@xopcai/xopc 0.0.221 → 0.0.223

package/dist/src/agent/service/process-direct-streaming.js

@@ -11,9 +11,16 @@ import { isVoiceLikeAttachment, mergeVoiceTranscriptsIntoUserText } from "../../
 import { applyReasoningVisibility } from "../streaming/reasoning-visibility.js";
 import { isSessionSourceBinding, summarizeSourceContext } from "../source-context/types.js";
 import { injectSourceContextsIntoUserMessage } from "../source-context/injector.js";
-import { AsyncQueue } from "./async-queue.js";
+import { AsyncQueue, AsyncQueueOverflowError } from "./async-queue.js";
 import { hydratePerTurnState, runDirectAgentTurn, tryRunSlashCommand } from "./direct-turn-helpers.js";
 //#region src/agent/service/process-direct-streaming.ts
+const MAX_BUFFERED_STREAM_EVENTS = 512;
+const LOSSY_STREAM_EVENT_TYPES = new Set([
+	"message_update",
+	"tool_execution_update",
+	"progress",
+	"review_delta"
+]);
 function isReviewOutput(value) {
 	return !!value && typeof value === "object" && !Array.isArray(value) && value.type === "review";
 }
@@ -118,7 +125,10 @@ async function* runProcessDirectStreaming(deps, input) {
 	const sessionKey = input.sessionKey ?? "agent:main:main";
 	const { channel, chatId } = await deps.resolveSessionEndpoint(sessionKey);
 	const context = deps.initDirectStreamingSession(sessionKey, channel, chatId, input.origin);
-	const queue = new AsyncQueue();
+	const queue = new AsyncQueue({
+		maxBuffered: MAX_BUFFERED_STREAM_EVENTS,
+		isDroppable: (event) => LOSSY_STREAM_EVENT_TYPES.has(event.type)
+	});
 	let reasoningLevel = channel === "webchat" ? resolveConfiguredActivityDetailDefault(deps.getConfig()) : "stream";
 	const pushVisible = (event) => {
 		const visible = channel === "webchat" ? event : applyReasoningVisibility(event, reasoningLevel);
@@ -144,6 +154,7 @@ async function* runProcessDirectStreaming(deps, input) {
 	let ranSlashCommand = false;
 	let mergedUserText = input.content;
 	let webchatSlashReceipt;
+	let streamOverflowed = false;
 	let slashCommandMetadata;
 	const slashTraceRows = [];
 	const taskPromise = (async () => {
@@ -301,12 +312,24 @@ async function* runProcessDirectStreaming(deps, input) {
 				clearPendingTranscriptUserMessage(sessionKey, pendingUserMessage);
 			}
 		} catch (err) {
-			if (!abortHandled) pushVisible({
+			if (err instanceof AsyncQueueOverflowError) {
+				streamOverflowed = true;
+				await abortEmbeddedRun(sessionKey).catch(() => false);
+				deps.log.warn({
+					err,
+					sessionKey,
+					maxBuffered: err.maxBuffered
+				}, "Aborted agent stream because the consumer could not keep up with critical events");
+			} else if (!abortHandled) pushVisible({
 				type: "error",
 				content: formatStreamError(err instanceof Error ? err.message : String(err))
 			});
 		} finally {
-			if (!userAborted && channel === "webchat") try {
+			if (queue.droppedCount > 0) deps.log.warn({
+				sessionKey,
+				droppedEvents: queue.droppedCount
+			}, "Coalesced stream progress events because the consumer fell behind");
+			if (!userAborted && !streamOverflowed && channel === "webchat") try {
 				const ttsAudioEvent = await deps.maybeEmitWebchatTts(sessionKey, inboundVoice);
 				if (ttsAudioEvent) queue.push(ttsAudioEvent);
 			} catch (ttsErr) {

package/dist/src/agent/service.js

@@ -3,10 +3,10 @@ import { init_logger } from "../utils/logger.js";
 import { getUserProfile } from "../storage/sqlite/user-context-repository.js";
 import { parseNoteAttachmentTarget } from "../notes/attachment-ref.js";
 import { getAgentDefaultModelRef, init_schema } from "../config/schema.js";
-import { init_agent_scope, resolveAgentHomeDir, resolveDefaultAgentId } from "./agent-scope.js";
-import { init_providers, resolveModel } from "../providers/index.js";
 import { applyConfigOverrides } from "../config/runtime-overrides.js";
+import { init_agent_scope, resolveAgentHomeDir, resolveDefaultAgentId } from "./agent-scope.js";
 import { extractProfileAgentId } from "../config/agent-profile.js";
+import { init_providers, resolveModel } from "../providers/index.js";
 import { extractTextContent } from "./context/workspace.js";
 import { effectiveWorkspacePathForSession } from "../session/session-workspace.js";
 import { getProjectForSession } from "../projects/workspace.js";
@@ -602,6 +602,7 @@ var AgentService = class {
 			workspaceDir,
 			transcriptRuntime: params.transcriptRuntime,
 			timeoutMs: resolveAgentTurnTimeoutMs(this.effectiveAppConfig(), params.parentSessionKey),
+			turnPolicy: this.agentManager.createAgentTurnPolicy(params.parentSessionKey),
 			abortSignal: params.abortSignal,
 			onEvent: params.onEvent
 		}));

