@xopcai/xopc 0.0.369 → 0.0.370

package/dist/src/extensions/agent-plugins/auth.js

@@ -1,9 +1,8 @@
 import { init_paths_state, resolveStateDir } from "../../config/paths-state.js";
 import { init_write_file_atomic, writeTextAtomic } from "../../infra/write-file-atomic.js";
 import { CredentialResolver, init_credentials } from "../../auth/credentials.js";
-import { pluginName } from "./validation.js";
-import { clearPluginMcpHealth } from "./health.js";
 import { isDangerousHostEnvVarName } from "../../infra/host-env-security.js";
+import { pluginName } from "./validation.js";
 import { join } from "node:path";
 import { existsSync, readFileSync } from "node:fs";
 import { createHash } from "node:crypto";
@@ -15,12 +14,7 @@ init_write_file_atomic();
 init_paths_state();
 const bindingSchema = z.strictObject({
 	serverName: z.string(),
-	mode: z.enum([
-		"auto",
-		"oauth",
-		"api-key",
-		"none"
-	]),
+	mode: z.enum(["auto", "api-key"]),
 	identityScope: z.literal("owner"),
 	endpointFingerprint: z.string(),
 	fields: z.array(z.strictObject({
@@ -49,7 +43,6 @@ async function savePluginAuthBinding(store, id, name, input) {
 	const plugin = store.get(id);
 	const server = plugin?.servers[name];
 	if (!server || plugin?.readiness === "blocked") throw new Error("Plugin MCP server unavailable");
-	if (input.mode === "oauth" && server.type !== "streamable-http") throw new Error("OAuth requires streamable HTTP");
 	const endpointFingerprint = pluginEndpointFingerprint(server);
 	const fields = [];
 	const resolver = new CredentialResolver(store.stateDir === resolveStateDir() ? {} : { stateDir: store.stateDir });
@@ -95,20 +88,10 @@ async function savePluginAuthBinding(store, id, name, input) {
 		fields
 	});
 	await writeTextAtomic(bindingPath(store, id, name), JSON.stringify(binding));
-	clearPluginMcpHealth(id, name, store.stateDir);
 }
 function applyPluginAuthBinding(raw, binding) {
 	if (!binding) return raw;
 	const result = { ...raw };
-	if (binding.mode === "none" || binding.mode === "api-key") {
-		delete result.auth;
-		delete result.xopcAutoAuth;
-	}
-	if (binding.mode === "oauth") {
-		result.auth = { type: "oauth" };
-		delete result.xopcAutoAuth;
-		result.headers = Object.fromEntries(Object.entries(result.headers ?? {}).filter(([key]) => key.toLowerCase() !== "authorization"));
-	}
 	for (const field of binding.fields) {
 		const values = { ...result[field.target] };
 		const insensitive = field.target === "headers" || process.platform === "win32";

package/dist/src/extensions/agent-plugins/credentials.js

@@ -1,31 +1,15 @@
 import { init_paths_state, resolveStateDir } from "../../config/paths-state.js";
 import { CredentialResolver, init_credentials } from "../../auth/credentials.js";
-import { pluginName, pluginServerId } from "./validation.js";
-import { parsePluginAuthBinding, pluginCredentialProviderPrefix } from "./auth.js";
-import { McpOAuthStore } from "../../agent/mcp/oauth/mcp-oauth-store.js";
-import { getMcpOAuthManager } from "../../agent/mcp/oauth/mcp-oauth-manager.js";
+import { pluginName } from "./validation.js";
+import { pluginCredentialProviderPrefix } from "./auth.js";
 import { join } from "node:path";
-import { existsSync, readFileSync, readdirSync, rmSync } from "node:fs";
+import { existsSync, rmSync } from "node:fs";
 //#region src/extensions/agent-plugins/credentials.ts
 init_credentials();
 init_paths_state();
 async function removePluginCredentials(store, id) {
 	pluginName.parse(id);
-	const plugin = store.get(id);
-	const serverNames = new Set(Object.keys(plugin?.servers ?? {}));
 	const dir = join(store.stateDir, "plugin-auth", id);
-	if (existsSync(dir)) for (const file of readdirSync(dir)) {
-		if (!/^[a-f0-9]{64}\.json$/.test(file)) throw new Error("Unexpected plugin auth store entry");
-		const binding = parsePluginAuthBinding(JSON.parse(readFileSync(join(dir, file), "utf8")));
-		serverNames.add(binding.serverName);
-	}
-	for (const name of serverNames) {
-		await getMcpOAuthManager({ xopcPlugin: {
-			id,
-			serverName: name
-		} }).cancelPending();
-		await new McpOAuthStore(`owner:${pluginServerId(id, name)}`).deleteScope();
-	}
 	const resolver = new CredentialResolver(store.stateDir === resolveStateDir() ? {} : { stateDir: store.stateDir });
 	for (const profile of await resolver.listProfiles()) if (profile.provider.startsWith(pluginCredentialProviderPrefix(id))) await resolver.deleteProviderCredential(profile.provider);
 	if (existsSync(dir)) rmSync(dir, {

