funolio-agent 1.0.47 → 1.0.49

package/dist/commands/start.js

@@ -49,11 +49,10 @@ const service_mode_1 = require("../service-mode");
 const index_1 = require("../providers/index");
 const sync_cli_config_1 = require("../mcp/sync-cli-config");
 const agent_config_1 = require("../agent-config");
+// refreshOAuthToken removed — token refresh now handled per-request in message-loop.ts
 const local_db_1 = require("../local-db");
 const local_server_1 = require("../local-server");
 const data = __importStar(require("../local-data"));
-const default_tool_profile_1 = require("../default-tool-profile");
-const approval_1 = require("../approval");
 const AUTH_SESSION_KEY = 'auth.session';
 const DESKTOP_PREFS_KEY = 'desktop.preferences';
 const WIZARD_PROFILE_KEY = 'wizard.profile';
@@ -79,33 +78,15 @@ function readLastInteractionAtMs() {
     const parsed = Date.parse(raw);
     return Number.isNaN(parsed) ? 0 : parsed;
 }
-/** Minimum hours between maintenance restarts to prevent restart loops */
-const MAINTENANCE_COOLDOWN_MS = 6 * 60 * 60 * 1000; // 6 hours
-const MAINTENANCE_RESTART_KEY = 'agent.last_maintenance_restart_at';
 function shouldRunNightlyRestart(now, lastInteractionAtMs, botManager) {
-    const hour = now.getUTCHours();
-    if (hour < 7 || hour >= 10)
+    const hour = now.getHours();
+    if (hour < 1 || hour >= 4)
         return false;
     if (botManager.isBusy())
         return false;
     if (!lastInteractionAtMs)
         return false;
-    if ((now.getTime() - lastInteractionAtMs) < AGENT_IDLE_RESTART_MS)
-        return false;
-    try {
-        const lastRestart = data.getSetting(MAINTENANCE_RESTART_KEY);
-        if (lastRestart) {
-            const lastRestartMs = new Date(lastRestart).getTime();
-            if (!isNaN(lastRestartMs) && (now.getTime() - lastRestartMs) < MAINTENANCE_COOLDOWN_MS)
-                return false;
-        }
-    }
-    catch { /* best effort */ }
-    try {
-        data.setSetting(MAINTENANCE_RESTART_KEY, now.toISOString());
-    }
-    catch { /* best effort */ }
-    return true;
+    return (now.getTime() - lastInteractionAtMs) >= AGENT_IDLE_RESTART_MS;
 }
 function parseJson(value) {
     if (!value)
@@ -129,10 +110,11 @@ function loadDbRuntimeConfig() {
         const defaultBot = botRows.find((bot) => bot.is_default === 1) || botRows[0];
         const providers = providerRows.map((row) => ({
             id: row.provider_id,
-            authType: row.access_mode === 'cli'
-                ? 'cli'
-                : (row.auth_type === 'oauth' ? 'oauth' : 'apiKey'),
+            authType: row.auth_type === 'oauth' ? 'oauth' : 'apiKey',
             apiKey: row.api_key_enc || undefined,
+            oauthToken: row.oauth_token || undefined,
+            oauthRefreshToken: row.oauth_refresh_token || undefined,
+            oauthExpiresAt: row.oauth_expires_at ?? undefined,
             defaultModel: row.default_model || config_1.DEFAULT_MODELS[row.provider_id] || '',
             label: row.label || undefined,
         }));
@@ -144,9 +126,9 @@ function loadDbRuntimeConfig() {
                 projectDir,
                 provider: row.provider,
                 model: row.model,
-                enabledTools: (0, default_tool_profile_1.normalizeEnabledTools)(parseJson(row.enabled_builtin_tools_json)),
+                enabledTools: parseJson(row.enabled_builtin_tools_json),
                 enabledMcpTools: parseJson(row.enabled_mcp_tools_json),
-                permissionMode: (0, approval_1.normalizePermissionMode)(row.permission_mode || default_tool_profile_1.DEFAULT_PERMISSION_MODE),
+                permissionMode: row.permission_mode || 'autopilot',
                 systemPrompt: row.final_prompt || undefined,
                 agentDescription: row.purpose_md || undefined,
                 createdAt: row.created_at,
@@ -181,6 +163,16 @@ function persistRuntimeAuth(config, useDbRuntime) {
     }
     (0, config_1.saveConfig)(config);
 }
+function persistRuntimeProviderToken(providerId, token, refreshToken, expiresAt) {
