@agentproto/runtime 3.1.0 → 3.2.0

package/dist/credential-discovery.d.ts

@@ -0,0 +1,161 @@
+import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+import { ProfileProvisionDeps, CreatedAuthProfile } from '@agentproto/auth';
+
+/**
+ * Read-only DISCOVERY SCANNER — `auth_discover_credentials`.
+ *
+ * Probes the well-known local locations where the CLIs and gateways this host
+ * knows about write their credentials (Claude Code's OAuth item, Codex/Gemini
+ * login files, `~/.hermes/config.yaml`, and the provider API-key env vars) and
+ * reports what it FINDS — so onboarding can offer to import a credential the
+ * user already has, instead of making them paste it again.
+ *
+ * It is a scanner, not a resolver. Two invariants make it money-safe, and the
+ * suite in `__tests__/credential-discovery.test.ts` is written against both:
+ *
+ *  1. NEVER return (or log) a discovered secret's VALUE. Every probe answers a
+ *     BOOLEAN "is a non-empty credential present here?" via {@link jsonFieldPresent}
+ *     / a presence check — the value is never bound into a result, only a
+ *     non-secret `hint` locator ("OPENROUTER_API_KEY in ~/.hermes/config.yaml").
+ *     This mirrors `verifyLocalLoginPresent`'s discard-the-value discipline in
+ *     `claude-code-oauth-source.ts`, taken one step further: we never hold the
+ *     plaintext at all.
+ *
+ *  2. NEVER throw on a malformed/unreadable source. A single corrupt file must
+ *     not sink the whole scan — each probe is wrapped so a parse error / bad
+ *     permission becomes a per-source `warn`+skip (same "malformed → empty, not
+ *     fatal" spirit as `loadProviders`). A MISSING file is normal "not found",
+ *     not even a warning.
+ *
+ * The source recipes (Keychain service name, file paths, jsonPaths) mirror the
+ * builtin provision recipes in
+ * `@agentproto/secrets/provision/recipe` (`claudeCodeOauthRecipe`,
+ * `codexRecipe`, `geminiRecipe`) so discovery and provisioning agree on where a
+ * credential lives.
+ *
+ * PHASE 1 (this file) is pure discovery: it reports EVERYTHING it finds, with
+ * provenance. Cross-referencing against already-imported profiles (the
+ * "found-but-not-*imported*" filter, keyed on a future AuthProfile `origin`
+ * field) is Phase 2 and is deliberately not done here.
+ */
+
+/** Where a discovered credential came from. Stable, non-secret provenance. */
+type CredentialOrigin = "claude-code" | "hermes-config" | "env" | "codex" | "gemini";
+/** One found-but-not-imported credential. Carries provenance and a non-secret
+ *  locator only — NEVER the credential value. */
+interface DiscoveredCredential {
+    /** Billing endpoint / vendor the credential is for (anthropic, openai, …). */
+    endpoint: string;
+    /** Auth method the credential installs as. */
+    method: "oauth-bearer" | "api-key";
+    /** Where it was found. */
+    origin: CredentialOrigin;
+    /** Non-secret human locator — e.g. "OPENROUTER_API_KEY in ~/.hermes/config.yaml".
+     *  Says WHERE the secret is, never WHAT it is. */
+    hint: string;
+}
+/**
+ * Injectable I/O so the scanner is unit-testable without touching the real
+ * home dir / Keychain. Defaults reach for the real host.
+ */
+interface CredentialDiscoveryDeps {
+    /** Home directory (`~` expands to this). Default: `os.homedir()`. */
+    homeDir?: string;
+    /** Process env to probe. Default: `process.env`. */
+    env?: Record<string, string | undefined>;
+    /** Read a file's text. MUST throw a Node-style error with `.code === "ENOENT"`
+     *  for a missing file (the default `readFileSync` does). Default: real fs. */
+    readFile?: (path: string) => string;
+    /** Look up a macOS Keychain generic-password by service, returning its raw
+     *  value; MUST throw when the item is absent. Default: `security find-generic-password`
+     *  on darwin, always-throws elsewhere. */
+    keychainLookup?: (service: string) => string;
+    /** Platform gate for the Keychain probe. Default: `process.platform`. */
+    platform?: NodeJS.Platform;
+    /** Non-secret warning sink for a malformed/unreadable source. Default: no-op. */
+    warn?: (message: string) => void;
+}
+/**
+ * Is there a non-empty STRING at `path` in this JSON text? Returns a boolean —
+ * it deliberately NEVER returns the value, so a discovered secret can't leak
+ * through it. Throws only if the text isn't parseable JSON (a malformed
+ * source), which the caller turns into a warn+skip.
+ */
+declare function jsonFieldPresent(raw: string, path: string): boolean;
+/**
+ * Extract a `KEY: <value>` value from `~/.hermes/config.yaml` text — a minimal,
+ * dependency-free reader (no YAML parser pulled in): the first top-levelish
+ * `key:` line, quotes stripped. Returns `undefined` when the key is absent or
+ * its value is blank/empty-quotes.
+ *
+ * Used TWO ways: the discovery scanner only asks {@link yamlKeyPresent}
+ * (boolean, never the value); the import path calls this directly to COPY the
+ * value into the keychain. The value it returns is a SECRET — callers must
+ * pass it straight to the credential store and never echo it.
+ */
+declare function readYamlKeyValue(raw: string, key: string): string | undefined;
+/**
+ * Does `~/.hermes/config.yaml` carry a non-empty value for `key`? Presence
+ * only — returns a boolean, NEVER the value (the discovery invariant).
+ */
+declare function yamlKeyPresent(raw: string, key: string): boolean;
+/**
+ * Scan the known local credential locations and report what's present, with
+ * provenance and a non-secret locator. Read-only, and safe against a corrupt
+ * or unreadable source (per-source warn+skip). NEVER returns a secret value.
+ */
+declare function discoverCredentials(deps?: CredentialDiscoveryDeps): DiscoveredCredential[];
+/** Raised when an import can't proceed (unknown origin/endpoint, or nothing to
+ *  import). Distinct type so the MCP surface can map it to a clean error. */
+declare class CredentialImportError extends Error {
+    constructor(message: string);
+}
+/** How a chosen `{ origin, endpoint }` becomes a profile. Discriminated: a
+ *  `source`-backed oauth-bearer, or an api-key COPIED from a located value. */
+type ImportMaterialization = {
+    method: "oauth-bearer";
+    endpoint: string;
+    source: string;
+} | {
+    method: "api-key";
+    endpoint: string;
+    copy: {
+        via: "env" | "hermes";
+        key: string;
+    };
+};
+/**
+ * Decide how to materialize a profile for a discovered `{ origin, endpoint }`.
+ * PURE — no I/O, no secret. Throws {@link CredentialImportError} for an unknown
+ * origin, or an endpoint that origin doesn't serve. The method is fixed by
+ * origin here, which is what forbids a bearer↔api-key mix.
+ */
+declare function planCredentialImport(origin: string, endpoint: string): ImportMaterialization;
+interface ImportCredentialArgs {
+    /** Discovery origin to import from. */
+    origin: string;
+    /** Billing endpoint to import (must be one the origin serves). */
+    endpoint: string;
+    /** Optional explicit profile id; defaults to `<origin>-<endpoint>`. */
+    id?: string;
+    /** Optional human label. */
+    label?: string;
+}
+/**
+ * Import a discovered credential into a named auth profile end-to-end.
+ *
+ * Guards against fabricating a profile: it re-runs discovery and refuses unless
+ * the requested `{ origin, endpoint }` is ACTUALLY present right now — discovery
+ * having once located a value is not license to import it. Then materializes via
+ * the single validated create path ({@link createAuthProfile}), stamping
+ * `origin` so the UI can badge it. Returns the non-secret {@link
+ * CreatedAuthProfile} (fingerprint, never the credential).
+ *
+ * `provisionDeps` is the profile/credential storage (a real keychain in prod, a
+ * `MemoryStore` in tests); `ioDeps` is the discovery I/O (env / files /
+ * keychain-read), injectable for the same reason.
+ */
+declare function importDiscoveredCredential(args: ImportCredentialArgs, provisionDeps: ProfileProvisionDeps, ioDeps?: CredentialDiscoveryDeps): Promise<CreatedAuthProfile>;
+declare function registerCredentialDiscoveryTools(server: McpServer): void;
+
+export { type CredentialDiscoveryDeps, CredentialImportError, type CredentialOrigin, type DiscoveredCredential, type ImportCredentialArgs, type ImportMaterialization, discoverCredentials, importDiscoveredCredential, jsonFieldPresent, planCredentialImport, readYamlKeyValue, registerCredentialDiscoveryTools, yamlKeyPresent };

package/dist/credential-discovery.mjs

@@ -0,0 +1,305 @@
+import { execFileSync } from 'child_process';
+import { readFileSync } from 'fs';
+import { homedir } from 'os';
+import { createAuthProfile } from '@agentproto/auth';
+
+/**
+ * @agentproto/runtime v0.1.0-alpha
+ * Long-running gateway: MCP server + HTTP transport + HEARTBEAT autonomy + conversation persistence over a workspace dir.
