@agent-deck/backend 1.8.0 → 1.8.2

package/dist/mcp-session-binding.js.map

@@ -1 +1 @@
-{"version":3,"file":"mcp-session-binding.js","sourceRoot":"","sources":["../src/mcp-session-binding.ts"],"names":[],"mappings":";;;;;;AAwLA,4DASC;AAjMD,0DAA6B;AAC7B,+CAK4B;AAgB5B,2DAA2D;AAC3D,MAAa,sBAAsB;IACzB,kBAAkB,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC/C,eAAe,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC5C,mBAAmB,GAAG,IAAI,GAAG,EAAkB,CAAC;IAChD,SAAS,GAAG,IAAI,GAAG,EAAoC,CAAC;IACxD,cAAc,GAAG,IAAI,GAAG,EAG7B,CAAC;IACa,gBAAgB,CAAU;IAC1B,aAAa,CAAU;IAExC,YAAY,MAA+C,EAAE;QAC3D,IAAI,CAAC,gBAAgB,GAAG,GAAG,CAAC,SAAS,EAAE,IAAI,EAAE,IAAI,SAAS,CAAC;QAC3D,IAAI,CAAC,aAAa,GAAG,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,SAAS,CAAC;IACvD,CAAC;IAED,iBAAiB,CACf,YAAoB,EACpB,KAKC;QAED,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QACzC,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC,YAAY,EAAE,KAAK,CAAC,gBAAgB,CAAC,CAAC;QACnE,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,YAAY,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;QACrD,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,YAAY,EAAE,KAAK,CAAC,IAAI,IAAI,QAAQ,CAAC,CAAC;QACzD,IAAI,KAAK,CAAC,aAAa,EAAE,CAAC;YACxB,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,YAAY,EAAE,mBAAI,CAAC,OAAO,CAAC,KAAK,CAAC,aAAa,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;QACtF,CAAC;IACH,CAAC;IAED,qBAAqB,CACnB,YAAoB,EACpB,KAMC;QAED,IAAI,CAAC,mBAAmB,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QAC9C,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC;QAC3C,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,YAAY,EAAE;YACpC,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,eAAe,EAAE,KAAK,CAAC,eAAe;YACtC,QAAQ,EAAE,KAAK,CAAC,QAAQ;SACzB,CAAC,CAAC;QACH,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,YAAY,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;QACrD,IAAI,KAAK,CAAC,aAAa,EAAE,CAAC;YACxB,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,YAAY,EAAE,mBAAI,CAAC,OAAO,CAAC,KAAK,CAAC,aAAa,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;QACtF,CAAC;IACH,CAAC;IAED,qBAAqB,CACnB,SAAiB;QAEjB,OAAO,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IAC5C,CAAC;IAED,YAAY,CAAC,SAAiB,EAAE,aAAqB;QACnD,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,SAAS,EAAE,mBAAI,CAAC,OAAO,CAAC,aAAa,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IAC7E,CAAC;IAED,SAAS,CAAC,SAAiB,EAAE,MAAc;QACzC,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;IAC9C,CAAC;IAED,WAAW,CAAC,SAAiB;QAC3B,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACzC,CAAC;IAED,YAAY,CAAC,SAAiB;QAC5B,IAAI,CAAC,kBAAkB,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QAC1C,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QACvC,IAAI,CAAC,mBAAmB,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QAC3C,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QACjC,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACxC,CAAC;IAED,YAAY,CAAC,SAAiB;QAC5B,OAAO,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC,gBAAgB,CAAC;IACzE,CAAC;IAED,eAAe,CAAC,SAAiB;QAC/B,OAAO,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC,aAAa,CAAC;IACnE,CAAC;IAED,mBAAmB,CAAC,SAAiB;QACnC,OAAO,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACjD,CAAC;IAED,cAAc,CAAC,YAAoB,EAAE,IAA8B;QACjE,IAAI,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,CAAC;YACrC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,YAAY,EAAE,IAAI,CAAC,CAAC;QACzC,CAAC;IACH,CAAC;IAED,OAAO,CAAC,SAAiB;QACvB,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACvC,CAAC;IAED,sBAAsB,CAAC,SAAiB;QACtC,OAAO,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IAC7C,CAAC;IAED,UAAU,CAAC,SAAiB;QAC1B,MAAM,WAAW,GAAG,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACxD,MAAM,MAAM,GAAG,WAAW,IAAI,IAAI,CAAC,aAAa,CAAC;QACjD,MAAM,gBAAgB,GAAG,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACjE,MAAM,SAAS,GAAG,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACrD,OAAO;YACL,aAAa,EAAE,IAAI,CAAC,YAAY,CAAC,SAAS,CAAC;YAC3C,MAAM;YACN,gBAAgB;YAChB,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,SAAS,CAAC;YACnC,WAAW,EAAE,SAAS,EAAE,WAAW;YACnC,eAAe,EAAE,SAAS,EAAE,eAAe;YAC3C,QAAQ,EAAE,SAAS,EAAE,QAAQ;YAC7B,UAAU,EAAE,SAAS;gBACnB,CAAC,CAAC,qBAAqB;gBACvB,CAAC,CAAC,gBAAgB;oBAChB,CAAC,CAAC,OAAO;oBACT,CAAC,CAAC,WAAW;wBACX,CAAC,CAAC,kBAAkB;wBACpB,CAAC,CAAC,IAAI,CAAC,aAAa;4BAClB,CAAC,CAAC,KAAK;4BACP,CAAC,CAAC,SAAS;SACpB,CAAC;IACJ,CAAC;IAED,eAAe,CAAC,SAAiB;QAC/B,MAAM,OAAO,GAA2B;YACtC,CAAC,iCAAwB,CAAC,EAAE,gCAAuB;YACnD,MAAM,EAAE,kBAAkB;SAC3B,CAAC;QAEF,MAAM,SAAS,GAAG,IAAI,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC;QAC/C,IAAI,SAAS,EAAE,CAAC;YACd,OAAO,CAAC,oCAA2B,CAAC,GAAG,SAAS,CAAC;QACnD,CAAC;QAED,MAAM,SAAS,GAAG,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACrD,IAAI,SAAS,EAAE,CAAC;YACd,OAAO,CAAC,aAAa,GAAG,UAAU,SAAS,CAAC,WAAW,IAAI,SAAS,CAAC,eAAe,EAAE,CAAC;YACvF,OAAO,OAAO,CAAC;QACjB,CAAC;QAED,MAAM,gBAAgB,GAAG,IAAI,CAAC,mBAAmB,CAAC,SAAS,CAAC,CAAC;QAC7D,IAAI,gBAAgB,EAAE,CAAC;YACrB,OAAO,CAAC,kCAAyB,CAAC,GAAG,gBAAgB,CAAC;QACxD,CAAC;QAED,OAAO,OAAO,CAAC;IACjB,CAAC;CACF;AA/JD,wDA+JC;AAED,SAAgB,wBAAwB,CAAC,OAA+B;IACtE,IAAI,OAAO,CAAC,UAAU,KAAK,OAAO,EAAE,CAAC;QACnC,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,yFAAyF;IACzF,IAAI,OAAO,CAAC,UAAU,KAAK,qBAAqB,EAAE,CAAC;QACjD,OAAO,kBAAkB,CAAC;IAC5B,CAAC;IACD,OAAO,OAAO,CAAC,UAAU,KAAK,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,kBAAkB,CAAC;AACnE,CAAC"}
