@xopcai/xopc 0.0.369 → 0.0.371

package/dist/src/{agent/mcp/plugin-http-fetch.js → extensions/agent-plugins/source-http-fetch.js}

@@ -1,7 +1,7 @@
 import { BlockList, isIP } from "node:net";
 import { Agent, fetch } from "undici";
 import { lookup } from "node:dns";
-//#region src/agent/mcp/plugin-http-fetch.ts
+//#region src/extensions/agent-plugins/source-http-fetch.ts
 const blocked = new BlockList();
 for (const [network, prefix] of [
 	["0.0.0.0", 8],
@@ -29,19 +29,19 @@ const publicDispatcher = new Agent({ connect: { lookup(host, options, callback)
 		all: true
 	}, (error, addresses) => {
 		if (error) return callback(error, []);
-		if (!addresses.length || addresses.some((entry) => isBlocked(entry.address))) return callback(/* @__PURE__ */ new Error("Plugin MCP cannot access private network addresses"), []);
+		if (!addresses.length || addresses.some((entry) => isBlocked(entry.address))) return callback(/* @__PURE__ */ new Error("Plugin download cannot access private network addresses"), []);
 		if (options.all) callback(null, addresses);
 		else callback(null, addresses[0].address, addresses[0].family);
 	});
 } } });
-function createPluginHttpFetch(endpoint, configuredHeaders) {
+function createPluginSourceFetch(endpoint, configuredHeaders) {
 	return async (input, init) => {
 		const url = new URL(input);
-		if (!["https:", "http:"].includes(url.protocol) || url.username || url.password || url.hash) throw new Error("Invalid plugin MCP request URL");
+		if (!["https:", "http:"].includes(url.protocol) || url.username || url.password || url.hash) throw new Error("Invalid plugin download request URL");
 		const local = loopback(endpoint.hostname) && url.origin === endpoint.origin;
-		if (!local && url.protocol !== "https:") throw new Error("Plugin MCP requires HTTPS");
+		if (!local && url.protocol !== "https:") throw new Error("Plugin download requires HTTPS");
 		const address = url.hostname.replace(/^\[|\]$/g, "");
-		if (!local && isIP(address) && isBlocked(address)) throw new Error("Plugin MCP cannot access private network addresses");
+		if (!local && isIP(address) && isBlocked(address)) throw new Error("Plugin download cannot access private network addresses");
 		const headers = new Headers(url.origin === endpoint.origin ? configuredHeaders : void 0);
 		new Headers(init?.headers).forEach((value, key) => headers.set(key, value));
 		return await fetch(url, {
@@ -53,4 +53,4 @@ function createPluginHttpFetch(endpoint, configuredHeaders) {
 	};
 }
 //#endregion
-export { createPluginHttpFetch };
+export { createPluginSourceFetch };

package/dist/src/extensions/agent-plugins/sources.js

@@ -1,4 +1,4 @@
-import { createPluginHttpFetch } from "../../agent/mcp/plugin-http-fetch.js";
+import { createPluginSourceFetch } from "./source-http-fetch.js";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { mkdtempSync, rmSync, writeFileSync } from "node:fs";
@@ -63,7 +63,7 @@ async function withAgentPluginSource(source, config, fn) {
 		};
 	} else {
 		const url = new URL(source);
-		const response = await createPluginHttpFetch(url, {})(url, { signal: AbortSignal.timeout(3e4) });
+		const response = await createPluginSourceFetch(url, {})(url, { signal: AbortSignal.timeout(3e4) });
 		if (!response.ok || !response.body) throw new Error(`Plugin download failed (${response.status})`);
 		const reader = response.body.getReader();
 		const chunks = [];

