@xopcai/xopc 0.0.320 → 0.0.323

package/dist/src/gateway/hono/routes/agent-plugins.js

@@ -0,0 +1,166 @@
+import { AgentPluginStore } from "../../../extensions/agent-plugins/store.js";
+import { removePluginCredentials, savePluginAuthBinding } from "../../../extensions/agent-plugins/auth.js";
+import { disposeAllSessionMcpRuntimes } from "../../../agent/mcp/bundle-mcp-runtime.js";
+import { withAgentPluginSource } from "../../../extensions/agent-plugins/sources.js";
+import { agentPluginInventoryRow } from "../../../extensions/agent-plugins/inventory.js";
+import { z } from "zod";
+//#region src/gateway/hono/routes/agent-plugins.ts
+const sourceBody = z.strictObject({
+	source: z.string().min(1),
+	reviewHash: z.string().optional()
+});
+function registerAgentPluginRoutes(app, deps) {
+	const store = new AgentPluginStore();
+	const refresh = async () => {
+		await disposeAllSessionMcpRuntimes();
+		deps.service.marketplace.reloadSkills();
+	};
+	app.post("/api/extensions/inspect", deps.strictRateLimitMiddleware, async (c) => {
+		try {
+			const body = sourceBody.parse(await c.req.json());
+			return c.json({
+				ok: true,
+				payload: await withAgentPluginSource(body.source, deps.service.currentConfig, (source) => store.inspect(source))
+			});
+		} catch (error) {
+			return c.json({
+				ok: false,
+				error: error instanceof Error ? error.message : String(error)
+			}, 400);
+		}
+	});
+	app.post("/api/extensions/install", deps.strictRateLimitMiddleware, async (c) => {
+		try {
+			const body = sourceBody.parse(await c.req.json());
+			const plugin = await withAgentPluginSource(body.source, deps.service.currentConfig, (source) => store.install(source, {
+				reviewHash: body.reviewHash,
+				sourceLabel: body.source
+			}));
+			await refresh();
+			return c.json({
+				ok: true,
+				payload: agentPluginInventoryRow(plugin)
+			});
+		} catch (error) {
+			return c.json({
+				ok: false,
+				error: error instanceof Error ? error.message : String(error)
+			}, 400);
+		}
+	});
+	app.get("/api/extensions/agent-plugins/:id", (c) => {
+		try {
+			const plugin = store.get(c.req.param("id"));
+			return plugin ? c.json({
+				ok: true,
+				payload: agentPluginInventoryRow(plugin)
+			}) : c.json({
+				ok: false,
+				error: "Plugin not found"
+			}, 404);
+		} catch (error) {
+			return c.json({
+				ok: false,
+				error: error instanceof Error ? error.message : String(error)
+			}, 400);
+		}
+	});
+	app.post("/api/extensions/agent-plugins/:id/activation", deps.strictRateLimitMiddleware, async (c) => {
+		try {
+			const body = z.strictObject({ enabled: z.boolean() }).parse(await c.req.json());
+			const plugin = store.setEnabled(c.req.param("id"), body.enabled);
+			await refresh();
+			return c.json({
+				ok: true,
+				payload: agentPluginInventoryRow(plugin)
+			});
+		} catch (error) {
+			return c.json({
+				ok: false,
+				error: error instanceof Error ? error.message : String(error)
+			}, 400);
+		}
+	});
+	app.post("/api/extensions/agent-plugins/:id/update", deps.strictRateLimitMiddleware, async (c) => {
+		try {
+			const body = sourceBody.parse(await c.req.json());
+			const plugin = await withAgentPluginSource(body.source, deps.service.currentConfig, (source) => store.install(source, {
+				reviewHash: body.reviewHash,
+				replace: true,
+				expectedId: c.req.param("id"),
+				sourceLabel: body.source
+			}));
+			await refresh();
+			return c.json({
+				ok: true,
+				payload: agentPluginInventoryRow(plugin)
+			});
+		} catch (error) {
+			return c.json({
+				ok: false,
+				error: error instanceof Error ? error.message : String(error)
+			}, 400);
+		}
+	});
+	app.post("/api/extensions/agent-plugins/:id/rollback", deps.strictRateLimitMiddleware, async (c) => {
+		try {
+			const plugin = store.rollback(c.req.param("id"));
+			await refresh();
+			return c.json({
+				ok: true,
+				payload: agentPluginInventoryRow(plugin)
+			});
+		} catch (error) {
+			return c.json({
+				ok: false,
+				error: error instanceof Error ? error.message : String(error)
+			}, 400);
+		}
+	});
+	app.put("/api/extensions/agent-plugins/:id/mcp/:server/auth", deps.strictRateLimitMiddleware, async (c) => {
+		try {
+			const body = z.strictObject({
+				mode: z.enum([
+					"auto",
+					"oauth",
+					"api-key",
+					"none"
+				]),
+				secrets: z.array(z.strictObject({
+					target: z.enum(["headers", "env"]),
+					key: z.string(),
+					value: z.string(),
+					prefix: z.string().optional()
+				})).max(20).optional()
+			}).parse(await c.req.json());
+			await savePluginAuthBinding(store, c.req.param("id"), c.req.param("server"), body);
+			await refresh();
+			return c.json({ ok: true });
+		} catch (error) {
+			return c.json({
+				ok: false,
+				error: error instanceof Error ? error.message : String(error)
+			}, 400);
+		}
+	});
+	app.delete("/api/extensions/agent-plugins/:id", deps.strictRateLimitMiddleware, async (c) => {
+		try {
+			const body = z.strictObject({
+				removeData: z.boolean().optional(),
+				removeCredentials: z.boolean().optional()
+			}).parse(await c.req.json());
+			await disposeAllSessionMcpRuntimes();
+			if (body.removeCredentials) await removePluginCredentials(store, c.req.param("id"));
+			store.remove(c.req.param("id"), body.removeData);
+			deps.service.marketplace.reloadSkills();
+			return c.json({ ok: true });
+		} catch (error) {
+			return c.json({
+				ok: false,
+				error: error instanceof Error ? error.message : String(error)
+			}, 400);
+		}
+	});
+}
+//#endregion
+export { registerAgentPluginRoutes };

