@codingame/monaco-vscode-chat-service-override 37.0.0 → 37.1.0

package/vscode/src/vs/workbench/contrib/chat/browser/agentSessions/agentHost/agentHostAuth.js

@@ -0,0 +1,746 @@
+
+import { fetchAuthorizationServerMetadata } from '@codingame/monaco-vscode-api/vscode/vs/base/common/oauth';
+import { SequencerByKey } from '@codingame/monaco-vscode-api/vscode/vs/base/common/async';
+import { CancellationError } from '@codingame/monaco-vscode-api/vscode/vs/base/common/errors';
+import { match } from '@codingame/monaco-vscode-api/vscode/vs/base/common/glob';
+import { URI } from '@codingame/monaco-vscode-api/vscode/vs/base/common/uri';
+import { readAgentModelByokIdentifier } from '../../../../../../platform/agentHost/common/agentModelByokMeta.js';
+import { ICommandService } from '@codingame/monaco-vscode-api/vscode/vs/platform/commands/common/commands.service';
+import { ILabelService } from '@codingame/monaco-vscode-api/vscode/vs/platform/label/common/label.service';
+import { ILogService } from '@codingame/monaco-vscode-api/vscode/vs/platform/log/common/log.service';
+import { localize } from '@codingame/monaco-vscode-api/vscode/vs/nls';
+import { IAuthenticationMcpAccessService } from '@codingame/monaco-vscode-api/vscode/vs/workbench/services/authentication/browser/authenticationMcpAccessService.service';
+import { IAuthenticationMcpService } from '@codingame/monaco-vscode-api/vscode/vs/workbench/services/authentication/browser/authenticationMcpService.service';
+import { IAuthenticationMcpUsageService } from '@codingame/monaco-vscode-api/vscode/vs/workbench/services/authentication/browser/authenticationMcpUsageService.service';
+import { getDynamicAuthenticationProviderId } from '@codingame/monaco-vscode-api/vscode/vs/workbench/services/authentication/common/authentication';
+import { IAuthenticationService } from '@codingame/monaco-vscode-api/vscode/vs/workbench/services/authentication/common/authentication.service';
+import { IDynamicAuthenticationProviderStorageService } from '@codingame/monaco-vscode-api/vscode/vs/workbench/services/authentication/common/dynamicAuthenticationProviderStorage.service';
+import { CHAT_SETUP_ACTION_ID } from '@codingame/monaco-vscode-api/vscode/vs/workbench/contrib/chat/browser/actions/chatActions';
+
+function agentHostMcpServerId(authority, serverName, resourceUrl) {
+    return `agent-host-mcp:${authority}/${encodeURIComponent(serverName)}/${encodeURIComponent(resourceUrl)}`;
+}
+function modelRequiresAgentAuthentication(agent, model, allowSignedOutWhenUsable = false) {
+    if (!agent?.protectedResources?.length) {
+        return false;
+    }
+    const requiresAuthentication = ( agent.protectedResources.some(resource => resource.required !== false));
+    if (!allowSignedOutWhenUsable || !( agent.models.some(candidate => readAgentModelByokIdentifier(candidate) !== undefined))) {
+        return requiresAuthentication;
+    }
+    if (!model) {
+        return true;
+    }
+    const selectedModel = agent.models.find(candidate => candidate.id === model.id);
+    return !selectedModel || readAgentModelByokIdentifier(selectedModel) === undefined;
+}
+class AgentHostAuthTokenCache {
+    constructor() {
+        this._completedTokens = ( new Map());
+        this._pendingAuthentications = ( new Map());
+        this._keyGenerations = ( new Map());
+        this._globalGeneration = 0;
+    }
+    async authenticate(resource, scopes, token, authenticate) {
+        const key = this._key(resource, scopes);
+        const globalGeneration = this._globalGeneration;
+        const keyGeneration = this._keyGenerations.get(key) ?? 0;
+        const pending = this._pendingAuthentications.get(key);
+        if (pending) {
+            if (pending.token === token) {
+                await pending.promise;
+                if (!this._isCurrentGeneration(key, globalGeneration, keyGeneration)) {
+                    throw ( new CancellationError());
+                }
+                return false;
+            }
+            try {
+                await pending.promise;
+            } catch {}
+            if (!this._isCurrentGeneration(key, globalGeneration, keyGeneration)) {
+                throw ( new CancellationError());
+            }
+            return this.authenticate(resource, scopes, token, authenticate);
+        }
+        if (this._completedTokens.get(key) === token) {
+            return false;
+        }
+        const promise = (async () => {
+            await authenticate();
+            if (!this._isCurrentGeneration(key, globalGeneration, keyGeneration)) {
+                throw ( new CancellationError());
+            }
+            this._completedTokens.set(key, token);
+        })();
+        this._pendingAuthentications.set(key, {