package/dist/src/extensions/agent-plugins/store.js

@@ -4,7 +4,6 @@ import { init_logger } from "../../utils/logger.js";
 import { init_write_file_atomic, writeTextAtomicSync } from "../../infra/write-file-atomic.js";
 import { computeExtensionDirectoryIntegrity } from "../lockfile.js";
 import { containedPath, inspectAgentPlugin, pluginName } from "./validation.js";
-import { readPluginMcpHealth } from "./health.js";
 import { tmpdir } from "node:os";
 import { dirname, join, resolve } from "node:path";
 import { cpSync, existsSync, lstatSync, mkdirSync, mkdtempSync, readFileSync, readdirSync, rmSync, statSync, writeFileSync } from "node:fs";
@@ -104,8 +103,7 @@ var AgentPluginStore = class {
 				component: "package",
 				message: "Installed files differ from the reviewed package"
 			});
-			const health = Object.keys(inspection.servers).map((name) => readPluginMcpHealth(id, name, receipt.revision, this.stateDir));
-			const readiness = !valid ? "blocked" : inspection.diagnostics.length || health.includes("error") ? "degraded" : health.some((status) => status !== "ready") ? "setup_required" : "ready";
+			const readiness = !valid ? "blocked" : inspection.diagnostics.length ? "degraded" : "ready";
 			return {
 				...inspection,
 				id,

package/dist/src/extensions/agent-plugins/validation.d.ts

@@ -28,10 +28,6 @@ declare const serverSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
     type: z.ZodLiteral<"streamable-http">;
     url: z.ZodString;
     headers: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
-}, z.core.$strict>, z.ZodObject<{
-    type: z.ZodLiteral<"sse">;
-    url: z.ZodString;
-    headers: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
 }, z.core.$strict>], "type">;
 export type PluginManifest = z.infer<typeof manifestSchema>;
 export type PluginServer = z.infer<typeof serverSchema>;

package/dist/src/extensions/agent-plugins/validation.js

@@ -1,8 +1,9 @@
 import { dirname, isAbsolute, join, relative, resolve } from "node:path";
 import { existsSync, lstatSync, readFileSync, readdirSync, realpathSync, statSync } from "node:fs";
+import { createHash } from "node:crypto";
 import { z } from "zod";
-import { validateHeaderName, validateHeaderValue } from "node:http";
 import yaml from "js-yaml";
+import { validateHeaderName, validateHeaderValue } from "node:http";
 //#region src/extensions/agent-plugins/validation.ts
 const PLUGIN_SCHEMA = "https://agent-plugins.org/schemas/1.0.0/plugin.schema.json";
 const MCP_SCHEMA = "https://agent-plugins.org/schemas/1.0.0/mcp.schema.json";
@@ -24,25 +25,17 @@ const manifestSchema = z.object({
 	extensions: z.record(z.string(), z.unknown()).optional()
 });
 const strings = z.record(z.string(), z.string());
-const serverSchema = z.discriminatedUnion("type", [
-	z.strictObject({
-		type: z.literal("stdio"),
-		command: z.string().min(1),
-		args: z.array(z.string()).optional(),
-		env: strings.optional(),
-		cwd: z.string().optional()
-	}),
-	z.strictObject({
-		type: z.literal("streamable-http"),
-		url: z.string().min(1),
-		headers: strings.optional()
-	}),
-	z.strictObject({
-		type: z.literal("sse"),
-		url: z.string().min(1),
-		headers: strings.optional()
-	})
-]);
+const serverSchema = z.discriminatedUnion("type", [z.strictObject({
+	type: z.literal("stdio"),
+	command: z.string().min(1),
+	args: z.array(z.string()).optional(),
+	env: strings.optional(),
+	cwd: z.string().optional()
+}), z.strictObject({
+	type: z.literal("streamable-http"),
+	url: z.string().min(1),
+	headers: strings.optional()
+})]);
 function containedPath(root, path) {
 	const base = resolve(root);
 	const target = resolve(path);
@@ -205,7 +198,7 @@ function inspectAgentPlugin(rootDir, dataDir = join(rootDir, ".inspection-data")
 	return result;
 }
 function pluginServerId(pluginId, serverName) {
-	return `plugin/${encodeURIComponent(pluginId)}/${encodeURIComponent(serverName)}`;
+	return `plugin_${pluginId.replace(/[^a-zA-Z0-9_]/g, "_")}_${createHash("sha256").update(JSON.stringify([pluginId, serverName])).digest("hex").slice(0, 16)}`;
 }
 //#endregion
 export { MCP_SCHEMA, PLUGIN_SCHEMA, containedPath, expandPluginVariables, inspectAgentPlugin, pluginName, pluginServerId, resolvePluginCwd, validatePluginServer };

