@xopcai/xopc 0.0.369 → 0.0.371

package/dist/src/agent-catalog/repository.js

@@ -1,9 +1,9 @@
 import { __esmMin } from "../../_virtual/_rolldown/runtime.js";
 import { getSqliteDatabase, runSqliteWriteTransaction } from "../storage/sqlite/transaction.js";
 import { init_sqlite } from "../storage/sqlite/index.js";
-import { DEFAULT_AGENT_ID, init_id, normalizeAgentId } from "./id.js";
 import { AgentDefaultsSchema, AgentEntrySchema, DEFAULT_AGENT_MODEL_REF, DEFAULT_SKILL_POLICY } from "../agent-config/schema.js";
 import { init_agent_config } from "../agent-config/index.js";
+import { DEFAULT_AGENT_ID, init_id, normalizeAgentId } from "./id.js";
 import { BindingsSchema, init_binding_schema } from "../routing/binding-schema.js";
 import { randomUUID } from "node:crypto";
 //#region src/agent-catalog/repository.ts

package/dist/src/agent-config/schema.d.ts

@@ -136,6 +136,13 @@ export declare const WorkflowPolicySchema: z.ZodObject<{
     allowed: z.ZodOptional<z.ZodArray<z.ZodString>>;
 }, z.core.$strict>;
 export declare const RuntimePolicySchema: z.ZodObject<{
+    codemode: z.ZodOptional<z.ZodObject<{
+        enabled: z.ZodDefault<z.ZodBoolean>;
+        timeoutMs: z.ZodDefault<z.ZodNumber>;
+        maxConcurrentCalls: z.ZodDefault<z.ZodNumber>;
+        maxCalls: z.ZodDefault<z.ZodNumber>;
+        maxOutputTokens: z.ZodDefault<z.ZodNumber>;
+    }, z.core.$strict>>;
     thinkingLevel: z.ZodOptional<z.ZodEnum<{
         low: "low";
         high: "high";
@@ -224,6 +231,13 @@ export declare const AgentDefaultsSchema: z.ZodObject<{
         allowed: z.ZodOptional<z.ZodArray<z.ZodString>>;
     }, z.core.$strict>>;
     runtime: z.ZodDefault<z.ZodObject<{
+        codemode: z.ZodOptional<z.ZodObject<{
+            enabled: z.ZodDefault<z.ZodBoolean>;
+            timeoutMs: z.ZodDefault<z.ZodNumber>;
+            maxConcurrentCalls: z.ZodDefault<z.ZodNumber>;
+            maxCalls: z.ZodDefault<z.ZodNumber>;
+            maxOutputTokens: z.ZodDefault<z.ZodNumber>;
+        }, z.core.$strict>>;
         thinkingLevel: z.ZodOptional<z.ZodEnum<{
             low: "low";
             high: "high";
@@ -435,6 +449,13 @@ export declare const AgentEntrySchema: z.ZodObject<{
         allowed: z.ZodOptional<z.ZodArray<z.ZodString>>;
     }, z.core.$strict>>;
     runtime: z.ZodOptional<z.ZodObject<{
+        codemode: z.ZodOptional<z.ZodObject<{
+            enabled: z.ZodDefault<z.ZodBoolean>;
+            timeoutMs: z.ZodDefault<z.ZodNumber>;
+            maxConcurrentCalls: z.ZodDefault<z.ZodNumber>;
+            maxCalls: z.ZodDefault<z.ZodNumber>;
+            maxOutputTokens: z.ZodDefault<z.ZodNumber>;
+        }, z.core.$strict>>;
         thinkingLevel: z.ZodOptional<z.ZodEnum<{
             low: "low";
             high: "high";
@@ -572,6 +593,13 @@ export declare const EffectiveAgentConfigSchema: z.ZodObject<{
         allowed: z.ZodOptional<z.ZodArray<z.ZodString>>;
     }, z.core.$strict>;
     runtime: z.ZodObject<{
+        codemode: z.ZodOptional<z.ZodObject<{
+            enabled: z.ZodDefault<z.ZodBoolean>;
+            timeoutMs: z.ZodDefault<z.ZodNumber>;
+            maxConcurrentCalls: z.ZodDefault<z.ZodNumber>;
+            maxCalls: z.ZodDefault<z.ZodNumber>;
+            maxOutputTokens: z.ZodDefault<z.ZodNumber>;
+        }, z.core.$strict>>;
         thinkingLevel: z.ZodOptional<z.ZodEnum<{
             low: "low";
             high: "high";

package/dist/src/agent-config/schema.js

@@ -92,6 +92,13 @@ var init_schema = __esmMin((() => {
 		allowed: z.array(z.string().min(1)).optional()
 	}).strict();
 	RuntimePolicySchema = z.object({
+		codemode: z.object({
+			enabled: z.boolean().default(false),
+			timeoutMs: z.number().int().min(1).max(6e4).default(6e4),
+			maxConcurrentCalls: z.number().int().min(1).max(4).default(4),
+			maxCalls: z.number().int().min(1).max(32).default(32),
+			maxOutputTokens: z.number().int().min(1).max(4e3).default(4e3)
+		}).strict().optional(),
 		thinkingLevel: z.enum([
 			"off",
 			"minimal",

