@xopcai/xopc 0.0.174 → 0.0.176

package/dist/src/agent/skills/skill-manage-ops.js

@@ -1,8 +1,8 @@
 import { init_paths, resolveSkillsDir } from "../../config/paths.js";
 import { parseFrontmatter } from "../../markdown/frontmatter.js";
 import { fuzzyFindText, normalizeForFuzzyMatch, normalizeToLF, restoreLineEndings } from "../tools/edit-diff.js";
-import { formatScanSummary, scanSkillDirectory } from "./scanner.js";
 import { resolveWorkspaceSkillsDir } from "./workspace-skills-dir.js";
+import { formatScanSummary, scanSkillDirectory } from "./scanner.js";
 import { join, resolve, sep } from "path";
 import { existsSync, realpathSync } from "fs";
 import { mkdir, writeFile } from "fs/promises";

package/dist/src/agent/skills/test-framework.js

@@ -2,8 +2,8 @@ import { createLogger } from "../../utils/logger/index.js";
 import { init_logger } from "../../utils/logger.js";
 import { parseFrontmatter } from "../../markdown/frontmatter.js";
 import { hasBinary } from "./installer.js";
-import { scanSkillDirectory } from "./scanner.js";
 import { parseSkillMetadata } from "./parse-skill-metadata.js";
+import { scanSkillDirectory } from "./scanner.js";
 import { basename, join, relative } from "path";
 import { existsSync, readFileSync, readdirSync } from "fs";
 //#region src/agent/skills/test-framework.ts

package/dist/src/agent/workflow/subagent-runner.js

@@ -114,6 +114,7 @@ var DelegateSubagentRunner = class {
 			sessionType: "workflow-subagent",
 			hiddenFromSessionList: true,
 			parentSessionKey: metadata.parentSessionKey,
+			projectId: metadata.projectId,
 			workflowRunId: metadata.workflowRunId,
 			workflowDefinitionId: metadata.workflowDefinitionId,
 			workflowAgentId: metadata.workflowAgentId,
@@ -132,6 +133,7 @@ var DelegateSubagentRunner = class {
 			sessionType: "workflow-subagent",
 			hiddenFromSessionList: true,
 			parentSessionKey: metadata.parentSessionKey,
+			projectId: metadata.projectId,
 			workflowRunId: metadata.workflowRunId,
 			workflowDefinitionId: metadata.workflowDefinitionId,
 			workflowAgentId: metadata.workflowAgentId,

package/dist/src/agent/workflow/types.d.ts

@@ -134,6 +134,7 @@ export interface SubagentRunOptions<T = unknown> {
     sessionKey?: string;
     sessionMetadata?: {
         parentSessionKey?: string;
+        projectId?: string;
         workflowRunId: string;
         workflowDefinitionId: string;
         workflowAgentId: string;

package/dist/src/auth/model-credential-store.d.ts

@@ -0,0 +1,17 @@
+import { type AuthOperationOptions, type Credential, type CredentialInfo, type CredentialStore } from '@earendil-works/pi-ai';
+import { CredentialResolver } from './credentials.js';
+type OAuthCredentialRepository = Pick<CredentialResolver, 'deleteOAuthToken' | 'listOAuthTokens' | 'loadOAuthTokenRecord' | 'saveOAuthToken'>;
+/**
+ * ModelRuntime credential store backed by xopc OAuth persistence.
+ * API keys remain process-local because their canonical sources are xopc config and environment.
+ */
+export declare class XopcModelCredentialStore implements CredentialStore {
+    private readonly repository;
+    private readonly runtimeApiKeys;
+    constructor(repository?: OAuthCredentialRepository);
+    read(providerId: string, options?: AuthOperationOptions): Promise<Credential | undefined>;
+    list(options?: AuthOperationOptions): Promise<readonly CredentialInfo[]>;
+    modify(providerId: string, update: (current: Credential | undefined) => Promise<Credential | undefined>, options?: AuthOperationOptions): Promise<Credential | undefined>;
+    delete(providerId: string, options?: AuthOperationOptions): Promise<void>;
+}
+export {};

