@xopcai/xopc 0.0.224 → 0.0.227

package/dist/src/capabilities/store-connector.js

@@ -16,6 +16,74 @@ function asStringArray(value, label) {
 	if (!Array.isArray(value) || value.some((item) => typeof item !== "string" || !item.trim())) throw new Error(`${label} must be an array of non-empty strings.`);
 	return value.map((item) => item.trim());
 }
+const TEMPLATE_PATTERN = /^\{\{(secrets|config)\.([A-Za-z0-9_.-]+)\}\}$/;
+const SETUP_KEY_PATTERN = /^[A-Za-z0-9_.-]+$/;
+function readSetup(value) {
+	if (value === void 0) return {
+		setup: {},
+		keys: /* @__PURE__ */ new Set()
+	};
+	const record = asRecord(value, "Connector setup");
+	const keys = /* @__PURE__ */ new Set();
+	const secrets = record.secrets === void 0 ? void 0 : (Array.isArray(record.secrets) ? record.secrets : (() => {
+		throw new Error("Connector setup.secrets must be an array.");
+	})()).map((raw) => {
+		const field = asRecord(raw, "Connector secret field");
+		const key = asString(field.key, "Connector secret key");
+		if (!SETUP_KEY_PATTERN.test(key) || keys.has(`secrets:${key}`)) throw new Error(`Invalid or duplicate Connector secret key: ${key}`);
+		keys.add(`secrets:${key}`);
+		return {
+			key,
+			label: asString(field.label, `Connector secret "${key}" label`),
+			...typeof field.description === "string" ? { description: field.description } : {},
+			required: field.required === true
+		};
+	});
+	const config = record.config === void 0 ? void 0 : (Array.isArray(record.config) ? record.config : (() => {
+		throw new Error("Connector setup.config must be an array.");
+	})()).map((raw) => {
+		const field = asRecord(raw, "Connector config field");
+		const key = asString(field.key, "Connector config key");
+		const type = asString(field.type, `Connector config "${key}" type`);
+		if (!SETUP_KEY_PATTERN.test(key) || keys.has(`config:${key}`)) throw new Error(`Invalid or duplicate Connector config key: ${key}`);
+		if (![
+			"string",
+			"number",
+			"boolean",
+			"json",
+			"path"
+		].includes(type)) throw new Error(`Unsupported Connector config type: ${type}`);
+		keys.add(`config:${key}`);
+		return {
+			key,
+			label: asString(field.label, `Connector config "${key}" label`),
+			type,
+			...typeof field.required === "boolean" ? { required: field.required } : {},
+			...typeof field.placeholder === "string" ? { placeholder: field.placeholder } : {},
+			...field.defaultValue !== void 0 ? { defaultValue: field.defaultValue } : {},
+			...typeof field.description === "string" ? { description: field.description } : {}
+		};
+	});
+	return {
+		setup: {
+			...secrets ? { secrets } : {},
+			...config ? { config } : {}
+		},
+		keys
+	};
+}
+function assertDeclaredTemplateReferences(value, setupKeys) {
+	if (typeof value === "string") {
+		const match = TEMPLATE_PATTERN.exec(value.trim());
+		if (match && !setupKeys.has(`${match[1]}:${match[2]}`)) throw new Error(`Connector template references undeclared ${match[1]} field "${match[2]}".`);
+		return;
+	}
+	if (Array.isArray(value)) {
+		for (const child of value) assertDeclaredTemplateReferences(child, setupKeys);
+		return;
+	}
+	if (value && typeof value === "object") for (const child of Object.values(value)) assertDeclaredTemplateReferences(child, setupKeys);
+}
 const NPM_PACKAGE_NAME = /^(?:@[a-z0-9][a-z0-9._-]*\/)?[a-z0-9][a-z0-9._-]*$/;
 const EXACT_SEMVER = /^v?(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?$/;
 function assertSafeRemoteUrl(value) {
@@ -55,13 +123,17 @@ function readPinnedLocalRuntime(runtime, template) {
 	const version = asString(localPackage.version, "Connector local package version");
 	if (!NPM_PACKAGE_NAME.test(name) || !EXACT_SEMVER.test(version)) throw new Error("Local Store connectors must use a valid exact npm package version.");
 	if (template.command !== "npx" || JSON.stringify(asStringArray(template.args, "Connector local MCP arguments")) !== JSON.stringify(["--yes", `${name}@${version}`])) throw new Error("Local Store connectors must use the pinned npx launch form.");
+	if (template.env !== void 0) {
+		const env = asRecord(template.env, "Connector local MCP environment");
+		for (const [key, value] of Object.entries(env)) if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(key) || typeof value !== "string" || !TEMPLATE_PATTERN.test(value.trim())) throw new Error("Connector local MCP environment must contain declared setup references under valid environment variable names.");
+	}
 	for (const field of [
 		"url",
-		"env",
 		"cwd",
 		"workingDirectory",
 		"headers",
-		"transport"
+		"transport",
+		"auth"
 	]) if (field in template) throw new Error("Local Store connectors cannot define additional MCP process fields.");
 	return {
 		registry: "npm",
@@ -71,16 +143,25 @@ function readPinnedLocalRuntime(runtime, template) {
 }
 function readConnectorManifest(value, packageName, version, sha256) {
 	const manifest = asRecord(value, "Connector manifest");
+	if (manifest.contractVersion !== 1) throw new Error("Store connector manifest must use contractVersion 1.");
 	if (asString(manifest.id, "Connector id") !== packageName) throw new Error("Connector manifest id does not match the store package name.");
 	const runtime = asRecord(manifest.runtime, "Connector runtime");
 	if (runtime.type !== "mcp") throw new Error("Store connectors must use the MCP runtime.");
 	const serverTemplate = asRecord(runtime.serverTemplate, "Connector MCP serverTemplate");
 	const localPackage = readPinnedLocalRuntime(runtime, serverTemplate);
 	const transport = serverTemplate.transport;
-	if (!localPackage && transport !== "streamable-http" && transport !== "sse") throw new Error("Store connectors must use streamable-http or sse transport.");
-	const authMode = asRecord(manifest.auth, "Connector auth").mode;
-	if (authMode !== "none" && authMode !== "apiKey") throw new Error("Store connectors support only none or apiKey authentication.");
-	const normalizedAuth = { mode: authMode };
+	if (!localPackage && transport !== "streamable-http") throw new Error("Remote Store connectors must use streamable-http transport.");
+	if ("auth" in serverTemplate) throw new Error("Connector MCP authentication must be declared only in the top-level auth field.");
+	const auth = asRecord(manifest.auth, "Connector auth");
+	const authMode = auth.mode;
+	if (authMode !== "none" && authMode !== "apiKey" && authMode !== "oauth") throw new Error("Store connectors support only none, apiKey, or oauth authentication.");
+	if (authMode === "oauth" && localPackage) throw new Error("MCP OAuth requires a remote Store connector.");
+	const clientId = auth.clientId === void 0 ? void 0 : asString(auth.clientId, "Connector OAuth clientId");
+	if (clientId && authMode !== "oauth") throw new Error("Connector OAuth clientId requires oauth authentication.");
+	const normalizedAuth = authMode === "oauth" ? {
+		mode: "oauth",
+		...clientId ? { clientId } : {}
+	} : { mode: authMode };
 	const category = asString(manifest.category, "Connector category");
 	if (![
 		"code",
@@ -98,16 +179,20 @@ function readConnectorManifest(value, packageName, version, sha256) {
 		"context",
 		"events",
 		"auth.apiKey",
+		"auth.oauth",
 		"runtime.mcp.stdio",
-		"runtime.mcp.sse",
 		"runtime.mcp.streamableHttp"
 	]);
 	if (capabilities.some((capability) => !allowedCapabilities.has(capability))) throw new Error("Connector manifest contains an unsupported capability.");
-	const setup = manifest.setup === void 0 ? {} : asRecord(manifest.setup, "Connector setup");
+	const expectedAuthCapability = authMode === "oauth" ? "auth.oauth" : authMode === "apiKey" ? "auth.apiKey" : void 0;
+	const declaredAuthCapabilities = capabilities.filter((capability) => capability === "auth.oauth" || capability === "auth.apiKey");
+	if (expectedAuthCapability ? declaredAuthCapabilities.length !== 1 || declaredAuthCapabilities[0] !== expectedAuthCapability : declaredAuthCapabilities.length > 0) throw new Error("Connector authentication capabilities must match the declared auth mode.");
+	const { setup, keys: setupKeys } = readSetup(manifest.setup);
+	assertDeclaredTemplateReferences(serverTemplate, setupKeys);
 	const permissions = readPermissions(manifest.permissions, Boolean(localPackage));
 	const endpoint = localPackage ? void 0 : assertSafeRemoteUrl(serverTemplate.url);
 	const hostname = endpoint ? new URL(endpoint).hostname : void 0;
-	if (hostname && permissions.networkDomains?.length && !permissions.networkDomains.includes(hostname)) throw new Error("Connector network permissions must include the MCP endpoint host.");
+	if (hostname && permissions.networkDomains?.length && !permissions.networkDomains.some((domain) => domain.toLowerCase() === hostname.toLowerCase())) throw new Error("Connector network permissions must include the MCP endpoint host.");
 	return {
 		id: packageName,
 		version,
@@ -125,7 +210,11 @@ function readConnectorManifest(value, packageName, version, sha256) {
 			serverId: asString(runtime.serverId, "Connector MCP serverId"),
 			serverTemplate: localPackage ? serverTemplate : {
 				...serverTemplate,
-				url: endpoint
+				url: endpoint,
+				...authMode === "oauth" ? { auth: {
+					type: "oauth",
+					...clientId ? { clientId } : {}
+				} } : {}
 			},
 			...localPackage ? { localPackage } : {}
 		},