package/dist/src/agent/session/session-inspector.js

@@ -1,8 +1,8 @@
 import { createLogger } from "../../utils/logger/index.js";
 import { init_logger } from "../../utils/logger.js";
 import { init_workspace_defaults, resolveDefaultAgentWorkspaceDir } from "../../config/workspace-defaults.js";
-import { init_providers, resolveModel } from "../../providers/index.js";
 import { resolveEffectiveAgentProfileForSession } from "../../config/agent-profile.js";
+import { init_providers, resolveModel } from "../../providers/index.js";
 import { effectiveWorkspacePathForSession, projectWorkspacePath } from "../../session/session-workspace.js";
 import { getProjectForSession } from "../../projects/workspace.js";
 import { resolveCompactionPolicy } from "../memory/compaction-policy.js";

package/dist/src/agent/skills/hub-lock.js

@@ -1,5 +1,5 @@
-import { init_write_file_atomic, writeTextAtomicSync } from "../../infra/write-file-atomic.js";
 import { init_paths, resolveSkillsLockPath } from "../../config/paths.js";
+import { init_write_file_atomic, writeTextAtomicSync } from "../../infra/write-file-atomic.js";
 import { existsSync, readFileSync } from "node:fs";
 //#region src/agent/skills/hub-lock.ts
 /**

package/dist/src/agent/tasks/task-judge-service.js

@@ -1,14 +1,14 @@
 import { createLogger } from "../../utils/logger/index.js";
 import { init_logger } from "../../utils/logger.js";
-import { extractAssistantText, getAssistantMessageErrorReason, stripCodeFences } from "../../providers/model-response.js";
 import { getAgentDefaultModelRef, init_schema } from "../../config/schema.js";
-import { getApiKey, init_providers, resolveModel } from "../../providers/index.js";
-import { completeWithResolvedCredentials } from "../../providers/model-call.js";
 import { resolveEffectiveAgentProfileForSession } from "../../config/agent-profile.js";
+import { getApiKey, init_providers, resolveModel } from "../../providers/index.js";
 import { TaskRepository } from "../../tasks/task-repository.js";
 import { TaskConversationRepository } from "../../tasks/task-conversation-repository.js";
 import { TaskRunRepository } from "../../tasks/task-run-repository.js";
+import { completeWithResolvedCredentials } from "../../providers/model-call.js";
 import { TaskApplicationService } from "../../tasks/task-application-service.js";
+import { extractAssistantText, getAssistantMessageErrorReason, stripCodeFences } from "../../providers/model-response.js";
 //#region src/agent/tasks/task-judge-service.ts
 init_schema();
 init_providers();

package/dist/src/agent/tools/exec-command.d.ts

@@ -9,6 +9,8 @@ export interface ExecCommandDetails {
     truncated: boolean;
     truncatedBy?: 'lines' | 'bytes' | null;
     outputBytes: number;
+    totalOutputBytes: number;
+    captureTruncated: boolean;
     stdout: string;
     stderr: string;
     aggregatedOutput: string;