package/dist/src/auth/model-credential-store.js

@@ -0,0 +1,110 @@
+import { __esmMin } from "../../_virtual/_rolldown/runtime.js";
+import { CredentialResolver, init_credentials } from "./credentials.js";
+//#region src/auth/model-credential-store.ts
+function normalizeProviderId(providerId) {
+	return providerId.toLowerCase();
+}
+function toRuntimeCredential(token) {
+	const { type: _type, provider: _provider, expiresAt, createdAt: _createdAt, updatedAt: _updatedAt, ...credential } = token;
+	return {
+		...credential,
+		type: "oauth",
+		access: token.access,
+		refresh: token.refresh ?? "",
+		expires: expiresAt ?? Number.MAX_SAFE_INTEGER
+	};
+}
+function toPersistedToken(credential, current) {
+	const { type: _type, expires, ...token } = credential;
+	let previous = {};
+	if (current) {
+		const { type: _previousType, expires: _previousExpires, ...previousFields } = toRuntimeCredential(current);
+		previous = previousFields;
+	}
+	return {
+		...previous,
+		...token,
+		access: credential.access,
+		refresh: credential.refresh || void 0,
+		expiresAt: expires,
+		createdAt: current?.createdAt ?? (/* @__PURE__ */ new Date()).toISOString()
+	};
+}
+async function serializeProviderModification(providerId, operation) {
+	const previous = providerModificationTails.get(providerId) ?? Promise.resolve();
+	let release;
+	const gate = new Promise((resolve) => {
+		release = resolve;
+	});
+	const tail = previous.catch(() => void 0).then(() => gate);
+	providerModificationTails.set(providerId, tail);
+	await previous.catch(() => void 0);
+	try {
+		return await operation();
+	} finally {
+		release();
+		if (providerModificationTails.get(providerId) === tail) providerModificationTails.delete(providerId);
+	}
+}
+var providerModificationTails, XopcModelCredentialStore;
+var init_model_credential_store = __esmMin((() => {
+	init_credentials();
+	providerModificationTails = /* @__PURE__ */ new Map();
+	XopcModelCredentialStore = class {
+		runtimeApiKeys = /* @__PURE__ */ new Map();
+		constructor(repository = new CredentialResolver()) {
+			this.repository = repository;
+		}
+		async read(providerId, options) {
+			options?.signal?.throwIfAborted();
+			const normalizedProvider = normalizeProviderId(providerId);
+			const runtimeApiKey = this.runtimeApiKeys.get(normalizedProvider);
+			if (runtimeApiKey) return runtimeApiKey;
+			const token = await this.repository.loadOAuthTokenRecord(normalizedProvider);
+			options?.signal?.throwIfAborted();
+			return token ? toRuntimeCredential(token) : void 0;
+		}
+		async list(options) {
+			options?.signal?.throwIfAborted();
+			const oauthTokens = await this.repository.listOAuthTokens();
+			options?.signal?.throwIfAborted();
+			const credentials = /* @__PURE__ */ new Map();
+			for (const token of oauthTokens) credentials.set(normalizeProviderId(token.provider), {
+				providerId: normalizeProviderId(token.provider),
+				type: "oauth"
+			});
+			for (const providerId of this.runtimeApiKeys.keys()) credentials.set(providerId, {
+				providerId,
+				type: "api_key"
+			});
+			return [...credentials.values()];
+		}
+		async modify(providerId, update, options) {
+			const normalizedProvider = normalizeProviderId(providerId);
+			return serializeProviderModification(normalizedProvider, async () => {
+				options?.signal?.throwIfAborted();
+				const persisted = await this.repository.loadOAuthTokenRecord(normalizedProvider);
+				const current = this.runtimeApiKeys.get(normalizedProvider) ?? (persisted ? toRuntimeCredential(persisted) : void 0);
+				const updated = await update(current);
+				options?.signal?.throwIfAborted();
+				if (!updated) return current;
+				if (updated.type === "oauth") {
+					await this.repository.saveOAuthToken(normalizedProvider, toPersistedToken(updated, persisted));
+					this.runtimeApiKeys.delete(normalizedProvider);
+				} else this.runtimeApiKeys.set(normalizedProvider, updated);
+				return updated;
+			});
+		}
+		async delete(providerId, options) {
+			const normalizedProvider = normalizeProviderId(providerId);
+			await serializeProviderModification(normalizedProvider, async () => {
+				options?.signal?.throwIfAborted();
+				await this.repository.deleteOAuthToken(normalizedProvider);
+				this.runtimeApiKeys.delete(normalizedProvider);
+			});
+		}
+	};
+}));
+//#endregion
+init_model_credential_store();
+export { XopcModelCredentialStore, init_model_credential_store };

package/dist/src/auth/oauth/github-copilot.js

@@ -18,7 +18,7 @@ function fromPiCredential({ type: _type, ...credentials }) {
 }
 function toAuthInteraction(callbacks) {
 	return {
-		signal: callbacks.signal,
+		signal: callbacks.signal ?? new AbortController().signal,
 		async prompt(prompt) {
 			if (prompt.type === "select") return await callbacks.onSelect({
 				message: prompt.message,
@@ -57,7 +57,7 @@ var init_github_copilot = __esmMin((() => {
 			return fromPiCredential(await getCopilotOAuth().login(toAuthInteraction(callbacks)));
 		},
 		async refreshToken(credentials) {
-			return fromPiCredential(await getCopilotOAuth().refresh(toPiCredential(credentials)));
+			return fromPiCredential(await getCopilotOAuth().refresh(toPiCredential(credentials), new AbortController().signal));
 		},
 		getApiKey(credentials) {
 			return credentials.access;