package/dist/src/extensions/agent-plugins/inventory.d.ts

@@ -7,7 +7,7 @@ export declare function agentPluginInventoryRow(plugin: InstalledAgentPlugin): {
         mcp: {
             name: string;
             id: string;
-            type: "sse" | "streamable-http" | "stdio";
+            type: "stdio" | "streamable-http";
         }[];
     };
     diagnostics: import("./validation.js").PluginDiagnostic[];
@@ -45,7 +45,7 @@ export declare function listAgentPluginInventory(): {
         mcp: {
             name: string;
             id: string;
-            type: "sse" | "streamable-http" | "stdio";
+            type: "stdio" | "streamable-http";
         }[];
     };
     diagnostics: import("./validation.js").PluginDiagnostic[];

package/dist/src/extensions/agent-plugins/mcp-adapter.js

@@ -17,11 +17,7 @@ function materializePluginServers(plugin, store = new AgentPluginStore(), diagno
 		};
 		const raw = server.type !== "stdio" ? {
 			...server,
-			xopcPlugin: origin,
-			...server.type === "streamable-http" && !Object.keys(server.headers ?? {}).some((key) => key.toLowerCase() === "authorization") ? {
-				auth: { type: "oauth" },
-				xopcAutoAuth: true
-			} : {}
+			xopcPlugin: origin
 		} : {
 			type: "stdio",
 			xopcPlugin: origin,

package/dist/src/extensions/agent-plugins/source-http-fetch.d.ts

@@ -0,0 +1,2 @@
+import type { FetchLike } from '@modelcontextprotocol/sdk/shared/transport.js';
+export declare function createPluginSourceFetch(endpoint: URL, configuredHeaders: Record<string, string>): FetchLike;

package/dist/src/{agent/mcp/plugin-http-fetch.js → extensions/agent-plugins/source-http-fetch.js}

