@xopcai/xopc 0.0.320 → 0.0.323

package/dist/src/config/index.js

@@ -2,15 +2,15 @@ import { ENV_VARS, XOPC_DB_FILENAME, resolveHomeDir, resolveStateDir, resolveXop
 import { TelegramAccountConfigSchema, TelegramConfigSchema, TelegramGroupConfigSchema, TelegramTopicConfigSchema } from "../../extensions/telegram/src/config-schema.js";
 import { WeixinAccountConfigSchema, WeixinConfigSchema } from "../../extensions/weixin/src/config-schema.js";
 import { AgentImageGenerationModelSchema, AgentModelRefSchema, AgentModelsSchema, AgentsConfigSchema, BindingMatchSchema, BindingRuleSchema, BindingsConfigSchema, BrowserConfigSchema, ChannelsConfigSchema, CommandsConfigSchema, ConfigSchema, ConnectorsConfigSchema, ExperimentalConfigSchema, ExtensionSecurityConfigSchema, ExtensionSlotsConfigSchema, ExtensionsConfigSchema, GatewayAuthRateLimitSchema, GatewayAuthSchema, GatewayBindModeSchema, GatewayChannelConnectDeferModeSchema, GatewayConfigSchema, GatewayModeSchema, GatewayRemoteSchema, GatewayScenesConfigSchema, GatewaySecuritySchema, GatewayTailscaleConsentSchema, GatewayTailscaleSchema, GatewayTlsSchema, GatewayTrustedProxySchema, GatewayWebchatConfigSchema, HeartbeatConfigSchema, McpConfigSchema, McpOAuthConfigSchema, McpServerSchema, MediaUnderstandingCapabilitiesSchema, MediaUnderstandingModelSchema, MessagesConfigSchema, ModelCatalogConfigSchema, ModelsDevConfigSchema, ProviderAuthConfigSchema, ProviderAzureConfigSchema, ProviderRequestOverridesSchema, ProvidersConfigSchema, RuntimeToolsConfigSchema, STTConfigSchema, STTFallbackConfigSchema, STTProviderConfigSchema, SearchProviderEntrySchema, SessionConfigSchema, SessionDmScopeSchema, SessionResetByTypeSchema, SessionResetConfigSchema, SessionResetModeSchema, SessionScopeSchema, SessionStorageConfigSchema, TTSConfigSchema, TTSEdgeConfigSchema, TTSFallbackConfigSchema, TTSModelOverridesConfigSchema, TTSProviderConfigSchema, TTSSummarizationConfigSchema, ToolsConfigSchema, ToolsMediaAudioConfigSchema, ToolsMediaConfigSchema, TuiConfigSchema, TunnelConfigSchema, TunnelConsentSchema, UpdateAutoConfigSchema, UpdateConfigSchema, VoiceConfigSchema, VoiceRefinementConfigSchema, WebSearchConfigSchema, WebToolsConfigSchema, WebsiteBlocklistSchema, WorkspaceConfigSchema, WorkspaceImportConfigSchema, getAgentDefaultImageGenerationModelConfig, getAgentDefaultImageModelConfig, getAgentDefaultModelRef, init_schema, parseModelRef } from "./schema.js";
-import { clearConfigValueCache, getAllowedCommands, getCacheStats, init_resolve_config_value, resolveConfigValue, resolveHeaders, testApiKeyResolution } from "./resolve-config-value.js";
+import { applyConfigOverrides, getConfigOverrides, resetConfigOverrides, setConfigOverride, unsetConfigOverride } from "./runtime-overrides.js";
 import { expandWorkspacePathString, init_workspace_path, normalizeWorkspaceDir, resolveWorkspaceRoot } from "./workspace-path.js";
 import { resolveDefaultAgentWorkspaceDir } from "./workspace-defaults.js";
 import { resolveAgentDir as resolveAgentDir$1, resolveAgentHomeDir as resolveAgentHomeDir$1, resolveAgentWorkspaceDir } from "../agent/agent-scope.js";
+import { extractProfileAgentId, resolveEffectiveAgentConfigForAgent, resolveEffectiveAgentConfigForSession, resolveEffectiveAgentProfile, resolveEffectiveAgentProfileForSession } from "./agent-profile.js";
 import { FILENAMES, WORKSPACE_FILES, existsSync, hasBundledExtensionManifest, init_paths, resolveAgentAuthProfilesPath, resolveAgentDir, resolveAgentHomeDir, resolveAgentProfileDir, resolveAgentProfileMarkdownPath, resolveAuthProfilesPath, resolveBinDir, resolveBundledExtensionsDir, resolveBundledSkillsDir, resolveConfigPath, resolveCredentialsDir, resolveExtensionSdkPath, resolveExtensionsDir, resolveExtensionsLockPath, resolveInboxDir, resolveInboxMessagePath, resolveInboxPendingDir, resolveInboxProcessedDir, resolveLogPath, resolveLogsDir, resolveMcpOAuthPath, resolveModelsJsonPath, resolveNodeBinDir, resolveNodeBinPath, resolveNodeToolsDir, resolveNpmBinPath, resolveOAuthPath, resolvePidPath, resolveSkillPath, resolveSkillsCachePath, resolveSkillsDir, resolveSkillsLockPath, resolveSocketPath, resolveStatusPath, resolveToolsDir, resolveWorkspaceExtensionsDir, resolveWorkspaceFile, resolveWorkspaceStateDir, resolveWorkspaceStatePath, resolveXopcBinPath } from "./paths.js";
-import { CustomModelSchema, ImageGenerationCapabilitiesSchema, ImageGenerationModelSchema, ImageGenerationProviderSchema, ModelOverrideSchema, ModelsJsonSchema, OpenAICompatSchema, OpenAICompletionsCompatSchema, OpenAIResponsesCompatSchema, OpenRouterRoutingSchema, ProviderConfigSchema, VercelGatewayRoutingSchema, getDefaultModelValues, init_models_json, loadModelsJson, modelsJsonExists, saveModelsJson, validateModelsConfig } from "./models-json.js";
 import { assertConfigRewriteSafeForRunningGateway, init_loader, loadConfig, saveConfig } from "./loader.js";
-import { applyConfigOverrides, getConfigOverrides, resetConfigOverrides, setConfigOverride, unsetConfigOverride } from "./runtime-overrides.js";
-import { extractProfileAgentId, resolveEffectiveAgentConfigForAgent, resolveEffectiveAgentConfigForSession, resolveEffectiveAgentProfile, resolveEffectiveAgentProfileForSession } from "./agent-profile.js";
+import { clearConfigValueCache, getAllowedCommands, getCacheStats, init_resolve_config_value, resolveConfigValue, resolveHeaders, testApiKeyResolution } from "./resolve-config-value.js";
+import { CustomModelSchema, ImageGenerationCapabilitiesSchema, ImageGenerationModelSchema, ImageGenerationProviderSchema, ModelOverrideSchema, ModelsJsonSchema, OpenAICompatSchema, OpenAICompletionsCompatSchema, OpenAIResponsesCompatSchema, OpenRouterRoutingSchema, ProviderConfigSchema, VercelGatewayRoutingSchema, getDefaultModelValues, init_models_json, loadModelsJson, modelsJsonExists, saveModelsJson, validateModelsConfig } from "./models-json.js";
 import { canonicalizeConfiguredMcpServer, isKnownCliMcpTypeAlias, normalizeConfiguredMcpServers, resolveXopcMcpTransportAlias } from "./mcp-config-normalize.js";
 import { formatThinkingLevels, listThinkingLevels, normalizeElevatedMode, normalizeReasoningLevel, normalizeThinkLevel, normalizeVerboseLevel, thinkLevelToNumber } from "../agent/transcript/thinking-types.js";
 import { getWorkspacePath } from "./workspace-path-helpers.js";

