@xopcai/xopc 0.0.425 → 0.0.427

package/dist/src/agent/mcp/tool-catalog.js

@@ -1,6 +1,6 @@
+import { resolveMcpSetupConfig } from "./effective-server.js";
 import { createEmbeddedModelRuntime } from "../embedded/model-runtime.js";
 import { getNativePiAgentDir, prepareNativeMcpConfig } from "./native-mcp.js";
-import { resolveMcpSetupConfig } from "./effective-server.js";
 import { join } from "node:path";
 import { InMemoryCredentialStore, InMemoryModelsStore } from "@earendil-works/pi-ai";
 import { DefaultResourceLoader, ModelRuntime, SessionManager, SettingsManager, createAgentSession, createMcpExtension, createToolSearchExtension } from "@earendil-works/pi-coding-agent";
@@ -22,6 +22,22 @@ async function runNativeMcpSession(config, workspaceDir, serverId, interaction,
 	const entry = loaded.servers.find((server) => server.name === serverId);
 	if (!entry) throw new Error(`MCP server "${serverId}" is not configured or has invalid configuration.`);
 	if (entry.config.enabled === false) throw new Error(`MCP server "${serverId}" is disabled.`);
+	if (interaction && options?.callbackRelayUrl && "url" in entry.config) {
+		const relay = new URL(options.callbackRelayUrl);
+		if (relay.protocol !== "https:" && !(relay.protocol === "http:" && [
+			"127.0.0.1",
+			"localhost",
+			"[::1]"
+		].includes(relay.hostname))) throw new Error("A secure callback relay is required.");
+		if (relay.username || relay.password || relay.search || relay.hash) throw new Error("Invalid callback relay.");
+		entry.config = {
+			...entry.config,
+			oauth: {
+				...entry.config.oauth,
+				callbackRelayUrl: relay.href
+			}
+		};
+	}
 	const agentDir = getNativePiAgentDir();
 	const settingsManager = SettingsManager.inMemory({
 		retry: { enabled: false },
@@ -116,7 +132,8 @@ async function runNativeMcpSession(config, workspaceDir, serverId, interaction,
 			name: tool.name,
 			description: tool.description,
 			inputSchema: tool.parameters,
-			exposure: tool.exposure
+			exposure: tool.exposure,
+			annotations: tool.annotations
 		})).sort((a, b) => a.name.localeCompare(b.name));
 	} finally {
 		try {

package/dist/src/agent/mcp/weixin-setup-scope.d.ts

@@ -0,0 +1,12 @@
+import type { Config } from '../../config/schema.js';
+export type WeixinPrivateIdentity = {
+    accountId: string;
+    peerId: string;
+    principalId: string;
+};
+export type WeixinSetupScope = WeixinPrivateIdentity & {
+    origin: string;
+};
+/** Pairing permits a bounded proposal; it never grants general owner authority. */
+export declare function weixinPrivateIdentity(conversationId: string, config: Config): WeixinPrivateIdentity | undefined;
+export declare function weixinSetupScope(conversationId: string, config: Config): WeixinSetupScope | undefined;

package/dist/src/agent/mcp/weixin-setup-scope.js

@@ -0,0 +1,43 @@
+import { getConversationRouting } from "../../storage/sqlite/conversation-repository.js";
+import { init_session_key } from "../../routing/session-key.js";
+import { weixinAccountIdentityRevision } from "../../channels/weixin/account-identity.js";
+import { resolveWeixinAllowFromPath } from "../../channels/pairing/paths.js";
+import { readAllowFromIdsSync } from "../../channels/pairing/allow-from-file.js";
+import { resolveReverseProxyPublicUrl } from "../../gateway/public-url.js";
+//#region src/agent/mcp/weixin-setup-scope.ts
+init_session_key();
+/** Pairing permits a bounded proposal; it never grants general owner authority. */
+function weixinPrivateIdentity(conversationId, config) {
+	if (config.session.dmScope !== "per-account-channel-peer" || Object.keys(config.session.identityLinks ?? {}).length) return;
+	const route = getConversationRouting(conversationId);
+	if (route?.source !== "weixin" || route.peerKind !== "direct" || !route.accountId || !route.peerId) return;
+	const section = config.channels?.weixin;
+	const account = section?.accounts?.[route.accountId];
+	if (section?.enabled !== true || account?.enabled === false || (account?.dmPolicy ?? section.dmPolicy) === "disabled") return;
+	if (![...account?.allowFrom ?? section.allowFrom ?? [], ...readAllowFromIdsSync(resolveWeixinAllowFromPath(route.accountId))].some((id) => id.trim().toLowerCase() === route.peerId.toLowerCase())) return;
+	const loginRevision = weixinAccountIdentityRevision(route.accountId);
+	if (!loginRevision) return;
+	return {
+		accountId: route.accountId,
+		peerId: route.peerId,
+		principalId: `channel:weixin:${route.accountId}:direct:${route.peerId}:login:${loginRevision}`
+	};
+}
+function weixinSetupScope(conversationId, config) {
+	const identity = weixinPrivateIdentity(conversationId, config);
+	if (!identity) return;
+	const origin = resolveReverseProxyPublicUrl(config);
+	if (!origin) return;
+	const url = new URL(origin);
+	if (url.protocol !== "https:" && ![
+		"127.0.0.1",
+		"localhost",
+		"[::1]"
+	].includes(url.hostname)) return;
+	return {
+		...identity,
+		origin
+	};
+}
+//#endregion
+export { weixinPrivateIdentity, weixinSetupScope };

package/dist/src/agent/prompt/conversational-configuration-guide.js

@@ -19,7 +19,8 @@ or topic:"settings", "automation", "connections" as relevant; no need to load a
 /** Tool registration already reflects the host's allowlist and deny policy. */
 function getConversationalConfigurationGuide(toolNames) {
 	if (!toolNames.includes("xopc_use")) return "";
-	return toolNames.includes("tool_manual") ? conversationalConfigurationGuide : conversationalConfigurationGuide.replace(manualRouting, "No tool_manual is registered. Use documented registered parameters; report a blocker if required details are unavailable.\n");
+	const guide = `${toolNames.includes("tool_manual") ? conversationalConfigurationGuide : conversationalConfigurationGuide.replace(manualRouting, "No tool_manual is registered. Use documented registered parameters; report a blocker if required details are unavailable.\n")}\nxopc_use is registered and may be deferred. If its schema is absent and tool_search is available, discover the exact name before reporting it missing. Never bypass policy.\n${toolNames.includes("mcp_setup") ? "HTTP MCP: mcp_setup is directly available. Its probes execute on the Gateway host; user-provided loopback addresses are supported. Check with this tool before claiming a missing capability or unreachable address. Use inspect/start/advance; secrets use interactionPath.\n" : ""}`;
+	return toolNames.includes("skill_manage") ? `${guide}\nFor Skill configuration use skill_manage status/enable/disable/delete and skill_install; never edit product storage through shell/file tools. A clear request to install a specified source already authorizes that installation: do not ask for the same confirmation again. Search or a pasted URL alone does not authorize installation; overwrites or additional permissions require their own authorization. Load the skills manual topic when needed. Installation is not a verified first use. For an explicit HTTP MCP service address, use xopc_use mode mcp_setup and manual topic mcp; credentials use its trusted interaction page.\n` : guide;
 }
 //#endregion
 export { conversationalConfigurationGuide, getConversationalConfigurationGuide };