package/dist/src/agent/tools/exec-command.js

@@ -25,6 +25,45 @@ function commandStatus(exitCode, timedOut) {
 	if (exitCode === 0) return "success";
 	return "failed";
 }
+function appendBoundedTail(current, chunk, maxChars) {
+	const combined = current + chunk;
+	if (combined.length <= maxChars) return {
+		value: combined,
+		truncated: false
+	};
+	return {
+		value: combined.slice(-maxChars),
+		truncated: true
+	};
+}
+function terminateProcessTree(proc) {
+	if (!proc.pid) return;
+	if (process.platform === "win32") {
+		const killer = spawn("taskkill", [
+			"/pid",
+			String(proc.pid),
+			"/t",
+			"/f"
+		], {
+			stdio: "ignore",
+			windowsHide: true
+		});
+		killer.once("error", () => {
+			try {
+				proc.kill("SIGKILL");
+			} catch {}
+		});
+		killer.unref();
+		return;
+	}
+	try {
+		process.kill(-proc.pid, "SIGKILL");
+		return;
+	} catch {}
+	try {
+		proc.kill("SIGKILL");
+	} catch {}
+}
 function commandFailureHint(details) {
 	if (details.status === "success") return void 0;
 	if (details.status === "timed_out") return "The command timed out. Re-run a narrower command, increase timeoutMs if the long run is expected, or inspect partial output before retrying.";
@@ -36,6 +75,7 @@ function formatOutputForModel(details, maxOutputChars) {
 	let prefix = "";
 	if (details.timedOut) prefix += `Command timed out after ${Math.round(details.durationMs / 1e3)}s\n`;
 	if (details.exitCode !== 0 && details.exitCode != null) prefix += `Command exited with code ${details.exitCode}\n`;
+	if (details.captureTruncated) prefix += `Earlier command output was discarded after ${formatSize(details.totalOutputBytes)}; showing the latest captured output.\n`;
 	const truncation = truncateTail(details.aggregatedOutput, { maxBytes: Math.min(maxOutputChars, DEFAULT_MAX_OUTPUT_CHARS) });
 	let text = `${prefix}${truncation.content}`.trimEnd();
 	if (!text) text = "(no output)";
@@ -78,6 +118,8 @@ function createExecCommandTool(workspaceCwd, options) {
 					timedOut: false,
 					truncated: false,
 					outputBytes: 0,
+					totalOutputBytes: 0,
+					captureTruncated: false,
 					stdout: "",
 					stderr: "cmd is required",
 					aggregatedOutput: "cmd is required",
@@ -106,6 +148,8 @@ function createExecCommandTool(workspaceCwd, options) {
 						timedOut: false,
 						truncated: false,
 						outputBytes: Buffer.byteLength(text),
+						totalOutputBytes: Buffer.byteLength(text),
+						captureTruncated: false,
 						stdout: "",
 						stderr: text,
 						aggregatedOutput: text,
@@ -120,11 +164,14 @@ function createExecCommandTool(workspaceCwd, options) {
 			let stdout = "";
 			let stderr = "";
 			let aggregatedOutput = "";
+			let totalOutputBytes = 0;
+			let captureTruncated = false;
 			let timedOut = false;
 			let settled = false;
 			return new Promise((resolveTool) => {
 				const proc = spawn(command, [], {
 					shell: true,
+					detached: process.platform !== "win32",
 					cwd: policy.effectiveCwd,
 					env: {
 						...runtimeEnv,
@@ -134,9 +181,19 @@ function createExecCommandTool(workspaceCwd, options) {
 				const publishDelta = (stream, raw) => {
 					const text = raw.toString();
 					if (!text) return;
-					if (stream === "stdout") stdout += text;
-					else stderr += text;
-					aggregatedOutput += text;
+					totalOutputBytes += Buffer.byteLength(text);
+					if (stream === "stdout") {
+						const next = appendBoundedTail(stdout, text, maxOutputChars);
+						stdout = next.value;
+						captureTruncated ||= next.truncated;
+					} else {
+						const next = appendBoundedTail(stderr, text, maxOutputChars);
+						stderr = next.value;
+						captureTruncated ||= next.truncated;
+					}
+					const nextAggregate = appendBoundedTail(aggregatedOutput, text, maxOutputChars);
+					aggregatedOutput = nextAggregate.value;
+					captureTruncated ||= nextAggregate.truncated;
 					const delta = text.length > STREAM_DELTA_MAX_CHARS ? `${text.slice(0, STREAM_DELTA_MAX_CHARS)}\n[stream delta truncated]` : text;
 					onUpdate?.({
 						content: [],
@@ -155,8 +212,12 @@ function createExecCommandTool(workspaceCwd, options) {
 					clearTimeout(timeout);
 					signal?.removeEventListener("abort", abort);
 					if (errorText) {
-						stderr += errorText;
-						aggregatedOutput += errorText;
+						totalOutputBytes += Buffer.byteLength(errorText);
+						const nextStderr = appendBoundedTail(stderr, errorText, maxOutputChars);
+						stderr = nextStderr.value;
+						const nextAggregate = appendBoundedTail(aggregatedOutput, errorText, maxOutputChars);
+						aggregatedOutput = nextAggregate.value;
+						captureTruncated ||= nextStderr.truncated || nextAggregate.truncated;
 					}
 					const durationMs = Date.now() - startTime;
 					const baseDetails = {
@@ -168,6 +229,8 @@ function createExecCommandTool(workspaceCwd, options) {
 						timedOut,
 						truncated: false,
 						outputBytes: Buffer.byteLength(aggregatedOutput),
+						totalOutputBytes,
+						captureTruncated,
 						stdout,
 						stderr,
 						aggregatedOutput
@@ -190,11 +253,11 @@ function createExecCommandTool(workspaceCwd, options) {
 				};
 				const abort = () => {
 					timedOut = true;
-					proc.kill("SIGKILL");
+					terminateProcessTree(proc);
 				};
 				const timeout = setTimeout(() => {
 					timedOut = true;
-					proc.kill("SIGKILL");
+					terminateProcessTree(proc);
 				}, timeoutMs);
 				if (signal?.aborted) abort();
 				else signal?.addEventListener("abort", abort, { once: true });

