@xopcai/xopc 0.0.210 → 0.0.213

package/dist/src/extensions/install.js

@@ -7,8 +7,9 @@ import { checkEngineCompatibility } from "./engine-check.js";
 import { collectExtensionPackageDependencyIssues } from "./package-contract.js";
 import { dirname, isAbsolute, join, resolve, sep } from "path";
 import { cpSync, existsSync, mkdirSync, mkdtempSync, readFileSync, readdirSync, rmSync, writeFileSync } from "fs";
-import { execSync } from "child_process";
+import { execFileSync } from "node:child_process";
 import AdmZip from "adm-zip";
+import semver from "semver";
 import { tmpdir } from "os";
 //#region src/extensions/install.ts
 /**
@@ -21,6 +22,58 @@ init_package_version();
 init_logger();
 const log = createLogger("ExtensionInstall");
 const NPM_INSTALL_ENV = process.env.XOPC_EXTENSION_NPM_INSTALL?.trim().toLowerCase();
+const NPM_INSTALL_SCRIPTS_ENV = process.env.XOPC_EXTENSION_NPM_INSTALL_SCRIPTS?.trim().toLowerCase();
+const ALLOW_NPM_INSTALL_SCRIPTS = [
+	"1",
+	"true",
+	"allow"
+].includes(NPM_INSTALL_SCRIPTS_ENV ?? "");
+const NPM_PACKAGE_PART_RE = /^(?![._])[a-z0-9][a-z0-9._~-]*$/;
+/** Accept registry package names with an optional exact semver; reject URLs, paths, tags, and ranges. */
+function validateNpmPackageSpec(packageSpec) {
+	if (!packageSpec || packageSpec !== packageSpec.trim() || /\s/.test(packageSpec)) return {
+		ok: false,
+		error: "npm package spec must not be empty or contain whitespace"
+	};
+	let packageName = packageSpec;
+	let version;
+	if (packageSpec.startsWith("@")) {
+		const slashIndex = packageSpec.indexOf("/");
+		const versionSeparator = packageSpec.lastIndexOf("@");
+		if (slashIndex <= 1) return {
+			ok: false,
+			error: "Invalid scoped npm package name"
+		};
+		if (versionSeparator > slashIndex) {
+			packageName = packageSpec.slice(0, versionSeparator);
+			version = packageSpec.slice(versionSeparator + 1);
+		}
+	} else {
+		const versionSeparator = packageSpec.lastIndexOf("@");
+		if (versionSeparator > 0) {
+			packageName = packageSpec.slice(0, versionSeparator);
+			version = packageSpec.slice(versionSeparator + 1);
+		}
+	}
+	if (packageName.length > 214) return {
+		ok: false,
+		error: "npm package name exceeds 214 characters"
+	};
+	const parts = packageName.startsWith("@") ? packageName.slice(1).split("/") : [packageName];
+	if (parts.length !== (packageName.startsWith("@") ? 2 : 1) || parts.some((part) => !NPM_PACKAGE_PART_RE.test(part))) return {
+		ok: false,
+		error: "Only npm registry package names are allowed (for example pkg or @scope/pkg)"
+	};
+	if (version !== void 0 && !semver.valid(version)) return {
+		ok: false,
+		error: "npm package versions must be exact semver values; tags and ranges are not allowed"
+	};
+	return {
+		ok: true,
+		packageName,
+		...version ? { version } : {}
+	};
+}
 function extractExecSyncOutput(error) {
 	if (!error || typeof error !== "object") return "";
 	const o = error;
@@ -41,8 +94,9 @@ function truncateOutput(text, max = 4500) {
 }
 /**
 * Install production `node_modules` for an unpacked extension (package.json dependencies).
-* Uses pnpm when `pnpm-lock.yaml` is present, otherwise npm. Set `XOPC_EXTENSION_NPM_INSTALL=skip`
-* to skip (extensions must ship runnable code or you install deps manually).
+* Uses pnpm when `pnpm-lock.yaml` is present, otherwise npm. Lifecycle scripts are disabled by
+* default; set `XOPC_EXTENSION_NPM_INSTALL_SCRIPTS=allow` only for a reviewed extension that needs
+* them. Set `XOPC_EXTENSION_NPM_INSTALL=skip` to skip dependency installation entirely.
 */
 function installExtensionProdDependencies(extensionDir) {
 	if (NPM_INSTALL_ENV === "skip" || NPM_INSTALL_ENV === "0" || NPM_INSTALL_ENV === "false") {
@@ -65,9 +119,9 @@ function installExtensionProdDependencies(extensionDir) {
 		env: process.env,
 		...process.platform === "win32" ? { shell: process.env.ComSpec && process.env.ComSpec.trim() || "cmd.exe" } : {}