package/dist/src/cli/commands/channels.js

@@ -1,8 +1,8 @@
 import { buildChannelCatalogForConfig, init_channel_catalog_service } from "../../channels/catalog/channel-catalog-service.js";
 import { init_loader, loadConfig, saveConfig } from "../../config/loader.js";
-import { formatExamples, register } from "../registry.js";
 import { listChannelPairingState } from "../../channels/pairing/pairing-service.js";
 import { approveChannelPairingFromCli } from "../../channels/pairing/approve-cli.js";
+import { formatExamples, register } from "../registry.js";
 import { colors } from "../utils/colors.js";
 import { Command } from "commander";
 //#region src/cli/commands/channels.ts

package/dist/src/cli/commands/connectors.js

@@ -1,8 +1,8 @@
 import { init_loader, loadConfig, saveConfig } from "../../config/loader.js";
 import { getStoreConnectorInstallPlan, installStoreConnector, listStoreConnectors } from "../../capabilities/store-connector.js";
 import { register } from "../registry.js";
-import { Command } from "commander";
 import { confirm } from "@inquirer/prompts";
+import { Command } from "commander";
 //#region src/cli/commands/connectors.ts
 init_loader();
 function parsePairs(values, option) {

package/dist/src/cli/commands/doctor/checks/database-schema.js

@@ -52,7 +52,7 @@ async function checkDatabaseSchema(ctx) {
 		id: "database-schema",
 		label: "Database schema",
 		status: "pass",
-		message: `SQLite schema v${status.dbVersion} (current release v133).`,
+		message: `SQLite schema v${status.dbVersion} (current release v135).`,
 		hints: []
 	};
 }

package/dist/src/cli/commands/extension-marketplace.js

@@ -13,8 +13,8 @@ import { existsSync, readFileSync, rmSync, statSync } from "node:fs";
 import { execSync } from "node:child_process";
 import { createHash } from "node:crypto";
 import semver from "semver";
-import { Command } from "commander";
 import { confirm } from "@inquirer/prompts";
+import { Command } from "commander";
 //#region src/cli/commands/extension-marketplace.ts
 init_loader();
 init_paths();

package/dist/src/cli/commands/models.js

@@ -9,8 +9,8 @@ import { prepareUpdateGlobalDefaults } from "../../gateway/global-defaults-admin
 import { disconnectProvider } from "../../providers/provider-disconnect.js";
 import { colors } from "../utils/colors.js";
 import { runCliOAuthLogin } from "../utils/oauth-login.js";
-import { Command } from "commander";
 import { input } from "@inquirer/prompts";
+import { Command } from "commander";
 //#region src/cli/commands/models.ts
 init_credentials();
 init_schema();

package/dist/src/cli/commands/onboard.js

@@ -10,8 +10,8 @@ import { initWorkspace } from "../utils/init-workspace.js";
 import { setupModel } from "./onboard/model.js";
 import { getChannelConfigurators } from "./onboard/channels/registry.js";
 import { setupChannels } from "./onboard/channels/index.js";
-import { Command } from "commander";
 import { select } from "@inquirer/prompts";
+import { Command } from "commander";
 //#region src/cli/commands/onboard.ts
 init_schema();
 init_paths_state();

package/dist/src/config/config-mutation.d.ts

@@ -0,0 +1,14 @@
+import type { Config } from './schema.js';
+/** Restore an in-memory config object after a failed persistence attempt. */
+export declare function restoreConfig(config: Config, snapshot: Config): void;
+export declare class ConfigPersistenceError extends Error {
+    constructor(message: string, options?: ErrorOptions);
+}
+export declare function persistConfigMutation<T>(params: {
+    config: Config;
+    mutate: () => T | Promise<T>;
+    save: () => Promise<{
+        saved: boolean;
+        error?: string;
+    }>;
+}): Promise<T>;

package/dist/src/config/config-mutation.js

@@ -0,0 +1,33 @@
+//#region src/config/config-mutation.ts
+/** Restore an in-memory config object after a failed persistence attempt. */
+function restoreConfig(config, snapshot) {
+	for (const key of Object.keys(config)) delete config[key];
+	Object.assign(config, snapshot);
+}
+var ConfigPersistenceError = class extends Error {
+	constructor(message, options) {
+		super(message, options);
+		this.name = "ConfigPersistenceError";
+	}
+};
+async function persistConfigMutation(params) {
+	const snapshot = structuredClone(params.config);
+	let result;
+	try {
+		result = await params.mutate();
+	} catch (error) {
+		restoreConfig(params.config, snapshot);
+		throw error;
+	}
+	try {
+		const saved = await params.save();
+		if (!saved.saved) throw new ConfigPersistenceError(saved.error ?? "Failed to save configuration.");
+		return result;
+	} catch (error) {
+		restoreConfig(params.config, snapshot);
+		if (error instanceof ConfigPersistenceError) throw error;
+		throw new ConfigPersistenceError(error instanceof Error ? error.message : String(error), { cause: error });
+	}
+}
+//#endregion
+export { ConfigPersistenceError, persistConfigMutation, restoreConfig };

