@xopcai/xopc 0.0.175 → 0.0.176

package/dist/src/config/schema.js

@@ -64,7 +64,7 @@ function parseModelRef(ref) {
 		model: trimmed.slice(idx + 1).trim()
 	};
 }
-var AgentModelRefSchema, AgentImageGenerationModelSchema, AgentTypedModelRoleSchema, AgentTypedModelRolesSchema, AgentModelsSchema, AgentsConfigSchema, BrowserCloudConfigSchema, BrowserExtensionConfigSchema, BrowserCloakConfigSchema, BrowserConfigSchema, BindingMatchSchema, BindingRuleSchema, BindingsConfigSchema, SessionDmScopeSchema, SessionStorageConfigSchema, SessionResetModeSchema, SessionResetConfigSchema, SessionResetByTypeSchema, SessionScopeSchema, SessionConfigSchema, ChannelsConfigSchema, SearchProviderEntrySchema, WebSearchConfigSchema, WebsiteBlocklistSchema, WebToolsConfigSchema, ToolsConfigSchema, GatewayAuthRateLimitSchema, GatewaySecuritySchema, GatewayTrustedProxySchema, GatewayAuthSchema, GatewayTailscaleConsentSchema, GatewayTailscaleSchema, GatewayRemoteSchema, GatewayTlsSchema, GatewayModeSchema, HeartbeatConfigSchema, GatewayChannelConnectDeferModeSchema, TunnelConsentSchema, TunnelConfigSchema, WorkspaceImportConfigSchema, WorkspaceConfigSchema, GatewayBindModeSchema, GatewayConfigSchema, ModelsDevConfigSchema, ModelCatalogConfigSchema, SttProviderConfigCatchallSchema, STTProviderConfigSchema, STTFallbackConfigSchema, MediaUnderstandingCapabilitiesSchema, MediaUnderstandingModelSchema, STTConfigSchema, TtsProviderConfigCatchallSchema, TTSProviderConfigSchema, TTSFallbackConfigSchema, TTSModelOverridesConfigSchema, TTSEdgeConfigSchema, TTSSummarizationConfigSchema, TTSConfigSchema, VoiceRefinementConfigSchema, VoiceConfigSchema, MessagesConfigSchema, ToolsMediaAudioConfigSchema, ToolsMediaConfigSchema, ProviderAzureConfigSchema, ProviderRequestOverridesSchema, ProviderAuthConfigSchema, ProvidersConfigSchema, ExtensionSecurityConfigSchema, ExtensionSlotsConfigSchema, ExtensionsConfigSchema, UpdateAutoConfigSchema, GoalNotificationEventSchema, GoalNotificationTargetSchema, GoalNotificationsConfigSchema, GoalsConfigSchema, UpdateConfigSchema, CommandsConfigSchema, TuiConfigSchema, McpHttpUrlSchema, ConnectorSecretReferenceSchema, McpConfigScalarSchema, McpServerSchema, McpConfigSchema, CodeIntelligenceConfigSchema, ConnectorsConfigSchema, ExperimentalConfigSchema, ConfigSchema;
+var AgentModelRefSchema, AgentImageGenerationModelSchema, AgentTypedModelRoleSchema, AgentTypedModelRolesSchema, AgentModelsSchema, AgentsConfigSchema, BrowserCloudConfigSchema, BrowserExtensionConfigSchema, BrowserCloakConfigSchema, BrowserConfigSchema, BindingMatchSchema, BindingRuleSchema, BindingsConfigSchema, SessionDmScopeSchema, SessionStorageConfigSchema, SessionResetModeSchema, SessionResetConfigSchema, SessionResetByTypeSchema, SessionScopeSchema, SessionConfigSchema, ChannelsConfigSchema, SearchProviderEntrySchema, WebSearchConfigSchema, WebsiteBlocklistSchema, WebToolsConfigSchema, ToolsConfigSchema, GatewayAuthRateLimitSchema, GatewaySecuritySchema, GatewayTrustedProxySchema, GatewayAuthSchema, GatewayTailscaleConsentSchema, GatewayTailscaleSchema, GatewayRemoteSchema, GatewayTlsSchema, GatewayModeSchema, HeartbeatConfigSchema, GatewayChannelConnectDeferModeSchema, TunnelConsentSchema, TunnelConfigSchema, WorkspaceImportConfigSchema, WorkspaceConfigSchema, GatewayBindModeSchema, GatewayWebchatConfigSchema, GatewayConfigSchema, ModelsDevConfigSchema, ModelCatalogConfigSchema, SttProviderConfigCatchallSchema, STTProviderConfigSchema, STTFallbackConfigSchema, MediaUnderstandingCapabilitiesSchema, MediaUnderstandingModelSchema, STTConfigSchema, TtsProviderConfigCatchallSchema, TTSProviderConfigSchema, TTSFallbackConfigSchema, TTSModelOverridesConfigSchema, TTSEdgeConfigSchema, TTSSummarizationConfigSchema, TTSConfigSchema, VoiceRefinementConfigSchema, VoiceConfigSchema, MessagesConfigSchema, ToolsMediaAudioConfigSchema, ToolsMediaConfigSchema, ProviderAzureConfigSchema, ProviderRequestOverridesSchema, ProviderAuthConfigSchema, ProvidersConfigSchema, ExtensionSecurityConfigSchema, ExtensionSlotsConfigSchema, ExtensionsConfigSchema, UpdateAutoConfigSchema, GoalNotificationEventSchema, GoalNotificationTargetSchema, GoalNotificationsConfigSchema, GoalsConfigSchema, UpdateConfigSchema, CommandsConfigSchema, TuiConfigSchema, McpHttpUrlSchema, ConnectorSecretReferenceSchema, McpConfigScalarSchema, McpServerSchema, McpConfigSchema, CodeIntelligenceConfigSchema, ConnectorsConfigSchema, ExperimentalConfigSchema, ConfigSchema;
 var init_schema = __esmMin((() => {
 	init_schema$1();
 	init_preset_chain();
@@ -451,6 +451,13 @@ strict: z.boolean().optional() }).optional();
 		"tailnet",
 		"custom"
 	]);
+	GatewayWebchatConfigSchema = z.object({ 
+	/** Default visibility of AI execution activity in the Web UI. */
+activityDetailDefault: z.enum([
+		"off",
+		"on",
+		"stream"
+	]).default("on") }).default({ activityDetailDefault: "on" });
 	GatewayConfigSchema = z.object({
 		/** Semantic bind mode. */
 		bind: GatewayBindModeSchema.optional(),
@@ -465,6 +472,7 @@ strict: z.boolean().optional() }).optional();
 		tls: GatewayTlsSchema.optional(),
 		auth: GatewayAuthSchema.optional(),
 		heartbeat: HeartbeatConfigSchema.optional(),
+		webchat: GatewayWebchatConfigSchema.optional(),
