@xopcai/xopc 0.0.174 → 0.0.176

package/dist/src/gateway/hono/routes/project-skills.js

@@ -0,0 +1,119 @@
+import { ProjectSkillError, ProjectSkillService } from "../../../projects/project-skill-service.js";
+import "../../../projects/index.js";
+//#region src/gateway/hono/routes/project-skills.ts
+function projectSkills(deps) {
+	return new ProjectSkillService({
+		projects: deps.service.projects,
+		getConfig: () => deps.service.currentConfig,
+		refreshSkills: () => deps.service.agentService.refreshSkillsAfterDiskChange()
+	});
+}
+function errorResponse(c, error) {
+	if (error instanceof ProjectSkillError) return c.json({
+		ok: false,
+		code: error.code,
+		error: error.message
+	}, error.status);
+	return c.json({
+		ok: false,
+		code: "project_skill_operation_failed",
+		error: error instanceof Error ? error.message : String(error)
+	}, 400);
+}
+function registerProjectSkillRoutes(authenticated, deps) {
+	authenticated.get("/api/projects/:projectId/skills", (c) => {
+		try {
+			return c.json({
+				ok: true,
+				...projectSkills(deps).list(c.req.param("projectId"))
+			});
+		} catch (error) {
+			return errorResponse(c, error);
+		}
+	});
+	authenticated.get("/api/projects/:projectId/skills/:skillId", (c) => {
+		try {
+			return c.json({
+				ok: true,
+				skill: projectSkills(deps).getContent(c.req.param("projectId"), c.req.param("skillId"))
+			});
+		} catch (error) {
+			return errorResponse(c, error);
+		}
+	});
+	authenticated.post("/api/projects/:projectId/skills/upload", async (c) => {
+		try {
+			const body = await c.req.parseBody();
+			const file = body.file;
+			if (!(file instanceof File)) return c.json({
+				ok: false,
+				error: "Skill zip file is required"
+			}, 400);
+			const skill = await projectSkills(deps).installZip(c.req.param("projectId"), Buffer.from(await file.arrayBuffer()), {
+				skillId: typeof body.skillId === "string" ? body.skillId : void 0,
+				overwrite: body.overwrite === "true"
+			});
+			return c.json({
+				ok: true,
+				skill
+			}, 201);
+		} catch (error) {
+			return errorResponse(c, error);
+		}
+	});
+	authenticated.post("/api/projects/:projectId/skills/marketplace/install", async (c) => {
+		try {
+			const body = await c.req.json();
+			const name = typeof body.name === "string" ? body.name.trim() : "";
+			if (!name) return c.json({
+				ok: false,
+				error: "Marketplace skill name is required"
+			}, 400);
+			const skill = await projectSkills(deps).installMarketplace(c.req.param("projectId"), {
+				name,
+				version: typeof body.version === "string" ? body.version : void 0,
+				provider: typeof body.provider === "string" ? body.provider : void 0,
+				overwrite: body.overwrite === true
+			});
+			return c.json({
+				ok: true,
+				skill
+			}, 201);
+		} catch (error) {
+			return errorResponse(c, error);
+		}
+	});
+	authenticated.post("/api/projects/:projectId/skills/source/install", async (c) => {
+		try {
+			const body = await c.req.json();
+			const source = typeof body.source === "string" ? body.source.trim() : "";
+			if (!source) return c.json({
+				ok: false,
+				error: "Skill source is required"
+			}, 400);
+			const skill = await projectSkills(deps).installSource(c.req.param("projectId"), {
+				source,
+				skillId: typeof body.skillId === "string" ? body.skillId : void 0,
+				ref: typeof body.ref === "string" ? body.ref : void 0,
+				subpath: typeof body.subpath === "string" ? body.subpath : void 0,
+				force: body.force === true
+			});
+			return c.json({
+				ok: true,
+				skill
+			}, 201);
+		} catch (error) {
+			return errorResponse(c, error);
+		}
+	});
+	authenticated.delete("/api/projects/:projectId/skills/:skillId", async (c) => {
+		try {
+			await projectSkills(deps).remove(c.req.param("projectId"), c.req.param("skillId"));
+			return c.json({ ok: true });
+		} catch (error) {
+			return errorResponse(c, error);
+		}
+	});
+}
+//#endregion
+export { registerProjectSkillRoutes };