package/dist/src/agent/prompt/sections/tooling.js

@@ -68,12 +68,12 @@ const CORE_TOOL_SUMMARIES = {
 	session_status: "Show session usage/time/model state",
 	tool_manual: "Load built-in usage manuals for complex tools",
 	delegate_task: "Spawn an isolated sub-agent for a delegated task",
-	automation: "Manage product automations",
+	automation: "Manage product automations; explicit local create/edit/pause/resume/delete requests authorize that operation without duplicate confirmation",
 	skills_list: "List available skills",
 	skill_view: "Load a skill SKILL.md or sub-documents",
 	skill_manage: "Create or update skills on disk",
 	skills_marketplace_search: "Search and rank skills across Store, ClawHub, and skills.sh without installing",
-	skill_install: "Install a skill from an explicit Git, archive, file, or local source after confirmation",
+	skill_install: "Install a skill from a marketplace or explicit source when the user requests installation; that request is consent, do not ask again",
 	todo: "Manage in-session todo items",
 	clarify: "Ask the user a blocking clarification question",
 	text_to_speech: "Send a standalone voice message",
@@ -132,6 +132,7 @@ function buildToolingSection(params) {
 		"## Tooling",
 		"Tool availability (filtered by policy):",
 		"Use only case-sensitive names in current function schemas; prose/history examples grant no tool. Never probe invented names. Missing prerequisites: give a final blocker, without unrelated calls.",
+		availableTools.has("tool_search") ? "Registered tools may be deferred. Use tool_search for the exact name before reporting it missing; call only after its schema loads." : "",
 		hasPublishArtifacts && !hasRead && !hasWrite && !hasPatch && !hasExec ? "Only publication is available for workspace files. For a request to edit then publish, editing is blocked: make no publication call and explain the limitation. Publish an existing file only when the user requests that existing content without an outstanding edit." : "",
 		"When a tool returns an xopc product link, reuse its exact URL in a Markdown link with a short descriptive label in the user's language (for example, [打开会话](url)). Do not invent link parameters, escape the link brackets/parentheses, or wrap a navigation link in a code span. Avoid repeating raw URLs or internal object metadata unless requested.",
 		toolLines.length > 0 ? toolLines.join("\n") : "- No tools are registered for this session.",

package/dist/src/agent/prompt/service-prompt-builder.js

@@ -9,9 +9,9 @@ import "../../storage/sqlite/index.js";
 import { appendStablePromptSection } from "./cache-boundary.js";
 import { getUserTimezone } from "../../user-model/repository.js";
 import "../../user-model/index.js";
+import { resolveResponseLanguageForSession } from "./response-language.js";
 import { resolveSystemPromptBuildParams } from "./system-prompt-params.js";
 import { buildSystemPrompt } from "./system-prompt.js";
-import { resolveResponseLanguageForSession } from "./response-language.js";
 import { buildTtsSystemPromptHint } from "../../voice/tts/directives.js";
 import { mergeTtsConfigFromAppConfig } from "../../voice/tts/merge-config.js";
 import { getConversationalConfigurationGuide } from "./conversational-configuration-guide.js";

package/dist/src/agent/service/direct-turn-helpers.js

@@ -2,9 +2,9 @@ import { getConnectionResumeInput, init_connection_wait_repository } from "../..
 import { getClarificationResumeInput } from "../../storage/sqlite/clarification-wait-repository.js";
 import { isPersonalConversation } from "../../personal-agent/repository.js";
 import { phoneResumeForRun } from "../../phone/assistance.js";
+import { buildDelegatedTaskDirective, buildTaskExecutionDirective } from "../../tasks/task-context-assembler.js";
 import { resolveImageHandlingStrategy } from "../image/vision-detection.js";
 import { hydrateUserTurnForLlm } from "../inbound/attachment-pipeline.js";
-import { buildDelegatedTaskDirective, buildTaskExecutionDirective } from "../../tasks/task-context-assembler.js";
 import { shouldSkipResetOverlapCommand } from "../../session/reset-triggers.js";
 import { parseSlashCommand } from "../../chat-commands/command-parse.js";
 import { personalCommandRejection } from "../../chat-commands/personal-command-policy.js";

package/dist/src/agent/service/process-direct-streaming.js

@@ -8,11 +8,11 @@ import { init_agent_scope, resolveDefaultAgentId } from "../agent-scope.js";
 import { init_model_usage, modelUsageOriginFromTurn, withModelUsageOrigin } from "../../providers/model-usage.js";
 import { init_agent_session_key, resolveAgentMainConversationId } from "../../routing/agent-session-key.js";
 import { phoneResumeForRun } from "../../phone/assistance.js";
-import { abortEmbeddedRun } from "../embedded/runs.js";
-import { clearPendingTranscriptUserMessage, setPendingTranscriptUserMessage } from "../inbound/attachment-pipeline.js";
 import { mergeSttConfigFromAppConfig } from "../../voice/stt/config.js";
 import "../../voice/stt/index.js";
 import { isSessionSourceBinding, summarizeSourceContext } from "../source-context/types.js";
+import { abortEmbeddedRun } from "../embedded/runs.js";
+import { clearPendingTranscriptUserMessage, setPendingTranscriptUserMessage } from "../inbound/attachment-pipeline.js";
 import { formatAgentRunErrorForClient } from "../client-error-format.js";
 import { resolveConfiguredActivityDetailDefault, resolveEffectiveReasoningLevel } from "../../session/thinking-resolve.js";
 import { initSessionTurn } from "../../session/init-session-turn.js";

package/dist/src/agent/service.d.ts

@@ -182,6 +182,8 @@ export declare class AgentService {
      * `agentService.sessionStore.*` directly.
      */
     clearSessionMessages(key: string): Promise<void>;
+    /** Revoke setup grants and release independent verification sessions before resetting. */
+    cancelConfigurationSetups(conversationId: string): Promise<void>;
     /**
      * Reset session transcript (archive + new session id) and evict in-memory agent state.
      * Preserves the session key and persisted per-session overrides.

