@xopcai/xopc 0.0.395 → 0.0.397

package/dist/src/agent/mcp/connection-setup.js

@@ -2,6 +2,7 @@ import { createLogger } from "../../utils/logger/index.js";
 import { init_logger } from "../../utils/logger.js";
 import { isManagedConnectorServer } from "../../connectors/materialize.js";
 import { prepareNativeMcpConfig } from "./native-mcp.js";
+import { resolveMcpSetupConfig } from "./effective-server.js";
 import { classifyMcpConnectionError } from "./connection-errors.js";
 import { McpAuthenticationRequiredError, discoverMcpTools, signInNativeMcp } from "./tool-catalog.js";
 import { createHash, randomUUID } from "node:crypto";
@@ -83,6 +84,7 @@ async function advertisesOAuth(config, workspace, serverId, signal) {
 	return Boolean(legacy && legacy.issuer === url.origin && typeof legacy.authorization_endpoint === "string" && typeof legacy.token_endpoint === "string");
 }
 async function probeMcpConnection(config, workspace, serverId, options) {
+	config = resolveMcpSetupConfig(config, serverId);
 	try {
 		return {
 			state: "connected",
@@ -116,6 +118,7 @@ async function probeMcpConnection(config, workspace, serverId, options) {
 }
 const attempts = /* @__PURE__ */ new Map();
 function fingerprint(config, serverId) {
+	config = resolveMcpSetupConfig(config, serverId);
 	const server = config.mcp?.servers?.[serverId];
 	return createHash("sha256").update(JSON.stringify(server ? {
 		...server,
@@ -138,6 +141,7 @@ function cancel(attempt) {
 }
 /** A UI bridge to native pi's login command; no host-owned OAuth client or token store. */
 function startMcpAuthorization(config, workspace, serverId, owner, options) {
+	config = resolveMcpSetupConfig(config, serverId);
 	const server = config.mcp?.servers?.[serverId];
 	if (!server?.url || server.enabled === false || isManagedConnectorServer(server) && server.xopcConnector.enabled === false) throw new Error("An enabled HTTP MCP server is required.");
 	httpUrl(server.url);
@@ -227,7 +231,15 @@ function submitMcpRedirect(id, owner, redirectUrl, config) {
 	if (!expected) return false;
 	const target = new URL(expected);
 	const actual = httpUrl(redirectUrl);
-	if (actual.origin !== target.origin || actual.pathname !== target.pathname || actual.searchParams.get("state") !== authorization.searchParams.get("state") || !actual.searchParams.get("code")) return false;
+	if (actual.origin !== target.origin || actual.pathname !== target.pathname || actual.searchParams.get("state") !== authorization.searchParams.get("state")) return false;
+	if (actual.searchParams.has("error")) {
+		cancel(attempt);
+		attempt.result.state = "error";
+		attempt.result.error = "Sign-in was declined or could not be completed. Try again.";
+		delete attempt.result.authorizationUrl;
+		return true;
+	}
+	if (!actual.searchParams.get("code")) return false;
 	attempt.redirect(actual.href);
 	attempt.redirect = void 0;
 	return true;

package/dist/src/agent/mcp/effective-server.d.ts

@@ -0,0 +1,3 @@
+import type { Config } from '../../config/schema.js';
+/** Resolve a single explicit setup target without enabling it for any agent. */
+export declare function resolveMcpSetupConfig(config: Config, serverId: string): Config;

package/dist/src/agent/mcp/effective-server.js

@@ -0,0 +1,27 @@
+import { AgentPluginStore } from "../../extensions/agent-plugins/store.js";
+import { materializePluginServers } from "../../extensions/agent-plugins/mcp-adapter.js";
+//#region src/agent/mcp/effective-server.ts
+/** Resolve a single explicit setup target without enabling it for any agent. */
+function resolveMcpSetupConfig(config, serverId) {
+	if (Object.hasOwn(config.mcp?.servers ?? {}, serverId)) return config;
+	const store = new AgentPluginStore();
+	for (const installed of store.list()) {
+		const plugin = store.pending(installed.id) ?? installed;
+		if (plugin.readiness === "blocked") continue;
+		const servers = materializePluginServers(plugin, store, [], true);
+		if (!Object.hasOwn(servers, serverId)) continue;
+		return {
+			...config,
+			mcp: {
+				...config.mcp,
+				servers: {
+					...config.mcp?.servers,
+					[serverId]: servers[serverId]
+				}
+			}
+		};
+	}
+	return config;
+}
+//#endregion
+export { resolveMcpSetupConfig };