 	};
-	const run = (label, command) => {
+	const run = (label, executable, args) => {
 		try {
-			execSync(command, execOpts);
+			execFileSync(executable, args, execOpts);
 			return { ok: true };
 		} catch (err) {
 			const out = truncateOutput(extractExecSyncOutput(err));
@@ -77,17 +131,38 @@ function installExtensionProdDependencies(extensionDir) {
 			};
 		}
 	};
-	if (existsSync(join(extensionDir, "pnpm-lock.yaml"))) {
-		const pnpm = run("pnpm", "pnpm install --prod --no-frozen-lockfile");
+	const usePnpm = existsSync(join(extensionDir, "pnpm-lock.yaml"));
+	const scriptArgs = ALLOW_NPM_INSTALL_SCRIPTS ? [] : ["--ignore-scripts"];
+	const npmExecutable = process.platform === "win32" ? "npm.cmd" : "npm";
+	const pnpmExecutable = process.platform === "win32" ? "pnpm.cmd" : "pnpm";
+	if (usePnpm) {
+		const pnpm = run("pnpm", pnpmExecutable, [
+			"install",
+			"--prod",
+			"--no-frozen-lockfile",
+			...scriptArgs
+		]);
 		if (pnpm.ok) return pnpm;
-		const npmFallback = run("npm", "npm install --omit=dev --no-audit --no-fund");
+		const npmFallback = run("npm", npmExecutable, [
+			"install",
+			"--omit=dev",
+			"--no-audit",
+			"--no-fund",
+			...scriptArgs
+		]);
 		if (npmFallback.ok) {
 			log.warn({ extensionDir }, "pnpm failed; extension dependencies installed with npm instead");
 			return { ok: true };
 		}
 		return npmFallback;
 	}
-	return run("npm", "npm install --omit=dev --no-audit --no-fund");
+	return run("npm", npmExecutable, [
+		"install",
+		"--omit=dev",
+		"--no-audit",
+		"--no-fund",
+		...scriptArgs
+	]);
 }
 function isSafeZipPath(name) {
 	if (!name) return false;
@@ -261,11 +336,20 @@ function resolveExtensionsDir(workspaceDir, global = false) {
 * Install extension from npm package
 */
 async function installFromNpm(packageSpec, extensionsDir, timeoutMs = 12e4) {
-	const tmpDir = join(tmpdir(), `xopc-install-${Date.now()}`);
+	const validation = validateNpmPackageSpec(packageSpec);
+	if (validation.ok === false) return {
+		ok: false,
+		error: `Invalid npm package spec: ${validation.error}`
+	};
+	const tmpDir = mkdtempSync(join(tmpdir(), "xopc-install-"));
 	try {
 		console.log(`📦 Downloading ${packageSpec} from npm...`);
-		mkdirSync(tmpDir, { recursive: true });
-		const packedFile = execSync(`npm pack ${packageSpec} --pack-destination ${tmpDir}`, {
+		const packedFile = execFileSync(process.platform === "win32" ? "npm.cmd" : "npm", [
+			"pack",
+			packageSpec,
+			"--pack-destination",
+			tmpDir
+		], {
 			timeout: timeoutMs,
 			encoding: "utf-8",
 			stdio: "pipe"
@@ -274,9 +358,22 @@ async function installFromNpm(packageSpec, extensionsDir, timeoutMs = 12e4) {
 			ok: false,
 			error: "Failed to download package from npm"
 		};
+		if (packedFile !== packedFile.split(/[\\/]/).pop() || !packedFile.endsWith(".tgz")) return {
+			ok: false,
+			error: "npm returned an invalid archive filename"
+		};
 		const archivePath = join(tmpDir, packedFile);
+		if (!existsSync(archivePath)) return {
+			ok: false,
+			error: "npm package archive was not created"
+		};
 		console.log(`📂 Extracting ${packedFile}...`);
-		execSync(`tar -xzf ${archivePath} -C ${tmpDir}`, {
+		execFileSync("tar", [
+			"-xzf",
+			archivePath,
+			"-C",
+			tmpDir
+		], {
 			timeout: 3e4,
 			stdio: "pipe"
 		});
@@ -532,4 +629,4 @@ function readManifest(extensionDir) {
 	}
 }
 //#endregion
-export { installExtensionFromStoreZip, installFromLocal, installFromNpm, listAllExtensions, peekExtensionIdFromStoreZip, peekExtensionManifestFromStoreZip, peekExtensionPackageJsonFromStoreZip, removeExtension, resolveExtensionsDir };
+export { installExtensionFromStoreZip, installFromLocal, installFromNpm, listAllExtensions, peekExtensionIdFromStoreZip, peekExtensionManifestFromStoreZip, peekExtensionPackageJsonFromStoreZip, removeExtension, resolveExtensionsDir, validateNpmPackageSpec };