package/dist/src/agent/service.js

@@ -20,13 +20,13 @@ import { removeSkillsLockEntry } from "./skills/hub-lock.js";
 import { installSkillFromZip } from "./skills/managed-store.js";
 import { resolveWorkspaceSkillsDir, resolveWorkspaceSkillsLockPath } from "./skills/workspace-skills-dir.js";
 import { pullSkillFromSource } from "./skills/hub-pull.js";
+import { resolveResponseLanguageForSession } from "./prompt/response-language.js";
 import { persistInboundAttachments } from "../channels/attachments/inbound-persist.js";
 import { buildTranscriptUserMessage, hydrateUserTurnForLlm } from "./inbound/attachment-pipeline.js";
 import { drainEmbeddedSessionRunnerShutdowns } from "./embedded/session-runner.js";
 import { resolveCompactionPolicy } from "./memory/compaction-policy.js";
 import { getModelThinking } from "../providers/model-thinking.js";
 import { runXopcEmbeddedTurn } from "./embedded/run-turn.js";
-import { resolveResponseLanguageForSession } from "./prompt/response-language.js";
 import { normalizeSkillInstallTarget } from "./skills/install-target.js";
 import { AgentManager } from "./agent-manager.js";
 import { MAX_WEBCHAT_ATTACHMENT_FILE_BYTES } from "../gateway/chat-limits.js";
@@ -237,6 +237,7 @@ var AgentService = class {
 			getAutomationService: config.getAutomationService,
 			getBrowserAutomationService: config.getBrowserAutomationService,
 			getBrowserSetupService: config.getBrowserSetupService,
+			getMcpSetupService: config.getMcpSetupService,
 			getPhoneSetupService: config.getPhoneSetupService,
 			canConfigureEndpoint: config.canConfigureEndpoint,
 			emitBrowserEvent: config.emitBrowserEvent,
@@ -798,6 +799,10 @@ var AgentService = class {
 		await this.sessionStore.saveMessages(key, []);
 		this.agentManager.removeAgent(key);
 	}
+	/** Revoke setup grants and release independent verification sessions before resetting. */
+	async cancelConfigurationSetups(conversationId) {
+		await Promise.all([this.config.getPhoneSetupService?.()?.cancelConversation(conversationId), this.config.getBrowserSetupService?.()?.cancelConversation(conversationId)]);
+	}
 	/**
 	* Reset session transcript (archive + new session id) and evict in-memory agent state.
 	* Preserves the session key and persisted per-session overrides.
@@ -805,6 +810,11 @@ var AgentService = class {
 	async resetSession(key) {
 		const { abortEmbeddedRun } = await import("./embedded/runs.js");
 		await abortEmbeddedRun(key);
+		await this.cancelConfigurationSetups(key);
+		const { getPhoneRuntime } = await import("../phone/runtime.js");
+		const { cancelPhoneAssistance } = await import("../phone/assistance.js");
+		cancelPhoneAssistance(key);
+		await getPhoneRuntime().stop(key, "close");
 		const task = await this.sessionStore.reset(key);
 		if (!task) return null;
 		this.agentManager.removeAgent(key);

package/dist/src/agent/service.types.d.ts

@@ -32,6 +32,7 @@ export interface AgentServiceConfig {
     canConfigureEndpoint?: (endpointId: string) => boolean;
     getPhoneSetupService?: () => import('../phone/setup/service.js').PhoneSetupService | undefined;
     getBrowserSetupService?: () => import('../browser/setup/service.js').BrowserSetupService | undefined;
+    getMcpSetupService?: () => import('./mcp/conversation-setup.js').McpConversationSetup | undefined;
     getBrowserAutomationService?: () => import('../browser/automations/index.js').BrowserAutomationService | undefined;
     emitBrowserEvent?: (type: string, payload: unknown) => void;
     /** Gateway: exposes first-class xopc product objects for the `xopc_use` tool. */

package/dist/src/agent/tasks/task-judge-service.js

@@ -12,10 +12,10 @@ import { resolveTaskLocale } from "../../tasks/task-language.js";
 import { TaskConversationRepository } from "../../tasks/task-conversation-repository.js";
 import { readWorkspaceRevision } from "../coding/workspace-revision.js";
 import { TaskCollaborationRepository } from "../../tasks/task-collaboration-repository.js";
+import { TaskApplicationService } from "../../tasks/task-application-service.js";
+import { resolveResponseLanguageForSession } from "../prompt/response-language.js";
 import { currentTaskResearchResult } from "../../tasks/task-research-result.js";
 import { buildResponseLanguageSection } from "../prompt/sections/response-language.js";
-import { resolveResponseLanguageForSession } from "../prompt/response-language.js";
-import { TaskApplicationService } from "../../tasks/task-application-service.js";
 //#region src/agent/tasks/task-judge-service.ts
 init_schema();
 init_providers();

