@xopcai/xopc 0.0.400 → 0.0.402

package/dist/src/agent/image/tool-model-config.js

@@ -1,6 +1,6 @@
 import { init_agent_scope, resolveDefaultAgentId } from "../agent-scope.js";
-import { resolveEffectiveAgentConfigForAgent } from "../../config/agent-profile.js";
 import { getAgentDefaultImageModelConfig, getAgentDefaultModelRef, init_schema, parseModelRef } from "../../config/schema.js";
+import { resolveEffectiveAgentConfigForAgent } from "../../config/agent-profile.js";
 import { getDefaultModelSync, getModelsByProvider, init_providers, isProviderConfiguredSync, resolveModel } from "../../providers/index.js";
 import { resolveAgentModelFallbackValues, resolveAgentModelPrimaryValue } from "../../config/model-input.js";
 import { buildCapabilityPlansForConfig } from "../../capabilities/readiness/from-config.js";

package/dist/src/agent/mcp/connection-drafts.js

@@ -186,7 +186,7 @@ var McpConnectionDrafts = class {
 		try {
 			const server = structuredClone(draft.server);
 			if (enable) server.enabled = true;
-			if (server.url) {
+			if (typeof server.url === "string") {
 				const state = await draft.credentials.forServer(draft.serverId, server.url).load();
 				const candidateAlias = `mcp_draft_${randomUUID().replaceAll("-", "")}`;
 				durable = await createNativeMcpCredentials();
@@ -237,7 +237,7 @@ var McpConnectionDrafts = class {
 		} finally {
 			draft.committing = false;
 			if (alias && this.options.readConfig().mcp?.servers?.[draft.serverId]?.xopcOAuthCredentialId === alias) published = true;
-			if (!published && alias && durable && draft.server.url) durable.remove(alias, draft.server.url);
+			if (!published && alias && durable && typeof draft.server.url === "string") durable.remove(alias, draft.server.url);
 			if (this.drafts.has(id) && draft.expiresAt <= Date.now()) this.dispose(draft);
 		}
 	}

package/dist/src/agent/mcp/connection-setup.js

@@ -144,7 +144,7 @@ function startMcpAuthorization(config, workspace, serverId, owner, options) {
 	config = resolveMcpSetupConfig(config, serverId);
 	const server = config.mcp?.servers?.[serverId];
 	if (!server?.url || server.enabled === false || isManagedConnectorServer(server) && server.xopcConnector.enabled === false) throw new Error("An enabled HTTP MCP server is required.");
-	httpUrl(server.url);
+	if (typeof server.url === "string") httpUrl(server.url);
 	if (server.auth || Object.keys(server.headers ?? {}).some((name) => name.toLowerCase() === "authorization")) throw new Error("This server uses configured credentials. Remove Authorization before using OAuth.");
 	const scope = options?.authorizationScope ?? serverId;
 	for (const attempt of attempts.values()) if (attempt.owner === owner && attempt.scope === scope) cancel(attempt);

package/dist/src/agent/mcp/credential-store-modules.d.ts

@@ -0,0 +1,5 @@
+/** pi 1.1 exposes credential injection but keeps its store constructors internal. */
+export declare function loadNativeMcpCredentialModules(): Promise<{
+    McpOAuthCredentialStore: any;
+    InMemoryAuthStorageBackend: any;
+}>;

package/dist/src/agent/mcp/credential-store-modules.js

@@ -0,0 +1,13 @@
+//#region src/agent/mcp/credential-store-modules.ts
+/** pi 1.1 exposes credential injection but keeps its store constructors internal. */
+async function loadNativeMcpCredentialModules() {
+	const root = import.meta.resolve("@earendil-works/pi-coding-agent");
+	const { McpOAuthCredentialStore } = await import(new URL("./extensions/mcp/oauth.js", root).href);
+	const { InMemoryAuthStorageBackend } = await import(new URL("./core/auth-storage.js", root).href);
+	return {
+		McpOAuthCredentialStore,
+		InMemoryAuthStorageBackend
+	};
+}
+//#endregion
+export { loadNativeMcpCredentialModules };

package/dist/src/agent/mcp/credential-store.js

@@ -1,10 +1,9 @@
+import { loadNativeMcpCredentialModules } from "./credential-store-modules.js";
 //#region src/agent/mcp/credential-store.ts
 /** Use pi's own stores; never change PI_CODING_AGENT_DIR for an individual connection. */
 async function createNativeMcpCredentials(memory = false) {
-	const root = import.meta.resolve("@earendil-works/pi-coding-agent");
-	const { McpOAuthCredentialStore } = await import(new URL("./extensions/mcp/oauth.js", root).href);
+	const { McpOAuthCredentialStore, InMemoryAuthStorageBackend } = await loadNativeMcpCredentialModules();
 	if (!memory) return new McpOAuthCredentialStore();
-	const { InMemoryAuthStorageBackend } = await import(new URL("./core/auth-storage.js", root).href);
 	return new McpOAuthCredentialStore(new InMemoryAuthStorageBackend());
 }
 /** Credential identity may change on commit without changing the public tool namespace. */

