@xopcai/xopc 0.0.399 → 0.0.401

package/dist/src/extensions/agent-plugins/capability-access.js

@@ -0,0 +1,101 @@
+import { pluginAuthorizations } from "./setup-contract.js";
+import { join } from "node:path";
+import { existsSync, readFileSync } from "node:fs";
+import { z } from "zod";
+//#region src/extensions/agent-plugins/capability-access.ts
+const authorization = z.union([z.string().min(1), z.strictObject({
+	id: z.string().min(1),
+	scopes: z.array(z.string().min(1)).max(100)
+})]);
+const requirement = z.strictObject({
+	authorizations: z.array(authorization).max(20).default([]),
+	servers: z.array(z.string().min(1)).max(20).default([])
+});
+const accessSchema = z.strictObject({
+	skills: z.record(z.string(), requirement).default({}),
+	mcp: z.record(z.string(), requirement).default({})
+});
+function pluginCapabilityAccess(manifest) {
+	const extension = manifest.extensions?.["ai.xopc"];
+	return accessSchema.parse(extension?.setup?.capabilityAccess ?? {});
+}
+const stateSchema = z.object({
+	packageRevision: z.string(),
+	state: z.string(),
+	installed: z.boolean().optional(),
+	resources: z.string(),
+	connections: z.array(z.object({
+		name: z.string(),
+		state: z.string()
+	})),
+	authorizations: z.array(z.object({
+		id: z.string(),
+		state: z.string(),
+		expiresAt: z.number().finite().optional(),
+		issues: z.array(z.object({ scopes: z.array(z.string()).default([]) })).default([])
+	})).default([])
+});
+/** One fail-closed access decision shared by Skill discovery and MCP projection. */
+function resolvePluginCapabilityAccess(plugin, store, now = Date.now()) {
+	let declarations, access;
+	try {
+		declarations = pluginAuthorizations(plugin.manifest);
+		access = pluginCapabilityAccess(plugin.manifest);
+	} catch {
+		return {
+			skill: (_name) => false,
+			server: (_name) => false
+		};
+	}
+	const path = join(store.stateDir, "plugin-setup", `${plugin.id}.json`);
+	let state, damaged = false;
+	if (existsSync(path)) try {
+		const parsed = stateSchema.parse(JSON.parse(readFileSync(path, "utf8")));
+		if (parsed.packageRevision === plugin.receipt.revision) state = parsed;
+	} catch {
+		damaged = true;
+	}
+	const extension = plugin.manifest.extensions?.["ai.xopc"];
+	const prepared = !damaged && plugin.readiness !== "blocked" && (state ? state.resources === "ready" && (state.installed === true || state.state === "completed") && state.state !== "cancelled" : !extension?.setup?.resources?.length);
+	const connected = (name) => state?.connections.find((value) => value.name === name)?.state === "connected";
+	const requiresConnection = (name) => {
+		const server = plugin.servers[name];
+		if (!server) return true;
+		return server.type !== "stdio" ? server.connectionAuth?.mode !== "none" : Object.values(server.env ?? {}).some((value) => Object.entries(plugin.layout?.userConfig ?? {}).some(([key, field]) => field.sensitive && value.includes(`\${user_config.${key}}`)));
+	};
+	const granted = (entry) => {
+		const id = typeof entry === "string" ? entry : entry.id;
+		const declaration = declarations.find((value) => value.id === id);
+		const saved = state?.authorizations.find((value) => value.id === id);
+		if (!declaration || saved?.state !== "connected" || saved.expiresAt !== void 0 && saved.expiresAt <= now || !declaration.servers.every(connected)) return false;
+		return saved.issues.every((issue) => typeof entry !== "string" && issue.scopes.length > 0 && !issue.scopes.some((scope) => entry.scopes.includes(scope)));
+	};
+	const allows = (rule) => prepared && rule.authorizations.every(granted) && rule.servers.every(connected);
+	const defaults = {
+		authorizations: declarations.map((value) => value.id),
+		servers: declarations.length ? [] : Object.keys(plugin.servers).filter(requiresConnection)
+	};
+	return {
+		skill: (name) => allows(access.skills[name] ?? defaults),
+		server: (name) => {
+			const owners = declarations.filter((value) => value.servers.includes(name));
+			return allows(access.mcp[name] ?? {
+				authorizations: (owners.length ? owners : declarations).map((value) => value.id),
+				servers: []
+			}) && (state ? connected(name) : !requiresConnection(name));
+		}
+	};
+}
+function pluginRuntimeAccessKey(store, workspace, agentId) {
+	return JSON.stringify(store.active(agentId, workspace).map((plugin) => {
+		const access = resolvePluginCapabilityAccess(plugin, store);
+		return [
+			plugin.id,
+			plugin.receipt.revision,
+			plugin.skills.filter((skill) => access.skill(skill.name)).map((skill) => skill.name),
+			Object.keys(plugin.servers).filter(access.server)
+		];
+	}));
+}
+//#endregion
+export { pluginCapabilityAccess, pluginRuntimeAccessKey, resolvePluginCapabilityAccess };

