@xopcai/xopc 0.0.321 → 0.0.324

package/dist/src/agent/mcp/mcp-transport.js

@@ -2,11 +2,13 @@ import { init_paths_state, resolveStateDir } from "../../config/paths-state.js";
 import { createLogger } from "../../utils/logger/index.js";
 import { init_logger } from "../../utils/logger.js";
 import { init_string_coerce, normalizeOptionalString } from "../../utils/string-coerce.js";
+import { McpOAuthStore } from "./oauth/mcp-oauth-store.js";
+import { pluginOAuthScope } from "../../extensions/agent-plugins/auth.js";
 import { buildRuntimeEnvironment, resolveRuntimeCommand } from "../../runtime-tools/environment.js";
 import { XopcStdioClientTransport } from "./mcp-stdio-transport.js";
 import { resolveMcpTransportConfig } from "./mcp-transport-config.js";
-import { McpOAuthStore } from "./oauth/mcp-oauth-store.js";
 import { XopcMcpOAuthClientProvider } from "./oauth/mcp-oauth-provider.js";
+import { createPluginHttpFetch } from "./plugin-http-fetch.js";
 import { SSEClientTransport } from "@modelcontextprotocol/sdk/client/sse.js";
 import { StreamableHTTPClientTransport } from "@modelcontextprotocol/sdk/client/streamableHttp.js";
 import { getDefaultEnvironment } from "@modelcontextprotocol/sdk/client/stdio.js";
@@ -64,6 +66,7 @@ function buildScopedHttpFetch(serverUrl, headers) {
 async function resolveMcpTransport(serverName, rawServer, config, options = {}) {
 	const resolved = resolveMcpTransportConfig(serverName, rawServer);
 	if (!resolved) return null;
+	const plugin = rawServer && typeof rawServer === "object" ? rawServer.xopcPlugin : void 0;
 	if (resolved.kind === "stdio") {
 		const command = config ? await resolveRuntimeCommand({
 			command: resolved.command,
@@ -84,7 +87,8 @@ async function resolveMcpTransport(serverName, rawServer, config, options = {})
 			args: resolved.args,
 			env,
 			cwd: resolved.cwd,
-			stderr: "pipe"
+			stderr: "pipe",
+			pluginDataDir: plugin?.dataDir
 		});
 		return {
 			transport,
@@ -100,7 +104,7 @@ async function resolveMcpTransport(serverName, rawServer, config, options = {})
 		const oauthEnabled = Boolean(resolved.auth);
 		let oauthProvider = options.oauthProvider;
 		if (resolved.auth && !oauthProvider) {
-			const store = options.oauthStore ?? new McpOAuthStore();
+			const store = options.oauthStore ?? new McpOAuthStore(pluginOAuthScope(rawServer));
 			if ((await store.load(serverUrl))?.tokens) oauthProvider = new XopcMcpOAuthClientProvider({
 				serverUrl,
 				clientId: resolved.auth.clientId,
@@ -110,8 +114,8 @@ async function resolveMcpTransport(serverName, rawServer, config, options = {})
 		return {
 			transport: new StreamableHTTPClientTransport(serverUrl, {
 				authProvider: oauthProvider,
-				requestInit: !oauthEnabled && resolved.headers ? { headers: resolved.headers } : void 0,
-				fetch: oauthEnabled ? buildScopedHttpFetch(serverUrl, resolved.headers ?? {}) : fetchWithUndici
+				requestInit: !plugin && !oauthEnabled && resolved.headers ? { headers: resolved.headers } : void 0,
+				fetch: plugin ? createPluginHttpFetch(serverUrl, resolved.headers ?? {}) : oauthEnabled ? buildScopedHttpFetch(serverUrl, resolved.headers ?? {}) : fetchWithUndici
 			}),
 			description: resolved.description,
 			transportType: "streamable-http",
@@ -123,9 +127,9 @@ async function resolveMcpTransport(serverName, rawServer, config, options = {})
 	const hasHeaders = Object.keys(headers).length > 0;
 	return {
 		transport: new SSEClientTransport(new URL(resolved.url), {
-			requestInit: hasHeaders ? { headers } : void 0,
-			fetch: fetchWithUndici,
-			eventSourceInit: { fetch: buildSseEventSourceFetch(headers) }
+			requestInit: !plugin && hasHeaders ? { headers } : void 0,
+			fetch: plugin ? createPluginHttpFetch(new URL(resolved.url), headers) : fetchWithUndici,
+			eventSourceInit: { fetch: plugin ? createPluginHttpFetch(new URL(resolved.url), headers) : buildSseEventSourceFetch(headers) }
 		}),
 		description: resolved.description,
 		transportType: "sse",

