@xopcai/xopc 0.0.375 → 0.0.377

package/dist/gateway/static/root/index.html

@@ -11,7 +11,7 @@
     <link rel="apple-touch-icon" sizes="180x180" href="/apple-touch-icon.png?v=20260910-1" />
     <link rel="manifest" href="/site.webmanifest?v=20260910-1" />
     <title>XOPC — Keep what matters moving.</title>
-    <script type="module" crossorigin src="/assets/index-CgvOIDy_.js"></script>
+    <script type="module" crossorigin src="/assets/index-DU5FmDQh.js"></script>
     <link rel="modulepreload" crossorigin href="/assets/rolldown-runtime-aKtaBQYM.js">
     <link rel="modulepreload" crossorigin href="/assets/preload-helper-zJ_50EbN.js">
     <link rel="modulepreload" crossorigin href="/assets/vendor-react-BOUWij0V.js">
@@ -25,15 +25,15 @@
     <link rel="modulepreload" crossorigin href="/assets/download-Dk-ZjtO6.js">
     <link rel="modulepreload" crossorigin href="/assets/plus-Q2yW6OE7.js">
     <link rel="modulepreload" crossorigin href="/assets/x-B_N4OPjy.js">
-    <link rel="modulepreload" crossorigin href="/assets/messages-C1SUo4gG.js">
-    <link rel="modulepreload" crossorigin href="/assets/locale-store-rWFLl-p4.js">
+    <link rel="modulepreload" crossorigin href="/assets/messages-Cn25s55n.js">
+    <link rel="modulepreload" crossorigin href="/assets/locale-store-DSsLH7JO.js">
     <link rel="modulepreload" crossorigin href="/assets/cn-JdwAhgNB.js">
     <link rel="modulepreload" crossorigin href="/assets/schemas-CObaziC7.js">
     <link rel="modulepreload" crossorigin href="/assets/local-apps-yys1VChX.js">
     <link rel="modulepreload" crossorigin href="/assets/product-delivery-BAks11S4.js">
     <link rel="modulepreload" crossorigin href="/assets/app-link-4gpFbdsr.js">
     <link rel="modulepreload" crossorigin href="/assets/copy-to-clipboard-HOJ79TWv.js">
-    <link rel="modulepreload" crossorigin href="/assets/markdown-view-BHFFusQs.js">
+    <link rel="modulepreload" crossorigin href="/assets/markdown-view-2rwSrMXW.js">
     <link rel="modulepreload" crossorigin href="/assets/check-DUBLcKHA.js">
     <link rel="modulepreload" crossorigin href="/assets/copy-Dv6d4Dvw.js">
     <link rel="modulepreload" crossorigin href="/assets/button-CS04eWY9.js">
@@ -69,29 +69,29 @@
     <link rel="modulepreload" crossorigin href="/assets/rotate-cw-LIg3Am9S.js">
     <link rel="modulepreload" crossorigin href="/assets/search-DA7gz22f.js">
     <link rel="modulepreload" crossorigin href="/assets/index.module-Cd9ENXfk.js">
-    <link rel="modulepreload" crossorigin href="/assets/gateway-startup-retry-TYSQEQcG.js">
-    <link rel="modulepreload" crossorigin href="/assets/session-api-u_4_kFQt.js">
+    <link rel="modulepreload" crossorigin href="/assets/gateway-startup-retry-CeL1OFDZ.js">
+    <link rel="modulepreload" crossorigin href="/assets/session-api-BUa3BaGX.js">
     <link rel="modulepreload" crossorigin href="/assets/constants-Dy8Gw0sF.js">
     <link rel="modulepreload" crossorigin href="/assets/app-chrome-BeB4KgOf.js">
     <link rel="modulepreload" crossorigin href="/assets/attachment-utils-core-BIOUBrpT.js">
     <link rel="modulepreload" crossorigin href="/assets/files-Bw4SBGdM.js">
-    <link rel="modulepreload" crossorigin href="/assets/workspace-api-CXiyhTwv.js">
+    <link rel="modulepreload" crossorigin href="/assets/workspace-api-B5ssQs4p.js">
     <link rel="modulepreload" crossorigin href="/assets/electron-env-Dit0bHgy.js">
     <link rel="modulepreload" crossorigin href="/assets/use-async-resource-GrnWNwMZ.js">
-    <link rel="modulepreload" crossorigin href="/assets/activity-store-BeYLqqr8.js">
-    <link rel="modulepreload" crossorigin href="/assets/use-file-preview-expanded-Du37Gofn.js">
+    <link rel="modulepreload" crossorigin href="/assets/activity-store-BVtU6S1w.js">
+    <link rel="modulepreload" crossorigin href="/assets/use-file-preview-expanded-D4WI5JDn.js">
     <link rel="modulepreload" crossorigin href="/assets/mic-CuUb7zc-.js">
     <link rel="modulepreload" crossorigin href="/assets/globe-DSSGFWFn.js">
-    <link rel="modulepreload" crossorigin href="/assets/share-link-dialog-XhiuPKF4.js">
-    <link rel="modulepreload" crossorigin href="/assets/local-session-drafts-Cg9RdsNN.js">
+    <link rel="modulepreload" crossorigin href="/assets/share-link-dialog-CbkS1cj-.js">