package/dist/src/extensions/agent-plugins/cli-authorization.d.ts

@@ -24,6 +24,7 @@ export declare function inspectPluginCliAuthorization(store: AgentPluginStore, p
         method?: string;
         helpUrl?: string;
     }[];
+    expiresAt?: number;
 }>;
 export declare function checkPluginCliAuthorization(store: AgentPluginStore, plugin: InstalledAgentPlugin, authorization: string, method: CliMethod, signal: AbortSignal): Promise<boolean>;
 export declare function startPluginCliAuthorization(store: AgentPluginStore, plugin: InstalledAgentPlugin, authorization: string, method: CliMethod, owner: string): PluginCliAuthorization;

package/dist/src/extensions/agent-plugins/cli-authorization.js

@@ -1,10 +1,10 @@
 import { CredentialResolver, init_credentials } from "../../auth/credentials.js";
-import { spawnProcess } from "../../process/run-process.js";
 import { parsePluginAuthorizationCheck, pluginAuthorizations, safeAuthorizationUrl } from "./setup-contract.js";
 import { containedPath, expandPluginVariables, resolvePluginCwd, validatePluginServer } from "./validation.js";
+import { spawnProcess } from "../../process/run-process.js";
 import { expandUserConfig, readPluginUserConfig } from "./user-config.js";
-import { homedir } from "node:os";
 import { join, resolve } from "node:path";
+import { homedir } from "node:os";
 import { mkdirSync, readFileSync } from "node:fs";
 import { randomUUID } from "node:crypto";
 //#region src/extensions/agent-plugins/cli-authorization.ts

package/dist/src/extensions/agent-plugins/inventory.js

@@ -16,7 +16,7 @@ function agentPluginInventoryRow(plugin, store = new AgentPluginStore()) {
 	try {
 		authorizations = pluginAuthorizations(plugin.manifest);
 	} catch {}
-	const needsAuthorization = !!job && ((job.missingConfig?.length ?? 0) > 0 || job.connections?.some((value) => value.state !== "connected") || job.authorizations?.some((value) => value.state !== "connected" || !!value.issues?.length));
+	const needsAuthorization = !job && (authorizations.length > 0 || Object.values(plugin.servers).some((server) => server.type !== "stdio" && server.connectionAuth?.mode !== "none")) || !!job && ((job.missingConfig?.length ?? 0) > 0 || job.connections?.some((value) => value.state !== "connected") || job.authorizations?.some((value) => value.state !== "connected" || !!value.issues?.length || value.expiresAt !== void 0 && value.expiresAt <= Date.now()));
 	return {
 		id: `plugin:${plugin.id}`,
 		pluginId: plugin.id,

package/dist/src/extensions/agent-plugins/mcp-adapter.js

@@ -1,10 +1,11 @@
+import { resolvePluginCapabilityAccess } from "./capability-access.js";
 import { containedPath, expandPluginVariables, pluginServerId, resolvePluginCwd } from "./validation.js";
 import { AgentPluginStore } from "./store.js";
 import { applyPluginAuthBinding, readPluginAuthBinding } from "./auth.js";
 import { expandUserConfig, readPluginUserConfig } from "./user-config.js";
-import { homedir } from "node:os";
 import { join, resolve } from "node:path";
-import { existsSync, mkdirSync, readFileSync } from "node:fs";
+import { homedir } from "node:os";
+import { mkdirSync } from "node:fs";
 import { createHash } from "node:crypto";
 //#region src/extensions/agent-plugins/mcp-adapter.ts
 function pluginOAuthCredentialId(pluginId, revision, serverName) {
@@ -28,10 +29,9 @@ function materializePluginServers(plugin, store = new AgentPluginStore(), diagno
 	};
 	const expand = (value) => expandUserConfig(expandPluginVariables(value.replace(/\$\{PLUGIN_ACCOUNTS\}/g, join(data, "accounts", plugin.receipt.revision)).replace(/\$\{PLUGIN_RESOURCES\}/g, join(data, "resources", plugin.receipt.revision)), root, data), values);
 	const servers = Object.create(null);
-	const setupPath = join(store.stateDir, "plugin-setup", `${plugin.id}.json`);
-	const job = !setup && existsSync(setupPath) ? JSON.parse(readFileSync(setupPath, "utf8")) : void 0;
+	const access = setup ? void 0 : resolvePluginCapabilityAccess(plugin, store);
 	for (const [name, server] of Object.entries(plugin.servers)) try {
-		if (job?.packageRevision === plugin.receipt.revision && (job.state !== "completed" && !job.installed || job.connections.find((c) => c.name === name)?.state !== "connected")) continue;
+		if (access && !access.server(name)) continue;
 		const origin = {
 			id: plugin.id,
 			serverName: name,

