@akanjs/devkit 3.1.1-rc.9 → 3.1.2-rc.0

package/codeAgent/skills/akan-scaffold/SKILL.md

@@ -43,8 +43,8 @@ Each result names the next call in `next.tool`. Follow it; do not improvise.
    and each workflow's inputs.)
 2. `apply_workflow({ planPath })` — writes the scaffold and syncs the generated barrels. Returns
    `validationTarget`.
-3. `run_validation({ runIdOrPlan: <validationTarget> })`, or just call `akan_verify`, which runs the whole
-   chain over everything the working tree changed.
+3. `run_validation({ runIdOrPlan: <validationTarget> })`, or run `akan verify` (`akan_verify` in akan code);
+   both are the whole chain in one process.
 4. **Read each scaffolded file before editing it.** They are a few lines each and they extend base classes
    that already generated the CRUD surface. Read the `akan-store` skill before touching a store or adding
    signal endpoints, or you will redeclare `create<Model>` and hit an "already exists" typecheck error.
@@ -60,9 +60,19 @@ Each result names the next call in `next.tool`. Follow it; do not improvise.
 - Hand-writing files is the fallback, used only when no workflow matches, or when apply reports
   unsupported / no-op / failed diagnostics telling you to act manually. Say which case applied.
 - Never hand-edit a generated file to "finish" a scaffold — use `repair_generated` or `akan sync <app>`.
-- No workflow tools this turn? The same order through bash:
-  `akan workflow list` → `akan workflow plan create-module --app <app> --module comment --format json --out <path>`
-  → `akan workflow apply <path> --format json`.
+
+## No workflow tools? The CLI is the same chain
+
+The tools come from `akan mcp` (`--mode plan` reads, `--mode apply` writes). When they are not connected, each
+has a command that prints the same report:
+
+| tool | command |
+| --- | --- |
+| `list_workflows` / `explain_workflow` | `akan workflow list` / `akan workflow explain <name>` |
+| `plan_workflow` | `akan workflow plan create-module --app <app> --module comment --format json --out <path>` |
+| `apply_workflow` | `akan workflow apply <path> --format json` (`--dry-run` previews) |
+| `run_validation` | `akan verify <app>` |
+| `repair_generated` / `repair_imports` / `repair_module_shape` | `akan repair generated\|imports\|module-shape --app <app>` |
 
 ## Worked example — "an intro page, two detail pages, and a comment zone with a database"
 
@@ -73,4 +83,4 @@ Each result names the next call in `next.tool`. Follow it; do not improvise.
    leave the store body empty unless you need extra state.
 4. Write the pages and the comment UI against the generated actions — `st.do.createComment`,
    `st.do.initCommentInPublic`, `st.use.commentListInPublic`.
-5. `akan_verify` until clean.
+5. `akan verify` until it prints `verify ok`.