@@ -1,7 +1,7 @@
 import { BlockList, isIP } from "node:net";
 import { Agent, fetch } from "undici";
 import { lookup } from "node:dns";
-//#region src/agent/mcp/plugin-http-fetch.ts
+//#region src/extensions/agent-plugins/source-http-fetch.ts
 const blocked = new BlockList();
 for (const [network, prefix] of [
 	["0.0.0.0", 8],
@@ -29,19 +29,19 @@ const publicDispatcher = new Agent({ connect: { lookup(host, options, callback)
 		all: true
 	}, (error, addresses) => {
 		if (error) return callback(error, []);
-		if (!addresses.length || addresses.some((entry) => isBlocked(entry.address))) return callback(/* @__PURE__ */ new Error("Plugin MCP cannot access private network addresses"), []);
+		if (!addresses.length || addresses.some((entry) => isBlocked(entry.address))) return callback(/* @__PURE__ */ new Error("Plugin download cannot access private network addresses"), []);
 		if (options.all) callback(null, addresses);
 		else callback(null, addresses[0].address, addresses[0].family);
 	});
 } } });
-function createPluginHttpFetch(endpoint, configuredHeaders) {
+function createPluginSourceFetch(endpoint, configuredHeaders) {
 	return async (input, init) => {
 		const url = new URL(input);
-		if (!["https:", "http:"].includes(url.protocol) || url.username || url.password || url.hash) throw new Error("Invalid plugin MCP request URL");
+		if (!["https:", "http:"].includes(url.protocol) || url.username || url.password || url.hash) throw new Error("Invalid plugin download request URL");
 		const local = loopback(endpoint.hostname) && url.origin === endpoint.origin;
-		if (!local && url.protocol !== "https:") throw new Error("Plugin MCP requires HTTPS");
+		if (!local && url.protocol !== "https:") throw new Error("Plugin download requires HTTPS");
 		const address = url.hostname.replace(/^\[|\]$/g, "");
-		if (!local && isIP(address) && isBlocked(address)) throw new Error("Plugin MCP cannot access private network addresses");
+		if (!local && isIP(address) && isBlocked(address)) throw new Error("Plugin download cannot access private network addresses");
 		const headers = new Headers(url.origin === endpoint.origin ? configuredHeaders : void 0);
 		new Headers(init?.headers).forEach((value, key) => headers.set(key, value));
 		return await fetch(url, {
@@ -53,4 +53,4 @@ function createPluginHttpFetch(endpoint, configuredHeaders) {
 	};
 }
 //#endregion
-export { createPluginHttpFetch };
+export { createPluginSourceFetch };

package/dist/src/extensions/agent-plugins/sources.js

@@ -1,4 +1,4 @@
-import { createPluginHttpFetch } from "../../agent/mcp/plugin-http-fetch.js";
+import { createPluginSourceFetch } from "./source-http-fetch.js";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { mkdtempSync, rmSync, writeFileSync } from "node:fs";
@@ -63,7 +63,7 @@ async function withAgentPluginSource(source, config, fn) {
 		};
 	} else {
 		const url = new URL(source);
-		const response = await createPluginHttpFetch(url, {})(url, { signal: AbortSignal.timeout(3e4) });
+		const response = await createPluginSourceFetch(url, {})(url, { signal: AbortSignal.timeout(3e4) });
 		if (!response.ok || !response.body) throw new Error(`Plugin download failed (${response.status})`);
 		const reader = response.body.getReader();
 		const chunks = [];

package/dist/src/extensions/agent-plugins/store.js

@@ -4,7 +4,6 @@ import { init_logger } from "../../utils/logger.js";
 import { init_write_file_atomic, writeTextAtomicSync } from "../../infra/write-file-atomic.js";
 import { computeExtensionDirectoryIntegrity } from "../lockfile.js";
 import { containedPath, inspectAgentPlugin, pluginName } from "./validation.js";
-import { readPluginMcpHealth } from "./health.js";
 import { tmpdir } from "node:os";
 import { dirname, join, resolve } from "node:path";
 import { cpSync, existsSync, lstatSync, mkdirSync, mkdtempSync, readFileSync, readdirSync, rmSync, statSync, writeFileSync } from "node:fs";
@@ -104,8 +103,7 @@ var AgentPluginStore = class {
 				component: "package",
 				message: "Installed files differ from the reviewed package"
 			});
-			const health = Object.keys(inspection.servers).map((name) => readPluginMcpHealth(id, name, receipt.revision, this.stateDir));
-			const readiness = !valid ? "blocked" : inspection.diagnostics.length || health.includes("error") ? "degraded" : health.some((status) => status !== "ready") ? "setup_required" : "ready";
+			const readiness = !valid ? "blocked" : inspection.diagnostics.length ? "degraded" : "ready";
 			return {
 				...inspection,
 				id,