package/dist/src/agent-runtime/index.js

@@ -1,7 +1,7 @@
+import { buildMemoryRuntime } from "./memory-runtime.js";
 import { checkBoundary } from "./boundary-guard.js";
 import { resolveModelRole } from "./model-router.js";
 import { buildRuntimeToolRegistry } from "./tool-registry.js";
-import { buildMemoryRuntime } from "./memory-runtime.js";
 import { resolveWorkflow, validateWorkflowForRuntime } from "./workflow-runtime.js";
 import { buildAgentRuntimeProfile } from "./runtime-profile.js";
 import { appendAgentRunEvent, createAgentRunTrace, finishAgentRunTrace, hashEffectiveManifest } from "./run-trace.js";

package/dist/src/agent-runtime/runtime-profile.js

@@ -1,9 +1,9 @@
 import { buildAgentManifestPromptSection } from "../agent-manifest/prompt.js";
 import "../agent-manifest/index.js";
+import { buildMemoryRuntime } from "./memory-runtime.js";
 import { checkBoundary } from "./boundary-guard.js";
 import { resolveModelRole } from "./model-router.js";
 import { buildRuntimeToolRegistry } from "./tool-registry.js";
-import { buildMemoryRuntime } from "./memory-runtime.js";
 import { resolveWorkflow, validateWorkflowForRuntime } from "./workflow-runtime.js";
 //#region src/agent-runtime/runtime-profile.ts
 function buildAgentRuntimeProfile(params) {

package/dist/src/ai-assist/text-assist.js

@@ -1,9 +1,9 @@
 import { createLogger } from "../utils/logger/index.js";
 import { init_logger } from "../utils/logger.js";
-import { getAssistantMessageErrorReason, stripCodeFences } from "../providers/model-response.js";
 import { getDefaultModelSync, init_providers, resolveModel } from "../providers/index.js";
 import { createExtensionAwareStreamFn } from "../providers/extension-stream-bridge.js";
 import { isLocalModelBaseUrl, resolveModelCallApiKey, resolveModelCallOptions } from "../providers/model-call.js";
+import { getAssistantMessageErrorReason, stripCodeFences } from "../providers/model-response.js";
 //#region src/ai-assist/text-assist.ts
 init_providers();
 init_logger();

package/dist/src/auth/credentials.js

@@ -1,10 +1,10 @@
 import { __esmMin } from "../../_virtual/_rolldown/runtime.js";
 import { createLogger } from "../utils/logger/index.js";
 import { init_logger } from "../utils/logger.js";
-import { init_write_file_atomic, writeTextAtomic } from "../infra/write-file-atomic.js";
 import { init_paths, resolveAgentAuthProfilesPath, resolveAuthProfilesPath, resolveCredentialsDir, resolveOAuthPath } from "../config/paths.js";
-import { getApiKeyFromEnv, init_env_keys } from "../providers/env-keys.js";
+import { init_write_file_atomic, writeTextAtomic } from "../infra/write-file-atomic.js";
 import { getOAuthProviderDefinition, init_registry } from "./oauth/registry.js";
+import { getApiKeyFromEnv, init_env_keys } from "../providers/env-keys.js";
 import { init_oauth_provider_lock, withOAuthProviderLock } from "./oauth-provider-lock.js";
 import { dirname, join } from "path";
 import { mkdir, readFile, readdir, rm } from "fs/promises";