package/codeAgent/skills/akan-transport/SKILL.md

@@ -0,0 +1,40 @@
+---
+name: akan-transport
+description: "Guard and tune endpoints on the wire: writing a Can<Verb><Model> guard, deadlines, cache, idempotency, rate limits, server-to-server calls, body types, bytes and HTTP verbs."
+---
+
+# Akan transport
+
+## Guards
+
+- Every custom `query` / `mutation` / `pubsub` / `message` names its own `guards: [...]`; every `slice()` takes an
+  explicit guard map with `root: Admin`. `Public` belongs on a slice `get:`, and on a mutation only for an act that
+  must work signed out (sign-up, sign-in, token refresh, an OAuth route), which also declares a `rateLimit`.
+- A resource guard is a `Can<Verb><Model>` class in the model library's `srvkit/guards.ts` that fails closed:
+  no resource named, or a load that throws, is `false` (after a `logger.warn`). Admin bypass goes first.
+- Every guard declares `static scope`: `"account"` reads only the caller (`SignedIn`, `Admin`, roles), and
+  `"resource"` needs the call's arguments (every `Can<Verb><Model>`). Keep `static name = "User";` with a comment.
+- Guards read `context.get<T>("account")`, serve HTTP and websocket alike, and stay side-effect free. The acting
+  user comes from `.with(Self)` / `.with(CurrentUserId)` / `.with(Me)`, the address from `.with(Ip)` — never a
+  client-supplied id. The service re-checks ownership: two independent gates.
+
+## Endpoint options
+
+- `{ timeout: <ms> }` is the deadline on both ends; undeclared, the client quits at 30 s and the handler is not
+  cancelled.
+- `{ cache }` only on a `query` with no internal argument, capped at one day; `invalidate(endpoint, args?)` drops
+  it early through a plugged `EndpointCacheControl`.
+- `{ rateLimit: { calls, windowMs?, by? } }` per endpoint, `option.setRateLimit` per app, `plug(RateLimit)` for a
+  business key.
+- A mutation repeated under one `Idempotency-Key` header runs once and replays its first answer.
+- `{ method: "PATCH" | "PUT" | "DELETE" }` moves a mutation off `POST` — only when a foreign protocol forces it.
+- `errors: { 409: ["ticket.error.locked"] }` names the errors an endpoint throws on purpose.
+
+## Bodies and other servers
+
+- `.body()` / `.param()` take scalars, model refs or `enumOf(...)`; `Int` / `Float`, never `Number`; bytes are
+  `Binary`, never `Any`; `Upload` only in a `fileUpload: true` mutation.
+- Server to server, `fetch.clone({ origin })` opens no socket without `connect: true`, retries through `retry`,
+  and rethrows a remote `Err` as it is — never wrap or re-key it.
+
+Full detail: `get_guideline` with `transportRule`, or `mcpRule` for what a guard's scope does to an MCP listing.

package/codeAgent/skills/akan-validate/SKILL.md

@@ -7,17 +7,19 @@ description: "Run the akan check loop after editing and fix each failure class t
 
 ## One call does the whole chain
 
-`akan_verify` runs sync → lint → typecheck → `quality ssr` over everything the working tree has changed, in
-the right order, and reports only what failed. **Call it after editing, before you say you are done.** It
-also runs itself at the end of a turn that changed source, so a failure comes back to you either way.
-
-The same chain by hand, for the app you are editing:
-
-- `akan sync <app>` — after adding, renaming, or deleting any file. Regenerates the barrels.
-- `akan lint <app>` — fast; run after every edit. Prints up to 200 diagnostics.
-- `akan typecheck <app>` — the client/server boundary violations land here, not in lint.
-- `akan quality ssr` — only when you wrote or changed a `.tsx`. Did the server share hold?
-- `akan build <app>` — the full production build; slower, and only when the build itself is in question.
+`akan verify` (the `akan_verify` tool in akan code) syncs, lints with fixes, typechecks, fast-builds each
+changed app, and runs the SSR check for a `.tsx` change — over everything the working tree has changed, in one
+process. It prints one line when it passes and one line per problem when it fails. **Run it after editing,
+before you say you are done.** In akan code it also runs itself at the end of a turn that changed source.
+
+Never run `akan lint`, `akan typecheck` and `akan build` in turn: that is the same work three times over, at
+three times the output. Narrow the one command instead:
+
+- `akan verify <app-or-lib-or-pkg>` — that target whole, changed or not.
+- `akan verify --lint-only` — the quick pass between edits.
+- `akan verify --no-build` — leave the app build out.
+- `akan verify --max 0` — every line, when the report ends in `+N more`.
+- `fixed N files` in the header means lint rewrote them on disk: re-read before editing them again.
 
 Raw `tsc` misses the generated barrels and reports false errors. Do not reach for it.
 

package/codeAgent/tools/AkanCli.ts

@@ -24,7 +24,8 @@ export class AkanCli {
       cwd: this.#cwd,
       stdout: "pipe",
       stderr: "pipe",
-      env: { ...process.env, FORCE_COLOR: "0", NO_COLOR: "1" },
+      //? A workspace .env's AKAN_PUBLIC_LOG_LEVEL=verbose reaches the child too, and buried its error under 90 lines.
+      env: { ...process.env, FORCE_COLOR: "0", NO_COLOR: "1", AKAN_LOG_STDOUT_LEVEL: "warn" },
     });
     const timer = setTimeout(() => proc.kill(), timeoutMs);
     const [stdout, stderr, exitCode] = await Promise.all([

