@xopcai/xopc 0.0.369 → 0.0.371

package/dist/packages/gateway-contract/src/session-input-command.js

@@ -12,12 +12,18 @@ function canonicalSessionCommand(value) {
 }
 function sessionCommandIdentity(command) {
 	if ("origin" in command) {
-		const { origin: _origin, ...identity } = command;
-		return canonicalSessionCommand(identity);
+		const origin = command.origin.type === "endpoint" ? {
+			type: "endpoint",
+			endpointId: command.origin.endpointId
+		} : command.origin;
+		return canonicalSessionCommand({
+			...command,
+			origin
+		});
 	}
 	return canonicalSessionCommand(command);
 }
-var sessionCreationSchema, attachmentSchema, sessionInputContentSchema, originSchema, sessionInputCommandSchema, sessionMaterializeCommandSchema;
+var sessionCreationSchema, attachmentSchema, endpointContextSchema, sessionInputContentSchema, originSchema, sessionInputCommandSchema, sessionMaterializeCommandSchema;
 var init_session_input_command = __esmMin((() => {
 	init_app_context();
 	init_browser_page_context();
@@ -46,8 +52,28 @@ var init_session_input_command = __esmMin((() => {
 		workspaceRelativePath: z.string().optional(),
 		durationSeconds: z.number().nonnegative().optional()
 	});
+	endpointContextSchema = z.strictObject({
+		version: z.literal(1),
+		capturedAt: z.number().int().nonnegative().max(Number.MAX_SAFE_INTEGER),
+		timezone: z.string().min(1).max(80).refine((value) => {
+			try {
+				new Intl.DateTimeFormat("en", { timeZone: value });
+				return true;
+			} catch {
+				return false;
+			}
+		}, "Invalid timezone"),
+		locale: z.string().min(1).max(80).refine((value) => {
+			try {
+				return Intl.getCanonicalLocales(value).length === 1;
+			} catch {
+				return false;
+			}
+		}, "Invalid locale")
+	});
 	sessionInputContentSchema = z.strictObject({
 		content: z.string(),
+		endpointContext: endpointContextSchema.optional(),
 		attachments: z.array(attachmentSchema).optional(),
 		contextRefs: z.array(z.strictObject({
 			kind: z.enum([
@@ -56,7 +82,6 @@ var init_session_input_command = __esmMin((() => {
 				"file",
 				"session",
 				"browser_tab",
-				"mcp_resource",
 				"user_assertion"
 			]),
 			sourceId: z.string().trim().min(1),
@@ -108,4 +133,4 @@ var init_session_input_command = __esmMin((() => {
 }));
 //#endregion
 init_session_input_command();
-export { canonicalSessionCommand, init_session_input_command, sessionCommandIdentity, sessionCreationSchema, sessionInputCommandSchema, sessionInputContentSchema, sessionMaterializeCommandSchema };
+export { canonicalSessionCommand, endpointContextSchema, init_session_input_command, sessionCommandIdentity, sessionCreationSchema, sessionInputCommandSchema, sessionInputContentSchema, sessionMaterializeCommandSchema };