package/dist/src/agent/mcp/native-mcp.d.ts

@@ -8,4 +8,4 @@ export type NativeMcpConfig = LoadedMcpConfig & {
     credentialAliases?: Record<string, string>;
 };
 /** Only projects host configuration and secret references; all MCP execution belongs to pi. */
-export declare function prepareNativeMcpConfig(config: Config, workspaceDir: string): Promise<NativeMcpConfig>;
+export declare function prepareNativeMcpConfig(config: Config, workspaceDir: string, agentId?: string): Promise<NativeMcpConfig>;

package/dist/src/agent/mcp/native-mcp.js

@@ -1,6 +1,7 @@
 import { init_paths_state, resolveStateDir } from "../../config/paths-state.js";
 import { McpServerSchema, init_schema } from "../../config/schema.js";
 import { resolveConnectorSecretReferences } from "../../connectors/secret-store.js";
+import { validPluginOAuthReference } from "../../extensions/agent-plugins/connection-reuse.js";
 import { createNativeMcpCredentials, routeNativeMcpCredentials } from "./credential-store.js";
 import { loadMergedMcpConfig } from "./config.js";
 import { join } from "node:path";
@@ -20,17 +21,19 @@ function getNativePiAgentDir() {
 	return directory;
 }
 /** Only projects host configuration and secret references; all MCP execution belongs to pi. */
-async function prepareNativeMcpConfig(config, workspaceDir) {
+async function prepareNativeMcpConfig(config, workspaceDir, agentId) {
 	getNativePiAgentDir();
 	const merged = loadMergedMcpConfig({
 		cfg: config,
-		workspaceDir
+		workspaceDir,
+		agentId
 	});
 	const result = {
 		servers: [],
 		errors: merged.diagnostics.map((item) => item.message)
 	};
 	const names = /* @__PURE__ */ new Set();
+	const aliases = /* @__PURE__ */ new Map();
 	for (const [name, raw] of Object.entries(merged.config.mcpServers)) {
 		const normalized = name.replace(/-/g, "_");
 		if (!/^[a-zA-Z0-9_-]+$/.test(name) || names.has(normalized)) {
@@ -38,6 +41,12 @@ async function prepareNativeMcpConfig(config, workspaceDir) {
 			continue;
 		}
 		names.add(normalized);
+		const reference = raw.xopcPluginOAuthReference;
+		if (reference && !validPluginOAuthReference(reference, config, raw)) {
+			result.errors.push(`Shared MCP connection changed: ${name}. Reconnect this plugin.`);
+			continue;
+		}
+		if (typeof raw.xopcOAuthCredentialId === "string") aliases.set(name, raw.xopcOAuthCredentialId);
 		const parsed = McpServerSchema.safeParse(raw);
 		if (!parsed.success) {
 			result.errors.push(`Invalid MCP server ${name}: ${parsed.error.message}`);
@@ -61,14 +70,14 @@ async function prepareNativeMcpConfig(config, workspaceDir) {
 			"description"
 		].filter((key) => value[key] !== void 0).map((key) => [key, value[key]]));
 		if (projected.type === "streamable-http") projected.type = "http";
+		const plugin = raw.xopcPlugin;
 		result.servers.push({
 			name,
 			config: projected,
-			source: "xopc.json",
+			source: plugin?.revision ? `plugin:${plugin.id}@${plugin.revision}` : "xopc.json",
 			scope: "extension"
 		});
 	}
-	const aliases = new Map(Object.entries(config.mcp?.servers ?? {}).filter(([, value]) => typeof value.xopcOAuthCredentialId === "string").map(([name, value]) => [name, value.xopcOAuthCredentialId]));
 	if (aliases.size) {
 		result.credentials = routeNativeMcpCredentials(await createNativeMcpCredentials(), aliases);
 		result.credentialAliases = Object.fromEntries(aliases);

package/dist/src/agent/mcp/tool-catalog.js

@@ -1,5 +1,6 @@
 import { createEmbeddedModelRuntime } from "../embedded/model-runtime.js";
 import { getNativePiAgentDir, prepareNativeMcpConfig } from "./native-mcp.js";
+import { resolveMcpSetupConfig } from "./effective-server.js";
 import { join } from "node:path";
 import { InMemoryCredentialStore, InMemoryModelsStore } from "@earendil-works/pi-ai";
 import { DefaultResourceLoader, ModelRuntime, SessionManager, SettingsManager, createAgentSession, createMcpExtension, createToolSearchExtension } from "@earendil-works/pi-coding-agent";
@@ -16,7 +17,7 @@ async function signInNativeMcp(config, workspaceDir, serverId, interaction, opti
 async function runNativeMcpSession(config, workspaceDir, serverId, interaction, options) {
 	const signal = interaction?.signal ?? options?.signal;
 	signal?.throwIfAborted();
-	const loaded = await prepareNativeMcpConfig(config, workspaceDir);
+	const loaded = await prepareNativeMcpConfig(resolveMcpSetupConfig(config, serverId), workspaceDir);
 	signal?.throwIfAborted();
 	const entry = loaded.servers.find((server) => server.name === serverId);
 	if (!entry) throw new Error(`MCP server "${serverId}" is not configured or has invalid configuration.`);

