@xopcai/xopc 0.0.191 → 0.0.193

package/dist/src/agent/skills/skills-marketplace.js

@@ -5,8 +5,8 @@ function marketplaceAdapter(config, provider) {
 	if (provider && isRegisteredProvider(provider)) return getMarketplaceAdapterForProvider(provider);
 	return getMarketplaceAdapter(config);
 }
-async function listMarketplaceCategories(config, provider) {
-	return { items: await marketplaceAdapter(config, provider).listCategories(config) };
+async function listMarketplaceCategories(config, provider, locale) {
+	return { items: await marketplaceAdapter(config, provider).listCategories(config, { locale }) };
 }
 async function listMarketplacePackages(config, params, provider) {
 	return marketplaceAdapter(config, provider).listPackages(config, params);

package/dist/src/agent/skills/types.d.ts

@@ -106,12 +106,6 @@ export interface SkillSourceDescriptor {
     writable: boolean;
 }
 export type SkillOrigin = SkillSourceDescriptor;
-export interface SkillsInstallConfig {
-    /** Prefer brew for package installation */
-    preferBrew?: boolean;
-    /** Node package manager preference */
-    nodeManager?: 'pnpm' | 'npm' | 'yarn' | 'bun';
-}
 export interface SkillsLimitsConfig {
     /** Max number of immediate child directories to consider */
     maxCandidatesPerRoot?: number;
@@ -129,8 +123,6 @@ export interface SkillsConfig {
     allowBundled?: string[];
     /** Load configuration */
     load?: SkillsLoadConfig;
-    /** Install configuration */
-    install?: SkillsInstallConfig;
     /** Limits configuration */
     limits?: SkillsLimitsConfig;
     /** Per-skill configuration */

package/dist/src/agent/tools/exec-command.d.ts

@@ -24,5 +24,6 @@ export interface ExecCommandUpdateDetails {
 export interface CreateExecCommandToolOptions {
     /** Env var names allowed through prepareSafeToolEnv even if they match secret heuristics. */
     getSkillPassthroughEnvVarNames?: () => string[];
+    prepareEnv?: (baseEnv: Record<string, string>, cwd: string) => Promise<Record<string, string>>;
 }
 export declare function createExecCommandTool(workspaceCwd: string, options?: CreateExecCommandToolOptions): AgentTool;

package/dist/src/agent/tools/exec-command.js

@@ -116,6 +116,7 @@ function createExecCommandTool(workspaceCwd, options) {
 			const timeoutMs = Math.min(clampTimeoutMs(params.timeoutMs), policy.timeoutMs);
 			const maxOutputChars = clampMaxOutputChars(params.maxOutputChars);
 			const startTime = Date.now();
+			const runtimeEnv = options?.prepareEnv ? await options.prepareEnv(policy.sanitizedEnv, policy.effectiveCwd) : policy.sanitizedEnv;
 			let stdout = "";
 			let stderr = "";
 			let aggregatedOutput = "";
@@ -126,7 +127,7 @@ function createExecCommandTool(workspaceCwd, options) {
 					shell: true,
 					cwd: policy.effectiveCwd,
 					env: {
-						...policy.sanitizedEnv,
+						...runtimeEnv,
 						COLUMNS: "200"
 					}
 				});

package/dist/src/agent/tools/factory.d.ts

@@ -99,6 +99,7 @@ export declare class AgentToolsFactory {
     /** Cached readiness probe — keyed by backend mode + extension host:port. */
     private browserReadinessCache;
     constructor(deps: ToolFactoryDeps);
+    private prepareRuntimeEnv;
     private browserReadinessKey;
     private checkBrowserReadinessCached;
     /** Invalidate the readiness cache (config hot-reload, settings-page save, etc.). */