package/dist/src/gateway/agents-admin.d.ts

@@ -101,3 +101,8 @@ export declare function writeAgentAvatarFromBase64(agentId: string, base64: stri
 export declare function deleteAgentAvatarFile(agentId: string): Promise<AgentAdminResult<{
     agentId: string;
 }>>;
+/** Rasterize configured generated avatars locally for native mobile clients. */
+export declare function resolveAgentAvatarImage(agentId: string): Promise<AgentAdminResult<{
+    buffer: Buffer;
+    contentType: string;
+}>>;

package/dist/src/gateway/agents-admin.js

@@ -1,10 +1,10 @@
 import { normalizeAgentId, validateAgentIdForNewAgent } from "../agent-catalog/id.js";
 import { AgentCatalogRepository, init_repository } from "../agent-catalog/repository.js";
 import { init_agent_scope, listAgentEntries, resolveAgentProfileDir, resolveAgentWorkspaceDir, resolveDefaultAgentId, resolveUserPath } from "../agent/agent-scope.js";
-import { resolveEffectiveAgentProfile } from "../config/agent-profile.js";
 import { AGENT_PROFILE_MARKDOWN_SYSTEM_FILES, REQUIRED_AGENT_PROFILE_MARKDOWN_FILE_SET } from "../agent/context/workspace.js";
-import { isPathUnderWorkspace, resolveWorkspaceSafePath } from "./workspace-editor-path.js";
 import { AgentCatalogService } from "../agent-catalog/service.js";
+import { resolveEffectiveAgentProfile } from "../config/agent-profile.js";
+import { isPathUnderWorkspace, resolveWorkspaceSafePath } from "./workspace-editor-path.js";
 import { GATEWAY_BUILTIN_TOOL_IDS } from "./agent-builtin-tools.js";
 import { resolve } from "node:path";
 import { mkdir, readFile, realpath, stat, unlink, writeFile } from "node:fs/promises";
@@ -434,5 +434,60 @@ async function deleteAgentAvatarFile(agentId) {
 		data: { agentId: id }
 	};
 }
+const renderedAvatarCache = /* @__PURE__ */ new Map();
+/** Rasterize configured generated avatars locally for native mobile clients. */
+async function resolveAgentAvatarImage(agentId) {
+	const missing = assertAgentExistsForAvatar(agentId);
+	if (missing) return missing;
+	const id = normalizeAgentId(agentId);
+	const reference = listAgentEntries().find((entry) => normalizeAgentId(entry.id) === id)?.profile?.avatar?.trim() ?? "";
+	if (reference === "xopc:custom") return readAgentAvatarFile(id);
+	if (reference.startsWith("xopc:loopi:") || /^https?:\/\//i.test(reference)) return {
+		ok: false,
+		status: 404,
+		error: "Avatar is rendered by the client"
+	};
+	const match = /^xopc:dicebear:(adventurer|bottts|lorelei|thumbs|fun-emoji|pixel-art):(.+)$/.exec(reference);
+	const style = match?.[1] ?? "adventurer";
+	const seed = match?.[2] ?? id;
+	const key = JSON.stringify([style, seed]);
+	const cached = renderedAvatarCache.get(key);
+	if (cached) return {
+		ok: true,
+		data: {
+			buffer: cached,
+			contentType: "image/png"
+		}
+	};
+	const [{ createAvatar }, collection, { default: sharp }] = await Promise.all([
+		import("@dicebear/core"),
+		import("@dicebear/collection"),
+		import("sharp")
+	]);
+	const options = {
+		seed,
+		size: 128
+	};
+	const svg = (() => {
+		switch (style) {
+			case "bottts": return createAvatar(collection.bottts, options).toString();
+			case "lorelei": return createAvatar(collection.lorelei, options).toString();
+			case "thumbs": return createAvatar(collection.thumbs, options).toString();
+			case "fun-emoji": return createAvatar(collection.funEmoji, options).toString();
+			case "pixel-art": return createAvatar(collection.pixelArt, options).toString();
+			default: return createAvatar(collection.adventurer, options).toString();
+		}
+	})();
+	const buffer = await sharp(Buffer.from(svg)).png().toBuffer();
+	if (renderedAvatarCache.size >= 64) renderedAvatarCache.delete(renderedAvatarCache.keys().next().value);
+	renderedAvatarCache.set(key, buffer);
+	return {
+		ok: true,
+		data: {
+			buffer,
+			contentType: "image/png"
+		}
+	};
+}
 //#endregion
-export { createGatewayAgent, deleteAgentAvatarFile, deleteGatewayAgent, getGatewayAgentEffectiveConfig, listAgentProfileFiles, listGatewayAgents, readAgentAvatarFile, readAgentProfileFile, updateGatewayAgent, writeAgentAvatarFromBase64, writeAgentProfileFile };
+export { createGatewayAgent, deleteAgentAvatarFile, deleteGatewayAgent, getGatewayAgentEffectiveConfig, listAgentProfileFiles, listGatewayAgents, readAgentAvatarFile, readAgentProfileFile, resolveAgentAvatarImage, updateGatewayAgent, writeAgentAvatarFromBase64, writeAgentProfileFile };