package/dist/src/auth/oauth/openai-codex.js

@@ -2,12 +2,17 @@ import { __esmMin } from "../../../_virtual/_rolldown/runtime.js";
 import { generatePKCE, init_pkce } from "./pkce.js";
 import { randomBytes } from "node:crypto";
 import http from "node:http";
+import { setTimeout as setTimeout$1 } from "node:timers/promises";
 //#region src/auth/oauth/openai-codex.ts
 /**
 * OpenAI Codex (ChatGPT) OAuth.
 *
 * Owns callback validation, manual prompt handling, and success/error pages.
 */
+function requestSignal(signal) {
+	const timeout = AbortSignal.timeout(TOKEN_REQUEST_TIMEOUT_MS);
+	return signal ? AbortSignal.any([signal, timeout]) : timeout;
+}
 function xopcOAuthHtml(params) {
 	const color = params.tone === "success" ? "#2563eb" : "#dc2626";
 	const escapedTitle = escapeHtml(params.title);
@@ -199,7 +204,7 @@ async function postTokenForm(body, signal) {
 			Accept: "application/json"
 		},
 		body,
-		signal: signal ?? AbortSignal.timeout(TOKEN_REQUEST_TIMEOUT_MS)
+		signal: requestSignal(signal)
 	});
 	const contentType = response.headers.get("content-type") ?? "";
 	const text = await response.text();
@@ -207,15 +212,82 @@ async function postTokenForm(body, signal) {
 	if (!contentType.toLowerCase().includes("application/json")) throw new Error(`OpenAI Codex token response was not JSON: ${contentType || "missing content-type"}`);
 	return JSON.parse(text);
 }
-async function exchangeAuthorizationCode(code, verifier, signal) {
+async function exchangeAuthorizationCode(code, verifier, signal, redirectUri = REDIRECT_URI) {
 	return normalizeTokenResponse(await postTokenForm(new URLSearchParams({
 		grant_type: "authorization_code",
 		client_id: CLIENT_ID,
 		code,
 		code_verifier: verifier,
-		redirect_uri: REDIRECT_URI
+		redirect_uri: redirectUri
 	}), signal));
 }
+async function requestDeviceCode(signal) {
+	const response = await fetch(DEVICE_USER_CODE_URL, {
+		method: "POST",
+		headers: {
+			"Content-Type": "application/json",
+			Accept: "application/json"
+		},
+		body: JSON.stringify({ client_id: CLIENT_ID }),
+		signal: requestSignal(signal)
+	});
+	const body = await response.json().catch(() => ({}));
+	if (!response.ok) {
+		if (response.status === 404) throw new Error("OpenAI Codex device code login is not enabled. Enable it in ChatGPT security or workspace settings, or use browser login.");
+		throw new Error(body.error_description ?? body.error ?? `OpenAI Codex device code request failed (${response.status})`);
+	}
+	if (!body.device_auth_id || !body.user_code) throw new Error("OpenAI Codex device code response is incomplete");
+	const intervalSeconds = Number(body.interval);
+	return {
+		deviceAuthId: body.device_auth_id,
+		userCode: body.user_code,
+		intervalMs: Math.max(1, Number.isFinite(intervalSeconds) ? intervalSeconds : 5) * 1e3
+	};
+}
+async function pollDeviceAuthorization(params) {
+	const expiresAt = Date.now() + DEVICE_AUTH_TIMEOUT_MS;
+	while (Date.now() < expiresAt) {
+		if (params.signal?.aborted) throw params.signal.reason instanceof Error ? params.signal.reason : /* @__PURE__ */ new Error("OpenAI Codex login cancelled");
+		const response = await fetch(DEVICE_TOKEN_URL, {
+			method: "POST",
+			headers: {
+				"Content-Type": "application/json",
+				Accept: "application/json"
+			},
+			body: JSON.stringify({
+				device_auth_id: params.deviceAuthId,
+				user_code: params.userCode
+			}),
+			signal: requestSignal(params.signal)
+		});
+		const body = await response.json().catch(() => ({}));
+		if (response.ok) {
+			if (!body.authorization_code || !body.code_verifier) throw new Error("OpenAI Codex device authorization response is incomplete");
+			return {
+				code: body.authorization_code,