package/dist/src/gateway/hono/routes/agent-stream.js

@@ -1,7 +1,10 @@
+import { parseUserTurnDocument, userTurnDocumentRefIds } from "../../../../packages/gateway-contract/src/user-turn-document.js";
+import { init_src } from "../../../../packages/gateway-contract/src/index.js";
 import { validateWebchatAttachments, validateWebchatContent } from "../../chat-limits.js";
 import { parseTurnContextRefs } from "../../../agent/source-context/types.js";
 import { replaceLatestSessionTurn, submitSessionInput } from "./session-input-handler.js";
 //#region src/gateway/hono/routes/agent-stream.ts
+init_src();
 function registerAgentStreamRoutes(authenticated, deps) {
 	const { service, chatRateLimitMiddleware } = deps;
 	authenticated.post("/api/agent/abort", chatRateLimitMiddleware, async (c) => {
@@ -60,6 +63,17 @@ function registerAgentStreamRoutes(authenticated, deps) {
 				message: "Invalid source context references"
 			}
 		}, 400);
+		if (typeof body.content === "string") {
+			const document = parseUserTurnDocument(body.content);
+			const refIds = new Set((contextRefs ?? []).flatMap((ref) => ref.refId ? [ref.refId] : []));
+			if (document && !userTurnDocumentRefIds(document).every((refId) => refIds.has(refId))) return c.json({
+				ok: false,
+				error: {
+					code: "BAD_REQUEST",
+					message: "Input contains an unknown context reference"
+				}
+			}, 400);
+		}
 		if (body.content !== void 0) {
 			const contentError = validateWebchatContent(body.content);
 			if (contentError) return c.json({