package/dist/src/config/index.js

@@ -1,13 +1,13 @@
 import { ENV_VARS, XOPC_DB_FILENAME, resolveHomeDir, resolveStateDir, resolveXopcCloudCatalogCachePath, resolveXopcDatabasePath } from "./paths-state.js";
 import { TelegramAccountConfigSchema, TelegramConfigSchema, TelegramGroupConfigSchema, TelegramTopicConfigSchema } from "../../extensions/telegram/src/config-schema.js";
 import { WeixinAccountConfigSchema, WeixinConfigSchema } from "../../extensions/weixin/src/config-schema.js";
-import { AgentImageGenerationModelSchema, AgentModelRefSchema, AgentModelsSchema, AgentTypedModelRoleSchema, AgentsConfigSchema, BindingMatchSchema, BindingRuleSchema, BindingsConfigSchema, BrowserConfigSchema, ChannelsConfigSchema, CommandsConfigSchema, ConfigSchema, ConnectorsConfigSchema, ExperimentalConfigSchema, ExtensionSecurityConfigSchema, ExtensionSlotsConfigSchema, ExtensionsConfigSchema, GatewayAuthRateLimitSchema, GatewayAuthSchema, GatewayBindModeSchema, GatewayChannelConnectDeferModeSchema, GatewayConfigSchema, GatewayModeSchema, GatewayRemoteSchema, GatewaySecuritySchema, GatewayTailscaleConsentSchema, GatewayTailscaleSchema, GatewayTlsSchema, GatewayTrustedProxySchema, GatewayWebchatConfigSchema, HeartbeatConfigSchema, McpConfigSchema, McpServerSchema, MediaUnderstandingCapabilitiesSchema, MediaUnderstandingModelSchema, MessagesConfigSchema, ModelCatalogConfigSchema, ModelsDevConfigSchema, ProviderAuthConfigSchema, ProviderAzureConfigSchema, ProviderRequestOverridesSchema, ProvidersConfigSchema, RuntimeToolsConfigSchema, STTConfigSchema, STTFallbackConfigSchema, STTProviderConfigSchema, SearchProviderEntrySchema, SessionConfigSchema, SessionDmScopeSchema, SessionResetByTypeSchema, SessionResetConfigSchema, SessionResetModeSchema, SessionScopeSchema, SessionStorageConfigSchema, TTSConfigSchema, TTSEdgeConfigSchema, TTSFallbackConfigSchema, TTSModelOverridesConfigSchema, TTSProviderConfigSchema, TTSSummarizationConfigSchema, ToolsConfigSchema, ToolsMediaAudioConfigSchema, ToolsMediaConfigSchema, TuiConfigSchema, TunnelConfigSchema, TunnelConsentSchema, UpdateAutoConfigSchema, UpdateConfigSchema, VoiceConfigSchema, VoiceRefinementConfigSchema, WebSearchConfigSchema, WebToolsConfigSchema, WebsiteBlocklistSchema, WorkspaceConfigSchema, WorkspaceImportConfigSchema, getAgentDefaultImageGenerationModelConfig, getAgentDefaultImageModelConfig, getAgentDefaultModelRef, init_schema, parseModelRef } from "./schema.js";
+import { AgentImageGenerationModelSchema, AgentModelRefSchema, AgentModelsSchema, AgentTypedModelRoleSchema, AgentsConfigSchema, BindingMatchSchema, BindingRuleSchema, BindingsConfigSchema, BrowserConfigSchema, ChannelsConfigSchema, CommandsConfigSchema, ConfigSchema, ConnectorsConfigSchema, ExperimentalConfigSchema, ExtensionSecurityConfigSchema, ExtensionSlotsConfigSchema, ExtensionsConfigSchema, GatewayAuthRateLimitSchema, GatewayAuthSchema, GatewayBindModeSchema, GatewayChannelConnectDeferModeSchema, GatewayConfigSchema, GatewayModeSchema, GatewayRemoteSchema, GatewaySecuritySchema, GatewayTailscaleConsentSchema, GatewayTailscaleSchema, GatewayTlsSchema, GatewayTrustedProxySchema, GatewayWebchatConfigSchema, HeartbeatConfigSchema, McpConfigSchema, McpOAuthConfigSchema, McpServerSchema, MediaUnderstandingCapabilitiesSchema, MediaUnderstandingModelSchema, MessagesConfigSchema, ModelCatalogConfigSchema, ModelsDevConfigSchema, ProviderAuthConfigSchema, ProviderAzureConfigSchema, ProviderRequestOverridesSchema, ProvidersConfigSchema, RuntimeToolsConfigSchema, STTConfigSchema, STTFallbackConfigSchema, STTProviderConfigSchema, SearchProviderEntrySchema, SessionConfigSchema, SessionDmScopeSchema, SessionResetByTypeSchema, SessionResetConfigSchema, SessionResetModeSchema, SessionScopeSchema, SessionStorageConfigSchema, TTSConfigSchema, TTSEdgeConfigSchema, TTSFallbackConfigSchema, TTSModelOverridesConfigSchema, TTSProviderConfigSchema, TTSSummarizationConfigSchema, ToolsConfigSchema, ToolsMediaAudioConfigSchema, ToolsMediaConfigSchema, TuiConfigSchema, TunnelConfigSchema, TunnelConsentSchema, UpdateAutoConfigSchema, UpdateConfigSchema, VoiceConfigSchema, VoiceRefinementConfigSchema, WebSearchConfigSchema, WebToolsConfigSchema, WebsiteBlocklistSchema, WorkspaceConfigSchema, WorkspaceImportConfigSchema, getAgentDefaultImageGenerationModelConfig, getAgentDefaultImageModelConfig, getAgentDefaultModelRef, init_schema, parseModelRef } from "./schema.js";
 import { applyConfigOverrides, getConfigOverrides, resetConfigOverrides, setConfigOverride, unsetConfigOverride } from "./runtime-overrides.js";
 import { expandWorkspacePathString, init_workspace_path, normalizeWorkspaceDir, resolveWorkspaceRoot } from "./workspace-path.js";
 import { resolveDefaultAgentWorkspaceDir } from "./workspace-defaults.js";
 import { resolveAgentDir as resolveAgentDir$1, resolveAgentHomeDir as resolveAgentHomeDir$1, resolveAgentWorkspaceDir } from "../agent/agent-scope.js";
 import { extractProfileAgentId, resolveEffectiveAgentManifestForAgent, resolveEffectiveAgentManifestForSession, resolveEffectiveAgentProfile, resolveEffectiveAgentProfileForSession } from "./agent-profile.js";
-import { FILENAMES, WORKSPACE_FILES, existsSync, hasBundledExtensionManifest, init_paths, resolveAgentAuthProfilesPath, resolveAgentDir, resolveAgentHomeDir, resolveAgentProfileDir, resolveAgentProfileMarkdownPath, resolveAuthProfilesPath, resolveBinDir, resolveBundledExtensionsDir, resolveBundledSkillsDir, resolveConfigPath, resolveCredentialsDir, resolveExtensionSdkPath, resolveExtensionsDir, resolveExtensionsLockPath, resolveInboxDir, resolveInboxMessagePath, resolveInboxPendingDir, resolveInboxProcessedDir, resolveLogPath, resolveLogsDir, resolveModelsJsonPath, resolveNodeBinDir, resolveNodeBinPath, resolveNodeToolsDir, resolveNpmBinPath, resolveOAuthPath, resolvePidPath, resolveSkillPath, resolveSkillsCachePath, resolveSkillsDir, resolveSkillsLockPath, resolveSocketPath, resolveStatusPath, resolveToolsDir, resolveWorkspaceExtensionsDir, resolveWorkspaceFile, resolveWorkspaceStateDir, resolveWorkspaceStatePath, resolveXopcBinPath } from "./paths.js";
+import { FILENAMES, WORKSPACE_FILES, existsSync, hasBundledExtensionManifest, init_paths, resolveAgentAuthProfilesPath, resolveAgentDir, resolveAgentHomeDir, resolveAgentProfileDir, resolveAgentProfileMarkdownPath, resolveAuthProfilesPath, resolveBinDir, resolveBundledExtensionsDir, resolveBundledSkillsDir, resolveConfigPath, resolveCredentialsDir, resolveExtensionSdkPath, resolveExtensionsDir, resolveExtensionsLockPath, resolveInboxDir, resolveInboxMessagePath, resolveInboxPendingDir, resolveInboxProcessedDir, resolveLogPath, resolveLogsDir, resolveMcpOAuthPath, resolveModelsJsonPath, resolveNodeBinDir, resolveNodeBinPath, resolveNodeToolsDir, resolveNpmBinPath, resolveOAuthPath, resolvePidPath, resolveSkillPath, resolveSkillsCachePath, resolveSkillsDir, resolveSkillsLockPath, resolveSocketPath, resolveStatusPath, resolveToolsDir, resolveWorkspaceExtensionsDir, resolveWorkspaceFile, resolveWorkspaceStateDir, resolveWorkspaceStatePath, resolveXopcBinPath } from "./paths.js";
 import { init_loader, loadConfig, saveConfig } from "./loader.js";
 import { clearConfigValueCache, getAllowedCommands, getCacheStats, init_resolve_config_value, resolveConfigValue, resolveHeaders, testApiKeyResolution } from "./resolve-config-value.js";
 import { CustomModelSchema, ImageGenerationCapabilitiesSchema, ImageGenerationModelSchema, ImageGenerationProviderSchema, ModelOverrideSchema, ModelsJsonSchema, OpenAICompatSchema, OpenAICompletionsCompatSchema, OpenAIResponsesCompatSchema, OpenRouterRoutingSchema, ProviderConfigSchema, VercelGatewayRoutingSchema, getDefaultModelValues, init_models_json, loadModelsJson, modelsJsonExists, saveModelsJson, validateModelsConfig } from "./models-json.js";
@@ -27,4 +27,4 @@ init_workspace_path();
 init_models_json();
 init_resolve_config_value();
 //#endregion