package/dist/src/extensions/agent-plugins/validation.d.ts

@@ -28,10 +28,6 @@ declare const serverSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
     type: z.ZodLiteral<"streamable-http">;
     url: z.ZodString;
     headers: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
-}, z.core.$strict>, z.ZodObject<{
-    type: z.ZodLiteral<"sse">;
-    url: z.ZodString;
-    headers: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
 }, z.core.$strict>], "type">;
 export type PluginManifest = z.infer<typeof manifestSchema>;
 export type PluginServer = z.infer<typeof serverSchema>;

package/dist/src/extensions/agent-plugins/validation.js

@@ -1,5 +1,6 @@
 import { dirname, isAbsolute, join, relative, resolve } from "node:path";
 import { existsSync, lstatSync, readFileSync, readdirSync, realpathSync, statSync } from "node:fs";
+import { createHash } from "node:crypto";
 import { z } from "zod";
 import { validateHeaderName, validateHeaderValue } from "node:http";
 import yaml from "js-yaml";
@@ -24,25 +25,17 @@ const manifestSchema = z.object({
 	extensions: z.record(z.string(), z.unknown()).optional()
 });
 const strings = z.record(z.string(), z.string());
-const serverSchema = z.discriminatedUnion("type", [
-	z.strictObject({
-		type: z.literal("stdio"),
-		command: z.string().min(1),
-		args: z.array(z.string()).optional(),
-		env: strings.optional(),
-		cwd: z.string().optional()
-	}),
-	z.strictObject({
-		type: z.literal("streamable-http"),
-		url: z.string().min(1),
-		headers: strings.optional()
-	}),
-	z.strictObject({
-		type: z.literal("sse"),
-		url: z.string().min(1),
-		headers: strings.optional()
-	})
-]);
+const serverSchema = z.discriminatedUnion("type", [z.strictObject({
+	type: z.literal("stdio"),
+	command: z.string().min(1),
+	args: z.array(z.string()).optional(),
+	env: strings.optional(),
+	cwd: z.string().optional()
+}), z.strictObject({
+	type: z.literal("streamable-http"),
+	url: z.string().min(1),
+	headers: strings.optional()
+})]);
 function containedPath(root, path) {
 	const base = resolve(root);
 	const target = resolve(path);
@@ -205,7 +198,7 @@ function inspectAgentPlugin(rootDir, dataDir = join(rootDir, ".inspection-data")
 	return result;
 }
 function pluginServerId(pluginId, serverName) {
-	return `plugin/${encodeURIComponent(pluginId)}/${encodeURIComponent(serverName)}`;
+	return `plugin_${pluginId.replace(/[^a-zA-Z0-9_]/g, "_")}_${createHash("sha256").update(JSON.stringify([pluginId, serverName])).digest("hex").slice(0, 16)}`;
 }
 //#endregion
 export { MCP_SCHEMA, PLUGIN_SCHEMA, containedPath, expandPluginVariables, inspectAgentPlugin, pluginName, pluginServerId, resolvePluginCwd, validatePluginServer };

package/dist/src/gateway/agents-admin.d.ts

@@ -101,3 +101,8 @@ export declare function writeAgentAvatarFromBase64(agentId: string, base64: stri
 export declare function deleteAgentAvatarFile(agentId: string): Promise<AgentAdminResult<{
     agentId: string;
 }>>;
+/** Rasterize configured generated avatars locally for native mobile clients. */
+export declare function resolveAgentAvatarImage(agentId: string): Promise<AgentAdminResult<{
+    buffer: Buffer;
+    contentType: string;
+}>>;