+    const existing = data.findProviderConnection(providerId);
+    if (!existing)
+        return;
+    data.updateProviderConnection(existing.id, {
+        oauthToken: token,
+        oauthRefreshToken: refreshToken ?? existing.oauth_refresh_token,
+        oauthExpiresAt: expiresAt ?? existing.oauth_expires_at,
+    });
+}
 async function startCommand(projectDir, options) {
     if (options.mode === 'windows-service') {
         process.env.LOCAL_FIRST_ENABLED = 'true';
@@ -225,10 +217,10 @@ async function startCommand(projectDir, options) {
         });
     }
     if ((0, local_db_1.isLocalFirstEnabled)() && !localServerStarted) {
-        console.log(chalk_1.default.blue('Local-first mode enabled — initializing local database...'));
+        console.log(chalk_1.default.blue('Local-first mode enabled — initializing local database...'));
         try {
             const dbInfo = (0, local_db_1.initLocalDb)();
-            console.log(chalk_1.default.green(`✓ Local DB ready: ${dbInfo.path}`));
+            console.log(chalk_1.default.green(`✓ Local DB ready: ${dbInfo.path}`));
             console.log(chalk_1.default.gray(`  WAL mode: ${dbInfo.walMode}, tables: ${dbInfo.tableCount}, write: ${dbInfo.testWrite}, read: ${dbInfo.testRead}`));
             cleanupExpiredMessageActivityRows();
             if (isServiceMode) {
@@ -236,7 +228,7 @@ async function startCommand(projectDir, options) {
             }
         }
         catch (err) {
-            console.error(chalk_1.default.red(`✗ Local DB init failed: ${err.message}`));
+            console.error(chalk_1.default.red(`✗ Local DB init failed: ${err.message}`));
             console.error(chalk_1.default.yellow('  Continuing without local-first features.'));
             if (isServiceMode) {
                 (0, service_mode_1.emitEvent)('local_db', { status: 'failed', error: err.message });
@@ -245,13 +237,13 @@ async function startCommand(projectDir, options) {
         try {
             await (0, local_server_1.startLocalServer)({ projectDir: initialResolvedDir });
             localServerStarted = true;
-            console.log(chalk_1.default.green('✓ Local HTTP server ready'));
+            console.log(chalk_1.default.green('✓ Local HTTP server ready'));
             if (isServiceMode) {
                 (0, service_mode_1.emitEvent)('local_server', { status: 'ready', port: LOCAL_SERVER_PORT });
             }
         }
         catch (err) {
-            console.error(chalk_1.default.red(`✗ Local server failed: ${err.message}`));
+            console.error(chalk_1.default.red(`✗ Local server failed: ${err.message}`));
             console.error(chalk_1.default.yellow('  Desktop UI will not be available.'));
             if (isServiceMode) {
                 (0, service_mode_1.emitEvent)('local_server', { status: 'failed', error: err.message });
@@ -296,10 +288,10 @@ async function startCommand(projectDir, options) {
             const text = await res.text().catch(() => '');
             throw new Error(`${res.status} ${res.statusText}${text ? ': ' + text : ''}`);
         }
-        const mqttData = await res.json();
-        auth.mqttJwt = mqttData.mqttJwt;
-        auth.mqttJwtExpiresAt = mqttData.mqttJwtExpiresAt;
-        auth.expiresAt = mqttData.expiresAt;
+        const data = await res.json();
+        auth.mqttJwt = data.mqttJwt;
+        auth.mqttJwtExpiresAt = data.mqttJwtExpiresAt;
+        auth.expiresAt = data.expiresAt;
         persistRuntimeAuth(config, useDbRuntime);
         console.log(chalk_1.default.green('✓ MQTT token refreshed'));
     }
@@ -316,6 +308,56 @@ async function startCommand(projectDir, options) {
             process.exit(1);
         }
     }
+    // Re-sync provider credentials from server (picks up web re-auth tokens)
+    if (config.providers?.some(p => p.authType === 'oauth')) {
+        try {
+            const res = await fetch(`${config_1.FUNOLIO_API_URL}/api/v1/agent/config`, {