package/codeAgent/tools/AkanCodePlugins.ts

@@ -1,11 +1,12 @@
 import type { InlineExtension } from "@earendil-works/pi-coding-agent";
 import type { CodeAgentMcpStatus, CodeAgentProfile, CodeAgentQuestion, CodeAgentSubagent } from "akanjs/common";
 import type { Workspace } from "../../commandDecorators";
+import { PreviewView } from "../../preview/PreviewView";
+import type { CodeAgentModelRef } from "../agent/akanCodeModel";
 import type { CodeMailbox } from "../agent/CodeMailbox";
 import { SubagentPool, type SubagentSpend } from "../agent/SubagentPool";
 import { DevLogFeedback } from "../feedback/DevLogFeedback";
 import { PreviewFeedback } from "../feedback/PreviewFeedback";
-import { PreviewView } from "../feedback/PreviewView";
 import { TurnFeedback, type TurnFeedbackSource } from "../feedback/TurnFeedback";
 import { VerifyFeedback } from "../feedback/VerifyFeedback";
 import { AkanToolPack } from "./AkanToolPack";
@@ -23,6 +24,8 @@ export interface AkanCodePluginsOptions {
   /** Apps whose dev server should be watched, and whose page should be probed. */
   apps: string[];
   canSeeImages: boolean;
+  /** The owning agent's model as it is now; a `task` child runs on it. */
+  model?: () => CodeAgentModelRef | undefined;
   deepseek?: DeepSeekWeb | undefined;
   /** How many `task` levels deep the owning agent is. */
   depth: number;
@@ -92,6 +95,7 @@ export class AkanCodePlugins {
       workspace: options.workspace,
       cwd: options.cwd,
       parent: options.profile,
+      ...(options.model ? { model: options.model } : {}),
       depth: options.depth,
       ...(options.subagentSpend ? { spend: options.subagentSpend } : {}),
       ...(options.onNotice ? { onNotice: options.onNotice } : {}),

package/codeAgent/tools/AkanEditScope.ts

@@ -2,12 +2,13 @@ export interface AkanEditScopeResult {
   paths: string[];
   apps: string[];
   libs: string[];
+  pkgs: string[];
   /** A created, deleted or renamed file under `apps/**` or `libs/**` — the only kind a barrel has to catch up with. */
   needsSync: boolean;
   touchesTsx: boolean;
 }
 
-const empty: AkanEditScopeResult = { paths: [], apps: [], libs: [], needsSync: false, touchesTsx: false };
+const empty: AkanEditScopeResult = { paths: [], apps: [], libs: [], pkgs: [], needsSync: false, touchesTsx: false };
 
 // Read from git, not tool events: an edit made through `bash` (a heredoc, sed, a codemod) produces no write tool call.
 export class AkanEditScope {
@@ -21,6 +22,7 @@ export class AkanEditScope {
       paths,
       apps: AkanEditScope.#targets(paths, "apps"),
       libs: AkanEditScope.#targets(paths, "libs"),
+      pkgs: AkanEditScope.#targets(paths, "pkgs"),
       needsSync: entries.some((entry) => /[ARD?]/.test(entry.code) && /^(apps|libs)\//.test(entry.file)),
       touchesTsx: paths.some((file) => file.endsWith(".tsx")),
     };
@@ -38,10 +40,13 @@ export class AkanEditScope {
     return new Set(text.split("\n").filter((line) => line.trim().length > 3));
   }
 
-  static #targets(paths: string[], root: "apps" | "libs") {
+  static #targets(paths: string[], root: "apps" | "libs" | "pkgs") {
     const names = paths
       .filter((file) => file.startsWith(`${root}/`))
-      .map((file) => file.split("/")[1] ?? "")
+      .map((file) => {
+        const [, first = "", second = ""] = file.split("/");
+        return first.startsWith("@") && second ? `${first}/${second}` : first;
+      })
       .filter(Boolean);
     return [...new Set(names)];
   }