package/dist/src/gateway/hono/routes/auth-registry-extensions.js

@@ -7,6 +7,7 @@ import { createOAuthAsyncHandler } from "../oauth-async.js";
 import { createOAuthHandler } from "../oauth.js";
 import { extensionAssetMimeType } from "../lib/extension-assets.js";
 import { loadExtensionStore, saveExtensionStore } from "../lib/extension-store.js";
+import { listAgentPluginInventory } from "../../../extensions/agent-plugins/inventory.js";
 import { relative, resolve } from "node:path";
 import { existsSync, readFileSync, statSync } from "node:fs";
 //#region src/gateway/hono/routes/auth-registry-extensions.ts
@@ -152,7 +153,7 @@ function registerAuthRegistryExtensionsRoutes(authenticated, deps) {
 	});
 	authenticated.get("/api/extensions", async (c) => {
 		const loader = service.getExtensionLoader();
-		if (!loader) return c.json({ extensions: [] });
+		if (!loader) return c.json({ extensions: listAgentPluginInventory() });
 		const registry = loader.getRegistry();
 		const discovered = loader.discoverExtensions();
 		const activeIds = /* @__PURE__ */ new Set();
@@ -166,6 +167,7 @@ function registerAuthRegistryExtensionsRoutes(authenticated, deps) {
 			activationEligibleIds = /* @__PURE__ */ new Set();
 		}
 		const extensions = discovered.map((ext) => ({
+			format: "native-extension",
 			id: ext.manifest.id,
 			name: ext.manifest.name,
 			description: ext.manifest.description,
@@ -182,7 +184,7 @@ function registerAuthRegistryExtensionsRoutes(authenticated, deps) {
 				contributions: ext.manifest.ui.contributions
 			} : void 0
 		}));
-		return c.json({ extensions });
+		return c.json({ extensions: [...extensions, ...listAgentPluginInventory()] });
 	});
 	/**
 	* Built-in (bundled) extension enable/disable — persists `extensions.enabled` / `extensions.disabled`.

package/dist/src/gateway/hono/routes/chat-previews.d.ts

@@ -0,0 +1,3 @@
+import type { Hono } from 'hono';
+import type { AuthenticatedRouteDeps } from './deps.js';
+export declare function registerChatPreviewRoutes(app: Hono, deps: AuthenticatedRouteDeps): void;

package/dist/src/gateway/hono/routes/chat-previews.js

@@ -0,0 +1,41 @@
+import { ChatPreviewFixGuidanceInputSchema, ChatPreviewSourceHashSchema } from "../../../../packages/gateway-contract/src/chat-previews.js";
+import { init_src } from "../../../../packages/gateway-contract/src/index.js";
+import { ChatPreviewNotFoundError } from "../../../chat-previews/service.js";
+import "../../../chat-previews/index.js";
+//#region src/gateway/hono/routes/chat-previews.ts
+init_src();
+function registerChatPreviewRoutes(app, deps) {
+	app.get("/api/chat-previews/:id/revisions/:sourceHash", (c) => {
+		const sourceHash = ChatPreviewSourceHashSchema.safeParse(c.req.param("sourceHash"));
+		if (!sourceHash.success) return c.json({ error: "Invalid preview revision" }, 400);
+		try {
+			return c.json({ revision: deps.service.chatPreviews.getRevision(c.req.param("id"), sourceHash.data) }, 200, { "Cache-Control": "private, max-age=31536000, immutable" });
+		} catch (error) {
+			if (error instanceof ChatPreviewNotFoundError) return c.json({ error: error.message }, 404);
+			throw error;
+		}
+	});
+	app.post("/api/chat-previews/:id/fix-guidance", async (c) => {
+		const parsed = ChatPreviewFixGuidanceInputSchema.safeParse(await c.req.json().catch(() => null));
+		if (!parsed.success) return c.json({ error: "Invalid fix guidance input" }, 400);
+		try {
+			return c.json({ guidance: deps.service.chatPreviews.getFixGuidance(c.req.param("id"), parsed.data.sourceHash, parsed.data.diagnostics, parsed.data.locale) });
+		} catch (error) {
+			if (error instanceof ChatPreviewNotFoundError) return c.json({ error: error.message }, 404);
+			throw error;
+		}
+	});
+	app.post("/api/chat-previews/:id/promote", async (c) => {
+		const body = await c.req.json().catch(() => null);
+		const sourceHash = ChatPreviewSourceHashSchema.safeParse(body?.sourceHash);
+		if (!sourceHash.success) return c.json({ error: "Invalid preview revision" }, 400);
+		try {
+			return c.json({ app: deps.service.chatPreviews.promote(c.req.param("id"), sourceHash.data) }, 201);
+		} catch (error) {
+			if (error instanceof ChatPreviewNotFoundError) return c.json({ error: error.message }, 404);
+			throw error;
+		}
+	});
+}
+//#endregion
+export { registerChatPreviewRoutes };