+ */
+
+function isMissingFile(err) {
+  return typeof err === "object" && err !== null && "code" in err && err.code === "ENOENT";
+}
+function expandHome(homeDir, p) {
+  if (p === "~") return homeDir;
+  if (p.startsWith("~/")) return homeDir.replace(/\/$/, "") + "/" + p.slice(2);
+  return p;
+}
+function jsonFieldPresent(raw, path) {
+  let cur = JSON.parse(raw);
+  for (const part of path.split(".")) {
+    if (cur == null || typeof cur !== "object") return false;
+    cur = cur[part];
+  }
+  return typeof cur === "string" && cur.length > 0;
+}
+function readYamlKeyValue(raw, key) {
+  const escaped = key.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+  const re = new RegExp(`^\\s*${escaped}\\s*:\\s*(.*)$`, "m");
+  const m = re.exec(raw);
+  if (!m) return void 0;
+  let value = (m[1] ?? "").trim();
+  if (value.startsWith('"') && value.endsWith('"') || value.startsWith("'") && value.endsWith("'")) {
+    value = value.slice(1, -1);
+  }
+  return value.length > 0 ? value : void 0;
+}
+function yamlKeyPresent(raw, key) {
+  return readYamlKeyValue(raw, key) !== void 0;
+}
+var CLAUDE_CODE_KEYCHAIN = "Claude Code-credentials";
+var CLAUDE_CODE_JSON_PATH = "claudeAiOauth.accessToken";
+var CLAUDE_CODE_FILE = "~/.claude/.credentials.json";
+var FILE_OAUTH_PROBES = [
+  { origin: "codex", endpoint: "openai", file: "~/.codex/auth.json", jsonPath: "tokens.access_token" },
+  { origin: "gemini", endpoint: "google", file: "~/.gemini/oauth_creds.json", jsonPath: "access_token" }
+];
+var HERMES_FILE = "~/.hermes/config.yaml";
+var HERMES_KEYS = [
+  { key: "OPENROUTER_API_KEY", endpoint: "openrouter" },
+  { key: "OPENAI_API_KEY", endpoint: "openai" }
+];
+var ENV_KEYS = [
+  { env: "OPENROUTER_API_KEY", endpoint: "openrouter" },
+  { env: "MOONSHOT_API_KEY", endpoint: "moonshot" },
+  { env: "OPENAI_API_KEY", endpoint: "openai" },
+  { env: "ANTHROPIC_API_KEY", endpoint: "anthropic" },
+  { env: "DEEPSEEK_API_KEY", endpoint: "deepseek" },
+  { env: "XAI_API_KEY", endpoint: "xai" }
+];
+function defaultKeychainLookup(service) {
+  return execFileSync("security", ["find-generic-password", "-w", "-s", service], {
+    encoding: "utf8"
+  }).trim();
+}
+function defaultReadFile(path) {
+  return readFileSync(path, "utf8");
+}
+function resolveDeps(deps) {
+  const platform = deps.platform ?? process.platform;
+  return {
+    homeDir: deps.homeDir ?? homedir(),
+    env: deps.env ?? process.env,
+    readFile: deps.readFile ?? defaultReadFile,
+    keychainLookup: deps.keychainLookup ?? (platform === "darwin" ? defaultKeychainLookup : () => {
+      throw new Error("keychain is macOS-only");
+    }),
+    platform,
+    warn: deps.warn ?? (() => {
+    })
+  };
+}
+function discoverCredentials(deps = {}) {
+  const d = resolveDeps(deps);
+  const found = [];
+  probeClaudeCode(d, found);
+  for (const probe of FILE_OAUTH_PROBES) probeFileOauth(d, probe, found);
+  probeHermes(d, found);
+  probeEnv(d, found);
+  return found;
+}
+function probeClaudeCode(d, out) {
+  if (d.platform === "darwin") {
+    try {
+      const raw = d.keychainLookup(CLAUDE_CODE_KEYCHAIN);
+      if (raw && jsonFieldPresent(raw, CLAUDE_CODE_JSON_PATH)) {
+        out.push({
+          endpoint: "anthropic",
+          method: "oauth-bearer",
+          origin: "claude-code",
+          hint: `Claude Code OAuth token in macOS Keychain ("${CLAUDE_CODE_KEYCHAIN}")`
+        });
+        return;
+      }
+    } catch (err) {
+    }
+  }
+  try {
+    const raw = d.readFile(expandHome(d.homeDir, CLAUDE_CODE_FILE));
+    if (jsonFieldPresent(raw, CLAUDE_CODE_JSON_PATH)) {
+      out.push({
+        endpoint: "anthropic",
+        method: "oauth-bearer",
+        origin: "claude-code",
+        hint: `Claude Code OAuth token in ${CLAUDE_CODE_FILE}`
+      });
+    }
+  } catch (err) {
+    if (!isMissingFile(err)) {
+      d.warn(`skipping ${CLAUDE_CODE_FILE}: ${errText(err)}`);
+    }
+  }
+}
+function probeFileOauth(d, probe, out) {
+  try {
+    const raw = d.readFile(expandHome(d.homeDir, probe.file));
+    if (jsonFieldPresent(raw, probe.jsonPath)) {
+      out.push({
+        endpoint: probe.endpoint,
+        method: "oauth-bearer",
+        origin: probe.origin,
+        hint: `${probe.origin} OAuth token in ${probe.file}`
+      });
+    }
+  } catch (err) {
+    if (!isMissingFile(err)) {
+      d.warn(`skipping ${probe.file}: ${errText(err)}`);
+    }
+  }
+}
+function probeHermes(d, out) {
+  let raw;
+  try {
+    raw = d.readFile(expandHome(d.homeDir, HERMES_FILE));
+  } catch (err) {
+    if (!isMissingFile(err)) d.warn(`skipping ${HERMES_FILE}: ${errText(err)}`);
+    return;
+  }
+  for (const { key, endpoint } of HERMES_KEYS) {
+    try {
+      if (yamlKeyPresent(raw, key)) {
+        out.push({
+          endpoint,
+          method: "api-key",
+          origin: "hermes-config",
+          hint: `${key} in ${HERMES_FILE}`
+        });
+      }
+    } catch (err) {
+      d.warn(`skipping ${key} in ${HERMES_FILE}: ${errText(err)}`);
+    }
+  }
+}
+function probeEnv(d, out) {
+  for (const { env, endpoint } of ENV_KEYS) {
+    const value = d.env[env];
+    if (value && value.trim().length > 0) {
+      out.push({
+        endpoint,
+        method: "api-key",
+        origin: "env",
+        hint: `${env} in the environment`
+      });
+    }
+  }
+}
+function errText(err) {
+  return err instanceof Error ? err.message : String(err);
+}
+var CredentialImportError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "CredentialImportError";
+  }
+};
+var SOURCE_BACKED_ORIGINS = {
+  "claude-code": { source: "claude-code-oauth", endpoint: "anthropic" },
+  codex: { source: "codex", endpoint: "openai" },
+  gemini: { source: "gemini", endpoint: "google" }
+};
+function planCredentialImport(origin, endpoint) {
+  const wanted = endpoint.trim();
+  const sourceBacked = SOURCE_BACKED_ORIGINS[origin];
+  if (sourceBacked) {
+    if (wanted && wanted !== sourceBacked.endpoint) {
+      throw new CredentialImportError(
+        `origin "${origin}" authenticates ${sourceBacked.endpoint}, not "${wanted}"`
+      );
+    }
+    return { method: "oauth-bearer", endpoint: sourceBacked.endpoint, source: sourceBacked.source };
+  }