package/codeAgent/tools/AkanToolPack.ts

@@ -1,7 +1,6 @@
 import type { ExtensionAPI, InlineExtension } from "@earendil-works/pi-coding-agent";
 import { Type } from "typebox";
 import type { Workspace } from "../../commandDecorators";
-import { AkanEditScope } from "./AkanEditScope";
 import { AkanVerifier } from "./AkanVerifier";
 
 export interface AkanToolPackOptions {
@@ -66,17 +65,12 @@ export class AkanToolPack {
       name: AkanToolPack.verifyToolName,
       label: "akan verify",
       description:
-        "Run the akan validation chain (sync, lint, typecheck, and quality ssr for .tsx changes) over everything the working tree has changed, and report what failed. Call this after editing before you finish.",
-      promptSnippet: "akan_verify: run sync/lint/typecheck/quality over the working tree's changes",
+        "Run `akan verify` over everything the working tree has changed: sync, lint (with fixes), typecheck, a fast build of each changed app, and the SSR check for .tsx changes, in one call. It prints one line when it passes and one line per problem when it fails. Call this after editing, before you finish; never run lint, typecheck or build separately.",
+      promptSnippet: "akan_verify: sync, lint, typecheck and build what the working tree changed, in one call",
       parameters: Type.Object({}),
       execute: async () => {
-        const scope = await AkanEditScope.since(this.#options.cwd, new Set());
-        const report = await verifier.verify(scope);
-        return {
-          content: [{ type: "text", text: AkanVerifier.summarize(report) }],
-          details: undefined,
-          isError: !report.ok,
-        };
+        const report = await verifier.verify();
+        return { content: [{ type: "text", text: report.text }], details: undefined, isError: !report.ok };
       },
     });
   }

package/codeAgent/tools/AkanVerifier.ts

@@ -1,48 +1,30 @@
 import { AkanCli, type AkanCliResult } from "./AkanCli";
-import type { AkanEditScopeResult } from "./AkanEditScope";
 
 export interface AkanVerifyReport {
   ok: boolean;
-  steps: AkanCliResult[];
-  scope: AkanEditScopeResult;
+  text: string;
 }
 
 export class AkanVerifier {
+  static readonly tailLines = 20;
   readonly #cli: AkanCli;
 
   constructor(cwd: string) {
     this.#cli = new AkanCli(cwd);
   }
 
-  async verify(scope: AkanEditScopeResult): Promise<AkanVerifyReport> {
-    const steps: AkanCliResult[] = [];
-    const targets = [...scope.apps, ...scope.libs];
-    // Order matters: a stale barrel reads to typecheck as a missing symbol, and lint moves the positions it reports.
-    if (scope.needsSync) for (const target of targets) steps.push(await this.#cli.run(["sync", target]));
-    for (const target of targets) steps.push(await this.#cli.run(["lint", target]));
-    for (const app of scope.apps) steps.push(await this.#cli.run(["typecheck", app]));
-    if (scope.touchesTsx) steps.push(await this.#cli.run(["quality", "ssr"]));
-    return { ok: steps.every((step) => step.ok), steps, scope };
+  async verify(paths: string[] = []): Promise<AkanVerifyReport> {
+    const args = ["verify", ...(paths.length ? ["--files", paths.join(",")] : [])];
+    const result = await this.#cli.run(args, { timeoutMs: 600_000 });
+    return { ok: result.ok, text: AkanVerifier.summarize(result) };
   }
 
-  /** What a model needs to act: which step failed and its tail — never the whole output, which rides every later turn. */
-  static summarize(report: AkanVerifyReport, { tailLines = 40 }: { tailLines?: number } = {}) {
-    if (!report.steps.length) return "No akan target was touched, so there was nothing to verify.";
-    if (report.ok) return `Verification passed: ${report.steps.map((step) => step.command).join(", ")}.`;
-    const failed = report.steps.filter((step) => !step.ok);
-    const passed = report.steps.filter((step) => step.ok).map((step) => step.command);
-    const blocks = failed.map((step) => `### ${step.command} (exit ${step.exitCode})\n${tail(step.output, tailLines)}`);
-    return [
-      `Verification failed: ${failed.map((step) => step.command).join(", ")}.`,
-      passed.length ? `Passed: ${passed.join(", ")}.` : "",
-      ...blocks,
-    ]
-      .filter(Boolean)
-      .join("\n\n");
+  //* `akan verify` already prints the agent-sized report; only a crash before it prints needs trimming.
+  static summarize(result: AkanCliResult) {
+    if (result.output.startsWith("verify ")) return result.output;
+    const lines = result.output.split("\n");
+    const tail =
+      lines.length <= AkanVerifier.tailLines ? result.output : `…\n${lines.slice(-AkanVerifier.tailLines).join("\n")}`;
+    return `${result.command} exited ${result.exitCode} before reporting:\n${tail}`;
   }
 }
-
-const tail = (text: string, lines: number) => {
-  const all = text.split("\n");
-  return all.length <= lines ? text : `…\n${all.slice(-lines).join("\n")}`;
-};