package/dist/src/extensions/loader.js

@@ -290,13 +290,6 @@ var ExtensionLoader = class {
 	}
 	async loadExtension(config) {
 		try {
-			const cacheKey = this.cache.buildKey(this.options, [config.id]);
-			const cached = this.cache.get(cacheKey);
-			if (cached) {
-				log.debug({ extensionId: config.id }, "Extension loaded from cache");
-				return cached;
-			}
-			if (this.extensionInstances.has(config.id)) return this.extensionInstances.get(config.id);
 			let extensionPath;
 			if (isAbsolute(config.path)) extensionPath = config.path;
 			else extensionPath = resolveExtensionPath(config.path, this.options) || resolveExtensionPath(config.id, this.options);
@@ -314,19 +307,30 @@ var ExtensionLoader = class {
 			}, "Resolved extension path");
 			const source = config.source || "bundled";
 			const safetyResult = checkExtensionPathSafety(extensionPath, extensionPath, source);
-			if (!safetyResult.safe) {
+			if (this.securityConfig.checkPermissions && !safetyResult.safe) {
 				logSecurityIssue(config.id, safetyResult);
-				if (this.securityConfig.checkPermissions && source !== "bundled") {
-					if (!isExtensionAllowed(config.id, this.securityConfig)) {
-						this.diagnostics.error(config.id, `Extension not allowed: ${safetyResult.detail}`);
-						log.error({
-							extensionId: config.id,
-							reason: safetyResult.reason
-						}, "Extension blocked by security policy");
-						return null;
-					}
-				}
+				this.diagnostics.error(config.id, `Unsafe extension path: ${safetyResult.detail}`);
+				log.error({
+					extensionId: config.id,
+					reason: safetyResult.reason
+				}, "Extension blocked because its path is unsafe");
+				return null;
 			}
+			if (source !== "bundled" && !isExtensionAllowed(config.id, this.securityConfig)) {
+				this.diagnostics.error(config.id, "Extension is not present in extensions.security.allow");
+				log.error({
+					extensionId: config.id,
+					source
+				}, "Extension blocked because it is not trusted by security policy");
+				return null;
+			}
+			const cacheKey = this.cache.buildKey(this.options, [config.id]);
+			const cached = this.cache.get(cacheKey);
+			if (cached) {
+				log.debug({ extensionId: config.id }, "Extension loaded from cache");
+				return cached;
+			}
+			if (this.extensionInstances.has(config.id)) return this.extensionInstances.get(config.id);
 			provenanceTracker.track(config.id, source);
 			const manifest = this.loadManifest(extensionPath);
 			if (!manifest) {