package/dist/src/agent/agent-manager.js

@@ -8,6 +8,7 @@ import { getSessionMetadata } from "../storage/sqlite/session-read-repository.js
 import { init_sqlite } from "../storage/sqlite/index.js";
 import { expandWorkspacePathString, init_workspace_path } from "../config/workspace-path.js";
 import { init_agent_scope, listAgentEntries, resolveAgentProfileDir } from "./agent-scope.js";
+import { extractTextContent } from "./context/workspace.js";
 import { init_paths, resolveBundledSkillsDir } from "../config/paths.js";
 import { CredentialResolver, init_credentials } from "../auth/credentials.js";
 import { traceTools } from "../observability/runtime.js";
@@ -18,7 +19,6 @@ import { init_sync_provider_auth, resolveProviderApiKeySync } from "../auth/sync
 import { getApiKeySync, getDefaultModelSync, init_providers, resolveModel } from "../providers/index.js";
 import { createExtensionAwareStreamFn } from "../providers/extension-stream-bridge.js";
 import { continuesAfterTool, trackAiUsageStream } from "../usage/recorder.js";
-import { extractTextContent } from "./context/workspace.js";
 import { resolveUserContextSessionAccess } from "../user-context/access-policy.js";
 import { isPersonalConversation } from "../personal-agent/repository.js";
 import { PersonalPromptContext } from "../personal-agent/prompt-context.js";
@@ -27,22 +27,18 @@ import { clearBootstrapSnapshot } from "./bootstrap/bootstrap-cache.js";
 import { resolveBootstrapContextSync } from "./bootstrap/bootstrap-files.js";
 import { loadProjectAgentsContextFile } from "./bootstrap/project-agents-context.js";
 import { getEmbeddedExecutionRunId } from "./embedded/execution-context.js";
-import { parseExternalToolRef } from "./external-tools/refs.js";
 import { loadSkillsLock } from "./skills/hub-lock.js";
 import { isUnderManagedSkillsDir } from "./skills/managed-store.js";
-import { mcpToolPolicyId } from "./mcp/bundle-mcp-policy.js";
-import { disposeAllSessionMcpRuntimes, retireSessionMcpRuntimeForConversationId } from "./mcp/bundle-mcp-runtime.js";
 import { createSkillConfigManager, isSkillEnabled, resolveSkillConfig } from "./skills/config.js";
 import { isValidSkillEnvVarName } from "./skills/required-env-vars.js";
 import { resolveWorkspaceSkillsDir, resolveWorkspaceSkillsLockPath } from "./skills/workspace-skills-dir.js";
-import { replaceAgentSystemPrompt } from "./prompt/agent-system-prompt.js";
+import { abortEmbeddedRun } from "./embedded/runs.js";
 import { evictAllEmbeddedSessionRunners, evictEmbeddedSessionRunner } from "./embedded/session-runner.js";
 import { createAgentTurnPolicy } from "./orchestration/agent-turn-policy.js";
 import { createAgentCapabilitySessionState, resolveAgentCapabilityCatalog } from "./capabilities/registry.js";
 import "./capabilities/index.js";
 import { sortToolsForPromptCache } from "./tools/cache-stability.js";
 import { AgentToolsFactory } from "./tools/factory.js";
-import "./mcp/bundle-mcp-tools.js";
 import { isMemorySubsystemEnabled } from "./memory/memory-config.js";
 import { evaluateToolGate } from "./context/execution-context.js";
 import { ExecutionContextCoordinator } from "./context/coordinator.js";
@@ -51,6 +47,7 @@ import { BackgroundReviewCoordinator } from "./background-review/coordinator.js"
 import { maybeRequestChannelExecApproval } from "../channels/exec-approval-runtime.js";
 import { SkillFilesystemWatcher } from "./skills/filesystem-watcher.js";
 import { ProjectTrustStore, hasTrustRequiringProjectResources } from "../project-trust/trust-store.js";
+import { replaceAgentSystemPrompt } from "./prompt/agent-system-prompt.js";
 import { basename, resolve, sep } from "node:path";
 import { createHash } from "node:crypto";
 import { Agent } from "@earendil-works/pi-agent-core";
@@ -232,6 +229,22 @@ var AgentManager = class {
 	*/
 	updateRuntimeConfiguration(config) {
 		this.config.config = config;
+		for (const instance of this.agents.values()) {
+			const before = instance.effectiveProfile.config;
+			const after = resolveEffectiveAgentProfileForSession(instance.conversationId).config;
+			if (JSON.stringify([
+				before.runtime.codemode,
+				before.tools,
+				before.toolAllowlist
+			]) !== JSON.stringify([
+				after.runtime.codemode,
+				after.tools,
+				after.toolAllowlist
+			])) {
+				abortEmbeddedRun(instance.conversationId);
+				evictEmbeddedSessionRunner(instance.conversationId, "agent_tool_configuration_changed");
+			}
+		}
 		const ref = getAgentDefaultModelRef();
 		this.config.model = ref;
 		this.defaultModel = ref || getDefaultModelSync(config);
@@ -849,10 +862,6 @@ var AgentManager = class {
 		if (instance) {
 			this.backgroundReview.forgetSession(conversationId);
 			this.toolsFactory.closeBrowserPageForSession(conversationId);
-			retireSessionMcpRuntimeForConversationId({
-				conversationId,
-				reason: "agent-evict"
-			});
 			instance.agent.abort();
 			evictEmbeddedSessionRunner(conversationId, "agent_removed");
 			this.agents.delete(conversationId);
@@ -930,7 +939,6 @@ var AgentManager = class {
 		if (this.skillsUpdatedTimer) clearTimeout(this.skillsUpdatedTimer);
 		this.skillFilesystemWatcher.dispose();
 		this.toolsFactory.shutdownBrowser();
-		disposeAllSessionMcpRuntimes().catch(() => {});
 		evictAllEmbeddedSessionRunners("agent_manager_dispose");
 		this.backgroundReview.clear();
 		this.userUnderstandingMaintenance.clear();
@@ -1177,22 +1185,10 @@ var AgentManager = class {
 			} : void 0;
 		}
 		const toolRef = typeof args?.toolRef === "string" ? args.toolRef : "";
-		const parsed = parseExternalToolRef(toolRef, "mcp");
-		if (!parsed) {
-			const externalPolicy = profile.config.tools[toolRef];
-			return externalPolicy ? {
-				id: toolRef,
-				...externalPolicy
-			} : gatewayPolicy ? {
-				id: toolName,
-				...gatewayPolicy
-			} : void 0;
-		}
-		const id = mcpToolPolicyId(parsed.namespace, parsed.toolName);
-		const policy = profile.config.tools[id];
-		return policy ? {
-			id,
-			...policy
+		const externalPolicy = profile.config.tools[toolRef];
+		return externalPolicy ? {
+			id: toolRef,
+			...externalPolicy
 		} : gatewayPolicy ? {
 			id: toolName,
 			...gatewayPolicy