package/dist/src/agent/tool-manuals/xopc-configuration.d.ts

@@ -1,10 +1,12 @@
 /** Focused product workflows; loaded on demand instead of expanding every turn. */
 export declare const xopcConfigurationTopics: {
+    readonly mcp: "# HTTP MCP configuration\nIn Weixin do not inspect the global registry. The host chooses a stable connection id from\nthe exact service and private identity; use the returned serverId, and displayName for human\nlabels. Different service URLs never overwrite a connection because a model reused a name.\nA paired Weixin direct conversation can propose a new connection when the host has a secure\ngateway.publicUrl. Its returned absolute interactionPath requires authenticated owner approval\nof the exact service and Weixin identity, then secure Token/OAuth input. Send that exact link\nand stop; never ask for a secret, callback URL or continue reply in Weixin. The host resumes\nand delivers the actual result to the same original account/peer after authorization.\nPairing is not owner authority; no replacing/removing shared connections through this proposal.\nMissing pairing, HTTPS access or login is an honest blocker. Do not bypass it with local tools.\nWhen registered use mcp_setup; otherwise use xopc_use mode mcp_setup, the equivalent adapter.\nProbes run on the Gateway host, including user-provided HTTP loopback addresses. Never infer\nreachability from the browser/device context; use the actual probe and report its result.\ninspect {} returns configured server IDs and revisions without\nsecrets. For a clear connection request start {serverId,url,purpose,displayName?,expectedRevision?}.\nUse displayName for the user's service name. Derive a simple ASCII serverId when none was\nsupplied; do not ask users to invent technical identifiers. Use only the user-supplied or\nverified service URL, never invent one. start is HTTP-only and does\nnot execute package installers. purpose preserves the original user objective. Replacing a\nconfigured server requires its revision from inspect. Do not alter managed connectors/plugins.\nThen advance {setupId,expectedVersion} using the returned version. get {setupId} refreshes\nstatus; cancel requires the current version. OAuth/Token steps provide interactionPath:\nlink to that trusted product page, never request credentials or OAuth callbacks in chat.\nUse the exact returned interactionPath in a Markdown link; Weixin paths are absolute. Never prepend localhost or an origin to a relative product path. Do not invent a URL\nscheme or setup id. The host also displays a trusted Complete connection action above input.\nThe page owns sign-in, safe credential entry, verification and automatic return to the\noriginal objective. When ready/continuationQueued is returned, stop this turn; the host\ncontinues in a fresh turn where native MCP tools can load. Use native tool_search and the\ndiscovered exact tools for the original read; do not invent a tool name or claim a read from\ntool counts. set_enabled {serverId,enabled,expectedRevision} and remove {serverId,expectedRevision}\nchange local custom-server configuration. Removal does not revoke remote OAuth authorization\nor uninstall a package. A clear request to connect, disable, enable or remove a specific local\nconnection already authorizes that operation; do not ask for the same confirmation again.\nNew overwrite scope or additional privileges still require authorization. Respect permission refusals and report blocked/reload_required states.\nFor an already configured healthy service prefer its actual tools over replacing its setup.";
+    readonly skills: "# Skill configuration\nUse skill_manage status to inspect installed skills, including disabled ones and current Agent\navailability. skills_list contains only usable skills. Search with skills_marketplace_search;\nrecommendation alone never authorizes installation. Install an exact returned reference with\nskill_install only for a clear installation request. Default target is global; explain that\nscope, and use workspace when explicitly requested. Do not force-overwrite an existing skill\nwithout an explicit update/replace request. After an uncertain install inspect status and the\nexisting source before retrying; do not blindly reinstall. Enable/disable with skill_manage;\nthese flags are shared by name, not per-Agent permissions. Inspect the resulting state; do\nnot widen an allowlist, install dependencies through shell or ask for secrets in chat.\nDelete/uninstall with skill_manage delete only for writable managed user skills; bundled,\nplugin-owned and extra-directory skills must retain their owner management path. After\ninstallation, read skill_view and complete the user's requested first task. Return an actual\nresult, two relevant example requests and the installed-skills link. A ready state is not a\nsuccessful task test. Never claim success when requirements or Agent policy still block use.";
     readonly agent: "# xopc Agent configuration\nThe host's current Agent id is authoritative. \"You / this assistant\" means that Agent,\nnot main or the default Agent. Read agent get {id} (or list for discovery) for revision\nand effective inherited configuration. For identity changes prefer agent patch_profile\n{id,expectedRevision,patch:{name?,description?,style?,language?,...},idempotencyKey?}:\nomitted fields are preserved atomically. Existing agent update {id,expectedRevision,patch}\nremains a full replacement for patch.profile, so include every field to retain when using it.\nSet a chat model with update patch.models.chat={primary:\"provider/model\",fallbacks:[]}.\nChange only the requested Agent. Global defaults and other Agents are separate explicit\nrequests and still require permission. For creation list first, then create\n{id,profile:{name,language?,style?}}; do not invent a Project or custom workspace.\nset_default {id,expectedRevision} uses the catalog revision from list, not an Agent revision.\nAfter a revision conflict re-read the target, preserve concurrent fields and retry the\nrequested change once with the new revision and a new intent key. After an uncertain write,\ninspect first and retain the original idempotency key. A permission denial is not a conflict:\ndo not switch identity, target or tools to bypass it. Inspect returned product ok and saved\nfields before reporting success. A saved model reference does not prove it can be called.";
-    readonly phone_setup: "# Phone setup\nUse configure-xopc and references/phone/overview.md. Use plain conversation, never embedded chat\nconfiguration panels. mode phone_setup inspect/preview/start inspect or resume; models lists\ncompatible models. get/recheck/verification_report/cancel/release take {setupId}.\nAutomate source {setupId,source:local|aliyun,expectedRevision}, configure {setupId,enabled:true,\nexpectedRevision}, install_dependency {setupId,kind:adb|scrcpy,repair?:true,expectedRevision},\nset_model {setupId,modelRef:<listed compatible ref>,expectedRevision,replaceExisting?:true},\nregister_local {setupId,serial:<discovered online serial>,name?,expectedRevision}, and\nbegin_verification {setupId,deviceId,expectedRevision}. Writes require a host-authorized\ninteractive turn and preserve current policy. dryRun never writes. Do not silently select a\nphone, change the chat model, widen app access, use shell installs or submit keys in chat.\nUse set_model for the dedicated Phone model only; it cannot change the chat model; credentials use secure settings.\nExplain the Settings-only goal, screenshot sharing and model costs before testing. Get provides\nattempt.goal/completion/maxActions. Use phone_use open, observe, run, close, then verification_report.\nUser-only work is physical USB/RSA, login/OAuth, private-key entry/upload and cloud purchase.\nAfter interruption recheck, release the old test, resolve the cause and continue here.";
-    readonly browser_setup: "# Browser setup\nUse configure-xopc and its Browser references. Plain conversation only; no configuration panel\ninside chat. mode browser_setup inspect/preview/start inspect or resume. get/recheck/\nverification_report/cancel/release take {setupId}. prepare/advance {setupId,expectedRevision}\nautomatically prepares the managed extension/native host and enables the extension route in\nan authorized interactive turn. Explain and confirm a shared driver change before switchDriver:true.\nopen {setupId,target:chrome|folder|both,expectedRevision} opens the existing Chrome page/folder.\nOnly the user loads the unpacked extension and accepts native permissions. Recheck connection,\nresolve the intended Chrome with the user, explain the bounded read/click/fill demo, then use\nbegin_verification {setupId,endpointId,expectedRevision}. The host derives the fixture origin.\nUse normal browser_use calls on the returned attempt; close and read verification_report.\nNo API Key is needed. Preserve policy refusals and existing pairing; only manual steps need\nan ordinary link to settingsPath. dryRun never writes; opening a page is not proof of success.";