+  if (origin === "env") {
+    const entry = ENV_KEYS.find((e) => e.endpoint === wanted);
+    if (!entry) {
+      throw new CredentialImportError(
+        `no known env var maps to endpoint "${wanted}" for origin "env"`
+      );
+    }
+    return { method: "api-key", endpoint: wanted, copy: { via: "env", key: entry.env } };
+  }
+  if (origin === "hermes-config") {
+    const entry = HERMES_KEYS.find((h) => h.endpoint === wanted);
+    if (!entry) {
+      throw new CredentialImportError(
+        `no known ~/.hermes/config.yaml key maps to endpoint "${wanted}"`
+      );
+    }
+    return { method: "api-key", endpoint: wanted, copy: { via: "hermes", key: entry.key } };
+  }
+  throw new CredentialImportError(`unknown credential origin "${origin}"`);
+}
+function resolveCopyValue(copy, d) {
+  if (copy.via === "env") {
+    const value2 = d.env[copy.key]?.trim();
+    if (!value2) {
+      throw new CredentialImportError(`no ${copy.key} in the environment to import`);
+    }
+    return value2;
+  }
+  let raw;
+  try {
+    raw = d.readFile(expandHome(d.homeDir, HERMES_FILE));
+  } catch (err) {
+    throw new CredentialImportError(`cannot read ${HERMES_FILE} to import ${copy.key}: ${errText(err)}`);
+  }
+  const value = readYamlKeyValue(raw, copy.key);
+  if (!value) {
+    throw new CredentialImportError(`no ${copy.key} value in ${HERMES_FILE} to import`);
+  }
+  return value;
+}
+function defaultImportId(origin, endpoint) {
+  return `${origin}-${endpoint}`;
+}
+async function importDiscoveredCredential(args, provisionDeps, ioDeps = {}) {
+  const plan = planCredentialImport(args.origin, args.endpoint);
+  const present = discoverCredentials(ioDeps).some(
+    (c) => c.origin === args.origin && c.endpoint === plan.endpoint
+  );
+  if (!present) {
+    throw new CredentialImportError(
+      `nothing to import \u2014 no ${args.origin} credential for ${plan.endpoint} was discovered`
+    );
+  }
+  const id = args.id?.trim() || defaultImportId(args.origin, plan.endpoint);
+  const label = args.label?.trim();
+  const base = {
+    id,
+    endpoint: plan.endpoint,
+    method: plan.method,
+    origin: args.origin,
+    ...label ? { label } : {}
+  };
+  if (plan.method === "oauth-bearer") {
+    return createAuthProfile({ ...base, source: plan.source }, provisionDeps);
+  }
+  const credential = resolveCopyValue(plan.copy, resolveDeps(ioDeps));
+  return createAuthProfile({ ...base, credential }, provisionDeps);
+}
+function text(value) {
+  return {
+    content: [
+      {
+        type: "text",
+        text: typeof value === "string" ? value : JSON.stringify(value)
+      }
+    ]
+  };
+}
+function errorText(message) {
+  return { content: [{ type: "text", text: message }], isError: true };
+}
+function registerCredentialDiscoveryTools(server) {
+  server.tool(
+    "auth_discover_credentials",
+    "Read-only scan of the known local credential locations (Claude Code's Keychain/OAuth file, Codex/Gemini login files, `~/.hermes/config.yaml`, and the provider API-key env vars). Reports which credentials are PRESENT and where they came from, so onboarding can offer to import one you already have. Returns only non-secret provenance \u2014 `{ endpoint, method, origin, hint }` \u2014 and NEVER the credential value; the `hint` is a locator, not the secret. A malformed or unreadable source is skipped, never fatal; a missing file is a normal 'not found'.",
+    {},
+    async () => {
+      try {
+        const warnings = [];
+        const credentials = discoverCredentials({ warn: (m) => warnings.push(m) });
+        return text({
+          credentials,
+          ...warnings.length ? { warnings } : {}
+        });
+      } catch (err) {
+        return errorText(`auth_discover_credentials failed: ${errText(err)}`);
+      }
+    }
+  );
+}
+
+export { CredentialImportError, discoverCredentials, importDiscoveredCredential, jsonFieldPresent, planCredentialImport, readYamlKeyValue, registerCredentialDiscoveryTools, yamlKeyPresent };
+//# sourceMappingURL=credential-discovery.mjs.map
+//# sourceMappingURL=credential-discovery.mjs.map

package/dist/credential-discovery.mjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/credential-discovery.ts"],"names":["value"],"mappings":";;;;;;;;;;AAwGA,SAAS,cAAc,GAAA,EAAuB;AAC5C,EAAA,OACE,OAAO,QAAQ,QAAA,IACf,GAAA,KAAQ,QACR,MAAA,IAAU,GAAA,IACT,IAA2B,IAAA,KAAS,QAAA;AAEzC;AAEA,SAAS,UAAA,CAAW,SAAiB,CAAA,EAAmB;AACtD,EAAA,IAAI,CAAA,KAAM,KAAK,OAAO,OAAA;AACtB,EAAA,IAAI,CAAA,CAAE,UAAA,CAAW,IAAI,CAAA,EAAG,OAAO,OAAA,CAAQ,OAAA,CAAQ,KAAA,EAAO,EAAE,CAAA,GAAI,GAAA,GAAM,CAAA,CAAE,MAAM,CAAC,CAAA;AAC3E,EAAA,OAAO,CAAA;AACT;AAQO,SAAS,gBAAA,CAAiB,KAAa,IAAA,EAAuB;AACnE,EAAA,IAAI,GAAA,GAAe,IAAA,CAAK,KAAA,CAAM,GAAG,CAAA;AACjC,EAAA,KAAA,MAAW,IAAA,IAAQ,IAAA,CAAK,KAAA,CAAM,GAAG,CAAA,EAAG;AAClC,IAAA,IAAI,GAAA,IAAO,IAAA,IAAQ,OAAO,GAAA,KAAQ,UAAU,OAAO,KAAA;AACnD,IAAA,GAAA,GAAO,IAAgC,IAAI,CAAA;AAAA,EAC7C;AACA,EAAA,OAAO,OAAO,GAAA,KAAQ,QAAA,IAAY,GAAA,CAAI,MAAA,GAAS,CAAA;AACjD;AAaO,SAAS,gBAAA,CAAiB,KAAa,GAAA,EAAiC;AAC7E,EAAA,MAAM,OAAA,GAAU,GAAA,CAAI,OAAA,CAAQ,qBAAA,EAAuB,MAAM,CAAA;AACzD,EAAA,MAAM,KAAK,IAAI,MAAA,CAAO,CAAA,KAAA,EAAQ,OAAO,kBAAkB,GAAG,CAAA;AAC1D,EAAA,MAAM,CAAA,GAAI,EAAA,CAAG,IAAA,CAAK,GAAG,CAAA;AACrB,EAAA,IAAI,CAAC,GAAG,OAAO,MAAA;AAEf,EAAA,IAAI,KAAA,GAAA,CAAS,CAAA,CAAE,CAAC,CAAA,IAAK,IAAI,IAAA,EAAK;AAC9B,EAAA,IACG,KAAA,CAAM,UAAA,CAAW,GAAG,CAAA,IAAK,MAAM,QAAA,CAAS,GAAG,CAAA,IAC3C,KAAA,CAAM,WAAW,GAAG,CAAA,IAAK,KAAA,CAAM,QAAA,CAAS,GAAG,CAAA,EAC5C;AACA,IAAA,KAAA,GAAQ,KAAA,CAAM,KAAA,CAAM,CAAA,EAAG,EAAE,CAAA;AAAA,EAC3B;AACA,EAAA,OAAO,KAAA,CAAM,MAAA,GAAS,CAAA,GAAI,KAAA,GAAQ,MAAA;AACpC;AAMO,SAAS,cAAA,CAAe,KAAa,GAAA,EAAsB;AAChE,EAAA,OAAO,gBAAA,CAAiB,GAAA,EAAK,GAAG,CAAA,KAAM,MAAA;AACxC;AAGA,IAAM,oBAAA,GAAuB,yBAAA;AAC7B,IAAM,qBAAA,GAAwB,2BAAA;AAC9B,IAAM,gBAAA,GAAmB,6BAAA;AAGzB,IAAM,iBAAA,GAKD;AAAA,EACH,EAAE,QAAQ,OAAA,EAAS,QAAA,EAAU,UAAU,IAAA,EAAM,oBAAA,EAAsB,UAAU,qBAAA,EAAsB;AAAA,EACnG,EAAE,QAAQ,QAAA,EAAU,QAAA,EAAU,UAAU,IAAA,EAAM,4BAAA,EAA8B,UAAU,cAAA;AACxF,CAAA;AAGA,IAAM,WAAA,GAAc,uBAAA;AACpB,IAAM,WAAA,GAAgE;AAAA,EACpE,EAAE,GAAA,EAAK,oBAAA,EAAsB,QAAA,EAAU,YAAA,EAAa;AAAA,EACpD,EAAE,GAAA,EAAK,gBAAA,EAAkB,QAAA,EAAU,QAAA;AACrC,CAAA;AAGA,IAAM,QAAA,GAA6D;AAAA,EACjE,EAAE,GAAA,EAAK,oBAAA,EAAsB,QAAA,EAAU,YAAA