+{"version":3,"file":"mcp-session-binding.js","sourceRoot":"","sources":["../src/mcp-session-binding.ts"],"names":[],"mappings":";;;;;;AAiKA,4DASC;AA1KD,0DAA6B;AAC7B,+CAK4B;AAgB5B,2DAA2D;AAC3D,MAAa,sBAAsB;IACzB,kBAAkB,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC/C,eAAe,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC5C,mBAAmB,GAAG,IAAI,GAAG,EAAkB,CAAC;IAChD,SAAS,GAAG,IAAI,GAAG,EAAoC,CAAC;IAChE,wEAAwE;IAChE,WAAW,GAAG,IAAI,GAAG,EAAU,CAAC;IACvB,gBAAgB,CAAU;IAC1B,aAAa,CAAU;IAExC,YAAY,MAA+C,EAAE;QAC3D,IAAI,CAAC,gBAAgB,GAAG,GAAG,CAAC,SAAS,EAAE,IAAI,EAAE,IAAI,SAAS,CAAC;QAC3D,IAAI,CAAC,aAAa,GAAG,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,SAAS,CAAC;IACvD,CAAC;IAED,iBAAiB,CACf,YAAoB,EACpB,KAKC;QAED,wEAAwE;QACxE,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC,YAAY,EAAE,KAAK,CAAC,gBAAgB,CAAC,CAAC;QACnE,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,YAAY,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;QACrD,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,YAAY,EAAE,KAAK,CAAC,IAAI,IAAI,QAAQ,CAAC,CAAC;QACzD,IAAI,KAAK,CAAC,aAAa,EAAE,CAAC;YACxB,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,YAAY,EAAE,mBAAI,CAAC,OAAO,CAAC,KAAK,CAAC,aAAa,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;QACtF,CAAC;IACH,CAAC;IAED,gBAAgB,CACd,YAAoB,EACpB,KAKC;QAED,IAAI,CAAC,iBAAiB,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC;QAC5C,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IACrC,CAAC;IAED,eAAe,CAAC,YAAoB;QAClC,OAAO,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IAC5C,CAAC;IAED,YAAY,CAAC,SAAiB,EAAE,aAAqB;QACnD,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,SAAS,EAAE,mBAAI,CAAC,OAAO,CAAC,aAAa,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IAC7E,CAAC;IAED,SAAS,CAAC,SAAiB,EAAE,MAAc;QACzC,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;IAC9C,CAAC;IAED,WAAW,CAAC,SAAiB;QAC3B,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACzC,CAAC;IAED,YAAY,CAAC,SAAiB;QAC5B,IAAI,CAAC,kBAAkB,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QAC1C,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QACvC,IAAI,CAAC,mBAAmB,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QAC3C,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QACjC,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACrC,CAAC;IAED,YAAY,CAAC,SAAiB;QAC5B,OAAO,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC,gBAAgB,CAAC;IACzE,CAAC;IAED,eAAe,CAAC,SAAiB;QAC/B,OAAO,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC,aAAa,CAAC;IACnE,CAAC;IAED,mBAAmB,CAAC,SAAiB;QACnC,OAAO,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACjD,CAAC;IAED,cAAc,CAAC,YAAoB,EAAE,IAA8B;QACjE,IAAI,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,CAAC;YACrC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,YAAY,EAAE,IAAI,CAAC,CAAC;QACzC,CAAC;IACH,CAAC;IAED,OAAO,CAAC,SAAiB;QACvB,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACvC,CAAC;IAED,sBAAsB,CAAC,SAAiB;QACtC,OAAO,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IAC7C,CAAC;IAED,UAAU,CAAC,SAAiB;QAC1B,MAAM,WAAW,GAAG,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACxD,MAAM,MAAM,GAAG,WAAW,IAAI,IAAI,CAAC,aAAa,CAAC;QACjD,MAAM,gBAAgB,GAAG,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACjE,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACjD,OAAO;YACL,aAAa,EAAE,IAAI,CAAC,YAAY,CAAC,SAAS,CAAC;YAC3C,MAAM;YACN,gBAAgB;YAChB,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,SAAS,CAAC;YACnC,UAAU,EAAE,QAAQ;gBAClB,CAAC,CAAC,QAAQ;gBACV,CAAC,CAAC,gBAAgB;oBAChB,CAAC,CAAC,OAAO;oBACT,CAAC,CAAC,WAAW;wBACX,CAAC,CAAC,kBAAkB;wBACpB,CAAC,CAAC,IAAI,CAAC,aAAa;4BAClB,CAAC,CAAC,KAAK;4BACP,CAAC,CAAC,SAAS;SACpB,CAAC;IACJ,CAAC;IAED,eAAe,CAAC,SAAiB;QAC/B,MAAM,OAAO,GAA2B;YACtC,CAAC,iCAAwB,CAAC,EAAE,gCAAuB;YACnD,MAAM,EAAE,kBAAkB;SAC3B,CAAC;QAEF,MAAM,SAAS,GAAG,IAAI,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC;QAC/C,IAAI,SAAS,EAAE,CAAC;YACd,OAAO,CAAC,oCAA2B,CAAC,GAAG,SAAS,CAAC;QACnD,CAAC;QAED,MAAM,gBAAgB,GAAG,IAAI,CAAC,mBAAmB,CAAC,SAAS,CAAC,CAAC;QAC7D,IAAI,gBAAgB,EAAE,CAAC;YACrB,OAAO,CAAC,kCAAyB,CAAC,GAAG,gBAAgB,CAAC;QACxD,CAAC;QAED,OAAO,OAAO,CAAC;IACjB,CAAC;CACF;AAxID,wDAwIC;AAED,SAAgB,wBAAwB,CAAC,OAA+B;IACtE,IAAI,OAAO,CAAC,UAAU,KAAK,OAAO,EAAE,CAAC;QACnC,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,4EAA4E;IAC5E,IAAI,OAAO,CAAC,UAAU,KAAK,QAAQ,EAAE,CAAC;QACpC,OAAO,kBAAkB,CAAC;IAC5B,CAAC;IACD,OAAO,OAAO,CAAC,UAAU,KAAK,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,kBAAkB,CAAC;AACnE,CAAC"}

