@atlasharness/atlascode 0.1.74 → 0.1.76

package/dist/cli.js

@@ -28664,9 +28664,6 @@ function setIsInteractive(v) {
 function setClientType(t) {
   _clientType = t;
 }
-function getClientType() {
-  return _clientType;
-}
 function setQuestionPreviewFormat(f) {
   _questionPreviewFormat = f;
 }
@@ -85413,17 +85410,13 @@ async function main() {
       return "local-agent";
     if (process.env.ATLAS_ENTRYPOINT === "claude-desktop")
       return "claude-desktop";
-    const hasSessionIngressToken = process.env.ATLAS_SESSION_ACCESS_TOKEN || process.env.ATLAS_WEBSOCKET_AUTH_FILE_DESCRIPTOR;
-    if (process.env.ATLAS_ENTRYPOINT === "remote" || hasSessionIngressToken) {
-      return "remote";
-    }
     return "cli";
   })();
   setClientType(clientType);
   const previewFormat = process.env.ATLAS_QUESTION_PREVIEW_FORMAT;
   if (previewFormat === "markdown" || previewFormat === "html") {
     setQuestionPreviewFormat(previewFormat);
-  } else if (!clientType.startsWith("sdk-") && clientType !== "claude-desktop" && clientType !== "local-agent" && clientType !== "remote") {
+  } else if (!clientType.startsWith("sdk-") && clientType !== "claude-desktop" && clientType !== "local-agent") {
     setQuestionPreviewFormat("markdown");
   }
   eagerLoadSettings();
@@ -125692,7 +125685,7 @@ var _spSectionCache, _agentColorMap, _invokedSkillsByAgent, _invokedSkillAgentKe
   _spSectionCache.clear();
 }, getSystemPromptSectionCache = () => _spSectionCache, setSystemPromptSectionCacheEntry = (name, value) => {
   _spSectionCache.set(name, value);
-}, setCachedClaudeMdContent = () => ({}), getLastApiCompletionTimestamp = () => ({}), getPromptCache1hAllowlist = () => null, getPromptCache1hEligible = () => null, setPromptCache1hAllowlist = () => ({}), setPromptCache1hEligible = () => ({}), setLastApiCompletionTimestamp = () => ({}), hasExitedPlanModeInSession = () => ({}), getLastEmittedDate = () => ({}), preferThirdPartyAuthentication = () => ({}), getApiKeyFromFd = () => ({}), getOauthTokenFromFd = () => ({}), setApiKeyFromFd = () => ({}), setOauthTokenFromFd = () => ({}), onSessionSwitch = () => ({}), getSessionCronTasks = () => ({}), removeSessionCronTasks = () => ({}), addSessionCronTask = () => ({}), getCachedClaudeMdContent = () => ({}), setLastClassifierRequests = () => ({}), clearRegisteredPluginHooks = () => ({}), getSessionIngressToken = () => ({}), setSessionIngressToken = () => ({}), getSessionProjectDir = () => null, getLastMainRequestId = () => ({}), getStatsStore = () => null, getFlagSettingsPath = () => "/tmp/.claude-flags.json", needsPlanModeExitAttachment = () => ({}), needsAutoModeExitAttachment = () => ({}), getScheduledTasksEnabled = () => ({}), _turnHookDurationMs = 0, _turnHookCount = 0, _turnToolDurationMs = 0, _turnToolCount = 0, _turnClassifierDurationMs = 0, _turnClassifierCount = 0, addToTurnHookDuration = (durationMs) => {
+}, setCachedClaudeMdContent = () => ({}), getLastApiCompletionTimestamp = () => ({}), getPromptCache1hAllowlist = () => null, getPromptCache1hEligible = () => null, setPromptCache1hAllowlist = () => ({}), setPromptCache1hEligible = () => ({}), setLastApiCompletionTimestamp = () => ({}), hasExitedPlanModeInSession = () => ({}), getLastEmittedDate = () => ({}), preferThirdPartyAuthentication = () => ({}), getApiKeyFromFd = () => ({}), getOauthTokenFromFd = () => ({}), setApiKeyFromFd = () => ({}), setOauthTokenFromFd = () => ({}), onSessionSwitch = () => ({}), getSessionCronTasks = () => ({}), removeSessionCronTasks = () => ({}), addSessionCronTask = () => ({}), getCachedClaudeMdContent = () => ({}), setLastClassifierRequests = () => ({}), clearRegisteredPluginHooks = () => ({}), getSessionProjectDir = () => null, getLastMainRequestId = () => ({}), getStatsStore = () => null, getFlagSettingsPath = () => "/tmp/.claude-flags.json", needsPlanModeExitAttachment = () => ({}), needsAutoModeExitAttachment = () => ({}), getScheduledTasksEnabled = () => ({}), _turnHookDurationMs = 0, _turnHookCount = 0, _turnToolDurationMs = 0, _turnToolCount = 0, _turnClassifierDurationMs = 0, _turnClassifierCount = 0, addToTurnHookDuration = (durationMs) => {
   _turnHookDurationMs += durationMs;
   _turnHookCount++;
 }, handleAutoModeTransition = () => ({}), addToTurnClassifierDuration = (durationMs) => {
@@ -167957,7 +167950,7 @@ var init_hooks3 = __esm(() => {
 });
 
 // src/tui/services/mcp/types.ts
-var ConfigScopeSchema3, TransportSchema2, McpStdioServerConfigSchema3, McpXaaConfigSchema2, McpOAuthConfigSchema2, McpSSEServerConfigSchema3, McpSSEIDEServerConfigSchema, McpWebSocketIDEServerConfigSchema, McpHTTPServerConfigSchema2, McpWebSocketServerConfigSchema2, McpSdkServerConfigSchema2, McpServerConfigSchema2, McpJsonConfigSchema2;