package/dist/src/gateway/hono/app.js

@@ -10,7 +10,7 @@ import { buildGatewayConsoleCspHeader } from "../security/csp.js";
 import { checkBrowserOrigin } from "../security/origin-check.js";
 import { auth } from "./middleware/auth.js";
 import { operatorScopes } from "./middleware/scopes.js";
-import { createChannelRateLimitMiddleware, createChatRateLimitMiddleware, createStrictRateLimitMiddleware, createTaskRateLimitMiddleware, createXopcCloudPollRateLimitMiddleware } from "./middleware/strict-rate-limit.js";
+import { createChannelRateLimitMiddleware, createChatRateLimitMiddleware, createMediaRateLimitMiddleware, createStrictRateLimitMiddleware, createTaskRateLimitMiddleware, createXopcCloudPollRateLimitMiddleware } from "./middleware/strict-rate-limit.js";
 import { logContextMiddleware } from "./middleware/log-context.js";
 import { logger } from "./middleware/logger.js";
 import { routeErrorMiddleware } from "./middleware/route-errors.js";
@@ -147,7 +147,7 @@ function createHonoApp(config) {
 	const DEFAULT_API_BODY_MAX = 1 * 1024 * 1024;
 	const SKILL_UPLOAD_BODY_MAX = 10 * 1024 * 1024;
 	const NOTE_MEDIA_BODY_MAX = 25 * 1024 * 1024;
-	const VOICE_TRANSCRIBE_BODY_MAX = 35 * 1024 * 1024;
+	const VOICE_TRANSCRIBE_BODY_MAX = 26 * 1024 * 1024;
 	const SESSION_INPUT_BODY_MAX = maxSessionInputRequestBodyBytes();
 	const isNoteMediaUploadRequest = (path, method, contentType) => {
 		if (method !== "POST") return false;
@@ -175,7 +175,7 @@ function createHonoApp(config) {
 	}));
 	app.use("/api/*", async (c, next) => {
 		const contentType = c.req.header("content-type");
-		const maxSize = c.req.method === "POST" && c.req.path === "/api/tasks" || c.req.method === "POST" && /^\/api\/sessions\/[^/]+\/inputs$/.test(c.req.path) || c.req.method === "POST" && /^\/api\/tasks\/[^/]+\/inputs$/.test(c.req.path) || c.req.method === "PATCH" && /^\/api\/sessions\/[^/]+\/inputs\/[^/]+$/.test(c.req.path) ? SESSION_INPUT_BODY_MAX : c.req.path === "/api/skills/upload" ? SKILL_UPLOAD_BODY_MAX : c.req.path === "/api/voice/transcribe" || c.req.path === "/api/voice/transcriptions" ? VOICE_TRANSCRIBE_BODY_MAX : isNoteMediaUploadRequest(c.req.path, c.req.method, contentType) ? NOTE_MEDIA_BODY_MAX : isProjectFileUploadRequest(c.req.path, c.req.method, contentType) ? NOTE_MEDIA_BODY_MAX : discussionUploadBodyMax(c.req.path, c.req.method, contentType) ?? DEFAULT_API_BODY_MAX;
+		const maxSize = c.req.method === "POST" && c.req.path === "/api/tasks" || c.req.method === "POST" && /^\/api\/sessions\/[^/]+\/inputs$/.test(c.req.path) || c.req.method === "POST" && /^\/api\/tasks\/[^/]+\/inputs$/.test(c.req.path) || c.req.method === "PATCH" && /^\/api\/sessions\/[^/]+\/inputs\/[^/]+$/.test(c.req.path) ? SESSION_INPUT_BODY_MAX : c.req.path === "/api/skills/upload" ? SKILL_UPLOAD_BODY_MAX : c.req.path === "/api/voice/transcriptions" ? VOICE_TRANSCRIBE_BODY_MAX : isNoteMediaUploadRequest(c.req.path, c.req.method, contentType) ? NOTE_MEDIA_BODY_MAX : isProjectFileUploadRequest(c.req.path, c.req.method, contentType) ? NOTE_MEDIA_BODY_MAX : discussionUploadBodyMax(c.req.path, c.req.method, contentType) ?? DEFAULT_API_BODY_MAX;
 		const maxSizeMb = Math.ceil(maxSize / (1024 * 1024));
 		return bodyLimit({
 			maxSize,
@@ -213,6 +213,10 @@ function createHonoApp(config) {
 		trustedProxies: service.currentConfig.gateway?.trustedProxies,
 		allowRealIpFallback: service.currentConfig.gateway?.allowRealIpFallback === true
 	}) });
+	const mediaRateLimitMiddleware = createMediaRateLimitMiddleware({ getTrustedProxyContext: () => ({
+		trustedProxies: service.currentConfig.gateway?.trustedProxies,
+		allowRealIpFallback: service.currentConfig.gateway?.allowRealIpFallback === true
+	}) });
 	const taskRateLimitMiddleware = createTaskRateLimitMiddleware({ getTrustedProxyContext: () => ({
 		trustedProxies: service.currentConfig.gateway?.trustedProxies,
 		allowRealIpFallback: service.currentConfig.gateway?.allowRealIpFallback === true
@@ -225,6 +229,7 @@ function createHonoApp(config) {
 		service,
 		strictRateLimitMiddleware,
 		chatRateLimitMiddleware,
+		mediaRateLimitMiddleware,
 		taskRateLimitMiddleware,
 		xopcCloudPollRateLimitMiddleware: createXopcCloudPollRateLimitMiddleware({ getTrustedProxyContext: () => ({
 			trustedProxies: service.currentConfig.gateway?.trustedProxies,

package/dist/src/gateway/hono/lib/config-payload.js

@@ -8,10 +8,10 @@ import { getProviderRegistry, init_plugin_registry } from "../../../providers/pl
 import { getAllProviders, init_providers, isProviderConfigured } from "../../../providers/index.js";
 import { normalizeConfiguredMcpServers } from "../../../config/mcp-config-normalize.js";
 import { resolveShareConfig } from "../../../share/share-config.js";
-import { maskTunnelSecretForWeb } from "../../../tunnel/env.js";
 import { resolveSessionConfigForWeb, resolveUpdateConfigForWeb } from "../../../config/web-patch.js";
 import { GENERIC_MASKED_SECRET, maskSecretLength } from "./mask-secret-length.js";
 import { safeToolsWebForGet } from "../../config-tools-web.js";
+import { maskTunnelSecretForWeb } from "../../../tunnel/env.js";
 import { buildSafeProvidersConfigForWeb } from "./safe-providers-config.js";
 import { maskSttConfigForWeb, maskTtsConfigForWeb } from "./safe-voice-config.js";
 //#region src/gateway/hono/lib/config-payload.ts