+    <link rel="modulepreload" crossorigin href="/assets/local-session-drafts-DnSw14fE.js">
     <link rel="modulepreload" crossorigin href="/assets/tasks-DwKXgZ-I.js">
-    <link rel="modulepreload" crossorigin href="/assets/capabilities-CquUV0DP.js">
+    <link rel="modulepreload" crossorigin href="/assets/capabilities-LpGa-olH.js">
     <link rel="modulepreload" crossorigin href="/assets/skill-wire-pattern-BPpeIcCi.js">
-    <link rel="modulepreload" crossorigin href="/assets/shares-api-BVSb1vh4.js">
-    <link rel="modulepreload" crossorigin href="/assets/capabilities-D4KFLtqM.js">
-    <link rel="modulepreload" crossorigin href="/assets/use-composer-attachments-Dxphaxk-.js">
+    <link rel="modulepreload" crossorigin href="/assets/shares-api-BUGeqXCG.js">
+    <link rel="modulepreload" crossorigin href="/assets/capabilities-HaRLmYU1.js">
+    <link rel="modulepreload" crossorigin href="/assets/use-composer-attachments-Bb_Hqqry.js">
     <link rel="modulepreload" crossorigin href="/assets/git-branch-Dh9uxTot.js">
-    <link rel="modulepreload" crossorigin href="/assets/notes-api-CSLVCZBn.js">
+    <link rel="modulepreload" crossorigin href="/assets/notes-api-D9fGUbkK.js">
     <link rel="modulepreload" crossorigin href="/assets/message-square-fVE7Ghj1.js">
     <link rel="modulepreload" crossorigin href="/assets/pause-DuPxgSxk.js">
     <link rel="modulepreload" crossorigin href="/assets/play-kxZvpBg8.js">
@@ -99,24 +99,24 @@
     <link rel="modulepreload" crossorigin href="/assets/settings-2-D-csvaET.js">
     <link rel="modulepreload" crossorigin href="/assets/sparkles-DHlfQFAF.js">
     <link rel="modulepreload" crossorigin href="/assets/middleware-Pd0e8Igk.js">
-    <link rel="modulepreload" crossorigin href="/assets/gateway-realtime-store-cLCDEe4D.js">
-    <link rel="modulepreload" crossorigin href="/assets/gateway-realtime-C3WQQY10.js">
+    <link rel="modulepreload" crossorigin href="/assets/gateway-realtime-store-BazlseY_.js">
+    <link rel="modulepreload" crossorigin href="/assets/gateway-realtime-Biz18NiE.js">
     <link rel="modulepreload" crossorigin href="/assets/tool-activity-BtJkgjFf.js">
-    <link rel="modulepreload" crossorigin href="/assets/registry-api-CoMBYjHD.js">
-    <link rel="modulepreload" crossorigin href="/assets/gateway-config-swr-BoRkBnsw.js">
-    <link rel="modulepreload" crossorigin href="/assets/agents-admin-api-B4tgTbWG.js">
-    <link rel="modulepreload" crossorigin href="/assets/session-manager-B06ZCie_.js">
-    <link rel="modulepreload" crossorigin href="/assets/send-session-input-CLhR1uEp.js">
-    <link rel="modulepreload" crossorigin href="/assets/theme-store-KcQhCg1-.js">
-    <link rel="modulepreload" crossorigin href="/assets/extension-provider-DxlAZ2iy.js">
+    <link rel="modulepreload" crossorigin href="/assets/registry-api-ZhIt79wL.js">
+    <link rel="modulepreload" crossorigin href="/assets/gateway-config-swr-siY2J0hx.js">
+    <link rel="modulepreload" crossorigin href="/assets/agents-admin-api-DgQph1Pu.js">
+    <link rel="modulepreload" crossorigin href="/assets/session-manager-BWLIDok4.js">
+    <link rel="modulepreload" crossorigin href="/assets/send-session-input-B64q4_6R.js">
+    <link rel="modulepreload" crossorigin href="/assets/theme-store-Kz0VUMSb.js">
+    <link rel="modulepreload" crossorigin href="/assets/extension-provider-B-_CkaD2.js">
     <link rel="modulepreload" crossorigin href="/assets/loopi-Djb8XU3l.js">
-    <link rel="modulepreload" crossorigin href="/assets/models-hub-cache-Jj8dvYcv.js">
+    <link rel="modulepreload" crossorigin href="/assets/models-hub-cache-DaqiLHPe.js">
     <link rel="modulepreload" crossorigin href="/assets/skill-api-utils-C7V4JVXM.js">
     <link rel="modulepreload" crossorigin href="/assets/date-formatters-CUZAyDEg.js">
     <link rel="modulepreload" crossorigin href="/assets/settings-form-draft-Dy10ldo8.js">
     <link rel="stylesheet" crossorigin href="/assets/markdown-view-DSjfHfaW.css">
     <link rel="stylesheet" crossorigin href="/assets/loopi-C09I2mNj.css">
-    <link rel="stylesheet" crossorigin href="/assets/index-BGBkIIzM.css">
+    <link rel="stylesheet" crossorigin href="/assets/index-CGVecvp4.css">
   </head>
   <body>
     <div id="root"></div>