+				verifier: body.code_verifier
+			};
+		}
+		if (response.status !== 403 && response.status !== 404) throw new Error(body.error_description ?? body.error ?? `OpenAI Codex device authorization failed (${response.status})`);
+		const remainingMs = expiresAt - Date.now();
+		await setTimeout$1(Math.min(params.intervalMs, remainingMs), void 0, params.signal ? { signal: params.signal } : void 0);
+	}
+	throw new Error("OpenAI Codex device authorization timed out");
+}
+async function loginOpenAICodexWithDeviceCode(callbacks) {
+	const device = await requestDeviceCode(callbacks.signal);
+	callbacks.onDeviceCode({
+		userCode: device.userCode,
+		verificationUri: DEVICE_VERIFICATION_URL,
+		intervalSeconds: device.intervalMs / 1e3,
+		expiresInSeconds: DEVICE_AUTH_TIMEOUT_MS / 1e3
+	});
+	const authorization = await pollDeviceAuthorization({
+		...device,
+		signal: callbacks.signal
+	});
+	return exchangeAuthorizationCode(authorization.code, authorization.verifier, callbacks.signal, DEVICE_REDIRECT_URI);
+}
 async function refreshAccessToken(refreshToken) {
 	return normalizeTokenResponse(await postTokenForm(new URLSearchParams({
 		grant_type: "refresh_token",
@@ -258,7 +330,7 @@ function getAccountId(accessToken) {
 		return null;
 	}
 }
-async function loginOpenAICodex(callbacks) {
+async function loginOpenAICodexWithBrowser(callbacks) {
 	const { verifier, state, url } = await createAuthorizationFlow();
 	const server = await startLocalOAuthServer(state);
 	try {
@@ -288,25 +360,44 @@ async function loginOpenAICodex(callbacks) {
 		server.close();
 	}
 }
+async function loginOpenAICodex(callbacks) {
+	return await callbacks.onSelect({
+		message: "Choose how to authorize OpenAI Codex",
+		options: [{
+			id: "browser",
+			label: "Browser (recommended for this device)"
+		}, {
+			id: "device_code",
+			label: "Device code (remote or headless)"
+		}]
+	}) === "device_code" ? loginOpenAICodexWithDeviceCode(callbacks) : loginOpenAICodexWithBrowser(callbacks);
+}
 async function refreshOpenAICodexToken(refreshToken) {
 	return refreshAccessToken(refreshToken);
 }
-var CLIENT_ID, AUTHORIZE_URL, TOKEN_URL, CALLBACK_PORT, CALLBACK_PATH, REDIRECT_URI, SCOPE, MANUAL_PROMPT_DELAY_MS, TOKEN_REQUEST_TIMEOUT_MS, openaiCodexOAuthProvider;
+var CLIENT_ID, AUTH_BASE_URL, AUTHORIZE_URL, TOKEN_URL, DEVICE_USER_CODE_URL, DEVICE_TOKEN_URL, DEVICE_VERIFICATION_URL, DEVICE_REDIRECT_URI, CALLBACK_PORT, CALLBACK_PATH, REDIRECT_URI, SCOPE, MANUAL_PROMPT_DELAY_MS, TOKEN_REQUEST_TIMEOUT_MS, DEVICE_AUTH_TIMEOUT_MS, openaiCodexOAuthProvider;
 var init_openai_codex = __esmMin((() => {
 	init_pkce();
 	CLIENT_ID = "app_EMoamEEZ73f0CkXaXp7hrann";
-	AUTHORIZE_URL = "https://auth.openai.com/oauth/authorize";
-	TOKEN_URL = "https://auth.openai.com/oauth/token";
+	AUTH_BASE_URL = "https://auth.openai.com";
+	AUTHORIZE_URL = `${AUTH_BASE_URL}/oauth/authorize`;
+	TOKEN_URL = `${AUTH_BASE_URL}/oauth/token`;
+	DEVICE_USER_CODE_URL = `${AUTH_BASE_URL}/api/accounts/deviceauth/usercode`;
+	DEVICE_TOKEN_URL = `${AUTH_BASE_URL}/api/accounts/deviceauth/token`;
+	DEVICE_VERIFICATION_URL = `${AUTH_BASE_URL}/codex/device`;
+	DEVICE_REDIRECT_URI = `${AUTH_BASE_URL}/deviceauth/callback`;
 	CALLBACK_PORT = 1455;
 	CALLBACK_PATH = "/auth/callback";
 	REDIRECT_URI = `http://localhost:${CALLBACK_PORT}${CALLBACK_PATH}`;
 	SCOPE = "openid profile email offline_access";
 	MANUAL_PROMPT_DELAY_MS = 15e3;
 	TOKEN_REQUEST_TIMEOUT_MS = 3e4;
+	DEVICE_AUTH_TIMEOUT_MS = 15 * 6e4;
 	openaiCodexOAuthProvider = {
 		id: "openai-codex",
 		name: "OpenAI Codex",
 		usesCallbackServer: true,
+		loginMethods: ["browser", "device_code"],
 		async login(callbacks) {
 			return loginOpenAICodex(callbacks);
 		},