package/dist/src/agent/mcp/oauth/index.js

@@ -1,5 +1,5 @@
-import { McpAuthorizationRequiredError, isMcpAuthorizationError } from "./mcp-oauth-errors.js";
 import { McpOAuthStore, canonicalMcpServerUrl, mcpOAuthServerKey } from "./mcp-oauth-store.js";
+import { McpAuthorizationRequiredError, isMcpAuthorizationError } from "./mcp-oauth-errors.js";
 import { XopcMcpOAuthClientProvider } from "./mcp-oauth-provider.js";
 import { McpOAuthSession } from "./mcp-oauth-session.js";
 import { McpOAuthManager, getMcpOAuthManager } from "./mcp-oauth-manager.js";

package/dist/src/agent/mcp/oauth/mcp-oauth-manager.d.ts

@@ -15,11 +15,16 @@ type StartMcpOAuthParams = {
 export declare class McpOAuthManager {
     private readonly store;
     private readonly sessionsByServerUrl;
+    private readonly pending;
+    private cancelling;
     constructor(store?: McpOAuthStore);
     status(serverId: string, rawServer: unknown): Promise<McpOAuthStatus>;
     start(params: StartMcpOAuthParams): Promise<McpOAuthStatus>;
+    cancelPending(): Promise<void>;
+    private startSession;
     disconnect(serverId: string, rawServer: unknown): Promise<McpOAuthStatus>;
+    submitCallback(serverId: string, rawServer: unknown, callbackUrl: string): Promise<McpOAuthStatus>;
     private finishAuthorization;
 }
-export declare function getMcpOAuthManager(): McpOAuthManager;
+export declare function getMcpOAuthManager(rawServer?: unknown): McpOAuthManager;
 export {};