package/codeAgent/tools/McpServerConfig.ts

@@ -42,16 +42,18 @@ export class McpServerConfig {
     ];
   }
 
-  static read(workspaceRoot: string): CodeAgentMcpServerRef[] {
-    return McpServerConfig.declared(workspaceRoot)
+  static read(workspaceRoot: string, scopes?: McpServerScope[]): CodeAgentMcpServerRef[] {
+    return McpServerConfig.declared(workspaceRoot, scopes)
       .filter((entry) => !entry.disabled)
       .map((entry) => entry.ref);
   }
 
   /** Every declared server including the disabled ones, which is what a listing has to show. */
-  static declared(workspaceRoot: string): McpDeclaredServer[] {
+  static declared(workspaceRoot: string, scopes?: McpServerScope[]): McpDeclaredServer[] {
     const byName = new Map<string, McpDeclaredServer>();
-    for (const { scope } of McpServerConfig.files(workspaceRoot))
+    for (const { scope } of McpServerConfig.files(workspaceRoot).filter(
+      (file) => !scopes || scopes.includes(file.scope),
+    ))
       for (const [name, entry] of Object.entries(McpServerConfig.#parse(workspaceRoot, scope).map))
         byName.set(name, { ref: McpServerConfig.#refOf(name, entry), disabled: !!entry.disabled, scope });
     return [...byName.values()];

package/codeAgent/tools/McpSignIn.ts

@@ -16,7 +16,7 @@ export class McpSignIn {
 
   /** The token to connect with, or undefined when none is had without asking; a failed refresh is not a throw. */
   static async token(ref: CodeAgentMcpServerRef, onNotice?: (message: string) => void) {
-    const stored = McpTokenStore.read(ref.name);
+    const stored = McpTokenStore.read(ref);
     if (!stored) return undefined;
     if (!McpTokenStore.isExpired(stored)) return stored.accessToken;
     return await McpSignIn.#refreshOnce(ref, stored, onNotice);
@@ -24,14 +24,14 @@ export class McpSignIn {
 
   /** After a server answered `refused` with 401: a token another session stored since, else one refresh. */
   static async retryToken(ref: CodeAgentMcpServerRef, refused: string, onNotice?: (message: string) => void) {
-    const stored = McpTokenStore.read(ref.name);
+    const stored = McpTokenStore.read(ref);
     if (!stored) return undefined;
     if (stored.accessToken !== refused && !McpTokenStore.isExpired(stored)) return stored.accessToken;
     return await McpSignIn.#refreshOnce(ref, stored, onNotice);
   }
 