+                headers: { Authorization: `Bearer ${auth.token}` },
+            });
+            if (res.ok) {
+                const serverConfig = await res.json();
+                if (serverConfig.providers) {
+                    let updated = false;
+                    for (const sp of serverConfig.providers) {
+                        if (sp.connectionType !== 'oauth' || !sp.access_token)
+                            continue;
+                        const local = config.providers.find(p => p.id === sp.id);
+                        if (!local || local.authType !== 'oauth')
+                            continue;
+                        // Only update if server has a different (newer) token
+                        if (local.oauthToken !== sp.access_token) {
+                            local.oauthToken = sp.access_token;
+                            local.oauthRefreshToken = sp.refresh_token;
+                            local.oauthExpiresAt = sp.expires_at;
+                            updated = true;
+                            console.log(chalk_1.default.green(`✓ Updated ${sp.id} OAuth token from server`));
+                        }
+                    }
+                    if (updated) {
+                        (0, config_1.saveConfig)(config);
+                        // Also update agent config files on disk
+                        for (const p of config.providers) {
+                            if (p.authType !== 'oauth' || !p.oauthToken)
+                                continue;
+                            const { listAgents, loadAgentConfig: loadAC, saveAgentConfig: saveAC } = await Promise.resolve().then(() => __importStar(require('../agent-config')));
+                            for (const agentName of listAgents()) {
+                                const ac = loadAC(agentName);
+                                if (ac && ac.provider === p.id && ac.oauthToken) {
+                                    ac.oauthToken = p.oauthToken;
+                                    ac.oauthRefreshToken = p.oauthRefreshToken;
+                                    ac.oauthExpiresAt = p.oauthExpiresAt;
+                                    saveAC(agentName, ac);
+                                }
+                            }
+                        }
+                    }
+                }
+            }
+        }
+        catch (err) {
+            console.log(chalk_1.default.gray(`  Server config re-sync skipped: ${err.message}`));
+        }
+    }
     // Load agent-specific config if --agent was specified
     const agentLocalConfig = options.agent ? (0, agent_config_1.loadAgentConfig)(options.agent) : null;
     if (options.agent && !agentLocalConfig) {
@@ -332,9 +374,12 @@ async function startCommand(projectDir, options) {
             id: bot.id,
             name: bot.name,
             provider: bot.provider,
+            runtimeProvider: bot.runtimeProvider,
             model: bot.model,
+            runtimeModel: bot.runtimeModel,
+            accessMode: bot.accessMode,
             projectDir: '.',
-            permissionMode: default_tool_profile_1.DEFAULT_PERMISSION_MODE,
+            permissionMode: 'autopilot',
             createdAt: new Date().toISOString(),
         }));
         if (!config.activeAgentId && config.agents.length > 0) {
@@ -346,9 +391,13 @@ async function startCommand(projectDir, options) {
     }
     // Resolve active agent from agents[] + activeAgentId FIRST (before dir resolution)
     let activeAgentConfig = null;
-    let agentPermissionMode = default_tool_profile_1.DEFAULT_PERMISSION_MODE;
+    let agentPermissionMode = 'autopilot';
     let agentEnabledTools;
+    let agentEnabledMcpTools;
     let agentSystemPrompt;
+    let reportedProvider;
+    let reportedModel;
+    let reportedAccessMode;
     if (config.agents && config.agents.length > 0) {
         const activeId = config.activeAgentId;
         activeAgentConfig = (activeId
@@ -356,9 +405,13 @@ async function startCommand(projectDir, options) {