package/dist/src/extensions/agent-plugins/refresh-runtime-access.d.ts

@@ -0,0 +1,3 @@
+import type { Config } from '../../config/schema.js';
+/** Check provider-defined credentials before constructing a new turn's Skill index and MCP config. */
+export declare function refreshPluginRuntimeAccess(config: Config, workspace: string, agentId?: string): Promise<boolean>;

package/dist/src/extensions/agent-plugins/refresh-runtime-access.js

@@ -0,0 +1,36 @@
+import { createLogger } from "../../utils/logger/index.js";
+import { init_logger } from "../../utils/logger.js";
+import { pluginAuthorizations } from "./setup-contract.js";
+import { resolvePluginCapabilityAccess } from "./capability-access.js";
+import { AgentPluginStore } from "./store.js";
+import { PluginSetupService } from "./setup.js";
+//#region src/extensions/agent-plugins/refresh-runtime-access.ts
+init_logger();
+const log = createLogger("PluginRuntimeAccess");
+/** Check provider-defined credentials before constructing a new turn's Skill index and MCP config. */
+async function refreshPluginRuntimeAccess(config, workspace, agentId) {
+	const store = new AgentPluginStore(), service = new PluginSetupService(store);
+	const signature = () => JSON.stringify(store.active(agentId, workspace).map((plugin) => {
+		const access = resolvePluginCapabilityAccess(plugin, store);
+		return [
+			plugin.id,
+			plugin.skills.filter((s) => access.skill(s.name)).map((s) => s.name),
+			Object.keys(plugin.servers).filter(access.server)
+		];
+	}));
+	const before = signature();
+	for (const plugin of store.active(agentId, workspace)) {
+		if (!pluginAuthorizations(plugin.manifest).length && !Object.values(plugin.layout?.userConfig ?? {}).some((field) => field.sensitive) && Object.values(plugin.servers).every((server) => server.type === "stdio" || server.connectionAuth?.mode === "none")) continue;
+		try {
+			await service.refreshRuntime(plugin.id, config, workspace);
+		} catch (err) {
+			log.warn({
+				err,
+				pluginId: plugin.id
+			}, "Could not refresh plugin authorization state");
+		}
+	}
+	return before !== signature();
+}
+//#endregion
+export { refreshPluginRuntimeAccess };

package/dist/src/extensions/agent-plugins/setup-contract.d.ts

@@ -71,4 +71,5 @@ export declare function parsePluginAuthorizationCheck(output: string, methodIds:
         method?: string;
         helpUrl?: string;
     }[];
+    expiresAt?: number;
 };

package/dist/src/extensions/agent-plugins/setup-contract.js

@@ -65,6 +65,7 @@ const pluginPermissionIssueSchema = z.strictObject({
 function parsePluginAuthorizationCheck(output, methodIds) {
 	const result = z.object({
 		authenticated: z.boolean(),
+		expiresAt: z.number().finite().optional(),
 		issues: z.array(pluginPermissionIssueSchema).max(20).default([])
 	}).parse(JSON.parse(output.trim().split("\n").at(-1)));
 	for (const issue of result.issues) {

package/dist/src/extensions/agent-plugins/setup.d.ts

@@ -39,6 +39,7 @@ declare const schema: z.ZodObject<{
     deferred: z.ZodDefault<z.ZodBoolean>;
     authorizations: z.ZodDefault<z.ZodArray<z.ZodObject<{
         id: z.ZodString;
+        expiresAt: z.ZodOptional<z.ZodNumber>;
         state: z.ZodEnum<{
             error: "error";
             pending: "pending";
@@ -117,10 +118,12 @@ export declare class PluginSetupService {
         id: string;
         name: string;
     }>>>;
-    authorization(id: string, owner: string, server: string, config: Config): Promise<import("../../agent/mcp/connection-setup.js").McpAuthorization | import("./cli-authorization.js").PluginCliAuthorization>;
+    authorization(id: string, owner: string, server: string, config: Config): Promise<import("./cli-authorization.js").PluginCliAuthorization | import("../../agent/mcp/connection-setup.js").McpAuthorization>;
     redirect(id: string, owner: string, server: string, url: string, config: Config): boolean;
     private config;
     startPrepare(id: string, owner: string, revision: number, config: Config, workspace: string, idempotencyKey?: string): PluginSetupJob;
+    /** Recheck an installed revision without login prompts or resource downloads. */
+    refreshRuntime(id: string, config: Config, workspace: string): Promise<void>;
     act(id: string, owner: string, input: z.infer<typeof setupActionSchema>, config: Config, workspace: string): Promise<PluginSetupJob>;
     private perform;
 }