package/dist/src/auth/oauth/index.js

@@ -8,8 +8,8 @@ import { init_kimi_coding, kimiCodingOAuthProvider } from "./kimi-coding.js";
 import { init_minimax_cn, minimaxCnOAuthProvider } from "./minimax-cn.js";
 import { init_minimax, minimaxOAuthProvider } from "./minimax.js";
 import { init_openai_codex, loginOpenAICodex, openaiCodexOAuthProvider, refreshOpenAICodexToken } from "./openai-codex.js";
-import { init_xopc_cloud, xopcCloudOAuthProvider } from "./xopc-cloud.js";
-import { OAUTH_PROVIDER_DEFINITIONS, getOAuthProviderDefinition, getOAuthProviderIds, getOAuthProviderInterfaces, init_registry, isOAuthOnlyProvider } from "./registry.js";
+import { init_xopc_cloud, xopcCloudOAuthProvider, xopcTunnelOAuthProvider } from "./xopc-cloud.js";
+import { OAUTH_PROVIDER_DEFINITIONS, getModelOAuthProviderIds, getOAuthProviderDefinition, getOAuthProviderIds, getOAuthProviderInterfaces, init_registry, isOAuthOnlyProvider } from "./registry.js";
 //#region src/auth/oauth/index.ts
 init_anthropic();
 init_minimax();
@@ -22,4 +22,4 @@ init_openai_codex();
 init_xopc_cloud();
 init_registry();
 //#endregion
-export { OAUTH_PROVIDER_DEFINITIONS, anthropicOAuthProvider, getOAuthProviderDefinition, getOAuthProviderIds, getOAuthProviderInterfaces, githubCopilotOAuthProvider, antigravityOAuthProvider as googleAntigravityOAuthProvider, geminiCliOAuthProvider as googleGeminiCliOAuthProvider, isOAuthOnlyProvider, kimiCodingOAuthProvider, loginAnthropic, loginAntigravity, loginGeminiCli, loginOpenAICodex, minimaxCnOAuthProvider, minimaxOAuthProvider, openaiCodexOAuthProvider, refreshAnthropicToken, refreshAntigravityToken, refreshGoogleCloudToken, refreshOpenAICodexToken, xopcCloudOAuthProvider };
+export { OAUTH_PROVIDER_DEFINITIONS, anthropicOAuthProvider, getModelOAuthProviderIds, getOAuthProviderDefinition, getOAuthProviderIds, getOAuthProviderInterfaces, githubCopilotOAuthProvider, antigravityOAuthProvider as googleAntigravityOAuthProvider, geminiCliOAuthProvider as googleGeminiCliOAuthProvider, isOAuthOnlyProvider, kimiCodingOAuthProvider, loginAnthropic, loginAntigravity, loginGeminiCli, loginOpenAICodex, minimaxCnOAuthProvider, minimaxOAuthProvider, openaiCodexOAuthProvider, refreshAnthropicToken, refreshAntigravityToken, refreshGoogleCloudToken, refreshOpenAICodexToken, xopcCloudOAuthProvider, xopcTunnelOAuthProvider };

package/dist/src/auth/oauth/registry.d.ts

@@ -2,6 +2,7 @@ import type { OAuthProviderInterface } from './types.js';
 export interface OAuthProviderDefinition {
     displayName: string;
     oauthOnly?: boolean;
+    purpose: 'models' | 'tunnel';
     provider: OAuthProviderInterface;
     profileId: string;
     urlPrompt: string;
@@ -10,4 +11,5 @@ export declare const OAUTH_PROVIDER_DEFINITIONS: Readonly<Record<string, OAuthPr
 export declare function getOAuthProviderDefinition(provider: string): OAuthProviderDefinition | undefined;
 export declare function getOAuthProviderInterfaces(): Record<string, OAuthProviderInterface>;
 export declare function getOAuthProviderIds(): string[];
+export declare function getModelOAuthProviderIds(): string[];
 export declare function isOAuthOnlyProvider(provider: string): boolean;