             : config.agents[0]) || null;
         if (activeAgentConfig) {
             console.log(chalk_1.default.blue(`Active agent: ${activeAgentConfig.name || activeAgentConfig.id}`));
-            agentPermissionMode = activeAgentConfig.permissionMode || default_tool_profile_1.DEFAULT_PERMISSION_MODE;
-            agentEnabledTools = (0, default_tool_profile_1.normalizeEnabledTools)(activeAgentConfig.enabledTools ?? activeAgentConfig.enabledMcpTools);
+            agentPermissionMode = activeAgentConfig.permissionMode || 'autopilot';
+            agentEnabledTools = activeAgentConfig.enabledTools;
+            agentEnabledMcpTools = activeAgentConfig.enabledMcpTools;
             agentSystemPrompt = activeAgentConfig.systemPrompt || activeAgentConfig.agentDescription;
+            reportedProvider = activeAgentConfig.provider;
+            reportedModel = activeAgentConfig.model;
+            reportedAccessMode = activeAgentConfig.accessMode;
             // Use agent's project dir if specified
             if (activeAgentConfig.projectDir && activeAgentConfig.projectDir !== '.') {
                 projectDir = activeAgentConfig.projectDir;
@@ -382,7 +435,11 @@ async function startCommand(projectDir, options) {
         console.log('');
     }
     // Resolve active provider — prefer --agent local config, then agent-specific provider, then CLI flag
-    const providerOverride = agentLocalConfig?.provider || activeAgentConfig?.provider || options.provider;
+    const providerOverride = agentLocalConfig?.runtimeProvider ||
+        activeAgentConfig?.runtimeProvider ||
+        agentLocalConfig?.provider ||
+        activeAgentConfig?.provider ||
+        options.provider;
     const activeProvider = (0, config_1.getProvider)(config, providerOverride);
     // Determine provider/model/apiKey from either providers[] or CLI flags/env
     let provider;
@@ -391,19 +448,39 @@ async function startCommand(projectDir, options) {
     let oauthToken;
     if (activeProvider) {
         provider = activeProvider.id;
-        model = options.model || agentLocalConfig?.model || activeAgentConfig?.model || activeProvider.defaultModel;
+        model =
+            options.model ||
+                agentLocalConfig?.runtimeModel ||
+                activeAgentConfig?.runtimeModel ||
+                agentLocalConfig?.model ||
+                activeAgentConfig?.model ||
+                activeProvider.defaultModel;
         apiKey = options.apiKey || agentLocalConfig?.apiKey || activeProvider.apiKey || getEnvApiKey(provider);
         oauthToken = agentLocalConfig?.oauthToken || activeProvider.oauthToken;
     }
     else {
         // Fallback to CLI args / env detection (no providers configured)
-        provider = agentLocalConfig?.provider || options.provider || detectProvider();
-        model = agentLocalConfig?.model || options.model || defaultModel(provider);
+        provider =
+            agentLocalConfig?.runtimeProvider ||
+                activeAgentConfig?.runtimeProvider ||
+                agentLocalConfig?.provider ||
+                activeAgentConfig?.provider ||
+                options.provider ||
+                detectProvider();
+        model =
+            agentLocalConfig?.runtimeModel ||
+                activeAgentConfig?.runtimeModel ||
+                agentLocalConfig?.model ||
+                activeAgentConfig?.model ||
+                options.model ||
+                defaultModel(provider);
         apiKey = options.apiKey || agentLocalConfig?.apiKey || getEnvApiKey(provider);
         oauthToken = agentLocalConfig?.oauthToken;
     }
-    // Auto-detect Claude Code CLI if no API key and no provider explicitly set.
-    if (!apiKey && !options.provider && !agentLocalConfig?.provider && provider !== 'claude-cli') {
+    // Auto-detect Claude Code CLI if no API key/token and no provider explicitly set.
+    // OAuth tokens from claude.ai can't be used with the Anthropic API directly,
+    // so we prefer claude-cli when Claude Code is installed.