package/dist/src/extensions/agent-plugins/setup.js

@@ -11,8 +11,8 @@ import { readPluginAuthBinding, savePluginAuthBinding, savePluginOAuthReference
 import { pluginConfigMissing, readPluginUserConfig, savePluginUserConfig } from "./user-config.js";
 import { materializePluginServers } from "./mcp-adapter.js";
 import { getNativePiAgentDir } from "../../agent/mcp/native-mcp.js";
-import { cancelMcpAuthorization, getMcpAuthorization, probeMcpConnection, startMcpAuthorization, submitMcpRedirect } from "../../agent/mcp/connection-setup.js";
 import { cancelPluginCliAuthorizations, getPluginCliAuthorization, inspectPluginCliAuthorization, startPluginCliAuthorization } from "./cli-authorization.js";
+import { cancelMcpAuthorization, getMcpAuthorization, probeMcpConnection, startMcpAuthorization, submitMcpRedirect } from "../../agent/mcp/connection-setup.js";
 import { join } from "node:path";
 import { existsSync, readFileSync } from "node:fs";
 import { randomUUID } from "node:crypto";
@@ -60,6 +60,7 @@ const schema = z.object({
 	deferred: z.boolean().default(false),
 	authorizations: z.array(z.object({
 		id: z.string(),
+		expiresAt: z.number().finite().optional(),
 		state: z.enum([
 			"pending",
 			"connected",
@@ -265,6 +266,21 @@ var PluginSetupService = class {
 		});
 		return this.get(id, owner);
 	}
+	/** Recheck an installed revision without login prompts or resource downloads. */
+	async refreshRuntime(id, config, workspace) {
+		if (!existsSync(this.path(id)) || this.store.pending(id)) return;
+		const saved = schema.parse(JSON.parse(readFileSync(this.path(id), "utf8")));
+		if (saved.packageRevision !== this.store.receipt(id)?.revision || !saved.installed || saved.resources !== "ready" || !saved.connections.some((value) => value.state === "connected") && !saved.authorizations.some((value) => value.state === "connected") || saved.state === "cancelled" || running.has(this.key(id)) || lockfile.checkSync(this.path(id), { realpath: false })) return;
+		const release = lockfile.lockSync(this.path(id), { realpath: false });
+		try {
+			await this.perform(id, saved.owner, {
+				action: "prepare",
+				expectedRevision: saved.revision
+			}, config, workspace, true);
+		} finally {
+			release();
+		}
+	}
 	async act(id, owner, input, config, workspace) {
 		const current = this.get(id, owner);
 		const previous = input.idempotencyKey && current?.operations.find((op) => op.key === input.idempotencyKey);
@@ -290,7 +306,7 @@ var PluginSetupService = class {
 			release();
 		}
 	}
-	async perform(id, owner, input, config, workspace) {
+	async perform(id, owner, input, config, workspace, refreshOnly = false) {
 		const job = this.get(id, owner);
 		if (!job) throw new Error("Setup not found");
 		if (job.revision !== input.expectedRevision) throw new Error("Setup changed. Refresh and retry.");
@@ -428,49 +444,58 @@ var PluginSetupService = class {
 		delete job.error;
 		this.write(job);
 		try {
-			await preparePluginResources(this.store, plugin, controller.signal);
+			if (!refreshOnly) await preparePluginResources(this.store, plugin, controller.signal);
 			job.resources = "ready";
 			job.missingConfig = pluginConfigMissing(this.store, plugin);
 			if (job.missingConfig.length) {
 				job.state = "action_required";
 				job.error = "Complete the required configuration fields.";
-			} else {
-				for (const target of job.authorizations) {
-					const method = declarations.find((value) => value.id === target.id).methods.find((value) => value.id === target.method);
-					if (method?.type === "cli") {
-						const check = await inspectPluginCliAuthorization(this.store, plugin, target.id, method, controller.signal);
-						target.state = check.authenticated ? "connected" : "pending";
-						target.issues = check.issues;
-					} else if (method?.type === "form") {
-						const values = readPluginUserConfig(this.store, id, plugin.receipt.revision);
-						target.state = method.fields.every((key) => values[key] !== void 0 && values[key] !== "") ? "connected" : "pending";
-					}
+			}
+			for (const target of job.authorizations) {
+				const method = declarations.find((value) => value.id === target.id).methods.find((value) => value.id === target.method);
+				if (method?.type === "cli" && method.fields.some((key) => job.missingConfig.includes(key))) {
+					target.state = "pending";
+					continue;
 				}
-				for (const server of job.connections) {
-					controller.signal.throwIfAborted();
-					if (declarations.filter((value) => value.servers.includes(server.name)).some((gate) => {
-						const target = job.authorizations.find((value) => value.id === gate.id);
-						const method = gate.methods.find((value) => value.id === target.method);
-						return !method || method.type !== "oauth" && target.state !== "connected";
-					})) {
-						server.state = "skipped";
-						delete server.toolCount;