-export { AgentImageGenerationModelSchema, AgentModelRefSchema, AgentModelsSchema, AgentTypedModelRoleSchema, AgentsConfigSchema, BASE_RELOAD_RULES, BindingMatchSchema, BindingRuleSchema, BindingsConfigSchema, BrowserConfigSchema, ChannelsConfigSchema, CommandsConfigSchema, ConfigHotReloader, ConfigSchema, ConnectorsConfigSchema, CustomModelSchema, ENV_VARS, ExperimentalConfigSchema, ExtensionSecurityConfigSchema, ExtensionSlotsConfigSchema, ExtensionsConfigSchema, FILENAMES, GatewayAuthRateLimitSchema, GatewayAuthSchema, GatewayBindModeSchema, GatewayChannelConnectDeferModeSchema, GatewayConfigSchema, GatewayModeSchema, GatewayRemoteSchema, GatewaySecuritySchema, GatewayTailscaleConsentSchema, GatewayTailscaleSchema, GatewayTlsSchema, GatewayTrustedProxySchema, GatewayWebchatConfigSchema, HeartbeatConfigSchema, ImageGenerationCapabilitiesSchema, ImageGenerationModelSchema, ImageGenerationProviderSchema, McpConfigSchema, McpServerSchema, MediaUnderstandingCapabilitiesSchema, MediaUnderstandingModelSchema, MessagesConfigSchema, ModelCatalogConfigSchema, ModelOverrideSchema, ModelsDevConfigSchema, ModelsJsonSchema, OpenAICompatSchema, OpenAICompletionsCompatSchema, OpenAIResponsesCompatSchema, OpenRouterRoutingSchema, ProfileManager, ProviderAuthConfigSchema, ProviderAzureConfigSchema, ProviderConfigSchema, ProviderRequestOverridesSchema, ProvidersConfigSchema, RuntimeToolsConfigSchema, STTConfigSchema, STTFallbackConfigSchema, STTProviderConfigSchema, SearchProviderEntrySchema, SessionConfigSchema, SessionDmScopeSchema, SessionResetByTypeSchema, SessionResetConfigSchema, SessionResetModeSchema, SessionScopeSchema, SessionStorageConfigSchema, TTSConfigSchema, TTSEdgeConfigSchema, TTSFallbackConfigSchema, TTSModelOverridesConfigSchema, TTSProviderConfigSchema, TTSSummarizationConfigSchema, TelegramAccountConfigSchema, TelegramConfigSchema, TelegramGroupConfigSchema, TelegramTopicConfigSchema, ToolsConfigSchema, ToolsMediaAudioConfigSchema, ToolsMediaConfigSchema, TuiConfigSchema, TunnelConfigSchema, TunnelConsentSchema, UpdateAutoConfigSchema, UpdateConfigSchema, VercelGatewayRoutingSchema, VoiceConfigSchema, VoiceRefinementConfigSchema, WORKSPACE_FILES, WebSearchConfigSchema, WebToolsConfigSchema, WebsiteBlocklistSchema, WeixinAccountConfigSchema, WeixinConfigSchema, WorkspaceConfigSchema, WorkspaceImportConfigSchema, XOPC_DB_FILENAME, applyConfigOverrides, buildReloadPlan, canonicalizeConfiguredMcpServer, clearConfigValueCache, createProfile, deleteProfile, diffConfigPaths, existsSync, expandWorkspacePathString, extractProfileAgentId, formatThinkingLevels, getAgentDefaultImageGenerationModelConfig, getAgentDefaultImageModelConfig, getAgentDefaultModelRef, getAllowedCommands, getCacheStats, getConfigOverrides, getCurrentProfile, getDefaultModelValues, resolveModelsJsonPath as getModelsJsonPath, getProfileManager, getProfileNameFromDir, getSwitchCommand, getWorkspacePath, hasBundledExtensionManifest, isKnownCliMcpTypeAlias, listAgentProfileMarkdownDirs, listAgentWorkspaceDirs, listProfiles, listThinkingLevels, loadConfig, loadModelsJson, matchReloadRule, modelsJsonExists, normalizeConfiguredMcpServers, normalizeElevatedMode, normalizeReasoningLevel, normalizeThinkLevel, normalizeVerboseLevel, normalizeWorkspaceDir, parseModelRef, resetConfigOverrides, resolveAgentAuthProfilesPath, resolveAgentDir, resolveAgentDir$1 as resolveAgentDirFromConfig, resolveAgentHomeDir, resolveAgentHomeDir$1 as resolveAgentHomeDirFromConfig, resolveAgentProfileDir, resolveAgentProfileMarkdownPath, resolveAgentWorkspaceDir, resolveAuthProfilesPath, resolveBinDir, resolveBundledExtensionsDir, resolveBundledSkillsDir, resolveConfigPath, resolveConfigValue, resolveCredentialsDir, resolveDefaultAgentWorkspaceDir, resolveEffectiveAgentManifestForAgent, resolveEffectiveAgentManifestForSession, resolveEffectiveAgentProfile, resolveEffectiveAgentProfileForSession, resolveExtensionSdkPath, resolveExtensionsDir, resolveExtensionsLockPath, resolveHeaders, resolveHomeDir, resolveInboxDir, resolveInboxMessagePath, resolveInboxPendingDir, resolveInboxProcessedDir, resolveLogPath, resolveLogsDir, resolveModelsJsonPath, resolveNodeBinDir, resolveNodeBinPath, resolveNodeToolsDir, resolveNpmBinPath, resolveOAuthPath, resolvePidPath, resolveProfileStateDir, resolveSkillPath, resolveSkillsCachePath, resolveSkillsDir, resolveSkillsLockPath, resolveSocketPath, resolveStateDir, resolveStatusPath, resolveToolsDir, resolveWorkspaceExtensionsDir, resolveWorkspaceFile, resolveWorkspaceRoot, resolveWorkspaceStateDir, resolveWorkspaceStatePath, resolveXopcBinPath, resolveXopcCloudCatalogCachePath, resolveXopcDatabasePath, resolveXopcMcpTransportAlias, saveConfig, saveModelsJson, setConfigOverride, testApiKeyResolution, thinkLevelToNumber, unsetConfigOverride, validateModelsConfig };
+export { AgentImageGenerationModelSchema, AgentModelRefSchema, AgentModelsSchema, AgentTypedModelRoleSchema, AgentsConfigSchema, BASE_RELOAD_RULES, BindingMatchSchema, BindingRuleSchema, BindingsConfigSchema, BrowserConfigSchema, ChannelsConfigSchema, CommandsConfigSchema, ConfigHotReloader, ConfigSchema, ConnectorsConfigSchema, CustomModelSchema, ENV_VARS, ExperimentalConfigSchema, ExtensionSecurityConfigSchema, ExtensionSlotsConfigSchema, ExtensionsConfigSchema, FILENAMES, GatewayAuthRateLimitSchema, GatewayAuthSchema, GatewayBindModeSchema, GatewayChannelConnectDeferModeSchema, GatewayConfigSchema, GatewayModeSchema, GatewayRemoteSchema, GatewaySecuritySchema, GatewayTailscaleConsentSchema, GatewayTailscaleSchema, GatewayTlsSchema, GatewayTrustedProxySchema, GatewayWebchatConfigSchema, HeartbeatConfigSchema, ImageGenerationCapabilitiesSchema, ImageGenerationModelSchema, ImageGenerationProviderSchema, McpConfigSchema, McpOAuthConfigSchema, McpServerSchema, MediaUnderstandingCapabilitiesSchema, MediaUnderstandingModelSchema, MessagesConfigSchema, ModelCatalogConfigSchema, ModelOverrideSchema, ModelsDevConfigSchema, ModelsJsonSchema, OpenAICompatSchema, OpenAICompletionsCompatSchema, OpenAIResponsesCompatSchema, OpenRouterRoutingSchema, ProfileManager, ProviderAuthConfigSchema, ProviderAzureConfigSchema, ProviderConfigSchema, ProviderRequestOverridesSchema, ProvidersConfigSchema, RuntimeToolsConfigSchema, STTConfigSchema, STTFallbackConfigSchema, STTProviderConfigSchema, SearchProviderEntrySchema, SessionConfigSchema, SessionDmScopeSchema, SessionResetByTypeSchema, SessionResetConfigSchema, SessionResetModeSchema, SessionScopeSchema, SessionStorageConfigSchema, TTSConfigSchema, TTSEdgeConfigSchema, TTSFallbackConfigSchema, TTSModelOverridesConfigSchema, TTSProviderConfigSchema, TTSSummarizationConfigSchema, TelegramAccountConfigSchema, TelegramConfigSchema, TelegramGroupConfigSchema, TelegramTopicConfigSchema, ToolsConfigSchema, ToolsMediaAudioConfigSchema, ToolsMediaConfigSchema, TuiConfigSchema, TunnelConfigSchema, TunnelConsentSchema, UpdateAutoConfigSchema, UpdateConfigSchema, VercelGatewayRoutingSchema, VoiceConfigSchema, VoiceRefinementConfigSchema, WORKSPACE_FILES, WebSearchConfigSchema, WebToolsConfigSchema, WebsiteBlocklistSchema, WeixinAccountConfigSchema, WeixinConfigSchema, WorkspaceConfigSchema, WorkspaceImportConfigSchema, XOPC_DB_FILENAME, applyConfigOverrides, buildReloadPlan, canonicalizeConfiguredMcpServer, clearConfigValueCache, createProfile, deleteProfile, diffConfigPaths, existsSync, expandWorkspacePathString, extractProfileAgentId, formatThinkingLevels, getAgentDefaultImageGenerationModelConfig, getAgentDefaultImageModelConfig, getAgentDefaultModelRef, getAllowedCommands, getCacheStats, getConfigOverrides, getCurrentProfile, getDefaultModelValues, resolveModelsJsonPath as getModelsJsonPath, getProfileManager, getProfileNameFromDir, getSwitchCommand, getWorkspacePath, hasBundledExtensionManifest, isKnownCliMcpTypeAlias, listAgentProfileMarkdownDirs, listAgentWorkspaceDirs, listProfiles, listThinkingLevels, loadConfig, loadModelsJson, matchReloadRule, modelsJsonExists, normalizeConfiguredMcpServers, normalizeElevatedMode, normalizeReasoningLevel, normalizeThinkLevel, normalizeVerboseLevel, normalizeWorkspaceDir, parseModelRef, resetConfigOverrides, resolveAgentAuthProfilesPath, resolveAgentDir, resolveAgentDir$1 as resolveAgentDirFromConfig, resolveAgentHomeDir, resolveAgentHomeDir$1 as resolveAgentHomeDirFromConfig, resolveAgentProfileDir, resolveAgentProfileMarkdownPath, resolveAgentWorkspaceDir, resolveAuthProfilesPath, resolveBinDir, resolveBundledExtensionsDir, resolveBundledSkillsDir, resolveConfigPath, resolveConfigValue, resolveCredentialsDir, resolveDefaultAgentWorkspaceDir, resolveEffectiveAgentManifestForAgent, resolveEffectiveAgentManifestForSession, resolveEffectiveAgentProfile, resolveEffectiveAgentProfileForSession, resolveExtensionSdkPath, resolveExtensionsDir, resolveExtensionsLockPath, resolveHeaders, resolveHomeDir, resolveInboxDir, resolveInboxMessagePath, resolveInboxPendingDir, resolveInboxProcessedDir, resolveLogPath, resolveLogsDir, resolveMcpOAuthPath, resolveModelsJsonPath, resolveNodeBinDir, resolveNodeBinPath, resolveNodeToolsDir, resolveNpmBinPath, resolveOAuthPath, resolvePidPath, resolveProfileStateDir, resolveSkillPath, resolveSkillsCachePath, resolveSkillsDir, resolveSkillsLockPath, resolveSocketPath, resolveStateDir, resolveStatusPath, resolveToolsDir, resolveWorkspaceExtensionsDir, resolveWorkspaceFile, resolveWorkspaceRoot, resolveWorkspaceStateDir, resolveWorkspaceStatePath, resolveXopcBinPath, resolveXopcCloudCatalogCachePath, resolveXopcDatabasePath, resolveXopcMcpTransportAlias, saveConfig, saveModelsJson, setConfigOverride, testApiKeyResolution, thinkLevelToNumber, unsetConfigOverride, validateModelsConfig };