+    if (!apiKey && !oauthToken && !options.provider && !agentLocalConfig?.provider && provider !== 'claude-cli') {
         const claudeVersion = detectClaudeCli();
         if (claudeVersion) {
             console.log(chalk_1.default.green(`✓ Claude Code detected (${claudeVersion}), using your subscription`));
@@ -417,6 +494,61 @@ async function startCommand(projectDir, options) {
         console.error(chalk_1.default.gray('  (ANTHROPIC_API_KEY, OPENAI_API_KEY, GOOGLE_API_KEY)'));
         process.exit(1);
     }
+    // Check if stored OAuth token is expired before starting — try refresh instead of dying
+    if (activeProvider?.authType === 'oauth' && activeProvider.oauthExpiresAt) {
+        const oauthExpiresAtMs = activeProvider.oauthExpiresAt < 1e12
+            ? activeProvider.oauthExpiresAt * 1000
+            : activeProvider.oauthExpiresAt;
+        if (oauthExpiresAtMs < Date.now()) {
+            if (activeProvider.oauthRefreshToken) {
+                console.log(chalk_1.default.yellow(`⚠ ${activeProvider.id} OAuth token expired — attempting refresh...`));
+                try {
+                    const { refreshToken } = await Promise.resolve().then(() => __importStar(require('../auth/token-refresh')));
+                    const result = await refreshToken({
+                        provider: activeProvider.id,
+                        accessToken: oauthToken || activeProvider.oauthToken || '',
+                        refreshToken: activeProvider.oauthRefreshToken,
+                        expiresAt: oauthExpiresAtMs,
+                    });
+                    oauthToken = result.credential.accessToken;
+                    // Update config so next startup doesn't hit this again
+                    const freshConfig = (0, config_1.loadConfig)();
+                    const providerIdx = freshConfig.providers?.findIndex(p => p.id === activeProvider.id);
+                    if (freshConfig.providers && providerIdx !== undefined && providerIdx >= 0) {
+                        freshConfig.providers[providerIdx].oauthToken = result.credential.accessToken;
+                        freshConfig.providers[providerIdx].oauthRefreshToken = result.credential.refreshToken;
+                        freshConfig.providers[providerIdx].oauthExpiresAt = result.credential.expiresAt;
+                        (0, config_1.saveConfig)(freshConfig);
+                    }
+                    console.log(chalk_1.default.green(`✓ ${activeProvider.id} token refreshed successfully`));
+                }
+                catch (err) {
+                    const loginCmds = {
+                        anthropic: 'claude login',
+                        openai: 'codex login',
+                        'google-gemini': 'gemini login',
+                        google: 'gemini login',
+                    };
+                    const cmd = loginCmds[activeProvider.id] || `${activeProvider.id} login`;
+                    console.error(chalk_1.default.red(`✗ Your ${activeProvider.id} OAuth token has expired and refresh failed: ${err.message}`));
+                    console.error(chalk_1.default.yellow(`  Please run \`${cmd}\` and then \`funolio-agent configure\` to re-authenticate.`));
+                    process.exit(1);
+                }
+            }
+            else {
+                const loginCmds = {
+                    anthropic: 'claude login',
+                    openai: 'codex login',
+                    'google-gemini': 'gemini login',
+                    google: 'gemini login',
+                };
+                const cmd = loginCmds[activeProvider.id] || `${activeProvider.id} login`;
+                console.error(chalk_1.default.red(`✗ Your ${activeProvider.id} OAuth token has expired (no refresh token available).`));
+                console.error(chalk_1.default.yellow(`  Please run \`${cmd}\` and then \`funolio-agent configure\` to re-authenticate.`));
+                process.exit(1);
+            }
+        }
+    }
     // Local-first DB initialization (behind feature flag)
     if ((0, local_db_1.isLocalFirstEnabled)() && !localServerStarted) {
         console.log(chalk_1.default.blue('Local-first mode enabled — initializing local database...'));
@@ -425,10 +557,6 @@ async function startCommand(projectDir, options) {
             console.log(chalk_1.default.green(`✓ Local DB ready: ${dbInfo.path}`));
             console.log(chalk_1.default.gray(`  WAL mode: ${dbInfo.walMode}, tables: ${dbInfo.tableCount}, write: ${dbInfo.testWrite}, read: ${dbInfo.testRead}`));
             cleanupExpiredMessageActivityRows();
-            const migratedProfiles = data.migrateAgentProfilesToDefaultToolProfile();
-            if (migratedProfiles.updated > 0) {
-                console.log(chalk_1.default.green(`✓ Migrated ${migratedProfiles.updated} agent profile(s) to default tool profile`));
-            }
             if (isServiceMode) {
                 (0, service_mode_1.emitEvent)('local_db', { status: 'ready', path: dbInfo.path, walMode: dbInfo.walMode });
             }
@@ -478,97 +606,29 @@ async function startCommand(projectDir, options) {
         authToken: auth.token,
         refreshUrl: `${config_1.FUNOLIO_API_URL}/api/v1/agent/auth/refresh`,
     });
-    // Sync integration tokens from server BEFORE launching MCP servers.