+var ConfigScopeSchema3, TransportSchema2, McpStdioServerConfigSchema3, McpXaaConfigSchema2, McpOauthGatedMarkerSchema, McpOAuthConfigSchema2, McpSSEServerConfigSchema3, McpSSEIDEServerConfigSchema, McpWebSocketIDEServerConfigSchema, McpHTTPServerConfigSchema2, McpWebSocketServerConfigSchema2, McpSdkServerConfigSchema2, McpServerConfigSchema2, McpJsonConfigSchema2;
 var init_types9 = __esm(() => {
   init_v4();
   ConfigScopeSchema3 = lazySchema2(() => _enum([
@@ -167977,6 +167970,7 @@ var init_types9 = __esm(() => {
     env: record(string2(), string2()).optional()
   }));
   McpXaaConfigSchema2 = lazySchema2(() => boolean2());
+  McpOauthGatedMarkerSchema = lazySchema2(() => boolean2().optional());
   McpOAuthConfigSchema2 = lazySchema2(() => object({
     clientId: string2().optional(),
     callbackPort: number2().int().positive().optional(),
@@ -167993,7 +167987,8 @@ var init_types9 = __esm(() => {
     url: string2(),
     headers: record(string2(), string2()).optional(),
     headersHelper: string2().optional(),
-    oauth: McpOAuthConfigSchema2().optional()
+    oauth: McpOAuthConfigSchema2().optional(),
+    oauthGated: McpOauthGatedMarkerSchema()
   }));
   McpSSEIDEServerConfigSchema = lazySchema2(() => object({
     type: literal("sse-ide"),
@@ -168013,7 +168008,8 @@ var init_types9 = __esm(() => {
     url: string2(),
     headers: record(string2(), string2()).optional(),
     headersHelper: string2().optional(),
-    oauth: McpOAuthConfigSchema2().optional()
+    oauth: McpOAuthConfigSchema2().optional(),
+    oauthGated: McpOauthGatedMarkerSchema()
   }));
   McpWebSocketServerConfigSchema2 = lazySchema2(() => object({
     type: literal("ws"),
@@ -181783,28 +181779,6 @@ var init_argumentSubstitution2 = __esm(() => {
   init_shellQuote2();
 });
 
-// src/tui/constants/product.ts
-function isRemoteSessionStaging(sessionId, ingressUrl) {
-  return sessionId?.includes("_staging_") === true || ingressUrl?.includes("staging") === true;
-}
-function isRemoteSessionLocal(sessionId, ingressUrl) {
-  return sessionId?.includes("_local_") === true || ingressUrl?.includes("localhost") === true;
-}
-function getClaudeAiBaseUrl(sessionId, ingressUrl) {
-  if (isRemoteSessionLocal(sessionId, ingressUrl)) {
-    return CLAUDE_AI_LOCAL_BASE_URL;
-  }
-  if (isRemoteSessionStaging(sessionId, ingressUrl)) {
-    return CLAUDE_AI_STAGING_BASE_URL;
-  }
-  return CLAUDE_AI_BASE_URL;
-}
-function getRemoteSessionUrl(sessionId, ingressUrl) {
-  const baseUrl = getClaudeAiBaseUrl(sessionId, ingressUrl);
-  return `${baseUrl}/code/${sessionId}`;
-}
-var CLAUDE_AI_BASE_URL = "https://claude.ai", CLAUDE_AI_STAGING_BASE_URL = "https://claude-ai.staging.ant.dev", CLAUDE_AI_LOCAL_BASE_URL = "http://localhost:4000";
-
 // src/tui/utils/generatedFiles.ts
 import { basename as basename18, extname as extname7, posix as posix4, sep as sep15 } from "path";
 function isGeneratedFile(filePath) {
@@ -193150,6 +193124,63 @@ var init_oauthPort = __esm(() => {
   REDIRECT_PORT_RANGE = getPlatform3() === "windows" ? { min: 39152, max: 49151 } : { min: 49152, max: 65535 };
 });
 
+// src/tui/services/mcp/oauthScopeGate.ts
+function parseMcpOauthTrustedServersEnv(raw) {
+  if (raw === undefined || raw === null) {
+    return new Set;
+  }
+  const names = new Set;
+  for (const part of raw.split(",")) {
+    const name = part.trim().toLowerCase();
+    if (name !== "") {
+      names.add(name);
+    }
+  }
+  return names;
+}
+function getMcpOauthTrustedServers() {
+  return parseMcpOauthTrustedServersEnv(process.env[MCP_OAUTH_TRUSTED_SERVERS_ENV]);
+}
+function isMcpOauthUntrustedScope(scope, pluginSource) {
+  if (scope === "project") {
+    return true;
+  }
+  return scope === "dynamic" && pluginSource !== undefined;
+}
+function isMcpOauthBlockGated(serverName, scope, pluginSource, allowlist = getMcpOauthTrustedServers()) {
+  if (!isMcpOauthUntrustedScope(scope, pluginSource)) {
+    return false;
+  }
+  return !allowlist.has(serverName.toLowerCase());
+}
+function applyMcpOauthScopeGate(serverName, server) {
+  if (server.type !== "sse" && server.type !== "http") {
+    return server;
+  }
+  const remote = server;
+  if (remote.oauth === undefined) {
+    return server;
+  }
+  if (!isMcpOauthBlockGated(serverName, server.scope, server.pluginSource)) {
+    return server;
+  }
+  const { oauth: _gatedOAuth, ...rest } = remote;
+  return { ...rest, oauthGated: true };
+}
+function isMcpOauthDisplayGated(serverName, config) {
+  if (config.oauthGated === true) {
+    return true;
+  }
+  if (config.oauth === undefined || config.oauth === null) {
+    return false;
+  }
+  return isMcpOauthBlockGated(serverName, config.scope, config.pluginSource);
+}
+function mcpOauthGatedMessage(serverName) {