package/dist/src/agent/mcp/oauth/mcp-oauth-manager.js

@@ -2,10 +2,12 @@ import { createLogger } from "../../../utils/logger/index.js";
 import { init_logger } from "../../../utils/logger.js";
 import { init_global_singleton, resolveGlobalSingleton } from "../../../utils/global-singleton.js";
 import { resolveConnectorSecretReferences } from "../../../connectors/secret-store.js";
+import { recordPluginMcpHealth } from "../../../extensions/agent-plugins/health.js";
 import { redactSensitiveUrlLikeString } from "../../../utils/redact-sensitive-url.js";
+import { McpOAuthStore, canonicalMcpServerUrl } from "./mcp-oauth-store.js";
+import { pluginOAuthScope } from "../../../extensions/agent-plugins/auth.js";
 import { resolveMcpTransportConfig } from "../mcp-transport-config.js";
 import { isMcpAuthorizationError } from "./mcp-oauth-errors.js";
-import { McpOAuthStore, canonicalMcpServerUrl } from "./mcp-oauth-store.js";
 import { XopcMcpOAuthClientProvider } from "./mcp-oauth-provider.js";
 import { resolveMcpTransport } from "../mcp-transport.js";
 import { disposeAllSessionMcpRuntimes } from "../bundle-mcp-runtime.js";
@@ -49,6 +51,8 @@ function isAuthorizing(snapshot) {
 var McpOAuthManager = class {
 	store;
 	sessionsByServerUrl = /* @__PURE__ */ new Map();
+	pending = /* @__PURE__ */ new Set();
+	cancelling = false;
 	constructor(store = new McpOAuthStore()) {
 		this.store = store;
 	}
@@ -83,7 +87,28 @@ var McpOAuthManager = class {
 		};
 	}
 	async start(params) {
+		if (this.cancelling) throw new Error("OAuth connections are being cleared");
+		const task = this.startSession(params);
+		this.pending.add(task);
+		try {
+			return await task;
+		} finally {
+			this.pending.delete(task);
+		}
+	}
+	async cancelPending() {
+		this.cancelling = true;
+		try {
+			await Promise.all([...this.sessionsByServerUrl.values()].map((session) => session.close()));
+			await Promise.allSettled([...this.pending]);
+			this.sessionsByServerUrl.clear();
+		} finally {
+			this.cancelling = false;
+		}
+	}
+	async startSession(params) {
 		const rawServer = await resolveConnectorSecretReferences(params.rawServer);
+		if (this.cancelling) throw new Error("OAuth connections are being cleared");
 		const resolvedConfig = resolveMcpTransportConfig(params.serverId, rawServer);
 		if (!resolvedConfig || resolvedConfig.kind !== "http" || !resolvedConfig.auth) throw new Error(`MCP server "${params.serverId}" is not configured for OAuth`);
 		const serverUrl = new URL(resolvedConfig.url);
@@ -139,23 +164,39 @@ var McpOAuthManager = class {
 		const client = createClient();
 		try {
 			await connectClient(client, resolved);
+			if (session.snapshot().status === "cancelled") {
+				await this.store.delete(serverUrl);
+				await closeConnection(client, resolved);
+				return {
+					configured: true,
+					status: "disconnected"
+				};
+			}
 			session.complete();
+			recordPluginMcpHealth(rawServer, "ready");
 			await closeConnection(client, resolved);
 			await disposeAllSessionMcpRuntimes();
 		} catch (error) {
-			if (!isMcpAuthorizationError(error) || !session.snapshot().authorizationUrl) {
+			if (session.snapshot().status === "cancelled") {
+				await this.store.delete(serverUrl);
+				await closeConnection(client, resolved);
+			} else if (!isMcpAuthorizationError(error) || !session.snapshot().authorizationUrl) {
 				session.fail(error);
 				await closeConnection(client, resolved);
-			} else this.finishAuthorization({
-				session,
-				provider,
-				client,
-				resolved,
-				params: {
-					...params,
-					rawServer
-				}
-			});
+			} else {
+				const task = this.finishAuthorization({
+					session,
+					provider,
+					client,
+					resolved,
+					params: {
+						...params,
+						rawServer
+					}
+				});
+				this.pending.add(task);
+				task.finally(() => this.pending.delete(task));
+			}
 		}
 		return this.status(params.serverId, params.rawServer);
 	}
@@ -167,12 +208,21 @@ var McpOAuthManager = class {
 		this.sessionsByServerUrl.delete(conversationId);
 		if (session) await session.close();
 		await this.store.delete(resolved.url);
+		recordPluginMcpHealth(rawServer, "authorization_required");
 		await disposeAllSessionMcpRuntimes();
 		return {
 			configured: true,
 			status: "disconnected"
 		};
 	}
+	async submitCallback(serverId, rawServer, callbackUrl) {
+		const resolved = resolveMcpTransportConfig(serverId, rawServer);
+		if (!resolved || resolved.kind !== "http") throw new Error("Unknown OAuth server");
+		const session = this.sessionsByServerUrl.get(canonicalMcpServerUrl(resolved.url));
+		if (!session) throw new Error("OAuth session not found");
+		session.submitCallback(callbackUrl);
+		return this.status(serverId, rawServer);
+	}
 	async finishAuthorization(context) {
 		const { session, provider, client, resolved, params } = context;
 		try {
@@ -195,7 +245,12 @@ var McpOAuthManager = class {
 			} finally {
 				await closeConnection(authenticatedClient, authenticated);
 			}
+			if (session.snapshot().status === "cancelled") {
+				await this.store.delete(session.serverUrl);
+				return;
+			}
 			session.complete();
+			recordPluginMcpHealth(params.rawServer, "ready");
 			await disposeAllSessionMcpRuntimes();
 		} catch (error) {
 			if (session.snapshot().status === "cancelled") {
@@ -213,8 +268,9 @@ var McpOAuthManager = class {
 		}
 	}
 };
-function getMcpOAuthManager() {
-	return resolveGlobalSingleton(MCP_OAUTH_MANAGER_KEY, () => new McpOAuthManager());
+function getMcpOAuthManager(rawServer) {
+	const scope = pluginOAuthScope(rawServer);
+	return resolveGlobalSingleton(scope ? Symbol.for(`xopc.mcpOAuthManager:${scope}`) : MCP_OAUTH_MANAGER_KEY, () => new McpOAuthManager(new McpOAuthStore(scope)));
 }
 //#endregion
 export { McpOAuthManager, getMcpOAuthManager };