+    readonly phone_setup: "# Phone setup\nUse configure-xopc and references/phone/overview.md. Use plain conversation, no full settings page embedded in chat. Human-only steps use the returned interactionPath\nfor a small secure product modal; saving rechecks scope and returns to the original conversation. mode phone_setup inspect/preview/start inspect or resume; models lists\ncompatible models. get/recheck/verification_report/cancel/release take {setupId}.\nAutomate source {setupId,source:local|aliyun,expectedRevision}, configure {setupId,enabled:true,\nexpectedRevision}, install_dependency {setupId,kind:adb|scrcpy,repair?:true,expectedRevision},\nset_model {setupId,modelRef:<listed compatible ref>,expectedRevision,replaceExisting?:true},\nregister_local {setupId,serial:<discovered online serial>,name?,expectedRevision}, and\nbegin_verification {setupId,deviceId,expectedRevision}. Writes require a host-authorized\ninteractive turn and preserve current policy. dryRun never writes. Do not silently select a\nphone, change the chat model, widen app access, use shell installs or submit keys in chat.\nUse set_model for the dedicated Phone model only; it cannot change the chat model; credentials use the host interactionPath.\nExplain the Settings-only goal, screenshot sharing and model costs before testing. Get provides\nattempt.goal/completion/maxActions. Use phone_use open, observe, run, close, then verification_report.\nUser-only work is physical USB/RSA, login/OAuth, private-key entry/upload and cloud purchase.\nAfter interruption recheck, release the old test, resolve the cause and continue here.";
+    readonly browser_setup: "# Browser setup\nUse configure-xopc and its Browser references. Plain conversation for routine steps. Human-only steps use the returned interactionPath\nfor a small secure product modal; never collect credentials in chat. mode browser_setup inspect/preview/start inspect or resume. get/recheck/\nverification_report/cancel/release take {setupId}. prepare/advance {setupId,expectedRevision}\nautomatically prepares the managed extension/native host and enables the extension route in\nan authorized interactive turn. Explain and confirm a shared driver change before switchDriver:true.\nopen {setupId,target:chrome|folder|both,expectedRevision} opens the existing Chrome page/folder.\nOnly the user loads the unpacked extension and accepts native permissions. Recheck connection,\nresolve the intended Chrome with the user, explain the bounded read/click/fill demo, then use\nbegin_verification {setupId,endpointId,expectedRevision}. The host derives the fixture origin.\nUse normal browser_use calls on the returned attempt; close and read verification_report.\nNo API Key is needed. Preserve policy refusals and existing pairing; only manual steps need\nan ordinary link to interactionPath (settingsPath is the fallback). dryRun never writes; opening a page is not proof of success.";
     readonly settings: "# xopc settings and capability checks\nsettings open is navigation only; it does not read, apply or verify configuration.\nVoice: {section:\"capabilities/voice\",title:\"语音设置\"}; models: section:\"capabilities/models\";\nbrowser: section:\"agent-browser\". Unknown sections are rejected. There is no generic\nconfig/set, capability inspect or voice mutation in xopc_use. Never edit storage directly.\nFor a capability report read the current Agent's configuration, and use actual dedicated\nstatus/test tools if available. Model names or credentials alone are not proof of readiness.\nReport unknown when no verification tool exists. Saved, runtime-ready and tested differ.\nVoice settings are shared. Microphone permission, recording and playback need actual device\ninteraction. Return the exact product link and state the remaining action; never claim the\npage has opened or the device test passed from a navigation receipt. Do not invent UI buttons\nor promise audio verification unless the active tools can perform it.";
-    readonly automation: "# xopc automations\nUse automation list/get before changing an existing schedule or creating a potentially\nduplicate one. pause/resume takes {automationId,expectedRevision,idempotencyKey}; revision\nis the original updatedAtMs. Pause affects future scheduling, not proof a running job stopped.\nCreate with {name,enabled,trigger:{kind:\"schedule\",schedule:{kind:\"cron\",expr,tz}},\naction:{kind:\"agent\",instruction},delivery:{notificationPolicy:\"attention\",destinations:[]}}.\nUse the user's timezone. For 09:00 Asia/Shanghai use expr:\"0 9 * * *\",tz:\"Asia/Shanghai\".\nDraft / don't enable / don't run means enabled:false and no run call. simulate is not a real\nexecution. A one-off answer does not authorize creating a Task, Project, Agent or Automation.\nCheck returned ok and saved state; handle revision conflicts by re-reading, preserving changes\nand retrying once with the new revision. Keep original keys after uncertain writes.";
-    readonly connections: "# xopc external connections\nExternal services use their dedicated discovery, description, connection and execution tools,\nnot invented xopc_use connector commands or settings sections. When Gmail connection/read\ntools are absent, explain that specific blocker. Do not create or enable an email schedule\nbefore verifying the required account and a real read. Never invent a connection URL,\nconnected-apps/connections settings section, messages, or successful OAuth/reads.\nThe user saying \"connected\" is not evidence of working tools: rediscover and verify the\naccount and read permission before proceeding. Do not promise future execution while those\ntools are absent. Do not request passwords or API keys in ordinary chat.";
+    readonly automation: "# xopc automations\nIn a paired Weixin conversation the host pins result delivery to that exact original account\nand peer. Use notificationPolicy:all for requested reminders; do not invent a Weixin webhook,\nrecipient or client API. The normal saved run and durable delivery receipts remain separate.\nUse automation list/get before changing an existing schedule or creating a potentially\nduplicate one. pause/resume takes {automationId,expectedRevision,idempotencyKey}; revision\nis the original updatedAtMs. Pause affects future scheduling, not proof a running job stopped.\nCreate with {name,enabled,trigger:{kind:\"schedule\",schedule:{kind:\"cron\",expr,tz}},\naction:{kind:\"agent\",instruction},delivery:{notificationPolicy:\"all\",destinations:[{key:\"gateway_event\",kind:\"gateway_event\"}]}}.\nFor a reminder/report whose result the user expects, notify on success with notificationPolicy:all.\nattention is for exceptional/needs-action updates; none is for an explicitly silent task.\nUse the user's timezone. For 09:00 Asia/Shanghai use expr:\"0 9 * * *\",tz:\"Asia/Shanghai\".\nOne-time reminders use trigger:{kind:\"schedule\",schedule:{kind:\"once\",afterMs:90000}} for\n90 seconds after acceptance, or schedule:{kind:\"once\",at:<future ISO timestamp>}. The server\nanchors afterMs once within the stable receipt. Never encode a one-time reminder as cron:\ndate fields still repeat every year. Preserve the saved once/at when inspecting the result.\nDraft / don't enable / don't run means enabled:false and no run call. simulate is not a real\nexecution. For an explicitly requested trial, run the same saved disabled object, then read\nget_run {runId,waitMs:30000} until terminal or a real blocker. Queued/running is not completion.\nReport the actual result. When the user requested trial-before-enable, enable that same object\nonly after a successful run; never enable after failure or replace it with a duplicate.\nFor a custom HTTP MCP read, first verify a real read from the selected service. Then use\nautomation prepare_source {serverId,toolNames:[exact discovered tool names]} (or automation\naction prepare_source) to pin its server/grant reference and read-only tool contracts.\nUse optional toolInputs:{<exact tool name>:<fixed argument object>} for the verified read's\narguments; omitted inputs mean {}. Calls must retain these inputs, so account/query parameters\ncannot silently change on later runs. Dynamic parameter scopes require a dedicated adapter.\nCreate the disabled agent action with mcpSourceId:<returned sourceId>, agentId:<returned agentId>.\nEvery run is restricted to these tools and must actually read successfully. A changed or\ndisabled source fails, without switching services. Enabling requires a successful trial of\nthat exact action on the same object. Ordinary self-contained reminders need no MCP source.\nUse conversationMode:continuous when the user asks to retain task context between runs;\nhistorical context never replaces a fresh source read in the current run.\nWhen changing a bound action or assistant, save it paused, trial the updated action, then enable\nif authorized. Schedule-only edits retain the verified action. Existing source pins are retained\nwhen an agent action is replaced; omitting mcpSourceId cannot silently remove the boundary.\nThis generic source binding does not verify remote account identity. Explicit-account workflows\nremain disabled unless their account adapter verifies identity; never invent that verification.\nA clear create/change/pause/resume/delete request already authorizes that local operation;\ndo not repeat confirmation. A one-off answer does not authorize creating a Task, Project, Agent or Automation.\nCheck returned ok and saved state; handle revision conflicts by re-reading, preserving changes\nand retrying once with the new revision. Keep original keys after uncertain writes.";
+    readonly connections: "# xopc external connections\nFor a user-supplied HTTP MCP address, use the mcp manual topic and registered xopc_use\nmcp_setup commands. These configure a custom server; they are separate from connector discovery.\nExternal services use their dedicated discovery, description, connection and execution tools,\nnot invented xopc_use connector commands or settings sections. When Gmail connection/read\ntools are absent, explain that specific blocker. Do not create or enable an email schedule\nbefore verifying the required account and a real read. Never invent a connection URL,\nconnected-apps/connections settings section, messages, or successful OAuth/reads.\nThe user saying \"connected\" is not evidence of working tools: rediscover and verify the\naccount and read permission before proceeding. Do not promise future execution while those\ntools are absent. Do not request passwords or API keys in ordinary chat.";
 };
 export type XopcConfigurationTopic = keyof typeof xopcConfigurationTopics;