package/dist/package.js

@@ -1,4 +1,4 @@
 //#region package.json
-var version = "0.0.375";
+var version = "0.0.377";
 //#endregion
 export { version };

package/dist/src/agent/agent-manager.js

@@ -6,10 +6,11 @@ import { consumeClarificationApproval, init_clarification_wait_repository } from
 import { getInteractionState } from "../storage/sqlite/interaction-state-repository.js";
 import { getSessionMetadata } from "../storage/sqlite/session-read-repository.js";
 import { init_sqlite } from "../storage/sqlite/index.js";
-import { resolveUserContextSessionAccess } from "../user-context/access-policy.js";
-import { enqueueConversationLearning } from "../memory-learning/repository.js";
 import { expandWorkspacePathString, init_workspace_path } from "../config/workspace-path.js";
 import { init_agent_scope, listAgentEntries, resolveAgentProfileDir } from "./agent-scope.js";
+import { extractTextContent } from "./context/workspace.js";
+import { resolveUserContextSessionAccess } from "../user-context/access-policy.js";
+import { enqueueConversationLearning } from "../memory-learning/repository.js";
 import { resolveEffectiveAgentProfile, resolveEffectiveAgentProfileForSession } from "../config/agent-profile.js";
 import { getAgentDefaultModelRef, init_schema } from "../config/schema.js";
 import { init_paths, resolveBundledSkillsDir } from "../config/paths.js";
@@ -20,7 +21,6 @@ import { createExtensionAwareStreamFn } from "../providers/extension-stream-brid
 import { traceTools } from "../observability/runtime.js";
 import { continuesAfterTool, trackAiUsageStream } from "../usage/recorder.js";
 import { MemoryLearningService } from "../memory-learning/service.js";
-import { extractTextContent } from "./context/workspace.js";
 import { runPersistentLearningJob } from "./background-review/run-background-review.js";
 import { applyConfigOverrides } from "../config/runtime-overrides.js";
 import { isPersonalConversation } from "../personal-agent/repository.js";

package/dist/src/agent/background-review/run-background-review.js

@@ -5,6 +5,7 @@ import { finishContextExtractionRun } from "../../storage/sqlite/context-extract
 import { getSessionMetadata } from "../../storage/sqlite/session-read-repository.js";
 import { loadCompactionSourceSnapshot } from "../../storage/sqlite/transcript-repository.js";
 import { init_sqlite } from "../../storage/sqlite/index.js";
+import { extractTextContent } from "../context/workspace.js";
 import { resolveUserContextSessionAccess } from "../../user-context/access-policy.js";
 import { failLearningJob, finishLearningJob, learningPolicyHash } from "../../memory-learning/repository.js";
 import { extractProfileAgentId } from "../../config/agent-profile.js";
@@ -21,7 +22,6 @@ import { getAssertionSlot, listUserAssertions } from "../../user-model/repositor
 import { emptyUserModelCaptureResult, executeUserModelInterpretation } from "../../user-model/capture/executor.js";
 import { parseUserModelInterpretation } from "../../user-model/capture/semantic.js";
 import "../../user-model/capture/index.js";
-import { extractTextContent } from "../context/workspace.js";
 import { readAgentMessageContent } from "../memory/agent-message-access.js";
 import { resolveAgentTurnTimeoutMs, runAgentTurnWithTimeout } from "../orchestration/run-agent-turn-with-timeout.js";
 import { isAssistantTurnAborted, isAssistantTurnFailed } from "../orchestration/llm-turn-retry.js";

package/dist/src/agent/external-tools/endpoint-provider.js

@@ -1,7 +1,7 @@
-import { init_src } from "../../../packages/computer-control-contract/src/index.js";
-import "../../../packages/browser-control-contract/src/index.js";
 import { ExternalEffectNotAppliedError, executeExternalOperation } from "../../capabilities/runtime/external-operations.js";
 import { canonicalCapabilityJson } from "../../capabilities/runtime/dispatcher.js";
+import { init_src } from "../../../packages/computer-control-contract/src/index.js";
+import "../../../packages/browser-control-contract/src/index.js";
 import { externalToolRef, parseExternalToolRef } from "./refs.js";
 import { extractDocumentText } from "../../document-understanding/extract.js";
 import { prepareImageForModel } from "../image/prepare-image-for-model.js";