package/dist/src/agent/skills/index.d.ts

@@ -40,6 +40,7 @@ export interface SkillLoader {
     getEnabledSkills: (config?: Record<string, SkillConfig>) => Skill[];
 }
 export interface SkillLoaderOptions {
+    agentId?: string;
     /** Re-evaluated on every load so trust changes take effect without recreating the runtime. */
     isWorkspaceTrusted?: (workspaceDir: string) => boolean;
 }

package/dist/src/agent/skills/index.js

@@ -135,7 +135,10 @@ function discoverAndMergeSkills(sources, maxSkillFileBytes, limits = {}, initial
 			skills: source.skillFiles.slice(0, limits.maxSkillsLoadedPerSource).flatMap((path) => {
 				const result = loadSkillFromFile(path, source, source.rootDir, maxSkillFileBytes);
 				if (result.diagnostic) diagnostics.push(result.diagnostic);
-				return result.skill ? [result.skill] : [];
+				return result.skill ? [{
+					...result.skill,
+					name: source.skillAliases?.[path] ?? result.skill.name
+				}] : [];
 			}),
 			diagnostics: []
 		} : discoverSkills(source, maxSkillFileBytes, limits.maxSkillsLoadedPerSource, limits.maxCandidatesPerRoot);
@@ -320,7 +323,8 @@ function createSkillLoader(options = {}) {
 		return loadSkills({
 			workspaceDir,
 			builtinDir,
-			workspaceTrust
+			workspaceTrust,
+			agentId: options.agentId
 		});
 	}
 	return {

package/dist/src/agent/skills/skill-manager.d.ts

@@ -10,6 +10,7 @@ export interface SkillLoadResult {
     diagnostics: SkillDiagnostic[];
 }
 export interface SkillManagerOptions {
+    agentId?: string;
     isWorkspaceTrusted?: (workspaceDir: string) => boolean;
 }
 export declare class SkillManager {

package/dist/src/agent/skills/skill-manager.js

@@ -35,7 +35,10 @@ var SkillManager = class {
 	constructor(workspace, bundledSkillsDir, options = {}) {
 		this.workspace = workspace;
 		this.bundledSkillsDir = bundledSkillsDir || resolveBundledSkillsDir();
-		this.skillLoader = createSkillLoader({ isWorkspaceTrusted: options.isWorkspaceTrusted });
+		this.skillLoader = createSkillLoader({
+			agentId: options.agentId,
+			isWorkspaceTrusted: options.isWorkspaceTrusted
+		});
 		this.initialize();
 	}
 	/**
@@ -216,12 +219,14 @@ var SkillManager = class {
 	* Find a skill by name
 	*/
 	findSkill(name) {
+		this.refreshPlugins();
 		return this.skills.find((s) => s.name === name);
 	}
 	/**
 	* Check if a skill exists
 	*/
 	hasSkill(name) {
+		this.refreshPlugins();
 		return this.skills.some((s) => s.name === name);
 	}
 	/**

package/dist/src/agent/skills/skill-sources.d.ts

@@ -1,6 +1,7 @@
 import type { SkillDiagnostic, SkillSourceDescriptor, SkillsConfig } from './types.js';
 export interface ResolveSkillSourcesOptions {
     workspaceDir?: string;
+    agentId?: string;
     globalDir?: string;
     builtinDir?: string;
     agentsDir?: string;

package/dist/src/agent/skills/skill-sources.js

@@ -48,15 +48,16 @@ function resolveSkillSources(options, skillsConfig) {
 	const extraDirs = [...configuredExtraDirs, ...optionExtraDirs];
 	const sources = [];
 	const diagnostics = [];
-	for (const plugin of new AgentPluginStore().active()) {
+	for (const plugin of new AgentPluginStore().active(options.agentId, options.workspaceDir)) {
 		sources.push({
 			id: `plugin:${plugin.id}`,
-			rootDir: join(plugin.rootDir, "skills"),
+			rootDir: plugin.rootDir,
 			priority: 150,
 			scope: "global",
 			managed: false,
 			writable: false,
-			skillFiles: plugin.skills.map((skill) => skill.filePath)
+			skillFiles: plugin.skills.map((skill) => skill.filePath),
+			skillAliases: plugin.layout?.dialect !== "portable" ? Object.fromEntries(plugin.skills.map((skill) => [skill.filePath, `${plugin.id}.${skill.name}`])) : void 0
 		});
 		diagnostics.push(...plugin.diagnostics.map((diagnostic) => ({
 			type: "warning",