package/dist/src/agent/tools/factory.js

@@ -1,3 +1,4 @@
+import { init_paths_state, resolveStateDir } from "../../config/paths-state.js";
 import { createLogger } from "../../utils/logger/index.js";
 import { init_logger } from "../../utils/logger.js";
 import { isXopcDatabaseOpen } from "../../storage/sqlite/connection.js";
@@ -5,6 +6,7 @@ import { getSessionTaskPlan, setSessionTaskPlan } from "../../storage/sqlite/ses
 import "../../storage/sqlite/index.js";
 import { init_agent_scope, resolveDefaultAgentId } from "../agent-scope.js";
 import { wrapToolsWithProtection } from "./executor.js";
+import { buildRuntimeEnvironment } from "../../runtime-tools/environment.js";
 import { createDefaultExternalToolGatewayTools } from "../external-tools/index.js";
 import { createReadFileTool } from "./read.js";
 import { createWriteFileTool } from "./write.js";
@@ -56,6 +58,7 @@ import "../capabilities/index.js";
 //#region src/agent/tools/factory.ts
 init_agent_scope();
 init_logger();
+init_paths_state();
 const log = createLogger("AgentToolsFactory");
 /** Channels where `clarify` can block for a user answer (web UI, Telegram, CLI readline). */
 const CLARIFY_SUPPORTED_CHANNELS = new Set([
@@ -72,6 +75,15 @@ var AgentToolsFactory = class {
 	constructor(deps) {
 		this.deps = deps;
 	}
+	prepareRuntimeEnv = async (baseEnv) => {
+		const config = this.deps.getConfig?.();
+		if (!config) return baseEnv;
+		return (await buildRuntimeEnvironment({
+			stateDir: resolveStateDir(),
+			config: config.runtimeTools,
+			baseEnv
+		})).env;
+	};
 	browserReadinessKey() {
 		const cfg = this.deps.getConfig?.();
 		const backend = resolveBrowserBackendFromConfig(cfg);
@@ -251,8 +263,11 @@ var AgentToolsFactory = class {
 			listDir,
 			grep,
 			find,
-			createExecCommandTool(workspace, { getSkillPassthroughEnvVarNames: this.deps.getSkillPassthroughEnvVarNames }),
-			createManagedJobTool(workspace, () => this.deps.getCurrentContext()?.sessionKey, this.deps.getSkillPassthroughEnvVarNames),
+			createExecCommandTool(workspace, {
+				getSkillPassthroughEnvVarNames: this.deps.getSkillPassthroughEnvVarNames,
+				prepareEnv: this.prepareRuntimeEnv
+			}),
+			createManagedJobTool(workspace, () => this.deps.getCurrentContext()?.sessionKey, this.deps.getSkillPassthroughEnvVarNames, this.prepareRuntimeEnv),
 			createWebSearchTool(() => this.deps.getConfig?.()),
 			createWebFetchTool(() => this.deps.getConfig?.()),
 			createWebExtractTool({ getConfig: () => this.deps.getConfig?.() }),

package/dist/src/agent/tools/managed-job-tool.d.ts

@@ -1,2 +1,2 @@
 import type { AgentTool } from '@earendil-works/pi-agent-core';
-export declare function createManagedJobTool(workspace: string, getSessionKey: () => string | undefined, getSkillPassthroughEnvVarNames?: () => string[]): AgentTool;
+export declare function createManagedJobTool(workspace: string, getSessionKey: () => string | undefined, getSkillPassthroughEnvVarNames?: () => string[], prepareEnv?: (baseEnv: Record<string, string>, cwd: string) => Promise<Record<string, string>>): AgentTool;

package/dist/src/agent/tools/managed-job-tool.js

@@ -126,7 +126,7 @@ function result(value) {
 		details: {}
 	};
 }
-function createManagedJobTool(workspace, getSessionKey, getSkillPassthroughEnvVarNames) {
+function createManagedJobTool(workspace, getSessionKey, getSkillPassthroughEnvVarNames, prepareEnv) {
 	return {
 		name: "managed_job",
 		label: "Managed Job",
@@ -149,8 +149,9 @@ function createManagedJobTool(workspace, getSessionKey, getSkillPassthroughEnvVa
 			if (!policy.allowed) return result({ error: `Sandbox blocked command: ${policy.reason}` });
 			const rawMax = Number(input.maxRuntimeMs ?? DEFAULT_MAX_RUNTIME_MS);
 			const maxRuntimeMs = Math.min(MAX_RUNTIME_MS, Math.max(1e3, Number.isFinite(rawMax) ? rawMax : DEFAULT_MAX_RUNTIME_MS));
+			const runtimeEnv = prepareEnv ? await prepareEnv(policy.sanitizedEnv, policy.effectiveCwd) : policy.sanitizedEnv;
 			return result(registry().start(owner, command, policy.effectiveCwd, {
-				...policy.sanitizedEnv,
+				...runtimeEnv,
 				COLUMNS: "200"
 			}, maxRuntimeMs));
 		}