package/dist/mcp-tools/policy.d.ts

@@ -21,9 +21,6 @@ export declare function mcpContractError(error_code: string, message: string, co
     }[];
     isError: boolean;
 };
-/** Control-plane ops are never available under short-lived execution authority. */
-export declare function denyControlPlaneUnderAuthority(host: McpToolHost): ReturnType<typeof mcpContractError> | null;
-export declare function authorizeExecutionAuthorityTool(host: McpToolHost, serviceId: string, toolName: string): Promise<ReturnType<typeof mcpContractError> | null>;
 /** Reads live runtime session mode from backend (source of truth after dashboard approval). */
 export declare function requireMcpAdmin(host: McpToolHost): Promise<ReturnType<typeof mcpPolicyError> | null>;
 export declare function requireMcpDashboard(): ReturnType<typeof mcpPolicyError> | null;

package/dist/mcp-tools/policy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"policy.d.ts","sourceRoot":"","sources":["../../src/mcp-tools/policy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAuB,KAAK,uBAAuB,EAAE,MAAM,oBAAoB,CAAC;AAGvF,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAc9C,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,OAAO;;;;;;EAWhD;AAED,wBAAgB,cAAc,CAAC,IAAI,EAAE,uBAAuB;;;;;;EAM3D;AAED,wBAAgB,gBAAgB,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;;;;;;EAU1G;AAED,mFAAmF;AACnF,wBAAgB,8BAA8B,CAC5C,IAAI,EAAE,WAAW,GAChB,UAAU,CAAC,OAAO,gBAAgB,CAAC,GAAG,IAAI,CAQ5C;AAED,wBAAsB,+BAA+B,CACnD,IAAI,EAAE,WAAW,EACjB,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,UAAU,CAAC,OAAO,gBAAgB,CAAC,GAAG,IAAI,CAAC,CA4BrD;AAiBD,+FAA+F;AAC/F,wBAAsB,eAAe,CAAC,IAAI,EAAE,WAAW,GAAG,OAAO,CAAC,UAAU,CAAC,OAAO,cAAc,CAAC,GAAG,IAAI,CAAC,CAa1G;AAED,wBAAgB,mBAAmB,IAAI,UAAU,CAAC,OAAO,cAAc,CAAC,GAAG,IAAI,CAK9E"}
+{"version":3,"file":"policy.d.ts","sourceRoot":"","sources":["../../src/mcp-tools/policy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAuB,KAAK,uBAAuB,EAAE,MAAM,oBAAoB,CAAC;AAGvF,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAK9C,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,OAAO;;;;;;EAWhD;AAED,wBAAgB,cAAc,CAAC,IAAI,EAAE,uBAAuB;;;;;;EAM3D;AAED,wBAAgB,gBAAgB,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;;;;;;EAU1G;AAmBD,+FAA+F;AAC/F,wBAAsB,eAAe,CAAC,IAAI,EAAE,WAAW,GAAG,OAAO,CAAC,UAAU,CAAC,OAAO,cAAc,CAAC,GAAG,IAAI,CAAC,CAa1G;AAED,wBAAgB,mBAAmB,IAAI,UAAU,CAAC,OAAO,cAAc,CAAC,GAAG,IAAI,CAK9E"}

package/dist/mcp-tools/policy.js

@@ -3,26 +3,15 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.formatMcpToolError = formatMcpToolError;
 exports.mcpPolicyError = mcpPolicyError;
 exports.mcpContractError = mcpContractError;
-exports.denyControlPlaneUnderAuthority = denyControlPlaneUnderAuthority;
-exports.authorizeExecutionAuthorityTool = authorizeExecutionAuthorityTool;
 exports.requireMcpAdmin = requireMcpAdmin;
 exports.requireMcpDashboard = requireMcpDashboard;
 const shared_1 = require("@agent-deck/shared");
 const backend_api_error_1 = require("../lib/backend-api-error");
-const AUTHORITY_CONTRACT_CODES = new Set([
-    'AUTHORITY_EXPIRED',
-    'AUTHORITY_REVOKED',
-    'AUTHORITY_UNKNOWN',
-    'AUTHORITY_SECRET_INVALID',
-    'AUDIENCE_MISMATCH',
-    'ENROLLMENT_REVOKED',
-    'COORDINATOR_NOT_ENROLLED',
-    'INTERACTION_REQUIRED',
-    'RESOURCE_OUT_OF_SCOPE',
-]);
+/** Codes that MCP surfaces as `{ok:false,error_code}` rather than trusted-session shape. */
+const CONTRACT_SHAPED_CODES = new Set(['RESOURCE_OUT_OF_SCOPE']);
 function formatMcpToolError(error) {
     if (error instanceof backend_api_error_1.BackendApiError && error.errorCode) {
-        if (AUTHORITY_CONTRACT_CODES.has(error.errorCode)) {
+        if (CONTRACT_SHAPED_CODES.has(error.errorCode)) {
             return mcpContractError(error.errorCode, error.message);
         }
         return mcpPolicyError(error.errorCode);
@@ -50,34 +39,6 @@ function mcpContractError(error_code, message, correlation) {
         isError: true,
     };
 }
-/** Control-plane ops are never available under short-lived execution authority. */
-function denyControlPlaneUnderAuthority(host) {
-    const auth = host.sessionBinding.getExecutionAuthority?.(host.getSessionId());
-    if (!auth)
-        return null;
-    return mcpContractError('INTERACTION_REQUIRED', 'Control-plane decision required; do not hold the worker', { authorityId: auth.authorityId, requestId: `req_authority_control_${Date.now()}` });
-}
-async function authorizeExecutionAuthorityTool(host, serviceId, toolName) {
-    const auth = host.sessionBinding.getExecutionAuthority?.(host.getSessionId());
-    if (!auth)
-        return null;
-    const res = await fetch(`${host.backendUrl}/api/execution-authority/authorize-call`, {
-        method: 'POST',
-        headers: { 'Content-Type': 'application/json', Accept: 'application/json' },