package/dist/src/auth/credentials.js

@@ -4,8 +4,9 @@ import { init_logger } from "../utils/logger.js";
 import { init_write_file_atomic, writeTextAtomic } from "../infra/write-file-atomic.js";
 import { getApiKeyFromEnv, init_env_keys } from "../providers/env-keys.js";
 import { init_paths, resolveAgentAuthProfilesPath, resolveAuthProfilesPath, resolveCredentialsDir, resolveOAuthPath } from "../config/paths.js";
-import { getOAuthProviderDefinition, init_registry } from "./oauth/registry.js";
 import { init_oauth_provider_lock, withOAuthProviderLock } from "./oauth-provider-lock.js";
+import { getOAuthProviderDefinition, init_registry } from "./oauth/registry.js";
+import { assertCurrentModelProvider, init_provider_policy } from "../providers/provider-policy.js";
 import { dirname, join } from "path";
 import { mkdir, readFile, readdir, rm } from "fs/promises";
 //#region src/auth/credentials.ts
@@ -18,24 +19,6 @@ function toOAuthCredentials(token) {
 		expires: expiresAt ?? Number.MAX_SAFE_INTEGER
 	};
 }
-function normalizeLegacyOAuthToken(token) {
-	if (token.provider !== "google-gemini-cli" && token.provider !== "google-antigravity") return token;
-	let access = token.access;
-	let projectId = token.projectId;
-	for (let depth = 0; depth < 5; depth += 1) try {
-		const legacy = JSON.parse(access);
-		if (typeof legacy.token !== "string" || !legacy.token) break;
-		access = legacy.token;
-		if (typeof projectId !== "string" && typeof legacy.projectId === "string") projectId = legacy.projectId;
-	} catch {
-		break;
-	}
-	return access === token.access ? token : {
-		...token,
-		access,
-		projectId
-	};
-}
 function getCredentialResolver(options) {
 	if (options) return new CredentialResolver(options);
 	defaultResolver ??= new CredentialResolver();
@@ -55,6 +38,7 @@ var init_credentials = __esmMin((() => {
 	init_paths();
 	init_registry();
 	init_oauth_provider_lock();
+	init_provider_policy();
 	log = createLogger("Credentials");
 	warnedExpiredOAuthTokens = /* @__PURE__ */ new Set();
 	CredentialResolver = class {
@@ -73,6 +57,7 @@ var init_credentials = __esmMin((() => {
 		*/
 		async resolveApiKey(provider) {
 			const normalizedProvider = provider.toLowerCase();
+			assertCurrentModelProvider(normalizedProvider);
 			const oauthDefinition = getOAuthProviderDefinition(normalizedProvider);
 			if (oauthDefinition?.oauthOnly) {
 				const token = await this.loadOAuthToken(normalizedProvider);
@@ -125,6 +110,7 @@ var init_credentials = __esmMin((() => {
 		*/
 		async resolveApiKeySource(provider) {
 			const normalizedProvider = provider.toLowerCase();
+			assertCurrentModelProvider(normalizedProvider);
 			if (getOAuthProviderDefinition(normalizedProvider)?.oauthOnly) return await this.hasUsableOAuthTokenRecord(normalizedProvider) ? "oauth" : null;
 			if (this.agentId) {
 				if (await this.loadFromAgentCredentials(normalizedProvider)) return "agent";
@@ -169,6 +155,7 @@ var init_credentials = __esmMin((() => {
 		*/
 		async saveApiKey(provider, key, options = {}) {
 			const normalizedProvider = provider.toLowerCase();
+			assertCurrentModelProvider(normalizedProvider);
 			if (getOAuthProviderDefinition(normalizedProvider)?.oauthOnly) throw new Error(`${normalizedProvider} only supports OAuth credentials`);
 			const profileId = options.profileName ? `${normalizedProvider}:${options.profileName}` : `${normalizedProvider}:default`;
 			const profile = {
@@ -268,7 +255,7 @@ var init_credentials = __esmMin((() => {
 			try {
 				const content = await readFile(oauthPath, "utf-8");
 				const token = JSON.parse(content);
-				return token.provider === normalizedProvider ? normalizeLegacyOAuthToken(token) : null;
+				return token.provider === normalizedProvider ? token : null;
 			} catch {
 				return null;
 			}