package/dist/src/agent/mcp/connection-setup.d.ts

@@ -0,0 +1,21 @@
+import type { Config } from '../../config/schema.js';
+export type McpConnectionProbe = {
+    state: 'connected' | 'oauth_required' | 'token_required' | 'error';
+    toolCount?: number;
+    error?: string;
+};
+export declare function probeMcpConnection(config: Config, workspace: string, serverId: string): Promise<McpConnectionProbe>;
+export type McpAuthorization = {
+    id: string;
+    serverId: string;
+    state: 'starting' | 'authorizing' | 'connected' | 'error' | 'cancelled';
+    authorizationUrl?: string;
+    acceptsRedirect?: boolean;
+    toolCount?: number;
+    error?: string;
+};
+/** A UI bridge to native pi's login command; no host-owned OAuth client or token store. */
+export declare function startMcpAuthorization(config: Config, workspace: string, serverId: string, owner: string): McpAuthorization;
+export declare function getMcpAuthorization(id: string, owner: string, config: Config): McpAuthorization | undefined;
+export declare function cancelMcpAuthorization(id: string, owner: string): boolean;
+export declare function submitMcpRedirect(id: string, owner: string, redirectUrl: string, config: Config): boolean;

package/dist/src/agent/mcp/connection-setup.js

@@ -0,0 +1,214 @@
+import { isManagedConnectorServer } from "../../connectors/materialize.js";
+import { prepareNativeMcpConfig } from "./native-mcp.js";
+import { McpAuthenticationRequiredError, discoverMcpTools, signInNativeMcp } from "./tool-catalog.js";
+import { createHash, randomUUID } from "node:crypto";
+//#region src/agent/mcp/connection-setup.ts
+function httpUrl(value) {
+	const url = new URL(value);
+	if (!["http:", "https:"].includes(url.protocol) || url.username || url.password) throw new Error("Use an HTTP or HTTPS MCP address without embedded credentials.");
+	return url;
+}
+async function metadata(url) {
+	try {
+		const response = await fetch(url, {
+			signal: AbortSignal.timeout(5e3),
+			redirect: "error",
+			headers: { Accept: "application/json" }
+		});
+		if (!response.ok) return;
+		const result = await response.json();
+		if (result && typeof result === "object" && !Array.isArray(result)) return result;
+	} catch {}
+}
+/** A 401 alone is not evidence that a service supports OAuth. */
+async function advertisesOAuth(config, workspace, serverId) {
+	const entry = (await prepareNativeMcpConfig(config, workspace)).servers.find((server) => server.name === serverId);
+	if (!entry || !("url" in entry.config)) return false;
+	const url = httpUrl(entry.config.url);
+	if (Object.keys(entry.config.headers ?? {}).some((name) => name.toLowerCase() === "authorization")) return false;
+	const response = await fetch(url, {
+		method: "POST",
+		signal: AbortSignal.timeout(1e4),
+		redirect: "error",
+		headers: {
+			Accept: "application/json, text/event-stream",
+			"Content-Type": "application/json",
+			...entry.config.headers
+		},
+		body: JSON.stringify({
+			jsonrpc: "2.0",
+			id: 1,
+			method: "initialize",
+			params: {
+				protocolVersion: "2025-03-26",
+				capabilities: {},
+				clientInfo: {
+					name: "xopc",
+					version: "1"
+				}
+			}
+		})
+	});
+	const challenge = response.headers.get("WWW-Authenticate") ?? "";
+	await response.body?.cancel();
+	const resourceMetadata = /resource_metadata\s*=\s*"([^"\s]+)"/i.exec(challenge)?.[1];
+	const candidates = [
+		...resourceMetadata ? [httpUrl(resourceMetadata)] : [],
+		new URL(`/.well-known/oauth-protected-resource${url.pathname === "/" ? "" : url.pathname}`, url),
+		new URL("/.well-known/oauth-protected-resource", url)
+	];
+	for (const candidate of candidates) {
+		const data = await metadata(candidate);
+		if (data && typeof data.resource === "string" && data.resource === url.href && Array.isArray(data.authorization_servers) && data.authorization_servers.some((value) => {
+			try {
+				return typeof value === "string" && Boolean(httpUrl(value));
+			} catch {
+				return false;
+			}
+		})) return true;
+	}
+	if (!/\bBearer\b/i.test(challenge)) return false;
+	const legacy = await metadata(new URL("/.well-known/oauth-authorization-server", url));
+	return Boolean(legacy && legacy.issuer === url.origin && typeof legacy.authorization_endpoint === "string" && typeof legacy.token_endpoint === "string");
+}
+async function probeMcpConnection(config, workspace, serverId) {
+	try {
+		return {
+			state: "connected",
+			toolCount: (await discoverMcpTools(config, workspace, serverId)).length
+		};
+	} catch (error) {
+		if (error instanceof McpAuthenticationRequiredError) try {
+			return { state: await advertisesOAuth(config, workspace, serverId) ? "oauth_required" : "token_required" };
+		} catch (error) {
+			return {
+				state: "error",
+				error: error instanceof Error ? error.message : String(error)
+			};
+		}
+		const server = config.mcp?.servers?.[serverId];