 		maxSseConnections: z.number().optional(),
 		corsOrigins: z.array(z.string()).optional(),
 		/**
@@ -638,6 +646,7 @@ strict: z.boolean().optional() }).optional();
 			intervalMs: 18e5,
 			includeSystemPromptSection: false
 		},
+		webchat: { activityDetailDefault: "on" },
 		maxSseConnections: 100,
 		corsOrigins: [],
 		skillsMarketplaceProvider: "store",
@@ -1116,6 +1125,7 @@ workDiscoveryOnboarding: z.boolean().default(true) }).strict().default({ workDis
 				intervalMs: 18e5,
 				includeSystemPromptSection: false
 			},
+			webchat: { activityDetailDefault: "on" },
 			maxSseConnections: 100,
 			corsOrigins: [],
 			skillsMarketplaceProvider: "store",
@@ -1183,4 +1193,4 @@ workDiscoveryOnboarding: z.boolean().default(true) }).strict().default({ workDis
 }));
 //#endregion
 init_schema();
-export { AgentImageGenerationModelSchema, AgentModelRefSchema, AgentModelsSchema, AgentTypedModelRoleSchema, AgentsConfigSchema, BindingMatchSchema, BindingRuleSchema, BindingsConfigSchema, BrowserConfigSchema, ChannelsConfigSchema, CodeIntelligenceConfigSchema, CommandsConfigSchema, ConfigSchema, ConnectorsConfigSchema, ExperimentalConfigSchema, ExtensionSecurityConfigSchema, ExtensionSlotsConfigSchema, ExtensionsConfigSchema, GatewayAuthRateLimitSchema, GatewayAuthSchema, GatewayBindModeSchema, GatewayChannelConnectDeferModeSchema, GatewayConfigSchema, GatewayModeSchema, GatewayRemoteSchema, GatewaySecuritySchema, GatewayTailscaleConsentSchema, GatewayTailscaleSchema, GatewayTlsSchema, GatewayTrustedProxySchema, GoalNotificationEventSchema, GoalNotificationTargetSchema, GoalNotificationsConfigSchema, GoalsConfigSchema, HeartbeatConfigSchema, McpConfigSchema, McpServerSchema, MediaUnderstandingCapabilitiesSchema, MediaUnderstandingModelSchema, MessagesConfigSchema, ModelCatalogConfigSchema, ModelsDevConfigSchema, ProviderAuthConfigSchema, ProviderAzureConfigSchema, ProviderRequestOverridesSchema, ProvidersConfigSchema, STTConfigSchema, STTFallbackConfigSchema, STTProviderConfigSchema, SearchProviderEntrySchema, SessionConfigSchema, SessionDmScopeSchema, SessionResetByTypeSchema, SessionResetConfigSchema, SessionResetModeSchema, SessionScopeSchema, SessionStorageConfigSchema, TTSConfigSchema, TTSEdgeConfigSchema, TTSFallbackConfigSchema, TTSModelOverridesConfigSchema, TTSProviderConfigSchema, TTSSummarizationConfigSchema, TelegramAccountConfigSchema, TelegramConfigSchema, TelegramGroupConfigSchema, TelegramTopicConfigSchema, ToolsConfigSchema, ToolsMediaAudioConfigSchema, ToolsMediaConfigSchema, TuiConfigSchema, TunnelConfigSchema, TunnelConsentSchema, UpdateAutoConfigSchema, UpdateConfigSchema, VoiceConfigSchema, VoiceRefinementConfigSchema, WebSearchConfigSchema, WebToolsConfigSchema, WebsiteBlocklistSchema, WeixinAccountConfigSchema, WeixinConfigSchema, WorkspaceConfigSchema, WorkspaceImportConfigSchema, getAgentDefaultImageGenerationModelConfig, getAgentDefaultImageModelConfig, getAgentDefaultModelRef, init_schema, parseModelRef };
+export { AgentImageGenerationModelSchema, AgentModelRefSchema, AgentModelsSchema, AgentTypedModelRoleSchema, AgentsConfigSchema, BindingMatchSchema, BindingRuleSchema, BindingsConfigSchema, BrowserConfigSchema, ChannelsConfigSchema, CodeIntelligenceConfigSchema, CommandsConfigSchema, ConfigSchema, ConnectorsConfigSchema, ExperimentalConfigSchema, ExtensionSecurityConfigSchema, ExtensionSlotsConfigSchema, ExtensionsConfigSchema, GatewayAuthRateLimitSchema, GatewayAuthSchema, GatewayBindModeSchema, GatewayChannelConnectDeferModeSchema, GatewayConfigSchema, GatewayModeSchema, GatewayRemoteSchema, GatewaySecuritySchema, GatewayTailscaleConsentSchema, GatewayTailscaleSchema, GatewayTlsSchema, GatewayTrustedProxySchema, GatewayWebchatConfigSchema, GoalNotificationEventSchema, GoalNotificationTargetSchema, GoalNotificationsConfigSchema, GoalsConfigSchema, HeartbeatConfigSchema, McpConfigSchema, McpServerSchema, MediaUnderstandingCapabilitiesSchema, MediaUnderstandingModelSchema, MessagesConfigSchema, ModelCatalogConfigSchema, ModelsDevConfigSchema, ProviderAuthConfigSchema, ProviderAzureConfigSchema, ProviderRequestOverridesSchema, ProvidersConfigSchema, STTConfigSchema, STTFallbackConfigSchema, STTProviderConfigSchema, SearchProviderEntrySchema, SessionConfigSchema, SessionDmScopeSchema, SessionResetByTypeSchema, SessionResetConfigSchema, SessionResetModeSchema, SessionScopeSchema, SessionStorageConfigSchema, TTSConfigSchema, TTSEdgeConfigSchema, TTSFallbackConfigSchema, TTSModelOverridesConfigSchema, TTSProviderConfigSchema, TTSSummarizationConfigSchema, TelegramAccountConfigSchema, TelegramConfigSchema, TelegramGroupConfigSchema, TelegramTopicConfigSchema, ToolsConfigSchema, ToolsMediaAudioConfigSchema, ToolsMediaConfigSchema, TuiConfigSchema, TunnelConfigSchema, TunnelConsentSchema, UpdateAutoConfigSchema, UpdateConfigSchema, VoiceConfigSchema, VoiceRefinementConfigSchema, WebSearchConfigSchema, WebToolsConfigSchema, WebsiteBlocklistSchema, WeixinAccountConfigSchema, WeixinConfigSchema, WorkspaceConfigSchema, WorkspaceImportConfigSchema, getAgentDefaultImageGenerationModelConfig, getAgentDefaultImageModelConfig, getAgentDefaultModelRef, init_schema, parseModelRef };