package/dist/src/auth/model-credential-store.js

@@ -1,5 +1,6 @@
 import { __esmMin } from "../../_virtual/_rolldown/runtime.js";
 import { init_oauth_provider_lock, withOAuthProviderLock } from "./oauth-provider-lock.js";
+import { assertCurrentModelProvider, init_provider_policy, isRetiredModelProvider } from "../providers/provider-policy.js";
 import { CredentialResolver, init_credentials } from "./credentials.js";
 //#region src/auth/model-credential-store.ts
 function normalizeProviderId(providerId) {
@@ -35,6 +36,7 @@ var XopcModelCredentialStore;
 var init_model_credential_store = __esmMin((() => {
 	init_credentials();
 	init_oauth_provider_lock();
+	init_provider_policy();
 	XopcModelCredentialStore = class {
 		runtimeApiKeys = /* @__PURE__ */ new Map();
 		constructor(repository = new CredentialResolver()) {
@@ -43,6 +45,7 @@ var init_model_credential_store = __esmMin((() => {
 		async read(providerId, options) {
 			options?.signal?.throwIfAborted();
 			const normalizedProvider = normalizeProviderId(providerId);
+			if (isRetiredModelProvider(normalizedProvider)) return void 0;
 			const runtimeApiKey = this.runtimeApiKeys.get(normalizedProvider);
 			if (runtimeApiKey) return runtimeApiKey;
 			const token = await this.repository.loadOAuthTokenRecord(normalizedProvider);
@@ -54,10 +57,13 @@ var init_model_credential_store = __esmMin((() => {
 			const oauthTokens = await this.repository.listOAuthTokens();
 			options?.signal?.throwIfAborted();
 			const credentials = /* @__PURE__ */ new Map();
-			for (const token of oauthTokens) credentials.set(normalizeProviderId(token.provider), {
-				providerId: normalizeProviderId(token.provider),
-				type: "oauth"
-			});
+			for (const token of oauthTokens) {
+				if (isRetiredModelProvider(token.provider)) continue;
+				credentials.set(normalizeProviderId(token.provider), {
+					providerId: normalizeProviderId(token.provider),
+					type: "oauth"
+				});
+			}
 			for (const providerId of this.runtimeApiKeys.keys()) credentials.set(providerId, {
 				providerId,
 				type: "api_key"
@@ -66,6 +72,7 @@ var init_model_credential_store = __esmMin((() => {
 		}
 		async modify(providerId, update, options) {
 			const normalizedProvider = normalizeProviderId(providerId);
+			assertCurrentModelProvider(normalizedProvider);
 			return withOAuthProviderLock(normalizedProvider, async () => {
 				options?.signal?.throwIfAborted();
 				const persisted = await this.repository.loadOAuthTokenRecord(normalizedProvider);

package/dist/src/auth/oauth/index.d.ts

@@ -11,6 +11,6 @@ export * from './kimi-coding.js';
 export * from './github-copilot.js';
 export * from './google-gemini-cli.js';
 export * from './google-antigravity.js';
-export * from './openai-codex.js';
+export * from './openai.js';
 export * from './xopc-cloud.js';
 export * from './registry.js';

package/dist/src/auth/oauth/index.js

@@ -7,7 +7,7 @@ import { init_google_gemini_cli } from "./google-gemini-cli.js";
 import { init_kimi_coding, kimiCodingOAuthProvider } from "./kimi-coding.js";
 import { init_minimax_cn, minimaxCnOAuthProvider } from "./minimax-cn.js";
 import { init_minimax, minimaxOAuthProvider } from "./minimax.js";
-import { init_openai_codex, loginOpenAICodex, openaiCodexOAuthProvider, refreshOpenAICodexToken } from "./openai-codex.js";
+import { init_openai, openaiOAuthProvider } from "./openai.js";
 import { init_xopc_cloud, xopcCloudOAuthProvider, xopcShareOAuthProvider, xopcTunnelOAuthProvider } from "./xopc-cloud.js";
 import { OAUTH_PROVIDER_DEFINITIONS, getModelOAuthProviderIds, getOAuthProviderDefinition, getOAuthProviderIds, getOAuthProviderInterfaces, init_registry, isOAuthOnlyProvider } from "./registry.js";
 //#region src/auth/oauth/index.ts
@@ -18,8 +18,8 @@ init_kimi_coding();
 init_github_copilot();
 init_google_gemini_cli();
 init_google_antigravity();
-init_openai_codex();
+init_openai();
 init_xopc_cloud();
 init_registry();
 //#endregion
-export { OAUTH_PROVIDER_DEFINITIONS, anthropicOAuthProvider, getModelOAuthProviderIds, getOAuthProviderDefinition, getOAuthProviderIds, getOAuthProviderInterfaces, githubCopilotOAuthProvider, antigravityOAuthProvider as googleAntigravityOAuthProvider, geminiCliOAuthProvider as googleGeminiCliOAuthProvider, isOAuthOnlyProvider, kimiCodingOAuthProvider, loginAnthropic, loginAntigravity, loginGeminiCli, loginOpenAICodex, minimaxCnOAuthProvider, minimaxOAuthProvider, openaiCodexOAuthProvider, refreshAnthropicToken, refreshAntigravityToken, refreshGoogleCloudToken, refreshOpenAICodexToken, xopcCloudOAuthProvider, xopcShareOAuthProvider, xopcTunnelOAuthProvider };
+export { OAUTH_PROVIDER_DEFINITIONS, anthropicOAuthProvider, getModelOAuthProviderIds, getOAuthProviderDefinition, getOAuthProviderIds, getOAuthProviderInterfaces, githubCopilotOAuthProvider, antigravityOAuthProvider as googleAntigravityOAuthProvider, geminiCliOAuthProvider as googleGeminiCliOAuthProvider, isOAuthOnlyProvider, kimiCodingOAuthProvider, loginAnthropic, loginAntigravity, loginGeminiCli, minimaxCnOAuthProvider, minimaxOAuthProvider, openaiOAuthProvider, refreshAnthropicToken, refreshAntigravityToken, refreshGoogleCloudToken, xopcCloudOAuthProvider, xopcShareOAuthProvider, xopcTunnelOAuthProvider };