-						continue;
-					}
-					const result = await probeMcpConnection(effective, workspace, pluginServerId(id, server.name), { signal: controller.signal });
-					controller.signal.throwIfAborted();
-					server.state = result.state;
-					server.toolCount = result.toolCount;
-					const persisted = this.get(id, owner);
-					if (!persisted || persisted.id !== job.id || persisted.revision !== job.revision || persisted.state === "cancelled" || !this.store.receipt(id)) throw new Error("Setup changed");
-					this.config(id, job.packageRevision, config);
-					this.write(job);
+				if (method?.type === "cli") {
+					const check = await inspectPluginCliAuthorization(this.store, plugin, target.id, method, controller.signal);
+					target.state = check.authenticated && (check.expiresAt === void 0 || check.expiresAt > Date.now()) ? "connected" : "pending";
+					target.issues = check.issues;
+					target.expiresAt = check.expiresAt;
+				} else if (method?.type === "form") {
+					const values = readPluginUserConfig(this.store, id, plugin.receipt.revision);
+					target.state = method.fields.every((key) => values[key] !== void 0 && values[key] !== "") ? "connected" : "pending";
 				}
-				for (const target of job.authorizations) target.state = declarations.find((value) => value.id === target.id).servers.every((name) => job.connections.find((value) => value.name === name)?.state === "connected") ? "connected" : "pending";
-				job.partial = plugin.diagnostics.length > 0;
-				if (job.connections.some((value) => value.state === "error")) job.error = "Connection verification failed. Check the credentials or login status and try again.";
-				job.state = "action_required";
 			}
+			for (const server of job.connections) {
+				controller.signal.throwIfAborted();
+				const unavailable = declarations.filter((value) => value.servers.includes(server.name)).some((gate) => {
+					const target = job.authorizations.find((value) => value.id === gate.id);
+					const method = gate.methods.find((value) => value.id === target.method);
+					return !method || method.type !== "oauth" && target.state !== "connected";
+				});
+				const missingServerConfig = job.missingConfig.some((key) => JSON.stringify(plugin.servers[server.name]).includes(`\${user_config.${key}}`));
+				if (unavailable || missingServerConfig) {
+					server.state = "skipped";
+					delete server.toolCount;
+					continue;
+				}
+				const result = await probeMcpConnection(effective, workspace, pluginServerId(id, server.name), { signal: controller.signal });
+				controller.signal.throwIfAborted();
+				server.state = result.state;
+				server.toolCount = result.toolCount;
+				const persisted = this.get(id, owner);
+				if (!persisted || persisted.id !== job.id || persisted.revision !== job.revision || persisted.state === "cancelled" || !this.store.receipt(id)) throw new Error("Setup changed");
+				this.config(id, job.packageRevision, config);
+				this.write(job);
+			}
+			for (const target of job.authorizations) {
+				const declaration = declarations.find((value) => value.id === target.id);
+				target.state = (declaration.methods.find((value) => value.id === target.method)?.type === "oauth" || target.state === "connected") && declaration.servers.every((name) => job.connections.find((value) => value.name === name)?.state === "connected") ? "connected" : "pending";
+			}
+			job.partial = plugin.diagnostics.length > 0;
+			if (job.connections.some((value) => value.state === "error")) job.error = "Connection verification failed. Check the credentials or login status and try again.";
+			job.state = "action_required";
 			this.config(id, job.packageRevision, config);
 			controller.signal.throwIfAborted();
 			if (this.get(id, owner)?.id !== job.id || this.get(id, owner)?.state === "cancelled") throw new Error("Setup changed");
@@ -478,6 +503,14 @@ var PluginSetupService = class {
 		} catch {
 			const current = this.get(id, owner);
 			if (!controller.signal.aborted && current?.id === job.id && current.revision === job.revision && current.state !== "cancelled" && (this.store.pending(id) ?? this.store.get(id))?.receipt.revision === job.packageRevision) {
+				for (const target of job.authorizations) target.state = "pending";
+				for (const connection of job.connections) {
+					const server = plugin.servers[connection.name];
+					if (server && (server.type !== "stdio" ? server.connectionAuth?.mode !== "none" : Object.values(server.env ?? {}).some((value) => Object.entries(plugin.layout?.userConfig ?? {}).some(([key, field]) => field.sensitive && value.includes(`\${user_config.${key}}`))))) {
+						connection.state = "error";
+						delete connection.toolCount;
+					}
+				}
 				job.state = "failed";
 				if (job.resources !== "ready") job.resources = "error";
 				job.error = "Preparation failed. Retry after checking resources and connections.";