+  return `MCP server "${serverName}" 的 oauth 块为 untrusted scope（project/plugin 来源），` + `操作者 allowlist 后启用：将 server 名加入 env ${MCP_OAUTH_TRUSTED_SERVERS_ENV}（逗号分隔）后重启。` + `当前该 oauth 块整体视为缺席，不发起 OAuth 流。`;
+}
+var MCP_OAUTH_TRUSTED_SERVERS_ENV = "ATLAS_MCP_OAUTH_TRUSTED_SERVERS";
+
 // src/tui/services/mcp/envExpansion.ts
 function expandEnvVarsInString2(value) {
   const missingVars = [];
@@ -193511,7 +193542,7 @@ function addScopeToServers(servers, scope) {
   }
   const scopedServers = {};
   for (const [name, config] of Object.entries(servers)) {
-    scopedServers[name] = { ...config, scope };
+    scopedServers[name] = applyMcpOauthScopeGate(name, { ...config, scope });
   }
   return scopedServers;
 }
@@ -194198,7 +194229,7 @@ async function getMcpConfigs(dynamicServers = {}, extraDedupTargets = Promise.re
     if (!isMcpServerAllowedByPolicy(name, serverConfig)) {
       continue;
     }
-    filtered[name] = serverConfig;
+    filtered[name] = applyMcpOauthScopeGate(name, serverConfig);
   }
   return { servers: filtered, errors: mcpErrors };
 }
@@ -195567,6 +195598,9 @@ async function performMCPXaaAuth(serverName, serverConfig, onAuthorizationUrl, a
   }
 }
 async function performMCPOAuthFlow(serverName, serverConfig, onAuthorizationUrl, abortSignal, options) {
+  if (isMcpOauthDisplayGated(serverName, serverConfig)) {
+    throw new Error(mcpOauthGatedMessage(serverName));
+  }
   if (serverConfig.oauth?.xaa) {
     if (!isXaaEnabled()) {
       throw new Error(`XAA is not enabled (set ATLAS_ENABLE_XAA=1). Remove 'oauth.xaa' from server '${serverName}' to use the standard consent flow.`);
@@ -196597,6 +196631,14 @@ function createMcpAuthTool(serverName, config) {
           }
         };
       }
+      if (isMcpOauthDisplayGated(serverName, config)) {
+        return {
+          data: {
+            status: "error",
+            message: mcpOauthGatedMessage(serverName)
+          }
+        };
+      }
       const sseOrHttpConfig = config;
       let resolveAuthUrl;
       const authUrlPromise = new Promise((resolve) => {
@@ -197438,7 +197480,7 @@ function getApiKeyFromFileDescriptor() {
     setCached: setApiKeyFromFd
   });
 }
-var CCR_TOKEN_DIR, CCR_OAUTH_TOKEN_PATH, CCR_API_KEY_PATH, CCR_SESSION_INGRESS_TOKEN_PATH;
+var CCR_TOKEN_DIR, CCR_OAUTH_TOKEN_PATH, CCR_API_KEY_PATH;
 var init_authFileDescriptor = __esm(() => {
   init_bootstrapState();
   init_debug();
@@ -197448,7 +197490,6 @@ var init_authFileDescriptor = __esm(() => {
   CCR_TOKEN_DIR = join82(getAtlasConfigHomeDir3(), "remote");
   CCR_OAUTH_TOKEN_PATH = `${CCR_TOKEN_DIR}/.oauth_token`;
   CCR_API_KEY_PATH = `${CCR_TOKEN_DIR}/.api_key`;
-  CCR_SESSION_INGRESS_TOKEN_PATH = `${CCR_TOKEN_DIR}/.session_ingress_token`;
 });
 
 // src/tui/utils/authPortable.ts
@@ -200939,63 +200980,6 @@ function recursivelySanitizeUnicode2(value) {
   return value;
 }
 
-// src/tui/utils/sessionIngressAuth.ts
-function getTokenFromFileDescriptor() {
-  const cachedToken = getSessionIngressToken();
-  if (cachedToken !== undefined) {
-    return cachedToken;
-  }
-  const fdEnv = process.env.ATLAS_WEBSOCKET_AUTH_FILE_DESCRIPTOR;
-  if (!fdEnv) {
-    const path = process.env.ATLAS_SESSION_INGRESS_TOKEN_FILE ?? CCR_SESSION_INGRESS_TOKEN_PATH;
-    const fromFile = readTokenFromWellKnownFile(path, "session ingress token");
-    setSessionIngressToken(fromFile);
-    return fromFile;
-  }
-  const fd = parseInt(fdEnv, 10);
-  if (Number.isNaN(fd)) {
-    logForDebugging3(`ATLAS_WEBSOCKET_AUTH_FILE_DESCRIPTOR must be a valid file descriptor number, got: ${fdEnv}`, { level: "error" });
-    setSessionIngressToken(null);
-    return null;
-  }
-  try {
-    const fsOps = getFsImplementation2();
-    const fdPath = process.platform === "darwin" || process.platform === "freebsd" ? `/dev/fd/${fd}` : `/proc/self/fd/${fd}`;
-    const token = fsOps.readFileSync(fdPath, { encoding: "utf8" }).trim();
-    if (!token) {
-      logForDebugging3("File descriptor contained empty token", {
-        level: "error"
-      });
-      setSessionIngressToken(null);
-      return null;
-    }
-    logForDebugging3(`Successfully read token from file descriptor ${fd}`);
-    setSessionIngressToken(token);
-    maybePersistTokenForSubprocesses(CCR_SESSION_INGRESS_TOKEN_PATH, token, "session ingress token");
-    return token;
-  } catch (error) {
-    logForDebugging3(`Failed to read token from file descriptor ${fd}: ${errorMessage2(error)}`, { level: "error" });
-    const path = process.env.ATLAS_SESSION_INGRESS_TOKEN_FILE ?? CCR_SESSION_INGRESS_TOKEN_PATH;
-    const fromFile = readTokenFromWellKnownFile(path, "session ingress token");
-    setSessionIngressToken(fromFile);
-    return fromFile;
-  }
-}
-function getSessionIngressAuthToken() {
-  const envToken = process.env.ATLAS_SESSION_ACCESS_TOKEN;
-  if (envToken) {