package/dist/src/auth/oauth/types.d.ts

@@ -10,6 +10,7 @@ export type OAuthCredentials = {
     [key: string]: unknown;
 };
 export type OAuthProviderId = string;
+export type OAuthLoginMethod = 'browser' | 'device_code';
 export type OAuthPrompt = {
     message: string;
     placeholder?: string;
@@ -49,8 +50,10 @@ export interface OAuthProviderInterface {
     login(callbacks: OAuthLoginCallbacks): Promise<OAuthCredentials>;
     /** Whether login uses a local callback server and supports manual code input. */
     usesCallbackServer?: boolean;
+    /** Login methods exposed by providers that support more than one OAuth flow. */
+    loginMethods?: readonly OAuthLoginMethod[];
     /** Refresh expired credentials, return updated credentials to persist */
-    refreshToken(credentials: OAuthCredentials): Promise<OAuthCredentials>;
+    refreshToken(credentials: OAuthCredentials, signal?: AbortSignal): Promise<OAuthCredentials>;
     /** Convert credentials to API key string for the provider */
     getApiKey(credentials: OAuthCredentials): string;
 }

package/dist/src/auth/oauth/xopc-cloud.js

@@ -1,6 +1,9 @@
 import { __esmMin } from "../../../_virtual/_rolldown/runtime.js";
+import { generatePKCE, init_pkce } from "./pkce.js";
 import { hostname } from "node:os";
-import { setTimeout } from "node:timers/promises";
+import { randomBytes } from "node:crypto";
+import http from "node:http";
+import { setTimeout as setTimeout$1 } from "node:timers/promises";
 //#region src/auth/oauth/xopc-cloud.ts
 function consoleUrl() {
 	return (process.env.XOPC_CONSOLE_URL ?? DEFAULT_CONSOLE_URL).replace(/\/+$/, "");
@@ -29,7 +32,106 @@ async function tokenRequest(body, signal) {
 		signal: signal ?? AbortSignal.timeout(3e4)
 	});
 }
-async function login(callbacks) {
+function callbackHtml(title, message) {
+	return `<!doctype html><html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>${title}</title></head><body><main><h1>${title}</h1><p>${message}</p><p>You can close this window and return to XOPC.</p></main></body></html>`;
+}
+async function loginWithBrowser(callbacks) {
+	if (callbacks.signal?.aborted) throw callbacks.signal.reason instanceof Error ? callbacks.signal.reason : /* @__PURE__ */ new Error("XOPC OAuth login cancelled");
+	const { verifier, challenge } = await generatePKCE();
+	const state = randomBytes(24).toString("base64url");
+	let settle;
+	const callback = new Promise((resolve) => {
+		settle = resolve;
+	});
+	const server = http.createServer((request, response) => {
+		response.setHeader("content-type", "text/html; charset=utf-8");
+		try {
+			const url = new URL(request.url ?? "", "http://127.0.0.1");
+			if (url.pathname !== CALLBACK_PATH) {
+				response.statusCode = 404;
+				response.end(callbackHtml("Authorization callback not found", "This is not a valid XOPC OAuth callback URL."));
+				return;
+			}
+			const returnedState = url.searchParams.get("state");
+			const oauthError = url.searchParams.get("error");
+			const code = url.searchParams.get("code");
+			if (returnedState !== state) {
+				const error = /* @__PURE__ */ new Error("XOPC OAuth state mismatch");
+				response.statusCode = 400;
+				response.end(callbackHtml("Authorization failed", error.message));
+				settle?.({ error });
+				return;
+			}
+			if (oauthError || !code) {
+				const error = /* @__PURE__ */ new Error(oauthError === "access_denied" ? "XOPC OAuth authorization was denied" : "XOPC OAuth callback did not include an authorization code");
+				response.statusCode = 400;
+				response.end(callbackHtml("Authorization failed", error.message));
+				settle?.({ error });
+				return;
+			}
+			response.statusCode = 200;
+			response.end(callbackHtml("Authorization complete", "XOPC received the authorization callback successfully."));
+			settle?.({ code });
+		} catch {
+			const error = /* @__PURE__ */ new Error("XOPC OAuth callback could not be processed");
+			response.statusCode = 500;
+			response.end(callbackHtml("Authorization failed", error.message));
+			settle?.({ error });
+		}
+	});
+	const redirectUri = await new Promise((resolve, reject) => {
+		server.once("error", reject);
+		server.listen(0, "127.0.0.1", () => {
+			server.removeListener("error", reject);
+			const address = server.address();