package/dist/src/agent/mcp/oauth/mcp-oauth-provider.js

@@ -1,5 +1,5 @@
-import { McpAuthorizationRequiredError } from "./mcp-oauth-errors.js";
 import { McpOAuthStore } from "./mcp-oauth-store.js";
+import { McpAuthorizationRequiredError } from "./mcp-oauth-errors.js";
 //#region src/agent/mcp/oauth/mcp-oauth-provider.ts
 var XopcMcpOAuthClientProvider = class {
 	store;

package/dist/src/agent/mcp/oauth/mcp-oauth-session.d.ts

@@ -19,6 +19,8 @@ export declare class McpOAuthSession {
     get redirectUrl(): URL;
     start(): Promise<void>;
     setAuthorizationUrl(url: URL): void;
+    /** Remote Gateway users can submit the browser's loopback callback URL over the authenticated API. */
+    submitCallback(url: string): void;
     waitForCode(): Promise<string>;
     complete(): void;
     fail(error: unknown): void;

package/dist/src/agent/mcp/oauth/mcp-oauth-session.js

@@ -110,6 +110,18 @@ var McpOAuthSession = class {
 		this.authorizationUrlValue = url.toString();
 		this.statusValue = "waiting_browser";
 	}
+	/** Remote Gateway users can submit the browser's loopback callback URL over the authenticated API. */
+	submitCallback(url) {
+		const callback = new URL(url);
+		if (callback.origin !== this.redirectUrl.origin || callback.pathname !== CALLBACK_PATH || callback.searchParams.get("state") !== this.state) throw new Error("MCP OAuth callback mismatch");
+		if (this.statusValue !== "waiting_browser" || this.callbackConsumed || Date.now() >= this.expiresAt) throw new Error("MCP OAuth session is not waiting for a callback");
+		const code = callback.searchParams.get("code");
+		if (!code || callback.searchParams.has("error")) throw new Error("MCP OAuth authorization code is missing or denied");
+		this.callbackConsumed = true;
+		this.statusValue = "exchanging_code";
+		this.settleCode?.({ code });
+		this.settleCode = void 0;
+	}
 	async waitForCode() {
 		const result = await this.codePromise;
 		if (result.error) throw result.error;

package/dist/src/agent/mcp/oauth/mcp-oauth-store.d.ts

@@ -2,7 +2,10 @@ import type { McpOAuthRecord } from './mcp-oauth-types.js';
 export declare function canonicalMcpServerUrl(input: string | URL): string;
 export declare function mcpOAuthServerKey(input: string | URL): string;
 export declare class McpOAuthStore {
+    private readonly identityScope?;
+    constructor(identityScope?: string);
     pathFor(serverUrl: string | URL): string;
+    deleteScope(): Promise<void>;
     load(serverUrlInput: string | URL): Promise<McpOAuthRecord | undefined>;
     update(serverUrlInput: string | URL, update: (current: McpOAuthRecord | undefined) => McpOAuthRecord | undefined): Promise<McpOAuthRecord | undefined>;
     delete(serverUrl: string | URL): Promise<void>;