package/dist/src/agent/skills/types.d.ts

@@ -111,6 +111,7 @@ export interface SkillSourceDescriptor {
     writable: boolean;
     /** Validated portable plugin files; bypass recursive discovery. */
     skillFiles?: string[];
+    skillAliases?: Record<string, string>;
 }
 export type SkillOrigin = SkillSourceDescriptor;
 export interface SkillsLimitsConfig {

package/dist/src/agent/workspace-runtime/registry.js

@@ -23,11 +23,15 @@ var WorkspaceRuntimeRegistry = class {
 	/** Lazily construct and cache an agent-scoped runtime for a workspace. */
 	getOrCreate(resolvedPath, requestedAgentId) {
 		const cfg = this.getConfig();
-		const runtimeKey = `${normalizeAgentId(requestedAgentId?.trim() || resolveAgentIdForWorkspacePath(resolvedPath))}\u0000${resolvedPath}`;
+		const agentId = normalizeAgentId(requestedAgentId?.trim() || resolveAgentIdForWorkspacePath(resolvedPath));
+		const runtimeKey = `${agentId}\u0000${resolvedPath}`;
 		const existing = this.runtimes.get(runtimeKey);
 		if (existing) return existing;
 		const { memoryManager } = this.userContextRuntimes.getOrCreate(cfg);
-		const skillManager = new SkillManager(resolvedPath, this.bundledSkillsDir, { isWorkspaceTrusted: () => this.isWorkspaceTrusted?.(resolvedPath) === true });
+		const skillManager = new SkillManager(resolvedPath, this.bundledSkillsDir, {
+			agentId,
+			isWorkspaceTrusted: () => this.isWorkspaceTrusted?.(resolvedPath) === true
+		});
 		const rt = {
 			skillManager,
 			systemPromptBuilder: new SystemPromptBuilder({

package/dist/src/browser/native-messaging-host.js

@@ -4,8 +4,8 @@ import { init_src } from "../../packages/gateway-contract/src/index.js";
 import { getGatewayIdentityPublicKeyRaw, getOrCreateGatewayIdentity, init_gateway_identity_repository } from "../storage/sqlite/gateway-identity-repository.js";
 import { createDevicePairingSetup, init_device_pairing_repository } from "../storage/sqlite/device-pairing-repository.js";
 import { loadConfig } from "../config/loader.js";
-import { browserEnrollmentPublicKeyThumbprint } from "./enrollment.js";
 import { BROWSER_EXTENSION_ID, BROWSER_NATIVE_HOST_NAME } from "./extension-identity.js";
+import { browserEnrollmentPublicKeyThumbprint } from "./enrollment.js";
 import os from "node:os";
 //#region src/browser/native-messaging-host.ts
 init_src();

package/dist/src/browser/providers/browser-ext-install.js

@@ -4,10 +4,10 @@ import { createLogger } from "../../utils/logger/index.js";
 import { init_logger } from "../../utils/logger.js";
 import { init_write_file_atomic, writeTextAtomic } from "../../infra/write-file-atomic.js";
 import { init_paths, resolveBinDir, resolveConfigPath } from "../../config/paths.js";
-import { assertCacheDir } from "../cache-dir-policy.js";
+import { resolvePackageRoot } from "../../infra/update-check.js";
 import { BROWSER_EXTENSION_ID, BROWSER_NATIVE_HOST_NAME } from "../extension-identity.js";
+import { assertCacheDir } from "../cache-dir-policy.js";
 import "../native-messaging-host.js";
-import { resolvePackageRoot } from "../../infra/update-check.js";
 import { dirname, join } from "node:path";
 import { chmodSync, existsSync, mkdirSync, readFileSync, readdirSync, realpathSync, renameSync, rmSync, statSync, writeFileSync } from "node:fs";
 import { fileURLToPath } from "node:url";

package/dist/src/channels/index.js

@@ -7,8 +7,8 @@ import { compileAllowlist, evaluateAccess, hasBotMention, removeBotMention, reso
 import { renderMarkdownWithMarkers } from "../markdown/render.js";
 import { convertMarkdownTables } from "../markdown/tables.js";
 import { buildCodeSpanIndex, createInlineCodeState } from "../markdown/code-spans.js";
+import { ChannelManager, createChannelManager } from "./manager.js";
 import "./format.js";
 import { MessagePipeline, createEnvelopeTimestampHandler, createFilterCommandsHandler, createFilterEmptyHandler, createFilterSelfHandler, createPipeline, standardPreflightHandlers, standardProcessHandlers } from "./pipeline.js";
-import { ChannelManager, createChannelManager } from "./manager.js";
 import { collectSetupWizardChannels } from "./setup-wizard-discovery.js";
 export { ChannelManager, MessagePipeline, buildCodeSpanIndex, chunkMarkdownIR, chunkText, collectSetupWizardChannels, compileAllowlist, convertMarkdownTables, createChannelManager, createEnvelopeTimestampHandler, createFilterCommandsHandler, createFilterEmptyHandler, createFilterSelfHandler, createInlineCodeState, createPipeline, evaluateAccess, findFenceSpanAt, getChannelPlugin, getChannelRegistryVersion, hasBotMention, isSafeFenceBreak, listChannelPlugins, markdownToIR, markdownToIRWithMeta, parseFenceSpans, parseFrontmatterBlock, removeBotMention, renderMarkdownWithMarkers, resolveAllowlistMatch, resolveAllowlistMatchSimple, resolveDmPolicy, resolveGroupPolicy, standardPreflightHandlers, standardProcessHandlers, syncChannelPluginsFromManager };