package/dist/src/agent/service/process-direct-streaming.js

@@ -4,8 +4,8 @@ import { init_session_input_repository, listTaskUpdateTriggers } from "../../sto
 import { getClarificationResumeInput, init_clarification_wait_repository } from "../../storage/sqlite/clarification-wait-repository.js";
 import { getConnectionResumeInput, init_connection_wait_repository } from "../../storage/sqlite/connection-wait-repository.js";
 import { init_agent_scope, resolveDefaultAgentId } from "../agent-scope.js";
-import { init_agent_session_key, resolveAgentMainConversationId } from "../../routing/agent-session-key.js";
 import { init_model_usage, modelUsageOriginFromTurn, withModelUsageOrigin } from "../../providers/model-usage.js";
+import { init_agent_session_key, resolveAgentMainConversationId } from "../../routing/agent-session-key.js";
 import { readAgentMessageContent } from "../memory/agent-message-access.js";
 import { abortEmbeddedRun } from "../embedded/runs.js";
 import { clearPendingTranscriptUserMessage, setPendingTranscriptUserMessage } from "../inbound/attachment-pipeline.js";

package/dist/src/agent/service.js

@@ -2,13 +2,13 @@ import { createLogger } from "../utils/logger/index.js";
 import { init_logger } from "../utils/logger.js";
 import { init_attachment_ref, parseNoteAttachmentTarget } from "../notes/attachment-ref.js";
 import { init_agent_scope, resolveAgentHomeDir, resolveDefaultAgentId } from "./agent-scope.js";
-import { extractTextContent } from "./context/workspace.js";
+import { getAgentDefaultModelRef, init_schema } from "../config/schema.js";
 import { init_agent_session_key, resolveAgentIdFromConversationId } from "../routing/agent-session-key.js";
 import { extractProfileAgentId, resolveEffectiveAgentConfigForSession } from "../config/agent-profile.js";
-import { getAgentDefaultModelRef, init_schema } from "../config/schema.js";
 import { init_providers, resolveModel } from "../providers/index.js";
 import { configureTracing, flushTracing } from "../observability/runtime.js";
 import { getUserTimezone } from "../user-model/repository.js";
+import { extractTextContent } from "./context/workspace.js";
 import { resolveAgentTurnTimeoutMs } from "./orchestration/run-agent-turn-with-timeout.js";
 import { applyConfigOverrides } from "../config/runtime-overrides.js";
 import { effectiveWorkspacePathForSession } from "../session/session-workspace.js";

package/dist/src/agent/skills/index.js

@@ -1,8 +1,8 @@
 import { resolveStateDir } from "../../config/paths-state.js";
 import { createLogger } from "../../utils/logger/index.js";
 import { init_logger } from "../../utils/logger.js";
-import { parseFrontmatter } from "../../markdown/frontmatter.js";
 import { init_paths } from "../../config/paths.js";
+import { parseFrontmatter } from "../../markdown/frontmatter.js";
 import { findInstallSpec, hasBinary, installSkill } from "./installer.js";
 import { applySkillEnvOverrides, createSkillConfigManager, getSkillEnvironment, isSkillEnabled, resolveSkillConfig, validateSkillConfig } from "./config.js";
 import { parseSkillToolConditions } from "./skill-tool-gating.js";

package/dist/src/agent/skills/managed-store.js

@@ -1,5 +1,5 @@
-import { parseFrontmatter } from "../../markdown/frontmatter.js";
 import { init_paths, resolveSkillsDir } from "../../config/paths.js";
+import { parseFrontmatter } from "../../markdown/frontmatter.js";
 import { loadSkillsLock } from "./hub-lock.js";
 import { dirname, join, resolve, sep } from "node:path";
 import { existsSync, mkdirSync, readFileSync, readdirSync, renameSync, rmSync, writeFileSync } from "node:fs";

package/dist/src/agent/skills/skill-manage-ops.js

@@ -1,5 +1,5 @@
-import { parseFrontmatter } from "../../markdown/frontmatter.js";
 import { init_paths, resolveSkillsDir } from "../../config/paths.js";
+import { parseFrontmatter } from "../../markdown/frontmatter.js";
 import { resolveWorkspaceSkillsDir } from "./workspace-skills-dir.js";
 import { formatScanSummary, scanSkillDirectory } from "./scanner.js";
 import { fuzzyFindText, normalizeForFuzzyMatch, normalizeToLF, restoreLineEndings } from "../tools/edit-diff.js";

package/dist/src/agent/skills/skill-manager.js

@@ -2,9 +2,9 @@ import { resolveStateDir } from "../../config/paths-state.js";
 import { createLogger } from "../../utils/logger/index.js";
 import { init_logger } from "../../utils/logger.js";
 import { init_paths, resolveBundledSkillsDir } from "../../config/paths.js";
+import { AgentPluginStore } from "../../extensions/agent-plugins/store.js";
 import { createSkillConfigManager, isSkillEnabled } from "./config.js";
 import { formatSkillsForPrompt, selectSkillsVisibleInPrompt } from "./format-skills-prompt.js";
-import { AgentPluginStore } from "../../extensions/agent-plugins/store.js";
 import { createSkillLoader } from "./index.js";
 //#region src/agent/skills/skill-manager.ts
 /**
@@ -157,6 +157,7 @@ var SkillManager = class {
 		return this.skillLoader.getDiagnostics();
 	}
 	getVersion() {
+		this.refreshPlugins();
 		return String(this.version);
 	}
 	getLoadedAt() {