package/dist/src/agent/tool-manuals/xopc-configuration.js

@@ -1,6 +1,57 @@
 //#region src/agent/tool-manuals/xopc-configuration.ts
 /** Focused product workflows; loaded on demand instead of expanding every turn. */
 const xopcConfigurationTopics = {
+	mcp: `# HTTP MCP configuration
+In Weixin do not inspect the global registry. The host chooses a stable connection id from
+the exact service and private identity; use the returned serverId, and displayName for human
+labels. Different service URLs never overwrite a connection because a model reused a name.
+A paired Weixin direct conversation can propose a new connection when the host has a secure
+gateway.publicUrl. Its returned absolute interactionPath requires authenticated owner approval
+of the exact service and Weixin identity, then secure Token/OAuth input. Send that exact link
+and stop; never ask for a secret, callback URL or continue reply in Weixin. The host resumes
+and delivers the actual result to the same original account/peer after authorization.
+Pairing is not owner authority; no replacing/removing shared connections through this proposal.
+Missing pairing, HTTPS access or login is an honest blocker. Do not bypass it with local tools.
+When registered use mcp_setup; otherwise use xopc_use mode mcp_setup, the equivalent adapter.
+Probes run on the Gateway host, including user-provided HTTP loopback addresses. Never infer
+reachability from the browser/device context; use the actual probe and report its result.
+inspect {} returns configured server IDs and revisions without
+secrets. For a clear connection request start {serverId,url,purpose,displayName?,expectedRevision?}.
+Use displayName for the user's service name. Derive a simple ASCII serverId when none was
+supplied; do not ask users to invent technical identifiers. Use only the user-supplied or
+verified service URL, never invent one. start is HTTP-only and does
+not execute package installers. purpose preserves the original user objective. Replacing a
+configured server requires its revision from inspect. Do not alter managed connectors/plugins.
+Then advance {setupId,expectedVersion} using the returned version. get {setupId} refreshes
+status; cancel requires the current version. OAuth/Token steps provide interactionPath:
+link to that trusted product page, never request credentials or OAuth callbacks in chat.
+Use the exact returned interactionPath in a Markdown link; Weixin paths are absolute. Never prepend localhost or an origin to a relative product path. Do not invent a URL
+scheme or setup id. The host also displays a trusted Complete connection action above input.
+The page owns sign-in, safe credential entry, verification and automatic return to the
+original objective. When ready/continuationQueued is returned, stop this turn; the host
+continues in a fresh turn where native MCP tools can load. Use native tool_search and the
+discovered exact tools for the original read; do not invent a tool name or claim a read from
+tool counts. set_enabled {serverId,enabled,expectedRevision} and remove {serverId,expectedRevision}
+change local custom-server configuration. Removal does not revoke remote OAuth authorization
+or uninstall a package. A clear request to connect, disable, enable or remove a specific local
+connection already authorizes that operation; do not ask for the same confirmation again.
+New overwrite scope or additional privileges still require authorization. Respect permission refusals and report blocked/reload_required states.
+For an already configured healthy service prefer its actual tools over replacing its setup.`,
+	skills: `# Skill configuration
+Use skill_manage status to inspect installed skills, including disabled ones and current Agent
+availability. skills_list contains only usable skills. Search with skills_marketplace_search;
+recommendation alone never authorizes installation. Install an exact returned reference with
+skill_install only for a clear installation request. Default target is global; explain that
+scope, and use workspace when explicitly requested. Do not force-overwrite an existing skill
+without an explicit update/replace request. After an uncertain install inspect status and the
+existing source before retrying; do not blindly reinstall. Enable/disable with skill_manage;
+these flags are shared by name, not per-Agent permissions. Inspect the resulting state; do
+not widen an allowlist, install dependencies through shell or ask for secrets in chat.
+Delete/uninstall with skill_manage delete only for writable managed user skills; bundled,
+plugin-owned and extra-directory skills must retain their owner management path. After
+installation, read skill_view and complete the user's requested first task. Return an actual
+result, two relevant example requests and the installed-skills link. A ready state is not a
+successful task test. Never claim success when requirements or Agent policy still block use.`,
 	agent: `# xopc Agent configuration
 The host's current Agent id is authoritative. "You / this assistant" means that Agent,
 not main or the default Agent. Read agent get {id} (or list for discovery) for revision
@@ -19,8 +70,8 @@ inspect first and retain the original idempotency key. A permission denial is no
 do not switch identity, target or tools to bypass it. Inspect returned product ok and saved
 fields before reporting success. A saved model reference does not prove it can be called.`,
 	phone_setup: `# Phone setup
-Use configure-xopc and references/phone/overview.md. Use plain conversation, never embedded chat
-configuration panels. mode phone_setup inspect/preview/start inspect or resume; models lists
+Use configure-xopc and references/phone/overview.md. Use plain conversation, no full settings page embedded in chat. Human-only steps use the returned interactionPath
+for a small secure product modal; saving rechecks scope and returns to the original conversation. mode phone_setup inspect/preview/start inspect or resume; models lists
 compatible models. get/recheck/verification_report/cancel/release take {setupId}.
 Automate source {setupId,source:local|aliyun,expectedRevision}, configure {setupId,enabled:true,
 expectedRevision}, install_dependency {setupId,kind:adb|scrcpy,repair?:true,expectedRevision},
@@ -29,14 +80,14 @@ register_local {setupId,serial:<discovered online serial>,name?,expectedRevision
 begin_verification {setupId,deviceId,expectedRevision}. Writes require a host-authorized
 interactive turn and preserve current policy. dryRun never writes. Do not silently select a
 phone, change the chat model, widen app access, use shell installs or submit keys in chat.
-Use set_model for the dedicated Phone model only; it cannot change the chat model; credentials use secure settings.
+Use set_model for the dedicated Phone model only; it cannot change the chat model; credentials use the host interactionPath.
 Explain the Settings-only goal, screenshot sharing and model costs before testing. Get provides
 attempt.goal/completion/maxActions. Use phone_use open, observe, run, close, then verification_report.
 User-only work is physical USB/RSA, login/OAuth, private-key entry/upload and cloud purchase.
 After interruption recheck, release the old test, resolve the cause and continue here.`,
 	browser_setup: `# Browser setup
-Use configure-xopc and its Browser references. Plain conversation only; no configuration panel
-inside chat. mode browser_setup inspect/preview/start inspect or resume. get/recheck/
+Use configure-xopc and its Browser references. Plain conversation for routine steps. Human-only steps use the returned interactionPath
+for a small secure product modal; never collect credentials in chat. mode browser_setup inspect/preview/start inspect or resume. get/recheck/
 verification_report/cancel/release take {setupId}. prepare/advance {setupId,expectedRevision}
 automatically prepares the managed extension/native host and enables the extension route in
 an authorized interactive turn. Explain and confirm a shared driver change before switchDriver:true.
@@ -46,7 +97,7 @@ resolve the intended Chrome with the user, explain the bounded read/click/fill d
 begin_verification {setupId,endpointId,expectedRevision}. The host derives the fixture origin.
 Use normal browser_use calls on the returned attempt; close and read verification_report.
 No API Key is needed. Preserve policy refusals and existing pairing; only manual steps need
-an ordinary link to settingsPath. dryRun never writes; opening a page is not proof of success.`,
+an ordinary link to interactionPath (settingsPath is the fallback). dryRun never writes; opening a page is not proof of success.`,
 	settings: `# xopc settings and capability checks
 settings open is navigation only; it does not read, apply or verify configuration.
 Voice: {section:"capabilities/voice",title:"语音设置"}; models: section:"capabilities/models";
@@ -60,17 +111,50 @@ interaction. Return the exact product link and state the remaining action; never
 page has opened or the device test passed from a navigation receipt. Do not invent UI buttons
 or promise audio verification unless the active tools can perform it.`,
 	automation: `# xopc automations
+In a paired Weixin conversation the host pins result delivery to that exact original account
+and peer. Use notificationPolicy:all for requested reminders; do not invent a Weixin webhook,
+recipient or client API. The normal saved run and durable delivery receipts remain separate.
 Use automation list/get before changing an existing schedule or creating a potentially
 duplicate one. pause/resume takes {automationId,expectedRevision,idempotencyKey}; revision
 is the original updatedAtMs. Pause affects future scheduling, not proof a running job stopped.
 Create with {name,enabled,trigger:{kind:"schedule",schedule:{kind:"cron",expr,tz}},
-action:{kind:"agent",instruction},delivery:{notificationPolicy:"attention",destinations:[]}}.
+action:{kind:"agent",instruction},delivery:{notificationPolicy:"all",destinations:[{key:"gateway_event",kind:"gateway_event"}]}}.
+For a reminder/report whose result the user expects, notify on success with notificationPolicy:all.
+attention is for exceptional/needs-action updates; none is for an explicitly silent task.
 Use the user's timezone. For 09:00 Asia/Shanghai use expr:"0 9 * * *",tz:"Asia/Shanghai".
+One-time reminders use trigger:{kind:"schedule",schedule:{kind:"once",afterMs:90000}} for
+90 seconds after acceptance, or schedule:{kind:"once",at:<future ISO timestamp>}. The server
+anchors afterMs once within the stable receipt. Never encode a one-time reminder as cron:
+date fields still repeat every year. Preserve the saved once/at when inspecting the result.
 Draft / don't enable / don't run means enabled:false and no run call. simulate is not a real
-execution. A one-off answer does not authorize creating a Task, Project, Agent or Automation.
+execution. For an explicitly requested trial, run the same saved disabled object, then read
+get_run {runId,waitMs:30000} until terminal or a real blocker. Queued/running is not completion.
+Report the actual result. When the user requested trial-before-enable, enable that same object
+only after a successful run; never enable after failure or replace it with a duplicate.
+For a custom HTTP MCP read, first verify a real read from the selected service. Then use
+automation prepare_source {serverId,toolNames:[exact discovered tool names]} (or automation
+action prepare_source) to pin its server/grant reference and read-only tool contracts.
+Use optional toolInputs:{<exact tool name>:<fixed argument object>} for the verified read's
+arguments; omitted inputs mean {}. Calls must retain these inputs, so account/query parameters
+cannot silently change on later runs. Dynamic parameter scopes require a dedicated adapter.
+Create the disabled agent action with mcpSourceId:<returned sourceId>, agentId:<returned agentId>.
+Every run is restricted to these tools and must actually read successfully. A changed or
+disabled source fails, without switching services. Enabling requires a successful trial of
+that exact action on the same object. Ordinary self-contained reminders need no MCP source.
+Use conversationMode:continuous when the user asks to retain task context between runs;
+historical context never replaces a fresh source read in the current run.
+When changing a bound action or assistant, save it paused, trial the updated action, then enable
+if authorized. Schedule-only edits retain the verified action. Existing source pins are retained
+when an agent action is replaced; omitting mcpSourceId cannot silently remove the boundary.
+This generic source binding does not verify remote account identity. Explicit-account workflows
+remain disabled unless their account adapter verifies identity; never invent that verification.
+A clear create/change/pause/resume/delete request already authorizes that local operation;
+do not repeat confirmation. A one-off answer does not authorize creating a Task, Project, Agent or Automation.
 Check returned ok and saved state; handle revision conflicts by re-reading, preserving changes
 and retrying once with the new revision. Keep original keys after uncertain writes.`,
 	connections: `# xopc external connections
+For a user-supplied HTTP MCP address, use the mcp manual topic and registered xopc_use
+mcp_setup commands. These configure a custom server; they are separate from connector discovery.
 External services use their dedicated discovery, description, connection and execution tools,
 not invented xopc_use connector commands or settings sections. When Gmail connection/read
 tools are absent, explain that specific blocker. Do not create or enable an email schedule