-        body: JSON.stringify({
-            authorityId: auth.authorityId,
-            authoritySecret: auth.authoritySecret,
-            audience: auth.audience,
-            serviceId,
-            toolName,
-        }),
-    });
-    const body = (await res.json());
-    if (!res.ok || !body.ok) {
-        return mcpContractError(body.error_code ?? 'RESOURCE_OUT_OF_SCOPE', body.message ?? 'Authority denied tool call', body.correlation);
-    }
-    return null;
-}
 function bodyMessage(code) {
     switch (code) {
         case 'ADMIN_REQUIRED':
@@ -85,9 +46,11 @@ function bodyMessage(code) {
         case 'DASHBOARD_REQUIRED':
             return 'Operation is never available to an agent';
         case 'GRANT_REQUIRED':
-            return 'No valid workspace grant';
+            return 'No deck selected for this connection';
         case 'RESOURCE_OUT_OF_SCOPE':
             return 'Resource is outside the bound deck';
+        case 'DECK_FIXED':
+            return "This connection's deck was set when it was launched and cannot be changed by the agent. Change it where the connection is configured (for example the Agent Dealer profile).";
         default:
             return code;
     }

package/dist/mcp-tools/policy.js.map

@@ -1 +1 @@
-{"version":3,"file":"policy.js","sourceRoot":"","sources":["../../src/mcp-tools/policy.ts"],"names":[],"mappings":";;AAiBA,gDAWC;AAED,wCAMC;AAED,4CAUC;AAGD,wEAUC;AAED,0EAgCC;AAkBD,0CAaC;AAED,kDAKC;AArID,+CAAuF;AAEvF,gEAA2D;AAG3D,MAAM,wBAAwB,GAAG,IAAI,GAAG,CAAC;IACvC,mBAAmB;IACnB,mBAAmB;IACnB,mBAAmB;IACnB,0BAA0B;IAC1B,mBAAmB;IACnB,oBAAoB;IACpB,0BAA0B;IAC1B,sBAAsB;IACtB,uBAAuB;CACxB,CAAC,CAAC;AAEH,SAAgB,kBAAkB,CAAC,KAAc;IAC/C,IAAI,KAAK,YAAY,mCAAe,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;QACxD,IAAI,wBAAwB,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC;YAClD,OAAO,gBAAgB,CAAC,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;QAC1D,CAAC;QACD,OAAO,cAAc,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IACzC,CAAC;IACD,OAAO;QACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,CAAC;QACpF,OAAO,EAAE,IAAI;KACd,CAAC;AACJ,CAAC;AAED,SAAgB,cAAc,CAAC,IAA6B;IAC1D,MAAM,IAAI,GAAG,IAAA,4BAAmB,EAAC,IAAI,EAAE,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC;IAC1D,OAAO;QACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC;QAChE,OAAO,EAAE,IAAI;KACd,CAAC;AACJ,CAAC;AAED,SAAgB,gBAAgB,CAAC,UAAkB,EAAE,OAAe,EAAE,WAAqC;IACzG,OAAO;QACL,OAAO,EAAE;YACP;gBACE,IAAI,EAAE,MAAe;gBACrB,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,UAAU,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC;aACtE;SACF;QACD,OAAO,EAAE,IAAI;KACd,CAAC;AACJ,CAAC;AAED,mFAAmF;AACnF,SAAgB,8BAA8B,CAC5C,IAAiB;IAEjB,MAAM,IAAI,GAAG,IAAI,CAAC,cAAc,CAAC,qBAAqB,EAAE,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC,CAAC;IAC9E,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IACvB,OAAO,gBAAgB,CACrB,sBAAsB,EACtB,yDAAyD,EACzD,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,SAAS,EAAE,yBAAyB,IAAI,CAAC,GAAG,EAAE,EAAE,EAAE,CACpF,CAAC;AACJ,CAAC;AAEM,KAAK,UAAU,+BAA+B,CACnD,IAAiB,EACjB,SAAiB,EACjB,QAAgB;IAEhB,MAAM,IAAI,GAAG,IAAI,CAAC,cAAc,CAAC,qBAAqB,EAAE,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC,CAAC;IAC9E,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IACvB,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,CAAC,UAAU,yCAAyC,EAAE;QACnF,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,EAAE,kBAAkB,EAAE;QAC3E,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;YACnB,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,eAAe,EAAE,IAAI,CAAC,eAAe;YACrC,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,SAAS;YACT,QAAQ;SACT,CAAC;KACH,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAK7B,CAAC;IACF,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;QACxB,OAAO,gBAAgB,CACrB,IAAI,CAAC,UAAU,IAAI,uBAAuB,EAC1C,IAAI,CAAC,OAAO,IAAI,4BAA4B,EAC5C,IAAI,CAAC,WAAW,CACjB,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,WAAW,CAAC,IAA6B;IAChD,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,gBAAgB;YACnB,OAAO,kCAAkC,CAAC;QAC5C,KAAK,oBAAoB;YACvB,OAAO,0CAA0C,CAAC;QACpD,KAAK,gBAAgB;YACnB,OAAO,0BAA0B,CAAC;QACpC,KAAK,uBAAuB;YAC1B,OAAO,oCAAoC,CAAC;QAC9C;YACE,OAAO,IAAI,CAAC;IAChB,CAAC;AACH,CAAC;AAED,+FAA+F;AACxF,KAAK,UAAU,eAAe,CAAC,IAAiB;IACrD,IAAI,OAAO,CAAC,GAAG,CAAC,+BAA+B,KAAK,GAAG,EAAE,CAAC;QACxD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,CAAC;QACH,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,qBAAqB,EAAE,CAAC;QACpD,IAAI,IAAI,KAAK,aAAa,EAAE,CAAC;YAC3B,OAAO,cAAc,CAAC,gBAAgB,CAAC,CAAC;QAC1C,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,cAAc,CAAC,gBAAgB,CAAC,CAAC;IAC1C,CAAC;AACH,CAAC;AAED,SAAgB,mBAAmB;IACjC,IAAI,OAAO,CAAC,GAAG,CAAC,+BAA+B,KAAK,GAAG,EAAE,CAAC;QACxD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,cAAc,CAAC,oBAAoB,CAAC,CAAC;AAC9C,CAAC"}