package/dist/src/gateway/hono/routes/update.js

@@ -1,11 +1,11 @@
 import { PACKAGE_VERSION, init_package_version } from "../../../package-version.js";
 import { loadConfig } from "../../../config/loader.js";
 import "../../../config/index.js";
-import { acquireUpdateLock } from "../../../infra/update-lock.js";
 import { normalizeUpdateChannel } from "../../../infra/update-channels.js";
+import { acquireUpdateLock } from "../../../infra/update-lock.js";
+import { formatUpdateApiResult, runGatewayUpdateWithPostSteps } from "../../../infra/update-runner.js";
 import { getUpdateAvailable, runGatewayUpdateCheck } from "../../../infra/update-startup.js";
 import { createGatewayRouteLogger } from "../lib/route-logger.js";
-import { formatUpdateApiResult, runGatewayUpdateWithPostSteps } from "../../../infra/update-runner.js";
 import { streamSSE } from "hono/streaming";
 //#region src/gateway/hono/routes/update.ts
 init_package_version();

package/dist/src/gateway/index.js

@@ -1,5 +1,6 @@
 import { buildDefaultCorsOrigins, isAllInterfacesHost, isLoopbackHost, resolveEffectiveGatewayPort, resolveGatewayServiceListenPort } from "./host.js";
 import { defaultGatewayBindMode, isContainerEnvironment, resolveGatewayBindHost, resolveGatewayBindHostSync, resolveGatewayBindMode, resolveGatewayEffectiveHost } from "../config/gateway-bind.js";
+import { checkPortAvailable, forceFreePortAndWait, listPortListeners, parseLsofOutput } from "./ports.js";
 import { assertGatewayAuthConfigured, extractToken, resolveGatewayAuth, validateToken } from "./auth.js";
 import { resolveGatewayListenHost, resolveGatewayListenPlan } from "./listen.js";
 import { buckets } from "./rate-limit/buckets.js";
@@ -13,7 +14,6 @@ import { createHonoApp } from "./hono/app.js";
 import { GatewayServer } from "./server.js";
 import { GatewayLockError, acquireGatewayLock } from "./lock.js";
 import { runGatewayLoop } from "./run-loop.js";
-import { checkPortAvailable, forceFreePortAndWait, listPortListeners, parseLsofOutput } from "./ports.js";
 import { apiError, apiOk } from "./protocol.js";
 import "./hono/index.js";
 import { assertSecureGatewayHttpUrl, assertSecureWebSocketUrl, isInsecurePrivateWsAllowed, isSecureWebSocketUrl } from "./ws-security.js";

package/dist/src/gateway/run-loop.js

@@ -1,10 +1,10 @@
 import { loadConfig } from "../config/loader.js";
 import "../config/index.js";
 import { isRestartEnabled } from "../config/commands.flags.js";
+import { consumeGatewayRestartIntentSync, consumeGatewaySigusr1RestartAuthorization, isGatewaySigusr1RestartExternallyAllowed, resetGatewayRestartStateForInProcessRestart, scheduleGatewaySigusr1Restart, setGatewaySigusr1RestartPolicy } from "../infra/restart.js";
 import { runBootstrapMigrationsSync } from "../migrations/runner.js";
 import { restartGatewayProcessWithFreshPid } from "./respawn.js";
 import { acquireGatewayLock } from "./lock.js";
-import { consumeGatewayRestartIntentSync, consumeGatewaySigusr1RestartAuthorization, isGatewaySigusr1RestartExternallyAllowed, resetGatewayRestartStateForInProcessRestart, scheduleGatewaySigusr1Restart, setGatewaySigusr1RestartPolicy } from "../infra/restart.js";
 //#region src/gateway/run-loop.ts
 /**
 * Gateway Run Loop - Core run loop for gateway process management

package/dist/src/gateway/service/sessions-api.d.ts

@@ -88,7 +88,8 @@ export declare class GatewaySessionsApi {
     patchAgentConfig(sessionKey: string, body: {
         thinkingLevel?: string;
         model?: string | null;
-        reasoningLevel?: string;
+        activityDetailLevel?: string | null;
+        reasoningLevel?: string | null;
         verboseLevel?: string;
         workingDirectory?: string;
     }): Promise<import("../../agent/session/session-config-service.js").PatchSessionAgentConfigResult>;