package/dist/src/config/loader.js

@@ -2,10 +2,10 @@ import { __esmMin } from "../../_virtual/_rolldown/runtime.js";
 import { createLogger } from "../utils/logger/index.js";
 import { init_logger } from "../utils/logger.js";
 import { ConfigSchema, init_schema } from "./schema.js";
-import { init_write_file_atomic, writeTextAtomic } from "../infra/write-file-atomic.js";
 import { init_paths, resolveConfigPath } from "./paths.js";
-import { init_resolution, setActivePlatformDiscovery } from "../platform/resolution.js";
+import { init_write_file_atomic, writeTextAtomic } from "../infra/write-file-atomic.js";
 import { assertChannelPluginConfigs, init_validate_channel_configs } from "./validate-channel-configs.js";
+import { init_resolution, setActivePlatformDiscovery } from "../platform/resolution.js";
 import { init_lock, isGatewayConfigLockedByAnotherProcessSync } from "../gateway/lock.js";
 import { dirname } from "path";
 import { existsSync, mkdirSync, promises, readFileSync } from "fs";

package/dist/src/config/models-json.js

@@ -1,7 +1,7 @@
 import { __esmMin } from "../../_virtual/_rolldown/runtime.js";
-import { ComputerProfileSchema, init_src } from "../../packages/computer-control-contract/src/index.js";
-import { init_write_file_atomic, writeTextAtomicSync } from "../infra/write-file-atomic.js";
 import { init_paths, resolveModelsJsonPath } from "./paths.js";
+import { init_write_file_atomic, writeTextAtomicSync } from "../infra/write-file-atomic.js";
+import { ComputerProfileSchema, init_src } from "../../packages/computer-control-contract/src/index.js";
 import { init_model_policy, isComputerModel } from "../computer/model-policy.js";
 import { existsSync, readFileSync } from "fs";
 import { z } from "zod";

package/dist/src/config/schema.js

@@ -1,7 +1,7 @@
 import { __esmMin } from "../../_virtual/_rolldown/runtime.js";
+import { ComputerConfigSchema, init_config } from "../computer/config.js";
 import { AgentModelsOverrideSchema, AgentsConfigSchema as AgentsConfigSchema$1, DEFAULT_AGENT_MODEL_REF, DEFAULT_SKILL_POLICY, ImageGenerationRouteSchema, ModelRouteSchema } from "../agent-config/schema.js";
 import { init_agent_config } from "../agent-config/index.js";
-import { ComputerConfigSchema, init_config } from "../computer/config.js";
 import { DEFAULT_CONTEXT_COMPACTION_POLICY, UserContextConfigSchema, init_config as init_config$1 } from "../user-context/config.js";
 import { init_default_model } from "./default-model.js";
 import { init_public_url, validatePublicUrl } from "./public-url.js";
@@ -236,7 +236,7 @@ var init_schema = __esmMin((() => {
 	});
 	WebSearchConfigSchema = z.object({
 		maxResults: z.number().default(5),
-		/** Ordered API providers; empty → HTML fallback only */
+		/** Ordered manual providers; when none are usable, try XOPC Cloud then HTML fallback. */
 		providers: z.array(SearchProviderEntrySchema).default([])
 	});
 	WebsiteBlocklistSchema = z.object({