package/dist/src/agent/tools/skill-install-tool.d.ts

@@ -22,7 +22,7 @@ export interface SkillInstallToolResult {
     target?: SkillInstallTarget;
 }
 export interface MarketplaceSkillInstallToolOptions {
-    provider: 'store' | 'clawhub';
+    provider: 'store' | 'skillhub' | 'clawhub';
     name: string;
     version?: string;
     target?: SkillInstallTarget;
@@ -32,7 +32,7 @@ export interface MarketplaceSkillInstallToolOptions {
 export interface MarketplaceSkillInstallToolResult {
     skillId: string;
     path: string;
-    provider: 'store' | 'clawhub';
+    provider: 'store' | 'skillhub' | 'clawhub';
     name: string;
     version?: string;
     target?: SkillInstallTarget;

package/dist/src/agent/tools/skill-install-tool.js

@@ -3,7 +3,11 @@ import { Type } from "@sinclair/typebox";
 //#region src/agent/tools/skill-install-tool.ts
 const SkillInstallSchema = Type.Object({
 	source: Type.Optional(Type.String({ description: "Explicit source install: Git URL, GitHub repository URL, https .zip/.tar.gz URL, file:// URL, or local archive/path." })),
-	provider: Type.Optional(Type.Union([Type.Literal("store"), Type.Literal("clawhub")], { description: "Marketplace provider. Use with name; copy it from skills_marketplace_search." })),
+	provider: Type.Optional(Type.Union([
+		Type.Literal("store"),
+		Type.Literal("skillhub"),
+		Type.Literal("clawhub")
+	], { description: "Marketplace provider. Use with name; copy it from skills_marketplace_search." })),
 	name: Type.Optional(Type.String({ description: "Marketplace package name or install.reference. For ClawHub prefer owner/slug to disambiguate publishers." })),
 	version: Type.Optional(Type.String({ description: "Optional marketplace package version." })),
 	ref: Type.Optional(Type.String({ description: "Optional Git branch/tag/ref." })),
@@ -20,7 +24,7 @@ function createSkillInstallTool(deps) {
 	return {
 		name: "skill_install",
 		label: "Install skill",
-		description: "Install an xopc skill from a Store/ClawHub marketplace result or an explicit source. Use only when the user clearly asks to install or update a skill; never treat search or a pasted URL as installation consent.",
+		description: "Install an xopc skill from a Store/SkillHub/ClawHub marketplace result or an explicit source. Use only when the user clearly asks to install or update a skill; never treat search or a pasted URL as installation consent.",
 		parameters: SkillInstallSchema,
 		async execute(_toolCallId, params) {
 			const provider = clean(params.provider);
@@ -28,10 +32,10 @@ function createSkillInstallTool(deps) {
 			const target = isSkillInstallTarget(params.target) ? params.target : "global";
 			const sessionKey = deps.getSessionKey?.();
 			if (provider || name) {
-				if (provider !== "store" && provider !== "clawhub") return {
+				if (provider !== "store" && provider !== "skillhub" && provider !== "clawhub") return {
 					content: [{
 						type: "text",
-						text: "Marketplace installs require provider: store or clawhub."
+						text: "Marketplace installs require provider: store, skillhub, or clawhub."
 					}],
 					details: { errorCode: "missing_provider" }
 				};

package/dist/src/agent/tools/skills-marketplace-search-tool.js

@@ -8,11 +8,12 @@ const SkillsMarketplaceSearchSchema = Type.Object({
 	}),
 	sources: Type.Optional(Type.Array(Type.Union([
 		Type.Literal("store"),
+		Type.Literal("skillhub"),
 		Type.Literal("clawhub"),
 		Type.Literal("skills-sh")
 	]), {
 		minItems: 1,
-		maxItems: 3,
+		maxItems: 4,
 		uniqueItems: true
 	})),
 	limit: Type.Optional(Type.Integer({
@@ -34,7 +35,7 @@ function createSkillsMarketplaceSearchTool(deps) {
 	return {
 		name: "skills_marketplace_search",
 		label: "🔎 Find skills",
-		description: "Search the XOPC Store, native ClawHub catalog, and skills.sh results federated by ClawHub. Returns normalized provenance, install references, adoption metrics, partial-source errors, and a heuristic value score. Read-only; never installs a skill.",
+		description: "Search the XOPC Store, SkillHub, native ClawHub catalog, and skills.sh results federated by ClawHub. Returns normalized provenance, install references, adoption metrics, partial-source errors, and a heuristic value score. Read-only; never installs a skill.",
 		parameters: SkillsMarketplaceSearchSchema,
 		mutatesWorkspace: false,
 		mutationScope: "none",