package/dist/src/gateway/hono/middleware/auth.js

@@ -1,13 +1,13 @@
 import { logAuthEvent } from "../../../utils/logger/audit.js";
 import { createLogger } from "../../../utils/logger/index.js";
 import { init_logger } from "../../../utils/logger.js";
+import { safeEqualSecret } from "../../security/secret-equal.js";
+import { resolveClientIpFromRequest } from "../../client-ip.js";
 import { authPolicyConfig, buckets, resolveAuthRateLimit } from "../../rate-limit/buckets.js";
 import { getClientIpFromHeaders } from "../../security/loopback.js";
 import { resolveAuthTracking } from "../../rate-limit/auth-policy.js";
 import { isAuthRateLimitGloballyDisabled } from "../../rate-limit/env-flags.js";
 import "../../rate-limit/index.js";
-import { safeEqualSecret } from "../../security/secret-equal.js";
-import { resolveClientIpFromRequest } from "../../client-ip.js";
 import { authorizeTrustedProxy } from "../../trusted-proxy.js";
 import { createMiddleware } from "hono/factory";
 import { getConnInfo } from "@hono/node-server/conninfo";

package/dist/src/gateway/hono/middleware/logger.js

@@ -1,7 +1,7 @@
 import { createLogger } from "../../../utils/logger/index.js";
 import { init_logger } from "../../../utils/logger.js";
-import { getClientIpFromHeaders } from "../../security/loopback.js";
 import { resolveClientIpFromRequest } from "../../client-ip.js";
+import { getClientIpFromHeaders } from "../../security/loopback.js";
 import { createMiddleware } from "hono/factory";
 import { getConnInfo } from "@hono/node-server/conninfo";
 //#region src/gateway/hono/middleware/logger.ts

package/dist/src/gateway/hono/middleware/strict-rate-limit.d.ts

@@ -16,6 +16,10 @@ export declare function createChatRateLimitMiddleware(deps: StrictRateLimitDeps)
     error: string;
     code: string;
 }, 429, "json">>;
+export declare function createMediaRateLimitMiddleware(deps: StrictRateLimitDeps): import("hono").MiddlewareHandler<any, string, {}, Response & import("hono").TypedResponse<{
+    error: string;
+    code: string;
+}, 429, "json">>;
 export declare function createTaskRateLimitMiddleware(deps: StrictRateLimitDeps): import("hono").MiddlewareHandler<any, string, {}, Response & import("hono").TypedResponse<{
     error: string;
     code: string;

package/dist/src/gateway/hono/middleware/strict-rate-limit.js

@@ -1,9 +1,9 @@
 import { createLogger } from "../../../utils/logger/index.js";
 import { init_logger } from "../../../utils/logger.js";
+import { resolveClientIpFromRequest } from "../../client-ip.js";
 import { buckets } from "../../rate-limit/buckets.js";
 import { getClientIpFromHeaders } from "../../security/loopback.js";
 import "../../rate-limit/index.js";
-import { resolveClientIpFromRequest } from "../../client-ip.js";
 import { createMiddleware } from "hono/factory";
 import { getConnInfo } from "@hono/node-server/conninfo";
 //#region src/gateway/hono/middleware/strict-rate-limit.ts
@@ -70,6 +70,13 @@ function createChatRateLimitMiddleware(deps) {
 		reason: "chat_rate_limit_exceeded"
 	});
 }
+function createMediaRateLimitMiddleware(deps) {
+	return createClientRateLimitMiddleware(deps, {
+		limiter: () => buckets.mediaApi(),
+		exceededMessage: "Media API rate limit exceeded",
+		reason: "media_rate_limit_exceeded"
+	});
+}
 function createTaskRateLimitMiddleware(deps) {
 	return createClientRateLimitMiddleware(deps, {
 		limiter: () => buckets.taskApi(),
@@ -92,4 +99,4 @@ function createChannelRateLimitMiddleware(deps) {
 	});
 }
 //#endregion
-export { createChannelRateLimitMiddleware, createChatRateLimitMiddleware, createStrictRateLimitMiddleware, createTaskRateLimitMiddleware, createXopcCloudPollRateLimitMiddleware };
+export { createChannelRateLimitMiddleware, createChatRateLimitMiddleware, createMediaRateLimitMiddleware, createStrictRateLimitMiddleware, createTaskRateLimitMiddleware, createXopcCloudPollRateLimitMiddleware };