package/dist/src/config/paths.d.ts

@@ -41,6 +41,8 @@ export declare function resolveAuthProfilesPath(): string;
  * Resolve OAuth token file path for a provider
  */
 export declare function resolveOAuthPath(provider: string): string;
+/** Resolve the credential record for one canonical remote MCP endpoint. */
+export declare function resolveMcpOAuthPath(serverKey: string): string;
 /**
  * Internal agent state dir: `stateDir/agents/<id>/agent/`
  * (credentials, inbox IPC, pid, agent.json — not the Markdown workspace).

package/dist/src/config/paths.js

@@ -30,6 +30,10 @@ function resolveAuthProfilesPath() {
 function resolveOAuthPath(provider) {
 	return join(resolveCredentialsDir(), "oauth", `${provider}.json`);
 }
+/** Resolve the credential record for one canonical remote MCP endpoint. */
+function resolveMcpOAuthPath(serverKey) {
+	return join(resolveCredentialsDir(), "mcp", `${serverKey}.json`);
+}
 /**
 * Internal agent state dir: `stateDir/agents/<id>/agent/`
 * (credentials, inbox IPC, pid, agent.json — not the Markdown workspace).
@@ -320,4 +324,4 @@ var init_paths = __esmMin((() => {
 }));
 //#endregion
 init_paths();
-export { ENV_VARS, FILENAMES, WORKSPACE_FILES, XOPC_DB_FILENAME, existsSync, hasBundledExtensionManifest, init_paths, resolveAgentAuthProfilesPath, resolveAgentDir, resolveAgentDir$1 as resolveAgentDirFromConfig, resolveAgentHomeDir, resolveAgentHomeDir$1 as resolveAgentHomeDirFromConfig, resolveAgentProfileDir, resolveAgentProfileMarkdownPath, resolveAgentWorkspaceDir, resolveAuthProfilesPath, resolveBinDir, resolveBundledExtensionsDir, resolveBundledSkillsDir, resolveConfigPath, resolveCredentialsDir, resolveDefaultAgentWorkspaceDir, resolveExtensionSdkPath, resolveExtensionsDir, resolveExtensionsLockPath, resolveHomeDir, resolveInboxDir, resolveInboxMessagePath, resolveInboxPendingDir, resolveInboxProcessedDir, resolveLogPath, resolveLogsDir, resolveModelsJsonPath, resolveNodeBinDir, resolveNodeBinPath, resolveNodeToolsDir, resolveNpmBinPath, resolveOAuthPath, resolvePidPath, resolveSkillPath, resolveSkillsCachePath, resolveSkillsDir, resolveSkillsLockPath, resolveSocketPath, resolveStateDir, resolveStatusPath, resolveToolsDir, resolveWorkspaceExtensionsDir, resolveWorkspaceFile, resolveWorkspaceStateDir, resolveWorkspaceStatePath, resolveXopcBinPath, resolveXopcCloudCatalogCachePath, resolveXopcDatabasePath };
+export { ENV_VARS, FILENAMES, WORKSPACE_FILES, XOPC_DB_FILENAME, existsSync, hasBundledExtensionManifest, init_paths, resolveAgentAuthProfilesPath, resolveAgentDir, resolveAgentDir$1 as resolveAgentDirFromConfig, resolveAgentHomeDir, resolveAgentHomeDir$1 as resolveAgentHomeDirFromConfig, resolveAgentProfileDir, resolveAgentProfileMarkdownPath, resolveAgentWorkspaceDir, resolveAuthProfilesPath, resolveBinDir, resolveBundledExtensionsDir, resolveBundledSkillsDir, resolveConfigPath, resolveCredentialsDir, resolveDefaultAgentWorkspaceDir, resolveExtensionSdkPath, resolveExtensionsDir, resolveExtensionsLockPath, resolveHomeDir, resolveInboxDir, resolveInboxMessagePath, resolveInboxPendingDir, resolveInboxProcessedDir, resolveLogPath, resolveLogsDir, resolveMcpOAuthPath, resolveModelsJsonPath, resolveNodeBinDir, resolveNodeBinPath, resolveNodeToolsDir, resolveNpmBinPath, resolveOAuthPath, resolvePidPath, resolveSkillPath, resolveSkillsCachePath, resolveSkillsDir, resolveSkillsLockPath, resolveSocketPath, resolveStateDir, resolveStatusPath, resolveToolsDir, resolveWorkspaceExtensionsDir, resolveWorkspaceFile, resolveWorkspaceStateDir, resolveWorkspaceStatePath, resolveXopcBinPath, resolveXopcCloudCatalogCachePath, resolveXopcDatabasePath };