package/dist/src/gateway/chat-stream/mapper.js

@@ -274,6 +274,7 @@ var ChatStreamMapper = class {
 		const toolName = String(event.toolName ?? "unknown");
 		this.toolCallToMessageId.set(toolCallId, messageId);
 		const events = [this.make("tool_start", {
+			...toolExecutionMetadata(event),
 			messageId,
 			toolCallId,
 			toolName,
@@ -300,6 +301,7 @@ var ChatStreamMapper = class {
 		const textDelta = extractText(partial);
 		const toolName = String(event.toolName ?? "unknown");
 		const events = [this.make("tool_update", {
+			...toolExecutionMetadata(event),
 			messageId,
 			toolCallId,
 			toolName,
@@ -329,6 +331,7 @@ var ChatStreamMapper = class {
 		const result = boundRealtimeToolResult(fullResult);
 		const toolName = String(event.toolName ?? "unknown");
 		const events = [this.make("tool_end", {
+			...toolExecutionMetadata(event),
 			messageId,
 			toolCallId,
 			toolName,
@@ -541,6 +544,12 @@ function extractDetails(value) {
 function asRecord(value) {
 	return value && typeof value === "object" && !Array.isArray(value) ? value : null;
 }
+function toolExecutionMetadata(event) {
+	return {
+		...typeof event.parentToolCallId === "string" ? { parentToolCallId: event.parentToolCallId } : {},
+		...typeof event.durationMs === "number" ? { durationMs: event.durationMs } : {}
+	};
+}
 function normalizeToolResult(value) {
 	if (value == null) return void 0;
 	if (typeof value === "string") return { text: value };

package/dist/src/gateway/chat-stream/protocol.d.ts

@@ -1,4 +1,4 @@
-import type { ToolActivity, TurnOutcome } from '@xopcai/gateway-contract';
+import type { AgentStreamToolExecutionMetadata, ToolActivity, TurnOutcome } from '@xopcai/gateway-contract';
 import type { TaskUpdateTrigger } from '../../storage/sqlite/session-input-repository.js';
 export type ChatStreamStatus = 'success' | 'error' | 'cancelled' | 'suspended';
 export type PetFeedbackTaskState = 'working' | 'waiting' | 'success' | 'error';
@@ -63,14 +63,14 @@ export type ToolStartEvent = ChatStreamEnvelope<'tool_start', {
     toolName: string;
     args?: unknown;
     activity: ToolActivity;
-}>;
+} & AgentStreamToolExecutionMetadata>;
 export type ToolUpdateEvent = ChatStreamEnvelope<'tool_update', {
     messageId: string;
     toolCallId: string;
     toolName: string;
     details?: unknown;
     textDelta?: string;
-}>;
+} & AgentStreamToolExecutionMetadata>;
 export type ToolEndEvent = ChatStreamEnvelope<'tool_end', {
     messageId: string;
     toolCallId: string;
@@ -84,7 +84,7 @@ export type ToolEndEvent = ChatStreamEnvelope<'tool_end', {
     };
     deliveries?: import('@xopcai/gateway-contract').ProductDeliveryEnvelope[];
     errorMessage?: string;
-}>;
+} & AgentStreamToolExecutionMetadata>;
 export type CommandStartedEvent = ChatStreamEnvelope<'command_started', {
     messageId: string;
     toolCallId: string;