package/dist/src/agent/background-review/run-background-review.js

@@ -4,12 +4,12 @@ import { finishContextExtractionRun } from "../../storage/sqlite/context-extract
 import { getSessionMetadata } from "../../storage/sqlite/session-read-repository.js";
 import { loadCompactionSourceSnapshot } from "../../storage/sqlite/transcript-repository.js";
 import { init_sqlite } from "../../storage/sqlite/index.js";
+import { extractTextContent } from "../context/workspace.js";
 import { extractProfileAgentId } from "../../config/agent-profile.js";
 import { init_sync_provider_auth, resolveProviderApiKeySync } from "../../auth/sync-provider-auth.js";
 import { getApiKeySync, init_providers, resolveModel } from "../../providers/index.js";
 import { createExtensionAwareStreamFn } from "../../providers/extension-stream-bridge.js";
 import { trackAiUsageStream } from "../../usage/recorder.js";
-import { extractTextContent } from "../context/workspace.js";
 import { getAssertionSlot, listUserAssertions } from "../../user-model/repository.js";
 import { readAgentMessageContent } from "../memory/agent-message-access.js";
 import { isAssistantTurnAborted, isAssistantTurnFailed } from "../orchestration/llm-turn-retry.js";

package/dist/src/agent/embedded/codemode-extension.d.ts

@@ -0,0 +1,7 @@
+import type { AgentTool } from '@earendil-works/pi-agent-core';
+import { type AgentSession, type ExtensionFactory } from '@earendil-works/pi-coding-agent';
+import type { EffectiveAgentConfig } from '../../agent-config/schema.js';
+export type CodemodePolicy = NonNullable<EffectiveAgentConfig['runtime']['codemode']>;
+/** Public pi extension, restricted to core reads and the current xopc turn policy. */
+export declare function createXopcCodemodeExtension(policy: CodemodePolicy, tools: readonly AgentTool[], getSession: () => AgentSession | undefined): ExtensionFactory;
+export declare function boundCodemodeSource(source: string, policy: CodemodePolicy): string;