,EAAa;AAAA,EACpD,EAAE,GAAA,EAAK,kBAAA,EAAoB,QAAA,EAAU,UAAA,EAAW;AAAA,EAChD,EAAE,GAAA,EAAK,gBAAA,EAAkB,QAAA,EAAU,QAAA,EAAS;AAAA,EAC5C,EAAE,GAAA,EAAK,mBAAA,EAAqB,QAAA,EAAU,WAAA,EAAY;AAAA,EAClD,EAAE,GAAA,EAAK,kBAAA,EAAoB,QAAA,EAAU,UAAA,EAAW;AAAA,EAChD,EAAE,GAAA,EAAK,aAAA,EAAe,QAAA,EAAU,KAAA;AAClC,CAAA;AAEA,SAAS,sBAAsB,OAAA,EAAyB;AACtD,EAAA,OAAO,aAAa,UAAA,EAAY,CAAC,yBAAyB,IAAA,EAAM,IAAA,EAAM,OAAO,CAAA,EAAG;AAAA,IAC9E,QAAA,EAAU;AAAA,GACX,EAAE,IAAA,EAAK;AACV;AAEA,SAAS,gBAAgB,IAAA,EAAsB;AAC7C,EAAA,OAAO,YAAA,CAAa,MAAM,MAAM,CAAA;AAClC;AAEA,SAAS,YAAY,IAAA,EAA6C;AAChE,EAAA,MAAM,QAAA,GAAW,IAAA,CAAK,QAAA,IAAY,OAAA,CAAQ,QAAA;AAC1C,EAAA,OAAO;AAAA,IACL,OAAA,EAAS,IAAA,CAAK,OAAA,IAAW,OAAA,EAAQ;AAAA,IACjC,GAAA,EAAK,IAAA,CAAK,GAAA,IAAO,OAAA,CAAQ,GAAA;AAAA,IACzB,QAAA,EAAU,KAAK,QAAA,IAAY,eAAA;AAAA,IAC3B,gBACE,IAAA,CAAK,cAAA,KACJ,QAAA,KAAa,QAAA,GACV,wBACA,MAAM;AACJ,MAAA,MAAM,IAAI,MAAM,wBAAwB,CAAA;AAAA,IAC1C,CAAA,CAAA;AAAA,IACN,QAAA;AAAA,IACA,IAAA,EAAM,IAAA,CAAK,IAAA,KAAS,MAAM;AAAA,IAAC,CAAA;AAAA,GAC7B;AACF;AAOO,SAAS,mBAAA,CACd,IAAA,GAAgC,EAAC,EACT;AACxB,EAAA,MAAM,CAAA,GAAI,YAAY,IAAI,CAAA;AAC1B,EAAA,MAAM,QAAgC,EAAC;AAEvC,EAAA,eAAA,CAAgB,GAAG,KAAK,CAAA;AACxB,EAAA,KAAA,MAAW,KAAA,IAAS,iBAAA,EAAmB,cAAA,CAAe,CAAA,EAAG,OAAO,KAAK,CAAA;AACrE,EAAA,WAAA,CAAY,GAAG,KAAK,CAAA;AACpB,EAAA,QAAA,CAAS,GAAG,KAAK,CAAA;AAEjB,EAAA,OAAO,KAAA;AACT;AAEA,SAAS,eAAA,CAAgB,GAAiB,GAAA,EAAmC;AAG3E,EAAA,IAAI,CAAA,CAAE,aAAa,QAAA,EAAU;AAC3B,IAAA,IAAI;AACF,MAAA,MAAM,GAAA,GAAM,CAAA,CAAE,cAAA,CAAe,oBAAoB,CAAA;AACjD,MAAA,IAAI,GAAA,IAAO,gBAAA,CAAiB,GAAA,EAAK,qBAAqB,CAAA,EAAG;AACvD,QAAA,GAAA,CAAI,IAAA,CAAK;AAAA,UACP,QAAA,EAAU,WAAA;AAAA,UACV,MAAA,EAAQ,cAAA;AAAA,UACR,MAAA,EAAQ,aAAA;AAAA,UACR,IAAA,EAAM,+CAA+C,oBAAoB,CAAA,EAAA;AAAA,SAC1E,CAAA;AACD,QAAA;AAAA,MACF;AAAA,IACF,SAAS,GAAA,EAAK;AAGP,IACP;AAAA,EACF;AACA,EAAA,IAAI;AACF,IAAA,MAAM,MAAM,CAAA,CAAE,QAAA,CAAS,WAAW,CAAA,CAAE,OAAA,EAAS,gBAAgB,CAAC,CAAA;AAC9D,IAAA,IAAI,gBAAA,CAAiB,GAAA,EAAK,qBAAqB,CAAA,EAAG;AAChD,MAAA,GAAA,CAAI,IAAA,CAAK;AAAA,QACP,QAAA,EAAU,WAAA;AAAA,QACV,MAAA,EAAQ,cAAA;AAAA,QACR,MAAA,EAAQ,aAAA;AAAA,QACR,IAAA,EAAM,8BAA8B,gBAAgB,CAAA;AAAA,OACrD,CAAA;AAAA,IACH;AAAA,EACF,SAAS,GAAA,EAAK;AACZ,IAAA,IAAI,CAAC,aAAA,CAAc,GAAG,CAAA,EAAG;AACvB,MAAA,CAAA,CAAE,KAAK,CAAA,SAAA,EAAY,gBAAgB,KAAK,OAAA,CAAQ,GAAG,CAAC,CAAA,CAAE,CAAA;AAAA,IACxD;AAAA,EACF;AACF;AAEA,SAAS,cAAA,CACP,CAAA,EACA,KAAA,EACA,GAAA,EACM;AACN,EAAA,IAAI;AACF,IAAA,MAAM,GAAA,GAAM,EAAE,QAAA,CAAS,UAAA,CAAW,EAAE,OAAA,EAAS,KAAA,CAAM,IAAI,CAAC,CAAA;AACxD,IAAA,IAAI,gBAAA,CAAiB,GAAA,EAAK,KAAA,CAAM,QAAQ,CAAA,EAAG;AACzC,MAAA,GAAA,CAAI,IAAA,CAAK;AAAA,QACP,UAAU,KAAA,CAAM,QAAA;AAAA,QAChB,MAAA,EAAQ,cAAA;AAAA,QACR,QAAQ,KAAA,CAAM,MAAA;AAAA,QACd,MAAM,CAAA,EAAG,KAAA,CAAM,MAAM,CAAA,gBAAA,EAAmB,MAAM,IAAI,CAAA;AAAA,OACnD,CAAA;AAAA,IACH;AAAA,EACF,SAAS,GAAA,EAAK;AACZ,IAAA,IAAI,CAAC,aAAA,CAAc,GAAG,CAAA,EAAG;AACvB,MAAA,CAAA,CAAE,IAAA,CAAK,YAAY,KAAA,CAAM,IAAI,KAAK,OAAA,CAAQ,GAAG,CAAC,CAAA,CAAE,CAAA;AAAA,IAClD;AAAA,EACF;AACF;AAEA,SAAS,WAAA,CAAY,GAAiB,GAAA,EAAmC;AACvE,EAAA,IAAI,GAAA;AACJ,EAAA,IAAI;AACF,IAAA,GAAA,GAAM,EAAE,QAAA,CAAS,UAAA,CAAW,CAAA,CAAE,OAAA,EAAS,WAAW,CAAC,CAAA;AAAA,EACrD,SAAS,GAAA,EAAK;AACZ,IAAA,IAAI,CAAC,aAAA,CAAc,GAAG,CAAA,EAAG,CAAA,CAAE,IAAA,CAAK,CAAA,SAAA,EAAY,WAAW,CAAA,EAAA,EAAK,OAAA,CAAQ,GAAG,CAAC,CAAA,CAAE,CAAA;AAC1E,IAAA;AAAA,EACF;AACA,EAAA,KAAA,MAAW,EAAE,GAAA,EAAK,QAAA,EAAS,IAAK,WAAA,EAAa;AAC3C,IAAA,IAAI;AACF,MAAA,IAAI,cAAA,CAAe,GAAA,EAAK,GAAG,CAAA,EAAG;AAC5B,QAAA,GAAA,CAAI,IAAA,CAAK;AAAA,UACP,QAAA;AAAA,UACA,MAAA,EAAQ,SAAA;AAAA,UACR,MAAA,EAAQ,eAAA;AAAA,UACR,IAAA,EAAM,CAAA,EAAG,GAAG,CAAA,IAAA,EAAO,WAAW,CAAA;AAAA,SAC/B,CAAA;AAAA,MACH;AAAA,IACF,SAAS,GAAA,EAAK;AACZ,MAAA,CAAA,CAAE,IAAA,CAAK,YAAY,GAAG,CAAA,IAAA,EAAO,WAAW,CAAA,EAAA,EAAK,OAAA,CAAQ,GAAG,CAAC,CAAA,CAAE,CAAA;AAAA,IAC7D;AAAA,EACF;AACF;AAEA,SAAS,QAAA,CAAS,GAAiB,GAAA,EAAmC;AACpE,EAAA,KAAA,MAAW,EAAE,GAAA,EAAK,QAAA,EAAS,IAAK,QAAA,EAAU;AACxC,IAAA,MAAM,KAAA,GAAQ,CAAA,CAAE,GAAA,CAAI,GAAG,CAAA;AACvB,IAAA,IAAI,KAAA,IAAS,KAAA,CAAM,IAAA,EAAK,CAAE,SAAS,CAAA,EAAG;AACpC,MAAA,GAAA,CAAI,IAAA,CAAK;AAAA,QACP,QAAA;AAAA,QACA,MAAA,EAAQ,SAAA;AAAA,QACR,MAAA,EAAQ,KAAA;AAAA,QACR,IAAA,EAAM,GAAG,GAAG,CAAA,mBAAA;AAAA,OACb,CAAA;AAAA,IACH;AAAA,EACF;AACF;AAEA,SAAS,QAAQ,GAAA,EAAsB;AACrC,EAAA,OAAO,GAAA,YAAe,KAAA,GAAQ,GAAA,CAAI,OAAA,GAAU,OAAO,GAAG,CAAA;AACxD;AAqBO,IAAM,qBAAA,GAAN,cAAoC,KAAA,CAAM;AAAA,EAC/C,YAAY,OAAA,EAAiB;AAC3B,IAAA,KAAA,CAAM,OAAO,CAAA;AACb,IAAA,IAAA,CAAK,IAAA,GAAO,uBAAA;AAAA,EACd;AACF;AAOA,IAAM,qBAAA,GAA8E;AAAA,EAClF,aAAA,EAAe,EAAE,MAAA,EAAQ,mBAAA,EAAqB,UAAU,WAAA,EAAY;AAAA,EACpE,KAAA,EAAO,EAAE,MAAA,EAAQ,OAAA,EAAS,UAAU,QAAA,EAAS;AAAA,EAC7C,MAAA,EAAQ,EAAE,MAAA,EAAQ,QAAA,EAAU,UAAU,QAAA;AACxC,CAAA;AAkBO,SAAS,oBAAA,CACd,QACA,QAAA,EACuB;AACvB,EAAA,MAAM,MAAA,GAAS,SAAS,IAAA,EAAK;AAC7B,EAAA,MAAM,YAAA,GAAe,sBAAsB,MAAM,CAAA;AACjD,EAAA,IAAI,YAAA,EAAc;AAChB,IAAA,IAAI,MAAA,IAAU,MAAA,KAAW,YAAA,CAAa,QAAA,EAAU;AAC9C,MAAA,MAAM,IAAI,qBAAA;AAAA,QACR,WAAW,MAAM,CAAA,gBAAA,EAAmB,YAAA,CAAa,QAAQ,UAAU,MAAM,CAAA,CAAA;AAAA,OAC3E;AAAA,IACF;AACA,IAAA,OAAO,EAAE,QAAQ,cAAA,EAAgB,QAAA,EAAU,aAAa,QAAA,EAAU,MAAA,EAAQ,aAAa,MAAA,EAAO;AAAA,EAChG;AACA,EAAA,IAAI,WAAW,KAAA,EAAO;AACpB,IAAA,MAAM,QAAQ,QAAA,CAAS,IAAA,CAAK,CAAC,CAAA,KAAM,CAAA,CAAE,aAAa,MAAM,CAAA;AACxD,IAAA,IAAI,CAAC,KAAA,EAAO;AACV,MAAA,MAAM,IAAI,qBAAA;AAAA,QACR,sCAAsC,MAAM,CAAA,kBAAA;AAAA,OAC9C;AAAA,IACF;AACA,IAAA,OAAO,EAAE,MAAA,EAAQ,SAAA,EAAW,QAAA,EAAU,MAAA,EAAQ,IAAA,EAAM,EAAE,GAAA,EAAK,KAAA,EAAO,GAAA,EAAK,KAAA,CAAM,GAAA,EAAI,EAAE;AAAA,EACrF;AACA,EAAA,IAAI,WAAW,eAAA,EAAiB;AAC9B,IAAA,MAAM,QAAQ,WAAA,CAAY,IAAA,CAAK,CAAC,CAAA,KAAM,CAAA,CAAE,aAAa,MAAM,CAAA;AAC3D,IAAA,IAAI,CAAC,KAAA,EAAO;AACV,MAAA,MAAM,IAAI,qBAAA;AAAA,QACR,wDAAwD,MAAM,CAAA,CAAA;AAAA,OAChE;AAAA,IACF;AACA,IAAA,OAAO,EAAE,MAAA,EAAQ,SAAA,EAAW,QAAA,EAAU,MAAA,EAAQ,IAAA,EAAM,EAAE,GAAA,EAAK,QAAA,EAAU,GAAA,EAAK,KAAA,CAAM,GAAA,EAAI,EAAE;AAAA,EACxF;AACA,EAAA,MAAM,IAAI,qBAAA,CAAsB,CAAA,2BAAA,EAA8B,MAAM,CAAA,CAAA,CAAG,CAAA;AACzE;AAQA,SAAS,gBAAA,CACP,MACA,CAAA,EACQ;AACR,EAAA,IAAI,IAAA,CAAK,QAAQ,KAAA,EAAO;AACtB,IAAA,MAAMA,SAAQ,CAAA,CAAE,GAAA,CAAI,IAAA,CAAK,GAAG,GAAG,IAAA,EAAK;AACpC,IAAA,IAAI,CAACA,MAAAA,EAAO;AACV,MAAA,MAAM,IAAI,qBAAA,CAAsB,CAAA,GAAA,EAAM,IAAA,CAAK,GAAG,CAAA,6BAAA,CAA+B,CAAA;AAAA,IAC/E;AACA,IAAA,OAAOA,MAAAA;AAAA,EACT;AACA,EAAA,IAAI,GAAA;AACJ,EAAA,IAAI;AACF,IAAA,GAAA,GAAM,EAAE,QAAA,CAAS,UAAA,CAAW,CAAA,CAAE,OAAA,EAAS,WAAW,CAAC,CAAA;AAAA,EACrD,SAAS,GAAA,EAAK;AACZ,IAAA,MAAM,IAAI,qBAAA,CAAsB,CAAA,YAAA,EAAe,WAAW,CAAA,WAAA,EAAc,IAAA,CAAK,GAAG,CAAA,EAAA,EAAK,OAAA,CAAQ,GAAG,CAAC,CAAA,CAAE,CAAA;AAAA,EACrG;AACA,EAAA,MAAM,KAAA,GAAQ,gBAAA,CAAiB,GAAA,EAAK,IAAA,CAAK,GAAG,CAAA;AAC5C,EAAA,IAAI,CAAC,KAAA,EAAO;AACV,IAAA,MAAM,IAAI,qBAAA,CAAsB,CAAA,GAAA,EAAM,KAAK,GAAG,CAAA,UAAA,EAAa,WAAW,CAAA,UAAA,CAAY,CAAA;AAAA,EACpF;AACA,EAAA,OAAO,KAAA;AACT;AAIA,SAAS,eAAA,CAAgB,QAAgB,QAAA,EAA0B;AACjE,EAAA,OAAO,CAAA,EAAG,MAAM,CAAA,CAAA,EAAI,QAAQ,CAAA,CAAA;AAC9B;AA2BA,eAAsB,0BAAA,CACpB,IAAA,EACA,aAAA,EACA,MAAA,GAAkC,EAAC,EACN;AAC7B,EAAA,MAAM,IAAA,GAAO,oBAAA,CAAqB,IAAA,CAAK,MAAA,EAAQ,KAAK,QAAQ,CAAA;AAG5D,EAAA,MAAM,OAAA,GAAU,mBAAA,CAAoB,MAAM,CAAA,CAAE,IAAA;AAAA,IAC1C,CAAC,MAAM,CAAA,CAAE,MAAA,KAAW,KAAK,MAAA,IAAU,CAAA,CAAE,aAAa,IAAA,CAAK;AAAA,GACzD;AACA,EAAA,IAAI,CAAC,OAAA,EAAS;AACZ,IAAA,MAAM,IAAI,qBAAA;AAAA,MACR,CAAA,4BAAA,EAA0B,IAAA,CAAK,MAAM,CAAA,gBAAA,EAAmB,KAAK,QAAQ,CAAA,eAAA;AAAA,KACvE;AAAA,EACF;AAEA,EAAA,MAAM,EAAA,GAAK,KAAK,EAAA,EAAI,IAAA,MAAU,eAAA,CAAgB,IAAA,CAAK,MAAA,EAAQ,IAAA,CAAK,QAAQ,CAAA;AACxE,EAAA,MAAM,KAAA,GAAQ,IAAA,CAAK,KAAA,EAAO,IAAA,EAAK;AAC/B,EAAA,MAAM,IAAA,GAA+B;AAAA,IACnC,EAAA;AAAA,IACA,UAAU,IAAA,CAAK,QAAA;AAAA,IACf,QAAQ,IAAA,CAAK,MAAA;AAAA,IACb,QAAQ,IAAA,CAAK,MAAA;AAAA,IACb,GAAI,KAAA,GAAQ,EAAE,KAAA,KAAU;AAAC,GAC3B;AAEA,EAAA,IAAI,IAAA,CAAK,WAAW,cAAA,EAAgB;AAClC,IAAA,OAAO,iBAAA,CAAkB,EAAE,GAAG,IAAA,EAAM,QAAQ,IAAA,CAAK,MAAA,IAAU,aAAa,CAAA;AAAA,EAC1E;AAGA,EAAA,MAAM,aAAa,gBAAA,CAAiB,IAAA,CAAK,IAAA,EAAM,WAAA,CAAY,MAAM,CAAC,CAAA;AAClE,EAAA,OAAO,kBAAkB,EAAE,GAAG,IAAA,EAAM,UAAA,IAAc,aAAa,CAAA;AACjE;AAEA,SAAS,KAAK,KAAA,EAEZ;AACA,EAAA,OAAO;AAAA,IACL,OAAA,EAAS;AAAA,MACP;AAAA,QACE,IAAA,EAAM,MAAA;AAAA,QACN,MAAM,OAAO,KAAA,KAAU,WAAW,KAAA,GAAQ,IAAA,CAAK,UAAU,KAAK;AAAA;AAChE;AACF,GACF;AACF;AAEA,SAAS,UAAU,OAAA,EAGjB;AACA,EAAA,OAAO,EAAE,OAAA,EAAS,CAAC,EAAE,IAAA,EAAM,MAAA,EAAQ,IAAA,EAAM,OAAA,EAAS,CAAA,EAAG,OAAA,EAAS,IAAA,EAAK;AACrE;AAEO,SAAS,iCAAiC,MAAA,EAAyB;AAExE,EAAA,MAAA,CAAO,IAAA;AAAA,IACL,2BAAA;AAAA,IACA,4iBAAA;AAAA,IAQA,EAAC;AAAA,IACD,YAAY;AACV,MAAA,IAAI;AACF,QAAA,MAAM,WAAqB,EAAC;AAC5B,QAAA,MAAM,WAAA,GAAc,mBAAA,CAAoB,EAAE,IAAA,EAAM,CAAC,MAAM,QAAA,CAAS,IAAA,CAAK,CAAC,CAAA,EAAG,CAAA;AACzE,QAAA,OAAO,IAAA,CAAK;AAAA,UACV,WAAA;AAAA,UACA,GAAI,QAAA,CAAS,MAAA,GAAS,EAAE,QAAA,KAAa;AAAC,SACvC,CAAA;AAAA,MACH,SAAS,GAAA,EAAK;AACZ,QAAA,OAAO,SAAA,CAAU,CAAA,kCAAA,EAAqC,OAAA,CAAQ,GAAG,CAAC,CAAA,CAAE,CAAA;AAAA,MACtE;AAAA,IACF;AAAA,GACF;AACF","file":"credential-discovery.mjs","sourcesContent":["/**\n * Read-only DISCOVERY SCANNER — `auth_discover_credentials`.\n *\n * Probes the well-known local locations where the CLIs and gateways this host\n * knows about write their credentials (Claude Code's OAuth item, Codex/Gemini\n * login files, `~/.hermes/config.yaml`, and the provider API-key env vars) and\n * reports what it FINDS — so onboarding can offer to import a credential the\n * user already has, instead of making them paste it again.\n *\n * It is a scanner, not a resolver. Two invariants make it money-safe, and the\n * suite in `__tests__/credential-discovery.test.ts` is written against both:\n *\n *  1. NEVER return (or log) a discovered secret's VALUE. Every probe answers a\n *     BOOLEAN \"is a non-empty credential present here?\" via {@link jsonFieldPresent}\n *     / a presence check — the value is never bound into a result, only a\n *     non-secret `hint` locator (\"OPENROUTER_API_KEY in ~/.hermes/config.yaml\").\n *     This mirrors `verifyLocalLoginPresent`'s discard-the-value discipline in\n *     `claude-code-oauth-source.ts`, taken one step further: we never hold the\n *     plaintext at all.\n *\n *  2. NEVER throw on a malformed/unreadable source. A single corrupt file must\n *     not sink the whole scan — each probe is wrapped so a parse error / bad\n *     permission becomes a per-source `warn`+skip (same \"malformed → empty, not\n *     fatal\" spirit as `loadProviders`). A MISSING file is normal \"not found\",\n *     not even a warning.\n *\n * The source recipes (Keychain service name, file paths, jsonPaths) mirror the\n * builtin provision recipes in\n * `@agentproto/secrets/provision/recipe` (`claudeCodeOauthRecipe`,\n * `codexRecipe`, `geminiRecipe`) so discovery and provisioning agree on where a\n * credential lives.\n *\n * PHASE 1 (this file) is pure discovery: it reports EVERYTHING it finds, with\n * provenance. Cross-referencing against already-imported profiles (the\n * \"found-but-not-*imported*\" filter, keyed on a future AuthProfile `origin`\n * field) is Phase 2 and is deliberately not done here.\n */\n\nimport { execFileSync } from \"node:child_process\"\nimport { readFileSync } from \"node:fs\"\nimport { homedir } from \"node:os\"\nimport type { McpServer } from \"@modelcontextprotocol/sdk/server/mcp.js\"\nimport {\n  createAuthProfile,\n  type CreateAuthProfileInput,\n  type CreatedAuthProfile,\n  type ProfileProvisionDeps,\n} from \"@agentproto/auth\"\n\n/** Where a discovered credential came from. Stable, non-secret provenance. */\nexport type CredentialOrigin =\n  | \"claude-code\"\n  | \"hermes-config\"\n  | \"env\"\n  | \"codex\"\n  | \"gemini\"\n\n/** One found-but-not-imported credential. Carries provenance and a non-secret\n *  locator only — NEVER the credential value. */\nexport interface DiscoveredCredential {\n  /** Billing endpoint / vendor the credential is for (anthropic, openai, …). */\n  endpoint: string\n  /** Auth method the credential installs as. */\n  method: \"oauth-bearer\" | \"api-key\"\n  /** Where it was found. */\n  origin: CredentialOrigin\n  /** Non-secret human locator — e.g. \"OPENROUTER_API_KEY in ~/.hermes/config.yaml\".\n   *  Says WHERE the secret is, never WHAT it is. */\n  hint: string\n}\n\n/**\n * Injectable I/O so the scanner is unit-testable without touching the real\n * home dir / Keychain. Defaults reach for the real host.