package/dist/src/gateway/hono/oauth-async.d.ts

@@ -7,8 +7,17 @@
  */
 import { Hono } from 'hono';
 import type { GatewayService } from '../service.js';
-import { type OAuthCredentials } from '../../auth/oauth/types.js';
-export declare function refreshModelCatalogAfterOAuth(provider: string, service: Pick<GatewayService, 'getModelCatalogSync'>): Promise<void>;
+import type { Config } from '../../config/schema.js';
+import { type CapabilityId } from '../../capabilities/readiness/index.js';
+import type { CatalogReadiness } from '../../providers/xopc-cloud-catalog-coordinator.js';
+export interface OAuthCompletionReadiness {
+    authorized: true;
+    state: 'connected' | 'connected-degraded';
+    catalog: CatalogReadiness;
+    capabilities: Record<CapabilityId, 'ready' | 'unavailable' | 'disabled'>;
+}
+export declare function buildOAuthCompletionReadiness(config: Config, catalog: CatalogReadiness): OAuthCompletionReadiness;
+export declare function refreshModelCatalogAfterOAuth(provider: string, service: Pick<GatewayService, 'getModelCatalogSync'>): Promise<CatalogReadiness | undefined>;
 export declare function normalizeDesktopOAuthReturnPath(value: unknown): string | undefined;
 export declare function resolveOAuthLoginMethodPreference(params: {
     requestedMethod?: unknown;
@@ -16,6 +25,3 @@ export declare function resolveOAuthLoginMethodPreference(params: {
     remote: boolean;
 }): string | undefined;
 export declare function createOAuthAsyncHandler(service: GatewayService): Hono<import("hono/dist/types/types.js").BlankEnv, import("hono/dist/types/types.js").BlankSchema, "/">;
-export declare function getOAuthCredentialsFromCache(provider: string): OAuthCredentials | undefined;
-export declare function setOAuthCredentialsToCache(provider: string, creds: OAuthCredentials): void;
-export declare function deleteOAuthCredentialsFromCache(provider: string): void;

package/dist/src/gateway/hono/oauth-async.js

@@ -4,6 +4,8 @@ import { getOAuthProviderInterfaces, init_registry } from "../../auth/oauth/regi
 import { CredentialResolver, init_credentials } from "../../auth/credentials.js";
 import { isLoopbackHost } from "../host.js";
 import { resolveReverseProxyPublicUrl } from "../public-url.js";
+import { buildCapabilityPlansForConfig } from "../../capabilities/readiness/from-config.js";
+import "../../capabilities/readiness/index.js";
 import { Hono } from "hono";
 //#region src/gateway/hono/oauth-async.ts
 /**
@@ -17,10 +19,20 @@ init_registry();
 init_credentials();
 init_logger();
 const log = createLogger("OAuthAsync");
+function buildOAuthCompletionReadiness(config, catalog) {
+	const plans = buildCapabilityPlansForConfig(config);
+	const capabilities = Object.fromEntries(Object.entries(plans).map(([capability, plan]) => [capability, plan.status === "disabled" ? "disabled" : plan.status === "unavailable" ? "unavailable" : "ready"]));
+	return {
+		authorized: true,
+		state: Boolean(catalog.error) || Object.values(capabilities).some((status) => status === "unavailable") ? "connected-degraded" : "connected",
+		catalog,
+		capabilities
+	};
+}
 async function refreshModelCatalogAfterOAuth(provider, service) {
-	if (provider !== "xopc-cloud") return;
+	if (provider !== "xopc-cloud") return void 0;
 	try {
-		await service.getModelCatalogSync().refreshNow();
+		return await service.getModelCatalogSync().refreshNow();
 	} catch (err) {
 		const errorMessage = err instanceof Error ? err.message : String(err);
 		log.warn({
@@ -28,6 +40,16 @@ async function refreshModelCatalogAfterOAuth(provider, service) {
 			provider,
 			errorMessage
 		}, `OAuth completed, but the model catalog could not be refreshed: ${errorMessage}`);
+		return {
+			state: "unavailable",
+			source: "none",
+			modelCount: 0,
+			error: {
+				code: "refresh_failed",
+				message: errorMessage,
+				retryable: true
+			}
+		};
 	}
 }
 /** User-facing message when undici/fetch fails (often DNS, firewall, or wrong machine for localhost callback). */
@@ -172,6 +194,7 @@ function createOAuthAsyncHandler(service) {
 				verificationUri: session.verificationUri,
 				message: session.message,
 				error: session.error,
+				readiness: session.readiness,
 				expiresAt: session.expiresAt
 			}
 		});
@@ -301,13 +324,13 @@ async function runOAuthFlow(session, oauthProvider, service) {
 	};
 	try {
 		const credentials = await oauthProvider.login(callbacks);
-		setOAuthCredentialsToCache(session.provider, credentials);
 		await new CredentialResolver().saveOAuthCredentials(session.provider, credentials);
 		session.message = session.provider === "xopc-cloud" ? "OAuth login successful. Syncing available models..." : "OAuth login successful";
-		await refreshModelCatalogAfterOAuth(session.provider, service);
+		const catalog = await refreshModelCatalogAfterOAuth(session.provider, service);
+		if (catalog && session.provider === "xopc-cloud") session.readiness = buildOAuthCompletionReadiness(service.currentConfig, catalog);
 		session.status = "completed";
 		session.credentials = credentials;
-		session.message = "OAuth login successful";
+		session.message = session.readiness?.state === "connected-degraded" ? `OAuth login successful, but capability setup is degraded${catalog?.error ? `: ${catalog.error.message}` : ""}` : "OAuth login successful";
 		log.info({
 			sessionId: session.id,
 			provider: session.provider
@@ -331,15 +354,5 @@ async function runOAuthFlow(session, oauthProvider, service) {
 		session.manualCodeReject = void 0;
 	}
 }
-const oauthCredentialsCache = /* @__PURE__ */ new Map();
-function getOAuthCredentialsFromCache(provider) {
-	return oauthCredentialsCache.get(provider);
-}
-function setOAuthCredentialsToCache(provider, creds) {
-	oauthCredentialsCache.set(provider, creds);
-}
-function deleteOAuthCredentialsFromCache(provider) {
-	oauthCredentialsCache.delete(provider);
-}
 //#endregion
-export { createOAuthAsyncHandler, deleteOAuthCredentialsFromCache, getOAuthCredentialsFromCache, normalizeDesktopOAuthReturnPath, refreshModelCatalogAfterOAuth, resolveOAuthLoginMethodPreference, setOAuthCredentialsToCache };
+export { buildOAuthCompletionReadiness, createOAuthAsyncHandler, normalizeDesktopOAuthReturnPath, refreshModelCatalogAfterOAuth, resolveOAuthLoginMethodPreference };