package/dist/src/gateway/service.js

@@ -50,6 +50,11 @@ import { FocusService } from "../focuses/service.js";
 import { processFocusMonitorRun } from "../focuses/run-processor.js";
 import { startFocusReconciler } from "../focuses/reconciler.js";
 import "../focuses/index.js";
+import { LocalAppService } from "../local-apps/service.js";
+import "../local-apps/index.js";
+import { scheduleGatewayUpdateCheck } from "../infra/update-startup.js";
+import { runBootstrapMigrationsSync } from "../migrations/runner.js";
+import { MobileNotificationService } from "../mobile/notification-service.js";
 import { assertGatewayAuthConfigured, extractToken, resolveGatewayAuth, validateToken } from "./auth.js";
 import { reconcileDreamingAutomations } from "./dreaming-automation-reconciler.js";
 import { NotesStore } from "../notes/store.js";
@@ -75,13 +80,8 @@ import "./rate-limit/index.js";
 import { assertGatewayRuntimeConfig } from "./runtime-config.js";
 import { auditGatewayConfig } from "./security/audit.js";
 import { ModelCatalogSyncService } from "../providers/model-catalog-sync-service.js";
-import { runBootstrapMigrationsSync } from "../migrations/runner.js";
-import { MobileNotificationService } from "../mobile/notification-service.js";
-import { LocalAppService } from "../local-apps/service.js";
-import "../local-apps/index.js";
 import { createRuntimeBrowserRecipeService } from "../browser/recipes/runtime-service.js";
 import "../browser/recipes/index.js";
-import { scheduleGatewayUpdateCheck } from "../infra/update-startup.js";
 import { resolveChannelConnectDeferSet } from "./resolve-channel-connect-defer.js";
 import { restartGatewayProcessWithFreshPid } from "./respawn.js";
 import { GatewaySessionsApi } from "./service/sessions-api.js";

package/dist/src/heartbeat/index.js

@@ -1,6 +1,6 @@
 import { DEFAULT_ACK_MAX_CHARS, HEARTBEAT_OK, NO_REPLY, shouldSilence, stripHeartbeatToken } from "./tokens.js";
-import { appendCronEventLines } from "./event-prompt.js";
 import { isWithinActiveHours } from "./active-hours.js";
 import { isHeartbeatContentEmpty } from "./content-check.js";
+import { appendCronEventLines } from "./event-prompt.js";
 import { createHeartbeatWake } from "./wake.js";
 export { DEFAULT_ACK_MAX_CHARS, HEARTBEAT_OK, NO_REPLY, appendCronEventLines, createHeartbeatWake, isHeartbeatContentEmpty, isWithinActiveHours, shouldSilence, stripHeartbeatToken };

package/dist/src/infra/gateway-processes.js

@@ -1,5 +1,5 @@
-import { listPortListeners } from "../gateway/ports.js";
 import { isGatewayArgv, parseProcCmdline } from "./gateway-process-argv.js";
+import { listPortListeners } from "../gateway/ports.js";
 import fs from "node:fs";
 import { spawnSync } from "node:child_process";
 //#region src/infra/gateway-processes.ts

package/dist/src/infra/update-restart.js

@@ -4,8 +4,8 @@ import { init_paths, resolveConfigPath } from "../config/paths.js";
 import { init_loader, loadConfig } from "../config/loader.js";
 import { isRestartEnabled } from "../config/commands.flags.js";
 import { resolveGatewayService } from "../daemon/service.js";
-import { authorizeGatewaySigusr1Restart, writeGatewayRestartIntentSync } from "./restart.js";
 import { findVerifiedGatewayListenerPidsOnPortSync, signalVerifiedGatewayPidSync } from "./gateway-processes.js";
+import { authorizeGatewaySigusr1Restart, writeGatewayRestartIntentSync } from "./restart.js";
 import { refreshGatewayServiceAfterUpdate } from "./update-service-refresh.js";
 //#region src/infra/update-restart.ts
 init_loader();

package/dist/src/infra/update-runner.js

@@ -1,11 +1,11 @@
 import { runPostUpdateExtensionSync } from "../extensions/update.js";
-import "./update-channels.js";
-import { compareSemver, resolveNpmChannelTag } from "./update-check.js";
 import { readPackageName, readPackageVersion } from "./package-json.js";
 import { createDefaultCommandRunner, runCommandWithTimeout } from "./run-command.js";
 import { XOPC_PACKAGE_NAME, cleanupGlobalRenameDirs, createGlobalInstallEnv, detectGlobalInstallManagerForRoot, resolveGlobalInstallSpec, resolveGlobalInstallTarget } from "./update-global.js";
 import { runGlobalPackageUpdateSteps } from "./package-update-steps.js";
 import { resolveStableNodePath } from "./stable-node-path.js";
+import "./update-channels.js";
+import { compareSemver, resolveNpmChannelTag } from "./update-check.js";
 import { trimLogTail } from "./update-log.js";
 import { maybeRestartGatewayAfterUpdate } from "./update-restart.js";
 import path from "node:path";