package/dist/src/gateway/hono/lib/config-payload.d.ts

@@ -2,8 +2,7 @@ import type { Config } from '../../../config/schema.js';
 import type { GatewayService } from '../../service.js';
 /** MCP block for GET/PATCH `/api/config` (authenticated console editing). */
 export declare function buildSafeMcpConfigForWeb(config: Config): {
-    servers: import("../../../config/mcp-config-normalize.js").ConfigMcpServers;
-    sessionIdleTtlMs?: number;
+    servers: Record<string, Record<string, unknown>>;
 };
 export declare function buildSafeBrowserConfigForWeb(browser: unknown): {
     security?: unknown;
@@ -109,6 +108,13 @@ export declare function buildSafeWebConfigPayload(service: GatewayService, optio
                 allowed?: string[];
             };
             runtime: {
+                codemode?: {
+                    enabled: boolean;
+                    timeoutMs: number;
+                    maxConcurrentCalls: number;
+                    maxCalls: number;
+                    maxOutputTokens: number;
+                };
                 thinkingLevel?: "low" | "high" | "off" | "medium" | "minimal" | "xhigh" | "max";
                 commandIsolation?: {
                     mode: "host";
@@ -345,7 +351,6 @@ export declare function buildSafeWebConfigPayload(service: GatewayService, optio
         id?: string;
     }[];
     mcp: {
-        servers: import("../../../config/mcp-config-normalize.js").ConfigMcpServers;
-        sessionIdleTtlMs?: number;
+        servers: Record<string, Record<string, unknown>>;
     };
 }>;

package/dist/src/gateway/hono/lib/config-payload.js

@@ -7,9 +7,9 @@ import { ContextPlanningConfigSchema, KnowledgeMemoryConfigSchema, UserModelConf
 import { init_models_json, loadModelsJson } from "../../../config/models-json.js";
 import { getProviderRegistry, init_plugin_registry } from "../../../providers/plugin-registry.js";
 import { getAllProviders, init_providers, isProviderConfigured } from "../../../providers/index.js";
-import { normalizeConfiguredMcpServers } from "../../../config/mcp-config-normalize.js";
 import { resolveShareConfig } from "../../../share/share-config.js";
 import { maskTunnelSecretForWeb } from "../../../tunnel/env.js";
+import { normalizeConfiguredMcpServers } from "../../../config/mcp-config-normalize.js";
 import { buildChannelCatalogForConfig, buildChannelCatalogFromSnapshot, getChannelSetupStatus } from "../../../channels/catalog/channel-catalog-service.js";
 import { resolveSessionConfigForWeb, resolveUpdateConfigForWeb } from "../../../config/web-patch.js";
 import { GENERIC_MASKED_SECRET, maskSecretLength } from "./mask-secret-length.js";
@@ -43,10 +43,7 @@ async function maskLlmProviderApiKeyForWeb(provider) {
 function buildSafeMcpConfigForWeb(config) {
 	const mcp = config.mcp;
 	if (!mcp) return { servers: {} };
-	return {
-		...mcp.sessionIdleTtlMs !== void 0 ? { sessionIdleTtlMs: mcp.sessionIdleTtlMs } : {},
-		servers: normalizeConfiguredMcpServers(mcp.servers)
-	};
+	return { servers: normalizeConfiguredMcpServers(mcp.servers) };
 }
 function buildSafeBrowserConfigForWeb(browser) {
 	if (!browser || typeof browser !== "object") return { enabled: false };

package/dist/src/gateway/hono/oauth-async.js

@@ -295,13 +295,20 @@ async function runOAuthFlow(session, oauthProvider, service) {
 			session.deviceCode = prompt.deviceCode;
 			session.verificationUri = prompt.verificationUri;
 			session.message = prompt.message;
-			manualCodePromise = new Promise((resolve, reject) => {
+			manualCodePromise ??= new Promise((resolve, reject) => {
 				manualCodeResolve = resolve;
 				manualCodeReject = reject;
 			});
 			session.manualCodeResolve = manualCodeResolve;
 			session.manualCodeReject = manualCodeReject;
-			return "";
+			const cancel = () => manualCodeReject?.(/* @__PURE__ */ new Error("OAuth prompt cancelled"));
+			prompt.signal?.addEventListener("abort", cancel, { once: true });
+			try {
+				if (prompt.signal?.aborted) cancel();
+				return await manualCodePromise;
+			} finally {
+				prompt.signal?.removeEventListener("abort", cancel);
+			}
 		},
 		onProgress: (message) => {
 			log.debug({