   static async #refreshOnce(ref: CodeAgentMcpServerRef, stored: McpStoredAuth, onNotice?: (message: string) => void) {
-    const key = `${ref.name}\n${stored.refreshToken}`;
+    const key = `${stored.issuer}\n${stored.refreshToken}`;
     let pending = McpSignIn.#refreshing.get(key);
     if (!pending) {
       pending = McpSignIn.#refreshed(ref, stored, onNotice).finally(() => McpSignIn.#refreshing.delete(key));
@@ -45,7 +45,7 @@ export class McpSignIn {
     try {
       return await ConfigLock.run(McpTokenStore.lockFile(), async () => {
         // Another `akan code` may have refreshed while this one waited: take its token, never its spent refresh token.
-        const current = McpTokenStore.read(ref.name);
+        const current = McpTokenStore.read(ref);
         if (!current) return undefined;
         if (current.accessToken !== stored.accessToken && !McpTokenStore.isExpired(current)) return current.accessToken;
         const server: McpOAuthServer = {
@@ -58,7 +58,7 @@ export class McpSignIn {
         // `expires_in` is optional (RFC 6749 §5.1): the spent token's expiry must not outlive it on the new one.
         const { expiresAt: _spent, ...grant } = current;
         // A server that rotates refresh tokens invalidates the old one, so keeping it would sign us out.
-        McpTokenStore.write(ref.name, { ...grant, ...tokens });
+        McpTokenStore.write(ref, { ...grant, ...tokens });
         return tokens.accessToken;
       });
     } catch (error) {
@@ -72,7 +72,7 @@ export class McpSignIn {
     if (!ref.url) throw new Error(`"${ref.name}" is a stdio server: give it its credential through "env".`);
     const challenge = await McpSignIn.challenge(ref);
     const server = await McpOAuth.discover(ref.url, challenge);
-    const stored = McpTokenStore.read(ref.name);
+    const stored = McpTokenStore.read(ref);
     const reusable = stored && stored.issuer === server.issuer && !ref.oauth?.clientId ? stored : undefined;
     const loopback = McpOAuthLoopback.bind(McpSignIn.#portOf(reusable?.redirectUri));
     try {
@@ -98,7 +98,7 @@ export class McpSignIn {
         redirectUri,
         ...tokens,
       };
-      McpTokenStore.write(ref.name, auth);
+      McpTokenStore.write(ref, auth);
       return auth;
     } finally {
       loopback.close();

package/codeAgent/tools/McpTokenStore.ts

@@ -20,7 +20,18 @@ export interface McpStoredAuth {
   scope?: string;
 }
 
+export interface McpTokenOwner {
+  name: string;
+  url?: string | undefined;
+}
+
+interface McpTokenEntry extends McpStoredAuth {
+  name: string;
+  origin: string;
+}
+
 // Home directory only, mode 0600: `.akan/code/mcp.json` is shared with the editors and routinely committed.
+// Keyed by the server's origin, not its name: a workspace `mcp.json` can give a known name any url.
 export class McpTokenStore {
   static file() {
     return akanCodePaths.mcpAuthFile();
@@ -30,24 +41,37 @@ export class McpTokenStore {
     return `${McpTokenStore.file()}.lock`;
   }
 
-  static read(name: string): McpStoredAuth | undefined {
-    return McpTokenStore.#all()[name];
+  static read(owner: McpTokenOwner): McpStoredAuth | undefined {
+    const origin = McpTokenStore.#originOf(owner.url);
+    if (!origin) return undefined;
+    const here = McpTokenStore.#all().filter((entry) => entry.origin === origin);
+    const entry = here.find((candidate) => candidate.name === owner.name) ?? here[0];
+    if (!entry) return undefined;
+    const { name: _name, origin: _origin, ...auth } = entry;
+    return auth;
   }
 
   static names() {
-    return Object.keys(McpTokenStore.#all());
+    return [...new Set(McpTokenStore.#all().map((entry) => entry.name))];
   }
 
   /** Re-reads right before writing, or two concurrent sign-ins each drop the other's token. */
-  static write(name: string, auth: McpStoredAuth) {
-    McpTokenStore.#save({ ...McpTokenStore.#all(), [name]: auth });
+  static write(owner: McpTokenOwner, auth: McpStoredAuth) {
+    const origin = McpTokenStore.#originOf(owner.url);
+    if (!origin) throw new Error(`"${owner.name}" has no http(s) url to bind its token to.`);
+    const kept = McpTokenStore.#all().filter(
+      (entry) => entry.origin !== origin || (entry.issuer !== auth.issuer && entry.name !== owner.name),
+    );
+    McpTokenStore.#save([...kept, { ...auth, name: owner.name, origin }]);
   }
 