package/dist/src/agent/embedded/codemode-extension.js

@@ -0,0 +1,232 @@
+import { isCodemodeCoreRead } from "../tools/codemode-permissions.js";
+import { getXopcToolMetadata } from "./tool-metadata.js";
+import { withDataToolPermissions } from "../tools/dataBatch.js";
+import { retainCodemodeOutput } from "./codemode-output.js";
+import { AsyncLocalStorage } from "node:async_hooks";
+import { createCodemodeExtension } from "@earendil-works/pi-coding-agent";
+//#region src/agent/embedded/codemode-extension.ts
+const MAX_STORE_BYTES = 64 * 1024;
+const MAX_SOURCE_BYTES = 64 * 1024;
+/** Public pi extension, restricted to core reads and the current xopc turn policy. */
+function createXopcCodemodeExtension(policy, tools, getSession) {
+	const allowed = new Set(tools.filter((tool) => isCodemodeCoreRead(tool) || getXopcToolMetadata(tool)?.external?.readOnly === true).map((tool) => tool.name));
+	const isAllowed = (name) => allowed.has(name) || name.startsWith("mcp__") || [
+		"list_mcp_resources",
+		"list_mcp_resource_templates",
+		"read_mcp_resource"
+	].includes(name);
+	const inlineReads = tools.filter(isCodemodeCoreRead).map((tool) => tool.name);
+	const execution = new AsyncLocalStorage();
+	const original = createCodemodeExtension({
+		mode: "on",
+		models: false
+	});
+	const contextFor = (id, name, args) => {
+		const session = getSession();
+		const assistantMessage = session?.agent.state.messages.findLast((message) => message.role === "assistant");
+		if (!session || assistantMessage?.role !== "assistant") throw new Error("Codemode needs an active xopc turn");
+		return {
+			assistantMessage,
+			toolCall: {
+				type: "toolCall",
+				id,
+				name,
+				arguments: args
+			},
+			args,
+			context: {
+				messages: session.agent.state.messages,
+				tools: session.agent.state.tools
+			}
+		};
+	};
+	return (pi) => {
+		pi.on("tool_call", async (event) => {
+			if (!event.parentToolCallId) return;
+			const active = execution.getStore();
+			if (!active || active.parentId !== event.parentToolCallId || !isAllowed(event.toolName)) return {
+				block: true,
+				reason: "Codemode tool is not authorized"
+			};
+			active.signal.throwIfAborted();
+			return getSession()?.agent.beforeToolCall?.(contextFor(event.toolCallId, event.toolName, event.input), active.signal);
+		});
+		pi.on("tool_result", async (event) => {
+			if (!event.parentToolCallId) return;
+			const active = execution.getStore();
+			if (!active || active.parentId !== event.parentToolCallId) return {
+				content: [{
+					type: "text",
+					text: "Codemode execution is no longer active"
+				}],
+				isError: true
+			};
+			try {
+				return await getSession()?.agent.afterToolCall?.({
+					...contextFor(event.toolCallId, event.toolName, event.input),
+					result: {
+						content: event.content,
+						details: event.details,
+						structuredContent: event.structuredContent,
+						usage: event.usage
+					},
+					isError: event.isError
+				}, active.signal);
+			} catch {
+				return {
+					content: [{
+						type: "text",
+						text: "Codemode result policy failed"
+					}],
+					details: {},
+					isError: true
+				};
+			}
+		});
+		return original({
+			...pi,
+			appendEntry(customType, data) {
+				if (customType !== "codemode-store") throw new Error("Unsupported Codemode entry");
+				const active = execution.getStore();
+				if (!active || active.signal.aborted) throw new Error("Codemode execution is no longer active");
+				if (Buffer.byteLength(JSON.stringify(data)) > MAX_STORE_BYTES) throw new Error("Codemode store writes exceed 64 KiB");
+				const state = Object.create(null);
+				const apply = (value) => {
+					const writes = value;
+					for (const key of writes.delete ?? []) delete state[key];
+					Object.assign(state, writes.set ?? {});
+				};
+				for (const entry of active.ctx.sessionManager.getBranch()) if (entry.type === "custom" && entry.customType === customType) apply(entry.data);
+				apply(data);
+				if (Object.keys(state).length > 64 || Buffer.byteLength(JSON.stringify(state)) > MAX_STORE_BYTES) throw new Error("Codemode store exceeds 64 keys or 64 KiB");
+				pi.appendEntry(customType, data);
+			},
+			registerTool(definition) {
+				const prepare = definition.prepareLoadout;
+				pi.registerTool({
+					...definition,
+					prepareLoadout(loadout) {
+						const changes = prepare?.({
+							...loadout,
+							callable: loadout.callable.filter((tool) => isAllowed(tool.name))
+						});
+						return {
+							...changes,
+							descriptions: {
+								...changes?.descriptions,