-    return envToken;
-  }
-  return getTokenFromFileDescriptor();
-}
-var init_sessionIngressAuth = __esm(() => {
-  init_bootstrapState();
-  init_authFileDescriptor();
-  init_debug();
-  init_errors4();
-  init_fsOperations();
-});
-
 // src/tui/utils/subprocessEnv.ts
 function subprocessEnv() {
   const proxyEnv = _getUpstreamProxyEnv?.() ?? {};
@@ -209988,7 +209972,6 @@ var init_client4 = __esm(() => {
   init_memoize2();
   init_mtls();
   init_proxy();
-  init_sessionIngressAuth();
   init_subprocessEnv();
   init_toolResultStorage();
   init_elicitationHandler();
@@ -210040,7 +210023,6 @@ var init_client4 = __esm(() => {
     let inProcessServer;
     try {
       let transport;
-      const sessionIngressToken = getSessionIngressAuthToken();
       if (serverRef.type === "sse") {
         const authProvider = new ClaudeAuthProvider(name, serverRef);
         const combinedHeaders = await getMcpServerHeaders(name, serverRef);
@@ -210126,16 +210108,12 @@ var init_client4 = __esm(() => {
         const tlsOptions = getWebSocketTLSOptions();
         const wsHeaders = {
           "User-Agent": getMCPUserAgent(),
-          ...sessionIngressToken && {
-            Authorization: `Bearer ${sessionIngressToken}`
-          },
           ...combinedHeaders
         };
         const wsHeadersForLogging = mapValues_default(wsHeaders, (value, key) => key.toLowerCase() === "authorization" ? "[REDACTED]" : value);
         logMCPDebug(name, `WebSocket transport options: ${jsonStringify5({
           url: serverRef.url,
-          headers: wsHeadersForLogging,
-          hasSessionAuth: !!sessionIngressToken
+          headers: wsHeadersForLogging
         })}`);
         let wsClient;
         if (typeof Bun !== "undefined") {
@@ -210165,7 +210143,6 @@ var init_client4 = __esm(() => {
         })}`);
         const authProvider = new ClaudeAuthProvider(name, serverRef);
         const combinedHeaders = await getMcpServerHeaders(name, serverRef);
-        const hasOAuthTokens = !!await authProvider.tokens();
         const proxyOptions = getProxyFetchOptions();
         logMCPDebug(name, `Proxy options: ${proxyOptions.dispatcher ? "custom dispatcher" : "default"}`);
         const transportOptions = {
@@ -210175,9 +210152,6 @@ var init_client4 = __esm(() => {
             ...proxyOptions,
             headers: {
               "User-Agent": getMCPUserAgent(),
-              ...sessionIngressToken && !hasOAuthTokens && {
-                Authorization: `Bearer ${sessionIngressToken}`
-              },
               ...combinedHeaders
             }
           }
@@ -254826,17 +254800,6 @@ function buildPRTrailers(_attributionData, _attribution) {
 // src/tui/utils/attribution.ts
 import { stat as stat30 } from "fs/promises";
 function getAttributionTexts() {
-  if (getClientType() === "remote") {
-    const remoteSessionId = process.env.ATLAS_REMOTE_SESSION_ID;
-    if (remoteSessionId) {
-      const ingressUrl = process.env.SESSION_INGRESS_URL;
-      if (!isRemoteSessionLocal(remoteSessionId, ingressUrl)) {
-        const sessionUrl = getRemoteSessionUrl(remoteSessionId, ingressUrl);
-        return { commit: sessionUrl, pr: sessionUrl };
-      }
-    }
-    return { commit: "", pr: "" };
-  }
   const model = getMainLoopModel();
   const isKnownPublicModel = getPublicModelDisplayName(model) !== null;
   const modelName = isInternalModelRepoCached() || isKnownPublicModel ? getPublicModelName(model) : "Atlas Opus 4.6";
@@ -254949,16 +254912,6 @@ async function getTranscriptStats() {
   }
 }
 async function getEnhancedPRAttribution(getAppState) {
-  if (getClientType() === "remote") {
-    const remoteSessionId = process.env.ATLAS_REMOTE_SESSION_ID;
-    if (remoteSessionId) {
-      const ingressUrl = process.env.SESSION_INGRESS_URL;
-      if (!isRemoteSessionLocal(remoteSessionId, ingressUrl)) {
-        return getRemoteSessionUrl(remoteSessionId, ingressUrl);
-      }
-    }
-    return "";
-  }
   const settings = getInitialSettings2();
   if (settings.attribution?.pr) {
     return settings.attribution.pr;
@@ -255006,7 +254959,6 @@ ${trailers.join(`
 var MEMORY_ACCESS_TOOL_NAMES;
 var init_attribution = __esm(() => {
   init_shared();
-  init_bootstrap();
   init_xml();
   init_constants8();
   init_prompt2();
@@ -311079,9 +311031,6 @@ function gracefulShutdownSync(exitCode = 0, reason = "other", options) {
     forceExit(exitCode);
   }).catch(() => {});
 }
-function isShuttingDown() {
-  return shutdownInProgress;
-}
 async function gracefulShutdown(exitCode = 0, reason = "other", options) {
   if (shutdownInProgress) {
     return;
@@ -347228,183 +347177,6 @@ var init_fileSuggestions = __esm(() => {
   cachedTrackedDirs = [];
 });
 
-// src/tui/constants/oauth.ts