package/dist/src/gateway/hono/oauth.d.ts

@@ -5,6 +5,4 @@
  */
 import { Hono } from 'hono';
 import type { GatewayService } from '../service.js';
-/** No-op: OAuth tokens live on disk under auth paths; cache is populated during login. */
-export declare function loadOAuthCredentialsToCache(_service: GatewayService): void;
-export declare function createOAuthHandler(_service: GatewayService): Hono<import("hono/dist/types/types.js").BlankEnv, import("hono/dist/types/types.js").BlankSchema, "/">;
+export declare function createOAuthHandler(service: GatewayService): Hono<import("hono/dist/types/types.js").BlankEnv, import("hono/dist/types/types.js").BlankSchema, "/">;

package/dist/src/gateway/hono/oauth.js

@@ -1,6 +1,8 @@
 import { getOAuthProviderInterfaces, init_registry } from "../../auth/oauth/registry.js";
 import { CredentialResolver, init_credentials } from "../../auth/credentials.js";
 import { getProviderAuthState, init_providers, isProviderConfigured } from "../../providers/index.js";
+import { disconnectProvider } from "../../providers/provider-disconnect.js";
+import { buildOAuthCompletionReadiness, refreshModelCatalogAfterOAuth } from "./oauth-async.js";
 import { Hono } from "hono";
 //#region src/gateway/hono/oauth.ts
 /**
@@ -12,19 +14,7 @@ init_registry();
 init_credentials();
 init_providers();
 const OAUTH_PROVIDERS = getOAuthProviderInterfaces();
-const oauthCredentialsCache = /* @__PURE__ */ new Map();
-function getOAuthCredentialsFromCache(provider) {
-	return oauthCredentialsCache.get(provider);
-}
-function setOAuthCredentialsToCache(provider, creds) {
-	oauthCredentialsCache.set(provider, creds);
-}
-function deleteOAuthCredentialsFromCache(provider) {
-	oauthCredentialsCache.delete(provider);
-}
-/** No-op: OAuth tokens live on disk under auth paths; cache is populated during login. */
-function loadOAuthCredentialsToCache(_service) {}
-function createOAuthHandler(_service) {
+function createOAuthHandler(service) {
 	const oauth = new Hono();
 	/**
 	* POST /api/auth/oauth/start
@@ -73,21 +63,28 @@ function createOAuthHandler(_service) {
 					return prompt.options.find((option) => option.id === "browser")?.id ?? prompt.options[0]?.id;
 				}
 			});
-			setOAuthCredentialsToCache(provider, credentials);
 			await new CredentialResolver().saveOAuthCredentials(provider, credentials);
+			const catalog = await refreshModelCatalogAfterOAuth(provider, service);
+			const readiness = catalog ? buildOAuthCompletionReadiness(service.currentConfig, catalog) : void 0;
+			service.emit("provider.auth.changed", {
+				provider,
+				connected: true
+			});
 			return c.json({
 				ok: true,
 				payload: {
 					success: true,
 					provider,
-					message: "OAuth login successful",
+					message: readiness?.state === "connected-degraded" ? "OAuth login successful, but capability setup is degraded" : "OAuth login successful",
 					expires: credentials.expires,
 					authUrl: authResult?.url,
 					deviceCode: authResult?.deviceCode,
 					verificationUri: authResult?.verificationUri,
 					instructions: authResult?.instructions,
 					usesCallbackServer: oauthProvider.usesCallbackServer ?? false,
-					manualCodeRequested
+					manualCodeRequested,
+					catalog,
+					readiness
 				}
 			});
 		} catch (err) {