package/dist/src/auth/oauth/openai.d.ts

@@ -0,0 +1,2 @@
+import type { OAuthProviderInterface } from './types.js';
+export declare const openaiOAuthProvider: OAuthProviderInterface;

package/dist/src/auth/oauth/openai.js

@@ -0,0 +1,90 @@
+import { __esmMin } from "../../../_virtual/_rolldown/runtime.js";
+import { init_write_file_atomic, writeTextAtomic } from "../../infra/write-file-atomic.js";
+import { init_paths, resolveCredentialsDir } from "../../config/paths.js";
+import { init_oauth_provider_lock, withOAuthProviderLock } from "../oauth-provider-lock.js";
+import { init_register_bundled_oauth_flows, registerBundledOAuthFlows } from "../../providers/register-bundled-oauth-flows.js";
+import { join } from "node:path";
+import { randomUUID } from "node:crypto";
+import { readFile } from "node:fs/promises";
+import { openaiProvider } from "@earendil-works/pi-ai/providers/openai";
+//#region src/auth/oauth/openai.ts
+async function getDeviceId(signal) {
+	return withOAuthProviderLock("openai-device-id", async () => {
+		const path = join(resolveCredentialsDir(), "openai-device-id");
+		try {
+			const id = (await readFile(path, "utf8")).trim();
+			if (!/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(id)) throw new Error("Invalid OpenAI installation device ID");
+			return id;
+		} catch (error) {
+			if (error.code !== "ENOENT") throw error;
+			const id = randomUUID();
+			await writeTextAtomic(path, id);
+			return id;
+		}
+	}, { signal });
+}
+function getOpenaiOAuth() {
+	registerBundledOAuthFlows();
+	const oauth = openaiProvider().auth.oauth;
+	if (!oauth) throw new Error("OpenAI ChatGPT OAuth is unavailable");
+	return oauth;
+}
+function fromPiCredential({ type: _type, ...credentials }) {
+	return credentials;
+}
+function toAuthInteraction(callbacks) {
+	return {
+		signal: callbacks.signal ?? new AbortController().signal,
+		async prompt(prompt) {
+			if (prompt.type === "select") return await callbacks.onSelect({
+				message: prompt.message,
+				options: [...prompt.options]
+			}) ?? "";
+			return callbacks.onPrompt({
+				message: prompt.message,
+				placeholder: prompt.placeholder,
+				signal: prompt.signal
+			});
+		},
+		notify(event) {
+			if (event.type === "auth_url") callbacks.onAuth({
+				url: event.url,
+				instructions: event.instructions
+			});
+			else if (event.type === "device_code") callbacks.onDeviceCode(event);
+			else callbacks.onProgress?.(event.message);
+		}
+	};
+}
+var openaiOAuthProvider;
+var init_openai = __esmMin((() => {
+	init_paths();
+	init_write_file_atomic();
+	init_oauth_provider_lock();
+	init_register_bundled_oauth_flows();
+	openaiOAuthProvider = {
+		id: "openai",
+		name: "OpenAI (ChatGPT subscription)",
+		usesCallbackServer: true,
+		loginMethods: ["browser"],
+		async login(callbacks) {
+			const deviceId = await getDeviceId(callbacks.signal);
+			return fromPiCredential(await getOpenaiOAuth().login(toAuthInteraction(callbacks), {
+				getDeviceId: () => deviceId,
+				agentName: "xopc"
+			}));
+		},
+		async refreshToken(credentials, signal) {
+			return fromPiCredential(await getOpenaiOAuth().refresh({
+				...credentials,
+				type: "oauth"
+			}, signal ?? new AbortController().signal));
+		},
+		getApiKey(credentials) {
+			return credentials.access;
+		}
+	};
+}));
+//#endregion
+init_openai();
+export { init_openai, openaiOAuthProvider };