package/dist/src/connectors/account-selection.js

@@ -11,7 +11,7 @@ function selectConnectorAccount(input) {
 		principalId: installation.principalId,
 		connectorId: installation.connectorId
 	}).filter((connection) => connection.status === "active" && canAccessConnectorAccount(connection, installation, input.agentId) && (!input.accept || input.accept(connection))));
-	const bindings = input.conversationId ? connectionBindings(input.conversationId).filter((binding) => binding.connectorId === installation.connectorId) : [];
+	const bindings = input.conversationId ? connectionBindings(input.conversationId).filter((binding) => binding.target.type === "connector" && binding.target.connectorId === installation.connectorId) : [];
 	const requested = input.requestedAccountId ?? (bindings.length === 1 ? bindings[0]?.accountId : void 0);
 	if (requested && bindings.length && !bindings.some((binding) => binding.accountId === requested)) throw new Error("This account is not selected for the current objective.");
 	const connection = requested ? candidates.find((candidate) => candidate.accountId === requested) : bindings.length > 1 ? void 0 : candidates.length === 1 ? candidates[0] : void 0;

package/dist/src/connectors/connection-candidates.d.ts

@@ -5,7 +5,10 @@ export declare function connectionCandidates(query: string): {
 }[];
 export declare function resolveConnectionCandidate(ref: string): {
     key: string;
-    connectorId: string;
+    target: {
+        type: "connector";
+        connectorId: string;
+    };
     label: string;
     capabilities: string[];
 };

package/dist/src/connectors/connection-candidates.js

@@ -59,7 +59,10 @@ function resolveConnectionCandidate(ref) {
 	const cli = getConnectorDefinition(ref);
 	if (cli?.runtime.type === "cli") return {
 		key: `${ref}:default`,
-		connectorId: ref,
+		target: {
+			type: "connector",
+			connectorId: ref
+		},
 		label: cli.displayName,
 		capabilities: Object.entries(getCliAdapter(cli.runtime.adapterId).curatedActions).filter(([, scope]) => scope === "read").map(([id]) => id)
 	};
@@ -68,7 +71,10 @@ function resolveConnectionCandidate(ref) {
 	if (!item || !definition) throw new Error("Unknown connection candidate. Search for a supported app first.");
 	return {
 		key: `${ref}:default`,
-		connectorId: ref,
+		target: {
+			type: "connector",
+			connectorId: ref
+		},
 		label: definition.displayName,
 		capabilities: item.capabilities
 	};

package/dist/src/connectors/connection-capabilities.d.ts

@@ -1,4 +1,4 @@
 import type { ConnectionNeed } from '@xopcai/gateway-contract';
 export declare function isToolInputSchema(value: unknown): value is Record<string, unknown>;
-export declare function capabilityActions(need: Pick<ConnectionNeed, 'connectorId' | 'capabilities'>): string[][];
-export declare function missingConnectionCapabilities(need: Pick<ConnectionNeed, 'connectorId' | 'capabilities'>, actions: Set<string>): string[];
+export declare function capabilityActions(need: ConnectionNeed): string[][];
+export declare function missingConnectionCapabilities(need: ConnectionNeed, actions: Set<string>): string[];

package/dist/src/connectors/connection-capabilities.js

@@ -28,7 +28,9 @@ function isToolInputSchema(value) {
 	return Boolean(value && typeof value === "object" && !Array.isArray(value) && value.type === "object");
 }
 function capabilityActions(need) {
-	return need.capabilities.map((capability) => /^[A-Z]+_/.test(capability) ? [capability] : CAPABILITY_ACTIONS[need.connectorId]?.[capability] ?? []);
+	if (need.target.type !== "connector") return [];
+	const connectorId = need.target.connectorId;
+	return need.capabilities.map((capability) => /^[A-Z]+_/.test(capability) ? [capability] : CAPABILITY_ACTIONS[connectorId]?.[capability] ?? []);
 }
 function missingConnectionCapabilities(need, actions) {
 	return capabilityActions(need).flatMap((alternatives, index) => alternatives.some((action) => actions.has(action)) ? [] : [need.capabilities[index]]);