+			if (!address || typeof address === "string") {
+				reject(/* @__PURE__ */ new Error("XOPC OAuth callback server did not expose a TCP port"));
+				return;
+			}
+			resolve(`http://127.0.0.1:${address.port}${CALLBACK_PATH}`);
+		});
+	});
+	const authorizationUrl = new URL(`${consoleUrl()}/oauth/authorize`);
+	authorizationUrl.search = new URLSearchParams({
+		response_type: "code",
+		client_id: CLIENT_ID,
+		redirect_uri: redirectUri,
+		scope: DEFAULT_SCOPE,
+		code_challenge: challenge,
+		code_challenge_method: "S256",
+		state,
+		device_name: hostname() || "XOPC client",
+		client_type: "cli"
+	}).toString();
+	const timeout = setTimeout(() => settle?.({ error: /* @__PURE__ */ new Error("XOPC OAuth authorization timed out") }), AUTHORIZATION_TIMEOUT_MS);
+	timeout.unref?.();
+	const abort = () => settle?.({ error: callbacks.signal?.reason instanceof Error ? callbacks.signal.reason : /* @__PURE__ */ new Error("XOPC OAuth login cancelled") });
+	callbacks.signal?.addEventListener("abort", abort, { once: true });
+	try {
+		callbacks.onAuth({
+			url: authorizationUrl.toString(),
+			instructions: "Complete authorization in your browser. XOPC will finish automatically after the local callback."
+		});
+		const result = await callback;
+		if (result.error) throw result.error;
+		if (!result.code) throw new Error("XOPC OAuth callback did not include an authorization code");
+		const token = await tokenRequest(new URLSearchParams({
+			grant_type: "authorization_code",
+			client_id: CLIENT_ID,
+			code: result.code,
+			code_verifier: verifier,
+			redirect_uri: redirectUri
+		}), callbacks.signal);
+		const body = await readJson(token);
+		if (!token.ok) throw new Error(body.error_description ?? body.error ?? "XOPC OAuth token exchange failed");
+		return credentials(body);
+	} finally {
+		clearTimeout(timeout);
+		callbacks.signal?.removeEventListener("abort", abort);
+		server.close();
+	}
+}
+async function loginWithDeviceCode(callbacks) {
 	const response = await fetch(`${consoleUrl()}/oauth/device_authorization`, {
 		method: "POST",
 		headers: {
@@ -60,7 +162,7 @@ async function login(callbacks) {
 	});
 	while (Date.now() < expiresAt) {
 		if (callbacks.signal?.aborted) throw callbacks.signal.reason ?? /* @__PURE__ */ new Error("OAuth login cancelled");
-		await setTimeout(intervalMs, void 0, callbacks.signal ? { signal: callbacks.signal } : void 0);
+		await setTimeout$1(intervalMs, void 0, callbacks.signal ? { signal: callbacks.signal } : void 0);
 		const token = await tokenRequest(new URLSearchParams({
 			grant_type: "urn:ietf:params:oauth:grant-type:device_code",
 			client_id: CLIENT_ID,
@@ -73,24 +175,40 @@ async function login(callbacks) {
 	}
 	throw new Error("XOPC OAuth authorization expired");
 }
-async function refreshToken(current) {
+async function login(callbacks) {
+	return await callbacks.onSelect({
+		message: "Choose how to authorize XOPC Model Service",
+		options: [{
+			id: "browser",
+			label: "Browser (recommended for this device)"
+		}, {
+			id: "device_code",
+			label: "Device code (remote or headless)"
+		}]
+	}) === "device_code" ? loginWithDeviceCode(callbacks) : loginWithBrowser(callbacks);
+}
+async function refreshToken(current, signal) {
 	const response = await tokenRequest(new URLSearchParams({
 		grant_type: "refresh_token",
 		client_id: CLIENT_ID,
 		refresh_token: current.refresh
-	}));
+	}), signal);
 	const body = await readJson(response);
 	if (!response.ok) throw new Error(body.error_description ?? body.error ?? "XOPC OAuth refresh failed");
 	return credentials(body);
 }
-var CLIENT_ID, DEFAULT_CONSOLE_URL, DEFAULT_SCOPE, xopcCloudOAuthProvider;
+var CLIENT_ID, DEFAULT_CONSOLE_URL, DEFAULT_SCOPE, CALLBACK_PATH, AUTHORIZATION_TIMEOUT_MS, xopcCloudOAuthProvider;
 var init_xopc_cloud = __esmMin((() => {
+	init_pkce();
 	CLIENT_ID = "xopc-native";
 	DEFAULT_CONSOLE_URL = "https://console.xopc.ai";
 	DEFAULT_SCOPE = "models:read models:invoke account:usage offline_access";
+	CALLBACK_PATH = "/oauth/callback";
+	AUTHORIZATION_TIMEOUT_MS = 5 * 6e4;
 	xopcCloudOAuthProvider = {
 		id: "xopc-cloud",
 		name: "XOPC Model Service",
+		loginMethods: ["browser", "device_code"],
 		login,
 		refreshToken,
 		getApiKey: (value) => value.access