+{"version":3,"file":"policy.js","sourceRoot":"","sources":["../../src/mcp-tools/policy.ts"],"names":[],"mappings":";;AAQA,gDAWC;AAED,wCAMC;AAED,4CAUC;AAoBD,0CAaC;AAED,kDAKC;AA/ED,+CAAuF;AAEvF,gEAA2D;AAG3D,4FAA4F;AAC5F,MAAM,qBAAqB,GAAG,IAAI,GAAG,CAAC,CAAC,uBAAuB,CAAC,CAAC,CAAC;AAEjE,SAAgB,kBAAkB,CAAC,KAAc;IAC/C,IAAI,KAAK,YAAY,mCAAe,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;QACxD,IAAI,qBAAqB,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC;YAC/C,OAAO,gBAAgB,CAAC,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;QAC1D,CAAC;QACD,OAAO,cAAc,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IACzC,CAAC;IACD,OAAO;QACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,CAAC;QACpF,OAAO,EAAE,IAAI;KACd,CAAC;AACJ,CAAC;AAED,SAAgB,cAAc,CAAC,IAA6B;IAC1D,MAAM,IAAI,GAAG,IAAA,4BAAmB,EAAC,IAAI,EAAE,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC;IAC1D,OAAO;QACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC;QAChE,OAAO,EAAE,IAAI;KACd,CAAC;AACJ,CAAC;AAED,SAAgB,gBAAgB,CAAC,UAAkB,EAAE,OAAe,EAAE,WAAqC;IACzG,OAAO;QACL,OAAO,EAAE;YACP;gBACE,IAAI,EAAE,MAAe;gBACrB,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,UAAU,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC;aACtE;SACF;QACD,OAAO,EAAE,IAAI;KACd,CAAC;AACJ,CAAC;AAED,SAAS,WAAW,CAAC,IAA6B;IAChD,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,gBAAgB;YACnB,OAAO,kCAAkC,CAAC;QAC5C,KAAK,oBAAoB;YACvB,OAAO,0CAA0C,CAAC;QACpD,KAAK,gBAAgB;YACnB,OAAO,sCAAsC,CAAC;QAChD,KAAK,uBAAuB;YAC1B,OAAO,oCAAoC,CAAC;QAC9C,KAAK,YAAY;YACf,OAAO,8KAA8K,CAAC;QACxL;YACE,OAAO,IAAI,CAAC;IAChB,CAAC;AACH,CAAC;AAED,+FAA+F;AACxF,KAAK,UAAU,eAAe,CAAC,IAAiB;IACrD,IAAI,OAAO,CAAC,GAAG,CAAC,+BAA+B,KAAK,GAAG,EAAE,CAAC;QACxD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,CAAC;QACH,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,qBAAqB,EAAE,CAAC;QACpD,IAAI,IAAI,KAAK,aAAa,EAAE,CAAC;YAC3B,OAAO,cAAc,CAAC,gBAAgB,CAAC,CAAC;QAC1C,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,cAAc,CAAC,gBAAgB,CAAC,CAAC;IAC1C,CAAC;AACH,CAAC;AAED,SAAgB,mBAAmB;IACjC,IAAI,OAAO,CAAC,GAAG,CAAC,+BAA+B,KAAK,GAAG,EAAE,CAAC;QACxD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,cAAc,CAAC,oBAAoB,CAAC,CAAC;AAC9C,CAAC"}

package/dist/mcp-tools/register.d.ts

@@ -44,11 +44,7 @@ export type McpToolHost = {
             workspaceRoot?: string;
             mode?: 'normal' | 'agent-admin';
         }): void;
-        getExecutionAuthority?(sessionId: string): {
-            authorityId: string;
-            authoritySecret: string;
-            audience: string;
-        } | undefined;
+        isLaunchSession(sessionId: string): boolean;
         hasSessionDeckOverride(sessionId: string): boolean;
     };
     badgeBySession: Map<string, string>;

package/dist/mcp-tools/register.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"register.d.ts","sourceRoot":"","sources":["../../src/mcp-tools/register.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AAGjE,OAAO,EAAE,cAAc,EAAmB,MAAM,WAAW,CAAC;AAI5D,KAAK,cAAc,GAAG,CACpB,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,UAAU,CAAC,CAAA;CAAE,EACzF,OAAO,EAAE,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,OAAO,CAAC,GAAG,CAAC,KACtC,IAAI,CAAC;AAEV,MAAM,MAAM,WAAW,GAAG;IACxB,YAAY,EAAE,cAAc,CAAC;IAC7B,OAAO,EAAE,cAAc,CAAC;IACxB,YAAY,IAAI,MAAM,CAAC;IACvB,OAAO,IAAI,QAAQ,GAAG,aAAa,CAAC;IACpC,qBAAqB,IAAI,OAAO,CAAC;QAAE,IAAI,EAAE,QAAQ,GAAG,aAAa,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACrF,eAAe,IAAI,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC1C,cAAc,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;IAClC,cAAc,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;IACnE,SAAS,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACjE,mBAAmB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IACzE,mBAAmB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACtD,mBAAmB,CACjB,aAAa,EAAE,MAAM,EACrB,IAAI,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,GACjC,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,CAAC;IACtC,cAAc,EAAE;QACd,UAAU,CAAC,SAAS,EAAE,MAAM,GAAG;YAC7B,aAAa,CAAC,EAAE,MAAM,CAAC;YACvB,MAAM,CAAC,EAAE,MAAM,CAAC;YAChB,UAAU,CAAC,EAAE,MAAM,CAAC;YACpB,gBAAgB,CAAC,EAAE,MAAM,CAAC;YAC1B,IAAI,CAAC,EAAE,QAAQ,GAAG,aAAa,CAAC;SACjC,CAAC;QACF,YAAY,CAAC,SAAS,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;QAC7D,SAAS,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;QACnD,iBAAiB,CACf,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE;YACL,gBAAgB,EAAE,MAAM,CAAC;YACzB,MAAM,EAAE,MAAM,CAAC;YACf,aAAa,CAAC,EAAE,MAAM,CAAC;YACvB,IAAI,CAAC,EAAE,QAAQ,GAAG,aAAa,CAAC;SACjC,GACA,IAAI,CAAC;QACR,qBAAqB,CAAC,CACpB,SAAS,EAAE,MAAM,GAChB;YAAE,WAAW,EAAE,MAAM,CAAC;YAAC,eAAe,EAAE,MAAM,CAAC;YAAC,QAAQ,EAAE,MAAM,CAAA;SAAE,GAAG,SAAS,CAAC;QAClF,sBAAsB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC;KACpD,CAAC;IACF,cAAc,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACpC,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,IAAI,EAAE,OAAO,GAAG;QAAE,OAAO,EAAE,KAAK,CAAC;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,IAAI,EAAE,MAAM,CAAA;SAAE,CAAC,CAAA;KAAE,CAAC;IAC9E,SAAS,CAAC,KAAK,EAAE,OAAO,GAAG;QAAE,OAAO,EAAE,KAAK,CAAC;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,IAAI,EAAE,MAAM,CAAA;SAAE,CAAC,CAAA;KAAE,CAAC;CAC/E,CAAC;AAgDF,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,WAAW,GAAG,IAAI,CAmBxD;AAu2BD,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,cAAc,GAAG,MAAM,EAAE,CAgCzE"}