package/dist/src/connectors/connection-recovery-service.d.ts

@@ -1,16 +1,18 @@
 import type { Config } from '../config/schema.js';
 import type { SessionInput } from '../storage/sqlite/session-input-repository.js';
 import { ComposioSessionsAdapter } from './composio-sessions.js';
+import { type PluginMcpRecovery } from './plugin-mcp-recovery.js';
 import type { ConnectionWaitSnapshot } from '@xopcai/gateway-contract';
 export type ConnectionAction = {
     waitId: string;
     expectedTranscriptId: string;
     expectedVersion: number;
     idempotencyKey: string;
-    action: 'connect' | 'check' | 'continue' | 'skip' | 'cancel' | 'select_account' | 'confirm_scope' | 'replace_source';
+    action: 'connect' | 'check' | 'continue' | 'skip' | 'cancel' | 'select_account' | 'confirm_scope' | 'replace_source' | 'submit_callback';
     needKey?: string;
     accountId?: string;
     candidateRef?: string;
+    callbackUrl?: string;
 };
 /** Authorization lives at click time. Chat history contains only immutable explanations. */
 export declare class ConnectionRecoveryService {
@@ -29,13 +31,16 @@ export declare class ConnectionRecoveryService {
         }>;
         drain: (conversationId: string) => void;
         adapter?: ComposioSessionsAdapter;
+        pluginMcp?: PluginMcpRecovery;
     });
     private get adapter();
+    private get pluginMcp();
     snapshot(conversationId: string): ConnectionWaitSnapshot;
     private view;
     private ensureInstallation;
     private checkCapabilities;
     private syncConnections;
+    private syncPluginMcpNeeds;
     preflight(input: SessionInput): Promise<boolean>;
     act(conversationId: string, action: ConnectionAction): Promise<{
         snapshot: ConnectionWaitSnapshot;