package/dist/src/gateway/heartbeat/service.js

@@ -1,9 +1,9 @@
 import { createLogger } from "../../utils/logger/index.js";
 import { init_logger } from "../../utils/logger.js";
 import { shouldSilence, stripHeartbeatToken } from "../../heartbeat/tokens.js";
-import { appendCronEventLines } from "../../heartbeat/event-prompt.js";
 import { isWithinActiveHours } from "../../heartbeat/active-hours.js";
 import { isHeartbeatContentEmpty } from "../../heartbeat/content-check.js";
+import { appendCronEventLines } from "../../heartbeat/event-prompt.js";
 import { createHeartbeatWake } from "../../heartbeat/wake.js";
 import { resolveHeartbeatMdPath } from "../workspace-heartbeat-path.js";
 import { readFile } from "fs/promises";

package/dist/src/gateway/hono/lib/config-payload.d.ts

@@ -252,6 +252,9 @@ export declare function buildSafeWebConfigPayload(service: GatewayService, optio
                 timezone?: string;
             };
         };
+        webchat: {
+            activityDetailDefault: "stream" | "on" | "off";
+        };
         maxSseConnections: number;
         channelConnectDeferMode: "explicit" | "off" | "auto";
         channelConnectDeferIds: string[];

package/dist/src/gateway/hono/lib/config-payload.js

@@ -165,6 +165,7 @@ async function buildSafeWebConfigPayload(service, options = {}) {
 				isolatedSession: config.gateway?.heartbeat?.isolatedSession,
 				activeHours: config.gateway?.heartbeat?.activeHours
 			},
+			webchat: { activityDetailDefault: config.gateway?.webchat?.activityDetailDefault ?? "on" },
 			maxSseConnections: typeof config.gateway?.maxSseConnections === "number" ? config.gateway.maxSseConnections : 100,
 			channelConnectDeferMode: config.gateway?.channelConnectDeferMode ?? "auto",
 			channelConnectDeferIds: Array.isArray(config.gateway?.channelConnectDeferIds) ? config.gateway.channelConnectDeferIds : [],

package/dist/src/gateway/hono/oauth-async.d.ts

@@ -8,6 +8,11 @@
 import { Hono } from 'hono';
 import type { GatewayService } from '../service.js';
 import { type OAuthCredentials } from '../../auth/oauth/types.js';
+export declare function resolveOAuthLoginMethodPreference(params: {
+    requestedMethod?: unknown;
+    supportedMethods?: readonly string[];
+    remote: boolean;
+}): string | undefined;
 export declare function createOAuthAsyncHandler(service: GatewayService): Hono<import("hono/dist/types/types.js").BlankEnv, import("hono/dist/types/types.js").BlankSchema, "/">;
 export declare function getOAuthCredentialsFromCache(provider: string): OAuthCredentials | undefined;
 export declare function setOAuthCredentialsToCache(provider: string, creds: OAuthCredentials): void;