package/dist/src/agent/tools/automation-tool.d.ts

@@ -1,14 +1,19 @@
 import type { AgentTool } from '@earendil-works/pi-agent-core';
 import type { AutomationService } from '../../automations/index.js';
 import type { ProjectService } from '../../projects/project-service.js';
+import type { Config } from '../../config/schema.js';
 declare const AutomationToolSchema: import("@sinclair/typebox").TObject<{
-    action: import("@sinclair/typebox").TUnion<[import("@sinclair/typebox").TLiteral<"list">, import("@sinclair/typebox").TLiteral<"get">, import("@sinclair/typebox").TLiteral<"create">, import("@sinclair/typebox").TLiteral<"update">, import("@sinclair/typebox").TLiteral<"delete">, import("@sinclair/typebox").TLiteral<"run">, import("@sinclair/typebox").TLiteral<"rerun">, import("@sinclair/typebox").TLiteral<"cancel">, import("@sinclair/typebox").TLiteral<"read">, import("@sinclair/typebox").TLiteral<"read_all">, import("@sinclair/typebox").TLiteral<"pause">, import("@sinclair/typebox").TLiteral<"resume">, import("@sinclair/typebox").TLiteral<"history">, import("@sinclair/typebox").TLiteral<"get_run">, import("@sinclair/typebox").TLiteral<"run_events">, import("@sinclair/typebox").TLiteral<"metrics">, import("@sinclair/typebox").TLiteral<"events">, import("@sinclair/typebox").TLiteral<"deliveries">, import("@sinclair/typebox").TLiteral<"product_events">, import("@sinclair/typebox").TLiteral<"replay_event">, import("@sinclair/typebox").TLiteral<"retry_delivery">]>;
+    action: import("@sinclair/typebox").TUnion<[import("@sinclair/typebox").TLiteral<"list">, import("@sinclair/typebox").TLiteral<"prepare_source">, import("@sinclair/typebox").TLiteral<"get">, import("@sinclair/typebox").TLiteral<"create">, import("@sinclair/typebox").TLiteral<"update">, import("@sinclair/typebox").TLiteral<"delete">, import("@sinclair/typebox").TLiteral<"run">, import("@sinclair/typebox").TLiteral<"rerun">, import("@sinclair/typebox").TLiteral<"cancel">, import("@sinclair/typebox").TLiteral<"read">, import("@sinclair/typebox").TLiteral<"read_all">, import("@sinclair/typebox").TLiteral<"pause">, import("@sinclair/typebox").TLiteral<"resume">, import("@sinclair/typebox").TLiteral<"history">, import("@sinclair/typebox").TLiteral<"get_run">, import("@sinclair/typebox").TLiteral<"run_events">, import("@sinclair/typebox").TLiteral<"metrics">, import("@sinclair/typebox").TLiteral<"events">, import("@sinclair/typebox").TLiteral<"deliveries">, import("@sinclair/typebox").TLiteral<"product_events">, import("@sinclair/typebox").TLiteral<"replay_event">, import("@sinclair/typebox").TLiteral<"retry_delivery">]>;
     automationId: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TString>;
+    serverId: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TString>;
+    toolNames: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TArray<import("@sinclair/typebox").TString>>;
+    toolInputs: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TRecord<import("@sinclair/typebox").TString, import("@sinclair/typebox").TAny>>;
     runId: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TString>;
     projectId: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TString>;
     automation: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TAny>;
     patch: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TAny>;
     limit: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TNumber>;
+    waitMs: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TInteger>;
     eventType: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TString>;
     eventId: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TString>;
     destinationKey: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TString>;
@@ -20,6 +25,9 @@ declare const AutomationToolSchema: import("@sinclair/typebox").TObject<{
     idempotencyKey: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TString>;
 }>;
 export interface AutomationToolDeps {
+    getConfig?: () => Config | undefined;
+    getWorkspace?: () => string;
+    canConfigureFromConversation?: () => boolean;
     getAutomationService: () => AutomationService | undefined;
     getCurrentConversationId?: () => string | undefined;
     getCurrentAgentId?: () => string | undefined;