-function getOauthConfig() {
-  return PROD_OAUTH_CONFIG;
-}
-var PROD_OAUTH_CONFIG;
-var init_oauth = __esm(() => {
-  PROD_OAUTH_CONFIG = {
-    BASE_API_URL: undefined,
-    CLAUDE_AI_ORIGIN: undefined
-  };
-});
-
-// src/tui/services/api/sessionIngress.ts
-function getOrCreateSequentialAppend(sessionId) {
-  let sequentialAppend = sequentialAppendBySession.get(sessionId);
-  if (!sequentialAppend) {
-    sequentialAppend = sequential(async (entry, url, headers) => await appendSessionLogImpl(sessionId, entry, url, headers));
-    sequentialAppendBySession.set(sessionId, sequentialAppend);
-  }
-  return sequentialAppend;
-}
-async function appendSessionLogImpl(sessionId, entry, url, headers) {
-  for (let attempt = 1;attempt <= MAX_RETRIES; attempt++) {
-    try {
-      const lastUuid = lastUuidMap.get(sessionId);
-      const requestHeaders = { ...headers };
-      if (lastUuid) {
-        requestHeaders["Last-Uuid"] = lastUuid;
-      }
-      const response = await axios_default.put(url, entry, {
-        headers: requestHeaders,
-        validateStatus: (status) => status < 500
-      });
-      if (response.status === 200 || response.status === 201) {
-        lastUuidMap.set(sessionId, entry.uuid);
-        logForDebugging3(`Successfully persisted session log entry for session ${sessionId}`);
-        return true;
-      }
-      if (response.status === 409) {
-        const serverLastUuid = response.headers["x-last-uuid"];
-        if (serverLastUuid === entry.uuid) {
-          lastUuidMap.set(sessionId, entry.uuid);
-          logForDebugging3(`Session entry ${entry.uuid} already present on server, recovering from stale state`);
-          logForDiagnosticsNoPII("info", "session_persist_recovered_from_409");
-          return true;
-        }
-        if (serverLastUuid) {
-          lastUuidMap.set(sessionId, serverLastUuid);
-          logForDebugging3(`Session 409: adopting server lastUuid=${serverLastUuid} from header, retrying entry ${entry.uuid}`);
-        } else {
-          const logs = await fetchSessionLogsFromUrl(sessionId, url, headers);
-          const adoptedUuid = findLastUuid(logs);
-          if (adoptedUuid) {
-            lastUuidMap.set(sessionId, adoptedUuid);
-            logForDebugging3(`Session 409: re-fetched ${logs.length} entries, adopting lastUuid=${adoptedUuid}, retrying entry ${entry.uuid}`);
-          } else {
-            const errorData = response.data;
-            const errorMessage = errorData.error?.message || "Concurrent modification detected";
-            logError3(new Error(`Session persistence conflict: UUID mismatch for session ${sessionId}, entry ${entry.uuid}. ${errorMessage}`));
-            logForDiagnosticsNoPII("error", "session_persist_fail_concurrent_modification");
-            return false;
-          }
-        }
-        logForDiagnosticsNoPII("info", "session_persist_409_adopt_server_uuid");
-        continue;
-      }
-      if (response.status === 401) {
-        logForDebugging3("Session token expired or invalid");
-        logForDiagnosticsNoPII("error", "session_persist_fail_bad_token");
-        return false;
-      }
-      logForDebugging3(`Failed to persist session log: ${response.status} ${response.statusText}`);
-      logForDiagnosticsNoPII("error", "session_persist_fail_status", {
-        status: response.status,
-        attempt
-      });
-    } catch (error) {
-      const axiosError = error;
-      logError3(new Error(`Error persisting session log: ${axiosError.message}`));
-      logForDiagnosticsNoPII("error", "session_persist_fail_status", {
-        status: axiosError.status,
-        attempt
-      });
-    }
-    if (attempt === MAX_RETRIES) {
-      logForDebugging3(`Remote persistence failed after ${MAX_RETRIES} attempts`);
-      logForDiagnosticsNoPII("error", "session_persist_error_retries_exhausted", { attempt });
-      return false;
-    }
-    const delayMs = Math.min(BASE_DELAY_MS2 * Math.pow(2, attempt - 1), 8000);
-    logForDebugging3(`Remote persistence attempt ${attempt}/${MAX_RETRIES} failed, retrying in ${delayMs}ms…`);
-    await sleep9(delayMs);
-  }
-  return false;
-}
-async function appendSessionLog(sessionId, entry, url) {
-  const sessionToken = getSessionIngressAuthToken();
-  if (!sessionToken) {
-    logForDebugging3("No session token available for session persistence");
-    logForDiagnosticsNoPII("error", "session_persist_fail_jwt_no_token");
-    return false;
-  }
-  const headers = {
-    Authorization: `Bearer ${sessionToken}`,
-    "Content-Type": "application/json"
-  };
-  const sequentialAppend = getOrCreateSequentialAppend(sessionId);
-  return sequentialAppend(entry, url, headers);
-}
-async function fetchSessionLogsFromUrl(sessionId, url, headers) {
-  try {