package/dist/src/gateway/hono/oauth-async.js

@@ -28,6 +28,7 @@ function formatOAuthAsyncError(err) {
 const OAUTH_PROVIDERS = getOAuthProviderInterfaces();
 const oauthSessions = /* @__PURE__ */ new Map();
 const SESSION_TTL_MS = 600 * 1e3;
+const SESSION_EXPIRY_GRACE_MS = 3e4;
 setInterval(() => {
 	const now = Date.now();
 	for (const [id, session] of oauthSessions.entries()) if (now > session.expiresAt) {
@@ -64,11 +65,21 @@ function requestLooksRemote(c) {
 		hostWithoutPort(c.req.header("host"))
 	].some((candidate) => candidate && !isLoopbackHost(candidate));
 }
+function resolveOAuthLoginMethodPreference(params) {
+	if (typeof params.requestedMethod === "string" && params.requestedMethod.trim()) {
+		const requested = params.requestedMethod.trim();
+		return !params.supportedMethods || params.supportedMethods.includes(requested) ? requested : void 0;
+	}
+	if (params.remote && params.supportedMethods?.includes("browser") && params.supportedMethods.includes("device_code")) return "device_code";
+}
 function preferredOAuthLoginMethod(params) {
-	if (typeof params.requestedMethod === "string" && params.requestedMethod.trim()) return params.requestedMethod.trim();
-	if (params.provider !== "openai-codex") return;
 	const publicHost = hostWithoutPort(resolveReverseProxyPublicUrl(params.service.currentConfig) ?? void 0);
-	if (publicHost && !isLoopbackHost(publicHost) || requestLooksRemote(params.c)) return "device_code";
+	const remote = Boolean(publicHost && !isLoopbackHost(publicHost) || requestLooksRemote(params.c));
+	return resolveOAuthLoginMethodPreference({
+		requestedMethod: params.requestedMethod,
+		supportedMethods: OAUTH_PROVIDERS[params.provider]?.loginMethods,
+		remote
+	});
 }
 function createOAuthAsyncHandler(service) {
 	const oauth = new Hono();
@@ -99,9 +110,9 @@ function createOAuthAsyncHandler(service) {
 		oauthSessions.set(sessionId, session);
 		runOAuthFlow(session, oauthProvider, service).catch((err) => {
 			log.error({
+				err,
 				sessionId,
-				provider,
-				error: err
+				provider
 			}, "Background OAuth flow failed");
 			session.status = "failed";
 			session.error = err instanceof Error ? err.message : "OAuth flow failed";
@@ -220,6 +231,7 @@ async function runOAuthFlow(session, oauthProvider, _service) {
 			session.verificationUri = info.verificationUri;
 			session.instructions = `Enter code ${info.userCode}`;
 			session.message = `Open ${info.verificationUri} and enter code ${info.userCode}`;
+			if (info.expiresInSeconds) session.expiresAt = Math.max(session.expiresAt, Date.now() + info.expiresInSeconds * 1e3 + SESSION_EXPIRY_GRACE_MS);
 		},
 		onPrompt: async (prompt) => {
 			session.status = "waiting_code";
@@ -285,9 +297,9 @@ async function runOAuthFlow(session, oauthProvider, _service) {
 			session.status = "failed";
 			session.error = formatOAuthAsyncError(err);
 			log.error({
+				err,
 				sessionId: session.id,
-				provider: session.provider,
-				error: err
+				provider: session.provider
 			}, "OAuth login failed");
 		}
 	} finally {
@@ -307,4 +319,4 @@ function deleteOAuthCredentialsFromCache(provider) {
 	oauthCredentialsCache.delete(provider);
 }
 //#endregion
-export { createOAuthAsyncHandler, deleteOAuthCredentialsFromCache, getOAuthCredentialsFromCache, setOAuthCredentialsToCache };
+export { createOAuthAsyncHandler, deleteOAuthCredentialsFromCache, getOAuthCredentialsFromCache, resolveOAuthLoginMethodPreference, setOAuthCredentialsToCache };

package/dist/src/gateway/hono/routes/config-patch/gateway.d.ts

@@ -3,7 +3,7 @@
  *
  * Covers heartbeat, bind/customBindHost/port, tailscale, auth (mode + token +
  * password + rateLimit + trustedProxy), trustedProxies, allowRealIpFallback,
- * dangerouslyAllowHostHeaderOriginFallback, security, share, siteShare, publicUrl,
+ * dangerouslyAllowHostHeaderOriginFallback, security, share, siteShare, publicUrl, webchat,
  * corsOrigins, maxSseConnections, and channelConnectDefer{Mode,Ids,SkipIds}.
  *
  * Validation policy: each subsection that can reject rejects with a 400 and a

package/dist/src/gateway/hono/routes/config-patch/gateway.js

@@ -32,6 +32,15 @@ function parseDeferIdList(raw) {
 	return ids;
 }
 function applyGatewayPatch(config, body) {
+	if (body.gateway?.webchat?.activityDetailDefault !== void 0) {
+		const level = body.gateway.webchat.activityDetailDefault;
+		if (level !== "off" && level !== "on" && level !== "stream") return patchError("gateway.webchat.activityDetailDefault must be off, on, or stream");
+		const gw = ensureGateway(config);
+		gw.webchat = {
+			...gw.webchat ?? { activityDetailDefault: "on" },
+			activityDetailDefault: level
+		};
+	}
 	if (body.gateway?.heartbeat !== void 0 && typeof body.gateway.heartbeat === "object") {
 		const gw = ensureGateway(config);
 		if (!gw.heartbeat) gw.heartbeat = {

package/dist/src/gateway/hono/routes/goals.js

@@ -532,6 +532,8 @@ function registerGoalsRoutes(authenticated, deps) {
 			error: "Goal not found"
 		}, 404);
 		const patch = {};
+		let requestedProjectId;
+		let projectChanged = false;
 		if (typeof body.title === "string") patch.title = body.title;
 		if ("description" in body) patch.description = typeof body.description === "string" ? body.description : void 0;
 		const priority = parsePriority(body.priority);
@@ -547,10 +549,21 @@ function registerGoalsRoutes(authenticated, deps) {
 				ok: false,
 				error: "Project not found"
 			}, 404);
+			requestedProjectId = nextProjectId;
+			projectChanged = nextProjectId !== goal.projectId;
 			patch.projectId = nextProjectId;
 		}
 		const locale = normalizeGoalUiLocale(body.uiLocale);
 		if (locale) patch.uiLocale = locale;
+		if (projectChanged && goal.activeSessionKey) try {
+			if (requestedProjectId) deps.service.projects.attachSession(goal.activeSessionKey, requestedProjectId);
+			else deps.service.projects.detachSession(goal.activeSessionKey);
+		} catch (error) {
+			return c.json({
+				ok: false,
+				error: error instanceof Error ? error.message : String(error)
+			}, 404);
+		}
 		if (Object.keys(patch).length > 0) goal = goals.update(goalId, patch);
 		if (status) {
 			const previousStatus = goal?.status;