+            token,
+            promise
+        });
+        try {
+            await promise;
+            return true;
+        } finally {
+            if (this._pendingAuthentications.get(key)?.promise === promise) {
+                this._pendingAuthentications.delete(key);
+            }
+        }
+    }
+    clear(resource, scopes) {
+        if (resource !== undefined) {
+            if (scopes !== undefined) {
+                const key = this._key(resource, scopes);
+                this._invalidateKey(key);
+                this._completedTokens.delete(key);
+                this._pendingAuthentications.delete(key);
+                return;
+            }
+            const prefix = `${resource}\x00`;
+            const keys = ( new Set([...( this._completedTokens.keys()), ...( this._pendingAuthentications.keys()), ...( this._keyGenerations.keys())]));
+            for (const key of keys) {
+                if (key.startsWith(prefix)) {
+                    this._invalidateKey(key);
+                    this._completedTokens.delete(key);
+                    this._pendingAuthentications.delete(key);
+                }
+            }
+        } else {
+            this._globalGeneration++;
+            this._completedTokens.clear();
+            this._pendingAuthentications.clear();
+            this._keyGenerations.clear();
+        }
+    }
+    _invalidateKey(key) {
+        this._keyGenerations.set(key, (this._keyGenerations.get(key) ?? 0) + 1);
+    }
+    _isCurrentGeneration(key, globalGeneration, keyGeneration) {
+        return this._globalGeneration === globalGeneration && (this._keyGenerations.get(key) ?? 0) === keyGeneration;
+    }
+    _key(resource, scopes) {
+        return `${resource}\x00${scopes ? [...( new Set(scopes))].sort().join("\u0000") : ""}`;
+    }
+}
+function protectedResourceAuthenticationKey(resource) {
+    return JSON.stringify([resource.resource, [...( new Set(resource.scopes_supported ?? []))].sort(), resource.authorization_servers ?? []]);
+}
+class AgentHostAuthenticationRecovery {
+    constructor() {
+        this._resentTokens = ( new Map());
+        this._pendingRecoveries = ( new Map());
+    }
+    clear() {
+        this._resentTokens.clear();
+        this._pendingRecoveries.clear();
+    }
+    recover(accessor, resource, options) {
+        const key = protectedResourceAuthenticationKey(resource);
+        const pendingRecovery = this._pendingRecoveries.get(key);
+        if (pendingRecovery) {
+            return pendingRecovery;
+        }
+        const recovery = this._recover(accessor, key, resource, options).finally(() => {
+            if (this._pendingRecoveries.get(key) === recovery) {
+                this._pendingRecoveries.delete(key);
+            }
+        });
+        this._pendingRecoveries.set(key, recovery);
+        return recovery;
+    }
+    async _recover(accessor, key, resource, options) {
+        throwIfAuthenticationStale(options);
+        const authenticationService = accessor.get(IAuthenticationService);
+        const commandService = accessor.get(ICommandService);
+        const logService = accessor.get(ILogService);
+        const scopes = resource.scopes_supported ?? [];
+        const resolution = await resolveAuthenticationSessionForResource(( URI.parse(resource.resource)), resource.authorization_servers ?? [], scopes, authenticationService, logService, options.logPrefix);
+        throwIfAuthenticationStale(options);
+        if (resolution.kind !== "resolved") {
+            logAuthenticationSessionResolution(logService, options.logPrefix, resource.resource, resolution);
+            if (resolution.kind === "signedOut") {
+                this._resentTokens.delete(key);
+            }
+            return;
+        }
+        const session = resolution.session;
+        const previousToken = this._resentTokens.get(key);
+        if (previousToken !== undefined && previousToken === session.accessToken) {
+            options.authTokenCache?.clear(resource.resource, resource.scopes_supported);
+            throwIfAuthenticationStale(options);
+            const interactiveSession = await forceAuthenticationInteractively(authenticationService, commandService, logService, resource, options);
+            throwIfAuthenticationStale(options);
+            if (interactiveSession) {
+                this._resentTokens.set(key, interactiveSession.accessToken);
+                if (interactiveSession.accessToken === session.accessToken) {
+                    logService.info(
+                        `${options.logPrefix} Interactive authentication completed without a new token for ${resource.resource}`
+                    );
+                }
+            }
+            return;
+        }