package/dist/src/automations/domain/defaults.d.ts

@@ -0,0 +1 @@
+export declare const DEFAULT_AUTOMATION_TIMEOUT_SECONDS = 300;

package/dist/src/automations/domain/defaults.js

@@ -0,0 +1,4 @@
+//#region src/automations/domain/defaults.ts
+const DEFAULT_AUTOMATION_TIMEOUT_SECONDS = 300;
+//#endregion
+export { DEFAULT_AUTOMATION_TIMEOUT_SECONDS };

package/dist/src/automations/domain/index.d.ts

@@ -1,3 +1,4 @@
+export * from './defaults.js';
 export * from './schedule.js';
 export * from './types.js';
 export * from './validation.js';

package/dist/src/automations/domain/index.js

@@ -1,3 +1,4 @@
+import { DEFAULT_AUTOMATION_TIMEOUT_SECONDS } from "./defaults.js";
 import { computeNextAutomationRunAtMs, computeNextScheduleRunAtMs, timerDelayUntil } from "./schedule.js";
 import { AutomationActionSchema, AutomationAfterRunSchema, AutomationReliabilitySchema, AutomationSafetyPolicySchema, AutomationScheduleSchema, AutomationSchema, AutomationStateSchema, AutomationTriggerSchema, CreateAutomationSchema, UpdateAutomationSchema } from "./validation.js";
-export { AutomationActionSchema, AutomationAfterRunSchema, AutomationReliabilitySchema, AutomationSafetyPolicySchema, AutomationScheduleSchema, AutomationSchema, AutomationStateSchema, AutomationTriggerSchema, CreateAutomationSchema, UpdateAutomationSchema, computeNextAutomationRunAtMs, computeNextScheduleRunAtMs, timerDelayUntil };
+export { AutomationActionSchema, AutomationAfterRunSchema, AutomationReliabilitySchema, AutomationSafetyPolicySchema, AutomationScheduleSchema, AutomationSchema, AutomationStateSchema, AutomationTriggerSchema, CreateAutomationSchema, DEFAULT_AUTOMATION_TIMEOUT_SECONDS, UpdateAutomationSchema, computeNextAutomationRunAtMs, computeNextScheduleRunAtMs, timerDelayUntil };

package/dist/src/automations/index.js

@@ -1,8 +1,9 @@
 import { onAutomationProductEvent, publishAutomationProductEvent } from "./product-events.js";
+import { DEFAULT_AUTOMATION_TIMEOUT_SECONDS } from "./domain/defaults.js";
 import { computeNextAutomationRunAtMs, computeNextScheduleRunAtMs, timerDelayUntil } from "./domain/schedule.js";
 import { AutomationActionSchema, AutomationAfterRunSchema, AutomationReliabilitySchema, AutomationSafetyPolicySchema, AutomationScheduleSchema, AutomationSchema, AutomationStateSchema, AutomationTriggerSchema, CreateAutomationSchema, UpdateAutomationSchema } from "./domain/validation.js";
 import "./domain/index.js";
 import { AutomationActionExecutor } from "./service/action-executor.js";
 import { AutomationAlreadyRunningError, AutomationService } from "./service/automation-service.js";
 import "./service/index.js";
-export { AutomationActionExecutor, AutomationActionSchema, AutomationAfterRunSchema, AutomationAlreadyRunningError, AutomationReliabilitySchema, AutomationSafetyPolicySchema, AutomationScheduleSchema, AutomationSchema, AutomationService, AutomationStateSchema, AutomationTriggerSchema, CreateAutomationSchema, UpdateAutomationSchema, computeNextAutomationRunAtMs, computeNextScheduleRunAtMs, onAutomationProductEvent, publishAutomationProductEvent, timerDelayUntil };
+export { AutomationActionExecutor, AutomationActionSchema, AutomationAfterRunSchema, AutomationAlreadyRunningError, AutomationReliabilitySchema, AutomationSafetyPolicySchema, AutomationScheduleSchema, AutomationSchema, AutomationService, AutomationStateSchema, AutomationTriggerSchema, CreateAutomationSchema, DEFAULT_AUTOMATION_TIMEOUT_SECONDS, UpdateAutomationSchema, computeNextAutomationRunAtMs, computeNextScheduleRunAtMs, onAutomationProductEvent, publishAutomationProductEvent, timerDelayUntil };

