelRef, resetConfigOverrides, resolveAgentAuthProfilesPath, resolveAgentDir, resolveAgentDir$1 as resolveAgentDirFromConfig, resolveAgentHomeDir, resolveAgentHomeDir$1 as resolveAgentHomeDirFromConfig, resolveAgentProfileDir, resolveAgentProfileMarkdownPath, resolveAgentWorkspaceDir, resolveAuthProfilesPath, resolveBinDir, resolveBundledExtensionsDir, resolveBundledSkillsDir, resolveConfigPath, resolveConfigValue, resolveCredentialsDir, resolveDefaultAgentWorkspaceDir, resolveEffectiveAgentManifestForAgent, resolveEffectiveAgentManifestForSession, resolveEffectiveAgentProfile, resolveEffectiveAgentProfileForSession, resolveExtensionSdkPath, resolveExtensionsDir, resolveExtensionsLockPath, resolveHeaders, resolveHomeDir, resolveInboxDir, resolveInboxMessagePath, resolveInboxPendingDir, resolveInboxProcessedDir, resolveLogPath, resolveLogsDir, resolveModelsJsonPath, resolveNodeBinDir, resolveNodeBinPath, resolveNodeToolsDir, resolveNpmBinPath, resolveOAuthPath, resolvePidPath, resolveProfileStateDir, resolveSkillPath, resolveSkillsCachePath, resolveSkillsDir, resolveSkillsLockPath, resolveSocketPath, resolveStateDir, resolveStatusPath, resolveToolsDir, resolveUserDir, resolveUserMemoryPath, resolveUserProfilePath, resolveWorkspaceExtensionsDir, resolveWorkspaceFile, resolveWorkspaceRoot, resolveWorkspaceStateDir, resolveWorkspaceStatePath, resolveXopcBinPath, resolveXopcDatabasePath, resolveXopcMcpTransportAlias, saveConfig, saveModelsJson, setConfigOverride, testApiKeyResolution, thinkLevelToNumber, unsetConfigOverride, validateModelsConfig };

package/dist/src/config/models-json.d.ts

@@ -292,6 +292,9 @@ export declare const ProviderConfigSchema: z.ZodObject<{
             supportsStrictMode: z.ZodOptional<z.ZodBoolean>;
         }, z.core.$strip>, z.ZodObject<{}, z.core.$strip>]>>;
     }, z.core.$strip>>>;
+    modelDiscovery: z.ZodOptional<z.ZodObject<{
+        enabled: z.ZodBoolean;
+    }, z.core.$strict>>;
 }, z.core.$strip>;
 export declare const ModelsJsonSchema: z.ZodObject<{
     providers: z.ZodRecord<z.ZodString, z.ZodObject<{
@@ -412,6 +415,9 @@ export declare const ModelsJsonSchema: z.ZodObject<{
                 supportsStrictMode: z.ZodOptional<z.ZodBoolean>;
             }, z.core.$strip>, z.ZodObject<{}, z.core.$strip>]>>;
         }, z.core.$strip>>>;
+        modelDiscovery: z.ZodOptional<z.ZodObject<{
+            enabled: z.ZodBoolean;
+        }, z.core.$strict>>;
     }, z.core.$strip>>;
 }, z.core.$strip>;
 export type OpenRouterRouting = z.infer<typeof OpenRouterRoutingSchema>;

package/dist/src/config/models-json.js

@@ -27,6 +27,14 @@ function validateModelsConfig(config) {
 	}
 	const data = result.data;
 	for (const [providerName, providerConfig] of Object.entries(data.providers)) {
+		if (providerName === "xopc-cloud") {
+			errors.push({
+				path: "providers.xopc-cloud",
+				message: "xopc-cloud is managed by OAuth and the runtime model catalog; it cannot be configured in models.json",
+				severity: "error"
+			});
+			continue;
+		}
 		if (!PROVIDER_ID_REGEX.test(providerName)) errors.push({
 			path: `providers.${providerName}`,
 			message: "Provider ID must start/end with alphanumeric, contain only lowercase letters, numbers, hyphens, and underscores",
@@ -46,11 +54,6 @@ function validateModelsConfig(config) {
 				message: "baseUrl is required when defining custom models",
 				severity: "error"
 			});
-			if (!providerConfig.apiKey) errors.push({
-				path: `providers.${providerName}.apiKey`,
-				message: "apiKey is required when defining custom models",
-				severity: "error"
-			});
 		}
 		if (!hasModels && !hasBaseUrl && !hasModelOverrides && !providerConfig.apiKey) errors.push({
 			path: `providers.${providerName}`,
@@ -247,7 +250,8 @@ var init_models_json = __esmMin((() => {
 		headers: z.record(z.string(), z.string()).optional(),
 		authHeader: z.boolean().optional(),
 		models: z.array(CustomModelSchema).optional(),
-		modelOverrides: z.record(z.string(), ModelOverrideSchema).optional()
+		modelOverrides: z.record(z.string(), ModelOverrideSchema).optional(),
+		modelDiscovery: z.object({ enabled: z.boolean() }).strict().optional()
 	});
 	ModelsJsonSchema = z.object({ providers: z.record(z.string(), ProviderConfigSchema) });
 	PROVIDER_ID_REGEX = /^[a-z0-9]([a-z0-9-_]*[a-z0-9])?$/;