package/dist/src/auth/oauth/registry.js

@@ -9,11 +9,12 @@ import { init_kimi_coding, kimiCodingOAuthProvider } from "./kimi-coding.js";
 import { init_minimax_cn, minimaxCnOAuthProvider } from "./minimax-cn.js";
 import { init_minimax, minimaxOAuthProvider } from "./minimax.js";
 import { init_openai_codex, openaiCodexOAuthProvider } from "./openai-codex.js";
-import { init_xopc_cloud, xopcCloudOAuthProvider } from "./xopc-cloud.js";
+import { init_xopc_cloud, xopcCloudOAuthProvider, xopcTunnelOAuthProvider } from "./xopc-cloud.js";
 //#region src/auth/oauth/registry.ts
-function definition(provider, displayName = provider.name) {
+function definition(provider, purpose, displayName = provider.name) {
 	return {
 		displayName,
+		purpose,
 		provider,
 		profileId: `${provider.id}:default`,
 		urlPrompt: "🌐 Please open this URL in your browser:\n"
@@ -28,6 +29,9 @@ function getOAuthProviderInterfaces() {
 function getOAuthProviderIds() {
 	return Object.keys(OAUTH_PROVIDER_DEFINITIONS);
 }
+function getModelOAuthProviderIds() {
+	return Object.entries(OAUTH_PROVIDER_DEFINITIONS).filter(([, definition]) => definition.purpose === "models").map(([id]) => id);
+}
 function isOAuthOnlyProvider(provider) {
 	return OAUTH_PROVIDER_DEFINITIONS[provider]?.oauthOnly === true;
 }
@@ -44,22 +48,26 @@ var init_registry = __esmMin((() => {
 	init_xopc_cloud();
 	OAUTH_PROVIDER_DEFINITIONS = {
 		"xopc-cloud": {
-			...definition(xopcCloudOAuthProvider),
+			...definition(xopcCloudOAuthProvider, "models"),
+			oauthOnly: true
+		},
+		"xopc-tunnel": {
+			...definition(xopcTunnelOAuthProvider, "tunnel"),
 			oauthOnly: true
 		},
-		anthropic: definition(anthropicOAuthProvider, "Anthropic (Claude)"),
-		minimax: definition(minimaxOAuthProvider, "MiniMax (幂维智能)"),
+		anthropic: definition(anthropicOAuthProvider, "models", "Anthropic (Claude)"),
+		minimax: definition(minimaxOAuthProvider, "models", "MiniMax (幂维智能)"),
 		"minimax-cn": {
-			...definition(minimaxCnOAuthProvider, "MiniMax CN"),
+			...definition(minimaxCnOAuthProvider, "models", "MiniMax CN"),
 			urlPrompt: "🌐 请在浏览器中打开以下 URL:\n"
 		},
-		"kimi-coding": definition(kimiCodingOAuthProvider, "Kimi For Coding (月之暗面)"),
-		"github-copilot": definition(githubCopilotOAuthProvider),
-		"google-gemini-cli": definition(geminiCliOAuthProvider),
-		"google-antigravity": definition(antigravityOAuthProvider),
-		"openai-codex": definition(openaiCodexOAuthProvider)
+		"kimi-coding": definition(kimiCodingOAuthProvider, "models", "Kimi For Coding (月之暗面)"),
+		"github-copilot": definition(githubCopilotOAuthProvider, "models"),
+		"google-gemini-cli": definition(geminiCliOAuthProvider, "models"),
+		"google-antigravity": definition(antigravityOAuthProvider, "models"),
+		"openai-codex": definition(openaiCodexOAuthProvider, "models")
 	};
 }));
 //#endregion
 init_registry();
-export { OAUTH_PROVIDER_DEFINITIONS, getOAuthProviderDefinition, getOAuthProviderIds, getOAuthProviderInterfaces, init_registry, isOAuthOnlyProvider };
+export { OAUTH_PROVIDER_DEFINITIONS, getModelOAuthProviderIds, getOAuthProviderDefinition, getOAuthProviderIds, getOAuthProviderInterfaces, init_registry, isOAuthOnlyProvider };

package/dist/src/auth/oauth/xopc-cloud.d.ts

@@ -1,2 +1,3 @@
 import type { OAuthProviderInterface } from './types.js';
 export declare const xopcCloudOAuthProvider: OAuthProviderInterface;
+export declare const xopcTunnelOAuthProvider: OAuthProviderInterface;