package/dist/src/auth/oauth/registry.js

@@ -8,7 +8,7 @@ import { init_google_gemini_cli } from "./google-gemini-cli.js";
 import { init_kimi_coding, kimiCodingOAuthProvider } from "./kimi-coding.js";
 import { init_minimax_cn, minimaxCnOAuthProvider } from "./minimax-cn.js";
 import { init_minimax, minimaxOAuthProvider } from "./minimax.js";
-import { init_openai_codex, openaiCodexOAuthProvider } from "./openai-codex.js";
+import { init_openai, openaiOAuthProvider } from "./openai.js";
 import { init_xopc_cloud, xopcCloudOAuthProvider, xopcShareOAuthProvider, xopcTunnelOAuthProvider } from "./xopc-cloud.js";
 //#region src/auth/oauth/registry.ts
 function definition(provider, purpose, displayName = provider.name) {
@@ -44,7 +44,7 @@ var init_registry = __esmMin((() => {
 	init_kimi_coding();
 	init_minimax_cn();
 	init_minimax();
-	init_openai_codex();
+	init_openai();
 	init_xopc_cloud();
 	OAUTH_PROVIDER_DEFINITIONS = {
 		"xopc-cloud": {
@@ -69,7 +69,7 @@ var init_registry = __esmMin((() => {
 		"github-copilot": definition(githubCopilotOAuthProvider, "models"),
 		"google-gemini-cli": definition(geminiCliOAuthProvider, "models"),
 		"google-antigravity": definition(antigravityOAuthProvider, "models"),
-		"openai-codex": definition(openaiCodexOAuthProvider, "models")
+		openai: definition(openaiOAuthProvider, "models")
 	};
 }));
 //#endregion

package/dist/src/auth/oauth/types.d.ts

@@ -15,6 +15,7 @@ export type OAuthPrompt = {
     message: string;
     placeholder?: string;
     allowEmpty?: boolean;
+    signal?: AbortSignal;
 };
 export type OAuthAuthInfo = {
     url: string;

package/dist/src/auth/oauth/xopc-cloud.js

@@ -3,8 +3,8 @@ import { generatePKCE, init_pkce } from "./pkce.js";
 import { init_resolution, resolveConnectedPlatformEndpoint } from "../../platform/resolution.js";
 import { hostname } from "node:os";
 import { randomBytes } from "node:crypto";
-import http from "node:http";
 import { setTimeout as setTimeout$1 } from "node:timers/promises";
+import http from "node:http";
 //#region src/auth/oauth/xopc-cloud.ts
 function consoleUrl() {
 	return (process.env.XOPC_CONSOLE_URL ?? resolveConnectedPlatformEndpoint("authorizationServer") ?? DEFAULT_CONSOLE_URL).replace(/\/+$/, "");

package/dist/src/auth/sync-provider-auth.js

@@ -1,6 +1,7 @@
 import { __esmMin } from "../../_virtual/_rolldown/runtime.js";
 import { init_paths, resolveAgentAuthProfilesPath, resolveAuthProfilesPath, resolveOAuthPath } from "../config/paths.js";
 import { init_registry, isOAuthOnlyProvider } from "./oauth/registry.js";
+import { assertCurrentModelProvider, init_provider_policy } from "../providers/provider-policy.js";
 import { getDefaultAgentId, init_resolve_route } from "../routing/resolve-route.js";
 import { existsSync, readFileSync } from "node:fs";
 //#region src/auth/sync-provider-auth.ts
@@ -81,6 +82,7 @@ function readOAuthAccessTokenSync(provider) {
 */
 function resolveProviderApiKeySync(provider) {
 	const normalized = provider.toLowerCase();
+	assertCurrentModelProvider(normalized);
 	if (isOAuthOnlyProvider(normalized)) return readOAuthAccessTokenSync(normalized);
 	const fromAgent = readApiKeyFromProfilesFile(resolveAgentAuthProfilesPath(getDefaultAgentId()), normalized);
 	if (fromAgent) return fromAgent;
@@ -91,6 +93,7 @@ function resolveProviderApiKeySync(provider) {
 /** Resolve one agent's private credential, then the shared credential and OAuth token. */
 function resolveProviderApiKeyForAgentSync(provider, agentId, _config) {
 	const normalized = provider.toLowerCase();
+	assertCurrentModelProvider(normalized);
 	if (isOAuthOnlyProvider(normalized)) return readOAuthAccessTokenSync(normalized);
 	if (agentId?.trim()) {
 		const fromAgent = readApiKeyFromProfilesFile(resolveAgentAuthProfilesPath(agentId.trim()), normalized);
@@ -105,6 +108,7 @@ function resolveProviderApiKeyForAgentSync(provider, agentId, _config) {
 * matching async CredentialResolver resolution (excluding env — callers check env separately).
 */
 function hasProviderAuthOnDiskSync(provider) {
+	assertCurrentModelProvider(provider.toLowerCase());
 	if (isOAuthOnlyProvider(provider.toLowerCase())) return hasOAuthTokenSync(provider);
 	if (hasApiKeyInProfilesFile(resolveAgentAuthProfilesPath(getDefaultAgentId()), provider)) return true;
 	if (hasApiKeyInProfilesFile(resolveAuthProfilesPath(), provider)) return true;
@@ -114,6 +118,7 @@ function hasProviderAuthOnDiskSync(provider) {
 var init_sync_provider_auth = __esmMin((() => {
 	init_paths();
 	init_resolve_route();
+	init_provider_policy();
 	init_registry();
 }));
 //#endregion