+        options.authTokenCache?.clear(resource.resource, resource.scopes_supported);
+        if (await forwardAuthenticationToken(options, resource.resource, resource.scopes_supported ?? [], session)) {
+            this._resentTokens.set(key, session.accessToken);
+            logService.info(`${options.logPrefix} Authenticating for resource: ${resource.resource}`);
+        }
+    }
+}
+async function resolveSessionForResource(
+    resourceServer,
+    authorizationServers,
+    scopes,
+    authenticationService,
+    logService,
+    logPrefix
+) {
+    const resolution = await resolveAuthenticationSessionForResource(
+        resourceServer,
+        authorizationServers,
+        scopes,
+        authenticationService,
+        logService,
+        logPrefix
+    );
+    return resolution.kind === "resolved" ? resolution.session : undefined;
+}
+async function resolveAuthenticationSessionForResource(
+    resourceServer,
+    authorizationServers,
+    scopes,
+    authenticationService,
+    logService,
+    logPrefix
+) {
+    let hasUnavailableProvider = false;
+    for (const server of authorizationServers) {
+        const serverUri = ( URI.parse(server));
+        let providerId;
+        try {
+            providerId = await authenticationService.getOrActivateProviderIdForServer(serverUri, resourceServer);
+        } catch (error) {
+            hasUnavailableProvider = true;
+            logService.trace(
+                `${logPrefix} Authentication provider is not ready for server: ${server}`,
+                error
+            );
+            continue;
+        }
+        if (!providerId) {
+            const declaredProvider = authenticationService.declaredProviders.find(
+                provider => !authenticationService.isAuthenticationProviderRegistered(provider.id) && provider.authorizationServerGlobs?.some(glob => match(glob, ( serverUri.toString(true)), {
+                    ignoreCase: true
+                }))
+            );
+            if (declaredProvider) {
+                hasUnavailableProvider = true;
+                logService.trace(
+                    `${logPrefix} Authentication provider '${declaredProvider.id}' is not ready for server: ${server}`
+                );
+            } else {
+                logService.trace(`${logPrefix} No authentication provider resolved for server: ${server}`);
+            }
+            continue;
+        }
+        logService.trace(
+            `${logPrefix} Resolved auth provider '${providerId}' for server: ${server}`
+        );
+        let sessions;
+        try {
+            sessions = await authenticationService.getSessions(providerId, [...scopes], {
+                authorizationServer: serverUri
+            }, true);
+        } catch (error) {
+            hasUnavailableProvider = true;
+            logService.trace(
+                `${logPrefix} Authentication provider '${providerId}' is not ready to resolve sessions for server: ${server}`,
+                error
+            );
+            continue;
+        }
+        const exactSession = sessions[0];
+        if (exactSession) {
+            return {
+                kind: "resolved",
+                session: exactSession
+            };
+        }
+        let allSessions;
+        try {
+            allSessions = await authenticationService.getSessions(providerId, undefined, {
+                authorizationServer: serverUri
+            }, true);
+        } catch (error) {
+            hasUnavailableProvider = true;
+            logService.trace(
+                `${logPrefix} Authentication provider '${providerId}' is not ready to resolve sessions for server: ${server}`,
+                error
+            );
+            continue;
+        }
+        const requestedSet = ( new Set(scopes));
+        let bestSession;
+        let bestExtraScopes = Infinity;
+        for (const session of allSessions) {
+            const sessionScopes = ( new Set(session.scopes));
+            let isSuperset = true;
+            for (const scope of requestedSet) {
+                if (!( sessionScopes.has(scope))) {
+                    isSuperset = false;
+                    break;
+                }
+            }
+            if (isSuperset) {
+                const extraScopes = sessionScopes.size - requestedSet.size;
+                if (extraScopes < bestExtraScopes) {
+                    bestExtraScopes = extraScopes;
+                    bestSession = session;
+                }
+            }
+        }
+        if (bestSession) {
+            return {
+                kind: "resolved",
+                session: bestSession
+            };
+        }
+    }
+    return hasUnavailableProvider ? {
+        kind: "unavailable"