package/dist/src/config/schema.d.ts

@@ -1430,6 +1430,10 @@ export declare const TuiConfigSchema: z.ZodDefault<z.ZodObject<{
     defaultAgent: z.ZodOptional<z.ZodString>;
 }, z.core.$strict>>;
 export type TuiConfig = z.infer<typeof TuiConfigSchema>;
+export declare const McpOAuthConfigSchema: z.ZodObject<{
+    type: z.ZodLiteral<"oauth">;
+    clientId: z.ZodOptional<z.ZodString>;
+}, z.core.$strict>;
 export declare const McpServerSchema: z.ZodObject<{
     command: z.ZodOptional<z.ZodString>;
     args: z.ZodOptional<z.ZodArray<z.ZodString>>;
@@ -1452,6 +1456,10 @@ export declare const McpServerSchema: z.ZodObject<{
             fieldKey: z.ZodString;
         }, z.core.$strip>;
     }, z.core.$strip>]>>>;
+    auth: z.ZodOptional<z.ZodObject<{
+        type: z.ZodLiteral<"oauth">;
+        clientId: z.ZodOptional<z.ZodString>;
+    }, z.core.$strict>>;
     connectionTimeoutMs: z.ZodOptional<z.ZodNumber>;
     requestTimeoutMs: z.ZodOptional<z.ZodNumber>;
 }, z.core.$catchall<z.ZodUnknown>>;
@@ -1478,12 +1486,17 @@ export declare const McpConfigSchema: z.ZodOptional<z.ZodObject<{
                 fieldKey: z.ZodString;
             }, z.core.$strip>;
         }, z.core.$strip>]>>>;
+        auth: z.ZodOptional<z.ZodObject<{
+            type: z.ZodLiteral<"oauth">;
+            clientId: z.ZodOptional<z.ZodString>;
+        }, z.core.$strict>>;
         connectionTimeoutMs: z.ZodOptional<z.ZodNumber>;
         requestTimeoutMs: z.ZodOptional<z.ZodNumber>;
     }, z.core.$catchall<z.ZodUnknown>>>>;
     sessionIdleTtlMs: z.ZodOptional<z.ZodNumber>;
 }, z.core.$strict>>;
 export type McpServerConfig = z.infer<typeof McpServerSchema>;
+export type McpOAuthConfig = z.infer<typeof McpOAuthConfigSchema>;
 export type McpConfig = z.infer<typeof McpConfigSchema>;
 export declare const ConnectorsConfigSchema: z.ZodOptional<z.ZodObject<{
     instances: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodRecord<z.ZodString, z.ZodUnknown>>>;
@@ -2331,6 +2344,10 @@ export declare const ConfigSchema: z.ZodDefault<z.ZodObject<{
                     fieldKey: z.ZodString;
                 }, z.core.$strip>;
             }, z.core.$strip>]>>>;
+            auth: z.ZodOptional<z.ZodObject<{
+                type: z.ZodLiteral<"oauth">;
+                clientId: z.ZodOptional<z.ZodString>;
+            }, z.core.$strict>>;
             connectionTimeoutMs: z.ZodOptional<z.ZodNumber>;
             requestTimeoutMs: z.ZodOptional<z.ZodNumber>;
         }, z.core.$catchall<z.ZodUnknown>>>>;