package/dist/src/infra/update-startup.js

@@ -3,9 +3,9 @@ import { init_paths_state, resolveUpdateCheckStatePath } from "../config/paths-s
 import { createLogger } from "../utils/logger/index.js";
 import { init_logger } from "../utils/logger.js";
 import { init_write_file_atomic, writeTextAtomic } from "./write-file-atomic.js";
-import { acquireUpdateLock } from "./update-lock.js";
 import { normalizeUpdateChannel } from "./update-channels.js";
 import { compareSemver, detectInstallKind, resolveNpmChannelTag, resolvePackageRoot } from "./update-check.js";
+import { acquireUpdateLock } from "./update-lock.js";
 import { createHash, randomUUID } from "node:crypto";
 import { readFile } from "node:fs/promises";
 //#region src/infra/update-startup.ts

package/dist/src/mcp/channel-bridge.js

@@ -1,9 +1,9 @@
 import { createLogger } from "../utils/logger/index.js";
 import { init_logger } from "../utils/logger.js";
 import { init_loader, loadConfig } from "../config/loader.js";
-import { gatewayCredentialAuthorization } from "../gateway/credential.js";
 import { loadUndiciRuntimeDeps } from "../infra/undici-fetch.js";
 import { toConversation } from "./channel-shared.js";
+import { gatewayCredentialAuthorization } from "../gateway/credential.js";
 import { createGatewayHttpClientFromConfig, resolveGatewayHttpBaseUrl } from "./gateway-http-client.js";
 //#region src/mcp/channel-bridge.ts
 init_loader();

package/dist/src/projects/index.d.ts

@@ -1,6 +1,7 @@
 export * from './types.js';
 export * from './project-store.js';
 export * from './project-service.js';
+export * from './project-skill-service.js';
 export * from './project-agent.js';
 export * from './project-agent-suggestion.js';
 export * from './project-kind.js';

package/dist/src/projects/index.js

@@ -4,6 +4,7 @@ import { bindGoalToProject, bindGoalsToProject, listProjectGoalIds, unbindGoalFr
 import { bindSessionToProject, bindSessionsToProject, listProjectSessionKeys, moveSessionToProject, unbindSessionFromProject } from "./session-bind.js";
 import { ProjectWorkspaceConflictError, ProjectWorkspaceMissingError, canonicalWorkspacePath, ensureWorkspaceDirectory, inferProjectNameFromWorkspaceRoot, isPathSameOrInsideWorkspace, isSafeAutoCreateWorkspaceRoot, resolveWorkspaceProjectRoot, workspaceDirectoryExists } from "./workspace-project.js";
 import { ProjectService } from "./project-service.js";
+import { ProjectSkillError, ProjectSkillService } from "./project-skill-service.js";
 import { isValidProjectAgentId, normalizeProjectAgentId, resolveProjectAgentId } from "./project-agent.js";
 import { inferProjectKind } from "./project-kind.js";
 import { CODING_PROJECT_AGENT_ID, inferSuggestedProjectDefaultAgentId, suggestProjectDefaultAgentId } from "./project-agent-suggestion.js";
@@ -11,4 +12,4 @@ import { buildProjectLoopOverview } from "./project-loop.js";
 import { bindWorkflowRunToProject } from "./workflow-bind.js";
 import { bindAutomationToProject } from "./automation-bind.js";
 import { bindMemoryRecordToProject } from "./memory-bind.js";
-export { CODING_PROJECT_AGENT_ID, ProjectService, ProjectStore, ProjectWorkspaceConflictError, ProjectWorkspaceMissingError, bindAutomationToProject, bindGoalToProject, bindGoalsToProject, bindMemoryRecordToProject, bindSessionToProject, bindSessionsToProject, bindWorkflowRunToProject, buildProjectLoopOverview, canonicalWorkspacePath, ensureWorkspaceDirectory, getProjectForSession, getProjectWorkspacePathForSession, inferProjectKind, inferProjectNameFromWorkspaceRoot, inferSuggestedProjectDefaultAgentId, isPathSameOrInsideWorkspace, isSafeAutoCreateWorkspaceRoot, isValidProjectAgentId, listProjectGoalIds, listProjectSessionKeys, moveSessionToProject, normalizeProjectAgentId, resolveProjectAgentId, resolveProjectWorkspacePath, resolveWorkspaceProjectRoot, slugifyProjectName, suggestProjectDefaultAgentId, unbindGoalFromProject, unbindSessionFromProject, workspaceDirectoryExists };
+export { CODING_PROJECT_AGENT_ID, ProjectService, ProjectSkillError, ProjectSkillService, ProjectStore, ProjectWorkspaceConflictError, ProjectWorkspaceMissingError, bindAutomationToProject, bindGoalToProject, bindGoalsToProject, bindMemoryRecordToProject, bindSessionToProject, bindSessionsToProject, bindWorkflowRunToProject, buildProjectLoopOverview, canonicalWorkspacePath, ensureWorkspaceDirectory, getProjectForSession, getProjectWorkspacePathForSession, inferProjectKind, inferProjectNameFromWorkspaceRoot, inferSuggestedProjectDefaultAgentId, isPathSameOrInsideWorkspace, isSafeAutoCreateWorkspaceRoot, isValidProjectAgentId, listProjectGoalIds, listProjectSessionKeys, moveSessionToProject, normalizeProjectAgentId, resolveProjectAgentId, resolveProjectWorkspacePath, resolveWorkspaceProjectRoot, slugifyProjectName, suggestProjectDefaultAgentId, unbindGoalFromProject, unbindSessionFromProject, workspaceDirectoryExists };