package/dist/src/agent/skills/skill-sources.js

@@ -1,6 +1,7 @@
 import { init_paths, resolveSkillsDir } from "../../config/paths.js";
-import { resolveWorkspaceSkillsDir } from "./workspace-skills-dir.js";
+import { resolvePluginCapabilityAccess } from "../../extensions/agent-plugins/capability-access.js";
 import { AgentPluginStore } from "../../extensions/agent-plugins/store.js";
+import { resolveWorkspaceSkillsDir } from "./workspace-skills-dir.js";
 import { homedir } from "node:os";
 import { isAbsolute, join, relative, resolve } from "node:path";
 import { existsSync, realpathSync } from "node:fs";
@@ -48,7 +49,11 @@ function resolveSkillSources(options, skillsConfig) {
 	const extraDirs = [...configuredExtraDirs, ...optionExtraDirs];
 	const sources = [];
 	const diagnostics = [];
-	for (const plugin of new AgentPluginStore().active(options.agentId, options.workspaceDir)) {
+	const pluginStore = new AgentPluginStore();
+	for (const plugin of pluginStore.active(options.agentId, options.workspaceDir)) {
+		const access = resolvePluginCapabilityAccess(plugin, pluginStore);
+		const skills = plugin.skills.filter((skill) => access.skill(skill.name));
+		if (!skills.length) continue;
 		sources.push({
 			id: `plugin:${plugin.id}`,
 			rootDir: plugin.rootDir,
@@ -56,8 +61,8 @@ function resolveSkillSources(options, skillsConfig) {
 			scope: "global",
 			managed: false,
 			writable: false,
-			skillFiles: plugin.skills.map((skill) => skill.filePath),
-			skillAliases: plugin.layout?.dialect !== "portable" ? Object.fromEntries(plugin.skills.map((skill) => [skill.filePath, `${plugin.id}.${skill.name}`])) : void 0
+			skillFiles: skills.map((skill) => skill.filePath),
+			skillAliases: plugin.layout?.dialect !== "portable" ? Object.fromEntries(skills.map((skill) => [skill.filePath, `${plugin.id}.${skill.name}`])) : void 0
 		});
 		diagnostics.push(...plugin.diagnostics.map((diagnostic) => ({
 			type: "warning",

package/dist/src/agent/tasks/task-judge-service.js

@@ -2,8 +2,8 @@ import { createLogger } from "../../utils/logger/index.js";
 import { init_logger } from "../../utils/logger.js";
 import { TaskRepository, init_task_repository } from "../../tasks/task-repository.js";
 import { TaskRunRepository, init_task_run_repository } from "../../tasks/task-run-repository.js";
-import { resolveEffectiveAgentProfileForSession } from "../../config/agent-profile.js";
 import { getAgentDefaultModelRef, init_schema } from "../../config/schema.js";
+import { resolveEffectiveAgentProfileForSession } from "../../config/agent-profile.js";
 import { getApiKey, init_providers, resolveModel } from "../../providers/index.js";
 import { completeWithResolvedCredentials } from "../../providers/model-call.js";
 import { extractAssistantText, getAssistantMessageErrorReason, isTransientProviderErrorMessage, stripCodeFences } from "../../providers/model-response.js";

package/dist/src/agent/tools/fetch-text.js

@@ -1,6 +1,6 @@
 import { checkUrlSafety, checkWebsiteBlocklist } from "./url-safety.js";
-import { Agent, fetch } from "undici";
 import { lookup } from "node:dns";
+import { Agent, fetch } from "undici";
 //#region src/agent/tools/fetch-text.ts
 /** Validate each redirect and the address actually used for the connection. */
 async function fetchPublicText(input, blocklist, signal) {

package/dist/src/agent/tools/personal-read-tool.js

@@ -1,7 +1,7 @@
-import { CapabilityDispatcher } from "../../capabilities/runtime/dispatcher.js";
 import { isPersonalConversation } from "../../personal-agent/repository.js";
 import { LOCAL_READ_MAX_CHARS } from "./local-read-budget.js";
 import { getEmbeddedExecutionSession } from "../embedded/execution-context.js";
+import { CapabilityDispatcher } from "../../capabilities/runtime/dispatcher.js";
 import { registerNoteReadCapabilities } from "../../notes/capabilities/read.js";
 import { registerProjectReadCapabilities } from "../../projects/capabilities/read.js";
 import { registerAutomationReadCapabilities } from "../../automations/capabilities/read.js";