package/dist/src/automations/capabilities/drafts.js

@@ -3,10 +3,10 @@ import { init_src } from "../../../packages/gateway-contract/src/index.js";
 import { init_trust_policy, resolveAutomationSafetyForTrust } from "../../user-context/trust-policy.js";
 import { getUserTrustPolicy } from "../../storage/sqlite/user-trust-repository.js";
 import { init_sqlite } from "../../storage/sqlite/index.js";
-import { init_agent_scope, resolveDefaultAgentId } from "../../agent/agent-scope.js";
 import { CapabilityError } from "../../capabilities/runtime/errors.js";
 import { ExternalEffectNotAppliedError } from "../../capabilities/runtime/external-operations.js";
 import { defineExternalCapability, defineReadCapability } from "../../capabilities/runtime/dispatcher.js";
+import { init_agent_scope, resolveDefaultAgentId } from "../../agent/agent-scope.js";
 import { AutomationCreateCapabilityInputSchema } from "./write.js";
 import { simulateAutomation } from "../draft/automation-draft-validator.js";
 import { AutomationDraftService } from "../draft/automation-draft-service.js";

package/dist/src/bootstrap/application-state.js

@@ -1,9 +1,9 @@
 import { requireXopcDatabase } from "../storage/sqlite/connection.js";
 import { init_sqlite } from "../storage/sqlite/index.js";
 import { AgentCatalogService } from "../agent-catalog/service.js";
-import { ensureStarterAgentsInitialized } from "../agent/starter-agents.js";
 import { cutoverLegacyAgentConfig } from "../agent-catalog/migrations/legacy-config-cutover.js";
 import "../agent-catalog/index.js";
+import { ensureStarterAgentsInitialized } from "../agent/starter-agents.js";
 import { migrateIdentityMarkdownToCatalog } from "../agent-catalog/migrations/identity-markdown-cutover.js";
 import { migrateCloudPublicModelsSync } from "../migrations/cloud-public-models.js";
 import { runBootstrapMigrationsSync } from "../migrations/runner.js";

package/dist/src/capabilities/runtime/dispatcher.js

@@ -1,7 +1,7 @@
 import { SqliteCommitEffectError, init_transaction } from "../../storage/sqlite/transaction.js";
+import { OperationConflictError, executeAtomicOperation } from "./atomic-operations.js";
 import { CapabilityError } from "./errors.js";
 import { executeExternalOperation } from "./external-operations.js";
-import { OperationConflictError, executeAtomicOperation } from "./atomic-operations.js";
 import { createHash } from "node:crypto";
 import { z } from "zod";
 //#region src/capabilities/runtime/dispatcher.ts

package/dist/src/capabilities/runtime/product.js

@@ -1,5 +1,6 @@
 import { CapabilityError } from "./errors.js";
 import { CapabilityDispatcher } from "./dispatcher.js";
+import { registerAgentCapabilities } from "../../agent-catalog/capabilities.js";
 import { registerLocalAppReadCapabilities } from "../../local-apps/capabilities/read.js";
 import { registerNoteReadCapabilities } from "../../notes/capabilities/read.js";
 import { registerNoteWriteCapabilities } from "../../notes/capabilities/write.js";
@@ -18,7 +19,6 @@ import { registerSceneReadCapabilities } from "../../scenes/capabilities/read.js
 import { registerSceneWriteCapabilities } from "../../scenes/capabilities/write.js";
 import { registerSettingsCapability } from "./settings.js";
 import { registerAppContextCapability } from "./app-context.js";
-import { registerAgentCapabilities } from "../../agent-catalog/capabilities.js";
 //#region src/capabilities/runtime/product.ts
 function createProductDispatcher(getNotes, taskWrites) {
 	const dispatcher = new CapabilityDispatcher();