package/dist/src/agent/tools/workflow-tool.d.ts

@@ -8,6 +8,7 @@ export type WorkflowToolInput = {
     name?: string;
     args?: unknown;
     goal?: string;
+    intent?: string;
     taskRunId?: string;
 };
 export interface WorkflowToolDeps {

package/dist/src/agent/tools/workflow-tool.js

@@ -1,6 +1,6 @@
 import { createLogger } from "../../utils/logger/index.js";
 import { init_logger } from "../../utils/logger.js";
-import { extractProfileAgentId } from "../../config/agent-profile.js";
+import { extractProfileAgentId, resolveEffectiveAgentProfileForSession } from "../../config/agent-profile.js";
 import { appendProductDeliveryText } from "../../../packages/gateway-contract/src/product-delivery.js";
 import { Type } from "@sinclair/typebox";
 //#region src/agent/tools/workflow-tool.ts
@@ -13,6 +13,7 @@ const WorkflowToolSchema = Type.Object({
 	name: Type.Optional(Type.String({ description: "Name of a saved visual workflow to run." })),
 	args: Type.Optional(Type.Any({ description: "Optional JSON value passed as workflow input payload." })),
 	goal: Type.Optional(Type.String({ description: "Optional goal or task description for this workflow run (defaults to user intent in chat)." })),
+	intent: Type.Optional(Type.String({ description: "Optional short intent used to select a suggested workflow." })),
 	taskRunId: Type.Optional(Type.String({ description: "Optional TaskRun id. When set, the workflow executes and finalizes that run." }))
 });
 function createWorkflowTool(deps) {
@@ -35,7 +36,7 @@ function createWorkflowTool(deps) {
 			};
 			let definitionId;
 			try {
-				definitionId = resolveDefinitionId(params, deps.catalog);
+				definitionId = resolveDefinitionId(params, deps.catalog, deps.getConfig(), deps.getCurrentSessionKey?.());
 			} catch (e) {
 				const message = e instanceof Error ? e.message : String(e);
 				return {
@@ -136,13 +137,22 @@ function createWorkflowTool(deps) {
 		}
 	};
 }
-function resolveDefinitionId(params, catalog) {
+function resolveDefinitionId(params, catalog, config, sessionKey) {
 	const name = params.name?.trim();
 	if (name) {
 		catalog.load(name);
 		return name;
 	}
-	throw new Error("`name` is required. Create workflows in the visual workflow studio.");
+	const configuredDefault = config ? (() => {
+		const policy = resolveEffectiveAgentProfileForSession(config, sessionKey).manifest.workflows;
+		const intent = params.intent?.trim().toLowerCase();
+		return (intent ? policy.suggested?.find((entry) => entry.intent.toLowerCase() === intent)?.workflow : void 0) ?? policy.default;
+	})() : void 0;
+	if (configuredDefault) {
+		catalog.load(configuredDefault);
+		return configuredDefault;
+	}
+	throw new Error("`name` is required because this agent has no default workflow.");
 }
 //#endregion
 export { createWorkflowTool };