package/dist/src/channels/manager.js

@@ -1,8 +1,8 @@
 import { createLogger } from "../utils/logger/index.js";
 import { init_logger } from "../utils/logger.js";
 import { ChannelHealthMonitor } from "./health-monitor.js";
-import { ChannelHeartbeatScheduler } from "./heartbeat-scheduler.js";
 import { ChannelPluginRegistry } from "./plugin-registry.js";
+import { ChannelHeartbeatScheduler } from "./heartbeat-scheduler.js";
 import { ChannelOutboundSender } from "./outbound-sender.js";
 import { ChannelLifecycleSupervisor } from "./lifecycle-supervisor.js";
 //#region src/channels/manager.ts

package/dist/src/cli/commands/channels.js

@@ -1,8 +1,8 @@
 import { buildChannelCatalogForConfig } from "../../channels/catalog/channel-catalog-service.js";
 import { loadConfig, saveConfig } from "../../config/loader.js";
+import { formatExamples, register } from "../registry.js";
 import { listChannelPairingState } from "../../channels/pairing/pairing-service.js";
 import { approveChannelPairingFromCli } from "../../channels/pairing/approve-cli.js";
-import { formatExamples, register } from "../registry.js";
 import { colors } from "../utils/colors.js";
 import { Command } from "commander";
 //#region src/cli/commands/channels.ts

package/dist/src/cli/commands/connectors.js

@@ -1,8 +1,8 @@
 import { getStoreConnectorInstallPlan, installStoreConnector, listStoreConnectors } from "../../capabilities/store-connector.js";
 import { loadConfig, saveConfig } from "../../config/loader.js";
 import { register } from "../registry.js";
-import { confirm } from "@inquirer/prompts";
 import { Command } from "commander";
+import { confirm } from "@inquirer/prompts";
 //#region src/cli/commands/connectors.ts
 function parsePairs(values, option) {
 	const output = {};

package/dist/src/cli/commands/doctor/checks/database-schema.js

@@ -53,7 +53,7 @@ async function checkDatabaseSchema(ctx) {
 		id: "database-schema",
 		label: "Database schema",
 		status: "pass",
-		message: `SQLite schema v${status.dbVersion} (current release v256).`,
+		message: `SQLite schema v${status.dbVersion} (current release v257).`,
 		hints: []
 	};
 }