package/dist/src/gateway/hono/routes/local-apps.js

@@ -1,6 +1,6 @@
 import { readLocalAppAcceptanceConfig } from "../../../local-apps/acceptance.js";
-import { extensionAssetMimeType } from "../lib/extension-assets.js";
 import { LOCAL_APP_RUNTIME_BRIDGE_HASH, injectLocalAppRuntimeBridge } from "../../../local-apps/preview-runtime-bridge.js";
+import { extensionAssetMimeType } from "../lib/extension-assets.js";
 import { relative, resolve } from "node:path";
 import { existsSync, readFileSync, statSync } from "node:fs";
 //#region src/gateway/hono/routes/local-apps.ts

package/dist/src/gateway/hono/routes/update.js

@@ -1,11 +1,11 @@
 import { PACKAGE_VERSION, init_package_version } from "../../../package-version.js";
 import { loadConfig } from "../../../config/loader.js";
 import "../../../config/index.js";
-import { acquireUpdateLock } from "../../../infra/update-lock.js";
 import { normalizeUpdateChannel } from "../../../infra/update-channels.js";
+import { acquireUpdateLock } from "../../../infra/update-lock.js";
+import { formatUpdateApiResult, runGatewayUpdateWithPostSteps } from "../../../infra/update-runner.js";
 import { getUpdateAvailable, runGatewayUpdateCheck } from "../../../infra/update-startup.js";
 import { createGatewayRouteLogger } from "../lib/route-logger.js";
-import { formatUpdateApiResult, runGatewayUpdateWithPostSteps } from "../../../infra/update-runner.js";
 import { streamSSE } from "hono/streaming";
 //#region src/gateway/hono/routes/update.ts
 init_package_version();

package/dist/src/gateway/index.js

@@ -1,5 +1,6 @@
 import { buildDefaultCorsOrigins, isAllInterfacesHost, isLoopbackHost, resolveEffectiveGatewayPort, resolveGatewayServiceListenPort } from "./host.js";
 import { defaultGatewayBindMode, isContainerEnvironment, resolveGatewayBindHost, resolveGatewayBindHostSync, resolveGatewayBindMode, resolveGatewayEffectiveHost } from "../config/gateway-bind.js";
+import { checkPortAvailable, forceFreePortAndWait, listPortListeners, parseLsofOutput } from "./ports.js";
 import { assertGatewayAuthConfigured, extractToken, resolveGatewayAuth, validateToken } from "./auth.js";
 import { resolveGatewayListenHost, resolveGatewayListenPlan } from "./listen.js";
 import { buckets } from "./rate-limit/buckets.js";
@@ -13,7 +14,6 @@ import { createHonoApp } from "./hono/app.js";
 import { GatewayServer } from "./server.js";
 import { GatewayLockError, acquireGatewayLock } from "./lock.js";
 import { runGatewayLoop } from "./run-loop.js";
-import { checkPortAvailable, forceFreePortAndWait, listPortListeners, parseLsofOutput } from "./ports.js";
 import { apiError, apiOk } from "./protocol.js";
 import "./hono/index.js";
 import { assertSecureGatewayHttpUrl, assertSecureWebSocketUrl, isInsecurePrivateWsAllowed, isSecureWebSocketUrl } from "./ws-security.js";

package/dist/src/gateway/run-loop.js

@@ -1,10 +1,10 @@
 import { loadConfig } from "../config/loader.js";
 import "../config/index.js";
 import { isRestartEnabled } from "../config/commands.flags.js";
+import { consumeGatewayRestartIntentSync, consumeGatewaySigusr1RestartAuthorization, isGatewaySigusr1RestartExternallyAllowed, resetGatewayRestartStateForInProcessRestart, scheduleGatewaySigusr1Restart, setGatewaySigusr1RestartPolicy } from "../infra/restart.js";
 import { runBootstrapMigrationsSync } from "../migrations/runner.js";
 import { restartGatewayProcessWithFreshPid } from "./respawn.js";
 import { acquireGatewayLock } from "./lock.js";
-import { consumeGatewayRestartIntentSync, consumeGatewaySigusr1RestartAuthorization, isGatewaySigusr1RestartExternallyAllowed, resetGatewayRestartStateForInProcessRestart, scheduleGatewaySigusr1Restart, setGatewaySigusr1RestartPolicy } from "../infra/restart.js";
 //#region src/gateway/run-loop.ts
 /**
 * Gateway Run Loop - Core run loop for gateway process management

package/dist/src/gateway/service/sessions-api.d.ts

@@ -88,7 +88,8 @@ export declare class GatewaySessionsApi {
     patchAgentConfig(sessionKey: string, body: {
         thinkingLevel?: string;
         model?: string | null;
-        reasoningLevel?: string;
+        activityDetailLevel?: string | null;
+        reasoningLevel?: string | null;
         verboseLevel?: string;
         workingDirectory?: string;
     }): Promise<import("../../agent/session/session-config-service.js").PatchSessionAgentConfigResult>;

package/dist/src/gateway/service.js

@@ -50,6 +50,11 @@ import { FocusService } from "../focuses/service.js";
 import { processFocusMonitorRun } from "../focuses/run-processor.js";
 import { startFocusReconciler } from "../focuses/reconciler.js";
 import "../focuses/index.js";
+import { LocalAppService } from "../local-apps/service.js";
+import "../local-apps/index.js";
+import { scheduleGatewayUpdateCheck } from "../infra/update-startup.js";
+import { runBootstrapMigrationsSync } from "../migrations/runner.js";
+import { MobileNotificationService } from "../mobile/notification-service.js";
 import { assertGatewayAuthConfigured, extractToken, resolveGatewayAuth, validateToken } from "./auth.js";
 import { reconcileDreamingAutomations } from "./dreaming-automation-reconciler.js";
 import { NotesStore } from "../notes/store.js";
@@ -75,13 +80,8 @@ import "./rate-limit/index.js";
 import { assertGatewayRuntimeConfig } from "./runtime-config.js";
 import { auditGatewayConfig } from "./security/audit.js";
 import { ModelCatalogSyncService } from "../providers/model-catalog-sync-service.js";
-import { runBootstrapMigrationsSync } from "../migrations/runner.js";
-import { MobileNotificationService } from "../mobile/notification-service.js";
-import { LocalAppService } from "../local-apps/service.js";
-import "../local-apps/index.js";
 import { createRuntimeBrowserRecipeService } from "../browser/recipes/runtime-service.js";
 import "../browser/recipes/index.js";
-import { scheduleGatewayUpdateCheck } from "../infra/update-startup.js";
 import { resolveChannelConnectDeferSet } from "./resolve-channel-connect-defer.js";
 import { restartGatewayProcessWithFreshPid } from "./respawn.js";
 import { GatewaySessionsApi } from "./service/sessions-api.js";