package/dist/src/config/schema.js

@@ -64,7 +64,7 @@ function parseModelRef(ref) {
 		model: trimmed.slice(idx + 1).trim()
 	};
 }
-var AgentModelRefSchema, AgentImageGenerationModelSchema, AgentTypedModelRoleSchema, AgentTypedModelRolesSchema, AgentModelsSchema, AgentsConfigSchema, BrowserCloudConfigSchema, BrowserExtensionConfigSchema, BrowserCloakConfigSchema, BrowserConfigSchema, BindingMatchSchema, BindingRuleSchema, BindingsConfigSchema, SessionDmScopeSchema, SessionStorageConfigSchema, SessionResetModeSchema, SessionResetConfigSchema, SessionResetByTypeSchema, SessionScopeSchema, SessionConfigSchema, ChannelsConfigSchema, SearchProviderEntrySchema, WebSearchConfigSchema, WebsiteBlocklistSchema, WebToolsConfigSchema, ToolsConfigSchema, RuntimePreferenceSchema, RuntimeProvisionSchema, LanguageRuntimeSchema, DEFAULT_RUNTIME_TOOLS_CONFIG, RuntimeToolsConfigSchema, GatewayAuthRateLimitSchema, GatewaySecuritySchema, GatewayTrustedProxySchema, GatewayAuthSchema, GatewayTailscaleConsentSchema, GatewayTailscaleSchema, GatewayRemoteSchema, GatewayTlsSchema, GatewayModeSchema, HeartbeatConfigSchema, GatewayChannelConnectDeferModeSchema, TunnelConsentSchema, TunnelConfigSchema, WorkspaceImportConfigSchema, WorkspaceConfigSchema, GatewayBindModeSchema, GatewayWebchatConfigSchema, GatewayConfigSchema, ModelsDevConfigSchema, ModelCatalogConfigSchema, SttProviderConfigCatchallSchema, STTProviderConfigSchema, STTFallbackConfigSchema, MediaUnderstandingCapabilitiesSchema, MediaUnderstandingModelSchema, STTConfigSchema, TtsProviderConfigCatchallSchema, TTSProviderConfigSchema, TTSFallbackConfigSchema, TTSModelOverridesConfigSchema, TTSEdgeConfigSchema, TTSSummarizationConfigSchema, TTSConfigSchema, VoiceRefinementConfigSchema, VoiceConfigSchema, MessagesConfigSchema, ToolsMediaAudioConfigSchema, ToolsMediaConfigSchema, ProviderAzureConfigSchema, ProviderRequestOverridesSchema, ProviderAuthConfigSchema, ProvidersConfigSchema, ExtensionSecurityConfigSchema, ExtensionSlotsConfigSchema, ExtensionsConfigSchema, UpdateAutoConfigSchema, UpdateConfigSchema, CommandsConfigSchema, TuiConfigSchema, McpHttpUrlSchema, ConnectorSecretReferenceSchema, McpConfigScalarSchema, McpServerSchema, McpConfigSchema, ConnectorsConfigSchema, ExperimentalConfigSchema, ConfigSchema;
+var AgentModelRefSchema, AgentImageGenerationModelSchema, AgentTypedModelRoleSchema, AgentTypedModelRolesSchema, AgentModelsSchema, AgentsConfigSchema, BrowserCloudConfigSchema, BrowserExtensionConfigSchema, BrowserCloakConfigSchema, BrowserConfigSchema, BindingMatchSchema, BindingRuleSchema, BindingsConfigSchema, SessionDmScopeSchema, SessionStorageConfigSchema, SessionResetModeSchema, SessionResetConfigSchema, SessionResetByTypeSchema, SessionScopeSchema, SessionConfigSchema, ChannelsConfigSchema, SearchProviderEntrySchema, WebSearchConfigSchema, WebsiteBlocklistSchema, WebToolsConfigSchema, ToolsConfigSchema, RuntimePreferenceSchema, RuntimeProvisionSchema, LanguageRuntimeSchema, DEFAULT_RUNTIME_TOOLS_CONFIG, RuntimeToolsConfigSchema, GatewayAuthRateLimitSchema, GatewaySecuritySchema, GatewayTrustedProxySchema, GatewayAuthSchema, GatewayTailscaleConsentSchema, GatewayTailscaleSchema, GatewayRemoteSchema, GatewayTlsSchema, GatewayModeSchema, HeartbeatConfigSchema, GatewayChannelConnectDeferModeSchema, TunnelConsentSchema, TunnelConfigSchema, WorkspaceImportConfigSchema, WorkspaceConfigSchema, GatewayBindModeSchema, GatewayWebchatConfigSchema, GatewayConfigSchema, ModelsDevConfigSchema, ModelCatalogConfigSchema, SttProviderConfigCatchallSchema, STTProviderConfigSchema, STTFallbackConfigSchema, MediaUnderstandingCapabilitiesSchema, MediaUnderstandingModelSchema, STTConfigSchema, TtsProviderConfigCatchallSchema, TTSProviderConfigSchema, TTSFallbackConfigSchema, TTSModelOverridesConfigSchema, TTSEdgeConfigSchema, TTSSummarizationConfigSchema, TTSConfigSchema, VoiceRefinementConfigSchema, VoiceConfigSchema, MessagesConfigSchema, ToolsMediaAudioConfigSchema, ToolsMediaConfigSchema, ProviderAzureConfigSchema, ProviderRequestOverridesSchema, ProviderAuthConfigSchema, ProvidersConfigSchema, ExtensionSecurityConfigSchema, ExtensionSlotsConfigSchema, ExtensionsConfigSchema, UpdateAutoConfigSchema, UpdateConfigSchema, CommandsConfigSchema, TuiConfigSchema, McpHttpUrlSchema, ConnectorSecretReferenceSchema, McpConfigScalarSchema, McpOAuthConfigSchema, McpServerSchema, McpConfigSchema, ConnectorsConfigSchema, ExperimentalConfigSchema, ConfigSchema;
 var init_schema = __esmMin((() => {
 	init_schema$1();
 	init_preset_chain();
@@ -970,6 +970,11 @@ defaultAgent: z.string().min(1).optional() }).strict().default({});
 		z.boolean(),
 		ConnectorSecretReferenceSchema
 	]);
+	McpOAuthConfigSchema = z.object({
+		type: z.literal("oauth"),
+		/** Optional public client id for authorization servers without dynamic registration. */
+		clientId: z.string().min(1).optional()
+	}).strict();
 	McpServerSchema = z.object({
 		command: z.string().optional(),
 		args: z.array(z.string()).optional(),
@@ -979,6 +984,7 @@ defaultAgent: z.string().min(1).optional() }).strict().default({});
 		url: McpHttpUrlSchema.optional(),
 		transport: z.enum(["sse", "streamable-http"]).optional(),
 		headers: z.record(z.string(), McpConfigScalarSchema).optional(),
+		auth: McpOAuthConfigSchema.optional(),
 		connectionTimeoutMs: z.number().finite().positive().optional(),
 		requestTimeoutMs: z.number().finite().positive().optional()
 	}).catchall(z.unknown()).superRefine((value, ctx) => {
@@ -988,6 +994,24 @@ defaultAgent: z.string().min(1).optional() }).strict().default({});
 			code: "custom",
 			message: "MCP server cannot define both command and url"
 		});
+		if (value.auth && !hasUrl) ctx.addIssue({
+			code: "custom",
+			path: ["auth"],
+			message: "MCP OAuth requires an HTTP server URL"
+		});
+		if (value.auth && value.transport === "sse") ctx.addIssue({
+			code: "custom",
+			path: ["auth"],
+			message: "MCP OAuth currently supports streamable HTTP only"
+		});
+		if (value.auth && value.headers) {
+			const authorizationHeader = Object.keys(value.headers).find((key) => key.toLowerCase() === "authorization");
+			if (authorizationHeader) ctx.addIssue({
+				code: "custom",
+				path: ["headers", authorizationHeader],
+				message: "MCP OAuth cannot be combined with a static Authorization header"
+			});
+		}
 	});
 	McpConfigSchema = z.object({
 		servers: z.record(z.string(), McpServerSchema).optional(),
@@ -1148,4 +1172,4 @@ workDiscoveryOnboarding: z.boolean().default(true) }).strict().default({ workDis
 }));
 //#endregion
 init_schema();
-export { AgentImageGenerationModelSchema, AgentModelRefSchema, AgentModelsSchema, AgentTypedModelRoleSchema, AgentsConfigSchema, BindingMatchSchema, BindingRuleSchema, BindingsConfigSchema, BrowserConfigSchema, ChannelsConfigSchema, CommandsConfigSchema, ConfigSchema, ConnectorsConfigSchema, ExperimentalConfigSchema, ExtensionSecurityConfigSchema, ExtensionSlotsConfigSchema, ExtensionsConfigSchema, GatewayAuthRateLimitSchema, GatewayAuthSchema, GatewayBindModeSchema, GatewayChannelConnectDeferModeSchema, GatewayConfigSchema, GatewayModeSchema, GatewayRemoteSchema, GatewaySecuritySchema, GatewayTailscaleConsentSchema, GatewayTailscaleSchema, GatewayTlsSchema, GatewayTrustedProxySchema, GatewayWebchatConfigSchema, HeartbeatConfigSchema, McpConfigSchema, McpServerSchema, MediaUnderstandingCapabilitiesSchema, MediaUnderstandingModelSchema, MessagesConfigSchema, ModelCatalogConfigSchema, ModelsDevConfigSchema, ProviderAuthConfigSchema, ProviderAzureConfigSchema, ProviderRequestOverridesSchema, ProvidersConfigSchema, RuntimeToolsConfigSchema, STTConfigSchema, STTFallbackConfigSchema, STTProviderConfigSchema, SearchProviderEntrySchema, SessionConfigSchema, SessionDmScopeSchema, SessionResetByTypeSchema, SessionResetConfigSchema, SessionResetModeSchema, SessionScopeSchema, SessionStorageConfigSchema, TTSConfigSchema, TTSEdgeConfigSchema, TTSFallbackConfigSchema, TTSModelOverridesConfigSchema, TTSProviderConfigSchema, TTSSummarizationConfigSchema, TelegramAccountConfigSchema, TelegramConfigSchema, TelegramGroupConfigSchema, TelegramTopicConfigSchema, ToolsConfigSchema, ToolsMediaAudioConfigSchema, ToolsMediaConfigSchema, TuiConfigSchema, TunnelConfigSchema, TunnelConsentSchema, UpdateAutoConfigSchema, UpdateConfigSchema, VoiceConfigSchema, VoiceRefinementConfigSchema, WebSearchConfigSchema, WebToolsConfigSchema, WebsiteBlocklistSchema, WeixinAccountConfigSchema, WeixinConfigSchema, WorkspaceConfigSchema, WorkspaceImportConfigSchema, getAgentDefaultImageGenerationModelConfig, getAgentDefaultImageModelConfig, getAgentDefaultModelRef, init_schema, parseModelRef };
+export { AgentImageGenerationModelSchema, AgentModelRefSchema, AgentModelsSchema, AgentTypedModelRoleSchema, AgentsConfigSchema, BindingMatchSchema, BindingRuleSchema, BindingsConfigSchema, BrowserConfigSchema, ChannelsConfigSchema, CommandsConfigSchema, ConfigSchema, ConnectorsConfigSchema, ExperimentalConfigSchema, ExtensionSecurityConfigSchema, ExtensionSlotsConfigSchema, ExtensionsConfigSchema, GatewayAuthRateLimitSchema, GatewayAuthSchema, GatewayBindModeSchema, GatewayChannelConnectDeferModeSchema, GatewayConfigSchema, GatewayModeSchema, GatewayRemoteSchema, GatewaySecuritySchema, GatewayTailscaleConsentSchema, GatewayTailscaleSchema, GatewayTlsSchema, GatewayTrustedProxySchema, GatewayWebchatConfigSchema, HeartbeatConfigSchema, McpConfigSchema, McpOAuthConfigSchema, McpServerSchema, MediaUnderstandingCapabilitiesSchema, MediaUnderstandingModelSchema, MessagesConfigSchema, ModelCatalogConfigSchema, ModelsDevConfigSchema, ProviderAuthConfigSchema, ProviderAzureConfigSchema, ProviderRequestOverridesSchema, ProvidersConfigSchema, RuntimeToolsConfigSchema, STTConfigSchema, STTFallbackConfigSchema, STTProviderConfigSchema, SearchProviderEntrySchema, SessionConfigSchema, SessionDmScopeSchema, SessionResetByTypeSchema, SessionResetConfigSchema, SessionResetModeSchema, SessionScopeSchema, SessionStorageConfigSchema, TTSConfigSchema, TTSEdgeConfigSchema, TTSFallbackConfigSchema, TTSModelOverridesConfigSchema, TTSProviderConfigSchema, TTSSummarizationConfigSchema, TelegramAccountConfigSchema, TelegramConfigSchema, TelegramGroupConfigSchema, TelegramTopicConfigSchema, ToolsConfigSchema, ToolsMediaAudioConfigSchema, ToolsMediaConfigSchema, TuiConfigSchema, TunnelConfigSchema, TunnelConsentSchema, UpdateAutoConfigSchema, UpdateConfigSchema, VoiceConfigSchema, VoiceRefinementConfigSchema, WebSearchConfigSchema, WebToolsConfigSchema, WebsiteBlocklistSchema, WeixinAccountConfigSchema, WeixinConfigSchema, WorkspaceConfigSchema, WorkspaceImportConfigSchema, getAgentDefaultImageGenerationModelConfig, getAgentDefaultImageModelConfig, getAgentDefaultModelRef, init_schema, parseModelRef };

package/dist/src/connectors/auth-provider-registry.d.ts

@@ -7,4 +7,4 @@ export type ConnectorAuthStartResult = {
     authorizationUrl?: string;
     connectionId?: string;
 };
-export declare function startConnectorAuthorization(definition: ConnectorDefinition, config?: Config): Promise<ConnectorAuthStartResult>;
+export declare function startConnectorAuthorization(definition: ConnectorDefinition, config?: Config, instanceId?: string): Promise<ConnectorAuthStartResult>;