package/dist/src/agent/tools/automation-tool.js

@@ -2,14 +2,15 @@ import { appendProductDeliveryText } from "../../../packages/gateway-contract/sr
 import { AutomationCancelOutputSchema, AutomationDeleteOutputSchema, AutomationMutationOutputSchema, AutomationReadAllOutputSchema, AutomationReadOutputSchema, AutomationRecoveryOutputSchema, AutomationRunMutationOutputSchema, ProductReadContracts } from "../../../packages/gateway-contract/src/capabilities.js";
 import { init_src } from "../../../packages/gateway-contract/src/index.js";
 import { getAutomationSetup } from "../../automations/configuration-conversation.js";
+import { prepareAutomationMcpSource } from "../../automations/mcp-source.js";
 import { createProductDispatcher } from "../../capabilities/runtime/product.js";
-import { randomUUID } from "node:crypto";
 import { Type } from "@sinclair/typebox";
 //#region src/agent/tools/automation-tool.ts
 init_src();
 const AutomationToolSchema = Type.Object({
 	action: Type.Union([
 		Type.Literal("list"),
+		Type.Literal("prepare_source"),
 		Type.Literal("get"),
 		Type.Literal("create"),
 		Type.Literal("update"),
@@ -32,11 +33,19 @@ const AutomationToolSchema = Type.Object({
 		Type.Literal("retry_delivery")
 	]),
 	automationId: Type.Optional(Type.String({ description: "Automation id for update/delete/run/pause/resume/history" })),
+	serverId: Type.Optional(Type.String({ description: "prepare_source: the selected configured custom HTTP MCP server" })),
+	toolNames: Type.Optional(Type.Array(Type.String(), { description: "prepare_source: exact discovered MCP tool names annotated read-only" })),
+	toolInputs: Type.Optional(Type.Record(Type.String(), Type.Any(), { description: "prepare_source: fixed argument objects keyed by the exact tool name; defaults to {}. Future calls cannot change them." })),
 	runId: Type.Optional(Type.String({ description: "Run id for rerun/cancel/read" })),
 	projectId: Type.Optional(Type.String({ description: "Optional project filter for read_all; omitted means all projects" })),
 	automation: Type.Optional(Type.Any({ description: "Automation create payload" })),
 	patch: Type.Optional(Type.Any({ description: "Automation update patch" })),
 	limit: Type.Optional(Type.Number({ description: "History limit, default 5" })),
+	waitMs: Type.Optional(Type.Integer({
+		minimum: 0,
+		maximum: 3e4,
+		description: "get_run: bounded wait for an actual terminal state; queued/running is not completion"
+	})),
 	eventType: Type.Optional(Type.String()),
 	eventId: Type.Optional(Type.String({ description: "Dead-letter event id for replay_event" })),
 	destinationKey: Type.Optional(Type.String({ description: "Dead-letter result destination key for retry_delivery" })),
@@ -93,9 +102,9 @@ function createAutomationTool(deps) {
 	return {
 		name: "automation",
 		label: "Automation",
-		description: "Manage product automations. Automations can be manual, scheduled, webhook-triggered, or product-event-triggered and can run an agent instruction.",
+		description: "Manage product automations. A clear request to create, edit, pause, resume or delete a local automation already authorizes that operation: read the target and act without duplicate confirmation. This does not grant permission for external effects. One-time reminders use trigger:{kind:\"schedule\",schedule:{kind:\"once\",afterMs:90000}} for 90 seconds from acceptance, or once with an ISO at timestamp. A cron rule repeats; it is never a one-time reminder. For reminders/reports expected by the user, delivery.notificationPolicy:all notifies on success; attention is for exceptional updates. get_run with waitMs up to 30000 waits for an actual result. Use prepare_source for a selected custom HTTP MCP read before creating an action with mcpSourceId. Load tool_manual xopc_use topic automation for workflows.",
 		parameters: AutomationToolSchema,
-		async execute(_toolCallId, params, signal) {
+		async execute(toolCallId, params, signal) {
 			const service = deps.getAutomationService();
 			if (!service) return textResult("Automation service is not available.", { ok: false });
 			const call = async (operation, input, scope = "automations.write") => {
@@ -113,11 +122,28 @@ function createAutomationTool(deps) {
 				};
 				return capabilities.call(operation, input, caller, {
 					...capabilities.describe(operation, caller),
-					idempotencyKey: params.idempotencyKey ?? randomUUID()
+					idempotencyKey: params.idempotencyKey ?? toolCallId
 				});
 			};
 			const invoke = async (operation, input) => AutomationMutationOutputSchema.parse(await call(operation, input));
 			switch (params.action) {
+				case "prepare_source": {
+					const config = deps.getConfig?.();
+					if (!config || !deps.getWorkspace) return textResult("MCP source preparation is unavailable in this runtime.", { ok: false });
+					const source = await prepareAutomationMcpSource({
+						serverId: params.serverId,
+						toolNames: params.toolNames,
+						toolInputs: params.toolInputs
+					}, {
+						conversationId: deps.getCurrentConversationId?.(),
+						agentId: deps.getCurrentAgentId?.(),
+						canConfigure: deps.canConfigureFromConversation?.() === true,
+						workspaceDir: deps.getWorkspace(),
+						readConfig: () => deps.getConfig?.() ?? config,
+						signal
+					});
+					return textResult(JSON.stringify(source), { source });
+				}
 				case "get": {
 					const result = ProductReadContracts["xopc.automations.get"].output.parse(await call("xopc.automations.get", { id: params.automationId }, "automations.read"));
 					return textResult(JSON.stringify(result.automation), result);
@@ -249,7 +275,10 @@ function createAutomationTool(deps) {
 						payloadKey: params.payloadKey,
 						payloadValue: params.payloadValue,
 						limit: params.limit
-					} : { id: params.runId };
+					} : {
+						id: params.runId,
+						...params.action === "get_run" && params.waitMs !== void 0 ? { waitMs: params.waitMs } : {}
+					};
 					const result = ProductReadContracts[operation].output.parse(await call(operation, input, "automations.read"));
 					return textResult(JSON.stringify(result), result);
 				}