package/dist/src/agent/tools/xopc-use-tool.js

@@ -11,13 +11,13 @@ import { TaskRunRepository } from "../../tasks/task-run-repository.js";
 import { getSessionMetadata } from "../../storage/sqlite/session-read-repository.js";
 import { init_sqlite } from "../../storage/sqlite/index.js";
 import "../../activity/index.js";
-import { CapabilityError } from "../../capabilities/runtime/errors.js";
-import "../../capabilities/runtime/dispatcher.js";
 import { getDefaultAgentId, init_resolve_route } from "../../routing/resolve-route.js";
 import { hasUnlocalizedTaskText, resolveTaskLocale } from "../../tasks/task-language.js";
 import { TaskReadModelProjector } from "../../tasks/task-read-model-projector.js";
 import { TaskOriginRepository } from "../../tasks/task-origin-repository.js";
 import { TaskConversationRepository } from "../../tasks/task-conversation-repository.js";
+import { CapabilityError } from "../../capabilities/runtime/errors.js";
+import "../../capabilities/runtime/dispatcher.js";
 import { resolveProjectAgentId } from "../../projects/project-agent.js";
 import "../../projects/index.js";
 import { TaskCollaborationRepository } from "../../tasks/task-collaboration-repository.js";

package/dist/src/agent-catalog/capabilities.js

@@ -1,10 +1,10 @@
 import { AgentEntrySchema, EffectiveAgentConfigSchema } from "../agent-config/schema.js";
 import { resolveEffectiveAgentConfig } from "../agent-config/resolver.js";
 import { init_agent_config } from "../agent-config/index.js";
-import { CapabilityError } from "../capabilities/runtime/errors.js";
-import { defineAtomicCapability, defineReadCapability } from "../capabilities/runtime/dispatcher.js";
 import { AgentCatalogRepository, init_repository } from "./repository.js";
 import { init_agent_scope, resolveAgentWorkspaceDir } from "../agent/agent-scope.js";
+import { CapabilityError } from "../capabilities/runtime/errors.js";
+import { defineAtomicCapability, defineReadCapability } from "../capabilities/runtime/dispatcher.js";
 import { AgentCatalogService } from "./service.js";
 import { z } from "zod";
 //#region src/agent-catalog/capabilities.ts

package/dist/src/agent-catalog/migrations/legacy-config-cutover.js

@@ -1,11 +1,11 @@
 import { getXopcDatabase } from "../../storage/sqlite/connection.js";
 import { runSqliteWriteTransaction } from "../../storage/sqlite/transaction.js";
 import { init_sqlite } from "../../storage/sqlite/index.js";
+import { init_write_file_atomic, writeTextAtomicSync } from "../../infra/write-file-atomic.js";
 import { AgentDefaultsSchema, AgentEntrySchema, AgentIdSchema, DEFAULT_AGENT_MODEL_REF, DEFAULT_SKILL_POLICY } from "../../agent-config/schema.js";
 import { init_agent_config } from "../../agent-config/index.js";
 import { BindingsSchema, init_binding_schema } from "../../routing/binding-schema.js";
 import { AgentCatalogRepository, init_repository } from "../repository.js";
-import { init_write_file_atomic, writeTextAtomicSync } from "../../infra/write-file-atomic.js";
 import { backupDatabaseBeforeCutover } from "../../storage/sqlite/migrations/conversation-backup.js";
 import { copyFileSync, existsSync, readFileSync } from "node:fs";
 import { createHash, randomUUID } from "node:crypto";

package/dist/src/agent-catalog/repository.js

@@ -1,9 +1,9 @@
 import { __esmMin } from "../../_virtual/_rolldown/runtime.js";
 import { getSqliteDatabase, runSqliteWriteTransaction } from "../storage/sqlite/transaction.js";
 import { init_sqlite } from "../storage/sqlite/index.js";
+import { DEFAULT_AGENT_ID, init_id, normalizeAgentId } from "./id.js";
 import { AgentDefaultsSchema, AgentEntrySchema, DEFAULT_AGENT_MODEL_REF, DEFAULT_SKILL_POLICY } from "../agent-config/schema.js";
 import { init_agent_config } from "../agent-config/index.js";
-import { DEFAULT_AGENT_ID, init_id, normalizeAgentId } from "./id.js";
 import { BindingsSchema, init_binding_schema } from "../routing/binding-schema.js";
 import { randomUUID } from "node:crypto";
 //#region src/agent-catalog/repository.ts

package/dist/src/auth/oauth/xopc-cloud.js

@@ -3,8 +3,8 @@ import { generatePKCE, init_pkce } from "./pkce.js";
 import { init_resolution, resolveConnectedPlatformEndpoint } from "../../platform/resolution.js";
 import { hostname } from "node:os";
 import { randomBytes } from "node:crypto";
-import { setTimeout as setTimeout$1 } from "node:timers/promises";
 import http from "node:http";
+import { setTimeout as setTimeout$1 } from "node:timers/promises";
 //#region src/auth/oauth/xopc-cloud.ts
 function consoleUrl() {
 	return (process.env.XOPC_CONSOLE_URL ?? resolveConnectedPlatformEndpoint("authorizationServer") ?? DEFAULT_CONSOLE_URL).replace(/\/+$/, "");

package/dist/src/auth/sync-provider-auth.js

@@ -1,6 +1,6 @@
 import { __esmMin } from "../../_virtual/_rolldown/runtime.js";
-import { getDefaultAgentId, init_resolve_route } from "../routing/resolve-route.js";
 import { init_paths, resolveAgentAuthProfilesPath, resolveAuthProfilesPath, resolveOAuthPath } from "../config/paths.js";
+import { getDefaultAgentId, init_resolve_route } from "../routing/resolve-route.js";
 import { assertCurrentModelProvider, init_provider_policy } from "../providers/provider-policy.js";
 import { init_registry, isOAuthOnlyProvider } from "./oauth/registry.js";
 import { existsSync, readFileSync } from "node:fs";