-    try {
-        const authToken = (0, config_1.loadConfig)().auth?.token;
-        if (authToken) {
-            const tokenRes = await fetch(`${config_1.FUNOLIO_API_URL}/api/v1/google/tokens`, {
-                headers: { Authorization: `Bearer ${authToken}` },
-            });
-            if (tokenRes.ok) {
-                const tokenBody = await tokenRes.json();
-                if (tokenBody.connected && tokenBody.tokens?.access_token) {
-                    const { handleIntegrationTokens } = await Promise.resolve().then(() => __importStar(require('../integration-tokens')));
-                    const expiresAt = tokenBody.tokens.expires_at ? new Date(tokenBody.tokens.expires_at) : null;
-                    const expiresInSec = expiresAt ? Math.max(0, Math.floor((expiresAt.getTime() - Date.now()) / 1000)) : null;
-                    handleIntegrationTokens({
-                        type: 'integration_tokens',
-                        integration: 'google',
-                        tokens: {
-                            access_token: tokenBody.tokens.access_token,
-                            refresh_token: tokenBody.tokens.refresh_token,
-                            expires_in: expiresInSec,
-                            scope: tokenBody.tokens.scope || '',
-                        },
-                        clientId: tokenBody.clientId || '',
-                        clientSecret: tokenBody.clientSecret || '',
-                        email: tokenBody.email,
-                        timestamp: Date.now(),
-                    });
-                    console.log(chalk_1.default.green(`✓ Synced Google integration tokens from server${tokenBody.email ? ` (${tokenBody.email})` : ''}`));
-                }
-                else {
-                    console.log(chalk_1.default.gray('  No Google integration connected on server'));
-                }
-            }
-        }
-    }
-    catch (err) {
-        console.warn(chalk_1.default.yellow(`  [Integration] Token sync failed: ${err.message}`));
-    }
     // Create and auto-launch MCP manager for persistent tool discovery
     const { MCPManager } = await Promise.resolve().then(() => __importStar(require('../mcp/manager')));
     const mcpManager = new MCPManager();
     await mcpManager.autoLaunch();
-    // Sync MCP servers approved on the server but not yet launched locally
-    try {
-        const authToken = (0, config_1.loadConfig)().auth?.token;
-        if (authToken) {
-            const res = await fetch(`${config_1.FUNOLIO_API_URL}/api/v1/agent/mcp/installed?includeEnvVars=true`, {
-                headers: { Authorization: `Bearer ${authToken}` },
-            });
-            if (res.ok) {
-                const { servers: approvedServers } = await res.json();
-                const running = new Set(mcpManager.getRunningServers());
-                const { BUILTIN_REGISTRY } = await Promise.resolve().then(() => __importStar(require('../mcp/registry')));
-                for (const srv of approvedServers) {
-                    if (srv.status === 'approved' && !running.has(srv.serverId)) {
-                        const entry = BUILTIN_REGISTRY.find((e) => e.id === srv.serverId);
-                        if (entry) {
-                            console.log(chalk_1.default.cyan(`  📦 Auto-launching approved MCP server: ${srv.serverId}`));
-                            try {
-                                await mcpManager.installAndLaunch(entry, srv.envVars || {}, true);
-                            }
-                            catch (err) {
-                                console.error(chalk_1.default.red(`  ✗ Failed to launch ${srv.serverId}: ${err.message}`));
-                            }
-                        }
-                    }
-                }
-            }
-        }
-    }
-    catch (err) {
-        console.warn(chalk_1.default.yellow(`  [MCP] Server-side sync failed: ${err.message}`));
-    }
     const mcpServers = mcpManager.getRunningServers();
     if (mcpServers.length > 0) {
         console.log(chalk_1.default.green(`  MCP servers running: ${mcpServers.join(', ')} (${mcpManager.getToolDefinitions().length} tools)`));
     }
     // Create bot manager (multi-bot support)
-    // Auth modes: CLI providers handle their own auth; API key providers use BYOK.