package/dist/src/gateway/hono/routes/agent-plugins.js

@@ -1,6 +1,6 @@
 import { AgentPluginStore } from "../../../extensions/agent-plugins/store.js";
 import { savePluginAuthBinding } from "../../../extensions/agent-plugins/auth.js";
-import { disposeAllSessionMcpRuntimes } from "../../../agent/mcp/bundle-mcp-runtime.js";
+import { evictAllEmbeddedSessionRunners } from "../../../agent/embedded/session-runner.js";
 import { withAgentPluginSource } from "../../../extensions/agent-plugins/sources.js";
 import { agentPluginInventoryRow } from "../../../extensions/agent-plugins/inventory.js";
 import { removePluginCredentials } from "../../../extensions/agent-plugins/credentials.js";
@@ -13,7 +13,7 @@ const sourceBody = z.strictObject({
 function registerAgentPluginRoutes(app, deps) {
 	const store = new AgentPluginStore();
 	const refresh = async () => {
-		await disposeAllSessionMcpRuntimes();
+		evictAllEmbeddedSessionRunners();
 		deps.service.marketplace.reloadSkills();
 	};
 	app.post("/api/extensions/inspect", deps.strictRateLimitMiddleware, async (c) => {
@@ -123,12 +123,7 @@ function registerAgentPluginRoutes(app, deps) {
 	app.put("/api/extensions/agent-plugins/:id/mcp/:server/auth", deps.strictRateLimitMiddleware, async (c) => {
 		try {
 			const body = z.strictObject({
-				mode: z.enum([
-					"auto",
-					"oauth",
-					"api-key",
-					"none"
-				]),
+				mode: z.enum(["auto", "api-key"]),
 				secrets: z.array(z.strictObject({
 					target: z.enum(["headers", "env"]),
 					key: z.string(),
@@ -152,7 +147,7 @@ function registerAgentPluginRoutes(app, deps) {
 				removeData: z.boolean().optional(),
 				removeCredentials: z.boolean().optional()
 			}).parse(await c.req.json());
-			await disposeAllSessionMcpRuntimes();
+			evictAllEmbeddedSessionRunners();
 			if (body.removeCredentials) await removePluginCredentials(store, c.req.param("id"));
 			store.remove(c.req.param("id"), body.removeData);
 			deps.service.marketplace.reloadSkills();

package/dist/src/gateway/hono/routes/agents.js

@@ -1,8 +1,8 @@
-import { normalizeAgentId } from "../../../agent-catalog/id.js";
 import { AgentEntrySchema, AgentModelsOverrideSchema, AgentProfileSchema, RuntimePolicySchema, SkillOverrideSchema, ToolPoliciesSchema, WorkflowPolicySchema } from "../../../agent-config/schema.js";
 import { init_agent_config } from "../../../agent-config/index.js";
+import { normalizeAgentId } from "../../../agent-catalog/id.js";
 import { init_agent_scope } from "../../../agent/agent-scope.js";
-import { createGatewayAgent, deleteAgentAvatarFile, deleteGatewayAgent, getGatewayAgentEffectiveConfig, listAgentProfileFiles, listGatewayAgents, readAgentAvatarFile, readAgentProfileFile, updateGatewayAgent, writeAgentAvatarFromBase64, writeAgentProfileFile } from "../../agents-admin.js";
+import { createGatewayAgent, deleteAgentAvatarFile, deleteGatewayAgent, getGatewayAgentEffectiveConfig, listAgentProfileFiles, listGatewayAgents, readAgentAvatarFile, readAgentProfileFile, resolveAgentAvatarImage, updateGatewayAgent, writeAgentAvatarFromBase64, writeAgentProfileFile } from "../../agents-admin.js";
 import { getVoiceModelsConfig } from "../../../config/voice.js";
 //#region src/gateway/hono/routes/agents.ts
 init_agent_config();
@@ -208,7 +208,8 @@ function registerAgentsRoutes(authenticated, deps) {
 		});
 	});
 	authenticated.get("/api/agents/:id/avatar", async (c) => {
-		const res = await readAgentAvatarFile(normalizeAgentId(c.req.param("id") ?? ""));
+		const id = normalizeAgentId(c.req.param("id") ?? "");
+		const res = c.req.query("resolve") === "1" ? await resolveAgentAvatarImage(id) : await readAgentAvatarFile(id);
 		if (res.ok === false) return c.json({
 			ok: false,
 			error: { message: res.error }
@@ -217,7 +218,7 @@ function registerAgentsRoutes(authenticated, deps) {
 			status: 200,
 			headers: {
 				"Content-Type": res.data.contentType,
-				"Cache-Control": "private, max-age=3600"
+				"Cache-Control": c.req.query("resolve") === "1" ? "private, no-store" : "private, max-age=3600"
 			}
 		});
 	});