+		if (server?.url && Object.keys(server.headers ?? {}).some((name) => name.toLowerCase() === "authorization") && /401|403|unauthorized|forbidden/i.test(String(error))) return { state: "token_required" };
+		return {
+			state: "error",
+			error: error instanceof Error ? error.message : String(error)
+		};
+	}
+}
+const attempts = /* @__PURE__ */ new Map();
+function fingerprint(config, serverId) {
+	const server = config.mcp?.servers?.[serverId];
+	return createHash("sha256").update(JSON.stringify(server ? {
+		...server,
+		xopcConnector: void 0
+	} : null)).digest("hex");
+}
+function finish(attempt) {
+	attempt.dispose?.();
+	attempt.dispose = void 0;
+	attempt.redirect?.(void 0);
+	attempt.redirect = void 0;
+	attempt.result.acceptsRedirect = false;
+}
+function cancel(attempt) {
+	if (attempt.result.state === "starting" || attempt.result.state === "authorizing") {
+		attempt.result.state = "cancelled";
+		attempt.controller.abort();
+		finish(attempt);
+	}
+}
+/** A UI bridge to native pi's login command; no host-owned OAuth client or token store. */
+function startMcpAuthorization(config, workspace, serverId, owner) {
+	const server = config.mcp?.servers?.[serverId];
+	if (!server?.url || server.enabled === false || isManagedConnectorServer(server) && server.xopcConnector.enabled === false) throw new Error("An enabled HTTP MCP server is required.");
+	httpUrl(server.url);
+	if (server.auth || Object.keys(server.headers ?? {}).some((name) => name.toLowerCase() === "authorization")) throw new Error("This server uses configured credentials. Remove Authorization before using OAuth.");
+	for (const attempt of attempts.values()) if (attempt.owner === owner && attempt.result.serverId === serverId) cancel(attempt);
+	if (attempts.size >= 100) throw new Error("Too many pending sign-ins. Try again later.");
+	const attempt = {
+		owner,
+		fingerprint: fingerprint(config, serverId),
+		controller: new AbortController(),
+		result: {
+			id: randomUUID(),
+			serverId,
+			state: "starting"
+		}
+	};
+	attempts.set(attempt.result.id, attempt);
+	const expiry = setTimeout(() => cancel(attempt), 18e4);
+	expiry.unref();
+	setTimeout(() => {
+		cancel(attempt);
+		attempts.delete(attempt.result.id);
+	}, 10 * 6e4).unref();
+	signInNativeMcp(structuredClone(config), workspace, serverId, {
+		signal: attempt.controller.signal,
+		onAuthorizationUrl(url) {
+			const parsed = httpUrl(url);
+			if (attempt.controller.signal.aborted) return;
+			attempt.result.authorizationUrl = parsed.href;
+			attempt.result.state = "authorizing";
+		},
+		requestRedirectUrl(signal) {
+			if (signal?.aborted || attempt.controller.signal.aborted) return Promise.resolve(void 0);
+			attempt.result.acceptsRedirect = true;
+			return new Promise((resolve) => {
+				const stop = () => resolve(void 0);
+				signal?.addEventListener("abort", stop, { once: true });
+				attempt.redirect = resolve;
+				attempt.dispose = () => signal?.removeEventListener("abort", stop);
+			});
+		}
+	}).then((tools) => {
+		if (!attempt.controller.signal.aborted) {
+			attempt.result.state = "connected";
+			attempt.result.toolCount = tools.length;
+			delete attempt.result.authorizationUrl;
+		}
+	}).catch((error) => {
+		if (!attempt.controller.signal.aborted) {
+			attempt.result.state = "error";
+			attempt.result.error = error instanceof Error ? error.message : String(error);
+			delete attempt.result.authorizationUrl;
+		}
+	}).finally(() => {
+		clearTimeout(expiry);
+		finish(attempt);
+	});
+	return { ...attempt.result };
+}
+function getMcpAuthorization(id, owner, config) {
+	const attempt = attempts.get(id);
+	if (!attempt || attempt.owner !== owner) return;
+	if (attempt.fingerprint !== fingerprint(config, attempt.result.serverId)) {
+		cancel(attempt);
+		attempt.result = {
+			id,
+			serverId: attempt.result.serverId,
+			state: "cancelled"
+		};
+	}
+	return { ...attempt.result };
+}
+function cancelMcpAuthorization(id, owner) {
+	const attempt = attempts.get(id);
+	if (!attempt || attempt.owner !== owner) return false;
+	cancel(attempt);
+	return true;
+}
+function submitMcpRedirect(id, owner, redirectUrl, config) {
+	const result = getMcpAuthorization(id, owner, config);
+	const attempt = attempts.get(id);
+	if (!result || !attempt?.redirect || result.state !== "authorizing" || !result.authorizationUrl) return false;
+	const authorization = new URL(result.authorizationUrl);
+	const expected = authorization.searchParams.get("redirect_uri");
+	if (!expected) return false;
+	const target = new URL(expected);
+	const actual = httpUrl(redirectUrl);
+	if (actual.origin !== target.origin || actual.pathname !== target.pathname || actual.searchParams.get("state") !== authorization.searchParams.get("state") || !actual.searchParams.get("code")) return false;
+	attempt.redirect(actual.href);
+	attempt.redirect = void 0;
+	return true;
+}
+//#endregion
+export { cancelMcpAuthorization, getMcpAuthorization, probeMcpConnection, startMcpAuthorization, submitMcpRedirect };