package/dist/src/connectors/auth-provider-registry.js

@@ -1,8 +1,29 @@
 import { startComposioAuthorize } from "./composio.js";
+import { isManagedConnectorServer } from "./materialize.js";
 import { getConnectorInstance } from "./instances.js";
+import { getMcpOAuthManager } from "../agent/mcp/oauth/mcp-oauth-manager.js";
 //#region src/connectors/auth-provider-registry.ts
-async function startConnectorAuthorization(definition, config) {
-	if (definition.auth.mode !== "oauth" || definition.auth.provider !== "composio" || definition.runtime.type !== "composio" || definition.runtime.role !== "toolkit") throw new Error(`Connector "${definition.id}" does not support Composio authorization.`);
+async function startConnectorAuthorization(definition, config, instanceId) {
+	if (definition.auth.mode !== "oauth") throw new Error(`Connector "${definition.id}" does not use OAuth.`);
+	if (definition.runtime.type === "mcp") {
+		if (!config) throw new Error("Connector configuration is required for MCP authorization.");
+		const serverId = instanceId ?? definition.runtime.serverId;
+		const server = config.mcp?.servers?.[serverId];
+		if (!server) throw new Error(`Connector MCP server not found: ${serverId}`);
+		if (!isManagedConnectorServer(server) || server.xopcConnector.connectorId !== definition.id) throw new Error(`MCP server "${serverId}" is not managed by connector "${definition.id}".`);
+		const status = await getMcpOAuthManager().start({
+			serverId,
+			rawServer: server,
+			cfg: config
+		});
+		return {
+			connectorId: definition.id,
+			provider: "mcp",
+			status: status.status,
+			authorizationUrl: status.session?.authorizationUrl
+		};
+	}
+	if (definition.auth.provider !== "composio" || definition.runtime.type !== "composio" || definition.runtime.role !== "toolkit") throw new Error(`Connector "${definition.id}" does not support OAuth authorization.`);
 	const configuredAuthConfigId = config ? getConnectorInstance(config, definition.id)?.config?.authConfigId : void 0;
 	const authConfigId = typeof configuredAuthConfigId === "string" && configuredAuthConfigId.trim() ? configuredAuthConfigId.trim() : void 0;
 	const authorization = await startComposioAuthorize(definition.id, definition.runtime.toolkit, void 0, authConfigId);

package/dist/src/connectors/connected-source-understanding.js

@@ -1,9 +1,9 @@
 import { finishContextExtractionRun } from "../storage/sqlite/context-extraction-repository.js";
 import { listKnowledgeSourceItems } from "../storage/sqlite/knowledge-repository.js";
 import "../storage/sqlite/index.js";
+import { focusLifecycle } from "../user-context/focus-lifecycle.js";
 import { upsertUserFocus } from "../user-context/sources/repository.js";
 import { claimRegisteredExtraction } from "../user-context/extraction/registry.js";
-import { focusLifecycle } from "../user-context/focus-lifecycle.js";
 import { allowsRemoteSourceProcessing } from "../user-context/sources/processing-policy.js";
 import { analyzeUnderstandingSources } from "../work-discovery/analyzer.js";
 import { createHash } from "node:crypto";

package/dist/src/connectors/install.js

@@ -1,7 +1,7 @@
 import { CredentialResolver, init_credentials } from "../auth/credentials.js";
 import { assertPreferredConnectorStrategy } from "./integration-strategy.js";
 import { getConnectorDefinition } from "./catalog.js";
-import { getConnectorInstance } from "./instances.js";
+import { getConnectorInstance, getInstalledConnectorDefinition } from "./instances.js";
 import { getConnectorRuntimeAdapter } from "./runtime-adapter-registry.js";
 //#region src/connectors/install.ts
 init_credentials();
@@ -22,7 +22,7 @@ async function installConnector(config, connectorId, input, resolver = new Crede
 function updateConnectorConfig(config, instanceId, input) {
 	const instance = getConnectorInstance(config, instanceId);
 	if (!instance) throw new Error(`Connector instance not found: ${instanceId}`);
-	const definition = getConnectorDefinition(instance.connectorId);
+	const definition = getInstalledConnectorDefinition(config, instanceId);
 	if (!definition) throw new Error(`Unknown connector: ${instance.connectorId}`);
 	const adapter = getConnectorRuntimeAdapter(definition.runtime.type);
 	if (!adapter.update) throw new Error(`Connector type "${definition.runtime.type}" does not support config updates.`);
@@ -40,7 +40,7 @@ function uninstallConnector(config, instanceId) {
 		if (config.mcp?.servers?.[instanceId] || config.connectors?.instances?.[instanceId]) throw new Error(`Connector instance "${instanceId}" is not managed by Connectors.`);
 		throw new Error(`Connector instance not found: ${instanceId}`);
 	}
-	const definition = getConnectorDefinition(instance.connectorId);
+	const definition = getInstalledConnectorDefinition(config, instanceId);
 	if (!definition) throw new Error(`Unknown connector: ${instance.connectorId}`);
 	getConnectorRuntimeAdapter(definition.runtime.type).uninstall({
 		config,

package/dist/src/connectors/instances.d.ts

@@ -1,4 +1,5 @@
 import type { Config } from '../config/schema.js';
-import type { ConnectorInstance } from './types.js';
+import type { ConnectorDefinition, ConnectorInstance } from './types.js';
 export declare function listConnectorInstances(config: Config): ConnectorInstance[];
 export declare function getConnectorInstance(config: Config, instanceId: string): ConnectorInstance | undefined;
+export declare function getInstalledConnectorDefinition(config: Config, instanceId: string): ConnectorDefinition | undefined;

package/dist/src/connectors/instances.js

@@ -1,5 +1,5 @@
 import { getConnectorDefinition } from "./catalog.js";
-import { isManagedConnectorServer } from "./materialize.js";
+import { connectorDefinitionFromManagedMarker, isManagedConnectorServer } from "./materialize.js";
 import { getConnectorAuditFromMarker, getConnectorUsageFromMarker } from "./usage.js";
 //#region src/connectors/instances.ts
 function readMarkerConfig(marker) {
@@ -9,7 +9,7 @@ function readMarkerConfig(marker) {
 }
 function secretStatusForServer(server) {
 	const marker = server.xopcConnector;
-	const definition = marker?.connectorId ? getConnectorDefinition(marker.connectorId) : void 0;
+	const definition = connectorDefinitionFromManagedMarker(marker) ?? (marker?.connectorId ? getConnectorDefinition(marker.connectorId) : void 0);
 	const env = server.env && typeof server.env === "object" && !Array.isArray(server.env) ? server.env : {};
 	const status = {};
 	for (const secret of definition?.setup.secrets ?? []) {
@@ -24,7 +24,7 @@ function connectorInstanceFromRecord(instanceId, record) {
 	const markerRecord = marker;
 	if (markerRecord.managed !== true || typeof markerRecord.connectorId !== "string") return [];
 	const connectorId = markerRecord.connectorId;
-	const definition = getConnectorDefinition(connectorId);
+	const definition = connectorDefinitionFromManagedMarker(markerRecord) ?? getConnectorDefinition(connectorId);
 	const runtime = record.runtime && typeof record.runtime === "object" && !Array.isArray(record.runtime) ? record.runtime : {};
 	const runtimeType = runtime.type;
 	if (runtimeType !== "composio" && runtimeType !== "channel" && runtimeType !== "nativeTool" && runtimeType !== "memorySource") return [];
@@ -66,7 +66,7 @@ function listConnectorInstances(config) {
 	const mcpInstances = Object.entries(servers).flatMap(([serverId, server]) => {
 		if (!isManagedConnectorServer(server)) return [];
 		const connectorId = server.xopcConnector.connectorId;
-		const definition = getConnectorDefinition(connectorId);
+		const definition = connectorDefinitionFromManagedMarker(server.xopcConnector) ?? getConnectorDefinition(connectorId);
 		const enabled = server.xopcConnector.enabled !== false;
 		const usage = getConnectorUsageFromMarker(server.xopcConnector);
 		const lastHealthStatus = usage.lastHealthStatus;
@@ -99,5 +99,15 @@ function listConnectorInstances(config) {
 function getConnectorInstance(config, instanceId) {
 	return listConnectorInstances(config).find((instance) => instance.instanceId === instanceId);
 }
+function getInstalledConnectorDefinition(config, instanceId) {
+	const server = config.mcp?.servers?.[instanceId];
+	if (server && isManagedConnectorServer(server)) return connectorDefinitionFromManagedMarker(server.xopcConnector) ?? getConnectorDefinition(server.xopcConnector.connectorId);
+	const record = config.connectors?.instances?.[instanceId];
+	if (record && typeof record === "object" && !Array.isArray(record)) {
+		const marker = record.xopcConnector;
+		const connectorId = marker && typeof marker === "object" && !Array.isArray(marker) ? marker.connectorId : void 0;
+		return connectorDefinitionFromManagedMarker(marker) ?? (typeof connectorId === "string" ? getConnectorDefinition(connectorId) : void 0);
+	}
+}
 //#endregion
-export { getConnectorInstance, listConnectorInstances };
+export { getConnectorInstance, getInstalledConnectorDefinition, listConnectorInstances };