package/dist/src/auth/oauth/xopc-cloud.js

@@ -213,7 +213,7 @@ function callbackHtml(title, message, tone, returnToAppUrl) {
 </body>
 </html>`;
 }
-async function loginWithBrowser(callbacks) {
+async function loginWithBrowser(callbacks, scope) {
 	if (callbacks.signal?.aborted) throw callbacks.signal.reason instanceof Error ? callbacks.signal.reason : /* @__PURE__ */ new Error("XOPC OAuth login cancelled");
 	const { verifier, challenge } = await generatePKCE();
 	const state = randomBytes(24).toString("base64url");
@@ -274,7 +274,7 @@ async function loginWithBrowser(callbacks) {
 		response_type: "code",
 		client_id: CLIENT_ID,
 		redirect_uri: redirectUri,
-		scope: DEFAULT_SCOPE,
+		scope,
 		code_challenge: challenge,
 		code_challenge_method: "S256",
 		state,
@@ -309,7 +309,7 @@ async function loginWithBrowser(callbacks) {
 		server.close();
 	}
 }
-async function loginWithDeviceCode(callbacks) {
+async function loginWithDeviceCode(callbacks, scope) {
 	const response = await fetch(`${consoleUrl()}/oauth/device_authorization`, {
 		method: "POST",
 		headers: {
@@ -318,7 +318,7 @@ async function loginWithDeviceCode(callbacks) {
 		},
 		body: new URLSearchParams({
 			client_id: CLIENT_ID,
-			scope: DEFAULT_SCOPE,
+			scope,
 			device_name: hostname() || "XOPC client",
 			client_type: "cli"
 		}),
@@ -353,9 +353,9 @@ async function loginWithDeviceCode(callbacks) {
 	}
 	throw new Error("XOPC OAuth authorization expired");
 }
-async function login(callbacks) {
+async function login(callbacks, options) {
 	return await callbacks.onSelect({
-		message: "Choose how to authorize XOPC Model Service",
+		message: `Choose how to authorize ${options.serviceName}`,
 		options: [{
 			id: "browser",
 			label: "Browser (recommended for this device)"
@@ -363,7 +363,7 @@ async function login(callbacks) {
 			id: "device_code",
 			label: "Device code (remote or headless)"
 		}]
-	}) === "device_code" ? loginWithDeviceCode(callbacks) : loginWithBrowser(callbacks);
+	}) === "device_code" ? loginWithDeviceCode(callbacks, options.scope) : loginWithBrowser(callbacks, options.scope);
 }
 async function refreshToken(current, signal) {
 	const response = await tokenRequest(new URLSearchParams({
@@ -375,23 +375,39 @@ async function refreshToken(current, signal) {
 	if (!response.ok) throw new Error(body.error_description ?? body.error ?? "XOPC OAuth refresh failed");
 	return credentials(body);
 }
-var CLIENT_ID, DEFAULT_CONSOLE_URL, DEFAULT_SCOPE, CALLBACK_PATH, AUTHORIZATION_TIMEOUT_MS, xopcCloudOAuthProvider;
+function createXopcOAuthProvider(options) {
+	return {
+		id: options.id,
+		name: options.name,
+		loginMethods: ["browser", "device_code"],
+		login: (callbacks) => login(callbacks, {
+			scope: options.scope,
+			serviceName: options.name
+		}),
+		refreshToken,
+		getApiKey: (value) => value.access
+	};
+}
+var CLIENT_ID, DEFAULT_CONSOLE_URL, MODEL_SERVICE_SCOPE, TUNNEL_REGISTRATION_SCOPE, CALLBACK_PATH, AUTHORIZATION_TIMEOUT_MS, xopcCloudOAuthProvider, xopcTunnelOAuthProvider;
 var init_xopc_cloud = __esmMin((() => {
 	init_pkce();
 	CLIENT_ID = "xopc-native";
 	DEFAULT_CONSOLE_URL = "https://console.xopc.ai";
-	DEFAULT_SCOPE = "models:read models:invoke account:usage connectors:read connectors:manage connectors:execute offline_access";
+	MODEL_SERVICE_SCOPE = "models:read models:invoke account:usage connectors:read connectors:manage connectors:execute offline_access";
+	TUNNEL_REGISTRATION_SCOPE = "tunnel:register";
 	CALLBACK_PATH = "/oauth/callback";
 	AUTHORIZATION_TIMEOUT_MS = 5 * 6e4;
-	xopcCloudOAuthProvider = {
+	xopcCloudOAuthProvider = createXopcOAuthProvider({
 		id: "xopc-cloud",
 		name: "XOPC Model Service",
-		loginMethods: ["browser", "device_code"],
-		login,
-		refreshToken,
-		getApiKey: (value) => value.access
-	};
+		scope: MODEL_SERVICE_SCOPE
+	});
+	xopcTunnelOAuthProvider = createXopcOAuthProvider({
+		id: "xopc-tunnel",
+		name: "XOPC Public Tunnel",
+		scope: TUNNEL_REGISTRATION_SCOPE
+	});
 }));
 //#endregion
 init_xopc_cloud();
-export { init_xopc_cloud, xopcCloudOAuthProvider };
+export { init_xopc_cloud, xopcCloudOAuthProvider, xopcTunnelOAuthProvider };

package/dist/src/auth/profiles/store.js

@@ -1,5 +1,5 @@
-import { init_write_file_atomic, writeTextAtomicSync } from "../../infra/write-file-atomic.js";
 import { init_paths, resolveCredentialsDir } from "../../config/paths.js";
+import { init_write_file_atomic, writeTextAtomicSync } from "../../infra/write-file-atomic.js";
 import path from "node:path";
 import { chmodSync, existsSync, mkdirSync, readFileSync } from "node:fs";
 //#region src/auth/profiles/store.ts

package/dist/src/auth/sync-provider-auth.js

@@ -1,8 +1,8 @@
 import { __esmMin } from "../../_virtual/_rolldown/runtime.js";
+import { getDefaultAgentId, init_resolve_route } from "../routing/resolve-route.js";
 import { init_paths, resolveAgentAuthProfilesPath, resolveAuthProfilesPath, resolveOAuthPath } from "../config/paths.js";
-import { init_registry, isOAuthOnlyProvider } from "./oauth/registry.js";
 import { init_loader, loadConfig } from "../config/loader.js";
-import { getDefaultAgentId, init_resolve_route } from "../routing/resolve-route.js";
+import { init_registry, isOAuthOnlyProvider } from "./oauth/registry.js";
 import { existsSync, readFileSync } from "node:fs";
 //#region src/auth/sync-provider-auth.ts
 /**