package/dist/src/gateway/agents-admin.js

@@ -434,5 +434,60 @@ async function deleteAgentAvatarFile(agentId) {
 		data: { agentId: id }
 	};
 }
+const renderedAvatarCache = /* @__PURE__ */ new Map();
+/** Rasterize configured generated avatars locally for native mobile clients. */
+async function resolveAgentAvatarImage(agentId) {
+	const missing = assertAgentExistsForAvatar(agentId);
+	if (missing) return missing;
+	const id = normalizeAgentId(agentId);
+	const reference = listAgentEntries().find((entry) => normalizeAgentId(entry.id) === id)?.profile?.avatar?.trim() ?? "";
+	if (reference === "xopc:custom") return readAgentAvatarFile(id);
+	if (reference.startsWith("xopc:loopi:") || /^https?:\/\//i.test(reference)) return {
+		ok: false,
+		status: 404,
+		error: "Avatar is rendered by the client"
+	};
+	const match = /^xopc:dicebear:(adventurer|bottts|lorelei|thumbs|fun-emoji|pixel-art):(.+)$/.exec(reference);
+	const style = match?.[1] ?? "adventurer";
+	const seed = match?.[2] ?? id;
+	const key = JSON.stringify([style, seed]);
+	const cached = renderedAvatarCache.get(key);
+	if (cached) return {
+		ok: true,
+		data: {
+			buffer: cached,
+			contentType: "image/png"
+		}
+	};
+	const [{ createAvatar }, collection, { default: sharp }] = await Promise.all([
+		import("@dicebear/core"),
+		import("@dicebear/collection"),
+		import("sharp")
+	]);
+	const options = {
+		seed,
+		size: 128
+	};
+	const svg = (() => {
+		switch (style) {
+			case "bottts": return createAvatar(collection.bottts, options).toString();
+			case "lorelei": return createAvatar(collection.lorelei, options).toString();
+			case "thumbs": return createAvatar(collection.thumbs, options).toString();
+			case "fun-emoji": return createAvatar(collection.funEmoji, options).toString();
+			case "pixel-art": return createAvatar(collection.pixelArt, options).toString();
+			default: return createAvatar(collection.adventurer, options).toString();
+		}
+	})();
+	const buffer = await sharp(Buffer.from(svg)).png().toBuffer();
+	if (renderedAvatarCache.size >= 64) renderedAvatarCache.delete(renderedAvatarCache.keys().next().value);
+	renderedAvatarCache.set(key, buffer);
+	return {
+		ok: true,
+		data: {
+			buffer,
+			contentType: "image/png"
+		}
+	};
+}
 //#endregion
-export { createGatewayAgent, deleteAgentAvatarFile, deleteGatewayAgent, getGatewayAgentEffectiveConfig, listAgentProfileFiles, listGatewayAgents, readAgentAvatarFile, readAgentProfileFile, updateGatewayAgent, writeAgentAvatarFromBase64, writeAgentProfileFile };
+export { createGatewayAgent, deleteAgentAvatarFile, deleteGatewayAgent, getGatewayAgentEffectiveConfig, listAgentProfileFiles, listGatewayAgents, readAgentAvatarFile, readAgentProfileFile, resolveAgentAvatarImage, updateGatewayAgent, writeAgentAvatarFromBase64, writeAgentProfileFile };

package/dist/src/gateway/chat-stream/mapper.js

@@ -274,6 +274,7 @@ var ChatStreamMapper = class {
 		const toolName = String(event.toolName ?? "unknown");
 		this.toolCallToMessageId.set(toolCallId, messageId);
 		const events = [this.make("tool_start", {
+			...toolExecutionMetadata(event),
 			messageId,
 			toolCallId,
 			toolName,
@@ -300,6 +301,7 @@ var ChatStreamMapper = class {
 		const textDelta = extractText(partial);
 		const toolName = String(event.toolName ?? "unknown");
 		const events = [this.make("tool_update", {
+			...toolExecutionMetadata(event),
 			messageId,
 			toolCallId,
 			toolName,
@@ -329,6 +331,7 @@ var ChatStreamMapper = class {
 		const result = boundRealtimeToolResult(fullResult);
 		const toolName = String(event.toolName ?? "unknown");
 		const events = [this.make("tool_end", {
+			...toolExecutionMetadata(event),
 			messageId,
 			toolCallId,
 			toolName,
@@ -541,6 +544,12 @@ function extractDetails(value) {
 function asRecord(value) {
 	return value && typeof value === "object" && !Array.isArray(value) ? value : null;
 }
+function toolExecutionMetadata(event) {
+	return {
+		...typeof event.parentToolCallId === "string" ? { parentToolCallId: event.parentToolCallId } : {},
+		...typeof event.durationMs === "number" ? { durationMs: event.durationMs } : {}
+	};
+}
 function normalizeToolResult(value) {
 	if (value == null) return void 0;
 	if (typeof value === "string") return { text: value };