package/dist/src/gateway/hono/routes/config-patch/misc.js

@@ -1,10 +1,10 @@
 import { BindingsSchema, init_binding_schema } from "../../../../routing/binding-schema.js";
+import { AgentCatalogService } from "../../../../agent-catalog/service.js";
 import { CredentialResolver, init_credentials } from "../../../../auth/credentials.js";
 import { ComputerConfigSchema, init_config } from "../../../../computer/config.js";
 import { ContextPlanningConfigSchema, HomeIntelligenceConfigSchema, KnowledgeMemoryConfigSchema, UserContextConfigSchema, UserModelConfigSchema, init_config as init_config$1 } from "../../../../user-context/config.js";
 import { BrowserConfigSchema, McpConfigSchema, VoiceConfigSchema, init_schema } from "../../../../config/schema.js";
 import { canonicalizeConfiguredMcpServer } from "../../../../config/mcp-config-normalize.js";
-import { AgentCatalogService } from "../../../../agent-catalog/service.js";
 import { mergeGatewaySkillsMarketplacePatch, mergeSessionConfigPatch, mergeUpdateConfigPatch } from "../../../../config/web-patch.js";
 import { assertGatewayAuthConfigured, resolveGatewayAuth } from "../../../auth.js";
 import { isMaskedSecretPatchValue } from "../../lib/mask-secret-length.js";

package/dist/src/gateway/hono/routes/connection-waits.js

@@ -13,14 +13,11 @@ const actionSchema = z.object({
 		"cancel",
 		"select_account",
 		"confirm_scope",
-		"replace_source",
-		"submit_callback"
+		"replace_source"
 	]),
 	candidateRef: z.string().optional(),
 	needKey: z.string().optional(),
-	accountId: z.string().optional(),
-	callbackUrl: z.string().max(16384).optional(),
-	instanceId: z.string().optional()
+	accountId: z.string().optional()
 }).strict();
 function registerConnectionWaitRoutes(app, { service, strictRateLimitMiddleware }) {
 	app.get("/api/sessions/:conversationId/connection-wait", (c) => {