package/dist/src/extensions/agent-plugins/skill-catalog.js

@@ -1,8 +1,8 @@
 import { parseFrontmatter } from "../../markdown/frontmatter.js";
-import { createSkillConfigManager } from "../../agent/skills/config.js";
-import { parseSkillLocalizations } from "../../agent/skills/parse-skill-metadata.js";
 import { containedPath } from "./validation.js";
 import { AgentPluginStore } from "./store.js";
+import { createSkillConfigManager } from "../../agent/skills/config.js";
+import { parseSkillLocalizations } from "../../agent/skills/parse-skill-metadata.js";
 import { buildSkillMarkdownPreviewFromRaw } from "../../agent/skills/skill-markdown-preview-from-raw.js";
 import { agentPluginInventoryRow } from "./inventory.js";
 import { basename, dirname } from "node:path";

package/dist/src/extensions/agent-plugins/source-catalog.js

@@ -1,8 +1,8 @@
 import { PLUGIN_MANIFEST_PATHS } from "./formats.js";
 import { containedPath } from "./validation.js";
 import { runExec } from "../../infra/exec.js";
-import { tmpdir } from "node:os";
 import { join, resolve } from "node:path";
+import { tmpdir } from "node:os";
 import { existsSync, mkdtempSync, readFileSync, realpathSync, rmSync, statSync } from "node:fs";
 import { createHash } from "node:crypto";
 //#region src/extensions/agent-plugins/source-catalog.ts

package/dist/src/extensions/agent-plugins/source-http-fetch.js

@@ -1,5 +1,5 @@
-import { BlockList, isIP } from "node:net";
 import { Agent, fetch } from "undici";
+import { BlockList, isIP } from "node:net";
 import { lookup } from "node:dns";
 //#region src/extensions/agent-plugins/source-http-fetch.ts
 const blocked = new BlockList();

package/dist/src/extensions/agent-plugins/sources.js

@@ -1,8 +1,8 @@
 import { createPluginSourceFetch } from "./source-http-fetch.js";
 import { PLUGIN_MANIFEST_PATHS } from "./formats.js";
 import { PluginSourceRedirect, isGitPluginSource, withCatalogSource } from "./source-catalog.js";
-import { tmpdir } from "node:os";
 import { join } from "node:path";
+import { tmpdir } from "node:os";
 import { mkdtempSync, rmSync, writeFileSync } from "node:fs";
 import AdmZip from "adm-zip";
 //#region src/extensions/agent-plugins/sources.ts

package/dist/src/extensions/agent-plugins/store.d.ts

@@ -98,6 +98,7 @@ export declare class AgentPluginStore {
     constructor(stateDir?: string);
     private receiptsDir;
     revisionKey(): string;
+    private authorizationExpiryState;
     dataDir(id: string): string;
     private revisionDir;
     private receiptPath;

package/dist/src/extensions/agent-plugins/store.js

@@ -7,8 +7,8 @@ import { prunePluginResourceCache } from "./resources.js";
 import { PLUGIN_MANIFEST_PATHS } from "./formats.js";
 import { containedPath, inspectAgentPlugin, pluginName } from "./validation.js";
 import { pluginSourceKey } from "./source-catalog.js";
-import { tmpdir } from "node:os";
 import { dirname, join, resolve } from "node:path";
+import { tmpdir } from "node:os";
 import { cpSync, existsSync, lstatSync, mkdirSync, mkdtempSync, readFileSync, readdirSync, realpathSync, rmSync, statSync, writeFileSync } from "node:fs";
 import { createHash, randomUUID } from "node:crypto";
 import { z } from "zod";
@@ -66,12 +66,19 @@ var AgentPluginStore = class {
 		return readdirSync(this.receiptsDir()).filter((name) => name.endsWith(".json")).sort().map((name) => {
 			try {
 				const setupPath = join(this.stateDir, "plugin-setup", name);
-				return createHash("sha256").update(readFileSync(join(this.receiptsDir(), name))).update(existsSync(setupPath) ? readFileSync(setupPath) : "").digest("hex");
+				return createHash("sha256").update(readFileSync(join(this.receiptsDir(), name))).update(existsSync(setupPath) ? readFileSync(setupPath) : "").update(JSON.stringify(this.authorizationExpiryState(setupPath))).digest("hex");
 			} catch {
 				return "";
 			}
 		}).join("|");
 	}
+	authorizationExpiryState(path) {
+		try {
+			return (JSON.parse(readFileSync(path, "utf8")).authorizations ?? []).map((value) => value.expiresAt !== void 0 && value.expiresAt <= Date.now());
+		} catch {
+			return [];
+		}
+	}
 	dataDir(id) {
 		return containedPath(this.stateDir, join(this.stateDir, "plugin-data", pluginName.parse(id)));
 	}
@@ -127,7 +134,7 @@ var AgentPluginStore = class {
 			});
 			const setupPath = join(this.stateDir, "plugin-setup", `${id}.json`);
 			const setup = existsSync(setupPath) ? JSON.parse(readFileSync(setupPath, "utf8")) : void 0;
-			const readiness = !valid || adapterChanged || capabilityChanged || inspection.layout?.compatibility.some((item) => item.component === "hooks" || item.component === "authorizations" && item.support === "invalid") ? "blocked" : setup?.packageRevision === receipt.revision && setup.state !== "completed" && !setup.installed ? "setup_required" : inspection.diagnostics.length || setup?.packageRevision === receipt.revision && (setup.partial || setup.installed && (setup.missingConfig?.length || setup.connections?.some((value) => value.state !== "connected") || setup.authorizations?.some((value) => value.state !== "connected" || !!value.issues?.length))) ? "degraded" : "ready";
+			const readiness = !valid || adapterChanged || capabilityChanged || inspection.layout?.compatibility.some((item) => item.component === "hooks" || ["authorizations", "capability-access"].includes(item.component) && item.support === "invalid") ? "blocked" : setup?.packageRevision === receipt.revision && setup.state !== "completed" && !setup.installed ? "setup_required" : inspection.diagnostics.length || setup?.packageRevision === receipt.revision && (setup.partial || setup.installed && (setup.missingConfig?.length || setup.connections?.some((value) => value.state !== "connected") || setup.authorizations?.some((value) => value.state !== "connected" || !!value.issues?.length))) ? "degraded" : "ready";
 			return {
 				...inspection,
 				id,