package/dist/src/heartbeat/index.js

@@ -1,6 +1,6 @@
 import { DEFAULT_ACK_MAX_CHARS, HEARTBEAT_OK, NO_REPLY, shouldSilence, stripHeartbeatToken } from "./tokens.js";
-import { appendCronEventLines } from "./event-prompt.js";
 import { isWithinActiveHours } from "./active-hours.js";
 import { isHeartbeatContentEmpty } from "./content-check.js";
+import { appendCronEventLines } from "./event-prompt.js";
 import { createHeartbeatWake } from "./wake.js";
 export { DEFAULT_ACK_MAX_CHARS, HEARTBEAT_OK, NO_REPLY, appendCronEventLines, createHeartbeatWake, isHeartbeatContentEmpty, isWithinActiveHours, shouldSilence, stripHeartbeatToken };

package/dist/src/infra/gateway-processes.js

@@ -1,5 +1,5 @@
-import { listPortListeners } from "../gateway/ports.js";
 import { isGatewayArgv, parseProcCmdline } from "./gateway-process-argv.js";
+import { listPortListeners } from "../gateway/ports.js";
 import fs from "node:fs";
 import { spawnSync } from "node:child_process";
 //#region src/infra/gateway-processes.ts

package/dist/src/infra/update-restart.js

@@ -2,10 +2,10 @@ import { createLogger } from "../utils/logger/index.js";
 import { init_logger } from "../utils/logger.js";
 import { init_paths, resolveConfigPath } from "../config/paths.js";
 import { init_loader, loadConfig } from "../config/loader.js";
-import { resolveGatewayService } from "../daemon/service.js";
 import { isRestartEnabled } from "../config/commands.flags.js";
-import { authorizeGatewaySigusr1Restart, writeGatewayRestartIntentSync } from "./restart.js";
+import { resolveGatewayService } from "../daemon/service.js";
 import { findVerifiedGatewayListenerPidsOnPortSync, signalVerifiedGatewayPidSync } from "./gateway-processes.js";
+import { authorizeGatewaySigusr1Restart, writeGatewayRestartIntentSync } from "./restart.js";
 import { refreshGatewayServiceAfterUpdate } from "./update-service-refresh.js";
 //#region src/infra/update-restart.ts
 init_loader();

package/dist/src/infra/update-runner.js

@@ -1,11 +1,11 @@
 import { runPostUpdateExtensionSync } from "../extensions/update.js";
-import "./update-channels.js";
-import { compareSemver, resolveNpmChannelTag } from "./update-check.js";
 import { readPackageName, readPackageVersion } from "./package-json.js";
 import { createDefaultCommandRunner, runCommandWithTimeout } from "./run-command.js";
 import { XOPC_PACKAGE_NAME, cleanupGlobalRenameDirs, createGlobalInstallEnv, detectGlobalInstallManagerForRoot, resolveGlobalInstallSpec, resolveGlobalInstallTarget } from "./update-global.js";
 import { runGlobalPackageUpdateSteps } from "./package-update-steps.js";
 import { resolveStableNodePath } from "./stable-node-path.js";
+import "./update-channels.js";
+import { compareSemver, resolveNpmChannelTag } from "./update-check.js";
 import { trimLogTail } from "./update-log.js";
 import { maybeRestartGatewayAfterUpdate } from "./update-restart.js";
 import path from "node:path";

package/dist/src/infra/update-startup.js

@@ -3,9 +3,9 @@ import { init_paths_state, resolveUpdateCheckStatePath } from "../config/paths-s
 import { createLogger } from "../utils/logger/index.js";
 import { init_logger } from "../utils/logger.js";
 import { init_write_file_atomic, writeTextAtomic } from "./write-file-atomic.js";
-import { acquireUpdateLock } from "./update-lock.js";
 import { normalizeUpdateChannel } from "./update-channels.js";
 import { compareSemver, detectInstallKind, resolveNpmChannelTag, resolvePackageRoot } from "./update-check.js";
+import { acquireUpdateLock } from "./update-lock.js";
 import { createHash, randomUUID } from "node:crypto";
 import { readFile } from "node:fs/promises";
 //#region src/infra/update-startup.ts

package/dist/src/mcp/channel-bridge.js

@@ -1,9 +1,9 @@
 import { createLogger } from "../utils/logger/index.js";
 import { init_logger } from "../utils/logger.js";
 import { init_loader, loadConfig } from "../config/loader.js";
-import { gatewayCredentialAuthorization } from "../gateway/credential.js";
 import { loadUndiciRuntimeDeps } from "../infra/undici-fetch.js";
 import { toConversation } from "./channel-shared.js";
+import { gatewayCredentialAuthorization } from "../gateway/credential.js";
 import { createGatewayHttpClientFromConfig, resolveGatewayHttpBaseUrl } from "./gateway-http-client.js";
 //#region src/mcp/channel-bridge.ts
 init_loader();