     const botManager = new bot_manager_1.BotManager({
         projectDir: resolvedDir,
         userId,
         mqttClient,
         defaultProvider: provider,
         defaultModel: model,
+        defaultAccessMode: reportedAccessMode,
         defaultApiKey: apiKey,
         defaultOauthToken: oauthToken,
-        defaultOauthRefreshToken: activeProvider?.oauthRefreshToken || agentLocalConfig?.oauthRefreshToken,
-        defaultOauthExpiresAt: activeProvider?.oauthExpiresAt || agentLocalConfig?.oauthExpiresAt,
+        defaultOauthRefreshToken: activeProvider?.oauthRefreshToken,
+        defaultOauthExpiresAt: activeProvider?.oauthExpiresAt,
         permissionMode: agentPermissionMode,
         enabledTools: agentEnabledTools,
+        enabledMcpTools: agentEnabledMcpTools,
         systemPrompt: agentSystemPrompt,
         mcpManager,
     });
@@ -639,37 +699,15 @@ async function startCommand(projectDir, options) {
             tools: builtinToolNames,
             serverInfo,
             mcpTools: mcpToolNames,
-            llmProvider: provider,
-            llmModel: model,
+            llmProvider: reportedProvider || provider,
+            llmModel: reportedModel || model,
+            accessMode: reportedAccessMode,
         };
         fetch(`${config_1.FUNOLIO_API_URL}/api/v1/agent/status`, {
             method: 'POST',
             headers: { 'Content-Type': 'application/json' },
             body: JSON.stringify(statusPayload),
         }).catch(() => { }); // best-effort
-        // Sync projects from server to local DB
-        try {
-            const configRes = await fetch(`${config_1.FUNOLIO_API_URL}/api/v1/agent/config`, {
-                headers: { Authorization: `Bearer ${auth.token}` },
-            });
-            if (configRes.ok) {
-                const configBody = await configRes.json();
-                if (configBody.projects && Array.isArray(configBody.projects)) {
-                    for (const p of configBody.projects) {
-                        data.upsertProject({
-                            id: p.id || p.name,
-                            name: p.name,
-                            folder: p.folderPath || null,
-                            description: p.description || null,
-                        });
-                    }
-                    console.log(chalk_1.default.green(`  ✓ Synced ${configBody.projects.length} project(s) from server`));
-                }
-            }
-        }
-        catch (err) {
-            console.warn(chalk_1.default.yellow(`  [Projects] Sync failed: ${err.message}`));
-        }
         // Publish available providers to MQTT so web UI can show provider picker
         if (config.providers && config.providers.length > 0) {
             mqttClient.publishProviders(config.providers.map((p) => ({
@@ -708,9 +746,6 @@ async function startCommand(projectDir, options) {
         await botManager.startActive();
         // Start all additional bot loops from ~/.funolio/agents/ configs
         await botManager.startAllBots();
-        // Fix B: Sync cloud-configured bots that aren't in local config
-        // This ensures bots created on the web UI are available without manual local setup
-        await botManager.syncBotsFromCloud();
         try {
             if (!data.getSetting('agent.last_interaction_at')) {
                 data.setSetting('agent.last_interaction_at', new Date().toISOString());
@@ -749,6 +784,7 @@ async function startCommand(projectDir, options) {
             console.log(chalk_1.default.blue(`  ${config.agents.length} agent(s) configured (active: ${activeAgentConfig?.name || 'default'})`));
         }
         // Sync MCP tools into all configured CLI runtimes so shared tools are available
+        // regardless of which provider happens to be active for this launch.