\n */\nexport interface CredentialDiscoveryDeps {\n  /** Home directory (`~` expands to this). Default: `os.homedir()`. */\n  homeDir?: string\n  /** Process env to probe. Default: `process.env`. */\n  env?: Record<string, string | undefined>\n  /** Read a file's text. MUST throw a Node-style error with `.code === \"ENOENT\"`\n   *  for a missing file (the default `readFileSync` does). Default: real fs. */\n  readFile?: (path: string) => string\n  /** Look up a macOS Keychain generic-password by service, returning its raw\n   *  value; MUST throw when the item is absent. Default: `security find-generic-password`\n   *  on darwin, always-throws elsewhere. */\n  keychainLookup?: (service: string) => string\n  /** Platform gate for the Keychain probe. Default: `process.platform`. */\n  platform?: NodeJS.Platform\n  /** Non-secret warning sink for a malformed/unreadable source. Default: no-op. */\n  warn?: (message: string) => void\n}\n\ninterface ResolvedDeps {\n  homeDir: string\n  env: Record<string, string | undefined>\n  readFile: (path: string) => string\n  keychainLookup: (service: string) => string\n  platform: NodeJS.Platform\n  warn: (message: string) => void\n}\n\n/** A Node fs error for a file that does not exist — a normal \"not found\", not a\n *  malformed-source warning. */\nfunction isMissingFile(err: unknown): boolean {\n  return (\n    typeof err === \"object\" &&\n    err !== null &&\n    \"code\" in err &&\n    (err as { code?: unknown }).code === \"ENOENT\"\n  )\n}\n\nfunction expandHome(homeDir: string, p: string): string {\n  if (p === \"~\") return homeDir\n  if (p.startsWith(\"~/\")) return homeDir.replace(/\\/$/, \"\") + \"/\" + p.slice(2)\n  return p\n}\n\n/**\n * Is there a non-empty STRING at `path` in this JSON text? Returns a boolean —\n * it deliberately NEVER returns the value, so a discovered secret can't leak\n * through it. Throws only if the text isn't parseable JSON (a malformed\n * source), which the caller turns into a warn+skip.\n */\nexport function jsonFieldPresent(raw: string, path: string): boolean {\n  let cur: unknown = JSON.parse(raw)\n  for (const part of path.split(\".\")) {\n    if (cur == null || typeof cur !== \"object\") return false\n    cur = (cur as Record<string, unknown>)[part]\n  }\n  return typeof cur === \"string\" && cur.length > 0\n}\n\n/**\n * Extract a `KEY: <value>` value from `~/.hermes/config.yaml` text — a minimal,\n * dependency-free reader (no YAML parser pulled in): the first top-levelish\n * `key:` line, quotes stripped. Returns `undefined` when the key is absent or\n * its value is blank/empty-quotes.\n *\n * Used TWO ways: the discovery scanner only asks {@link yamlKeyPresent}\n * (boolean, never the value); the import path calls this directly to COPY the\n * value into the keychain. The value it returns is a SECRET — callers must\n * pass it straight to the credential store and never echo it.\n */\nexport function readYamlKeyValue(raw: string, key: string): string | undefined {\n  const escaped = key.replace(/[.*+?^${}()|[\\]\\\\]/g, \"\\\\$&\")\n  const re = new RegExp(`^\\\\s*${escaped}\\\\s*:\\\\s*(.*)$`, \"m\")\n  const m = re.exec(raw)\n  if (!m) return undefined\n  // Strip surrounding quotes; an empty remainder = no value.\n  let value = (m[1] ?? \"\").trim()\n  if (\n    (value.startsWith('\"') && value.endsWith('\"')) ||\n    (value.startsWith(\"'\") && value.endsWith(\"'\"))\n  ) {\n    value = value.slice(1, -1)\n  }\n  return value.length > 0 ? value : undefined\n}\n\n/**\n * Does `~/.hermes/config.yaml` carry a non-empty value for `key`? Presence\n * only — returns a boolean, NEVER the value (the discovery invariant).\n */\nexport function yamlKeyPresent(raw: string, key: string): boolean {\n  return readYamlKeyValue(raw, key) !== undefined\n}\n\n/** claude-code OAuth item, and its file fallback — mirrors `claudeCodeOauthRecipe`. */\nconst CLAUDE_CODE_KEYCHAIN = \"Claude Code-credentials\"\nconst CLAUDE_CODE_JSON_PATH = \"claudeAiOauth.accessToken\"\nconst CLAUDE_CODE_FILE = \"~/.claude/.credentials.json\"\n\n/** File-based OAuth logins — mirror `codexRecipe` / `geminiRecipe`. */\nconst FILE_OAUTH_PROBES: ReadonlyArray<{\n  origin: CredentialOrigin\n  endpoint: string\n  file: string\n  jsonPath: string\n}> = [\n  { origin: \"codex\", endpoint: \"openai\", file: \"~/.codex/auth.json\", jsonPath: \"tokens.access_token\" },\n  { origin: \"gemini\", endpoint: \"google\", file: \"~/.gemini/oauth_creds.json\", jsonPath: \"access_token\" },\n]\n\n/** `~/.hermes/config.yaml` gateway keys — presence only. */\nconst HERMES_FILE = \"~/.hermes/config.yaml\"\nconst HERMES_KEYS: ReadonlyArray<{ key: string; endpoint: string }> = [\n  { key: \"OPENROUTER_API_KEY\", endpoint: \"openrouter\" },\n  { key: \"OPENAI_API_KEY\", endpoint: \"openai\" },\n]\n\n/** Provider API-key env vars — presence only. */\nconst ENV_KEYS: ReadonlyArray<{ env: string; endpoint: string }> = [\n  { env: \"OPENROUTER_API_KEY\", endpoint: \"openrouter\" },\n  { env: \"MOONSHOT_API_KEY\", endpoint: \"moonshot\" },\n  { env: \"OPENAI_API_KEY\", endpoint: \"openai\" },\n  { env: \"ANTHROPIC_API_KEY\", endpoint: \"anthropic\" },\n  { env: \"DEEPSEEK_API_KEY\", endpoint: \"deepseek\" },\n  { env: \"XAI_API_KEY\", endpoint: \"xai\" },\n]\n\nfunction defaultKeychainLookup(service: string): string {\n  return execFileSync(\"security\", [\"find-generic-password\", \"-w\", \"-s\", service], {\n    encoding: \"utf8\",\n  }).trim()\n}\n\nfunction defaultReadFile(path: string): string {\n  return readFileSync(path, \"utf8\")\n}\n\nfunction resolveDeps(deps: CredentialDiscoveryDeps): ResolvedDeps {\n  const platform = deps.platform ?? process.platform\n  return {\n    homeDir: deps.homeDir ?? homedir(),\n    env: deps.env ?? process.env,\n    readFile: deps.readFile ?? defaultReadFile,\n    keychainLookup:\n      deps.keychainLookup ??\n      (platform === \"darwin\"\n        ? defaultKeychainLookup\n        : () => {\n            throw new Error(\"keychain is macOS-only\")\n          }),\n    platform,\n    warn: deps.warn ?? (() => {}),\n  }\n}\n\n/**\n * Scan the known local credential locations and report what's present, with\n * provenance and a non-secret locator. Read-only, and safe against a corrupt\n * or unreadable source (per-source warn+skip). NEVER returns a secret value.\n */\nexport function discoverCredentials(\n  deps: CredentialDiscoveryDeps = {},\n): DiscoveredCredential[] {\n  const d = resolveDeps(deps)\n  const found: DiscoveredCredential[] = []\n\n  probeClaudeCode(d, found)\n  for (const probe of FILE_OAUTH_PROBES) probeFileOauth(d, probe, found)\n  probeHermes(d, found)\n  probeEnv(d, found)\n\n  return found\n}\n\nfunction probeClaudeCode(d: ResolvedDeps, out: DiscoveredCredential[]): void {\n  // Keychain first (macOS), then the file fallback — first hit wins, reported\n  // once. Mirrors the recipe's ordered source chain.