package/dist/src/connectors/connection-recovery-service.js

@@ -19,6 +19,7 @@ import { capabilityActions, isToolInputSchema, missingConnectionCapabilities } f
 import { resolveConnectionCandidate } from "./connection-candidates.js";
 import { installConnector } from "./install.js";
 import { persistConfigMutation } from "../config/config-mutation.js";
+import { HostPluginMcpRecovery } from "./plugin-mcp-recovery.js";
 import { randomUUID } from "node:crypto";
 //#region src/connectors/connection-recovery-service.ts
 init_transaction();
@@ -36,6 +37,9 @@ const SCOPE_ORDER = {
 };
 const INTENT_TTL = 30 * 6e4;
 const ATTEMPT_TTL = 10 * 6e4;
+function isConnectorNeed(need) {
+	return need.target.type === "connector";
+}
 /** Authorization lives at click time. Chat history contains only immutable explanations. */
 var ConnectionRecoveryService = class {
 	busy = /* @__PURE__ */ new Set();
@@ -77,6 +81,9 @@ var ConnectionRecoveryService = class {
 	get adapter() {
 		return this.deps.adapter ?? new ComposioSessionsAdapter();
 	}
+	get pluginMcp() {
+		return this.deps.pluginMcp ?? new HostPluginMcpRecovery(this.deps.getConfig);
+	}
 	snapshot(conversationId) {
 		if (!connectorPrincipalForSession(conversationId).isLocalOwner) throw new Error("This connection belongs to another principal.");
 		const transcriptId = readCurrentTranscriptId(getSqliteDatabase(), conversationId);
@@ -90,13 +97,25 @@ var ConnectionRecoveryService = class {
 	}
 	view(wait, verifiedIds) {
 		const needs = wait.needs.map((need) => {
-			const instance = listConnectorInstances(this.deps.getConfig()).find((instance) => instance.connectorId === need.connectorId);
-			const installation = getConnectorInstallation(`${need.connectorId}-${wait.principalId}`);
+			if (need.target.type === "plugin-mcp") {
+				const availability = this.pluginMcp.availability(need.target);
+				const phase = !availability.available || need.connectionId && need.capabilityError ? "blocked" : need.connectionId === need.target.serverId ? "ready" : need.attempt && need.attempt.expiresAt > Date.now() ? "authorizing" : need.unavailable ? "reconnect" : "connect";
+				return {
+					...need,
+					phase,
+					accounts: [],
+					alternatives: [],
+					...availability.reason || need.capabilityError ? { reason: availability.reason ?? need.capabilityError } : {}
+				};
+			}
+			const id = need.target.connectorId;
+			const instance = listConnectorInstances(this.deps.getConfig()).find((instance) => instance.connectorId === id);
+			const installation = getConnectorInstallation(`${id}-${wait.principalId}`);
 			const cli = instance?.materialized.type === "cli" ? getCliAdapter(instance.materialized.adapterId) : void 0;
 			const scopeBlocked = Math.max(1, ...need.capabilities.filter((capability) => cli || /^[A-Z]+_/.test(capability)).map((capability) => SCOPE_ORDER[cli ? cli.curatedActions[capability] ?? "read" : scopeForComposioAction(capability).scope])) > SCOPE_ORDER[installation?.maxScope ?? "read"];
 			const all = listConnectorConnections({
 				principalId: wait.principalId,
-				connectorId: need.connectorId
+				connectorId: id
 			});
 			const requested = need.accountId ? all.find((connection) => connection.accountId === need.accountId) : void 0;
 			const blocked = scopeBlocked || instance?.enabled === false || installation?.enabled === false || installation?.selectedAccountIds?.length === 0 || Boolean(installation && requested && !canAccessConnectorAccount(requested, installation, wait.agentId)) || Boolean(installation?.allowedAgentIds.length && !installation.allowedAgentIds.includes(wait.agentId));
@@ -115,9 +134,9 @@ var ConnectionRecoveryService = class {
 				"revoked",
 				"failed"
 			].includes(connection.status)) ? "reconnect" : "connect";
-			const alternatives = ["composio-gmail", "composio-outlook"].includes(need.connectorId) ? ["composio-gmail", "composio-outlook"].filter((id) => id !== need.connectorId).map((id) => ({
-				candidateRef: id,
-				label: getConnectorDefinition(id)?.displayName ?? id
+			const alternatives = ["composio-gmail", "composio-outlook"].includes(id) ? ["composio-gmail", "composio-outlook"].filter((candidate) => candidate !== id).map((candidate) => ({
+				candidateRef: candidate,
+				label: getConnectorDefinition(candidate)?.displayName ?? candidate
 			})) : [];
 			return {
 				...need,
@@ -174,14 +193,16 @@ var ConnectionRecoveryService = class {
 			}))
 		}, verified).needs;
 		return Promise.all(wait.needs.map(async (need) => {
+			if (need.target.type === "plugin-mcp") return need;
 			if (views.find((view) => view.key === need.key)?.phase !== "ready") return {
 				...need,
 				capabilityError: void 0
 			};
 			try {
-				const instance = listConnectorInstances(this.deps.getConfig()).find((instance) => instance.connectorId === need.connectorId && instance.enabled);
+				const id = need.target.connectorId;
+				const instance = listConnectorInstances(this.deps.getConfig()).find((instance) => instance.connectorId === id && instance.enabled);
 				if (!instance) throw new Error("Connector setup is unavailable");
-				const definition = getInstalledConnectorDefinition(this.deps.getConfig(), instance.instanceId) ?? getConnectorDefinition(need.connectorId);
+				const definition = getInstalledConnectorDefinition(this.deps.getConfig(), instance.instanceId) ?? getConnectorDefinition(id);
 				if (definition?.runtime.type === "cli") {
 					const selected = views.find((view) => view.key === need.key);
 					const connection = selected?.connectionId ? getConnectorConnection(selected.connectionId) : void 0;
@@ -211,7 +232,7 @@ var ConnectionRecoveryService = class {
 				const missing = missingConnectionCapabilities(need, new Set(Object.entries(schemas && typeof schemas === "object" ? schemas : {}).filter(([action, value]) => value && typeof value === "object" && isToolInputSchema(value.inputSchema) && isComposioActionAllowedByCatalog(action)).map(([action]) => action)));
 				if (missing.length) log.warn({
 					conversationId: wait.conversationId,
-					connectorId: need.connectorId,
+					connectorId: id,
 					missingCapabilities: missing
 				}, "Connected app lacks required tool contracts");
 				return {
@@ -222,7 +243,7 @@ var ConnectionRecoveryService = class {
 				log.warn({
 					err,
 					conversationId: wait.conversationId,
-					connectorId: need.connectorId
+					connectorId: need.target.connectorId
 				}, "Connected app capability check failed");
 				return {
 					...need,
@@ -235,9 +256,10 @@ var ConnectionRecoveryService = class {
 		const config = this.deps.getConfig();
 		const instances = listConnectorInstances(config);
 		const cliIds = new Set(instances.filter((item) => item.materialized.type === "cli").map((item) => item.connectorId));
-		const fresh = wait.needs.some((need) => !cliIds.has(need.connectorId)) ? await this.adapter.syncConnections({ principalId: wait.principalId }) : [];
+		const connectorNeeds = wait.needs.filter(isConnectorNeed);
+		const fresh = connectorNeeds.some((need) => !cliIds.has(need.target.connectorId)) ? await this.adapter.syncConnections({ principalId: wait.principalId }) : [];
 		for (const connection of currentAccountConnections(listConnectorConnections({ principalId: wait.principalId }))) {
-			if (connection.provider !== "cli" || !wait.needs.some((need) => need.connectorId === connection.connectorId)) continue;
+			if (connection.provider !== "cli" || !connectorNeeds.some((need) => need.target.connectorId === connection.connectorId)) continue;
 			const policy = getConnectorInstallation(`${connection.connectorId}-${wait.principalId}`);
 			if (!policy || !canAccessConnectorAccount(connection, policy, wait.agentId)) continue;
 			const instanceId = connection.metadata.runtimeInstanceId;
@@ -247,6 +269,38 @@ var ConnectionRecoveryService = class {
 		}
 		return fresh;
 	}
+	async syncPluginMcpNeeds(wait) {
+		return Promise.all(wait.needs.map(async (need) => {
+			if (need.target.type !== "plugin-mcp") return need;
+			const status = await this.pluginMcp.status(need.target);
+			if (status.status === "connected") {
+				const verified = await this.pluginMcp.verify(need.target);
+				return {
+					...need,
+					connectionId: need.target.serverId,
+					unavailable: false,
+					attempt: void 0,
+					capabilityError: verified.ready ? void 0 : verified.error ?? "The connected MCP tools are unavailable."
+				};
+			}
+			if (status.status === "authorizing") return {
+				...need,
+				connectionId: void 0,
+				unavailable: false,
+				attempt: {
+					id: status.session?.id ?? need.attempt?.id ?? randomUUID(),
+					expiresAt: status.session?.expiresAt ?? Date.now() + ATTEMPT_TTL
+				}
+			};
+			return {
+				...need,
+				connectionId: void 0,
+				unavailable: true,
+				attempt: void 0,