package/dist/src/gateway/hono/routes/connection-waits.js

@@ -13,11 +13,13 @@ const actionSchema = z.object({
 		"cancel",
 		"select_account",
 		"confirm_scope",
-		"replace_source"
+		"replace_source",
+		"submit_callback"
 	]),
 	candidateRef: z.string().optional(),
 	needKey: z.string().optional(),
-	accountId: z.string().optional()
+	accountId: z.string().optional(),
+	callbackUrl: z.string().max(16384).optional()
 }).strict();
 function registerConnectionWaitRoutes(app, { service, strictRateLimitMiddleware }) {
 	app.get("/api/sessions/:conversationId/connection-wait", (c) => {

package/dist/src/gateway/hono/routes/index.js

@@ -16,6 +16,7 @@ import { registerEndpointToolRoutes } from "./endpoint-tools.js";
 import { registerRealtimeRoutes } from "./realtime.js";
 import { registerDeviceRoutes } from "./devices.js";
 import { registerLocalAppsRoutes } from "./local-apps.js";
+import { registerChatPreviewRoutes } from "./chat-previews.js";
 import { registerWorkDiscoveryRoutes } from "./work-discovery.js";
 import { registerContextSourceRoutes } from "./context-sources.js";
 import { registerTaskRoutes } from "./tasks.js";
@@ -34,6 +35,7 @@ function registerCoreAuthenticatedRoutes(authenticated, deps) {
 	registerProjectsRoutes(authenticated, deps);
 	registerProjectSkillRoutes(authenticated, deps);
 	registerLocalAppsRoutes(authenticated, deps);
+	registerChatPreviewRoutes(authenticated, deps);
 	registerWorkDiscoveryRoutes(authenticated, deps);
 	registerContextSourceRoutes(authenticated, deps);
 	registerTaskRoutes(authenticated, deps);

package/dist/src/gateway/hono/routes/lazy-bundles.js

@@ -3,6 +3,14 @@ function startsWithAny(path, prefixes) {
 	return prefixes.some((prefix) => path === prefix || path.startsWith(`${prefix}/`));
 }
 const AUTHENTICATED_LAZY_ROUTE_BUNDLES = [
+	{
+		id: "agent-plugins",
+		match: (path) => path === "/api/extensions/inspect" || path === "/api/extensions/install" || startsWithAny(path, ["/api/extensions/agent-plugins"]),
+		load: async () => {
+			const { registerAgentPluginRoutes } = await import("./agent-plugins.js");
+			return { register: registerAgentPluginRoutes };
+		}
+	},
 	{
 		id: "local-app-capabilities",
 		match: (path) => /^\/api\/local-app-capabilities\/[^/]+(?:\/[^/]+\/invocations)?$/.test(path),