+								codemode: `${changes?.descriptions?.codemode ?? definition.description}\n\nCore reads: ${inlineReads.join(", ") || "(none)"}. Host-approved deferred reads and native MCP tools can be found with searchTools(). Host limits: ${policy.timeoutMs}ms, ${policy.maxConcurrentCalls} concurrent calls, ${policy.maxCalls} calls, ${policy.maxOutputTokens} estimated output tokens. Store: 64 keys / 64 KiB. Models APIs are unavailable.`
+							}
+						};
+					},
+					async execute(id, params, signal, onUpdate, ctx) {
+						if (!ctx) throw new Error("Codemode needs an active session");
+						const input = params;
+						if (Buffer.byteLength(input.code) > MAX_SOURCE_BYTES) throw new Error("Codemode source exceeds 64 KiB");
+						const source = boundCodemodeSource(input.code, policy);
+						const deadline = AbortSignal.timeout(policy.timeoutMs);
+						const budgetAbort = new AbortController();
+						const combined = AbortSignal.any([
+							deadline,
+							budgetAbort.signal,
+							...signal ? [signal] : []
+						]);
+						let calls = 0;
+						let running = 0;
+						const waiting = /* @__PURE__ */ new Set();
+						const boundedContext = {
+							...ctx,
+							tools: ctx.tools.filter((tool) => isAllowed(tool.name)),
+							async executeTool(name, args, options) {
+								if (!isAllowed(name)) throw new Error(`Codemode tool ${name} is not authorized`);
+								if (++calls > policy.maxCalls) {
+									const error = /* @__PURE__ */ new Error(`Codemode exceeds ${policy.maxCalls} calls`);
+									budgetAbort.abort(error);
+									throw error;
+								}
+								const callSignal = options?.signal ? AbortSignal.any([combined, options.signal]) : combined;
+								while (running >= policy.maxConcurrentCalls) {
+									callSignal.throwIfAborted();
+									await new Promise((resolve) => {
+										const wake = () => {
+											waiting.delete(wake);
+											callSignal.removeEventListener("abort", wake);
+											resolve();
+										};
+										waiting.add(wake);
+										callSignal.addEventListener("abort", wake, { once: true });
+									});
+								}
+								callSignal.throwIfAborted();
+								running++;
+								try {
+									return await execution.run({
+										parentId: id,
+										signal: callSignal,
+										ctx
+									}, () => ctx.executeTool(name, args, {
+										...options,
+										signal: callSignal
+									}));
+								} finally {
+									running--;
+									waiting.values().next().value?.();
+								}
+							}
+						};
+						return execution.run({
+							parentId: id,
+							signal: combined,
+							ctx
+						}, () => withDataToolPermissions(allowed, async () => {
+							const result = await definition.execute(id, {
+								...params,
+								code: source
+							}, combined, onUpdate, boundedContext);
+							const details = result.details;
+							let outputPath;
+							if (details.fullOutputPath) try {
+								outputPath = await retainCodemodeOutput(ctx.cwd, details.fullOutputPath);
+							} catch {}
+							let remaining = policy.maxOutputTokens * 4;
+							const link = outputPath ? `Full Codemode output: ${outputPath}\n` : "";
+							const retainedLink = link.length <= remaining ? link : "";
+							remaining -= retainedLink.length;
+							const content = result.content.flatMap((block) => {
+								if (block.type === "image") {
+									if (block.data.length > remaining) return [];
+									remaining -= block.data.length;
+									return [block];
+								}
+								const text = block.text.replace(/\[Full output: [^\n]+\]/g, "").slice(0, remaining);
+								remaining -= text.length;
+								return text ? [{
+									type: "text",
+									text
+								}] : [];
+							});
+							details.fullOutputPath = outputPath;
+							return {
+								...result,
+								content: [...retainedLink ? [{
+									type: "text",
+									text: retainedLink
+								}] : [], ...content]
+							};
+						}));
+					}
+				});
+			}
+		});
+	};
+}
+function boundCodemodeSource(source, policy) {
+	const match = /^\s*\/\/\s*@options:\s*([^\r\n]*)(?:\r?\n|$)/.exec(source);
+	const options = match ? JSON.parse(match[1]) : {};
+	const clamp = (value, limit) => typeof value === "number" && Number.isFinite(value) && value > 0 ? Math.min(Math.floor(value), limit) : limit;
+	return `// @options: ${JSON.stringify({
+		timeout_ms: clamp(options.timeout_ms, policy.timeoutMs),
+		max_output_tokens: clamp(options.max_output_tokens, policy.maxOutputTokens)
+	})}\n${match ? source.slice(match[0].length) : source}`;
+}
+//#endregion
+export { boundCodemodeSource, createXopcCodemodeExtension };