package/dist/src/agent/mcp/tool-catalog.d.ts

@@ -0,0 +1,18 @@
+import type { Config } from '../../config/schema.js';
+export type McpCatalogTool = {
+    name: string;
+    description: string;
+    inputSchema: unknown;
+    exposure?: string;
+};
+export declare class McpAuthenticationRequiredError extends Error {
+}
+export type McpLoginInteraction = {
+    signal: AbortSignal;
+    onAuthorizationUrl: (url: string) => void;
+    requestRedirectUrl: (signal?: AbortSignal) => Promise<string | undefined>;
+};
+/** A short-lived native session discovers tools without making a model request. */
+export declare function discoverMcpTools(config: Config, workspaceDir: string, serverId: string): Promise<McpCatalogTool[]>;
+/** Native pi owns PKCE, registration, callbacks, token storage and refresh. */
+export declare function signInNativeMcp(config: Config, workspaceDir: string, serverId: string, interaction: McpLoginInteraction): Promise<McpCatalogTool[]>;

package/dist/src/agent/mcp/tool-catalog.js

@@ -0,0 +1,120 @@
+import { createEmbeddedModelRuntime } from "../embedded/model-runtime.js";
+import { getNativePiAgentDir, prepareNativeMcpConfig } from "./native-mcp.js";
+import { join } from "node:path";
+import { InMemoryCredentialStore, InMemoryModelsStore } from "@earendil-works/pi-ai";
+import { DefaultResourceLoader, ModelRuntime, SessionManager, SettingsManager, createAgentSession, createMcpExtension, createToolSearchExtension } from "@earendil-works/pi-coding-agent";
+//#region src/agent/mcp/tool-catalog.ts
+var McpAuthenticationRequiredError = class extends Error {};
+/** A short-lived native session discovers tools without making a model request. */
+async function discoverMcpTools(config, workspaceDir, serverId) {
+	return runNativeMcpSession(config, workspaceDir, serverId);
+}
+/** Native pi owns PKCE, registration, callbacks, token storage and refresh. */
+async function signInNativeMcp(config, workspaceDir, serverId, interaction) {
+	return runNativeMcpSession(config, workspaceDir, serverId, interaction);
+}
+async function runNativeMcpSession(config, workspaceDir, serverId, interaction) {
+	const entry = (await prepareNativeMcpConfig(config, workspaceDir)).servers.find((server) => server.name === serverId);
+	if (!entry) throw new Error(`MCP server "${serverId}" is not configured or has invalid configuration.`);
+	if (entry.config.enabled === false) throw new Error(`MCP server "${serverId}" is disabled.`);
+	const agentDir = getNativePiAgentDir();
+	const settingsManager = SettingsManager.inMemory({
+		retry: { enabled: false },
+		compaction: { enabled: false }
+	});
+	const loader = new DefaultResourceLoader({
+		cwd: workspaceDir,
+		agentDir,
+		settingsManager,
+		noExtensions: true,
+		noSkills: true,
+		noPromptTemplates: true,
+		noThemes: true,
+		noContextFiles: true,
+		extensionFactories: [createToolSearchExtension(), createMcpExtension({
+			loadConfig: () => ({
+				servers: [entry],
+				errors: [],
+				autoEnableCodemode: false
+			}),
+			logPath: join(agentDir, "mcp.log"),
+			openUrl: (url) => interaction?.onAuthorizationUrl(url)
+		})]
+	});
+	await loader.reload();
+	const provider = "url" in entry.config ? entry.config.auth?.provider : void 0;
+	const { session } = await createAgentSession({
+		cwd: workspaceDir,
+		agentDir,
+		resourceLoader: loader,
+		settingsManager,
+		modelRuntime: provider ? await createEmbeddedModelRuntime(provider) : await ModelRuntime.create({
+			credentials: new InMemoryCredentialStore(),
+			modelsStore: new InMemoryModelsStore(),
+			modelsPath: null,
+			refreshOnCreate: false
+		}),
+		sessionManager: SessionManager.inMemory(),
+		noTools: "builtin"
+	});
+	let failure;
+	let signedIn = false;
+	let shutdown;
+	const close = () => shutdown ??= session.extensionRunner?.emit({
+		type: "session_shutdown",
+		reason: "quit"
+	}) ?? Promise.resolve();
+	const abort = () => {
+		close();
+	};
+	try {
+		const runner = session.extensionRunner;
+		if (!runner) throw new Error("Native MCP extension is unavailable.");
+		await session.bindExtensions({ uiContext: {
+			...runner.getUIContext(),
+			notify(message) {
+				if (message.startsWith("MCP servers need attention:") || message.startsWith("MCP failed to load:")) failure = message;
+				if (message.startsWith("Signed in to MCP server")) signedIn = true;
+				if (message.startsWith("Sign-in ") || message.startsWith("Signed in, but")) failure = message;
+			},
+			input(_title, _placeholder, options) {
+				return interaction?.requestRedirectUrl(options?.signal) ?? Promise.resolve(void 0);
+			}
+		} });
+		interaction?.signal.addEventListener("abort", abort, { once: true });
+		if (interaction?.signal.aborted) throw new Error("MCP sign-in cancelled.");
+		let timer;
+		try {
+			await Promise.race([session.prompt("/mcp"), new Promise((_resolve, reject) => {
+				timer = setTimeout(() => reject(/* @__PURE__ */ new Error("MCP tool discovery timed out.")), 6e4);
+			})]);
+		} finally {
+			clearTimeout(timer);
+		}
+		if (interaction) {
+			failure = void 0;
+			await session.prompt(`/mcp login ${serverId}`);
+			if (interaction.signal.aborted) throw new Error("MCP sign-in cancelled.");
+			if (failure || !signedIn) throw new Error(failure ?? "MCP sign-in did not complete.");
+		} else if (failure) {
+			if (/needs sign-in|needs-auth/.test(failure)) throw new McpAuthenticationRequiredError(failure);
+			throw new Error(failure);
+		}
+		const namespace = `mcp__${serverId.replace(/-/g, "_")}`;
+		return session.getAllTools().filter((tool) => tool.namespace?.name === namespace).map((tool) => ({
+			name: tool.name,
+			description: tool.description,
+			inputSchema: tool.parameters,
+			exposure: tool.exposure
+		})).sort((a, b) => a.name.localeCompare(b.name));
+	} finally {
+		try {
+			interaction?.signal.removeEventListener("abort", abort);
+			await close();
+		} finally {
+			session.dispose();
+		}
+	}
+}
+//#endregion
+export { McpAuthenticationRequiredError, discoverMcpTools, signInNativeMcp };