package/dist/src/browser/providers/browser-ext-install.js

@@ -2,8 +2,8 @@ import { PACKAGE_VERSION, init_package_version } from "../../package-version.js"
 import { createLogger } from "../../utils/logger/index.js";
 import { init_logger } from "../../utils/logger.js";
 import { assertCacheDir, init_cache_dir_policy } from "../cache-dir-policy.js";
-import { init_write_file_atomic, writeTextAtomic } from "../../infra/write-file-atomic.js";
 import { init_paths, resolveBinDir } from "../../config/paths.js";
+import { init_write_file_atomic, writeTextAtomic } from "../../infra/write-file-atomic.js";
 import { shouldRunExtensionBridgeServer } from "../backend-from-config.js";
 import { resolvePackageRoot } from "../../infra/update-check.js";
 import { dirname, join } from "node:path";

package/dist/src/channels/attachments/voice-stt-webchat.js

@@ -1,9 +1,13 @@
+import { createLogger } from "../../utils/logger/index.js";
+import { init_logger } from "../../utils/logger.js";
 import { decodeInboundAttachmentBase64, readInboundAttachmentBuffer } from "./inbound-persist.js";
 import { transcribe } from "../../voice/stt/transcribe-core.js";
 import { isSTTAvailable } from "../../voice/stt/availability.js";
 import "../../voice/stt/index.js";
 //#region src/channels/attachments/voice-stt-webchat.ts
+init_logger();
 const STT_MAX_BYTES = 25 * 1024 * 1024;
+const log = createLogger("VoiceAttachmentSTT");
 function isVoiceLikeAttachment(att) {
 	if (att.type === "voice") return true;
 	return (att.mimeType?.toLowerCase() ?? "").startsWith("audio/");
@@ -52,10 +56,23 @@ async function mergeVoiceTranscriptsIntoUserText(prepared, userText, sttConfig,
 			continue;
 		}
 		try {
-			const r = await transcribe(buf, sttConfig, { language: sttConfig.provider === "alibaba" ? "zh" : void 0 });
+			const r = await transcribe(buf, sttConfig, {
+				language: sttConfig.provider === "alibaba" ? "zh" : void 0,
+				mime: att.mimeType,
+				fileName: att.name
+			});
 			transcripts.push(r.text.trim() || "[Voice: no speech detected]");
-		} catch {
-			transcripts.push("[STT failed]");
+		} catch (error) {
+			const errorMessage = error instanceof Error ? error.message : String(error);
+			log.error({
+				...error instanceof Error ? { err: error } : { errorMessage },
+				fileName: att.name,
+				mimeType: att.mimeType,
+				size: buf.length,
+				phase: "inbound_transcribe"
+			}, `Inbound voice transcription failed: ${errorMessage}`);
+			const decoderUnavailable = /ffmpeg|audio decoder|unsupported_audio_codec/i.test(errorMessage);
+			transcripts.push(decoderUnavailable ? "[STT failed: audio decoder unavailable]" : "[STT failed]");
 		}
 	}
 	return {

package/dist/src/cli/commands/doctor/checks/provider-auth.js

@@ -1,6 +1,6 @@
 import { getAgentDefaultModelRef, init_schema, parseModelRef } from "../../../../config/schema.js";
-import { PROVIDER_ENV_MAP, getApiKeyFromEnv, init_env_keys } from "../../../../providers/env-keys.js";
 import { init_loader, loadConfig } from "../../../../config/loader.js";
+import { PROVIDER_ENV_MAP, getApiKeyFromEnv, init_env_keys } from "../../../../providers/env-keys.js";
 import { existsSync } from "node:fs";
 //#region src/cli/commands/doctor/checks/provider-auth.ts
 init_loader();

package/dist/src/cli/commands/models.js

@@ -1,6 +1,6 @@
 import { getAgentDefaultModelRef, init_schema } from "../../config/schema.js";
-import { CredentialResolver, init_credentials } from "../../auth/credentials.js";
 import { loadConfig, saveConfig } from "../../config/loader.js";
+import { CredentialResolver, init_credentials } from "../../auth/credentials.js";
 import { getAllModels, getAvailableModels, getConfiguredProviders, getProviderAuthState, getProviderDisplayName, init_providers, isProviderConfigured, providerSupportsApiKey, providerSupportsOAuth, resolveModel } from "../../providers/index.js";
 import { formatExamples, register } from "../registry.js";
 import { getContextWithOpts } from "../context.js";