\n  if (d.platform === \"darwin\") {\n    try {\n      const raw = d.keychainLookup(CLAUDE_CODE_KEYCHAIN)\n      if (raw && jsonFieldPresent(raw, CLAUDE_CODE_JSON_PATH)) {\n        out.push({\n          endpoint: \"anthropic\",\n          method: \"oauth-bearer\",\n          origin: \"claude-code\",\n          hint: `Claude Code OAuth token in macOS Keychain (\"${CLAUDE_CODE_KEYCHAIN}\")`,\n        })\n        return\n      }\n    } catch (err) {\n      // A missing Keychain item throws too — that's a normal \"not logged in\",\n      // not a malformed source, so don't warn on it. Fall through to the file.\n      void err\n    }\n  }\n  try {\n    const raw = d.readFile(expandHome(d.homeDir, CLAUDE_CODE_FILE))\n    if (jsonFieldPresent(raw, CLAUDE_CODE_JSON_PATH)) {\n      out.push({\n        endpoint: \"anthropic\",\n        method: \"oauth-bearer\",\n        origin: \"claude-code\",\n        hint: `Claude Code OAuth token in ${CLAUDE_CODE_FILE}`,\n      })\n    }\n  } catch (err) {\n    if (!isMissingFile(err)) {\n      d.warn(`skipping ${CLAUDE_CODE_FILE}: ${errText(err)}`)\n    }\n  }\n}\n\nfunction probeFileOauth(\n  d: ResolvedDeps,\n  probe: { origin: CredentialOrigin; endpoint: string; file: string; jsonPath: string },\n  out: DiscoveredCredential[],\n): void {\n  try {\n    const raw = d.readFile(expandHome(d.homeDir, probe.file))\n    if (jsonFieldPresent(raw, probe.jsonPath)) {\n      out.push({\n        endpoint: probe.endpoint,\n        method: \"oauth-bearer\",\n        origin: probe.origin,\n        hint: `${probe.origin} OAuth token in ${probe.file}`,\n      })\n    }\n  } catch (err) {\n    if (!isMissingFile(err)) {\n      d.warn(`skipping ${probe.file}: ${errText(err)}`)\n    }\n  }\n}\n\nfunction probeHermes(d: ResolvedDeps, out: DiscoveredCredential[]): void {\n  let raw: string\n  try {\n    raw = d.readFile(expandHome(d.homeDir, HERMES_FILE))\n  } catch (err) {\n    if (!isMissingFile(err)) d.warn(`skipping ${HERMES_FILE}: ${errText(err)}`)\n    return\n  }\n  for (const { key, endpoint } of HERMES_KEYS) {\n    try {\n      if (yamlKeyPresent(raw, key)) {\n        out.push({\n          endpoint,\n          method: \"api-key\",\n          origin: \"hermes-config\",\n          hint: `${key} in ${HERMES_FILE}`,\n        })\n      }\n    } catch (err) {\n      d.warn(`skipping ${key} in ${HERMES_FILE}: ${errText(err)}`)\n    }\n  }\n}\n\nfunction probeEnv(d: ResolvedDeps, out: DiscoveredCredential[]): void {\n  for (const { env, endpoint } of ENV_KEYS) {\n    const value = d.env[env]\n    if (value && value.trim().length > 0) {\n      out.push({\n        endpoint,\n        method: \"api-key\",\n        origin: \"env\",\n        hint: `${env} in the environment`,\n      })\n    }\n  }\n}\n\nfunction errText(err: unknown): string {\n  return err instanceof Error ? err.message : String(err)\n}\n\n// ─────────────────────────────────────────────────────────────────────────\n// IMPORT — materialize a discovered credential into a named auth profile.\n//\n// Discovery only LOCATES a credential; import COPIES it into agentproto's own\n// storage (or wires a self-refreshing source). The two invariants that keep it\n// money-safe:\n//\n//  - The method is bound by ORIGIN, never by caller input, so a subscription\n//    bearer can never be materialized as an api-key (and vice-versa) — \"never\n//    mix a bearer into an api-key env\". `createAuthProfile` also enforces the\n//    method/source/credential exclusivity a second time.\n//  - The COPY path reads the plaintext at the daemon ONLY to hand it straight\n//    to `createAuthProfile`, which stores it and returns a fingerprint. The\n//    secret is never placed in a return value or a log — fail loud (throw)\n//    rather than proceed on anything ambiguous.\n// ─────────────────────────────────────────────────────────────────────────\n\n/** Raised when an import can't proceed (unknown origin/endpoint, or nothing to\n *  import). Distinct type so the MCP surface can map it to a clean error. */\nexport class CredentialImportError extends Error {\n  constructor(message: string) {\n    super(message)\n    this.name = \"CredentialImportError\"\n  }\n}\n\n/** The three source-backed origins and the spawn-valid `source` + endpoint each\n *  materializes as. `claude-code-oauth` resolves a fresh bearer at spawn;\n *  `codex`/`gemini` are EXTERNAL file-based logins the CLI reads itself — their\n *  source is verified (`verifyLocalLoginPresent`) but injects no bearer\n *  (session-spawn.ts external branch). */\nconst SOURCE_BACKED_ORIGINS: Record<string, { source: string; endpoint: string }> = {\n  \"claude-code\": { source: \"claude-code-oauth\", endpoint: \"anthropic\" },\n  codex: { source: \"codex\", endpoint: \"openai\" },\n  gemini: { source: \"gemini\", endpoint: \"google\" },\n}\n\n/** How a chosen `{ origin, endpoint }` becomes a profile. Discriminated: a\n *  `source`-backed oauth-bearer, or an api-key COPIED from a located value. */\nexport type ImportMaterialization =\n  | { method: \"oauth-bearer\"; endpoint: string; source: string }\n  | {\n      method: \"api-key\"\n      endpoint: string\n      copy: { via: \"env\" | \"hermes\"; key: string }\n    }\n\n/**\n * Decide how to materialize a profile for a discovered `{ origin, endpoint }`.\n * PURE — no I/O, no secret. Throws {@link CredentialImportError} for an unknown\n * origin, or an endpoint that origin doesn't serve. The method is fixed by\n * origin here, which is what forbids a bearer↔api-key mix.\n */\nexport function planCredentialImport(\n  origin: string,\n  endpoint: string,\n): ImportMaterialization {\n  const wanted = endpoint.trim()\n  const sourceBacked = SOURCE_BACKED_ORIGINS[origin]\n  if (sourceBacked) {\n    if (wanted && wanted !