package/dist/src/agent/service/process-direct-streaming.js

@@ -3,8 +3,8 @@ import { init_src } from "../../../packages/gateway-contract/src/index.js";
 import { init_session_input_repository, listTaskUpdateTriggers } from "../../storage/sqlite/session-input-repository.js";
 import { getClarificationResumeInput, init_clarification_wait_repository } from "../../storage/sqlite/clarification-wait-repository.js";
 import { getConnectionResumeInput, init_connection_wait_repository } from "../../storage/sqlite/connection-wait-repository.js";
-import { init_agent_session_key, resolveAgentMainConversationId } from "../../routing/agent-session-key.js";
 import { init_agent_scope, resolveDefaultAgentId } from "../agent-scope.js";
+import { init_agent_session_key, resolveAgentMainConversationId } from "../../routing/agent-session-key.js";
 import { readAgentMessageContent } from "../memory/agent-message-access.js";
 import { abortEmbeddedRun } from "../embedded/runs.js";
 import { clearPendingTranscriptUserMessage, setPendingTranscriptUserMessage } from "../inbound/attachment-pipeline.js";

package/dist/src/agent/service.js

@@ -1,14 +1,14 @@
 import { createLogger } from "../utils/logger/index.js";
 import { init_logger } from "../utils/logger.js";
 import { init_attachment_ref, parseNoteAttachmentTarget } from "../notes/attachment-ref.js";
-import { init_agent_session_key, resolveAgentIdFromConversationId } from "../routing/agent-session-key.js";
 import { init_agent_scope, resolveAgentHomeDir, resolveDefaultAgentId } from "./agent-scope.js";
+import { extractTextContent } from "./context/workspace.js";
+import { init_agent_session_key, resolveAgentIdFromConversationId } from "../routing/agent-session-key.js";
 import { extractProfileAgentId, resolveEffectiveAgentConfigForSession } from "../config/agent-profile.js";
 import { getAgentDefaultModelRef, init_schema } from "../config/schema.js";
 import { init_providers, resolveModel } from "../providers/index.js";
 import { configureTracing, flushTracing } from "../observability/runtime.js";
 import { getUserTimezone } from "../user-model/repository.js";
-import { extractTextContent } from "./context/workspace.js";
 import { resolveAgentTurnTimeoutMs } from "./orchestration/run-agent-turn-with-timeout.js";
 import { applyConfigOverrides } from "../config/runtime-overrides.js";
 import { effectiveWorkspacePathForSession } from "../session/session-workspace.js";