-  static clear(name: string) {
+  //? Everything `read` could hand this server goes: its origin's tokens under any name, and its name's at any origin.
+  static clear(owner: McpTokenOwner) {
+    const origin = McpTokenStore.#originOf(owner.url);
     const all = McpTokenStore.#all();
-    if (!(name in all)) return false;
-    delete all[name];
-    McpTokenStore.#save(all);
+    const kept = all.filter((entry) => entry.name !== owner.name && entry.origin !== origin);
+    if (kept.length === all.length) return false;
+    McpTokenStore.#save(kept);
     return true;
   }
 
@@ -58,22 +82,45 @@ export class McpTokenStore {
   /** A token is treated as spent this long before it actually is, so a call never races its own expiry. */
   static readonly skewMs = 60_000;
 
-  static #all(): Record<string, McpStoredAuth> {
+  static #originOf(url: string | undefined) {
+    if (!url) return undefined;
+    try {
+      const parsed = new URL(url);
+      return parsed.protocol === "http:" || parsed.protocol === "https:" ? parsed.origin : undefined;
+    } catch {
+      return undefined;
+    }
+  }
+
+  static #keyOf(entry: McpTokenEntry) {
+    return `${entry.origin} ${entry.issuer}`;
+  }
+
+  static #all(): McpTokenEntry[] {
     const file = McpTokenStore.file();
-    if (!existsSync(file)) return {};
+    if (!existsSync(file)) return [];
     try {
-      const parsed = JSON.parse(readFileSync(file, "utf8")) as { servers?: Record<string, McpStoredAuth> };
-      return parsed.servers ?? {};
+      const parsed = JSON.parse(readFileSync(file, "utf8")) as {
+        tokens?: Record<string, McpTokenEntry>;
+        servers?: Record<string, McpStoredAuth>;
+      };
+      if (parsed.tokens) return Object.values(parsed.tokens);
+      // An older build keyed by name alone; its resource is the url the token was minted for, so it keeps that origin.
+      return Object.entries(parsed.servers ?? {}).flatMap(([name, auth]) => {
+        const origin = McpTokenStore.#originOf(auth.resource);
+        return origin ? [{ ...auth, name, origin }] : [];
+      });
     } catch {
-      return {};
+      return [];
     }
   }
 
-  static #save(servers: Record<string, McpStoredAuth>) {
+  static #save(entries: McpTokenEntry[]) {
     const file = McpTokenStore.file();
     mkdirSync(path.dirname(file), { recursive: true, mode: 0o700 });
+    const tokens = Object.fromEntries(entries.map((entry) => [McpTokenStore.#keyOf(entry), entry]));
     const temp = `${file}.${process.pid}.tmp`;
-    writeFileSync(temp, `${JSON.stringify({ servers }, null, 2)}\n`, { mode: 0o600 });
+    writeFileSync(temp, `${JSON.stringify({ tokens }, null, 2)}\n`, { mode: 0o600 });
     renameSync(temp, file);
     // `rename` keeps the temp file's mode, but an existing target written by an older build may be looser.
     chmodSync(file, 0o600);

package/codeAgent/tools/McpToolPack.ts

@@ -7,6 +7,7 @@ import {
   codeAgentOutputChars,
 } from "akanjs/common";
 import { Type } from "typebox";
+import { WorkspaceTrust } from "../agent/WorkspaceTrust";
 import { McpClient, type McpToolInfo, McpUnauthorized } from "./McpClient";
 import { McpServerConfig } from "./McpServerConfig";
 import { McpSignIn } from "./McpSignIn";
@@ -194,6 +195,12 @@ export class McpToolPack {
   static #refs(options: McpToolPackOptions): CodeAgentMcpServerRef[] {
     if (options.profile.tools.mcp === "off") return [];
     const declared = Array.isArray(options.profile.tools.mcp) ? options.profile.tools.mcp : [];
-    return [...McpServerConfig.read(options.workspaceRoot), ...declared];
+    if (WorkspaceTrust.isTrusted(options.workspaceRoot, "mcp"))
+      return [...McpServerConfig.read(options.workspaceRoot), ...declared];
+    const skipped = McpServerConfig.read(options.workspaceRoot, ["workspace"]).map((ref) => ref.name);
+    options.onNotice?.(
+      `Not started, because this repo's MCP servers are not approved: ${skipped.join(", ")}. Start akan code in a terminal to approve them, or pass --trust-workspace.`,
+    );
+    return [...McpServerConfig.read(options.workspaceRoot, ["global"]), ...declared];
   }
 }