         const cliProvidersToSync = new Set();
         if (index_1.CLI_PROVIDERS.has(provider)) {
             cliProvidersToSync.add(provider);
@@ -773,21 +809,22 @@ async function startCommand(projectDir, options) {
             }
         }
         console.log(chalk_1.default.gray('  Waiting for commands...\n'));
+        // OAuth token refresh is handled per-request in message-loop.ts via ensureFreshToken()
+        // No background timer needed — this matches the pi-ai/Claude Code CLI pattern of
+        // refreshing lazily before each API call, avoiding race conditions on single-use refresh tokens
         // Listen for integration tokens delivered from the web UI via MQTT
         mqttClient.onIntegrationTokens(async (message) => {
             const { handleIntegrationTokens } = require('../integration-tokens');
             handleIntegrationTokens(message);
-            // If Google tokens were refreshed, reload any running Google MCP servers
-            // so they pick up the fresh credentials without a full agent restart.
             if (message.integration === 'google') {
                 try {
                     const restarted = await mcpManager.reloadIntegrationServers('google');
                     if (restarted.length > 0) {
-                        console.log(chalk_1.default.green(`  ✓ Reloaded Google MCP servers after token refresh: ${restarted.join(', ')}`));
+                        console.log(chalk_1.default.green(`✓ Reloaded Google MCP server(s): ${restarted.join(', ')}`));
                     }
                 }
                 catch (err) {
-                    console.error(chalk_1.default.red(`  ✗ Failed to reload Google MCP servers: ${err.message}`));
+                    console.error(chalk_1.default.yellow(`⚠ Failed to reload Google MCP servers: ${err.message}`));
                 }
             }
         });
@@ -795,21 +832,15 @@ async function startCommand(projectDir, options) {
         // Also handle MCP marketplace install/uninstall commands
         mqttClient.onCommand(async (message) => {
             if (message.type === 'command' && message.action === 'mcp_install') {
-                const { serverId, envVars, npmPackage, pipPackage } = message;
+                const { serverId, envVars } = message;
                 console.log(chalk_1.default.cyan(`📦 Marketplace: installing MCP server "${serverId}"...`));
                 try {
                     const { BUILTIN_REGISTRY } = await Promise.resolve().then(() => __importStar(require('../mcp/registry')));
-                    const { MCPManager: MCPMgr } = await Promise.resolve().then(() => __importStar(require('../mcp/manager')));
                     const entry = BUILTIN_REGISTRY.find((s) => s.id === serverId);
                     if (!entry)
                         throw new Error(`Unknown MCP server: ${serverId}`);
-                    if (entry.npmPackage) {
-                        MCPMgr.preWarmPackage(entry.npmPackage);
-                    }
                     await mcpManager.installAndLaunch(entry, envVars || {}, true);
-                    const tools = mcpManager.getToolDefinitions()
-                        .filter((t) => t.serverId === serverId)
-                        .map((t) => t.name);
+                    const tools = mcpManager.getServerInfo(serverId)?.tools.map((t) => t.name) || [];
                     console.log(chalk_1.default.green(`✓ MCP server "${serverId}" installed (${tools.length} tools)`));
                     await mqttClient.publishResult({
                         commandId: message.id,
@@ -834,7 +865,7 @@ async function startCommand(projectDir, options) {
                 const { serverId } = message;
                 console.log(chalk_1.default.cyan(`📦 Marketplace: uninstalling MCP server "${serverId}"...`));
                 try {
-                    await mcpManager.stopServer(serverId);
+                    await mcpManager.uninstallServer(serverId);
                     console.log(chalk_1.default.green(`✓ MCP server "${serverId}" uninstalled`));
                     await mqttClient.publishResult({
                         commandId: message.id,