+				capabilityError: status.status === "error" ? status.session?.error : void 0
+			};
+		}));
+	}
 	async preflight(input) {
 		if (input.kind !== "connection_resume") return true;
 		const wait = input.payload ? getConnectionWait(input.payload.waitId) : void 0;
@@ -255,12 +309,13 @@ var ConnectionRecoveryService = class {
 		try {
 			const fresh = await this.syncConnections(wait);
 			const verified = new Set(fresh.filter((item) => item.status === "active").map((item) => item.id));
-			wait.needs = await this.checkCapabilities(wait, verified);
-			const ready = this.view(wait, verified).needs.every((need) => need.phase === "ready");
-			wait.needs = wait.needs.map((need) => ({
+			wait.needs = await this.syncPluginMcpNeeds(wait);
+			wait.needs = wait.needs.map((need) => need.target.type === "plugin-mcp" ? need : {
 				...need,
 				unavailable: !fresh.some((item) => item.id === need.connectionId && item.status === "active")
-			}));
+			});
+			wait.needs = await this.checkCapabilities(wait, verified);
+			const ready = this.view(wait, verified).needs.every((need) => need.phase === "ready");
 			if (getConnectionWait(wait.id)?.version !== wait.version) return false;
 			if (ready && wait.intent && wait.intent.validUntil > Date.now() && wait.intent.objectiveRevision === wait.objectiveRevision) return true;
 		} catch {}
@@ -319,8 +374,51 @@ var ConnectionRecoveryService = class {
 				const need = wait.needs.find((need) => need.key === action.needKey);
 				if (!need) throw new Error("Unknown connection requirement.");
 				if (this.view(wait).needs.find((item) => item.key === need.key)?.phase === "blocked") throw new Error("Connector policy blocks this connection.");
-				const instance = listConnectorInstances(this.deps.getConfig()).find((item) => item.connectorId === need.connectorId);
-				const definition = (instance ? getInstalledConnectorDefinition(this.deps.getConfig(), instance.instanceId) : void 0) ?? getConnectorDefinition(need.connectorId);
+				if (need.target.type === "plugin-mcp") {
+					const serverId = need.target.serverId;
+					const attemptId = randomUUID();
+					wait = updateConnectionWait({
+						...wait,
+						intent: {
+							objectiveRevision: wait.objectiveRevision,
+							validUntil: Date.now() + INTENT_TTL
+						},
+						needs: wait.needs.map((item) => item.key === need.key ? {
+							...item,
+							unavailable: false,
+							capabilityError: void 0,
+							attempt: {
+								id: attemptId,
+								expiresAt: Date.now() + ATTEMPT_TTL
+							}
+						} : item)
+					}, wait.version);
+					publishConnectionWait(conversationId);
+					const auth = await this.pluginMcp.start(need.target);
+					const latest = getConnectionWait(wait.id);
+					if (!latest || latest.version !== wait.version || latest.status !== "open") throw new Error("WAIT_CHANGED");
+					wait = updateConnectionWait({
+						...wait,
+						needs: wait.needs.map((item) => item.key === need.key ? {
+							...item,
+							attempt: auth.status === "authorizing" ? {
+								id: auth.session?.id ?? attemptId,
+								expiresAt: auth.session?.expiresAt ?? Date.now() + ATTEMPT_TTL
+							} : void 0,
+							connectionId: auth.status === "connected" ? serverId : void 0,
+							unavailable: auth.status === "error",
+							capabilityError: auth.status === "error" ? auth.session?.error : void 0
+						} : item)
+					}, wait.version);
+					publishConnectionWait(conversationId);
+					return {
+						snapshot: this.snapshot(conversationId),
+						authorizationUrl: auth.session?.authorizationUrl
+					};
+				}
+				const id = need.target.connectorId;
+				const instance = listConnectorInstances(this.deps.getConfig()).find((item) => item.connectorId === id);
+				const definition = (instance ? getInstalledConnectorDefinition(this.deps.getConfig(), instance.instanceId) : void 0) ?? getConnectorDefinition(id);
 				if (definition?.runtime.type === "cli") {
 					updateConnectionWait({
 						...wait,
@@ -332,7 +430,7 @@ var ConnectionRecoveryService = class {
 					publishConnectionWait(conversationId);
 					return {
 						snapshot: this.snapshot(conversationId),
-						authorizationUrl: `/#/connectors?connector=${encodeURIComponent(need.connectorId)}`
+						authorizationUrl: `/#/connectors?connector=${encodeURIComponent(id)}`
 					};
 				}
 				if (definition?.runtime.type !== "composio" || definition.runtime.role !== "toolkit") throw new Error("Unsupported connector.");
@@ -353,8 +451,8 @@ var ConnectionRecoveryService = class {
 				}, wait.version);
 				publishConnectionWait(conversationId);
 				const config = this.deps.getConfig();
-				await this.ensureInstallation(wait, need.connectorId);
-				const installationId = `${need.connectorId}-${wait.principalId}`;
+				await this.ensureInstallation(wait, id);
+				const installationId = `${id}-${wait.principalId}`;
 				const auth = await this.adapter.authorize({
 					principalId: wait.principalId,
 					toolkit: definition.runtime.toolkit,
@@ -388,12 +486,20 @@ var ConnectionRecoveryService = class {
 					authorizationUrl: auth.connectUrl
 				};
 			} else {
+				if (action.action === "submit_callback") {
+					const need = wait.needs.find((need) => need.key === action.needKey);
+					if (!need || need.target.type !== "plugin-mcp") throw new Error("OAuth callback is unavailable.");
+					if (!action.callbackUrl || action.callbackUrl.length > 16384) throw new Error("Expected the complete OAuth callback URL.");
+					await this.pluginMcp.submitCallback(need.target, action.callbackUrl);
+				}
 				const fresh = await this.syncConnections(wait);
 				const verified = new Set(fresh.filter((item) => item.status === "active").map((item) => item.id));
 				const latest = getConnectionWait(wait.id);
 				if (!latest || latest.version !== wait.version || latest.status !== "open") throw new Error("WAIT_CHANGED");
 				let needs = wait.needs.map((need) => {
-					const authorized = fresh.find((item) => item.providerConnectionId === need.attempt?.connectionId && item.status === "active" && item.connectorId === need.connectorId && (!need.accountId || item.accountId === need.accountId));
+					if (need.target.type === "plugin-mcp") return need;
+					const id = need.target.connectorId;
+					const authorized = fresh.find((item) => item.providerConnectionId === need.attempt?.connectionId && item.status === "active" && item.connectorId === id && (!need.accountId || item.accountId === need.accountId));
 					return authorized ? {
 						...need,
 						unavailable: false,
@@ -404,13 +510,19 @@ var ConnectionRecoveryService = class {
 						attempt: void 0
 					} : {
 						...need,
-						unavailable: !fresh.some((item) => item.connectorId === need.connectorId && item.status === "active" && (!need.connectionId || item.id === need.connectionId) && (!need.accountId || item.accountId === need.accountId))
+						unavailable: !fresh.some((item) => item.connectorId === id && item.status === "active" && (!need.connectionId || item.id === need.connectionId) && (!need.accountId || item.accountId === need.accountId))
 					};
 				});
+				needs = await this.syncPluginMcpNeeds({
+					...wait,
+					needs
+				});
 				if (action.action === "select_account") {
 					const need = needs.find((item) => item.key === action.needKey);
-					const connection = currentAccountConnections(fresh).find((item) => item.accountId === action.accountId && item.connectorId === need?.connectorId);
-					if (!need || !connection || !this.view(wait, verified).needs.find((item) => item.key === need.key)?.accounts.some((item) => item.id === connection.accountId)) throw new Error("Account is unavailable.");
+					if (!need || need.target.type !== "connector") throw new Error("Account selection is unavailable.");
+					const id = need.target.connectorId;
+					const connection = currentAccountConnections(fresh).find((item) => item.accountId === action.accountId && item.connectorId === id);
+					if (!connection || !this.view(wait, verified).needs.find((item) => item.key === need.key)?.accounts.some((item) => item.id === connection.accountId)) throw new Error("Account is unavailable.");
 					needs = needs.map((item) => item.key === need.key ? {
 						...item,
 						connectionId: connection.id,
@@ -422,7 +534,7 @@ var ConnectionRecoveryService = class {
 				for (const selected of this.view({
 					...wait,
 					needs
-				}, verified).needs) if (selected.phase === "ready" || selected.capabilityError && selected.connectionId) await this.ensureInstallation(wait, selected.connectorId);
+				}, verified).needs) if (selected.target.type === "connector" && (selected.phase === "ready" || selected.capabilityError && selected.connectionId)) await this.ensureInstallation(wait, selected.target.connectorId);
 				needs = await this.checkCapabilities({
 					...wait,
 					needs