package/dist/src/projects/project-skill-service.d.ts

@@ -0,0 +1,67 @@
+import type { Config } from '../config/schema.js';
+import type { SkillDiagnostic, SkillMetadata, SkillToolConditions } from '../agent/skills/types.js';
+import type { ProjectService } from './project-service.js';
+export type ProjectSkillErrorCode = 'project_not_found' | 'project_workspace_required' | 'project_workspace_missing' | 'project_workspace_not_writable' | 'skill_not_found' | 'invalid_skill_id';
+export declare class ProjectSkillError extends Error {
+    readonly code: ProjectSkillErrorCode;
+    readonly status: 400 | 403 | 404 | 409;
+    constructor(code: ProjectSkillErrorCode, status: 400 | 403 | 404 | 409, message: string);
+}
+export interface ProjectSkillSummary {
+    id: string;
+    name: string;
+    description: string;
+    category?: string;
+    disableModelInvocation: boolean;
+    metadata: SkillMetadata;
+    toolConditions?: SkillToolConditions;
+    requiredEnvVarNames?: string[];
+}
+export interface ProjectSkillListResult {
+    workspaceRoot: string;
+    skillsRoot: string;
+    items: ProjectSkillSummary[];
+    diagnostics: SkillDiagnostic[];
+}
+interface ProjectSkillServiceOptions {
+    projects: ProjectService;
+    getConfig: () => Config;
+    refreshSkills: () => void | Promise<void>;
+}
+export declare class ProjectSkillService {
+    private readonly options;
+    constructor(options: ProjectSkillServiceOptions);
+    list(projectId: string): ProjectSkillListResult;
+    getContent(projectId: string, skillId: string): ProjectSkillSummary & {
+        bodyMarkdown: string;
+    };
+    installZip(projectId: string, buffer: Buffer, input?: {
+        skillId?: string;
+        overwrite?: boolean;
+    }): Promise<ProjectSkillSummary & {
+        bodyMarkdown: string;
+    }>;
+    installMarketplace(projectId: string, input: {
+        name: string;
+        version?: string;
+        provider?: string;
+        overwrite?: boolean;
+    }): Promise<ProjectSkillSummary & {
+        bodyMarkdown: string;
+    }>;
+    installSource(projectId: string, input: {
+        source: string;
+        skillId?: string;
+        ref?: string;
+        subpath?: string;
+        force?: boolean;
+    }): Promise<ProjectSkillSummary & {
+        bodyMarkdown: string;
+    }>;
+    remove(projectId: string, skillId: string): Promise<void>;
+    private findSkill;
+    private resolveLocation;
+    private isDirectSkill;
+    private toSummary;
+}
+export {};