package/dist/src/gateway/hono/routes/local-apps.js

@@ -1,56 +1,71 @@
+import { LocalAppSourceHashSchema } from "../../../../packages/gateway-contract/src/local-apps.js";
+import { init_src } from "../../../../packages/gateway-contract/src/index.js";
 import { CapabilityError } from "../../../capabilities/runtime/errors.js";
 import "../../../capabilities/runtime/dispatcher.js";
+import { parseLocalAppFixGuidanceInput } from "../../../local-apps/fix-guidance.js";
 import { readLocalAppAcceptanceConfig } from "../../../local-apps/acceptance.js";
 import { createProductDispatcher } from "../../../capabilities/runtime/product.js";
 import { extensionAssetMimeType } from "../lib/extension-assets.js";
 import { capabilityHttpContext, capabilityHttpError } from "../../../capabilities/adapters/http.js";
 import { LOCAL_APP_RUNTIME_BRIDGE_HASH, injectLocalAppRuntimeBridge } from "../../../local-apps/preview-runtime-bridge.js";
 import { relative, resolve } from "node:path";
-import { existsSync, readFileSync, statSync } from "node:fs";
+import { existsSync, readFileSync, realpathSync, statSync } from "node:fs";
 import { randomUUID } from "node:crypto";
 //#region src/gateway/hono/routes/local-apps.ts
+init_src();
 const LOCAL_APP_PREVIEW_CSP = `default-src 'self'; script-src 'self' 'sha256-${LOCAL_APP_RUNTIME_BRIDGE_HASH}'; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob:; connect-src 'none'; frame-ancestors 'self'; frame-src 'none'; base-uri 'none'; object-src 'none'; form-action 'none'`;
-function registerPublicLocalAppPreviewRoutes(app, service) {
-	app.get("/api/local-apps/preview/:token/*", (c) => {
-		const origin = c.req.header("origin");
-		const cors = { "Access-Control-Allow-Origin": origin === "null" ? "null" : origin || "*" };
-		const preview = service.localApps.resolvePreview(c.req.param("token"));
-		if (!preview) return c.json({ error: "Preview not found" }, 404, cors);
-		const prefix = `/api/local-apps/preview/${preview.previewToken}/`;
-		let assetPath = c.req.path.startsWith(prefix) ? c.req.path.slice(prefix.length) : "";
+function servePreviewAsset(c, preview, prefix, cacheControl) {
+	const origin = c.req.header("origin");
+	const cors = { "Access-Control-Allow-Origin": origin === "null" ? "null" : origin || "*" };
+	let assetPath = c.req.path.startsWith(prefix) ? c.req.path.slice(prefix.length) : "";
+	try {
+		assetPath = decodeURIComponent(assetPath);
+	} catch {
+		return c.json({ error: "Invalid asset path" }, 400, cors);
+	}
+	if (!assetPath || assetPath.includes("..")) return c.json({ error: "Invalid asset path" }, 400, cors);
+	if (!existsSync(preview.uiRoot)) return c.json({ error: "Not found" }, 404, cors);
+	const root = realpathSync(resolve(preview.uiRoot));
+	const unresolvedPath = resolve(root, assetPath);
+	const fullPath = existsSync(unresolvedPath) ? realpathSync(unresolvedPath) : unresolvedPath;
+	const rel = relative(root, fullPath);
+	if (rel.startsWith("..") || rel === "") return c.json({ error: "Path traversal denied" }, 403, cors);
+	if (!existsSync(fullPath) || !statSync(fullPath).isFile()) return c.json({ error: "Not found" }, 404, cors);
+	const mimeType = extensionAssetMimeType(assetPath);
+	const content = readFileSync(fullPath);
+	let textContent = null;
+	if (mimeType.startsWith("text/html")) {
+		let acceptance;
 		try {
-			assetPath = decodeURIComponent(assetPath);
+			acceptance = readLocalAppAcceptanceConfig(preview.uiRoot);
 		} catch {
-			return c.json({ error: "Invalid asset path" }, 400, cors);
+			acceptance = {
+				schemaVersion: 1,
+				scenarios: []
+			};
 		}
-		if (!assetPath || assetPath.includes("..")) return c.json({ error: "Invalid asset path" }, 400, cors);
-		const root = resolve(preview.uiRoot);
-		const fullPath = resolve(root, assetPath);
-		const rel = relative(root, fullPath);