package/codeAgent/tools/WebToolPack.ts

@@ -3,6 +3,7 @@ import { isIP } from "node:net";
 import type { ExtensionAPI, InlineExtension } from "@earendil-works/pi-coding-agent";
 import { type CodeAgentProfile, codeAgentClip } from "akanjs/common";
 import { Type } from "typebox";
+import { codeAgentHostListed, codeAgentHostOf, codeAgentIsLoopback } from "../agent/codeAgentHosts";
 import { DeepSeekWeb } from "./DeepSeekWeb";
 
 export interface WebToolPackOptions {
@@ -34,6 +35,7 @@ interface WebPage {
 export class WebToolPack {
   static readonly pageChars = 10_000;
   static readonly maxResults = 10;
+  static readonly maxRedirects = 5;
   static readonly #rememberedPages = 16;
   readonly #options: WebToolPackOptions;
   // A continuation reads the snapshot its first page came from; a fresh read always refetches, since a local dev
@@ -164,8 +166,10 @@ export class WebToolPack {
   }
 
   async #read(url: string, signal?: AbortSignal): Promise<WebPage> {
+    const within = this.#boundOf(new URL(url).hostname);
     const deepseek = this.#options.deepseek;
-    if (deepseek && !(await this.#isLocal(new URL(url).hostname))) {
+    // DeepSeek follows a redirect on its own servers, where no host list reaches it.
+    if (deepseek && !within && !(await this.#isLocal(new URL(url).hostname))) {
       try {
         const page = await deepseek.fetch(url, signal);
         return { status: 200, ok: true, title: page.title, text: page.content };
@@ -173,11 +177,51 @@ export class WebToolPack {
         if (signal?.aborted) throw error;
       }
     }
-    const response = await fetch(url, {
-      signal: signal ? AbortSignal.any([signal, AbortSignal.timeout(20_000)]) : AbortSignal.timeout(20_000),
-      redirect: "follow",
-    });
-    return { status: response.status, ok: response.ok, title: "", text: WebToolPack.#readable(await response.text()) };
+    const timeout = signal ? AbortSignal.any([signal, AbortSignal.timeout(20_000)]) : AbortSignal.timeout(20_000);
+    if (!within) {
+      const response = await fetch(url, { signal: timeout, redirect: "follow" });
+      return {
+        status: response.status,
+        ok: response.ok,
+        title: "",
+        text: WebToolPack.#readable(await response.text()),
+      };
+    }
+    return await WebToolPack.#readWithin(url, within, timeout);
+  }
+
+  #boundOf(hostname: string): ((host: string) => boolean) | undefined {
+    const { allowHosts, askOutside } = this.#options.profile.network;
+    if (allowHosts?.length) return (host) => allowHosts.includes(host);
+    const quiet = (host: string) => codeAgentIsLoopback(host) || codeAgentHostListed(host, askOutside ?? []);
+    return askOutside && quiet(hostname) ? quiet : undefined;
+  }
+
+  static async #readWithin(url: string, within: (host: string) => boolean, signal: AbortSignal): Promise<WebPage> {
+    let current = url;
+    for (let hop = 0; hop <= WebToolPack.maxRedirects; hop += 1) {
+      const response = await fetch(current, { signal, redirect: "manual" });
+      const location = response.headers.get("location");
+      if (response.status < 300 || response.status >= 400 || !location)
+        return {
+          status: response.status,
+          ok: response.ok,
+          title: "",
+          text: WebToolPack.#readable(await response.text()),
+        };
+      await response.body?.cancel();
+      const next = new URL(location, current).href;
+      const host = codeAgentHostOf(next);
+      if (!host || !within(host))
+        return {
+          status: response.status,
+          ok: false,
+          title: "",
+          text: `Redirected to ${next}, which this profile does not reach without asking. web_fetch that URL to follow it.`,
+        };
+      current = next;
+    }
+    return { status: 310, ok: false, title: "", text: `More than ${WebToolPack.maxRedirects} redirects.` };
   }
 
   #remember(url: string, page: WebPage) {