+{"version":3,"file":"register.d.ts","sourceRoot":"","sources":["../../src/mcp-tools/register.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAIxB,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AAIjE,OAAO,EAAE,cAAc,EAAmB,MAAM,WAAW,CAAC;AAI5D,KAAK,cAAc,GAAG,CACpB,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,UAAU,CAAC,CAAA;CAAE,EACzF,OAAO,EAAE,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,OAAO,CAAC,GAAG,CAAC,KACtC,IAAI,CAAC;AAEV,MAAM,MAAM,WAAW,GAAG;IACxB,YAAY,EAAE,cAAc,CAAC;IAC7B,OAAO,EAAE,cAAc,CAAC;IACxB,YAAY,IAAI,MAAM,CAAC;IACvB,OAAO,IAAI,QAAQ,GAAG,aAAa,CAAC;IACpC,qBAAqB,IAAI,OAAO,CAAC;QAAE,IAAI,EAAE,QAAQ,GAAG,aAAa,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACrF,eAAe,IAAI,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC1C,cAAc,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;IAClC,cAAc,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;IACnE,SAAS,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACjE,mBAAmB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IACzE,mBAAmB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACtD,mBAAmB,CACjB,aAAa,EAAE,MAAM,EACrB,IAAI,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,GACjC,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,CAAC;IACtC,cAAc,EAAE;QACd,UAAU,CAAC,SAAS,EAAE,MAAM,GAAG;YAC7B,aAAa,CAAC,EAAE,MAAM,CAAC;YACvB,MAAM,CAAC,EAAE,MAAM,CAAC;YAChB,UAAU,CAAC,EAAE,MAAM,CAAC;YACpB,gBAAgB,CAAC,EAAE,MAAM,CAAC;YAC1B,IAAI,CAAC,EAAE,QAAQ,GAAG,aAAa,CAAC;SACjC,CAAC;QACF,YAAY,CAAC,SAAS,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;QAC7D,SAAS,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;QACnD,iBAAiB,CACf,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE;YACL,gBAAgB,EAAE,MAAM,CAAC;YACzB,MAAM,EAAE,MAAM,CAAC;YACf,aAAa,CAAC,EAAE,MAAM,CAAC;YACvB,IAAI,CAAC,EAAE,QAAQ,GAAG,aAAa,CAAC;SACjC,GACA,IAAI,CAAC;QACR,eAAe,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC;QAC5C,sBAAsB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC;KACpD,CAAC;IACF,cAAc,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACpC,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,IAAI,EAAE,OAAO,GAAG;QAAE,OAAO,EAAE,KAAK,CAAC;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,IAAI,EAAE,MAAM,CAAA;SAAE,CAAC,CAAA;KAAE,CAAC;IAC9E,SAAS,CAAC,KAAK,EAAE,OAAO,GAAG;QAAE,OAAO,EAAE,KAAK,CAAC;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,IAAI,EAAE,MAAM,CAAA;SAAE,CAAC,CAAA;KAAE,CAAC;CAC/E,CAAC;AA4DF,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,WAAW,GAAG,IAAI,CAQxD;AAk1BD,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,cAAc,GAAG,MAAM,EAAE,CAiCzE"}

package/dist/mcp-tools/register.js

@@ -1,15 +1,32 @@
 "use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.registerMcpTools = registerMcpTools;
 exports.listToolNamesForProfile = listToolNamesForProfile;
 const zod_1 = require("zod");
+const node_fs_1 = __importDefault(require("node:fs"));
+const node_path_1 = __importDefault(require("node:path"));
 const shared_1 = require("@agent-deck/shared");
+const stub_sync_1 = require("../playbooks/stub-sync");
 const mcp_session_binding_1 = require("../mcp-session-binding");
 const deck_card_ops_1 = require("./deck-card-ops");
 const profile_1 = require("./profile");
 const policy_1 = require("./policy");
 const backend_api_error_1 = require("../lib/backend-api-error");
 const cardTypeSchema = zod_1.z.enum(['service', 'credential', 'playbook']);
+function assignmentFileExists(workspaceRoot) {
+    return node_fs_1.default.existsSync(node_path_1.default.join(workspaceRoot, '.agent-deck', 'use.json'));
+}
+function shouldSyncStubsOnBind(host, sessionId, workspaceRoot) {
+    // Grant sessions always sync. Launch sessions sync only when the folder has an assignment
+    // (IDE). Dealer worktrees without use.json keep skipping stub sync (NOT-105 / NOT-108).
+    if (!host.sessionBinding.isLaunchSession(sessionId)) {
+        return true;
+    }
+    return assignmentFileExists(workspaceRoot);
+}
 function isOutOfScopeError(error) {
     return error instanceof backend_api_error_1.BackendApiError && error.errorCode === 'RESOURCE_OUT_OF_SCOPE';
 }
@@ -17,8 +34,10 @@ function isOutOfScopeError(error) {
  * Resolve deck id/name for bind/switch.
  * Normal agents may only GET the bound deck; out-of-scope requires elevation,
  * then a retry of GET /api/decks/:id (agent-admin is allowed to read any deck).
+ *
+ * Launch sessions without an assignment file stay DECK_FIXED (NOT-108).