package/dist/src/connectors/plugin-mcp-recovery.d.ts

@@ -0,0 +1,28 @@
+import type { PluginMcpConnectionTarget } from '@xopcai/gateway-contract';
+import { type McpOAuthStatus } from '../agent/mcp/oauth/mcp-oauth-manager.js';
+import type { Config } from '../config/schema.js';
+export type PluginMcpAvailability = {
+    available: boolean;
+    reason?: string;
+};
+export type PluginMcpVerification = {
+    ready: boolean;
+    error?: string;
+};
+export interface PluginMcpRecovery {
+    availability(target: PluginMcpConnectionTarget): PluginMcpAvailability;
+    status(target: PluginMcpConnectionTarget): Promise<McpOAuthStatus>;
+    start(target: PluginMcpConnectionTarget): Promise<McpOAuthStatus>;
+    verify(target: PluginMcpConnectionTarget): Promise<PluginMcpVerification>;
+    submitCallback(target: PluginMcpConnectionTarget, callbackUrl: string): Promise<McpOAuthStatus>;
+}
+export declare class HostPluginMcpRecovery implements PluginMcpRecovery {
+    private readonly getConfig;
+    constructor(getConfig: () => Config);
+    availability(target: PluginMcpConnectionTarget): PluginMcpAvailability;
+    status(target: PluginMcpConnectionTarget): Promise<McpOAuthStatus>;
+    start(target: PluginMcpConnectionTarget): Promise<McpOAuthStatus>;
+    verify(target: PluginMcpConnectionTarget): Promise<PluginMcpVerification>;
+    submitCallback(target: PluginMcpConnectionTarget, callbackUrl: string): Promise<McpOAuthStatus>;
+    private resolveServer;
+}