package/dist/src/agent-manifest/schema.d.ts

@@ -250,6 +250,11 @@ export declare const RuntimePolicySchema: z.ZodOptional<z.ZodObject<{
     maxTurns: z.ZodOptional<z.ZodNumber>;
     timeoutMs: z.ZodOptional<z.ZodNumber>;
     maxToolFailuresPerTurn: z.ZodOptional<z.ZodNumber>;
+    promptCacheRetention: z.ZodOptional<z.ZodEnum<{
+        none: "none";
+        short: "short";
+        long: "long";
+    }>>;
 }, z.core.$strict>>;
 export declare const PromptPolicySchema: z.ZodOptional<z.ZodObject<{
     customInstructions: z.ZodOptional<z.ZodString>;
@@ -394,6 +399,11 @@ export declare const AgentManifestSchema: z.ZodObject<{
         maxTurns: z.ZodOptional<z.ZodNumber>;
         timeoutMs: z.ZodOptional<z.ZodNumber>;
         maxToolFailuresPerTurn: z.ZodOptional<z.ZodNumber>;
+        promptCacheRetention: z.ZodOptional<z.ZodEnum<{
+            none: "none";
+            short: "short";
+            long: "long";
+        }>>;
     }, z.core.$strict>>;
     prompt: z.ZodOptional<z.ZodObject<{
         customInstructions: z.ZodOptional<z.ZodString>;
@@ -526,6 +536,11 @@ export declare const AgentConfigEntrySchema: z.ZodObject<{
         maxTurns: z.ZodOptional<z.ZodNumber>;
         timeoutMs: z.ZodOptional<z.ZodNumber>;
         maxToolFailuresPerTurn: z.ZodOptional<z.ZodNumber>;
+        promptCacheRetention: z.ZodOptional<z.ZodEnum<{
+            none: "none";
+            short: "short";
+            long: "long";
+        }>>;
     }, z.core.$strict>>;
     prompt: z.ZodOptional<z.ZodObject<{
         customInstructions: z.ZodOptional<z.ZodString>;
@@ -644,6 +659,11 @@ export declare const CapabilityPresetSchema: z.ZodObject<{
         maxTurns: z.ZodOptional<z.ZodNumber>;
         timeoutMs: z.ZodOptional<z.ZodNumber>;
         maxToolFailuresPerTurn: z.ZodOptional<z.ZodNumber>;
+        promptCacheRetention: z.ZodOptional<z.ZodEnum<{
+            none: "none";
+            short: "short";
+            long: "long";
+        }>>;
     }, z.core.$strict>>;
     locks: z.ZodOptional<z.ZodArray<z.ZodString>>;
 }, z.core.$strict>;

package/dist/src/agent-manifest/schema.js

@@ -156,7 +156,12 @@ var init_schema = __esmMin((() => {
 	RuntimePolicySchema = z.object({
 		maxTurns: z.number().int().positive().optional(),
 		timeoutMs: z.number().int().positive().optional(),
-		maxToolFailuresPerTurn: z.number().int().positive().optional()
+		maxToolFailuresPerTurn: z.number().int().positive().optional(),
+		promptCacheRetention: z.enum([
+			"none",
+			"short",
+			"long"
+		]).optional()
 	}).strict().optional();
 	PromptPolicySchema = z.object({ customInstructions: z.string().optional() }).strict().optional();
 	AgentIdentitySchema = z.object({