-    const response = await axios_default.get(url, {
-      headers,
-      timeout: 20000,
-      validateStatus: (status) => status < 500,
-      params: isEnvTruthy2(process.env.ATLAS_AFTER_LAST_COMPACT) ? { after_last_compact: true } : undefined
-    });
-    if (response.status === 200) {
-      const data = response.data;
-      if (!data || typeof data !== "object" || !Array.isArray(data.loglines)) {
-        logError3(new Error(`Invalid session logs response format: ${jsonStringify5(data)}`));
-        logForDiagnosticsNoPII("error", "session_get_fail_invalid_response");
-        return null;
-      }
-      const logs = data.loglines;
-      logForDebugging3(`Fetched ${logs.length} session logs for session ${sessionId}`);
-      return logs;
-    }
-    if (response.status === 404) {
-      logForDebugging3(`No existing logs for session ${sessionId}`);
-      logForDiagnosticsNoPII("warn", "session_get_no_logs_for_session");
-      return [];
-    }
-    if (response.status === 401) {
-      logForDebugging3("Auth token expired or invalid");
-      logForDiagnosticsNoPII("error", "session_get_fail_bad_token");
-      throw new Error("Your session has expired. Please run /login to sign in again.");
-    }
-    logForDebugging3(`Failed to fetch session logs: ${response.status} ${response.statusText}`);
-    logForDiagnosticsNoPII("error", "session_get_fail_status", {
-      status: response.status
-    });
-    return null;
-  } catch (error) {
-    const axiosError = error;
-    logError3(new Error(`Error fetching session logs: ${axiosError.message}`));
-    logForDiagnosticsNoPII("error", "session_get_fail_status", {
-      status: axiosError.status
-    });
-    return null;
-  }
-}
-function findLastUuid(logs) {
-  if (!logs) {
-    return;
-  }
-  const entry = logs.findLast((e) => ("uuid" in e) && e.uuid);
-  return entry && "uuid" in entry ? entry.uuid : undefined;
-}
-function clearAllSessions() {
-  lastUuidMap.clear();
-  sequentialAppendBySession.clear();
-}
-var lastUuidMap, MAX_RETRIES = 10, BASE_DELAY_MS2 = 500, sequentialAppendBySession;
-var init_sessionIngress = __esm(() => {
-  init_axios2();
-  init_oauth();
-  init_debug();
-  init_diagLogs();
-  init_envUtils2();
-  init_log5();
-  init_sessionIngressAuth();
-  init_slowOperations();
-  lastUuidMap = new Map;
-  sequentialAppendBySession = new Map;
-});
-
 // src/tui/utils/hooks/postSamplingHooks.ts
 function registerPostSamplingHook(hook) {
   postSamplingHooks.push(hook);
@@ -347672,7 +347444,6 @@ function clearSessionCaches(preservedAgentIds = new Set) {
   resetSentSkillNames();
   resetGetMemoryFilesCache("session_start");
   clearStoredImagePaths();
-  clearAllSessions();
   if (!hasPreserved)
     clearAllPendingCallbacks2();
   if (feature("COMMIT_ATTRIBUTION")) {
@@ -347703,7 +347474,6 @@ var init_caches = __esm(() => {
   init_useSwarmPermissionPoller();
   init_dumpPrompts();
   init_promptCacheBreakDetection();
-  init_sessionIngress();
   init_engineCompat();
   init_LSPDiagnosticRegistry();
   init_magicDocs();
@@ -368566,6 +368336,10 @@ function MCPListPanel(t0) {
               statusIcon = color("error", theme)(figures_default.cross);
               statusText = "failed";
             }
+            if (server_3.oauthGated === true) {
+              statusIcon = color("warning", theme)(figures_default.triangleUpOutline);
+              statusText = "oauth gated (untrusted scope) — operator allowlist to enable: " + MCP_OAUTH_TRUSTED_SERVERS_ENV;
+            }
           }
         }
       }
@@ -370039,6 +369813,7 @@ function MCPRemoteServerMenu({
     }
   }, []);
   const isEffectivelyAuthenticated = server.isAuthenticated || server.client.type === "connected" && serverToolsCount > 0;
+  const isOauthGated = server.config ? isMcpOauthDisplayGated(server.name, server.config) : false;
   const reconnectMcpServer = useMcpReconnect();
   useKeybinding("confirm:no", () => {
     authAbortControllerRef.current?.abort();
@@ -370390,7 +370165,13 @@ function MCPRemoteServerMenu({
                     bold: true,
                     children: "Auth: "
                   }, undefined, false, undefined, this),
-                  isEffectivelyAuthenticated ? /* @__PURE__ */ jsx_dev_runtime193.jsxDEV(ThemedText, {
+                  isOauthGated ? /* @__PURE__ */ jsx_dev_runtime193.jsxDEV(ThemedText, {
+                    children: [
+                      color("warning", theme)(figures_default.triangleUpOutline),
+                      " oauth gated (untrusted scope) — operator allowlist to enable: ",
+                      MCP_OAUTH_TRUSTED_SERVERS_ENV
+                    ]
+                  }, undefined, true, undefined, this) : isEffectivelyAuthenticated ? /* @__PURE__ */ jsx_dev_runtime193.jsxDEV(ThemedText, {