package/dist/src/cli/commands/extension-agent-plugin.js

@@ -1,24 +1,35 @@
+import { getWorkspacePath } from "../../config/workspace-path-helpers.js";
+import { pluginAuthorizations } from "../../extensions/agent-plugins/setup-contract.js";
+import { PLUGIN_MANIFEST_PATHS } from "../../extensions/agent-plugins/formats.js";
+import { pluginServerId } from "../../extensions/agent-plugins/validation.js";
+import { isGitPluginSource } from "../../extensions/agent-plugins/source-catalog.js";
 import { AgentPluginStore } from "../../extensions/agent-plugins/store.js";
 import { loadConfig } from "../../config/loader.js";
 import { getContextWithOpts } from "../context.js";
 import { isAgentPluginArchive, withAgentPluginSource } from "../../extensions/agent-plugins/sources.js";
+import { PluginSetupService } from "../../extensions/agent-plugins/setup.js";
 import { removePluginCredentials } from "../../extensions/agent-plugins/credentials.js";
 import { join, resolve } from "node:path";
 import { existsSync, readFileSync, statSync } from "node:fs";
+import { readFile } from "node:fs/promises";
 import { confirm } from "@inquirer/prompts";
 //#region src/cli/commands/extension-agent-plugin.ts
 function isAgentPluginSource(source) {
-	if (source.startsWith("https://")) return true;
+	if (source.startsWith("https://") || isGitPluginSource(source) || source.includes("#plugin=")) return true;
 	const path = resolve(source);
 	if (existsSync(join(path, "package.json"))) {
 		if (JSON.parse(readFileSync(join(path, "package.json"), "utf8"))?.xopc?.extension) return false;
 	}
-	return existsSync(path) && (statSync(path).isFile() && /\.zip$/i.test(path) && statSync(path).size <= 50 * 1024 * 1024 && isAgentPluginArchive(readFileSync(path)) || existsSync(join(path, "plugin.json")) && !existsSync(join(path, "xopc.extension.json")));
+	return existsSync(path) && (statSync(path).isFile() && /\.zip$/i.test(path) && statSync(path).size <= 50 * 1024 * 1024 && isAgentPluginArchive(readFileSync(path)) || [
+		...PLUGIN_MANIFEST_PATHS,
+		".agents/plugins/marketplace.json",
+		".claude-plugin/marketplace.json"
+	].some((file) => existsSync(join(path, file))) && !existsSync(join(path, "xopc.extension.json")));
 }
 async function installAgentPluginFromCli(source, options) {
 	const store = new AgentPluginStore();
 	const cfg = loadConfig(getContextWithOpts().configPath);
-	const plan = await withAgentPluginSource(source, cfg, (local) => store.inspect(local));
+	const plan = await withAgentPluginSource(source, cfg, (local, _p, _commit, importManifest) => store.inspect(local, source, importManifest));
 	console.log(JSON.stringify({
 		format: "agent-plugin",
 		name: plan.manifest.name,
@@ -34,22 +45,96 @@ async function installAgentPluginFromCli(source, options) {
 			default: false
 		})) return;
 	}
-	const plugin = await withAgentPluginSource(source, cfg, (local, provenance) => store.install(local, {
+	const plugin = await withAgentPluginSource(source, cfg, (local, provenance, resolvedCommit, importManifest) => store.install(local, {
 		reviewHash: plan.reviewHash,
 		replace: options.force,
+		stage: options.force,
 		expectedId: options.expectedId,
-		sourceLabel: source.startsWith("https://") || source.startsWith("store:") ? source : resolve(source),
-		provenance
+		sourceLabel: source,
+		provenance,
+		resolvedCommit,
+		importManifest
 	}));
+	if (plugin.readiness !== "blocked") new PluginSetupService(store).create(plugin.id, "gateway-owner");
 	console.log(`Installed plugin:${plugin.id} (${plugin.receipt.enabled ? "enabled" : "disabled"}).`);
+	if (plugin.readiness !== "blocked") console.log(`Continue with: xopc extensions setup plugin:${plugin.id} --prepare`);
 	return plugin;
 }
 function addAgentPluginLifecycleCommands(command) {
+	command.command("setup").argument("<id>", "plugin:<id>").option("--prepare", "Prepare resources and check tools").option("--authorize <server>", "Authorize a plugin account or show native MCP sign-in instructions").option("--method <id>", "Choose one of the account authorization methods").option("--skip-auth", "Finish installation and authorize later in plugin details").option("--complete", "Finish setup and enable globally for all agents").option("--workspace <paths...>", "Restrict the plugin to these workspace paths").option("--config-file <path>", "Read typed user configuration from a JSON file").option("--allow-partial", "Enable available components after reviewing compatibility limits").option("--cancel", "Cancel preparation").action(async (raw, options) => {
+		const store = new AgentPluginStore(), setup = new PluginSetupService(store), id = raw.replace(/^plugin:/, "");
+		const cfg = loadConfig(getContextWithOpts().configPath), workspace = getWorkspacePath(cfg) || process.cwd(), owner = "gateway-owner";
+		let job = setup.create(id, owner);
+		const declaration = pluginAuthorizations((store.pending(id) ?? store.get(id)).manifest).find((value) => value.id === options.authorize);
+		const method = declaration?.methods.find((value) => value.id === (options.method ?? declaration.methods[0]?.id));
+		if (options.configFile) job = await setup.act(id, owner, {
+			action: "configure",
+			expectedRevision: job.revision,
+			values: JSON.parse(await readFile(options.configFile, "utf8")),
+			...method?.type === "form" ? {
+				authorization: declaration.id,
+				method: method.id
+			} : {}
+		}, cfg, workspace);
+		if (options.prepare || declaration) job = await setup.act(id, owner, {
+			action: "prepare",
+			expectedRevision: job.revision
+		}, cfg, workspace);
+		if (options.authorize) if (declaration) {
+			if (!method) throw new Error("Unknown authorization method");
+			if (method.type !== "form") {
+				job = await setup.act(id, owner, {
+					action: "authorize",
+					expectedRevision: job.revision,
+					server: declaration.id,
+					method: method.id
+				}, cfg, workspace);
+				let lastUrl = "";
+				for (;;) {
+					const attempt = await setup.authorization(id, owner, declaration.id, cfg);
+					if (!attempt) throw new Error("Sign-in is unavailable. Retry authorization.");
+					const url = "challenge" in attempt ? attempt.challenge?.url : "authorizationUrl" in attempt ? attempt.authorizationUrl : void 0;
+					if (url && url !== lastUrl) {
+						console.log(`Complete sign-in: ${url}`);
+						lastUrl = url;
+					}
+					if (attempt.state === "connected") break;
+					if (["cancelled", "error"].includes(attempt.state)) throw new Error("Sign-in did not complete. Retry authorization.");
+					await new Promise((resolve) => setTimeout(resolve, 1e3));
+				}
+				job = await setup.act(id, owner, {
+					action: "prepare",
+					expectedRevision: job.revision
+				}, cfg, workspace);
+			} else if (!options.configFile) throw new Error("Provide credential fields with --config-file");
+		} else {
+			if (!job.connections.some((c) => c.name === options.authorize)) throw new Error("Unknown plugin MCP server");
+			console.log(`Sign in with: xopc mcp login ${pluginServerId(id, options.authorize)}`);
+		}
+		if (options.complete) job = await setup.act(id, owner, {
+			action: "complete",
+			expectedRevision: job.revision,
+			workspacePaths: options.workspace,
+			allowPartial: options.allowPartial === true
+		}, cfg, workspace);
+		if (options.skipAuth) job = await setup.act(id, owner, {
+			action: "defer",
+			expectedRevision: job.revision
+		}, cfg, workspace);
+		if (options.cancel) job = await setup.act(id, owner, {
+			action: "cancel",
+			expectedRevision: job.revision
+		}, cfg, workspace);
+		console.log(JSON.stringify(job, null, 2));
+	});
 	command.command("rollback").argument("<id>", "plugin:<name>").action((raw) => {
 		console.log(JSON.stringify(new AgentPluginStore().rollback(raw.replace(/^plugin:/, "")), null, 2));
 	});
 	for (const action of ["enable", "disable"]) command.command(action).argument("<id>", "plugin:<name>").action((raw) => {
-		const plugin = new AgentPluginStore().setEnabled(raw.replace(/^plugin:/, ""), action === "enable");
+		const store = new AgentPluginStore(), id = raw.replace(/^plugin:/, "");
+		const job = new PluginSetupService(store).get(id, "gateway-owner");
+		if (action === "enable" && job && job.state !== "completed") throw new Error("Finish plugin setup before enabling");
+		const plugin = store.setEnabled(id, action === "enable");
 		console.log(`${plugin.id}: ${action}d`);
 	});
 	command.command("remove").argument("<id>", "plugin:<name>").option("--remove-data", "Also remove persistent plugin data").option("--remove-credentials", "Also delete local credentials").action(async (raw, options) => {