package/dist/src/extensions/agent-plugins/validation.js

@@ -1,13 +1,14 @@
-import { McpOAuthConfigSchema, init_schema } from "../../config/schema.js";
 import { pluginAuthorizations, safeAuthorizationUrl } from "./setup-contract.js";
+import { pluginCapabilityAccess } from "./capability-access.js";
 import { normalizePluginMcpServer } from "./mcp-format.js";
+import { McpOAuthConfigSchema, init_schema } from "../../config/schema.js";
 import { pluginResources } from "./resources.js";
 import { collectPluginSkillFiles, readPluginLayout } from "./formats.js";
+import yaml from "js-yaml";
 import { dirname, isAbsolute, join, relative, resolve } from "node:path";
 import { existsSync, lstatSync, readFileSync, readdirSync, realpathSync, statSync } from "node:fs";
 import { createHash } from "node:crypto";
 import { z } from "zod";
-import yaml from "js-yaml";
 import { validateHeaderName, validateHeaderValue } from "node:http";
 //#region src/extensions/agent-plugins/validation.ts
 init_schema();
@@ -309,6 +310,15 @@ function inspectAgentPlugin(rootDir, dataDir = join(rootDir, ".inspection-data")
 			}
 		}
 	});
+	attempt("capability-access", () => {
+		const access = pluginCapabilityAccess(manifest);
+		const accounts = new Set(pluginAuthorizations(manifest).map((value) => value.id));
+		for (const [kind, rules] of Object.entries(access)) for (const [name, rule] of Object.entries(rules)) {
+			if (kind === "skills" ? !result.skills.some((skill) => skill.name === name) : !result.servers[name]) throw new Error(`Unknown ${kind} capability: ${name}`);
+			if (rule.servers.some((server) => !result.servers[server]) || rule.authorizations.some((value) => !accounts.has(typeof value === "string" ? value : value.id))) throw new Error(`Unknown capability dependency: ${name}`);
+		}
+		if (Object.keys(access.skills).length || Object.keys(access.mcp).length) result.capabilities.push(`runtime.capability-access:${JSON.stringify(access)}`);
+	});
 	result.capabilities.sort();
 	return result;
 }

package/dist/src/extensions/api.js

@@ -1,8 +1,8 @@
 import { createLogger } from "../utils/logger/index.js";
 import { init_logger } from "../utils/logger.js";
+import { registerMediaUnderstandingProvider } from "../media-understanding/registry.js";
 import { getProviderRegistry, init_plugin_registry } from "../providers/plugin-registry.js";
 import { registerMarketplaceAdapter, unregisterMarketplaceAdapter } from "../agent/skills/marketplace/registry.js";
-import { registerMediaUnderstandingProvider } from "../media-understanding/registry.js";
 import { registerSpeechProvider } from "../voice/tts/speech-registry.js";
 import { HOOK_EXECUTION_MODES } from "./types/hooks.js";
 import { commandRegistry } from "../chat-commands/registry.js";

package/dist/src/extensions/install.js

@@ -9,8 +9,8 @@ import { collectExtensionPackageDependencyIssues } from "./package-contract.js";
 import { dirname, isAbsolute, join, resolve, sep } from "path";
 import { cpSync, existsSync, mkdirSync, mkdtempSync, readFileSync, readdirSync, rmSync, writeFileSync } from "fs";
 import { execFileSync } from "node:child_process";
-import semver from "semver";
 import AdmZip from "adm-zip";
+import semver from "semver";
 import { tmpdir } from "os";
 //#region src/extensions/install.ts
 /**

package/dist/src/extensions/loader.js

@@ -19,9 +19,9 @@ import { EXTENSION_API_VERSION, EXTENSION_UI_API_VERSION, checkExtensionApiCompa
 import { DEFAULT_SECURITY_CONFIG, checkExtensionDirSafety, checkExtensionPathSafety, isExtensionAllowed, logSecurityIssue, provenanceTracker } from "./security.js";
 import { getSlotRegistry } from "./slots.js";
 import { getExtensionCache, getExtensionDiagnostics } from "./diagnostics.js";
-import { fileURLToPath, pathToFileURL } from "node:url";
 import { dirname, isAbsolute, join } from "path";
 import { existsSync, readFileSync } from "fs";
+import { fileURLToPath, pathToFileURL } from "node:url";
 import { createJiti } from "jiti";
 //#region src/extensions/loader.ts
 /**