package/dist/src/chat-commands/builtins/model.js

@@ -66,10 +66,10 @@ const switchCommand = {
 		"group"
 	],
 	acceptsArgs: true,
-	examples: ["/switch openai/gpt-5.6", "/switch anthropic/claude-sonnet-5"],
+	examples: ["/switch openai/gpt-6-sol", "/switch anthropic/claude-sonnet-5"],
 	handler: async (ctx, args) => {
 		if (!args.trim()) return {
-			content: joinBlocks("❌ Missing model ref.", "**Usage:** `/switch provider/model-id`", "Run `/models` — each line shows a display name and a `provider/model` ref in backticks. Copy that ref.", "**Example:** `/switch openai/gpt-5.6`"),
+			content: joinBlocks("❌ Missing model ref.", "**Usage:** `/switch provider/model-id`", "Run `/models` — each line shows a display name and a `provider/model` ref in backticks. Copy that ref.", "**Example:** `/switch openai/gpt-6-sol`"),
 			success: false
 		};
 		await ctx.setTyping(true);

package/dist/src/cli/command-manifest.js

@@ -97,7 +97,7 @@ const ROOT_HELP_COMMANDS = [
 	},
 	{
 		name: "mcp",
-		description: "Expose selected Gateway capabilities over MCP"
+		description: "Manage native pi MCP servers and expose Gateway capabilities"
 	},
 	{
 		name: "platform",

package/dist/src/cli/commands/agents.js

@@ -1,8 +1,8 @@
 import { normalizeAgentId, validateAgentIdForNewAgent } from "../../agent-catalog/id.js";
 import { AgentCatalogRepository, init_repository } from "../../agent-catalog/repository.js";
 import { init_agent_scope, resolveAgentDir, resolveAgentWorkspaceDir, resolveDefaultAgentId } from "../../agent/agent-scope.js";
-import { resolveEffectiveAgentConfigForAgent } from "../../config/agent-profile.js";
 import { AgentCatalogService } from "../../agent-catalog/service.js";
+import { resolveEffectiveAgentConfigForAgent } from "../../config/agent-profile.js";
 import { colors } from "../utils/colors.js";
 //#region src/cli/commands/agents.ts
 init_repository();

package/dist/src/cli/commands/doctor/checks/database-schema.js

@@ -53,7 +53,7 @@ async function checkDatabaseSchema(ctx) {
 		id: "database-schema",
 		label: "Database schema",
 		status: "pass",
-		message: `SQLite schema v${status.dbVersion} (current release v239).`,
+		message: `SQLite schema v${status.dbVersion} (current release v241).`,
 		hints: []
 	};
 }

package/dist/src/cli/commands/doctor/checks/provider-auth.js

@@ -1,5 +1,5 @@
-import { PROVIDER_ENV_MAP, init_env_keys } from "../../../../providers/env-keys.js";
 import { AgentCatalogRepository, init_repository } from "../../../../agent-catalog/repository.js";
+import { PROVIDER_ENV_MAP, init_env_keys } from "../../../../providers/env-keys.js";
 import { getModelOAuthProviderIds, init_registry } from "../../../../auth/oauth/registry.js";
 import { CredentialResolver, init_credentials } from "../../../../auth/credentials.js";
 import { getAgentDefaultModelRef, init_schema, parseModelRef } from "../../../../config/schema.js";

package/dist/src/cli/commands/extension-agent-plugin.js

@@ -1,10 +1,6 @@
-import { pluginServerId } from "../../extensions/agent-plugins/validation.js";
 import { AgentPluginStore } from "../../extensions/agent-plugins/store.js";
-import { savePluginAuthBinding } from "../../extensions/agent-plugins/auth.js";
-import { materializePluginServers } from "../../extensions/agent-plugins/mcp-adapter.js";
 import { loadConfig } from "../../config/loader.js";
 import { getContextWithOpts } from "../context.js";
-import { getMcpOAuthManager } from "../../agent/mcp/oauth/mcp-oauth-manager.js";
 import { isAgentPluginArchive, withAgentPluginSource } from "../../extensions/agent-plugins/sources.js";
 import { removePluginCredentials } from "../../extensions/agent-plugins/credentials.js";
 import { join, resolve } from "node:path";
@@ -63,21 +59,6 @@ function addAgentPluginLifecycleCommands(command) {
 		store.remove(id, options.removeData);
 		console.log(`Removed ${raw}; credentials ${options.removeCredentials ? "deleted" : "retained"}${options.removeData ? ", plugin data deleted" : ", plugin data retained"}.`);
 	});
-	command.command("connect").argument("<id>", "plugin:<name>").requiredOption("--mcp <server>", "MCP server name").action(async (raw, options) => {
-		const store = new AgentPluginStore();
-		const id = raw.replace(/^plugin:/, "");
-		const plugin = store.get(id);
-		if (!plugin || plugin.readiness === "blocked") throw new Error("Plugin is unavailable");
-		await savePluginAuthBinding(store, id, options.mcp, { mode: "oauth" });
-		const serverId = pluginServerId(id, options.mcp);
-		const server = materializePluginServers(plugin, store)[serverId];
-		if (!server) throw new Error("MCP server not found");
-		const status = await getMcpOAuthManager(server).start({
-			serverId,
-			rawServer: server
-		});
-		console.log(JSON.stringify(status, null, 2));
-	});
 }
 //#endregion
 export { addAgentPluginLifecycleCommands, installAgentPluginFromCli, isAgentPluginSource };