package/dist/src/agent/mcp/oauth/mcp-oauth-store.js

@@ -1,5 +1,6 @@
 import { init_paths, resolveMcpOAuthPath } from "../../../config/paths.js";
 import { init_write_file_atomic, writeTextAtomic } from "../../../infra/write-file-atomic.js";
+import { dirname, join } from "node:path";
 import { createHash } from "node:crypto";
 import { readFile, rm } from "node:fs/promises";
 //#region src/agent/mcp/oauth/mcp-oauth-store.ts
@@ -41,8 +42,19 @@ async function serializeWrite(key, operation) {
 	}
 }
 var McpOAuthStore = class {
+	constructor(identityScope) {
+		this.identityScope = identityScope;
+	}
 	pathFor(serverUrl) {
-		return resolveMcpOAuthPath(mcpOAuthServerKey(serverUrl));
+		const endpoint = mcpOAuthServerKey(serverUrl);
+		return this.identityScope ? join(dirname(resolveMcpOAuthPath(endpoint)), createHash("sha256").update(this.identityScope).digest("hex"), `${endpoint}.json`) : resolveMcpOAuthPath(endpoint);
+	}
+	async deleteScope() {
+		if (!this.identityScope) throw new Error("Cannot remove unscoped MCP credentials");
+		await rm(dirname(this.pathFor("https://scope.invalid")), {
+			recursive: true,
+			force: true
+		});
 	}
 	async load(serverUrlInput) {
 		const serverUrl = canonicalMcpServerUrl(serverUrlInput);

package/dist/src/agent/mcp/plugin-http-fetch.d.ts

@@ -0,0 +1,2 @@
+import type { FetchLike } from '@modelcontextprotocol/sdk/shared/transport.js';
+export declare function createPluginHttpFetch(endpoint: URL, configuredHeaders: Record<string, string>): FetchLike;

package/dist/src/agent/mcp/plugin-http-fetch.js

@@ -0,0 +1,56 @@
+import { BlockList, isIP } from "node:net";
+import { Agent, fetch } from "undici";
+import { lookup } from "node:dns";
+//#region src/agent/mcp/plugin-http-fetch.ts
+const blocked = new BlockList();
+for (const [network, prefix] of [
+	["0.0.0.0", 8],
+	["10.0.0.0", 8],
+	["100.64.0.0", 10],
+	["127.0.0.0", 8],
+	["169.254.0.0", 16],
+	["172.16.0.0", 12],
+	["192.168.0.0", 16],
+	["224.0.0.0", 4],
+	["240.0.0.0", 4]
+]) blocked.addSubnet(network, prefix);
+for (const [network, prefix] of [
+	["::", 128],
+	["::1", 128],
+	["fc00::", 7],
+	["fe80::", 10],
+	["ff00::", 8]
+]) blocked.addSubnet(network, prefix, "ipv6");
+const isBlocked = (address) => blocked.check(address, isIP(address) === 6 ? "ipv6" : "ipv4");
+const loopback = (host) => host === "localhost" || host === "[::1]" || /^127(?:\.\d{1,3}){3}$/.test(host);
+const publicDispatcher = new Agent({ connect: { lookup(host, options, callback) {
+	lookup(host, {
+		...options,
+		all: true
+	}, (error, addresses) => {
+		if (error) return callback(error, []);
+		if (!addresses.length || addresses.some((entry) => isBlocked(entry.address))) return callback(/* @__PURE__ */ new Error("Plugin MCP cannot access private network addresses"), []);
+		if (options.all) callback(null, addresses);
+		else callback(null, addresses[0].address, addresses[0].family);
+	});
+} } });
+function createPluginHttpFetch(endpoint, configuredHeaders) {
+	return async (input, init) => {
+		const url = new URL(input);
+		if (!["https:", "http:"].includes(url.protocol) || url.username || url.password || url.hash) throw new Error("Invalid plugin MCP request URL");
+		const local = loopback(endpoint.hostname) && url.origin === endpoint.origin;
+		if (!local && url.protocol !== "https:") throw new Error("Plugin MCP requires HTTPS");
+		const address = url.hostname.replace(/^\[|\]$/g, "");
+		if (!local && isIP(address) && isBlocked(address)) throw new Error("Plugin MCP cannot access private network addresses");
+		const headers = new Headers(url.origin === endpoint.origin ? configuredHeaders : void 0);
+		new Headers(init?.headers).forEach((value, key) => headers.set(key, value));
+		return await fetch(url, {
+			...init,
+			headers,
+			redirect: "error",
+			...local ? {} : { dispatcher: publicDispatcher }
+		});
+	};
+}
+//#endregion
+export { createPluginHttpFetch };