                     children: [
                       color("success", theme)(figures_default.tick),
                       " authenticated"
@@ -371399,9 +371180,8 @@ function MCPSettings(t0) {
           if (isSSE || isHTTP) {
             const authProvider = new ClaudeAuthProvider(client_0.name, client_0.config);
             const tokens = await authProvider.tokens();
-            const hasSessionAuth = getSessionIngressAuthToken() !== null && client_0.type === "connected";
             const hasToolsAndConnected = client_0.type === "connected" && filterToolsByServer(mcp.tools, client_0.name).length > 0;
-            isAuthenticated = Boolean(tokens) || hasSessionAuth || hasToolsAndConnected;
+            isAuthenticated = Boolean(tokens) || hasToolsAndConnected;
           }
           const baseInfo = {
             name: client_0.name,
@@ -371413,6 +371193,7 @@ function MCPSettings(t0) {
               ...baseInfo,
               transport: "sse",
               isAuthenticated,
+              oauthGated: isMcpOauthDisplayGated(client_0.name, client_0.config),
               config: client_0.config
             };
           } else {
@@ -371421,6 +371202,7 @@ function MCPSettings(t0) {
                 ...baseInfo,
                 transport: "http",
                 isAuthenticated,
+                oauthGated: isMcpOauthDisplayGated(client_0.name, client_0.config),
                 config: client_0.config
               };
             } else {
@@ -371739,7 +371521,6 @@ var init_MCPSettings = __esm(() => {
   init_auth3();
   init_utils6();
   init_AppState();
-  init_sessionIngressAuth();
   init_MCPAgentServerMenu();
   init_MCPListPanel();
   init_MCPRemoteServerMenu();
@@ -421740,10 +421521,6 @@ class Project2 {
   currentSessionPrRepository;
   sessionFile = null;
   pendingEntries = [];
-  remoteIngressUrl = null;
-  internalEventWriter = null;
-  internalEventReader = null;
-  internalSubagentEventReader = null;
   pendingWriteCount = 0;
   flushResolvers = [];
   writeQueues = new Map;
@@ -422207,9 +421984,6 @@ class Project2 {
           this.enqueueWrite(targetFile, entry);
           if (!isAgentSidechain) {
             messageSet.add(entry.uuid);
-            if (isTranscriptMessage2(entry)) {
-              await this.persistToRemote(sessionId, entry);
-            }
           }
         }
       }
@@ -422237,55 +422011,6 @@ class Project2 {
       throw e;
     }
   }
-  async persistToRemote(sessionId, entry) {
-    if (isShuttingDown()) {
-      return;
-    }
-    if (this.internalEventWriter) {
-      try {
-        await this.internalEventWriter("transcript", entry, {
-          ...isCompactBoundaryMessage2(entry) && { isCompaction: true },
-          ...entry.agentId && { agentId: entry.agentId }
-        });
-      } catch {
-        logForDebugging3("Failed to write transcript as internal event");
-      }
-      return;
-    }
-    if (!isEnvTruthy2(process.env.ENABLE_SESSION_PERSISTENCE) || !this.remoteIngressUrl) {
-      return;
-    }
-    const success = await appendSessionLog(sessionId, entry, this.remoteIngressUrl);
-    if (!success) {
-      gracefulShutdownSync(1, "other");
-    }
-  }
-  setRemoteIngressUrl(url) {
-    this.remoteIngressUrl = url;
-    logForDebugging3(`Remote persistence enabled with URL: ${url}`);
-    if (url) {
-      this.FLUSH_INTERVAL_MS = REMOTE_FLUSH_INTERVAL_MS;
-    }
-  }
-  setInternalEventWriter(writer) {
-    this.internalEventWriter = writer;
-    logForDebugging3("CCR v2 internal event writer registered for transcript persistence");
-    this.FLUSH_INTERVAL_MS = REMOTE_FLUSH_INTERVAL_MS;
-  }
-  setInternalEventReader(reader) {
-    this.internalEventReader = reader;
-    logForDebugging3("CCR v2 internal event reader registered for session resume");
-  }
-  setInternalSubagentEventReader(reader) {
-    this.internalSubagentEventReader = reader;
-    logForDebugging3("CCR v2 subagent event reader registered for session resume");
-  }
-  getInternalEventReader() {
-    return this.internalEventReader;
-  }
-  getInternalSubagentEventReader() {
-    return this.internalSubagentEventReader;
-  }
 }
 async function recordTranscript2(messages, teamInfo, startingParentUuidHint, allMessages) {
   const cleanedMessages = cleanMessagesForLogging2(messages, allMessages);
@@ -424144,7 +423869,7 @@ async function enrichLogs(allLogs, startIndex, count) {
   }
   return { logs: result, nextIndex: i };
 }
-var VERSION6, MAX_TOMBSTONE_REWRITE_BYTES, SKIP_FIRST_PROMPT_PATTERN2, EPHEMERAL_PROGRESS_TYPES2, MAX_TRANSCRIPT_READ_BYTES2, agentTranscriptSubdirs2, getProjectDir3, project2 = null, cleanupRegistered3 = false, REMOTE_FLUSH_INTERVAL_MS = 10, METADATA_TYPE_MARKERS2, METADATA_MARKER_BUFS2, METADATA_PREFIX_BOUND2 = 25, getSessionMessages2 = (sessionId) => getSessionMessages(sessionId), INITIAL_ENRICH_COUNT = 50;