package/dist/src/automations/capabilities/drafts.js

@@ -3,10 +3,10 @@ import { init_src } from "../../../packages/gateway-contract/src/index.js";
 import { init_trust_policy, resolveAutomationSafetyForTrust } from "../../user-context/trust-policy.js";
 import { getUserTrustPolicy } from "../../storage/sqlite/user-trust-repository.js";
 import { init_sqlite } from "../../storage/sqlite/index.js";
+import { init_agent_scope, resolveDefaultAgentId } from "../../agent/agent-scope.js";
 import { CapabilityError } from "../../capabilities/runtime/errors.js";
 import { ExternalEffectNotAppliedError } from "../../capabilities/runtime/external-operations.js";
 import { defineExternalCapability, defineReadCapability } from "../../capabilities/runtime/dispatcher.js";
-import { init_agent_scope, resolveDefaultAgentId } from "../../agent/agent-scope.js";
 import { AutomationCreateCapabilityInputSchema } from "./write.js";
 import { simulateAutomation } from "../draft/automation-draft-validator.js";
 import { AutomationDraftService } from "../draft/automation-draft-service.js";

package/dist/src/automations/service/action-executor.js

@@ -2,8 +2,8 @@ import { createLogger } from "../../utils/logger/index.js";
 import { init_logger } from "../../utils/logger.js";
 import { normalizeAgentId } from "../../agent-catalog/id.js";
 import { init_agent_scope } from "../../agent/agent-scope.js";
-import { init_session_key, resolveConversationId } from "../../routing/session-key.js";
 import { init_model_usage, withModelUsageOrigin } from "../../providers/model-usage.js";
+import { init_session_key, resolveConversationId } from "../../routing/session-key.js";
 import { resolveAutomationTimeoutSeconds } from "../domain/defaults.js";
 //#region src/automations/service/action-executor.ts
 init_model_usage();

package/dist/src/bootstrap/application-state.js

@@ -1,9 +1,9 @@
 import { requireXopcDatabase } from "../storage/sqlite/connection.js";
 import { init_sqlite } from "../storage/sqlite/index.js";
 import { AgentCatalogService } from "../agent-catalog/service.js";
+import { ensureStarterAgentsInitialized } from "../agent/starter-agents.js";
 import { cutoverLegacyAgentConfig } from "../agent-catalog/migrations/legacy-config-cutover.js";
 import "../agent-catalog/index.js";
-import { ensureStarterAgentsInitialized } from "../agent/starter-agents.js";
 import { migrateIdentityMarkdownToCatalog } from "../agent-catalog/migrations/identity-markdown-cutover.js";
 import { migrateCloudPublicModelsSync } from "../migrations/cloud-public-models.js";
 import { runBootstrapMigrationsSync } from "../migrations/runner.js";

package/dist/src/browser/providers/browser-ext-install.js

@@ -13,8 +13,8 @@ import { chmodSync, existsSync, mkdirSync, readFileSync, readdirSync, realpathSy
 import { fileURLToPath } from "node:url";
 import { execFileSync, spawn } from "node:child_process";
 import { createHash } from "node:crypto";
-import { readFile, readdir, rm } from "node:fs/promises";
 import AdmZip from "adm-zip";
+import { readFile, readdir, rm } from "node:fs/promises";
 //#region src/browser/providers/browser-ext-install.ts
 /**
 * Install bundled Chrome extension artifacts into {resolveBinDir()}/browser-ext/.

package/dist/src/capabilities/runtime/dispatcher.js

@@ -1,7 +1,7 @@
 import { SqliteCommitEffectError, init_transaction } from "../../storage/sqlite/transaction.js";
-import { OperationConflictError, executeAtomicOperation } from "./atomic-operations.js";
 import { CapabilityError } from "./errors.js";
 import { executeExternalOperation } from "./external-operations.js";
+import { OperationConflictError, executeAtomicOperation } from "./atomic-operations.js";
 import { createHash } from "node:crypto";
 import { z } from "zod";
 //#region src/capabilities/runtime/dispatcher.ts

package/dist/src/capabilities/runtime/product.js

@@ -1,6 +1,5 @@
 import { CapabilityError } from "./errors.js";
 import { CapabilityDispatcher } from "./dispatcher.js";
-import { registerAgentCapabilities } from "../../agent-catalog/capabilities.js";
 import { registerLocalAppReadCapabilities } from "../../local-apps/capabilities/read.js";
 import { registerNoteReadCapabilities } from "../../notes/capabilities/read.js";
 import { registerNoteWriteCapabilities } from "../../notes/capabilities/write.js";
@@ -17,6 +16,7 @@ import { registerAutomationDraftCapabilities } from "../../automations/capabilit
 import { registerTaskWriteCapabilities } from "../../tasks/capabilities/write.js";
 import { registerSettingsCapability } from "./settings.js";
 import { registerAppContextCapability } from "./app-context.js";
+import { registerAgentCapabilities } from "../../agent-catalog/capabilities.js";
 //#region src/capabilities/runtime/product.ts
 function createProductDispatcher(getNotes, taskWrites) {
 	const dispatcher = new CapabilityDispatcher();