package/dist/src/agent/media-generation/runtime-shared.d.ts

@@ -90,7 +90,7 @@ export declare function throwCapabilityGenerationFailure(params: ThrowCapability
 export interface BuildNoCapabilityModelConfiguredMessageParams {
     /** Display label, e.g. "image-generation". */
     capabilityLabel: string;
-    /** Config key path, e.g. "agents.defaults.models.imageGeneration". */
+    /** Agent model capability key, e.g. "imageGeneration". */
     modelConfigKey: string;
     providers: ReadonlyArray<CapabilityProviderCandidate>;
     /** Optional env-var lookup, e.g. (id) => PROVIDER_ENV_MAP[id]. */

package/dist/src/agent/media-generation/runtime-shared.js

@@ -190,7 +190,7 @@ function throwCapabilityGenerationFailure(params) {
 	});
 }
 function buildNoCapabilityModelConfiguredMessage(params) {
-	const lines = [`No ${params.capabilityLabel} model configured. Set agents.defaults.models.${params.modelConfigKey} or pass modelOverride at call site.`];
+	const lines = [`No ${params.capabilityLabel} model configured. Configure ${params.modelConfigKey} in global Agent defaults or pass modelOverride at call site.`];
 	if (params.providers.length > 0) {
 		lines.push("Registered providers:");
 		for (const p of params.providers) {

package/dist/src/agent/memory/plugin-discovery.js

@@ -1,9 +1,8 @@
-import { discoverExtensionsFromDisk, init_discover_extensions } from "../../extensions/discover-extensions.js";
+import { discoverExtensionsFromDisk } from "../../extensions/discover-extensions.js";
 import { isAbsolute, join } from "node:path";
 import { pathToFileURL } from "node:url";
 import { stat } from "node:fs/promises";
 //#region src/agent/memory/plugin-discovery.ts
-init_discover_extensions();
 async function discoverMemoryPlugins(config) {
 	const plugins = [];
 	for (const extension of discoverMemoryProviderExtensions(config)) for (const providerId of extension.manifest.contracts?.memoryProviders ?? []) plugins.push({

package/dist/src/agent/models/manager.d.ts

@@ -19,7 +19,7 @@ export declare class ModelManager {
     private currentProvider;
     private sessionModels;
     private fixedSessionModels;
-    /** Baseline model from `agents.list` / defaults merge when the session agent is created. */
+    /** Baseline model from the Agent catalog/defaults merge when the session Agent is created. */
     private sessionProfileDefaults;
     private sessionProfileFallbacks;
     constructor(config?: ModelManagerConfig);

package/dist/src/agent/models/manager.js

@@ -16,7 +16,7 @@ var ModelManager = class {
 	currentProvider;
 	sessionModels = /* @__PURE__ */ new Map();
 	fixedSessionModels = /* @__PURE__ */ new Set();
-	/** Baseline model from `agents.list` / defaults merge when the session agent is created. */
+	/** Baseline model from the Agent catalog/defaults merge when the session Agent is created. */
 	sessionProfileDefaults = /* @__PURE__ */ new Map();
 	sessionProfileFallbacks = /* @__PURE__ */ new Map();
 	constructor(config = {}) {
@@ -30,7 +30,7 @@ var ModelManager = class {
 	*/
 	updateFromConfig(config) {
 		this.config = config;
-		const ref = getAgentDefaultModelRef(config);
+		const ref = getAgentDefaultModelRef();
 		this.defaultModel = ref ? ref : getDefaultModelSync(config);
 		this.sessionProfileDefaults.clear();
 		this.sessionProfileFallbacks.clear();