package/dist/src/gateway/chat-stream/protocol.d.ts

@@ -1,4 +1,4 @@
-import type { ToolActivity, TurnOutcome } from '@xopcai/gateway-contract';
+import type { AgentStreamToolExecutionMetadata, ToolActivity, TurnOutcome } from '@xopcai/gateway-contract';
 import type { TaskUpdateTrigger } from '../../storage/sqlite/session-input-repository.js';
 export type ChatStreamStatus = 'success' | 'error' | 'cancelled' | 'suspended';
 export type PetFeedbackTaskState = 'working' | 'waiting' | 'success' | 'error';
@@ -63,14 +63,14 @@ export type ToolStartEvent = ChatStreamEnvelope<'tool_start', {
     toolName: string;
     args?: unknown;
     activity: ToolActivity;
-}>;
+} & AgentStreamToolExecutionMetadata>;
 export type ToolUpdateEvent = ChatStreamEnvelope<'tool_update', {
     messageId: string;
     toolCallId: string;
     toolName: string;
     details?: unknown;
     textDelta?: string;
-}>;
+} & AgentStreamToolExecutionMetadata>;
 export type ToolEndEvent = ChatStreamEnvelope<'tool_end', {
     messageId: string;
     toolCallId: string;
@@ -84,7 +84,7 @@ export type ToolEndEvent = ChatStreamEnvelope<'tool_end', {
     };
     deliveries?: import('@xopcai/gateway-contract').ProductDeliveryEnvelope[];
     errorMessage?: string;
-}>;
+} & AgentStreamToolExecutionMetadata>;
 export type CommandStartedEvent = ChatStreamEnvelope<'command_started', {
     messageId: string;
     toolCallId: string;

package/dist/src/gateway/hono/lib/config-payload.d.ts

@@ -2,8 +2,7 @@ import type { Config } from '../../../config/schema.js';
 import type { GatewayService } from '../../service.js';
 /** MCP block for GET/PATCH `/api/config` (authenticated console editing). */
 export declare function buildSafeMcpConfigForWeb(config: Config): {
-    servers: import("../../../config/mcp-config-normalize.js").ConfigMcpServers;
-    sessionIdleTtlMs?: number;
+    servers: Record<string, Record<string, unknown>>;
 };
 export declare function buildSafeBrowserConfigForWeb(browser: unknown): {
     security?: unknown;
@@ -109,6 +108,13 @@ export declare function buildSafeWebConfigPayload(service: GatewayService, optio
                 allowed?: string[];
             };
             runtime: {
+                codemode?: {
+                    enabled: boolean;
+                    timeoutMs: number;
+                    maxConcurrentCalls: number;
+                    maxCalls: number;
+                    maxOutputTokens: number;
+                };
                 thinkingLevel?: "low" | "high" | "off" | "medium" | "minimal" | "xhigh" | "max";
                 commandIsolation?: {
                     mode: "host";
@@ -345,7 +351,6 @@ export declare function buildSafeWebConfigPayload(service: GatewayService, optio
         id?: string;
     }[];
     mcp: {
-        servers: import("../../../config/mcp-config-normalize.js").ConfigMcpServers;
-        sessionIdleTtlMs?: number;
+        servers: Record<string, Record<string, unknown>>;
     };
 }>;