package/dist/src/auth/oauth/xopc-cloud.js

@@ -32,8 +32,164 @@ async function tokenRequest(body, signal) {
 		signal: signal ?? AbortSignal.timeout(3e4)
 	});
 }
-function callbackHtml(title, message) {
-	return `<!doctype html><html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>${title}</title></head><body><main><h1>${title}</h1><p>${message}</p><p>You can close this window and return to XOPC.</p></main></body></html>`;
+function escapeHtml(value) {
+	return value.replace(/[&<>"']/g, (character) => ({
+		"&": "&amp;",
+		"<": "&lt;",
+		">": "&gt;",
+		"\"": "&quot;",
+		"'": "&#39;"
+	})[character] ?? character);
+}
+function callbackHtml(title, message, tone) {
+	const safeTitle = escapeHtml(title);
+	const safeMessage = escapeHtml(message);
+	return `<!doctype html>
+<html lang="en">
+<head>
+  <meta charset="utf-8" />
+  <meta name="viewport" content="width=device-width, initial-scale=1" />
+  <meta name="referrer" content="no-referrer" />
+  <title>${safeTitle} · XOPC</title>
+  <style>
+    :root {
+      color-scheme: light dark;
+      --accent: #3a6bff;
+      --accent-soft: #eef3ff;
+      --canvas: #f7f8fb;
+      --panel: rgba(255, 255, 255, 0.88);
+      --text: #111111;
+      --muted: #666666;
+      --edge: rgba(17, 17, 17, 0.08);
+      --status: ${tone === "success" ? "#17864b" : "#d64242"};
+      --status-soft: ${tone === "success" ? "#e7fbf1" : "#fff0f0"};
+      font-family: -apple-system, BlinkMacSystemFont, "SF Pro Text", "Segoe UI", Roboto, "Helvetica Neue", Arial, sans-serif;
+    }
+    * { box-sizing: border-box; }
+    html, body { min-height: 100%; }
+    body {
+      margin: 0;
+      min-height: 100vh;
+      display: grid;
+      place-items: center;
+      overflow: hidden;
+      padding: 24px;
+      background:
+        radial-gradient(circle at 18% 18%, rgba(46, 216, 255, 0.16), transparent 34rem),
+        radial-gradient(circle at 82% 78%, rgba(91, 87, 255, 0.14), transparent 32rem),
+        var(--canvas);
+      color: var(--text);
+      -webkit-font-smoothing: antialiased;
+    }
+    .glow {
+      position: fixed;
+      width: 280px;
+      height: 280px;
+      border-radius: 999px;
+      background: rgba(58, 107, 255, 0.12);
+      filter: blur(72px);
+      pointer-events: none;
+    }
+    .glow-one { top: -120px; right: -80px; }
+    .glow-two { bottom: -150px; left: -80px; }
+    .card {
+      position: relative;
+      width: min(100%, 480px);
+      padding: 34px;
+      overflow: hidden;
+      border: 1px solid var(--edge);
+      border-radius: 24px;
+      background: var(--panel);
+      box-shadow: 0 24px 80px rgba(31, 41, 78, 0.12), 0 2px 12px rgba(17, 17, 17, 0.05);
+      backdrop-filter: blur(20px);
+      -webkit-backdrop-filter: blur(20px);
+    }
+    .brand { display: flex; align-items: center; gap: 11px; margin-bottom: 34px; font-weight: 700; letter-spacing: -0.02em; }
+    .logo { width: 38px; height: 38px; filter: drop-shadow(0 8px 14px rgba(58, 107, 255, 0.22)); }
+    .status {
+      display: inline-flex;
+      align-items: center;
+      gap: 7px;
+      margin-bottom: 18px;
+      border-radius: 999px;
+      padding: 7px 11px 7px 8px;
+      background: var(--status-soft);
+      color: var(--status);
+      font-size: 12px;
+      font-weight: 650;
+      letter-spacing: 0.01em;
+    }
+    .status-icon { width: 18px; height: 18px; fill: none; stroke: currentColor; stroke-width: 2; stroke-linecap: round; stroke-linejoin: round; }
+    h1 { margin: 0; font-size: clamp(26px, 6vw, 32px); line-height: 1.15; letter-spacing: -0.035em; }
+    .message { margin: 14px 0 0; color: var(--muted); font-size: 15px; line-height: 1.65; }
+    .next-step {
+      display: flex;
+      align-items: flex-start;
+      gap: 11px;
+      margin-top: 28px;
+      padding-top: 22px;
+      border-top: 1px solid var(--edge);
+      color: var(--muted);
+      font-size: 13px;
+      line-height: 1.55;
+    }
+    .window-icon { flex: none; width: 18px; height: 18px; margin-top: 1px; color: var(--accent); fill: none; stroke: currentColor; stroke-width: 1.8; stroke-linecap: round; stroke-linejoin: round; }
+    @media (prefers-color-scheme: dark) {
+      :root {
+        --accent-soft: rgba(58, 107, 255, 0.16);
+        --canvas: #090a0d;
+        --panel: rgba(20, 22, 28, 0.9);
+        --text: #f7f8fb;
+        --muted: #a6a9b2;