package/dist/src/cli/commands/extension-marketplace.js

@@ -16,8 +16,8 @@ import { existsSync, readFileSync, statSync } from "node:fs";
 import { execSync } from "node:child_process";
 import { createHash } from "node:crypto";
 import semver from "semver";
-import { confirm } from "@inquirer/prompts";
 import { Command } from "commander";
+import { confirm } from "@inquirer/prompts";
 //#region src/cli/commands/extension-marketplace.ts
 init_paths();
 const MANIFEST = "xopc.extension.json";
@@ -224,7 +224,7 @@ async function installExtensionFromStoreWithLock(params) {
 	}
 }
 function createExtensionInstallCommand() {
-	return new Command("install").description("Install a native extension or portable Agent Plugin from an explicit source").argument("<target>", "store:<id>, npm:<package>, local directory, or Agent Plugin ZIP / HTTPS ZIP URL").option("-f, --force", "Replace an existing store or local extension with the same manifest id", false).option("-y, --yes", "Skip interactive install confirmation", false).action(async (target, opts) => {
+	return new Command("install").description("Install a native extension or Codex, Claude or portable Agent Plugin").argument("<target>", "store:<id>, npm:<package>, Git / marketplace source, directory or plugin ZIP").option("-f, --force", "Replace an existing store or local extension with the same manifest id", false).option("-y, --yes", "Skip interactive install confirmation", false).action(async (target, opts) => {
 		if (isAgentPluginSource(target)) {
 			await installAgentPluginFromCli(target, opts);
 			return;

package/dist/src/cli/commands/extension.js

@@ -78,7 +78,7 @@ function createExtensionInspectCommand() {
 		try {
 			if (extensionId.startsWith("plugin:") || extensionId.startsWith("store:") || isAgentPluginSource(extensionId)) {
 				const store = new AgentPluginStore();
-				const result = extensionId.startsWith("plugin:") ? store.get(extensionId.slice(7)) : await withAgentPluginSource(extensionId, loadConfig(getContextWithOpts().configPath), (source) => store.inspect(source));
+				const result = extensionId.startsWith("plugin:") ? store.get(extensionId.slice(7)) : await withAgentPluginSource(extensionId, loadConfig(getContextWithOpts().configPath), (source, _p, _commit, importManifest) => store.inspect(source, extensionId, importManifest));
 				if (!result) throw new Error("Plugin not installed");
 				console.log(JSON.stringify(result, null, 2));
 				return;