+var VERSION6, MAX_TOMBSTONE_REWRITE_BYTES, SKIP_FIRST_PROMPT_PATTERN2, EPHEMERAL_PROGRESS_TYPES2, MAX_TRANSCRIPT_READ_BYTES2, agentTranscriptSubdirs2, getProjectDir3, project2 = null, cleanupRegistered3 = false, METADATA_TYPE_MARKERS2, METADATA_MARKER_BUFS2, METADATA_PREFIX_BOUND2 = 25, getSessionMessages2 = (sessionId) => getSessionMessages(sessionId), INITIAL_ENRICH_COUNT = 50;
 var init_sessionStorage = __esm(() => {
   init_memoize();
   init_bootstrap();
@@ -424153,21 +423878,18 @@ var init_sessionStorage = __esm(() => {
   init_commands5();
   init_xml();
   init_growthbook();
-  init_sessionIngress();
   init_constants9();
   init_ids();
   init_cleanupRegistry3();
   init_concurrentSessions2();
   init_cwd3();
   init_debug();
-  init_diagLogs();
   init_envUtils2();
   init_errors4();
   init_format2();
   init_fsOperations();
   init_getWorktreePaths();
   init_git2();
-  init_gracefulShutdown();
   init_json2();
   init_log5();
   init_messages3();
@@ -434520,6 +434242,18 @@ var init_client5 = __esm(() => {
   init_config6();
 });
 
+// src/tui/constants/oauth.ts
+function getOauthConfig() {
+  return PROD_OAUTH_CONFIG;
+}
+var PROD_OAUTH_CONFIG;
+var init_oauth = __esm(() => {
+  PROD_OAUTH_CONFIG = {
+    BASE_API_URL: undefined,
+    CLAUDE_AI_ORIGIN: undefined
+  };
+});
+
 // src/tui/utils/apiPreconnect.ts
 function preconnectAtlasApi() {
   if (fired)
@@ -434715,8 +434449,19 @@ function withoutMcpOauthCimdVars(env) {
   }
   return out;
 }
+function withoutMcpOauthTrustedServersVars(env) {
+  if (!env)
+    return {};
+  const out = {};
+  for (const [key, value] of Object.entries(env)) {
+    if (key.toUpperCase() !== MCP_OAUTH_TRUSTED_SERVERS_ENV) {
+      out[key] = value;
+    }
+  }
+  return out;
+}
 function filterSettingsEnv(env) {
-  return withoutCcdSpawnEnvKeys(withoutMcpOauthCimdVars(withoutHostManagedProviderVars(withoutSSHTunnelVars(env))));
+  return withoutCcdSpawnEnvKeys(withoutMcpOauthTrustedServersVars(withoutMcpOauthCimdVars(withoutHostManagedProviderVars(withoutSSHTunnelVars(env)))));
 }
 function applySafeConfigEnvironmentVariables2() {
   if (ccdSpawnEnvKeys === undefined) {
@@ -490349,7 +490094,9 @@ async function mcpGetHandler2(name) {
         console.log(`    ${key}: ${value}`);
       }
     }
-    if (server.oauth?.clientId || server.oauth?.callbackPort || server.oauth?.clientMetadataUrl) {
+    if (isMcpOauthDisplayGated(name, server)) {
+      console.log(`  OAuth: gated (untrusted scope) — operator allowlist to enable: ${MCP_OAUTH_TRUSTED_SERVERS_ENV}`);
+    } else if (server.oauth?.clientId || server.oauth?.callbackPort || server.oauth?.clientMetadataUrl) {
       const parts = [];
       if (server.oauth.clientId) {
         parts.push("client_id configured");
@@ -490372,7 +490119,9 @@ async function mcpGetHandler2(name) {
         console.log(`    ${key}: ${value}`);
       }
     }
-    if (server.oauth?.clientId || server.oauth?.callbackPort || server.oauth?.clientMetadataUrl) {
+    if (isMcpOauthDisplayGated(name, server)) {
+      console.log(`  OAuth: gated (untrusted scope) — operator allowlist to enable: ${MCP_OAUTH_TRUSTED_SERVERS_ENV}`);
+    } else if (server.oauth?.clientId || server.oauth?.callbackPort || server.oauth?.clientMetadataUrl) {
       const parts = [];
       if (server.oauth.clientId) {
         parts.push("client_id configured");
@@ -492760,17 +492509,13 @@ async function main2() {
       return "local-agent";
     if (process.env.ATLAS_ENTRYPOINT === "claude-desktop")
       return "claude-desktop";
-    const hasSessionIngressToken = process.env.ATLAS_SESSION_ACCESS_TOKEN || process.env.ATLAS_WEBSOCKET_AUTH_FILE_DESCRIPTOR;
-    if (process.env.ATLAS_ENTRYPOINT === "remote" || hasSessionIngressToken) {
-      return "remote";
-    }
     return "cli";
   })();
   setClientType(clientType);
   const previewFormat = process.env.ATLAS_QUESTION_PREVIEW_FORMAT;
   if (previewFormat === "markdown" || previewFormat === "html") {
     setQuestionPreviewFormat(previewFormat);
-  } else if (!clientType.startsWith("sdk-") && clientType !== "claude-desktop" && clientType !== "local-agent" && clientType !== "remote") {
+  } else if (!clientType.startsWith("sdk-") && clientType !== "claude-desktop" && clientType !== "local-agent") {
     setQuestionPreviewFormat("markdown");
   }
   profileCheckpoint("main_client_type_determined");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@atlasharness/atlascode",
-  "version": "0.1.74",
+  "version": "0.1.76",
   "description": "AtlasCode \u2014 Coding Agent for the domestic computing ecosystem (Ascend NPU + domestic LLM backends)",
   "bin": {
     "atlas": "dist/cli.js",