package/dist/src/agent/embedded/codemode-output.d.ts

@@ -0,0 +1,2 @@
+/** Adopt only pi's own spill file, never a path printed by a script or an MCP server. */
+export declare function retainCodemodeOutput(workspace: string, source: unknown): Promise<string | undefined>;

package/dist/src/agent/embedded/codemode-output.js

@@ -0,0 +1,34 @@
+import { tmpdir } from "node:os";
+import { basename, dirname, join, relative, sep } from "node:path";
+import { constants } from "node:fs";
+import { randomUUID } from "node:crypto";
+import { mkdir, open, realpath, writeFile } from "node:fs/promises";
+//#region src/agent/embedded/codemode-output.ts
+/** Adopt only pi's own spill file, never a path printed by a script or an MCP server. */
+async function retainCodemodeOutput(workspace, source) {
+	if (typeof source !== "string" || dirname(source) !== tmpdir() || !/^pi-codemode-[a-f0-9]{16}\.txt$/.test(basename(source))) return;
+	const handle = await open(source, constants.O_RDONLY | constants.O_NOFOLLOW);
+	try {
+		const info = await handle.stat();
+		if (!info.isFile() || info.size > 64 * 1024 * 1024) throw new Error("Codemode output file exceeds 64 MiB");
+		const root = await realpath(workspace);
+		const directory = join(root, ".xopc", "codemode-output");
+		await mkdir(directory, {
+			recursive: true,
+			mode: 448
+		});
+		const resolved = await realpath(directory);
+		const location = relative(root, resolved);
+		if (location === ".." || location.startsWith(`..${sep}`) || location.startsWith(sep)) throw new Error("Codemode output directory escapes workspace");
+		const name = `${randomUUID()}.txt`;
+		await writeFile(join(resolved, name), await handle.readFile(), {
+			flag: "wx",
+			mode: 384
+		});
+		return `.xopc/codemode-output/${name}`;
+	} finally {
+		await handle.close();
+	}
+}
+//#endregion
+export { retainCodemodeOutput };

package/dist/src/agent/embedded/external-tool-discovery.d.ts

@@ -0,0 +1,6 @@
+import type { AgentTool } from '@earendil-works/pi-agent-core';
+/** Project the current host directory into pi; pi owns search and declaration loading. */
+export declare function materializeNativeExternalTools(params: {
+    conversationId: string;
+    tools: readonly AgentTool[];
+}): Promise<AgentTool[]>;