+        --edge: rgba(255, 255, 255, 0.09);
+        --status: ${tone === "success" ? "#63d69a" : "#ff8484"};
+        --status-soft: ${tone === "success" ? "rgba(44, 203, 127, 0.12)" : "rgba(255, 93, 93, 0.12)"};
+      }
+      body {
+        background:
+          radial-gradient(circle at 18% 18%, rgba(46, 216, 255, 0.09), transparent 34rem),
+          radial-gradient(circle at 82% 78%, rgba(91, 87, 255, 0.12), transparent 32rem),
+          var(--canvas);
+      }
+      .card { box-shadow: 0 26px 90px rgba(0, 0, 0, 0.42); }
+    }
+    @media (max-width: 520px) {
+      body { padding: 16px; }
+      .card { padding: 26px 22px; border-radius: 20px; }
+      .brand { margin-bottom: 28px; }
+    }
+    @media (prefers-reduced-motion: no-preference) {
+      .card { animation: enter 420ms cubic-bezier(.2, .75, .25, 1) both; }
+      .status-icon { animation: settle 520ms 160ms cubic-bezier(.2, .8, .25, 1.25) both; }
+      @keyframes enter { from { opacity: 0; transform: translateY(10px) scale(.985); } }
+      @keyframes settle { from { opacity: 0; transform: scale(.65); } }
+    }
+  </style>
+</head>
+<body>
+  <div class="glow glow-one"></div>
+  <div class="glow glow-two"></div>
+  <main class="card">
+    <div class="brand">
+      <svg class="logo" viewBox="0 0 72 72" aria-hidden="true">
+        <rect width="72" height="72" rx="20" fill="#3a6bff" />
+        <path d="M22 22l28 28M50 22 22 50" stroke="#fff" stroke-width="8" stroke-linecap="round" />
+      </svg>
+      <span>XOPC</span>
+    </div>
+    <div class="status">
+      <svg class="status-icon" viewBox="0 0 24 24" aria-hidden="true">${tone === "success" ? "<path d=\"m7.5 12 3 3 6-7\" />" : "<path d=\"M12 8v5m0 3.5v.01\" />"}</svg>
+      <span>${tone === "success" ? "Authorization successful" : "Authorization needs attention"}</span>
+    </div>
+    <h1>${safeTitle}</h1>
+    <p class="message">${safeMessage}</p>
+    <div class="next-step">
+      <svg class="window-icon" viewBox="0 0 24 24" aria-hidden="true"><rect x="3" y="5" width="18" height="14" rx="2" /><path d="M3 9h18" /></svg>
+      <span>You can safely close this window and return to XOPC.</span>
+    </div>
+  </main>
+</body>
+</html>`;
 }
 async function loginWithBrowser(callbacks) {
 	if (callbacks.signal?.aborted) throw callbacks.signal.reason instanceof Error ? callbacks.signal.reason : /* @__PURE__ */ new Error("XOPC OAuth login cancelled");
@@ -49,7 +205,7 @@ async function loginWithBrowser(callbacks) {
 			const url = new URL(request.url ?? "", "http://127.0.0.1");
 			if (url.pathname !== CALLBACK_PATH) {
 				response.statusCode = 404;
-				response.end(callbackHtml("Authorization callback not found", "This is not a valid XOPC OAuth callback URL."));
+				response.end(callbackHtml("Authorization callback not found", "This is not a valid XOPC OAuth callback URL.", "error"));
 				return;
 			}
 			const returnedState = url.searchParams.get("state");
@@ -58,24 +214,24 @@ async function loginWithBrowser(callbacks) {
 			if (returnedState !== state) {
 				const error = /* @__PURE__ */ new Error("XOPC OAuth state mismatch");
 				response.statusCode = 400;
-				response.end(callbackHtml("Authorization failed", error.message));
+				response.end(callbackHtml("Authorization failed", error.message, "error"));
 				settle?.({ error });
 				return;
 			}
 			if (oauthError || !code) {
 				const error = /* @__PURE__ */ new Error(oauthError === "access_denied" ? "XOPC OAuth authorization was denied" : "XOPC OAuth callback did not include an authorization code");
 				response.statusCode = 400;
-				response.end(callbackHtml("Authorization failed", error.message));
+				response.end(callbackHtml("Authorization failed", error.message, "error"));
 				settle?.({ error });
 				return;
 			}
 			response.statusCode = 200;
-			response.end(callbackHtml("Authorization complete", "XOPC received the authorization callback successfully."));
+			response.end(callbackHtml("Authorization complete", "XOPC received the authorization callback successfully.", "success"));
 			settle?.({ code });
 		} catch {
 			const error = /* @__PURE__ */ new Error("XOPC OAuth callback could not be processed");
 			response.statusCode = 500;
-			response.end(callbackHtml("Authorization failed", error.message));
+			response.end(callbackHtml("Authorization failed", error.message, "error"));
 			settle?.({ error });
 		}
 	});