package/dist/src/gateway/hono/lib/config-payload.js

@@ -7,9 +7,9 @@ import { ContextPlanningConfigSchema, KnowledgeMemoryConfigSchema, UserModelConf
 import { init_models_json, loadModelsJson } from "../../../config/models-json.js";
 import { getProviderRegistry, init_plugin_registry } from "../../../providers/plugin-registry.js";
 import { getAllProviders, init_providers, isProviderConfigured } from "../../../providers/index.js";
-import { normalizeConfiguredMcpServers } from "../../../config/mcp-config-normalize.js";
 import { resolveShareConfig } from "../../../share/share-config.js";
 import { maskTunnelSecretForWeb } from "../../../tunnel/env.js";
+import { normalizeConfiguredMcpServers } from "../../../config/mcp-config-normalize.js";
 import { buildChannelCatalogForConfig, buildChannelCatalogFromSnapshot, getChannelSetupStatus } from "../../../channels/catalog/channel-catalog-service.js";
 import { resolveSessionConfigForWeb, resolveUpdateConfigForWeb } from "../../../config/web-patch.js";
 import { GENERIC_MASKED_SECRET, maskSecretLength } from "./mask-secret-length.js";
@@ -43,10 +43,7 @@ async function maskLlmProviderApiKeyForWeb(provider) {
 function buildSafeMcpConfigForWeb(config) {
 	const mcp = config.mcp;
 	if (!mcp) return { servers: {} };
-	return {
-		...mcp.sessionIdleTtlMs !== void 0 ? { sessionIdleTtlMs: mcp.sessionIdleTtlMs } : {},
-		servers: normalizeConfiguredMcpServers(mcp.servers)
-	};
+	return { servers: normalizeConfiguredMcpServers(mcp.servers) };
 }
 function buildSafeBrowserConfigForWeb(browser) {
 	if (!browser || typeof browser !== "object") return { enabled: false };

package/dist/src/gateway/hono/oauth-async.js

@@ -295,13 +295,20 @@ async function runOAuthFlow(session, oauthProvider, service) {
 			session.deviceCode = prompt.deviceCode;
 			session.verificationUri = prompt.verificationUri;
 			session.message = prompt.message;
-			manualCodePromise = new Promise((resolve, reject) => {
+			manualCodePromise ??= new Promise((resolve, reject) => {
 				manualCodeResolve = resolve;
 				manualCodeReject = reject;
 			});
 			session.manualCodeResolve = manualCodeResolve;
 			session.manualCodeReject = manualCodeReject;
-			return "";
+			const cancel = () => manualCodeReject?.(/* @__PURE__ */ new Error("OAuth prompt cancelled"));
+			prompt.signal?.addEventListener("abort", cancel, { once: true });
+			try {
+				if (prompt.signal?.aborted) cancel();
+				return await manualCodePromise;
+			} finally {
+				prompt.signal?.removeEventListener("abort", cancel);
+			}
 		},
 		onProgress: (message) => {
 			log.debug({

package/dist/src/gateway/hono/routes/agent-plugins.js

@@ -1,6 +1,6 @@
 import { AgentPluginStore } from "../../../extensions/agent-plugins/store.js";
 import { savePluginAuthBinding } from "../../../extensions/agent-plugins/auth.js";
-import { disposeAllSessionMcpRuntimes } from "../../../agent/mcp/bundle-mcp-runtime.js";
+import { evictAllEmbeddedSessionRunners } from "../../../agent/embedded/session-runner.js";
 import { withAgentPluginSource } from "../../../extensions/agent-plugins/sources.js";
 import { agentPluginInventoryRow } from "../../../extensions/agent-plugins/inventory.js";
 import { removePluginCredentials } from "../../../extensions/agent-plugins/credentials.js";
@@ -13,7 +13,7 @@ const sourceBody = z.strictObject({
 function registerAgentPluginRoutes(app, deps) {
 	const store = new AgentPluginStore();
 	const refresh = async () => {
-		await disposeAllSessionMcpRuntimes();
+		evictAllEmbeddedSessionRunners();
 		deps.service.marketplace.reloadSkills();
 	};
 	app.post("/api/extensions/inspect", deps.strictRateLimitMiddleware, async (c) => {
@@ -123,12 +123,7 @@ function registerAgentPluginRoutes(app, deps) {
 	app.put("/api/extensions/agent-plugins/:id/mcp/:server/auth", deps.strictRateLimitMiddleware, async (c) => {
 		try {
 			const body = z.strictObject({
-				mode: z.enum([
-					"auto",
-					"oauth",
-					"api-key",
-					"none"
-				]),
+				mode: z.enum(["auto", "api-key"]),
 				secrets: z.array(z.strictObject({
 					target: z.enum(["headers", "env"]),
 					key: z.string(),
@@ -152,7 +147,7 @@ function registerAgentPluginRoutes(app, deps) {
 				removeData: z.boolean().optional(),
 				removeCredentials: z.boolean().optional()
 			}).parse(await c.req.json());
-			await disposeAllSessionMcpRuntimes();
+			evictAllEmbeddedSessionRunners();
 			if (body.removeCredentials) await removePluginCredentials(store, c.req.param("id"));
 			store.remove(c.req.param("id"), body.removeData);
 			deps.service.marketplace.reloadSkills();