package/dist/src/extensions/sdk/index.js

@@ -1,3 +1,4 @@
+import { defineChannelPluginEntry } from "./channel-entry.js";
 import { ProviderPluginRegistry, getProviderRegistry, init_plugin_registry } from "../../providers/plugin-registry.js";
 import { HOOK_EXECUTION_MODES } from "../types/hooks.js";
 import { TypedEventBus } from "../typed-event-bus.js";
@@ -7,7 +8,6 @@ import { DEFAULT_SECURITY_CONFIG, checkExtensionDirSafety, checkExtensionPathSaf
 import { SlotRegistry, getSlotRegistry, registerSlotType } from "../slots.js";
 import { ExtensionDiagnostics, ExtensionLoaderCacheImpl, getExtensionCache, getExtensionDiagnostics } from "../diagnostics.js";
 import { ExtensionHookRunner, createHookContext, isHookEvent } from "../hooks.js";
-import { defineChannelPluginEntry } from "./channel-entry.js";
 import { registerExtensionCliProgram } from "./channel-helpers.js";
 import { lazyFunction, lazyModule } from "./lazy.js";
 import { createMockExtensionApi, createTestGateway } from "./testing.js";

package/dist/src/extensions/update.js

@@ -1,8 +1,8 @@
 import { createLogger } from "../utils/logger/index.js";
 import { init_logger } from "../utils/logger.js";
 import { init_paths, resolveBundledExtensionsDir, resolveExtensionsDir } from "../config/paths.js";
-import { downloadExtensionStoreZipBuffer, resolveExtensionZipDownloadUrl, resolveExtensionsStoreBaseUrl, verifyStoreArtifactSha256 } from "../agent/skills/marketplace/adapters/store/store-api-client.js";
 import { computeExtensionDirectoryIntegrity, getExtensionLockfileManager } from "./lockfile.js";
+import { downloadExtensionStoreZipBuffer, resolveExtensionZipDownloadUrl, resolveExtensionsStoreBaseUrl, verifyStoreArtifactSha256 } from "../agent/skills/marketplace/adapters/store/store-api-client.js";
 import { loadConfig } from "../config/loader.js";
 import { commitStagedExtensionInstall, finalizeStagedExtensionInstall, rollbackStagedExtensionInstall, stageExtensionNpm, stageExtensionStoreZip } from "./install-transaction.js";
 import { findExtension } from "./marketplace.js";

package/dist/src/gateway/agents-admin.js

@@ -1,10 +1,10 @@
 import { normalizeAgentId, validateAgentIdForNewAgent } from "../agent-catalog/id.js";
 import { AgentCatalogRepository, init_repository } from "../agent-catalog/repository.js";
 import { init_agent_scope, listAgentEntries, resolveAgentProfileDir, resolveAgentWorkspaceDir, resolveDefaultAgentId, resolveUserPath } from "../agent/agent-scope.js";
-import { AGENT_PROFILE_MARKDOWN_SYSTEM_FILES, REQUIRED_AGENT_PROFILE_MARKDOWN_FILE_SET } from "../agent/context/workspace.js";
-import { AgentCatalogService } from "../agent-catalog/service.js";
 import { resolveEffectiveAgentProfile } from "../config/agent-profile.js";
+import { AGENT_PROFILE_MARKDOWN_SYSTEM_FILES, REQUIRED_AGENT_PROFILE_MARKDOWN_FILE_SET } from "../agent/context/workspace.js";
 import { isPathUnderWorkspace, resolveWorkspaceSafePath } from "./workspace-editor-path.js";
+import { AgentCatalogService } from "../agent-catalog/service.js";
 import { GATEWAY_BUILTIN_TOOL_IDS } from "./agent-builtin-tools.js";
 import { resolve } from "node:path";
 import { mkdir, readFile, realpath, stat, unlink, writeFile } from "node:fs/promises";

package/dist/src/gateway/file-path-classifier.js

@@ -1,11 +1,11 @@
 import { init_paths_state, resolveStateDir } from "../config/paths-state.js";
 import { init_agent_scope, resolveAgentProfileDir } from "../agent/agent-scope.js";
-import { extractProfileAgentId } from "../config/agent-profile.js";
 import { init_paths, resolveConfigPath, resolveSkillsDir } from "../config/paths.js";
+import { extractProfileAgentId } from "../config/agent-profile.js";
 import { isBareProfileMarkdownFileName, resolveProfileMarkdownPathIfBareName } from "../agent/tools/tool-paths.js";
 import { isPathUnderWorkspace } from "./workspace-editor-path.js";
-import { homedir } from "node:os";
 import { basename, isAbsolute, resolve } from "node:path";
+import { homedir } from "node:os";
 import { stat } from "node:fs/promises";
 //#region src/gateway/file-path-classifier.ts
 init_agent_scope();