-		if (rel.startsWith("..") || rel === "") return c.json({ error: "Path traversal denied" }, 403, cors);
-		if (!existsSync(fullPath) || !statSync(fullPath).isFile()) return c.json({ error: "Not found" }, 404, cors);
-		const mimeType = extensionAssetMimeType(assetPath);
-		const content = readFileSync(fullPath);
-		let textContent = null;
-		if (mimeType.startsWith("text/html")) {
-			let acceptance;
-			try {
-				acceptance = readLocalAppAcceptanceConfig(preview.uiRoot);
-			} catch {
-				acceptance = {
-					schemaVersion: 1,
-					scenarios: []
-				};
-			}
-			textContent = injectLocalAppRuntimeBridge(content.toString("utf8"), acceptance);
-		} else if (mimeType.startsWith("text/")) textContent = content.toString("utf8");
-		return new Response(textContent ?? new Uint8Array(content), { headers: {
-			"Content-Type": mimeType,
-			"Content-Security-Policy": LOCAL_APP_PREVIEW_CSP,
-			"Cache-Control": "no-store",
-			"X-Content-Type-Options": "nosniff",
-			...cors
-		} });
+		textContent = injectLocalAppRuntimeBridge(content.toString("utf8"), acceptance);
+	} else if (mimeType.startsWith("text/")) textContent = content.toString("utf8");
+	return new Response(textContent ?? new Uint8Array(content), { headers: {
+		"Content-Type": mimeType,
+		"Content-Security-Policy": LOCAL_APP_PREVIEW_CSP,
+		"Cache-Control": cacheControl,
+		"X-Content-Type-Options": "nosniff",
+		...cors
+	} });
+}
+function registerPublicLocalAppPreviewRoutes(app, service) {
+	app.get("/api/local-apps/preview/:token/draft/*", (c) => {
+		const preview = service.localApps.resolveDraftPreview(c.req.param("token"));
+		if (!preview) return c.json({ error: "Preview not found" }, 404);
+		return servePreviewAsset(c, preview, `/api/local-apps/preview/${preview.previewToken}/draft/`, "no-store");
+	});
+	app.get("/api/local-apps/preview/:token/snapshots/:sourceHash/*", (c) => {
+		const sourceHash = LocalAppSourceHashSchema.safeParse(c.req.param("sourceHash"));
+		if (!sourceHash.success) return c.json({ error: "Invalid snapshot hash" }, 400);
+		const preview = service.localApps.resolveSnapshotPreview(c.req.param("token"), sourceHash.data);
+		if (!preview) return c.json({ error: "Preview not found" }, 404);
+		return servePreviewAsset(c, preview, `/api/local-apps/preview/${preview.previewToken}/snapshots/${sourceHash.data}/`, "private, max-age=31536000, immutable");
 	});
 }
 function registerLocalAppsRoutes(app, deps) {
@@ -79,6 +94,12 @@ function registerLocalAppsRoutes(app, deps) {
 			return capabilityHttpError(c, error);
 		}
 	});
+	app.get("/api/local-apps/:id/snapshots/:sourceHash", (c) => {
+		const sourceHash = LocalAppSourceHashSchema.safeParse(c.req.param("sourceHash"));
+		if (!sourceHash.success) return c.json({ error: "Invalid snapshot hash" }, 400);
+		const snapshot = deps.service.localApps.getSnapshot(c.req.param("id"), sourceHash.data);
+		return snapshot ? c.json({ snapshot }) : c.json({ error: "Snapshot not found" }, 404);
+	});
 	app.post("/api/local-apps/:id/validate", async (c) => {
 		try {
 			return c.json(await capabilities.call("xopc.local_apps.validate", { id: c.req.param("id") }, capabilityHttpContext(c)));
@@ -86,6 +107,17 @@ function registerLocalAppsRoutes(app, deps) {
 			return capabilityHttpError(c, error);
 		}
 	});
+	app.post("/api/local-apps/:id/fix-guidance", async (c) => {
+		try {
+			const body = await c.req.json().catch(() => {
+				throw new CapabilityError("INVALID_INPUT", "Invalid JSON body");
+			});
+			const guidance = deps.service.localApps.getFixGuidance(c.req.param("id"), parseLocalAppFixGuidanceInput(body));
+			return c.json({ guidance });
+		} catch (error) {
+			return capabilityHttpError(c, error);
+		}
+	});
 	app.post("/api/local-apps/:id/acceptance-runs", async (c) => {
 		try {
 			const body = await c.req.json().catch(() => {