package/dist/src/agent/orchestration/run-agent-turn-with-timeout.js

@@ -20,7 +20,7 @@ function isAgentTurnUnsettledError(err) {
 }
 function resolveAgentTurnTimeoutMs(config, conversationId) {
 	if (!config) return DEFAULT_AGENT_TURN_TIMEOUT_MS;
-	const configured = resolveEffectiveAgentConfigForSession(config, conversationId).config.runtime.timeoutMs;
+	const configured = resolveEffectiveAgentConfigForSession(conversationId).config.runtime.timeoutMs;
 	if (!configured) return DEFAULT_AGENT_TURN_TIMEOUT_MS;
 	return Math.min(MAX_AGENT_TURN_TIMEOUT_MS, Math.max(MIN_AGENT_TURN_TIMEOUT_MS, configured));
 }

package/dist/src/agent/prompt/response-language.js

@@ -1,9 +1,10 @@
 import { isXopcDatabaseOpen } from "../../storage/sqlite/connection.js";
 import { getSessionConfig } from "../../storage/sqlite/config-repository.js";
-import "../../storage/sqlite/index.js";
+import { init_sqlite } from "../../storage/sqlite/index.js";
 import { init_response_language, resolveResponseLanguage } from "../../i18n/response-language.js";
 //#region src/agent/prompt/response-language.ts
 init_response_language();
+init_sqlite();
 function resolveResponseLanguageForSession(config, conversationId) {
 	return resolveResponseLanguage(config?.userContext?.preferences?.responseLanguage ?? "auto", conversationId && isXopcDatabaseOpen() ? getSessionConfig(conversationId)?.responseLanguage : void 0);
 }

package/dist/src/agent/prompt/service-prompt-builder.js

@@ -1,11 +1,11 @@
 import { createLogger } from "../../utils/logger/index.js";
 import { init_logger } from "../../utils/logger.js";
 import { isXopcDatabaseOpen } from "../../storage/sqlite/connection.js";
-import { buildInteractionStatePrompt } from "../../user-context/interaction-state.js";
+import { buildInteractionStatePrompt, init_interaction_state } from "../../user-context/interaction-state.js";
 import { getInteractionState } from "../../storage/sqlite/interaction-state-repository.js";
-import { DEFAULT_USER_TRUST_LEVEL } from "../../user-context/trust-policy.js";
+import { DEFAULT_USER_TRUST_LEVEL, init_trust_policy } from "../../user-context/trust-policy.js";
 import { getUserTrustPolicy } from "../../storage/sqlite/user-trust-repository.js";
-import "../../storage/sqlite/index.js";
+import { init_sqlite } from "../../storage/sqlite/index.js";
 import { appendStablePromptSection } from "./cache-boundary.js";
 import { getUserTimezone } from "../../user-model/repository.js";
 import "../../user-model/index.js";
@@ -15,6 +15,9 @@ import { resolveResponseLanguageForSession } from "./response-language.js";
 import { buildTtsSystemPromptHint } from "../../voice/tts/directives.js";
 import { mergeTtsConfigFromAppConfig } from "../../voice/tts/merge-config.js";
 //#region src/agent/prompt/service-prompt-builder.ts
+init_sqlite();
+init_interaction_state();
+init_trust_policy();
 init_logger();
 const log = createLogger("SystemPromptBuilder");
 var SystemPromptBuilder = class {