package/dist/src/connectors/plugin-mcp-recovery.js

@@ -0,0 +1,90 @@
+import { AgentPluginStore } from "../extensions/agent-plugins/store.js";
+import { savePluginAuthBinding } from "../extensions/agent-plugins/auth.js";
+import { loadMergedBundleMcpConfig } from "../agent/mcp/bundle-mcp-config.js";
+import { getWorkspacePath } from "../config/workspace-path-helpers.js";
+import { getMcpOAuthManager } from "../agent/mcp/oauth/mcp-oauth-manager.js";
+import { listBundleMcpServerCapabilitiesForGateway } from "../agent/mcp/bundle-mcp-gateway.js";
+//#region src/connectors/plugin-mcp-recovery.ts
+var HostPluginMcpRecovery = class {
+	constructor(getConfig) {
+		this.getConfig = getConfig;
+	}
+	availability(target) {
+		const plugin = new AgentPluginStore().get(target.pluginId);
+		if (!plugin) return {
+			available: false,
+			reason: "The plugin is no longer installed."
+		};
+		if (!plugin.receipt.enabled) return {
+			available: false,
+			reason: "Enable the plugin before connecting its account."
+		};
+		if (plugin.readiness === "blocked") return {
+			available: false,
+			reason: "Repair the plugin before connecting its account."
+		};
+		if (plugin.servers[target.serverName]?.type !== "streamable-http") return {
+			available: false,
+			reason: "This plugin server does not support OAuth."
+		};
+		return { available: true };
+	}
+	async status(target) {
+		const server = this.resolveServer(target);
+		return getMcpOAuthManager(server).status(target.serverId, server);
+	}
+	async start(target) {
+		const availability = this.availability(target);
+		if (!availability.available) throw new Error(availability.reason);
+		await savePluginAuthBinding(new AgentPluginStore(), target.pluginId, target.serverName, { mode: "oauth" });
+		const server = this.resolveServer(target);
+		return getMcpOAuthManager(server).start({
+			serverId: target.serverId,
+			rawServer: server,
+			cfg: this.getConfig()
+		});
+	}
+	async verify(target) {
+		const availability = this.availability(target);
+		if (!availability.available) return {
+			ready: false,
+			error: availability.reason
+		};
+		const status = await this.status(target);
+		if (status.status !== "connected") return {
+			ready: false,
+			error: status.session?.error
+		};
+		const cfg = this.getConfig();
+		const capabilities = await listBundleMcpServerCapabilitiesForGateway({
+			workspaceDir: getWorkspacePath(cfg) || "./workspace",
+			cfg,
+			serverId: target.serverId
+		});
+		if (capabilities.error) return {
+			ready: false,
+			error: capabilities.error.message
+		};
+		if (capabilities.toolCount === 0) return {
+			ready: false,
+			error: "The connected MCP server did not expose any tools."
+		};
+		return { ready: true };
+	}
+	async submitCallback(target, callbackUrl) {
+		const server = this.resolveServer(target);
+		return getMcpOAuthManager(server).submitCallback(target.serverId, server, callbackUrl);
+	}
+	resolveServer(target) {
+		const cfg = this.getConfig();
+		const server = loadMergedBundleMcpConfig({
+			workspaceDir: getWorkspacePath(cfg) || "./workspace",
+			cfg
+		}).config.mcpServers[target.serverId];
+		const origin = server?.xopcPlugin;
+		if (!server || origin?.id !== target.pluginId || origin.serverName !== target.serverName) throw new Error("Plugin MCP server is unavailable.");
+		return server;
+	}
+};
+//#endregion
+export { HostPluginMcpRecovery };

package/dist/src/extensions/agent-plugins/auth.d.ts

@@ -0,0 +1,39 @@
+import { z } from 'zod';
+import { AgentPluginStore } from './store.js';
+import { type PluginServer } from './validation.js';
+declare const bindingSchema: z.ZodObject<{
+    serverName: z.ZodString;
+    mode: z.ZodEnum<{
+        none: "none";
+        auto: "auto";
+        oauth: "oauth";
+        "api-key": "api-key";
+    }>;
+    identityScope: z.ZodLiteral<"owner">;
+    endpointFingerprint: z.ZodString;
+    fields: z.ZodArray<z.ZodObject<{
+        target: z.ZodEnum<{
+            headers: "headers";
+            env: "env";
+        }>;
+        key: z.ZodString;
+        provider: z.ZodString;
+        prefix: z.ZodString;
+    }, z.core.$strict>>;
+}, z.core.$strict>;
+export type PluginAuthBinding = z.infer<typeof bindingSchema>;
+export declare function pluginEndpointFingerprint(server: PluginServer): string;
+export declare function readPluginAuthBinding(store: AgentPluginStore, id: string, name: string, server: PluginServer): PluginAuthBinding | undefined;
+export declare function savePluginAuthBinding(store: AgentPluginStore, id: string, name: string, input: {
+    mode: PluginAuthBinding['mode'];
+    secrets?: Array<{
+        target: 'headers' | 'env';
+        key: string;
+        value: string;
+        prefix?: string;
+    }>;
+}): Promise<void>;
+export declare function applyPluginAuthBinding(raw: Record<string, unknown>, binding: PluginAuthBinding | undefined): Record<string, unknown>;
+export declare function pluginOAuthScope(raw: unknown): string | undefined;
+export declare function removePluginCredentials(store: AgentPluginStore, id: string): Promise<void>;
+export {};