package/dist/src/agent/embedded/external-tool-discovery.js

@@ -0,0 +1,60 @@
+import { getEmbeddedExecutionRunId, runWithEmbeddedExecutionSession } from "./execution-context.js";
+import { parseExternalToolRef } from "../external-tools/refs.js";
+import { wrapToolsWithProtection } from "../tools/executor.js";
+import { setXopcToolMetadata } from "./tool-metadata.js";
+import { getExternalToolRegistry } from "../external-tools/tool-registry.js";
+import { createHash } from "node:crypto";
+//#region src/agent/embedded/external-tool-discovery.ts
+/** Project the current host directory into pi; pi owns search and declaration loading. */
+async function materializeNativeExternalTools(params) {
+	const registry = getExternalToolRegistry(params.tools);
+	if (!registry) return [];
+	return runWithEmbeddedExecutionSession(params.conversationId, async () => {
+		const descriptors = await registry.service.catalog(registry.nativeSources);
+		const names = new Set(params.tools.map((tool) => tool.name));
+		const refs = /* @__PURE__ */ new Map();
+		return wrapToolsWithProtection(descriptors.map((descriptor) => {
+			const parsed = parseExternalToolRef(descriptor.toolRef, descriptor.source);
+			if (!parsed) throw new Error("Invalid native tool identity");
+			const suffix = createHash("sha256").update(descriptor.toolRef).digest("hex").slice(0, 12);
+			const prefix = descriptor.source === "endpoint" ? "device" : descriptor.source;
+			const name = `${prefix}__${parsed.toolName.replace(/[^A-Za-z0-9_]/g, "_").slice(0, 40)}_${suffix}`;
+			if (names.has(name)) throw new Error(`Native tool identifier collision: ${name}`);
+			names.add(name);
+			refs.set(name, descriptor.toolRef);
+			return setXopcToolMetadata({
+				name,
+				label: descriptor.title,
+				description: `${descriptor.description}\n${descriptor.summary}`,
+				parameters: descriptor.inputSchema,
+				execute(id, args, signal, update) {
+					return runWithEmbeddedExecutionSession(params.conversationId, () => registry.execute(id, {
+						toolRef: descriptor.toolRef,
+						revision: descriptor.revision,
+						arguments: args,
+						...descriptor.batchRead ? { readOnly: true } : {}
+					}, signal, update), getEmbeddedExecutionRunId());
+				}
+			}, {
+				exposure: descriptor.exposure === "model-only" ? "model-only" : "deferred",
+				namespace: {
+					name: `${prefix}__${createHash("sha256").update(parsed.namespace).digest("hex").slice(0, 12)}`,
+					description: descriptor.source === "endpoint" ? "Tools of the current authorized device" : descriptor.namespace
+				},
+				outputSchema: descriptor.outputSchema,
+				annotations: descriptor.annotations,
+				external: {
+					toolRef: descriptor.toolRef,
+					revision: descriptor.revision,
+					readOnly: descriptor.batchRead === true
+				},
+				...registry.subscribeInvalidation ? { subscribeInvalidation: (listener) => registry.subscribeInvalidation(params.conversationId, descriptor.toolRef, listener) } : {}
+			});
+		}), {
+			...registry.executorConfig,
+			resolveTimeoutMs: (name) => registry.executorConfig?.resolveTimeoutMs?.(refs.get(name) ?? name) ?? registry.executorConfig?.resolveTimeoutMs?.("xopc_tool_execute")
+		});
+	}, getEmbeddedExecutionRunId());
+}
+//#endregion
+export { materializeNativeExternalTools };

package/dist/src/agent/embedded/model-runtime.js

@@ -1,8 +1,9 @@
 import { init_paths, resolveModelsJsonPath } from "../../config/paths.js";
+import { init_register_bundled_oauth_flows, registerBundledOAuthFlows } from "../../providers/register-bundled-oauth-flows.js";
+import { assertCurrentModelProvider, init_provider_policy } from "../../providers/provider-policy.js";
 import { CredentialResolver, init_credentials } from "../../auth/credentials.js";
 import { init_sync_provider_auth, resolveProviderApiKeySync } from "../../auth/sync-provider-auth.js";
 import { XopcModelCredentialStore, init_model_credential_store } from "../../auth/model-credential-store.js";
-import { init_register_bundled_oauth_flows, registerBundledOAuthFlows } from "../../providers/register-bundled-oauth-flows.js";
 import { init_register_runtime_providers, registerRuntimeProviders } from "../../providers/register-runtime-providers.js";
 import { getApiKeySync, init_providers } from "../../providers/index.js";
 import { InMemoryModelsStore } from "@earendil-works/pi-ai";
@@ -15,10 +16,12 @@ init_paths();
 init_providers();
 init_register_bundled_oauth_flows();
 init_register_runtime_providers();
+init_provider_policy();
 function resolveEmbeddedProviderApiKeySync(providerId) {
 	return resolveProviderApiKeySync(providerId) ?? getApiKeySync(providerId);
 }
 async function createEmbeddedModelRuntime(providerId) {
+	assertCurrentModelProvider(providerId);
 	registerBundledOAuthFlows();
 	const resolver = new CredentialResolver();
 	const credentials = new XopcModelCredentialStore(resolver);
@@ -30,7 +33,7 @@ async function createEmbeddedModelRuntime(providerId) {
 	registerRuntimeProviders(modelRuntime);
 	const runtimeProvider = modelRuntime.getProvider(providerId);
 	const storedCredential = await credentials.read(providerId);
-	if (!(runtimeProvider?.auth.oauth && storedCredential?.type === "oauth")) {
+	if (await resolver.resolveApiKeySource(providerId) !== "oauth" || !(runtimeProvider?.auth.oauth && storedCredential?.type === "oauth")) {
 		const key = await resolver.resolveApiKey(providerId) ?? getApiKeySync(providerId);
 		if (key && key !== "extension-managed") await modelRuntime.setRuntimeApiKey(providerId, key);
 	}