== sourceBacked.endpoint) {\n      throw new CredentialImportError(\n        `origin \"${origin}\" authenticates ${sourceBacked.endpoint}, not \"${wanted}\"`,\n      )\n    }\n    return { method: \"oauth-bearer\", endpoint: sourceBacked.endpoint, source: sourceBacked.source }\n  }\n  if (origin === \"env\") {\n    const entry = ENV_KEYS.find((e) => e.endpoint === wanted)\n    if (!entry) {\n      throw new CredentialImportError(\n        `no known env var maps to endpoint \"${wanted}\" for origin \"env\"`,\n      )\n    }\n    return { method: \"api-key\", endpoint: wanted, copy: { via: \"env\", key: entry.env } }\n  }\n  if (origin === \"hermes-config\") {\n    const entry = HERMES_KEYS.find((h) => h.endpoint === wanted)\n    if (!entry) {\n      throw new CredentialImportError(\n        `no known ~/.hermes/config.yaml key maps to endpoint \"${wanted}\"`,\n      )\n    }\n    return { method: \"api-key\", endpoint: wanted, copy: { via: \"hermes\", key: entry.key } }\n  }\n  throw new CredentialImportError(`unknown credential origin \"${origin}\"`)\n}\n\n/**\n * Resolve the plaintext for an api-key COPY. Returns a SECRET — the caller\n * hands it straight to `createAuthProfile` and never echoes it. Fails LOUD\n * ({@link CredentialImportError}) when the located value is absent/blank rather\n * than importing an empty credential.\n */\nfunction resolveCopyValue(\n  copy: { via: \"env\" | \"hermes\"; key: string },\n  d: ResolvedDeps,\n): string {\n  if (copy.via === \"env\") {\n    const value = d.env[copy.key]?.trim()\n    if (!value) {\n      throw new CredentialImportError(`no ${copy.key} in the environment to import`)\n    }\n    return value\n  }\n  let raw: string\n  try {\n    raw = d.readFile(expandHome(d.homeDir, HERMES_FILE))\n  } catch (err) {\n    throw new CredentialImportError(`cannot read ${HERMES_FILE} to import ${copy.key}: ${errText(err)}`)\n  }\n  const value = readYamlKeyValue(raw, copy.key)\n  if (!value) {\n    throw new CredentialImportError(`no ${copy.key} value in ${HERMES_FILE} to import`)\n  }\n  return value\n}\n\n/** Default profile id for an import — `<origin>-<endpoint>` (both are\n *  slug-safe already). A caller may override. */\nfunction defaultImportId(origin: string, endpoint: string): string {\n  return `${origin}-${endpoint}`\n}\n\nexport interface ImportCredentialArgs {\n  /** Discovery origin to import from. */\n  origin: string\n  /** Billing endpoint to import (must be one the origin serves). */\n  endpoint: string\n  /** Optional explicit profile id; defaults to `<origin>-<endpoint>`. */\n  id?: string\n  /** Optional human label. */\n  label?: string\n}\n\n/**\n * Import a discovered credential into a named auth profile end-to-end.\n *\n * Guards against fabricating a profile: it re-runs discovery and refuses unless\n * the requested `{ origin, endpoint }` is ACTUALLY present right now — discovery\n * having once located a value is not license to import it. Then materializes via\n * the single validated create path ({@link createAuthProfile}), stamping\n * `origin` so the UI can badge it. Returns the non-secret {@link\n * CreatedAuthProfile} (fingerprint, never the credential).\n *\n * `provisionDeps` is the profile/credential storage (a real keychain in prod, a\n * `MemoryStore` in tests); `ioDeps` is the discovery I/O (env / files /\n * keychain-read), injectable for the same reason.\n */\nexport async function importDiscoveredCredential(\n  args: ImportCredentialArgs,\n  provisionDeps: ProfileProvisionDeps,\n  ioDeps: CredentialDiscoveryDeps = {},\n): Promise<CreatedAuthProfile> {\n  const plan = planCredentialImport(args.origin, args.endpoint)\n\n  // Only import what discovery currently sees — never fabricate a profile.\n  const present = discoverCredentials(ioDeps).some(\n    (c) => c.origin === args.origin && c.endpoint === plan.endpoint,\n  )\n  if (!present) {\n    throw new CredentialImportError(\n      `nothing to import — no ${args.origin} credential for ${plan.endpoint} was discovered`,\n    )\n  }\n\n  const id = args.id?.trim() || defaultImportId(args.origin, plan.endpoint)\n  const label = args.label?.trim()\n  const base: CreateAuthProfileInput = {\n    id,\n    endpoint: plan.endpoint,\n    method: plan.method,\n    origin: args.origin,\n    ...(label ? { label } : {}),\n  }\n\n  if (plan.method === \"oauth-bearer\") {\n    return createAuthProfile({ ...base, source: plan.source }, provisionDeps)\n  }\n  // api-key COPY — resolve the plaintext at the daemon, hand it straight to the\n  // store, never return it.\n  const credential = resolveCopyValue(plan.copy, resolveDeps(ioDeps))\n  return createAuthProfile({ ...base, credential }, provisionDeps)\n}\n\nfunction text(value: string | object): {\n  content: Array<{ type: \"text\"; text: string }>\n} {\n  return {\n    content: [\n      {\n        type: \"text\",\n        text: typeof value === \"string\" ? value : JSON.stringify(value),\n      },\n    ],\n  }\n}\n\nfunction errorText(message: string): {\n  content: Array<{ type: \"text\"; text: string }>\n  isError: true\n} {\n  return { content: [{ type: \"text\", text: message }], isError: true }\n}\n\nexport function registerCredentialDiscoveryTools(server: McpServer): void {\n  // ── auth_discover_credentials ─────────────────────────────────\n  server.tool(\n    \"auth_discover_credentials\",\n    \"Read-only scan of the known local credential locations (Claude Code's \" +\n      \"Keychain/OAuth file, Codex/Gemini login files, `~/.hermes/config.yaml`, \" +\n      \"and the provider API-key env vars). Reports which credentials are \" +\n      \"PRESENT and where they came from, so onboarding can offer to import one \" +\n      \"you already have. Returns only non-secret provenance — `{ endpoint, \" +\n      \"method, origin, hint }` — and NEVER the credential value; the `hint` is \" +\n      \"a locator, not the secret. A malformed or unreadable source is skipped, \" +\n      \"never fatal; a missing file is a normal 'not found'.\",\n    {},\n    async () => {\n      try {\n        const warnings: string[] = []\n        const credentials = discoverCredentials({ warn: (m) => warnings.push(m) })\n        return text({\n          credentials,\n          ...(warnings.length ? { warnings } : {}),\n        })\n      } catch (err) {\n        return errorText(`auth_discover_credentials failed: ${errText(err)}`)\n      }\n    },\n  )\n}\n"]}