package/dist/src/projects/project-skill-service.js

@@ -0,0 +1,131 @@
+import { resolveWorkspaceSkillsDir, resolveWorkspaceSkillsLockPath } from "../agent/skills/workspace-skills-dir.js";
+import { loadWorkspaceSkills } from "../agent/skills/index.js";
+import { removeSkillsLockEntry } from "../agent/skills/hub-lock.js";
+import { deleteManagedSkill, installSkillFromZip, isValidSkillId } from "../agent/skills/managed-store.js";
+import { pullSkillFromSource } from "../agent/skills/hub-pull.js";
+import { downloadFromMarketplace } from "../agent/skills/skills-marketplace.js";
+import { basename, dirname, join, relative, resolve, sep } from "node:path";
+import { accessSync, constants, existsSync, statSync } from "node:fs";
+//#region src/projects/project-skill-service.ts
+var ProjectSkillError = class extends Error {
+	constructor(code, status, message) {
+		super(message);
+		this.code = code;
+		this.status = status;
+		this.name = "ProjectSkillError";
+	}
+};
+var ProjectSkillService = class {
+	constructor(options) {
+		this.options = options;
+	}
+	list(projectId) {
+		const location = this.resolveLocation(projectId, false);
+		const loaded = loadWorkspaceSkills(location.workspaceRoot);
+		return {
+			...location,
+			items: loaded.skills.filter((skill) => this.isDirectSkill(skill, location.skillsRoot)).map((skill) => this.toSummary(skill)),
+			diagnostics: loaded.diagnostics
+		};
+	}
+	getContent(projectId, skillId) {
+		const { skill } = this.findSkill(projectId, skillId);
+		return {
+			...this.toSummary(skill),
+			bodyMarkdown: skill.content
+		};
+	}
+	async installZip(projectId, buffer, input = {}) {
+		const location = this.resolveLocation(projectId, true);
+		const installed = installSkillFromZip(buffer, {
+			skillId: input.skillId,
+			overwrite: input.overwrite,
+			rootDir: location.skillsRoot
+		});
+		removeSkillsLockEntry(installed.skillId, resolveWorkspaceSkillsLockPath(location.workspaceRoot));
+		await this.options.refreshSkills();
+		return this.getContent(projectId, installed.skillId);
+	}
+	async installMarketplace(projectId, input) {
+		const downloaded = await downloadFromMarketplace(this.options.getConfig(), input.name, input.version, input.provider);
+		return this.installZip(projectId, downloaded.buffer, {
+			skillId: downloaded.skillId,
+			overwrite: input.overwrite
+		});
+	}
+	async installSource(projectId, input) {
+		const location = this.resolveLocation(projectId, true);
+		const installed = await pullSkillFromSource(input.source, {
+			skillId: input.skillId,
+			ref: input.ref,
+			subpath: input.subpath,
+			force: input.force,
+			installRoot: location.skillsRoot,
+			lockPath: resolveWorkspaceSkillsLockPath(location.workspaceRoot)
+		});
+		await this.options.refreshSkills();
+		return this.getContent(projectId, installed.skillId);
+	}
+	async remove(projectId, skillId) {
+		const location = this.resolveLocation(projectId, true);
+		if (!isValidSkillId(skillId)) throw new ProjectSkillError("invalid_skill_id", 400, "Invalid skill id");
+		if (!existsSync(join(location.skillsRoot, skillId, "SKILL.md"))) throw new ProjectSkillError("skill_not_found", 404, "Project skill not found");
+		deleteManagedSkill(skillId, location.skillsRoot);
+		removeSkillsLockEntry(skillId, resolveWorkspaceSkillsLockPath(location.workspaceRoot));
+		await this.options.refreshSkills();
+	}
+	findSkill(projectId, skillId) {
+		if (!isValidSkillId(skillId)) throw new ProjectSkillError("invalid_skill_id", 400, "Invalid skill id");
+		const location = this.resolveLocation(projectId, false);
+		const skill = loadWorkspaceSkills(location.workspaceRoot).skills.find((item) => {
+			return !relative(location.skillsRoot, item.baseDir).includes(sep) && basename(item.baseDir) === skillId;
+		});
+		if (!skill) throw new ProjectSkillError("skill_not_found", 404, "Project skill not found");
+		return {
+			skill,
+			skillsRoot: location.skillsRoot
+		};
+	}
+	resolveLocation(projectId, requireWritable) {
+		const project = this.options.projects.get(projectId);
+		if (!project) throw new ProjectSkillError("project_not_found", 404, "Project not found");
+		const configuredRoot = project.workspaceRoot?.trim();
+		if (!configuredRoot) throw new ProjectSkillError("project_workspace_required", 409, "Project workspace is required");
+		const workspaceRoot = resolve(configuredRoot);
+		try {
+			if (!existsSync(workspaceRoot) || !statSync(workspaceRoot).isDirectory()) throw new ProjectSkillError("project_workspace_missing", 409, "Project workspace does not exist");
+		} catch (error) {
+			if (error instanceof ProjectSkillError) throw error;
+			throw new ProjectSkillError("project_workspace_missing", 409, "Project workspace does not exist");
+		}
+		const skillsRoot = resolveWorkspaceSkillsDir(workspaceRoot);
+		if (requireWritable) try {
+			const xopcRoot = dirname(skillsRoot);
+			accessSync(existsSync(skillsRoot) ? skillsRoot : existsSync(xopcRoot) ? xopcRoot : workspaceRoot, constants.W_OK);
+		} catch {
+			throw new ProjectSkillError("project_workspace_not_writable", 403, "Project workspace is not writable");
+		}
+		return {
+			workspaceRoot,
+			skillsRoot
+		};
+	}
+	isDirectSkill(skill, skillsRoot) {
+		const rel = relative(skillsRoot, skill.baseDir);
+		return Boolean(rel) && !rel.includes(sep) && isValidSkillId(basename(skill.baseDir));
+	}
+	toSummary(skill) {
+		return {
+			id: basename(skill.baseDir),
+			name: skill.name,
+			description: skill.description,
+			category: skill.category,
+			disableModelInvocation: skill.disableModelInvocation,
+			metadata: skill.metadata,
+			toolConditions: skill.toolConditions,
+			requiredEnvVarNames: skill.requiredEnvVarNames
+		};
+	}
+};
+//#endregion
+export { ProjectSkillError, ProjectSkillService };