package/dist/src/providers/index.js

@@ -5,10 +5,11 @@ import { hasProviderAuthOnDiskSync, init_sync_provider_auth } from "../auth/sync
 import { PROVIDER_ENV_MAP, getApiKeyFromEnv, init_env_keys } from "./env-keys.js";
 import { init_model_ref, splitProviderModelRef } from "./model-ref.js";
 import { ModelRegistry, getModelRegistry, init_model_registry, prewarmModelRegistry, resetModelRegistry } from "./model-registry.js";
-import { CredentialResolver, hasCredentials, init_credentials, resolveApiKey } from "../auth/credentials.js";
+import { CredentialResolver, hasCredentials, init_credentials } from "../auth/credentials.js";
 import { EXTENSION_PROVIDER_BASE_URL, init_constants } from "./constants.js";
 import { getSupplementalModels, init_model_supplements } from "./model-supplements.js";
 import { getProviderRegistry, init_plugin_registry } from "./plugin-registry.js";
+import { init_provider_auth_service, resolveProviderApiKey } from "./provider-auth-service.js";
 import { getModel, getModels, getProviders } from "@earendil-works/pi-ai/compat";
 //#region src/providers/index.ts
 /**
@@ -144,7 +145,7 @@ function getAllProviders() {
 }
 async function getApiKey(provider, credentialOptions) {
 	if (getProviderRegistry().has(provider)) return "extension-managed";
-	const credentialKey = await resolveApiKey(provider, credentialOptions);
+	const credentialKey = await resolveProviderApiKey(provider, credentialOptions);
 	if (credentialKey) return credentialKey;
 	const registryKey = getModelRegistry().getApiKey(provider);
 	if (registryKey) return registryKey;
@@ -320,6 +321,7 @@ var init_providers = __esmMin((() => {
 	init_model_supplements();
 	init_model_ref();
 	init_plugin_registry();
+	init_provider_auth_service();
 	OPENAI_CODEX_CANONICAL_BASE_URL = "https://chatgpt.com/backend-api/codex";
 	PROVIDER_META = {
 		"xopc-cloud": {

package/dist/src/providers/provider-auth-service.d.ts

@@ -0,0 +1,22 @@
+import { ModelRuntime } from '@earendil-works/pi-coding-agent';
+import { CredentialResolver, type CredentialResolverOptions } from '../auth/credentials.js';
+import { XopcModelCredentialStore } from '../auth/model-credential-store.js';
+type ApiKeyResolver = Pick<CredentialResolver, 'resolveApiKey'>;
+export interface ProviderAuthServiceOptions {
+    credentials?: XopcModelCredentialStore;
+    resolver?: ApiKeyResolver;
+    runtimeFactory?: (credentials: XopcModelCredentialStore) => Promise<ModelRuntime>;
+}
+/** Resolves request credentials while keeping OAuth refresh inside the shared persistent store. */
+export declare class ProviderAuthService {
+    private readonly credentials;
+    private readonly resolver;
+    private readonly runtimeFactory;
+    private runtime;
+    constructor(options?: ProviderAuthServiceOptions);
+    resolveApiKey(providerId: string, signal?: AbortSignal): Promise<string | null>;
+    private getRuntime;
+}
+export declare function getProviderAuthService(): ProviderAuthService;
+export declare function resolveProviderApiKey(providerId: string, credentialOptions?: CredentialResolverOptions): Promise<string | null>;
+export {};

package/dist/src/providers/provider-auth-service.js

@@ -0,0 +1,66 @@
+import { __esmMin } from "../../_virtual/_rolldown/runtime.js";
+import { init_paths, resolveModelsJsonPath } from "../config/paths.js";
+import { CredentialResolver, init_credentials } from "../auth/credentials.js";
+import { XopcModelCredentialStore, init_model_credential_store } from "../auth/model-credential-store.js";
+import { init_register_runtime_providers, registerRuntimeProviders } from "./register-runtime-providers.js";
+import { InMemoryModelsStore } from "@earendil-works/pi-ai";
+import { ModelRuntime } from "@earendil-works/pi-coding-agent";
+//#region src/providers/provider-auth-service.ts
+async function createAuthRuntime(credentials) {
+	const runtime = await ModelRuntime.create({
+		credentials,
+		modelsPath: resolveModelsJsonPath(),
+		modelsStore: new InMemoryModelsStore()
+	});
+	registerRuntimeProviders(runtime);
+	return runtime;
+}
+function getProviderAuthService() {
+	defaultProviderAuthService ??= new ProviderAuthService();
+	return defaultProviderAuthService;
+}
+async function resolveProviderApiKey(providerId, credentialOptions) {
+	if (!credentialOptions) return await getProviderAuthService().resolveApiKey(providerId);
+	const resolver = new CredentialResolver(credentialOptions);
+	return await new ProviderAuthService({
+		credentials: new XopcModelCredentialStore(resolver),
+		resolver
+	}).resolveApiKey(providerId);
+}
+var ProviderAuthService, defaultProviderAuthService;
+var init_provider_auth_service = __esmMin((() => {
+	init_credentials();
+	init_model_credential_store();
+	init_paths();
+	init_register_runtime_providers();
+	ProviderAuthService = class {
+		credentials;
+		resolver;
+		runtimeFactory;
+		runtime;
+		constructor(options = {}) {
+			const defaultResolver = new CredentialResolver();
+			this.resolver = options.resolver ?? defaultResolver;
+			this.credentials = options.credentials ?? new XopcModelCredentialStore(defaultResolver);
+			this.runtimeFactory = options.runtimeFactory ?? createAuthRuntime;
+		}
+		async resolveApiKey(providerId, signal) {
+			if ((await this.credentials.read(providerId, { signal }))?.type === "oauth") {
+				const runtime = await this.getRuntime();
+				const provider = runtime.getProvider(providerId);
+				if (provider?.auth.oauth && !provider.auth.apiKey) return (await runtime.getAuth(providerId, { signal }))?.auth.apiKey ?? null;
+			}
+			return await this.resolver.resolveApiKey(providerId);
+		}
+		getRuntime() {
+			this.runtime ??= this.runtimeFactory(this.credentials).catch((error) => {
+				this.runtime = void 0;
+				throw error;
+			});
+			return this.runtime;
+		}
+	};
+}));
+//#endregion
+init_provider_auth_service();
+export { ProviderAuthService, getProviderAuthService, init_provider_auth_service, resolveProviderApiKey };