  */
-async function resolveDeckForBind(host, deckRef) {
+async function resolveDeckForBind(host, deckRef, workspaceRoot) {
     try {
         return await host.fetchDeck(deckRef);
     }
@@ -26,6 +45,11 @@ async function resolveDeckForBind(host, deckRef) {
         if (!isOutOfScopeError(error)) {
             throw error;
         }
+        if (host.sessionBinding.isLaunchSession(host.getSessionId())) {
+            if (!workspaceRoot || !assignmentFileExists(workspaceRoot)) {
+                return (0, policy_1.mcpPolicyError)('DECK_FIXED');
+            }
+        }
         const denied = await (0, policy_1.requireMcpAdmin)(host);
         if (denied) {
             return denied;
@@ -42,26 +66,7 @@ async function resolveDeckForBind(host, deckRef) {
         }
     }
 }
-/** Tools allowed under short-lived execution authority (everything else → INTERACTION_REQUIRED). */
-const EXECUTION_AUTHORITY_ALLOWED_TOOLS = new Set([
-    'get_session_binding',
-    'get_bound_deck',
-    'list_service_tools',
-    'call_service_tool',
-    'get_playbook',
-]);
 function registerMcpTools(host) {
-    const rawRegister = host.registerTool.bind(host);
-    host.registerTool = (name, config, handler) => {
-        rawRegister(name, config, async (...args) => {
-            if (!EXECUTION_AUTHORITY_ALLOWED_TOOLS.has(name)) {
-                const blocked = (0, policy_1.denyControlPlaneUnderAuthority)(host);
-                if (blocked)
-                    return blocked;
-            }
-            return handler(...args);
-        });
-    };
     registerRuntimeTools(host);
     if ((0, profile_1.profileIncludes)(host.profile, 'editing')) {
         registerEditingTools(host);
@@ -81,35 +86,56 @@ function registerRuntimeTools(host) {
         },
     }, async ({ workspaceRoot, deckId }) => {
         try {
-            const blocked = (0, policy_1.denyControlPlaneUnderAuthority)(host);
-            if (blocked)
-                return blocked;
             const sessionId = host.getSessionId();
             const current = host.sessionBinding.getBinding(sessionId);
-            const resolved = await resolveDeckForBind(host, deckId);
+            const isLaunch = host.sessionBinding.isLaunchSession(sessionId);
+            const resolved = await resolveDeckForBind(host, deckId, workspaceRoot);
             if ('isError' in resolved) {
                 return resolved;
             }
             const deck = resolved;
             let bindResult;
             if (current.runtimeSessionId) {
-                if (current.deckId && current.deckId !== deck.id) {
+                if (isLaunch && current.deckId && current.deckId !== deck.id) {
+                    if (!assignmentFileExists(workspaceRoot)) {
+                        return (0, policy_1.mcpPolicyError)('DECK_FIXED');
+                    }
                     const denied = await (0, policy_1.requireMcpAdmin)(host);
                     if (denied) {
                         return denied;
                     }
+                    bindResult = (await host.callBackendAPI('/api/trusted-session/bind-workspace', {
+                        method: 'POST',
+                        headers: { 'Content-Type': 'application/json' },
+                        body: JSON.stringify({ workspaceRoot, deckId: deck.id, updateAssignment: true }),
+                    }));
+                    host.sessionBinding.setTrustedSession(sessionId, {
+                        runtimeSessionId: current.runtimeSessionId,
+                        deckId: String(bindResult?.deckId ?? deck.id),
+                        workspaceRoot,
+                        mode: bindResult?.mode ?? current.mode ?? 'normal',
+                    });
+                    (0, stub_sync_1.healUseManifest)(workspaceRoot, deck);
+                }
+                else {
+                    if (current.deckId && current.deckId !== deck.id) {
+                        const denied = await (0, policy_1.requireMcpAdmin)(host);
+                        if (denied) {
+                            return denied;
+                        }
+                    }
+                    bindResult = (await host.callBackendAPI('/api/trusted-session/bind-workspace', {
+                        method: 'POST',
+                        headers: { 'Content-Type': 'application/json' },
+                        body: JSON.stringify({ workspaceRoot, deckId: deck.id }),
+                    }));
+                    host.sessionBinding.setTrustedSession(sessionId, {
+                        runtimeSessionId: current.runtimeSessionId,
+                        deckId: String(bindResult?.deckId ?? deck.id),
+                        workspaceRoot,
+                        mode: bindResult?.mode ?? current.mode ?? 'normal',
+                    });
                 }
-                bindResult = (await host.callBackendAPI('/api/trusted-session/bind-workspace', {
-                    method: 'POST',
-                    headers: { 'Content-Type': 'application/json' },
-                    body: JSON.stringify({ workspaceRoot, deckId: deck.id }),
-                }));
-                host.sessionBinding.setTrustedSession(sessionId, {
-                    runtimeSessionId: current.runtimeSessionId,
-                    deckId: String(bindResult?.deckId ?? deck.id),
-                    workspaceRoot,
-                    mode: bindResult?.mode ?? current.mode ?? 'normal',
-                });
             }
             else {
                 if (current.deckId && current.deckId !== deck.id) {
@@ -122,26 +148,25 @@ function registerRuntimeTools(host) {
                 host.sessionBinding.setDeckId(sessionId, deck.id);
             }
             let stubSync = null;
-            try {
-                stubSync = await host.syncWorkspaceOnBind(workspaceRoot, deck);
-            }
-            catch {
-                stubSync = null;
+            if (shouldSyncStubsOnBind(host, sessionId, workspaceRoot)) {
+                try {
+                    stubSync = await host.syncWorkspaceOnBind(workspaceRoot, deck);
+                }
+                catch {
+                    stubSync = null;
+                }
             }
             await host.registerLiveDisplay(sessionId);
             const payload = await host.buildBindingPayload(sessionId);
             const response = {
                 ...payload,
                 deck_name: deck.name,
-                message: bindResult?.grantRotated
-                    ? 'Workspace grant rotated to new deck. Peer sessions revoked.'
+                message: bindResult?.assignmentUpdated
+                    ? 'Folder assignment updated to new deck.'
                     : 'Session bound to deck.',
             };
-            if (bindResult?.grantRotated) {
-                response.grant_rotated = true;
-                response.peers_revoked = bindResult.peersRevoked;
-                response.previous_deck_workspace_count = bindResult.previousDeckWorkspaceCount;
-                response.grant_refresh_note = bindResult.grantRefreshNote;
+            if (bindResult?.assignmentUpdated) {
+                response.assignment_updated = true;
             }
             if (stubSync) {
                 response.stubs = {
@@ -173,18 +198,12 @@ function registerRuntimeTools(host) {
     });
     r('switch_bound_deck', {
         title: 'Switch Bound Deck',
-        description: 'Persistently bind this workspace to another deck (requires agent-admin). Rotates the workspace grant and revokes peer sessions.',
+        description: 'Persistently bind this workspace to another deck (requires agent-admin). Updates the folder assignment when present.',
         inputSchema: { deckId: zod_1.z.string().min(1) },
     }, async ({ deckId }) => {
-        const denied = await (0, policy_1.requireMcpAdmin)(host);
-        if (denied) {
-            return denied;
-        }
         try {
             const sessionId = host.getSessionId();
             const snapshot = host.sessionBinding.getBinding(sessionId);
-            // Already elevated above — GET /api/decks/:id allows agent-admin any deck.