package/dist/src/gateway/hono/routes/connectors.js

@@ -22,14 +22,13 @@ import { getConnectorInstance, getInstalledConnectorDefinition, listConnectorIns
 import { installConnector, installConnectorDefinition, uninstallConnector, updateConnectorConfig } from "../../../connectors/install.js";
 import { ConfigPersistenceError, persistConfigMutation } from "../../../config/config-mutation.js";
 import { resumeApprovedConnectorAction } from "../../../connectors/approval-resume.js";
-import { getMcpOAuthManager } from "../../../agent/mcp/oauth/mcp-oauth-manager.js";
 import { startConnectorAuthorization } from "../../../connectors/auth-provider-registry.js";
 import { composioLogoResponse } from "../../../connectors/composio-logo.js";
 import { inspectManagedComposioStatus } from "../../../connectors/composio-managed-client.js";
 import { appendComposioTriggerEvent, listComposioTriggerEvents } from "../../../connectors/composio-triggers.js";
 import { ingestLocalFolderSource } from "../../../connectors/connected-source-ingestion.js";
 import { listUnderstandingSourceGrants, revokeUnderstandingSourceGrant } from "../../../user-context/sources/repository.js";
-import { previewConnectorDefinition, testConnectorInstance } from "../../../connectors/health.js";
+import { testConnectorInstance } from "../../../connectors/health.js";
 import { setConnectorEnabled } from "../../../connectors/lifecycle.js";
 import { projectComposioConnectionStatus } from "../../../connectors/runtime-status.js";
 import { getGatewayPrincipal } from "../../security/gateway-principal.js";
@@ -82,35 +81,7 @@ function registerConnectorRoutes(authenticated, deps) {
 					connectionStatus: connected ? "connected" : "disconnected"
 				};
 			}
-			if (!instance.enabled || instance.materialized.type !== "mcp") return instance;
-			const server = config.mcp?.servers?.[instance.materialized.serverId];
-			if (!server) return instance;
-			const oauth = await getMcpOAuthManager().status(instance.materialized.serverId, server);
-			if (!oauth.configured) return instance;
-			if (oauth.status === "connected") return {
-				...instance,
-				authStatus: "connected",
-				connectionStatus: "connected"
-			};
-			if (oauth.status === "authorizing") return {
-				...instance,
-				status: "connecting",
-				authStatus: "unknown",
-				connectionStatus: "connecting"
-			};
-			if (oauth.status === "error") return {
-				...instance,
-				status: "failed",
-				authStatus: "unauthorized",
-				connectionStatus: "error",
-				lastError: oauth.session?.error ?? instance.lastError
-			};
-			return {
-				...instance,
-				status: "unauthorized",
-				authStatus: "missing",
-				connectionStatus: "disconnected"
-			};
+			return instance;
 		}));
 		const connections = listConnectorConnections({ principalId: "local-owner" });
 		return c.json({
@@ -586,27 +557,6 @@ function registerConnectorRoutes(authenticated, deps) {
 			}
 		});
 	});
-	authenticated.post("/api/connectors/preview", strictRateLimitMiddleware, async (c) => {
-		const body = await c.req.json().catch(() => ({}));
-		const definition = body && typeof body === "object" && !Array.isArray(body) && body.definition && typeof body.definition === "object" && !Array.isArray(body.definition) ? body.definition : void 0;
-		if (!definition) return c.json({
-			ok: false,
-			error: "Missing connector definition."
-		}, 400);
-		const input = body && typeof body === "object" && !Array.isArray(body) ? body : {};
-		try {
-			const preview = await previewConnectorDefinition(service.currentConfig, definition, input);
-			return c.json({
-				ok: true,
-				payload: { preview }
-			});
-		} catch (error) {
-			return c.json({
-				ok: false,
-				error: errorMessage(error)
-			}, 400);
-		}
-	});
 	authenticated.get("/api/connectors/composio/:toolkit/health", async (c) => {
 		const health = await inspectComposioConnectorHealth(c.req.param("toolkit"));
 		return c.json({
@@ -880,12 +830,12 @@ function registerConnectorRoutes(authenticated, deps) {
 			ok: false,
 			error: `Connector instance not found: ${instanceId}`
 		}, 404);
-		if (instance.materialized.type !== "mcp" && instance.materialized.type !== "cli") return c.json({
+		if (instance.materialized.type !== "cli") return c.json({
 			ok: false,
-			error: `Connector type "${instance.materialized.type}" does not support MCP health checks.`
+			error: `Connector type "${instance.materialized.type}" does not support CLI health checks. Use xopc mcp list for MCP diagnostics.`
 		}, 400);
 		try {
-			const result = await testConnectorInstance(config, instance.materialized.type === "mcp" ? instance.materialized.serverId : instance.instanceId);
+			const result = await testConnectorInstance(config, instance.instanceId);
 			await persistConfigMutation({
 				config,
 				mutate: () => recordConnectorHealthUsage(config, instance.instanceId, result),
@@ -987,11 +937,6 @@ function registerConnectorRoutes(authenticated, deps) {
 		const instanceId = c.req.param("id");
 		const config = service.currentConfig;
 		try {
-			const definition = getInstalledConnectorDefinition(config, instanceId);
-			const installed = getConnectorInstance(config, instanceId);
-			const serverId = installed?.materialized.type === "mcp" ? installed.materialized.serverId : void 0;
-			const rawServer = serverId ? config.mcp?.servers?.[serverId] : void 0;
-			if (definition?.auth.mode === "oauth" && definition.runtime.type === "mcp" && rawServer) await getMcpOAuthManager().disconnect(serverId, rawServer);
 			const instance = await persistConfigMutation({
 				config,
 				mutate: () => uninstallConnector(config, instanceId),

package/dist/src/gateway/hono/routes/device-authorizations.d.ts

@@ -0,0 +1,3 @@
+import type { Hono } from 'hono';
+import type { AuthenticatedRouteDeps } from './deps.js';
+export declare function registerDeviceAuthorizationRoutes(app: Hono, deps: AuthenticatedRouteDeps): void;