package/dist/src/gateway/hono/routes/mcp.js

@@ -1,5 +1,7 @@
 import { isManagedConnectorServer } from "../../../connectors/materialize.js";
+import { AgentPluginStore } from "../../../extensions/agent-plugins/store.js";
 import { canonicalizeConfiguredMcpServer, normalizeConfiguredMcpServers } from "../../../config/mcp-config-normalize.js";
+import { savePluginAuthBinding } from "../../../extensions/agent-plugins/auth.js";
 import { loadMergedBundleMcpConfig } from "../../../agent/mcp/bundle-mcp-config.js";
 import { getWorkspacePath } from "../../../config/workspace-path-helpers.js";
 import { getMcpOAuthManager } from "../../../agent/mcp/oauth/mcp-oauth-manager.js";
@@ -20,12 +22,12 @@ function registerMcpRoutes(authenticated, deps) {
 			cfg
 		});
 		const configured = normalizeConfiguredMcpServers(cfg.mcp?.servers);
-		const oauthManager = getMcpOAuthManager();
-		const servers = await Promise.all(Object.entries(configured).map(async ([id, server]) => ({
+		const servers = await Promise.all(Object.entries(merged.config.mcpServers).map(async ([id, server]) => ({
 			id,
+			plugin: server.xopcPlugin,
 			managed: isManagedConnectorServer(server),
 			connectorId: isManagedConnectorServer(server) ? server.xopcConnector.connectorId : void 0,
-			oauth: await oauthManager.status(id, server)
+			oauth: await getMcpOAuthManager(server).status(id, server)
 		})));
 		return c.json({
 			ok: true,
@@ -76,9 +78,30 @@ function registerMcpRoutes(authenticated, deps) {
 		}, 404);
 		return c.json({
 			ok: true,
-			payload: await getMcpOAuthManager().status(id, server)
+			payload: await getMcpOAuthManager(server).status(id, server)
 		});
 	});
+	authenticated.post("/api/mcp/servers/:id/oauth/callback", deps.strictRateLimitMiddleware, async (c) => {
+		const id = c.req.param("id");
+		const server = resolveServer(id);
+		if (!server) return c.json({
+			ok: false,
+			error: "Unknown MCP server"
+		}, 404);
+		try {
+			const body = await c.req.json();
+			if (typeof body.callbackUrl !== "string" || body.callbackUrl.length > 16384) throw new Error("Expected callbackUrl");
+			return c.json({
+				ok: true,
+				payload: await getMcpOAuthManager(server).submitCallback(id, server, body.callbackUrl)
+			});
+		} catch {
+			return c.json({
+				ok: false,
+				error: "OAuth callback rejected; verify the URL and active authorization session"
+			}, 400);
+		}
+	});
 	authenticated.post("/api/mcp/servers/:id/oauth/start", deps.strictRateLimitMiddleware, async (c) => {
 		const id = c.req.param("id");
 		const server = resolveServer(id);
@@ -87,9 +110,12 @@ function registerMcpRoutes(authenticated, deps) {
 			error: `Unknown MCP server: ${id}`
 		}, 404);
 		try {
-			const payload = await getMcpOAuthManager().start({
+			const origin = server.xopcPlugin;
+			if (origin) await savePluginAuthBinding(new AgentPluginStore(), origin.id, origin.serverName, { mode: "oauth" });
+			const oauthServer = origin ? resolveServer(id) : server;
+			const payload = await getMcpOAuthManager(oauthServer).start({
 				serverId: id,
-				rawServer: server,
+				rawServer: oauthServer,
 				cfg: deps.service.currentConfig
 			});
 			return c.json({
@@ -111,7 +137,7 @@ function registerMcpRoutes(authenticated, deps) {
 			error: `Unknown MCP server: ${id}`
 		}, 404);
 		try {
-			const payload = await getMcpOAuthManager().disconnect(id, server);
+			const payload = await getMcpOAuthManager(server).disconnect(id, server);
 			return c.json({
 				ok: true,
 				payload
@@ -171,20 +197,25 @@ function registerMcpRoutes(authenticated, deps) {
 		const workspaceDir = getWorkspacePath(cfg) || "./workspace";
 		const body = await c.req.json().catch(() => ({}));
 		const inlineServer = body && typeof body === "object" && !Array.isArray(body) && body.server && typeof body.server === "object" ? body.server : void 0;
-		const servers = normalizeConfiguredMcpServers(cfg.mcp?.servers);
+		if (inlineServer && id.startsWith("plugin/")) return c.json({
+			ok: false,
+			error: "Plugin servers must use their installed configuration"
+		}, 400);
 		const mergedServers = loadMergedBundleMcpConfig({
 			workspaceDir,
 			cfg
 		}).config.mcpServers;
-		const knownServer = inlineServer ?? servers[id] ?? mergedServers[id];
+		const knownServer = inlineServer ?? mergedServers[id];
 		if (!knownServer) return c.json({
 			ok: false,
 			error: `Unknown MCP server: ${id}`
 		}, 404);
 		try {
-			const oauth = await getMcpOAuthManager().status(id, knownServer);
-			if (oauth.configured && oauth.status !== "connected") return c.json({
+			const oauth = await getMcpOAuthManager(knownServer).status(id, knownServer);
+			if (oauth.configured && knownServer.xopcAutoAuth !== true && oauth.status !== "connected") return c.json({
 				ok: false,
+				code: "MCP_AUTHORIZATION_REQUIRED",
+				serverId: id,
 				error: oauth.session?.error ?? "MCP server authorization is required"
 			}, 409);
 			const capabilities = await listBundleMcpServerCapabilitiesForGateway({
@@ -198,6 +229,12 @@ function registerMcpRoutes(authenticated, deps) {
 				} : cfg,
 				serverId: id
 			});
+			if (capabilities.error) return c.json({
+				ok: false,
+				code: capabilities.error.code,
+				serverId: id,
+				error: capabilities.error.message
+			}, capabilities.error.code === "MCP_AUTHORIZATION_REQUIRED" ? 409 : 502);
 			return c.json({
 				ok: true,
 				payload: {
@@ -212,16 +249,6 @@ function registerMcpRoutes(authenticated, deps) {
 			}, 500);
 		}
 	});
-	authenticated.post("/api/mcp/approvals/respond", async (c) => {
-		const body = await c.req.json().catch(() => ({}));
-		return c.json({
-			ok: true,
-			payload: {
-				acknowledged: true,
-				body
-			}
-		});
-	});
 }
 //#endregion
 export { registerMcpRoutes };