-            const deck = await host.fetchDeck(deckId);
             const workspaceRoot = snapshot.workspaceRoot;
             if (!workspaceRoot) {
                 return host.toolError(new Error('workspaceRoot missing — call bind_workspace first'));
@@ -192,19 +211,36 @@ function registerRuntimeTools(host) {
             if (!snapshot.runtimeSessionId) {
                 return host.toolError(new Error('GRANT_REQUIRED'));
             }
-            const bound = await host.callBackendAPI('/api/trusted-session/bind-workspace', {
+            const isLaunch = host.sessionBinding.isLaunchSession(sessionId);
+            if (isLaunch && !assignmentFileExists(workspaceRoot)) {
+                return (0, policy_1.mcpPolicyError)('DECK_FIXED');
+            }
+            const denied = await (0, policy_1.requireMcpAdmin)(host);
+            if (denied) {
+                return denied;
+            }
+            // Already elevated above — GET /api/decks/:id allows agent-admin any deck.
+            const deck = await host.fetchDeck(deckId);
+            const bound = (await host.callBackendAPI('/api/trusted-session/bind-workspace', {
                 method: 'POST',
                 headers: { 'Content-Type': 'application/json' },
-                body: JSON.stringify({ workspaceRoot, deckId: deck.id }),
-            });
+                body: JSON.stringify({
+                    workspaceRoot,
+                    deckId: deck.id,
+                    ...(isLaunch ? { updateAssignment: true } : {}),
+                }),
+            }));
             host.sessionBinding.setTrustedSession(sessionId, {
                 runtimeSessionId: snapshot.runtimeSessionId,
                 deckId: String(bound.deckId ?? deck.id),
                 workspaceRoot,
                 mode: bound.mode ?? 'agent-admin',
             });
+            if (isLaunch || assignmentFileExists(workspaceRoot)) {
+                (0, stub_sync_1.healUseManifest)(workspaceRoot, deck);
+            }
             let stubSync = null;
-            if (workspaceRoot) {
+            if (shouldSyncStubsOnBind(host, sessionId, workspaceRoot)) {
                 try {
                     stubSync = await host.syncWorkspaceOnBind(workspaceRoot, deck);
                 }
@@ -217,15 +253,12 @@ function registerRuntimeTools(host) {
             const response = {
                 ...payload,
                 deck_name: deck.name,
-                message: bound.grantRotated
-                    ? 'Workspace grant rotated. Peer sessions on the old grant were revoked.'
+                message: bound.assignmentUpdated
+                    ? 'Folder assignment updated to new deck.'
                     : 'Already bound to this deck.',
             };
-            if (bound.grantRotated) {
-                response.grant_rotated = true;
-                response.peers_revoked = bound.peersRevoked;
-                response.previous_deck_workspace_count = bound.previousDeckWorkspaceCount;
-                response.grant_refresh_note = bound.grantRefreshNote;
+            if (bound.assignmentUpdated) {
+                response.assignment_updated = true;
             }
             if (stubSync) {
                 response.stubs = {
@@ -359,9 +392,6 @@ function registerRuntimeTools(host) {
         inputSchema: {},
     }, async () => {
         try {
-            const blocked = (0, policy_1.denyControlPlaneUnderAuthority)(host);
-            if (blocked)
-                return blocked;
             const binding = host.sessionBinding.getBinding(host.getSessionId());
             const runtimeSessionId = binding.runtimeSessionId;
             if (!runtimeSessionId) {
@@ -384,9 +414,6 @@ function registerRuntimeTools(host) {
         inputSchema: {},
     }, async () => {
         try {
-            const blocked = (0, policy_1.denyControlPlaneUnderAuthority)(host);
-            if (blocked)
-                return blocked;
             const binding = host.sessionBinding.getBinding(host.getSessionId());
             const runtimeSessionId = binding.runtimeSessionId;
             if (!runtimeSessionId) {
@@ -492,36 +519,6 @@ function registerRuntimeTools(host) {
         inputSchema: { serviceId: zod_1.z.string() },
     }, async ({ serviceId }) => {
         try {
-            const auth = host.sessionBinding.getExecutionAuthority?.(host.getSessionId());
-            if (auth) {
-                const connect = await fetch(`${host.backendUrl}/api/execution-authority/mcp/connect`, {
-                    method: 'POST',
-                    headers: {
-                        'Content-Type': 'application/json',
-                        Authorization: `Bearer ${auth.authorityId}:${auth.authoritySecret}`,
-                    },
-                    body: JSON.stringify({
-                        authorityId: auth.authorityId,
-                        authoritySecret: auth.authoritySecret,
-                        audience: auth.audience,
-                    }),
-                });
-                const body = (await connect.json());
-                if (!connect.ok || !body.ok) {
-                    return (0, policy_1.mcpContractError)(body.error_code ?? 'AUTHORITY_SECRET_INVALID', body.message ?? 'Authority invalid', { authorityId: auth.authorityId });
-                }
-                if (!body.data?.allowedServices?.includes(serviceId)) {
-                    return host.toolError(new backend_api_error_1.BackendApiError('Service is not on the bound deck', 403, 'RESOURCE_OUT_OF_SCOPE'));
-                }
-                const tools = await host.callBackendAPI(`/api/services/${serviceId}/tools`);
-                const allowedNames = new Set((body.data.allowedTools ?? [])
-                    .filter((t) => t.serviceId === serviceId)
-                    .map((t) => t.toolName));
-                const filtered = Array.isArray(tools)
-                    ? tools.filter((t) => typeof t.name === 'string' && allowedNames.has(t.name))
-                    : tools;
-                return host.toolResult(filtered);
-            }
             const tools = await host.callBackendAPI(`/api/services/${serviceId}/tools`);
             return host.toolResult(tools);
         }
@@ -539,8 +536,6 @@ function registerRuntimeTools(host) {
         },
     }, async ({ serviceId, toolName, arguments: args = {} }) => {
         try {
-            // Authorization + audit happen once in POST /api/services/:id/call
-            // (authorizeAuthorityServiceCall → ledger). Do not preflight authorize-call here.
             let normalizedArgs = args;
             if (typeof normalizedArgs === 'string' && normalizedArgs.length > 0) {
                 try {
@@ -915,6 +910,7 @@ function listToolNamesForProfile(profile) {
             setWorkspace: () => { },
             setDeckId: () => { },
             setTrustedSession: () => { },
+            isLaunchSession: () => false,
             hasSessionDeckOverride: () => false,
         },
         badgeBySession: new Map(),