package/dist/src/capabilities/store-connector.js

@@ -1,10 +1,11 @@
 import { getCliAdapter } from "../connectors/cli/adapterRegistry.js";
+import { validEndpointDomain } from "../connectors/endpoint-policy.js";
 import { listConnectorInstances } from "../connectors/instances.js";
 import { installConnectorDefinition } from "../connectors/install.js";
 import { downloadConnectorStoreZipBuffer, fetchStoreConnectorPackageDetail, listConnectorPackages, resolveSkillsStoreBaseUrl } from "../agent/skills/marketplace/adapters/store/store-api-client.js";
 import { createHash } from "node:crypto";
-import { isIP } from "node:net";
 import AdmZip from "adm-zip";
+import { isIP } from "node:net";
 //#region src/capabilities/store-connector.ts
 const STORE_CONNECTOR_CANDIDATE_PREFIX = "store-connector:";
 function storeConnectorCandidateRef(packageName, version) {
@@ -130,8 +131,7 @@ function readSetup(value) {
 }
 function assertDeclaredTemplateReferences(value, setupKeys) {
 	if (typeof value === "string") {
-		const match = TEMPLATE_PATTERN.exec(value.trim());
-		if (match && !setupKeys.has(`${match[1]}:${match[2]}`)) throw new Error(`Connector template references undeclared ${match[1]} field "${match[2]}".`);
+		for (const match of value.matchAll(/\{\{(secrets|config)\.([A-Za-z0-9_.-]+)\}\}/g)) if (!setupKeys.has(`${match[1]}:${match[2]}`)) throw new Error(`Connector template references undeclared ${match[1]} field "${match[2]}".`);
 		return;
 	}
 	if (Array.isArray(value)) {
@@ -152,6 +152,10 @@ function assertSafeRemoteUrl(value) {
 	}
 	const hostname = url.hostname.toLowerCase().replace(/^\[|\]$/g, "");
 	if (url.protocol !== "https:" || url.username || url.password || hostname === "localhost" || hostname.endsWith(".localhost") || isIP(hostname)) throw new Error("Store connectors must use a public HTTPS MCP endpoint.");
+	if (/\{\{/.test(urlString)) {
+		if ([...urlString.matchAll(/\{\{secrets\.([A-Za-z0-9_.-]+)\}\}/g)].length !== 1 || /^https:\/\/[^/?#]*\{\{/.test(urlString) || url.hash) throw new Error("Connector URL may contain one secret in its path or query only.");
+		return urlString;
+	}
 	return url.toString();
 }
 function readPermissions(value, isLocal) {
@@ -263,7 +267,21 @@ function readConnectorManifest(value, packageName, version, sha256) {
 		mode: "oauth",
 		...clientId ? { clientId } : {}
 	} : { mode: authMode };
-	const category = asString(manifest.category, "Connector category");
+	const marketCategory = asString(manifest.category, "Connector category");
+	const category = {
+		logistics: "data",
+		commerce: "data",
+		analytics: "data",
+		projects: "automation",
+		design: "docs",
+		productivity: "automation",
+		industry: "data",
+		sales: "automation",
+		marketing: "automation",
+		finance: "data",
+		hr: "automation",
+		legal: "docs"
+	}[marketCategory] ?? marketCategory;
 	if (![
 		"code",
 		"docs",
@@ -271,7 +289,7 @@ function readConnectorManifest(value, packageName, version, sha256) {
 		"data",
 		"automation",
 		"custom"
-	].includes(category)) throw new Error(`Unsupported connector category: ${category}`);
+	].includes(category)) throw new Error(`Unsupported connector category: ${marketCategory}`);
 	const capabilities = asStringArray(manifest.capabilities, "Connector capabilities");
 	const allowedCapabilities = new Set([
 		"tools",
@@ -291,8 +309,20 @@ function readConnectorManifest(value, packageName, version, sha256) {
 	const { setup, keys: setupKeys } = readSetup(manifest.setup);
 	assertDeclaredTemplateReferences(serverTemplate, setupKeys);
 	const permissions = readPermissions(manifest.permissions, Boolean(localPackage));
-	const endpoint = localPackage ? void 0 : assertSafeRemoteUrl(serverTemplate.url);
-	const hostname = endpoint ? new URL(endpoint).hostname : void 0;
+	const endpointReference = typeof serverTemplate.url === "string" ? TEMPLATE_PATTERN.exec(serverTemplate.url) : null;
+	let endpointPolicy;
+	if (!localPackage && endpointReference) {
+		const policy = asRecord(runtime.endpointPolicy, "Connector endpoint policy");
+		const domains = asStringArray(policy.domains, "Connector endpoint domains");
+		const pathPrefixes = asStringArray(policy.pathPrefixes, "Connector endpoint paths");
+		if (endpointReference[1] !== "secrets" || !domains.length || domains.some((domain) => !validEndpointDomain(domain)) || !pathPrefixes.length || pathPrefixes.some((path) => !path.startsWith("/") || /[?#]|\.\./.test(path)) || domains.some((domain) => !permissions.networkDomains?.includes(domain))) throw new Error("Connector endpoint policy must constrain a secret URL to declared provider domains and MCP paths.");
+		endpointPolicy = {
+			domains,
+			pathPrefixes
+		};
+	}
+	const endpoint = localPackage ? void 0 : endpointReference ? serverTemplate.url : assertSafeRemoteUrl(serverTemplate.url);
+	const hostname = endpoint && !endpointReference ? new URL(endpoint).hostname : void 0;
 	if (hostname && permissions.networkDomains?.length && !permissions.networkDomains.some((domain) => domain.toLowerCase() === hostname.toLowerCase())) throw new Error("Connector network permissions must include the MCP endpoint host.");
 	return {
 		id: packageName,
@@ -310,14 +340,19 @@ function readConnectorManifest(value, packageName, version, sha256) {
 			type: "mcp",
 			serverId: asString(runtime.serverId, "Connector MCP serverId"),
 			serverTemplate: localPackage ? serverTemplate : {
-				...serverTemplate,
+				...Object.fromEntries(Object.entries(serverTemplate).filter(([key]) => ![
+					"transport",
+					"connectionTimeoutMs",
+					"requestTimeoutMs",
+					"oauth"
+				].includes(key))),
 				url: endpoint,
-				...authMode === "oauth" ? { auth: {
-					type: "oauth",
-					...clientId ? { clientId } : {}
-				} } : {}
+				type: "http",
+				...typeof serverTemplate.requestTimeoutMs === "number" || typeof serverTemplate.connectionTimeoutMs === "number" ? { timeout: serverTemplate.requestTimeoutMs ?? serverTemplate.connectionTimeoutMs } : {},
+				...authMode === "oauth" ? { oauth: { ...clientId ? { clientId } : {} } } : {}
 			},
-			...localPackage ? { localPackage } : {}
+			...localPackage ? { localPackage } : {},
+			...endpointPolicy ? { endpointPolicy } : {}
 		},
 		permissions,
 		provenance: {