package/dist/src/agent/prompt/system-prompt.js

@@ -1,4 +1,4 @@
-import { buildActionTrustPrompt } from "../../user-context/trust-policy.js";
+import { buildActionTrustPrompt, init_trust_policy } from "../../user-context/trust-policy.js";
 import { PROMPT_CACHE_BOUNDARY, splitPromptCacheBoundary } from "./cache-boundary.js";
 import { buildAestheticSection, buildExecutionBiasSection, buildHumanCollaborationSection, buildProblemSolvingSection, buildSafetySection, buildToolCallStyleSection, buildWorkContinuitySection } from "./sections/behavior.js";
 import { buildExternalMemorySection, buildMemorySection, buildSkillsSection } from "./sections/memory-skills.js";
@@ -9,6 +9,7 @@ import { buildRuntimeSection, buildWorkspaceFilesIntroSection, buildWorkspaceSec
 import { buildResponseLanguageSection } from "./sections/response-language.js";
 import { buildOverridablePromptSection } from "./system-prompt-params.js";
 //#region src/agent/prompt/system-prompt.ts
+init_trust_policy();
 function joinSections(sections) {
 	return sections.filter((section) => Boolean(section?.trim())).join("\n\n");
 }

package/dist/src/agent/reply/post-compaction-context.js

@@ -73,12 +73,12 @@ function readPostCompactionContext(params) {
 	if (!cfg) return null;
 	let agentId = params.agentId;
 	if (!agentId && params.conversationId) try {
-		agentId = resolveEffectiveAgentProfileForSession(cfg, params.conversationId).agentId;
+		agentId = resolveEffectiveAgentProfileForSession(params.conversationId).agentId;
 	} catch {
 		return null;
 	}
 	if (!agentId) return null;
-	const resolved = resolve(join(resolveAgentProfileDir(cfg, agentId), "AGENTS.md"));
+	const resolved = resolve(join(resolveAgentProfileDir(agentId), "AGENTS.md"));
 	try {
 		return readPostCompactionContextFromAgentsMd(readFileSync(resolved, "utf-8"), {
 			cfg,

package/dist/src/agent/service/build-direct-message-content.js

@@ -6,7 +6,7 @@ init_schema();
 init_providers();
 async function buildDirectUserMessageContent(opts) {
 	const sk = opts.conversationId ?? "";
-	const modelRef = sk !== "" ? opts.modelManager.getModelForSession(sk) : getAgentDefaultModelRef(opts.config) ?? getDefaultModelSync(opts.config);
+	const modelRef = sk !== "" ? opts.modelManager.getModelForSession(sk) : getAgentDefaultModelRef() ?? getDefaultModelSync(opts.config);
 	return buildTranscriptUserMessage({
 		text: opts.content,
 		prepared: opts.attachments,

package/dist/src/agent/service/direct-turn-helpers.js

@@ -1,4 +1,4 @@
-import { getClarificationResumeInput } from "../../storage/sqlite/clarification-wait-repository.js";
+import { getClarificationResumeInput, init_clarification_wait_repository } from "../../storage/sqlite/clarification-wait-repository.js";
 import { getConnectionResumeInput, init_connection_wait_repository } from "../../storage/sqlite/connection-wait-repository.js";
 import { resolveImageHandlingStrategy } from "../image/vision-detection.js";
 import { hydrateUserTurnForLlm } from "../inbound/attachment-pipeline.js";
@@ -21,6 +21,7 @@ import crypto from "node:crypto";
 * TTS, transcript persistence).
 */
 init_connection_wait_repository();
+init_clarification_wait_repository();
 /** Workspace + model + thinking level — common prep before any direct turn. */
 async function hydratePerTurnState(deps, conversationId, thinking) {
 	await deps.hydrateSessionWorkspaceFromStore(conversationId);

package/dist/src/agent/service/parse-outbound-session-key.js

@@ -1,7 +1,8 @@
 import { getSessionMetadata } from "../../storage/sqlite/session-read-repository.js";
-import "../../storage/sqlite/index.js";
+import { init_sqlite } from "../../storage/sqlite/index.js";
 import { INTERNAL_OUTBOUND_DROP_CHANNEL } from "../../channels/internal-outbound.js";
 //#region src/agent/service/parse-outbound-session-key.ts
+init_sqlite();
 /**
 * Map a session key to outbound channel routing (heartbeat/cron/virtual keys included).
 */