package/dist/src/agent/embedded/run-for-session.js

@@ -10,6 +10,7 @@ import { isPersonalConversation } from "../../personal-agent/repository.js";
 import { runWithEmbeddedExecutionSession } from "./execution-context.js";
 import { resolveAgentTurnTimeoutMs } from "../orchestration/run-agent-turn-with-timeout.js";
 import { resolvePromptCachePolicy } from "../../providers/prompt-cache-plan.js";
+import { prepareNativeMcpConfig } from "../mcp/native-mcp.js";
 import { evaluateContextBudget } from "../memory/context-budget.js";
 import { assessContext, recoverContext as recoverContext$1 } from "../memory/context-recovery.js";
 import { resolveCompactionPolicy } from "../memory/compaction-policy.js";
@@ -18,6 +19,7 @@ import { projectTurnOutcome } from "../../session/turn-outcome-projector.js";
 import { voicePresentationPrompt } from "../prompt/voice-presentation.js";
 import { applyStartupContextToUserMessage } from "../reply/apply-turn-user-enrichment.js";
 import { AgentRunSupervisor } from "../orchestration/agent-run-supervisor.js";
+import { materializeNativeExternalTools } from "./external-tool-discovery.js";
 import crypto from "node:crypto";
 //#region src/agent/embedded/run-for-session.ts
 init_src();
@@ -124,7 +126,7 @@ async function runEmbeddedTurnForSessionInner(params) {
 		if (typeof mm.applyResolvedModel === "function") mm.applyResolvedModel(agent, model, modelRef);
 		else await mm.applyModelForSession(agent, conversationId);
 		agentManager.setModelForSession(conversationId, modelRef);
-		const tools = agent.state.tools;
+		const tools = [...agent.state.tools];
 		const turnPolicy = agentManager.createAgentTurnPolicy(conversationId);
 		const systemPrompt = appendDynamicPromptSection([agent.state.systemPrompt ?? "", params.presentation === "voice" ? voicePresentationPrompt : ""].filter(Boolean).join("\n\n"), params.dynamicSystemContext ?? "");
 		const idlePolicy = resolveCompactionPolicy(config);
@@ -164,6 +166,11 @@ async function runEmbeddedTurnForSessionInner(params) {
 		};
 		const thinkingLevel = params.thinkingOverride ?? agent.state.thinkingLevel;
 		const workspaceDir = agentManager.getResolvedWorkspaceForSession(conversationId);
+		tools.push(...await materializeNativeExternalTools({
+			conversationId,
+			tools
+		}));
+		const mcp = config ? await prepareNativeMcpConfig(config, workspaceDir) : void 0;
 		const promptCachePolicy = resolvePromptCachePolicy(config ? resolveEffectiveAgentProfileForSession(conversationId).config.runtime.promptCache : void 0);
 		let userMessageForTurn = userMessage;
 		if (params.applyStartupContext !== false) {
@@ -263,6 +270,8 @@ async function runEmbeddedTurnForSessionInner(params) {
 					tools,
 					systemPrompt,
 					thinkingLevel,
+					codemode: config ? resolveEffectiveAgentProfileForSession(conversationId).config.runtime.codemode : void 0,
+					mcp,
 					promptCachePolicy,
 					compactionPolicy: resolveCompactionPolicy(config),
 					workspaceDir,