package/dist/src/providers/register-runtime-providers.d.ts

@@ -0,0 +1,6 @@
+import type { ModelRuntime } from '@earendil-works/pi-coding-agent';
+import { type ModelCatalogSnapshot } from './model-catalog-store.js';
+type RuntimeProviderRegistrar = Pick<ModelRuntime, 'registerProvider'>;
+/** Register dynamically discovered model providers, including their OAuth contract. */
+export declare function registerRuntimeProviders(modelRuntime: RuntimeProviderRegistrar, catalog?: ModelCatalogSnapshot): void;
+export {};

package/dist/src/providers/register-runtime-providers.js

@@ -0,0 +1,55 @@
+import { __esmMin } from "../../_virtual/_rolldown/runtime.js";
+import { getOAuthProviderDefinition, init_registry } from "../auth/oauth/registry.js";
+import { getModelCatalogStore, init_model_catalog_store } from "./model-catalog-store.js";
+import { XOPC_CLOUD_PROVIDER_ID, init_xopc_cloud_config, resolveXopcModelRouterUrl } from "./xopc-cloud-config.js";
+//#region src/providers/register-runtime-providers.ts
+function registerRuntimeProvider(modelRuntime, source) {
+	const oauthDefinition = getOAuthProviderDefinition(source.providerId);
+	const oauth = oauthDefinition?.oauthOnly ? {
+		name: oauthDefinition.displayName,
+		login: oauthDefinition.provider.login.bind(oauthDefinition.provider),
+		refreshToken: oauthDefinition.provider.refreshToken.bind(oauthDefinition.provider),
+		getApiKey: oauthDefinition.provider.getApiKey.bind(oauthDefinition.provider)
+	} : void 0;
+	modelRuntime.registerProvider(source.providerId, {
+		name: oauthDefinition?.displayName ?? source.providerId,
+		baseUrl: source.baseUrl,
+		api: source.api,
+		oauth,
+		models: source.models.filter((model) => model.availability === "available").map((model) => ({
+			id: model.id,
+			name: model.name,
+			reasoning: false,
+			input: ["text"],
+			cost: {
+				input: 0,
+				output: 0,
+				cacheRead: 0,
+				cacheWrite: 0
+			},
+			contextWindow: 128e3,
+			maxTokens: model.maxOutputTokens ?? 16384
+		}))
+	});
+}
+/** Register dynamically discovered model providers, including their OAuth contract. */
+function registerRuntimeProviders(modelRuntime, catalog = getModelCatalogStore().load()) {
+	for (const source of Object.values(catalog.sources)) registerRuntimeProvider(modelRuntime, source);
+	if (!catalog.sources["xopc-cloud"]) registerRuntimeProvider(modelRuntime, {
+		providerId: XOPC_CLOUD_PROVIDER_ID,
+		baseUrl: resolveXopcModelRouterUrl(),
+		api: "openai-completions",
+		etag: null,
+		recommendedModel: null,
+		lastSuccessAt: 0,
+		models: []
+	});
+}
+var init_register_runtime_providers = __esmMin((() => {
+	init_registry();
+	init_model_catalog_store();
+	init_xopc_cloud_config();
+}));
+//#endregion
+init_register_runtime_providers();
+export { init_register_runtime_providers, registerRuntimeProviders };

package/dist/src/providers/xopc-cloud-account-service.d.ts

@@ -1,5 +1,5 @@
 import { z } from 'zod';
-import { type CredentialResolver } from '../auth/credentials.js';
+import { type ProviderAuthService } from './provider-auth-service.js';
 declare const accountSummarySchema: z.ZodObject<{
     balance: z.ZodObject<{
         credits: z.ZodNumber;
@@ -33,7 +33,7 @@ export declare class XopcCloudAccountService {
     constructor(options?: {
         fetchImpl?: typeof fetch;
         routerUrl?: string;
-        credentials?: Pick<CredentialResolver, 'resolveApiKey'>;
+        credentials?: Pick<ProviderAuthService, 'resolveApiKey'>;
     });
     getSummary(days?: 1 | 7 | 30): Promise<XopcCloudAccountSummary | null>;
 }

package/dist/src/providers/xopc-cloud-account-service.js

@@ -1,8 +1,9 @@
-import { getCredentialResolver, init_credentials } from "../auth/credentials.js";
+import { init_xopc_cloud_config, resolveXopcModelRouterUrl } from "./xopc-cloud-config.js";
+import { getProviderAuthService, init_provider_auth_service } from "./provider-auth-service.js";
 import { z } from "zod";
 //#region src/providers/xopc-cloud-account-service.ts
-init_credentials();
-const DEFAULT_ROUTER_URL = "https://router.xopc.ai/v1";
+init_provider_auth_service();
+init_xopc_cloud_config();
 const accountSummarySchema = z.object({
 	balance: z.object({
 		credits: z.number().int().nonnegative(),
@@ -41,8 +42,8 @@ var XopcCloudAccountService = class {
 	credentials;
 	constructor(options = {}) {
 		this.fetchImpl = options.fetchImpl ?? fetch;
-		this.routerUrl = (options.routerUrl ?? process.env.XOPC_MODEL_ROUTER_URL ?? DEFAULT_ROUTER_URL).replace(/\/+$/, "");
-		this.credentials = options.credentials ?? getCredentialResolver();
+		this.routerUrl = resolveXopcModelRouterUrl(options.routerUrl);
+		this.credentials = options.credentials ?? getProviderAuthService();
 	}
 	async getSummary(days = 7) {
 		const accessToken = await this.credentials.resolveApiKey("xopc-cloud");