package/dist/src/gateway/hono/routes/models.js

@@ -1,5 +1,5 @@
-import { init_resolve_config_value, testApiKeyResolution } from "../../../config/resolve-config-value.js";
 import { resolveModelsJsonPath } from "../../../config/paths.js";
+import { init_resolve_config_value, testApiKeyResolution } from "../../../config/resolve-config-value.js";
 import { computerModelProfile, init_model_policy, isDedicatedComputerModel } from "../../../computer/model-policy.js";
 import { init_models_json, loadModelsJson, saveModelsJson, validateModelsConfig } from "../../../config/models-json.js";
 import { getModelCatalogStore, init_model_catalog_store } from "../../../providers/model-catalog-store.js";

package/dist/src/gateway/hono/routes/session-input-handler.d.ts

@@ -53,6 +53,7 @@ export declare function submitSessionInput(c: Context, deps: AuthenticatedRouteD
                 };
                 attachments?: import("hono/dist/types/utils/types.js").JSONValue[];
                 contextRefs?: {
+                    refId?: string;
                     kind: import("../../../agent/source-context/types.js").AgentSourceContext["kind"];
                     sourceId: string;
                     version: string;
@@ -65,6 +66,7 @@ export declare function submitSessionInput(c: Context, deps: AuthenticatedRouteD
                     fileKind?: "file" | "directory";
                 }[];
                 contextSnapshots?: {
+                    refId?: string;
                     kind: import("../../../agent/source-context/types.js").SessionSourceBinding["kind"] | "task" | "file" | "session" | "mcp_resource" | "browser_tab" | "browser_page" | "app_context";
                     sourceId: string;
                     version: string;
@@ -189,6 +191,7 @@ export declare function replaceLatestSessionTurn(c: Context, deps: Authenticated
                 };
                 attachments?: import("hono/dist/types/utils/types.js").JSONValue[];
                 contextRefs?: {
+                    refId?: string;
                     kind: import("../../../agent/source-context/types.js").AgentSourceContext["kind"];
                     sourceId: string;
                     version: string;
@@ -201,6 +204,7 @@ export declare function replaceLatestSessionTurn(c: Context, deps: Authenticated
                     fileKind?: "file" | "directory";
                 }[];
                 contextSnapshots?: {
+                    refId?: string;
                     kind: import("../../../agent/source-context/types.js").SessionSourceBinding["kind"] | "task" | "file" | "session" | "mcp_resource" | "browser_tab" | "browser_page" | "app_context";
                     sourceId: string;
                     version: string;