package/dist/src/providers/index.js

@@ -5,10 +5,11 @@ import { hasProviderAuthOnDiskSync, init_sync_provider_auth } from "../auth/sync
 import { PROVIDER_ENV_MAP, getApiKeyFromEnv, init_env_keys } from "./env-keys.js";
 import { init_model_ref, splitProviderModelRef } from "./model-ref.js";
 import { ModelRegistry, getModelRegistry, init_model_registry, prewarmModelRegistry, resetModelRegistry } from "./model-registry.js";
-import { CredentialResolver, hasCredentials, init_credentials, resolveApiKey } from "../auth/credentials.js";
+import { CredentialResolver, hasCredentials, init_credentials } from "../auth/credentials.js";
 import { EXTENSION_PROVIDER_BASE_URL, init_constants } from "./constants.js";
 import { getSupplementalModels, init_model_supplements } from "./model-supplements.js";
 import { getProviderRegistry, init_plugin_registry } from "./plugin-registry.js";
+import { init_provider_auth_service, resolveProviderApiKey } from "./provider-auth-service.js";
 import { getModel, getModels, getProviders } from "@earendil-works/pi-ai/compat";
 //#region src/providers/index.ts
 /**
@@ -144,7 +145,7 @@ function getAllProviders() {
 }
 async function getApiKey(provider, credentialOptions) {
 	if (getProviderRegistry().has(provider)) return "extension-managed";
-	const credentialKey = await resolveApiKey(provider, credentialOptions);
+	const credentialKey = await resolveProviderApiKey(provider, credentialOptions);
 	if (credentialKey) return credentialKey;
 	const registryKey = getModelRegistry().getApiKey(provider);
 	if (registryKey) return registryKey;
@@ -320,6 +321,7 @@ var init_providers = __esmMin((() => {
 	init_model_supplements();
 	init_model_ref();
 	init_plugin_registry();
+	init_provider_auth_service();
 	OPENAI_CODEX_CANONICAL_BASE_URL = "https://chatgpt.com/backend-api/codex";
 	PROVIDER_META = {
 		"xopc-cloud": {