package/dist/src/browser/providers/cloakbrowser.js

@@ -11,9 +11,9 @@ import { createReadStream, createWriteStream } from "node:fs";
 import { spawn } from "node:child_process";
 import { createHash } from "node:crypto";
 import { mkdir, mkdtemp, rm, stat } from "node:fs/promises";
-import { Readable, Transform } from "node:stream";
 import AdmZip from "adm-zip";
 import { pipeline } from "node:stream/promises";
+import { Readable, Transform } from "node:stream";
 //#region src/browser/providers/cloakbrowser.ts
 /**
 * CloakBrowser provider — anti-fingerprint Chromium with stealth capabilities.

package/dist/src/cli/command-loaders.js

@@ -15,6 +15,7 @@ const REGISTRY_COMMAND_MODULES = {
 	project: () => import("./commands/project.js"),
 	config: () => import("./commands/config.js"),
 	doctor: () => import("./commands/doctor/index.js"),
+	runtime: () => import("./commands/runtime.js"),
 	image: () => import("./commands/image.js"),
 	channels: () => import("./commands/channels.js"),
 	models: () => import("./commands/models.js"),

package/dist/src/cli/command-manifest.js

@@ -79,6 +79,10 @@ const ROOT_HELP_COMMANDS = [
 		name: "doctor [options]",
 		description: "Check xopc installation health and diagnose common issues"
 	},
+	{
+		name: "runtime",
+		description: "Manage Node.js and Python tool runtimes used by agents"
+	},
 	{
 		name: "update [options]",
 		description: "Check for and install xopc updates"

package/dist/src/cli/commands/doctor/checks/node-version.js

@@ -7,21 +7,21 @@ async function checkNodeVersion(_ctx) {
 	const major = parseNodeMajorVersion();
 	if (major === 0) return {
 		id: "node-version",
-		label: "Node.js",
+		label: "Host Node.js",
 		status: "warn",
 		message: "Could not parse Node.js version.",
 		hints: [`process.version=${process.version}`]
 	};
 	if (major < 22) return {
 		id: "node-version",
-		label: "Node.js",
+		label: "Host Node.js",
 		status: "fail",
 		message: `Node ${major} is below the required minimum (22).`,
 		hints: ["Install Node.js 22+ from https://nodejs.org/"]
 	};
 	return {
 		id: "node-version",
-		label: "Node.js",
+		label: "Host Node.js",
 		status: "pass",
 		message: `Node.js ${process.version} meets the project requirement (>= 22).`,
 		hints: []

package/dist/src/cli/commands/doctor/checks/tool-runtimes.d.ts

@@ -0,0 +1,2 @@
+import type { CheckResult, DoctorContext } from '../types.js';
+export declare function checkToolRuntimes(ctx: DoctorContext): Promise<CheckResult>;

package/dist/src/cli/commands/doctor/checks/tool-runtimes.js

@@ -0,0 +1,36 @@
+import { init_loader, loadConfig } from "../../../../config/loader.js";
+import { ManagedRuntimeManager } from "../../../../runtime-tools/manager.js";
+//#region src/cli/commands/doctor/checks/tool-runtimes.ts
+init_loader();
+async function checkToolRuntimes(ctx) {
+	const config = loadConfig(ctx.configPath);
+	const statuses = await new ManagedRuntimeManager({
+		stateDir: ctx.stateDir,
+		config: config.runtimeTools
+	}).statusAll();
+	const invalid = statuses.filter((status) => status.state === "corrupted" || status.state === "failed");
+	const absent = statuses.filter((status) => status.state === "absent");
+	if (invalid.length > 0) return {
+		id: "tool-runtimes",
+		label: "Agent tool runtimes",
+		status: "fail",
+		message: `${invalid.map((status) => status.runtime).join(", ")} runtime installation is invalid.`,
+		hints: invalid.map((status) => `Run xopc runtime repair ${status.runtime}`)
+	};
+	if (absent.length > 0) return {
+		id: "tool-runtimes",
+		label: "Agent tool runtimes",
+		status: "warn",
+		message: `${absent.map((status) => status.runtime).join(", ")} runtime is not installed.`,
+		hints: absent.map((status) => `Run xopc runtime install ${status.runtime}`)
+	};
+	return {
+		id: "tool-runtimes",
+		label: "Agent tool runtimes",
+		status: "pass",
+		message: statuses.map((status) => status.message).join("; "),
+		hints: []
+	};
+}
+//#endregion
+export { checkToolRuntimes };