package/dist/src/cli/commands/mcp.js

@@ -1,12 +1,46 @@
+import { getNativePiAgentDir, prepareNativeMcpConfig } from "../../agent/mcp/native-mcp.js";
 import { loadConfig } from "../../config/loader.js";
 import { register } from "../registry.js";
 import { createGatewayHttpClientFromConfig } from "../../mcp/gateway-http-client.js";
 import { createCapabilityMcpServer } from "../../mcp/capability-server.js";
+import { join } from "node:path";
+import { chmodSync, existsSync, readFileSync, writeFileSync } from "node:fs";
+import { main } from "@earendil-works/pi-coding-agent";
 import { Command } from "commander";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
 //#region src/cli/commands/mcp.ts
 function createMcpCommand(ctx) {
-	const command = new Command("mcp").description("Expose selected Gateway capabilities over MCP");
+	const command = new Command("mcp").description("Manage native pi MCP servers and expose Gateway capabilities");
+	for (const action of [
+		"list",
+		"login",
+		"logout"
+	]) {
+		const native = command.command(action).description(`Use pi's native MCP ${action}`);
+		if (action !== "list") native.argument("<server>", "Configured MCP server ID");
+		if (action === "list") native.option("--json", "Print pi MCP diagnostics as JSON");
+		if (action === "login") native.option("--timeout <seconds>", "Browser sign-in timeout in seconds");
+		native.action(async (serverOrOptions, loginOptions) => {
+			const server = typeof serverOrOptions === "string" ? serverOrOptions : void 0;
+			const options = typeof serverOrOptions === "string" ? loginOptions : serverOrOptions;
+			const mcp = await prepareNativeMcpConfig(loadConfig(ctx.configPath), ctx.workspacePath || process.cwd());
+			if (mcp.errors.length) throw new Error(mcp.errors.join("\n"));
+			const path = join(getNativePiAgentDir(), "mcp.json");
+			if (existsSync(path) && JSON.parse(readFileSync(path, "utf8")).xopcGenerated !== true) throw new Error("The pi directory contains a user-managed mcp.json. Use a dedicated PI_CODING_AGENT_DIR for xopc.");
+			if (existsSync(path)) chmodSync(path, 384);
+			writeFileSync(path, JSON.stringify({
+				xopcGenerated: true,
+				mcpServers: Object.fromEntries(mcp.servers.map((entry) => [entry.name, entry.config]))
+			}), { mode: 384 });
+			await main([
+				"mcp",
+				action,
+				...server ? [server] : [],
+				...action === "list" && options?.json ? ["--json"] : [],
+				...action === "login" && loginOptions?.timeout ? ["--timeout", loginOptions.timeout] : []
+			]);
+		});
+	}
 	command.command("capabilities").description("Run an opt-in stdio MCP proxy for an explicit capability allowlist").requiredOption("--allow-capability <ids...>", "Exact capability IDs; no wildcards").action(async (options) => {
 		const server = createCapabilityMcpServer(createGatewayHttpClientFromConfig({ config: loadConfig(ctx.configPath) }), options.allowCapability);
 		const transport = new StdioServerTransport();
@@ -39,7 +73,7 @@ function createMcpCommand(ctx) {
 register({
 	id: "mcp",
 	name: "mcp",
-	description: "Expose selected Gateway capabilities over MCP",
+	description: "Manage native pi MCP servers and expose Gateway capabilities",
 	factory: createMcpCommand,
 	metadata: {
 		category: "utility",

package/dist/src/cli/commands/models.js

@@ -1,8 +1,8 @@
 import { AgentCatalogRepository, init_repository } from "../../agent-catalog/repository.js";
+import { AgentCatalogService } from "../../agent-catalog/service.js";
 import { CredentialResolver, init_credentials } from "../../auth/credentials.js";
 import { getAgentDefaultModelRef, init_schema } from "../../config/schema.js";
 import { getAllModels, getAvailableModels, getConfiguredProviders, getProviderAuthState, getProviderDisplayName, init_providers, isProviderConfigured, providerSupportsApiKey, providerSupportsOAuth, resolveModel } from "../../providers/index.js";
-import { AgentCatalogService } from "../../agent-catalog/service.js";
 import { listImageProviderSpecs } from "../../../packages/image-providers/src/catalog.js";
 import "../../../packages/image-providers/src/index.js";
 import { loadConfig } from "../../config/loader.js";
@@ -22,7 +22,7 @@ init_repository();
 init_providers();
 const IMAGE_GENERATION_IDS = new Set(listImageProviderSpecs().flatMap((provider) => provider.models.map((model) => model.id)));
 const VISION_IDS = new Set([
-	"gpt-5.6",
+	"gpt-6-sol",
 	"gpt-5.6-luna",
 	"gpt-5.6-sol",
 	"gpt-5.6-terra",