package/dist/src/providers/provider-auth-service.d.ts

@@ -0,0 +1,22 @@
+import { ModelRuntime } from '@earendil-works/pi-coding-agent';
+import { CredentialResolver, type CredentialResolverOptions } from '../auth/credentials.js';
+import { XopcModelCredentialStore } from '../auth/model-credential-store.js';
+type ApiKeyResolver = Pick<CredentialResolver, 'resolveApiKey'>;
+export interface ProviderAuthServiceOptions {
+    credentials?: XopcModelCredentialStore;
+    resolver?: ApiKeyResolver;
+    runtimeFactory?: (credentials: XopcModelCredentialStore) => Promise<ModelRuntime>;
+}
+/** Resolves request credentials while keeping OAuth refresh inside the shared persistent store. */
+export declare class ProviderAuthService {
+    private readonly credentials;
+    private readonly resolver;
+    private readonly runtimeFactory;
+    private runtime;
+    constructor(options?: ProviderAuthServiceOptions);
+    resolveApiKey(providerId: string, signal?: AbortSignal): Promise<string | null>;
+    private getRuntime;
+}
+export declare function getProviderAuthService(): ProviderAuthService;
+export declare function resolveProviderApiKey(providerId: string, credentialOptions?: CredentialResolverOptions): Promise<string | null>;
+export {};

package/dist/src/providers/provider-auth-service.js

@@ -0,0 +1,66 @@
+import { __esmMin } from "../../_virtual/_rolldown/runtime.js";
+import { init_paths, resolveModelsJsonPath } from "../config/paths.js";
+import { CredentialResolver, init_credentials } from "../auth/credentials.js";
+import { XopcModelCredentialStore, init_model_credential_store } from "../auth/model-credential-store.js";
+import { init_register_runtime_providers, registerRuntimeProviders } from "./register-runtime-providers.js";
+import { InMemoryModelsStore } from "@earendil-works/pi-ai";
+import { ModelRuntime } from "@earendil-works/pi-coding-agent";
+//#region src/providers/provider-auth-service.ts
+async function createAuthRuntime(credentials) {
+	const runtime = await ModelRuntime.create({
+		credentials,
+		modelsPath: resolveModelsJsonPath(),
+		modelsStore: new InMemoryModelsStore()
+	});
+	registerRuntimeProviders(runtime);
+	return runtime;
+}
+function getProviderAuthService() {
+	defaultProviderAuthService ??= new ProviderAuthService();
+	return defaultProviderAuthService;
+}
+async function resolveProviderApiKey(providerId, credentialOptions) {
+	if (!credentialOptions) return await getProviderAuthService().resolveApiKey(providerId);
+	const resolver = new CredentialResolver(credentialOptions);
+	return await new ProviderAuthService({
+		credentials: new XopcModelCredentialStore(resolver),
+		resolver
+	}).resolveApiKey(providerId);
+}
+var ProviderAuthService, defaultProviderAuthService;
+var init_provider_auth_service = __esmMin((() => {
+	init_credentials();
+	init_model_credential_store();
+	init_paths();
+	init_register_runtime_providers();
+	ProviderAuthService = class {
+		credentials;
+		resolver;
+		runtimeFactory;
+		runtime;
+		constructor(options = {}) {
+			const defaultResolver = new CredentialResolver();
+			this.resolver = options.resolver ?? defaultResolver;
+			this.credentials = options.credentials ?? new XopcModelCredentialStore(defaultResolver);
+			this.runtimeFactory = options.runtimeFactory ?? createAuthRuntime;
+		}
+		async resolveApiKey(providerId, signal) {
+			if ((await this.credentials.read(providerId, { signal }))?.type === "oauth") {
+				const runtime = await this.getRuntime();
+				const provider = runtime.getProvider(providerId);
+				if (provider?.auth.oauth && !provider.auth.apiKey) return (await runtime.getAuth(providerId, { signal }))?.auth.apiKey ?? null;
+			}
+			return await this.resolver.resolveApiKey(providerId);
+		}
+		getRuntime() {
+			this.runtime ??= this.runtimeFactory(this.credentials).catch((error) => {
+				this.runtime = void 0;
+				throw error;
+			});
+			return this.runtime;
+		}
+	};
+}));
+//#endregion
+init_provider_auth_service();
+export { ProviderAuthService, getProviderAuthService, init_provider_auth_service, resolveProviderApiKey };

package/dist/src/providers/register-runtime-providers.d.ts

@@ -0,0 +1,6 @@
+import type { ModelRuntime } from '@earendil-works/pi-coding-agent';
+import { type ModelCatalogSnapshot } from './model-catalog-store.js';
+type RuntimeProviderRegistrar = Pick<ModelRuntime, 'registerProvider'>;
+/** Register dynamically discovered model providers, including their OAuth contract. */
+export declare function registerRuntimeProviders(modelRuntime: RuntimeProviderRegistrar, catalog?: ModelCatalogSnapshot): void;
+export {};