package/dist/src/automations/service/action-executor.js

@@ -2,13 +2,13 @@ import { createLogger } from "../../utils/logger/index.js";
 import { init_logger } from "../../utils/logger.js";
 import { init_agent_scope, normalizeAgentId } from "../../agent/agent-scope.js";
 import { buildSessionKey, init_session_key } from "../../routing/session-key.js";
+import "../domain/defaults.js";
 import crypto from "node:crypto";
 //#region src/automations/service/action-executor.ts
 init_agent_scope();
 init_session_key();
 init_logger();
 const log = createLogger("Automation:ActionExecutor");
-const DEFAULT_TIMEOUT_MS = 18e4;
 function withTimeout(promise, timeoutMs, signal) {
 	return new Promise((resolve, reject) => {
 		if (signal.aborted) {
@@ -41,7 +41,7 @@ var AutomationActionExecutor = class {
 		};
 	}
 	async execute(automation, run, signal) {
-		const timeoutMs = (automation.action.timeoutSeconds ?? automation.reliability?.timeoutSeconds ?? 0) > 0 ? (automation.action.timeoutSeconds ?? automation.reliability?.timeoutSeconds) * 1e3 : DEFAULT_TIMEOUT_MS;
+		const timeoutMs = (automation.action.timeoutSeconds ?? automation.reliability?.timeoutSeconds ?? 0) > 0 ? (automation.action.timeoutSeconds ?? automation.reliability?.timeoutSeconds) * 1e3 : 300 * 1e3;
 		return withTimeout(this.executeWithoutTimeout(automation, run, signal), timeoutMs, signal).catch((err) => {
 			const message = err instanceof Error ? err.message : String(err);
 			return {

package/dist/src/cli/commands/doctor/checks/database-schema.js

@@ -52,7 +52,7 @@ async function checkDatabaseSchema(ctx) {
 		id: "database-schema",
 		label: "Database schema",
 		status: "pass",
-		message: `SQLite schema v${status.dbVersion} (current release v66).`,
+		message: `SQLite schema v${status.dbVersion} (current release v67).`,
 		hints: []
 	};
 }

package/dist/src/cli/commands/gateway/lifecycle.js

@@ -3,8 +3,8 @@ import { loadConfig } from "../../../config/loader.js";
 import "../../../config/index.js";
 import { isRestartEnabled } from "../../../config/commands.flags.js";
 import { resolveGatewayService } from "../../../daemon/service.js";
-import { authorizeGatewaySigusr1Restart, writeGatewayRestartIntentSync } from "../../../infra/restart.js";
 import { findVerifiedGatewayListenerPidsOnPortSync, formatGatewayPidList, signalVerifiedGatewayPidSync } from "../../../infra/gateway-processes.js";
+import { authorizeGatewaySigusr1Restart, writeGatewayRestartIntentSync } from "../../../infra/restart.js";
 import { runServiceRestart, runServiceStop } from "./lifecycle-core.js";
 import { DEFAULT_RESTART_HEALTH_ATTEMPTS, renderGatewayPortHealthDiagnostics, waitForGatewayHealthyListener } from "./restart-health.js";
 import { parsePortFromArgs, renderGatewayServiceStartHints, resolveGatewayPortFromConfig } from "./shared.js";

package/dist/src/cli/commands/skills.js

@@ -3,8 +3,8 @@ import { init_paths, resolveBundledSkillsDir, resolveSkillsLockPath } from "../.
 import { findInstallSpec, getDefaultInstallerPreferences, hasBinary, installSkill } from "../../agent/skills/installer.js";
 import { createSkillConfigManager, isSkillEnabled } from "../../agent/skills/config.js";
 import { formatScanSummary, scanSkillDirectory } from "../../agent/skills/scanner.js";
-import { loadSkillsLock } from "../../agent/skills/hub-lock.js";
 import { createSkillLoader } from "../../agent/skills/index.js";
+import { loadSkillsLock } from "../../agent/skills/hub-lock.js";
 import { pullSkillFromSource, updateSkillFromLock } from "../../agent/skills/hub-pull.js";
 import { register } from "../registry.js";
 import { createSkillsTestCommand } from "./skills-test.js";