package/dist/src/cli/commands/mcp.js

@@ -3,6 +3,7 @@ import { loadConfig } from "../../config/loader.js";
 import { register } from "../registry.js";
 import { createGatewayHttpClientFromConfig } from "../../mcp/gateway-http-client.js";
 import { createCapabilityMcpServer } from "../../mcp/capability-server.js";
+import { resolveMcpSetupConfig } from "../../agent/mcp/effective-server.js";
 import { join } from "node:path";
 import { chmodSync, existsSync, readFileSync, writeFileSync } from "node:fs";
 import { main } from "@earendil-works/pi-coding-agent";
@@ -18,24 +19,25 @@ function createMcpCommand(ctx) {
 	]) {
 		const native = command.command(action).description(`Use pi's native MCP ${action}`);
 		if (action !== "list") native.argument("<server>", "Configured MCP server ID");
-		if (action === "list") native.option("--json", "Print pi MCP diagnostics as JSON");
+		if (action === "list") native.option("--json", "Print pi MCP diagnostics as JSON").option("--agent <id>", "Include plugins bound to this agent");
 		if (action === "login") native.option("--timeout <seconds>", "Browser sign-in timeout in seconds");
 		native.action(async (serverOrOptions, loginOptions) => {
 			const server = typeof serverOrOptions === "string" ? serverOrOptions : void 0;
 			const options = typeof serverOrOptions === "string" ? loginOptions : serverOrOptions;
-			const mcp = await prepareNativeMcpConfig(loadConfig(ctx.configPath), ctx.workspacePath || process.cwd());
+			const config = loadConfig(ctx.configPath);
+			const mcp = await prepareNativeMcpConfig(server ? resolveMcpSetupConfig(config, server) : config, ctx.workspacePath || process.cwd(), options?.agent);
 			if (mcp.errors.length) throw new Error(mcp.errors.join("\n"));
 			const path = join(getNativePiAgentDir(), "mcp.json");
 			if (existsSync(path) && JSON.parse(readFileSync(path, "utf8")).xopcGenerated !== true) throw new Error("The pi directory contains a user-managed mcp.json. Use a dedicated PI_CODING_AGENT_DIR for xopc.");
 			if (existsSync(path)) chmodSync(path, 384);
 			writeFileSync(path, JSON.stringify({
 				xopcGenerated: true,
-				mcpServers: Object.fromEntries(mcp.servers.map((entry) => [entry.name, entry.config]))
+				mcpServers: Object.fromEntries(mcp.servers.filter((entry) => !server || entry.name === server).map((entry) => [mcp.credentialAliases?.[entry.name] ?? entry.name, entry.config]))
 			}), { mode: 384 });
 			await main([
 				"mcp",
 				action,
-				...server ? [server] : [],
+				...server ? [mcp.credentialAliases?.[server] ?? server] : [],
 				...action === "list" && options?.json ? ["--json"] : [],
 				...action === "login" && loginOptions?.timeout ? ["--timeout", loginOptions.timeout] : []
 			]);

package/dist/src/cli/commands/models.js

@@ -16,8 +16,8 @@ import { prepareUpdateGlobalDefaults } from "../../gateway/global-defaults-admin
 import { disconnectProvider } from "../../providers/provider-disconnect.js";
 import { colors } from "../utils/colors.js";
 import { runCliOAuthLogin } from "../utils/oauth-login.js";
-import { input } from "@inquirer/prompts";
 import { Command } from "commander";
+import { input } from "@inquirer/prompts";
 //#region src/cli/commands/models.ts
 init_credentials();
 init_schema();

package/dist/src/cli/commands/onboard/model.js

@@ -58,7 +58,7 @@ async function setupCloudCapabilities(config) {
 			nextConfig = next;
 			return { saved: true };
 		}
-	});
+	}, { enableAvailable: true });
 	if (result.configured === false) throw new Error(result.error);
 	return nextConfig;
 }

package/dist/src/cli/commands/onboard.js

@@ -11,8 +11,8 @@ import { initWorkspace } from "../utils/init-workspace.js";
 import { setupModel } from "./onboard/model.js";
 import { getChannelConfigurators } from "./onboard/channels/registry.js";
 import { setupChannels } from "./onboard/channels/index.js";
-import { select } from "@inquirer/prompts";
 import { Command } from "commander";
+import { select } from "@inquirer/prompts";
 //#region src/cli/commands/onboard.ts
 init_repository();
 init_schema();