package/dist/src/agent/session/session-config-service.js

@@ -8,7 +8,6 @@ import { normalizeWorkingDirectoryInput } from "../../session/session-workspace.
 import { getProjectWorkspacePathForSession } from "../../projects/workspace.js";
 import { isPersonalConversation } from "../../personal-agent/repository.js";
 import { getModelThinking } from "../../providers/model-thinking.js";
-import { savePersonalModelConfig } from "../../personal-agent/model-config.js";
 import { normalizeReasoningLevel, normalizeThinkLevel, normalizeVerboseLevel } from "../transcript/thinking-types.js";
 import "../../session/index.js";
 import { mkdir } from "node:fs/promises";
@@ -28,8 +27,7 @@ var SessionConfigService = class {
 	* invalid field. Model and thinking are validated together and committed in one write.
 	*/
 	async patch(conversationId, partial) {
-		const personal = isPersonalConversation(conversationId);
-		const configuredThinking = personal ? void 0 : resolveEffectiveAgentConfigForSession(conversationId).config.runtime.thinkingLevel;
+		const configuredThinking = isPersonalConversation(conversationId) ? void 0 : resolveEffectiveAgentConfigForSession(conversationId).config.runtime.thinkingLevel;
 		if (configuredThinking && partial.thinkingLevel !== void 0 && partial.thinkingLevel !== configuredThinking) return {
 			ok: false,
 			code: "INVALID_THINKING",
@@ -70,7 +68,7 @@ var SessionConfigService = class {
 				};
 				const thinkingLevel = requested ?? chooseModelThinking(capabilities, existing?.thinkingLevel);
 				const modelRef = `${model.provider}/${model.id}`;
-				const updated = personal ? savePersonalModelConfig(conversationId, modelRef, thinkingLevel) : await this.opts.sessionConfigStore.update(conversationId, {
+				const updated = await this.opts.sessionConfigStore.update(conversationId, {
 					modelOverride: modelRef,
 					thinkingLevel,
 					fixedModel: partial.fixedModel ?? existing?.fixedModel ?? false

package/dist/src/agent/skills/index.js

@@ -1,8 +1,8 @@
 import { resolveStateDir } from "../../config/paths-state.js";
 import { createLogger } from "../../utils/logger/index.js";
 import { init_logger } from "../../utils/logger.js";
-import { init_paths } from "../../config/paths.js";
 import { parseFrontmatter } from "../../markdown/frontmatter.js";
+import { init_paths } from "../../config/paths.js";
 import { findInstallSpec, hasBinary, installSkill } from "./installer.js";
 import { applySkillEnvOverrides, createSkillConfigManager, getSkillEnvironment, isSkillEnabled, resolveSkillConfig, validateSkillConfig } from "./config.js";
 import { parseSkillToolConditions } from "./skill-tool-gating.js";

package/dist/src/agent/skills/managed-store.js

@@ -1,5 +1,5 @@
-import { init_paths, resolveSkillsDir } from "../../config/paths.js";
 import { parseFrontmatter } from "../../markdown/frontmatter.js";
+import { init_paths, resolveSkillsDir } from "../../config/paths.js";
 import { loadSkillsLock } from "./hub-lock.js";
 import { dirname, join, resolve, sep } from "node:path";
 import { existsSync, mkdirSync, readFileSync, readdirSync, renameSync, rmSync, writeFileSync } from "node:fs";

package/dist/src/agent/skills/skill-manage-ops.js

@@ -1,5 +1,5 @@
-import { init_paths, resolveSkillsDir } from "../../config/paths.js";
 import { parseFrontmatter } from "../../markdown/frontmatter.js";
+import { init_paths, resolveSkillsDir } from "../../config/paths.js";
 import { resolveWorkspaceSkillsDir } from "./workspace-skills-dir.js";
 import { formatScanSummary, scanSkillDirectory } from "./scanner.js";
 import { fuzzyFindText, normalizeForFuzzyMatch, normalizeToLF, restoreLineEndings } from "../tools/edit-diff.js";

package/dist/src/agent/tools/factory.js

@@ -8,8 +8,8 @@ import { getSessionMetadata } from "../../storage/sqlite/session-read-repository
 import { patchSessionMetadata } from "../../storage/sqlite/session-repository.js";
 import { getSessionTaskPlan, setSessionTaskPlan } from "../../storage/sqlite/session-task-plan-repository.js";
 import { init_sqlite } from "../../storage/sqlite/index.js";
-import { resolveUserContextSessionAccess } from "../../user-context/access-policy.js";
 import { init_agent_scope, resolveDefaultAgentId } from "../agent-scope.js";
+import { resolveUserContextSessionAccess } from "../../user-context/access-policy.js";
 import { resolveEffectiveAgentConfigForAgent, resolveEffectiveAgentConfigForSession } from "../../config/agent-profile.js";
 import { createPersonalAttentionTool } from "./personal-attention-tool.js";
 import { markCodemodeCoreRead } from "./codemode-permissions.js";