package/dist/src/chat-commands/agent-edit.js

@@ -1,7 +1,7 @@
 import { normalizeAgentId } from "../agent-catalog/id.js";
 import { init_agent_scope, resolveAgentProfileDir } from "../agent/agent-scope.js";
-import { init_agent_session_key, resolveAgentIdFromConversationId } from "../routing/agent-session-key.js";
 import { WORKSPACE_FILES, init_paths } from "../config/paths.js";
+import { init_agent_session_key, resolveAgentIdFromConversationId } from "../routing/agent-session-key.js";
 import { commandRegistry } from "./registry.js";
 import { join } from "node:path";
 import { readFile } from "node:fs/promises";

package/dist/src/chat-commands/builtins/config.js

@@ -1,7 +1,7 @@
 import { createLogger } from "../../utils/logger/index.js";
 import { init_logger } from "../../utils/logger.js";
-import { ConfigSchema, init_schema } from "../../config/schema.js";
 import { init_paths, resolveConfigPath } from "../../config/paths.js";
+import { ConfigSchema, init_schema } from "../../config/schema.js";
 import { commandRegistry } from "../registry.js";
 import { parseConfigValue } from "../config-value.js";
 import { getConfigValueAtPath, parseConfigPath, setConfigValueAtPath, unsetConfigValueAtPath } from "../config-paths.js";

package/dist/src/chat-commands/context.js

@@ -1,7 +1,7 @@
 import { createLogger } from "../utils/logger/index.js";
 import { init_logger } from "../utils/logger.js";
-import { resolveEffectiveAgentConfigForSession } from "../config/agent-profile.js";
 import { getAgentDefaultModelRef, init_schema } from "../config/schema.js";
+import { resolveEffectiveAgentConfigForSession } from "../config/agent-profile.js";
 import { effectiveWorkspacePathForSession } from "../session/session-workspace.js";
 import { getProjectForSession } from "../projects/workspace.js";
 import { getSessionDisplayName } from "./session-key.js";

package/dist/src/cli/commands/agent.js

@@ -1,8 +1,8 @@
 import { createLogger } from "../../utils/logger/index.js";
 import { init_logger } from "../../utils/logger.js";
 import { init_agent_scope, resolveDefaultAgentId } from "../../agent/agent-scope.js";
-import { init_agent_session_key, resolveAgentMainConversationId } from "../../routing/agent-session-key.js";
 import { getAgentDefaultModelRef, init_schema } from "../../config/schema.js";
+import { init_agent_session_key, resolveAgentMainConversationId } from "../../routing/agent-session-key.js";
 import { getWorkspacePath } from "../../config/workspace-path-helpers.js";
 import { ExtensionLoader } from "../../extensions/loader.js";
 import "../../extensions/index.js";

package/dist/src/cli/commands/agents.js

@@ -1,8 +1,8 @@
 import { normalizeAgentId, validateAgentIdForNewAgent } from "../../agent-catalog/id.js";
 import { AgentCatalogRepository, init_repository } from "../../agent-catalog/repository.js";
 import { init_agent_scope, resolveAgentDir, resolveAgentWorkspaceDir, resolveDefaultAgentId } from "../../agent/agent-scope.js";
-import { AgentCatalogService } from "../../agent-catalog/service.js";
 import { resolveEffectiveAgentConfigForAgent } from "../../config/agent-profile.js";
+import { AgentCatalogService } from "../../agent-catalog/service.js";
 import { colors } from "../utils/colors.js";
 //#region src/cli/commands/agents.ts
 init_repository();