package/dist/src/gateway/hono/routes/agents.js

@@ -2,7 +2,7 @@ import { normalizeAgentId } from "../../../agent-catalog/id.js";
 import { AgentEntrySchema, AgentModelsOverrideSchema, AgentProfileSchema, RuntimePolicySchema, SkillOverrideSchema, ToolPoliciesSchema, WorkflowPolicySchema } from "../../../agent-config/schema.js";
 import { init_agent_config } from "../../../agent-config/index.js";
 import { init_agent_scope } from "../../../agent/agent-scope.js";
-import { createGatewayAgent, deleteAgentAvatarFile, deleteGatewayAgent, getGatewayAgentEffectiveConfig, listAgentProfileFiles, listGatewayAgents, readAgentAvatarFile, readAgentProfileFile, updateGatewayAgent, writeAgentAvatarFromBase64, writeAgentProfileFile } from "../../agents-admin.js";
+import { createGatewayAgent, deleteAgentAvatarFile, deleteGatewayAgent, getGatewayAgentEffectiveConfig, listAgentProfileFiles, listGatewayAgents, readAgentAvatarFile, readAgentProfileFile, resolveAgentAvatarImage, updateGatewayAgent, writeAgentAvatarFromBase64, writeAgentProfileFile } from "../../agents-admin.js";
 import { getVoiceModelsConfig } from "../../../config/voice.js";
 //#region src/gateway/hono/routes/agents.ts
 init_agent_config();
@@ -208,7 +208,8 @@ function registerAgentsRoutes(authenticated, deps) {
 		});
 	});
 	authenticated.get("/api/agents/:id/avatar", async (c) => {
-		const res = await readAgentAvatarFile(normalizeAgentId(c.req.param("id") ?? ""));
+		const id = normalizeAgentId(c.req.param("id") ?? "");
+		const res = c.req.query("resolve") === "1" ? await resolveAgentAvatarImage(id) : await readAgentAvatarFile(id);
 		if (res.ok === false) return c.json({
 			ok: false,
 			error: { message: res.error }
@@ -217,7 +218,7 @@ function registerAgentsRoutes(authenticated, deps) {
 			status: 200,
 			headers: {
 				"Content-Type": res.data.contentType,
-				"Cache-Control": "private, max-age=3600"
+				"Cache-Control": c.req.query("resolve") === "1" ? "private, no-store" : "private, max-age=3600"
 			}
 		});
 	});

package/dist/src/gateway/hono/routes/connection-waits.js

@@ -13,14 +13,11 @@ const actionSchema = z.object({
 		"cancel",
 		"select_account",
 		"confirm_scope",
-		"replace_source",
-		"submit_callback"
+		"replace_source"
 	]),
 	candidateRef: z.string().optional(),
 	needKey: z.string().optional(),
-	accountId: z.string().optional(),
-	callbackUrl: z.string().max(16384).optional(),
-	instanceId: z.string().optional()
+	accountId: z.string().optional()
 }).strict();
 function registerConnectionWaitRoutes(app, { service, strictRateLimitMiddleware }) {
 	app.get("/api/sessions/:conversationId/connection-wait", (c) => {