@@ -101,16 +98,15 @@ function createOAuthHandler(_service) {
 	*/
 	oauth.get("/:provider", async (c) => {
 		const provider = c.req.param("provider");
-		const credentials = getOAuthCredentialsFromCache(provider);
 		const authState = await getProviderAuthState(provider);
 		const configured = await isProviderConfigured(provider);
 		return c.json({
 			ok: true,
 			payload: {
-				configured: configured || !!credentials,
+				configured,
 				authMode: authState.authMode,
 				authStatus: authState.authStatus,
-				expiresAt: authState.expiresAt ?? credentials?.expires
+				expiresAt: authState.expiresAt
 			}
 		});
 	});
@@ -120,8 +116,12 @@ function createOAuthHandler(_service) {
 	*/
 	oauth.delete("/:provider", async (c) => {
 		const provider = c.req.param("provider");
-		deleteOAuthCredentialsFromCache(provider);
-		await new CredentialResolver().deleteProviderCredential(provider);
+		await disconnectProvider(provider);
+		service.emit("provider.auth.changed", {
+			provider,
+			connected: false
+		});
+		if (provider === "xopc-cloud") service.emit("model-catalog.updated", { modelCount: 0 });
 		return c.json({
 			ok: true,
 			payload: { disconnected: provider }
@@ -144,4 +144,4 @@ function createOAuthHandler(_service) {
 	return oauth;
 }
 //#endregion
-export { createOAuthHandler, loadOAuthCredentialsToCache };
+export { createOAuthHandler };

package/dist/src/gateway/hono/routes/auth-registry-extensions.js

@@ -3,8 +3,8 @@ import { ActivationPlanner } from "../../../extensions/activation-planner.js";
 import { mergeActivationContext } from "../../../extensions/activation-context.js";
 import { fetchRegistry, listExtensions, searchExtensions } from "../../../extensions/marketplace.js";
 import { buildWhenContextSnapshot } from "../../../extensions/when-context.js";
-import { createOAuthHandler } from "../oauth.js";
 import { createOAuthAsyncHandler } from "../oauth-async.js";
+import { createOAuthHandler } from "../oauth.js";
 import { extensionAssetMimeType } from "../lib/extension-assets.js";
 import { loadExtensionStore, saveExtensionStore } from "../lib/extension-store.js";
 import { relative, resolve } from "node:path";

package/dist/src/gateway/hono/routes/config-patch/misc.js

@@ -3,11 +3,11 @@ import { BindingsConfigSchema, BrowserConfigSchema, McpConfigSchema, VoiceConfig
 import { CredentialResolver, init_credentials } from "../../../../auth/credentials.js";
 import { canonicalizeConfiguredMcpServer } from "../../../../config/mcp-config-normalize.js";
 import { setTuiDefaultAgentConfig } from "../../../../commands/agents.config.js";
-import { mergeTunnelConfigPatch } from "../../../../tunnel/tunnel-config.js";
 import { mergeGatewaySkillsMarketplacePatch, mergeSessionConfigPatch, mergeUpdateConfigPatch } from "../../../../config/web-patch.js";
 import { assertGatewayAuthConfigured, resolveGatewayAuth } from "../../../auth.js";
 import { isMaskedSecretPatchValue } from "../../lib/mask-secret-length.js";
 import { applyToolsWebPatch } from "../../../config-tools-web.js";
+import { mergeTunnelConfigPatch } from "../../../../tunnel/tunnel-config.js";
 import { assertGatewayRuntimeConfig } from "../../../runtime-config.js";
 import { mergeSttConfigPatch, mergeTtsConfigPatch } from "../../lib/safe-voice-config.js";
 import { PATCH_OK, patchError } from "./result.js";