package/dist/src/cli/commands/doctor/checks/provider-auth.js

@@ -1,6 +1,6 @@
 import { AgentCatalogRepository, init_repository } from "../../../../agent-catalog/repository.js";
-import { getDefaultAgentId, init_resolve_route } from "../../../../routing/resolve-route.js";
 import { getAgentDefaultModelRef, init_schema, parseModelRef } from "../../../../config/schema.js";
+import { getDefaultAgentId, init_resolve_route } from "../../../../routing/resolve-route.js";
 import { PROVIDER_ENV_MAP, init_env_keys } from "../../../../providers/env-keys.js";
 import { getModelOAuthProviderIds, init_registry } from "../../../../auth/oauth/registry.js";
 import { CredentialResolver, init_credentials } from "../../../../auth/credentials.js";

package/dist/src/cli/commands/extension-agent-plugin.js

@@ -1,13 +1,13 @@
-import { getWorkspacePath } from "../../config/workspace-path-helpers.js";
 import { pluginAuthorizations } from "../../extensions/agent-plugins/setup-contract.js";
 import { PLUGIN_MANIFEST_PATHS } from "../../extensions/agent-plugins/formats.js";
 import { pluginServerId } from "../../extensions/agent-plugins/validation.js";
 import { isGitPluginSource } from "../../extensions/agent-plugins/source-catalog.js";
 import { AgentPluginStore } from "../../extensions/agent-plugins/store.js";
+import { getWorkspacePath } from "../../config/workspace-path-helpers.js";
 import { loadConfig } from "../../config/loader.js";
+import { PluginSetupService } from "../../extensions/agent-plugins/setup.js";
 import { getContextWithOpts } from "../context.js";
 import { isAgentPluginArchive, withAgentPluginSource } from "../../extensions/agent-plugins/sources.js";
-import { PluginSetupService } from "../../extensions/agent-plugins/setup.js";
 import { removePluginCredentials } from "../../extensions/agent-plugins/credentials.js";
 import { join, resolve } from "node:path";
 import { existsSync, readFileSync, statSync } from "node:fs";

package/dist/src/cli/commands/extension-marketplace.js

@@ -1,7 +1,7 @@
 import { init_paths, resolveExtensionsDir } from "../../config/paths.js";
-import { downloadExtensionStoreZipBuffer, resolveExtensionZipDownloadUrl, resolveExtensionsStoreBaseUrl, verifyStoreArtifactSha256 } from "../../agent/skills/marketplace/adapters/store/store-api-client.js";
 import { computeExtensionDirectoryIntegrity, getExtensionLockfileManager } from "../../extensions/lockfile.js";
 import { AgentPluginStore } from "../../extensions/agent-plugins/store.js";
+import { downloadExtensionStoreZipBuffer, resolveExtensionZipDownloadUrl, resolveExtensionsStoreBaseUrl, verifyStoreArtifactSha256 } from "../../agent/skills/marketplace/adapters/store/store-api-client.js";
 import { loadConfig } from "../../config/loader.js";
 import { getContextWithOpts } from "../context.js";
 import { peekExtensionManifestFromStoreZip } from "../../extensions/install.js";

package/dist/src/cli/commands/gateway/lifecycle.js

@@ -1,8 +1,8 @@
 import { init_paths, resolveConfigPath } from "../../../config/paths.js";
 import { loadConfig } from "../../../config/loader.js";
 import "../../../config/index.js";
-import { isRestartEnabled } from "../../../config/commands.flags.js";
 import { resolveGatewayService } from "../../../daemon/service.js";
+import { isRestartEnabled } from "../../../config/commands.flags.js";
 import { authorizeGatewaySigusr1Restart, writeGatewayRestartIntentSync } from "../../../infra/restart.js";
 import { findVerifiedGatewayListenerPidsOnPortSync, formatGatewayPidList, signalVerifiedGatewayPidSync } from "../../../infra/gateway-processes.js";
 import { runServiceRestart, runServiceStop } from "./lifecycle-core.js";

package/dist/src/cli/commands/mcp.js

@@ -1,9 +1,9 @@
 import { getNativePiAgentDir, prepareNativeMcpConfig } from "../../agent/mcp/native-mcp.js";
 import { loadConfig } from "../../config/loader.js";
+import { resolveMcpSetupConfig } from "../../agent/mcp/effective-server.js";
 import { register } from "../registry.js";
 import { createGatewayHttpClientFromConfig } from "../../mcp/gateway-http-client.js";
 import { createCapabilityMcpServer } from "../../mcp/capability-server.js";
-import { resolveMcpSetupConfig } from "../../agent/mcp/effective-server.js";
 import { join } from "node:path";
 import { chmodSync, existsSync, readFileSync, writeFileSync } from "node:fs";
 import { main } from "@earendil-works/pi-coding-agent";