+    } : {
+        kind: "signedOut"
+    };
+}
+async function forwardAuthenticationToken(options, resource, scopes, session) {
+    throwIfAuthenticationStale(options);
+    const token = session?.accessToken ?? "";
+    const expiresAfter = session?.expiresAfter;
+    const request = {
+        resource,
+        scopes,
+        token,
+        ...(expiresAfter !== undefined && Number.isInteger(expiresAfter) && expiresAfter > 0 ? {
+            expiresIn: Math.ceil(expiresAfter / 1000)
+        } : {})
+    };
+    if (options.authTokenCache) {
+        return options.authTokenCache.authenticate(resource, scopes ?? [], token, () => options.authenticate(request));
+    }
+    await options.authenticate(request);
+    return true;
+}
+function throwIfAuthenticationStale(options) {
+    if (options.isCurrent?.() === false) {
+        throw ( new CancellationError());
+    }
+}
+async function authenticateProtectedResources(accessor, agents, options) {
+    const authenticationService = accessor.get(IAuthenticationService);
+    const logService = accessor.get(ILogService);
+    for (const agent of agents) {
+        for (const resource of agent.protectedResources ?? []) {
+            await authenticateProtectedResourceWithServices(authenticationService, logService, resource, options);
+        }
+    }
+}
+async function authenticateAgentProtectedResourcesWithToken(agents, token, options) {
+    for (const agent of agents) {
+        await authenticateProtectedResourcesWithToken(agent.protectedResources ?? [], token, options);
+    }
+}
+async function authenticateProtectedResourcesWithToken(protectedResources, token, options) {
+    for (const resource of protectedResources) {
+        await forwardAuthenticationToken(options, resource.resource, resource.scopes_supported, {
+            accessToken: token
+        });
+    }
+}
+async function revokeAuthenticationForRemovedSessions(accessor, agents, providerId, removedSessions, options) {
+    const authenticationService = accessor.get(IAuthenticationService);
+    const logService = accessor.get(ILogService);
+    const reconciledResources = ( new Set());
+    for (const agent of agents) {
+        for (const resource of agent.protectedResources ?? []) {
+            const scopes = resource.scopes_supported ?? [];
+            const key = protectedResourceAuthenticationKey(resource);
+            if (( reconciledResources.has(key))) {
+                continue;
+            }
+            if (!removedSessionsCouldSatisfyResource(removedSessions, scopes)) {
+                continue;
+            }
+            if (!(await resourceMatchesAuthenticationProvider(authenticationService, resource, providerId, logService, options.logPrefix))) {
+                continue;
+            }
+            reconciledResources.add(key);
+            const resolution = await resolveSessionForProtectedResource(authenticationService, logService, resource, options);
+            throwIfAuthenticationStale(options);
+            if (resolution.kind === "unavailable") {
+                logAuthenticationSessionResolution(logService, options.logPrefix, resource.resource, resolution);
+                continue;
+            }
+            if (resolution.kind === "resolved") {
+                if (await forwardAuthenticationToken(options, resource.resource, scopes, resolution.session)) {
+                    logService.info(
+                        `${options.logPrefix} Authenticating for resource after session removal: ${resource.resource}`
+                    );
+                }
+                continue;
+            }
+            options.authTokenCache?.clear(resource.resource, scopes);
+            if (await forwardAuthenticationToken(options, resource.resource, scopes, undefined)) {
+                logService.info(
+                    `${options.logPrefix} Clearing authentication for resource after session removal: ${resource.resource}`
+                );
+            }
+        }
+    }
+}
+function removedSessionsCouldSatisfyResource(removedSessions, scopes) {
+    return ( removedSessions.some(session => {
+        const granted = ( new Set(session.scopes));
+        return scopes.every(scope => ( granted.has(scope)));
+    }));
+}
+async function resourceMatchesAuthenticationProvider(authenticationService, resource, providerId, logService, logPrefix) {
+    for (const authorizationServer of resource.authorization_servers ?? []) {
+        try {
+            if ((await authenticationService.getOrActivateProviderIdForServer(( URI.parse(authorizationServer)), ( URI.parse(resource.resource)))) === providerId) {
+                return true;
+            }
+        } catch (error) {
+            logService.trace(
+                `${logPrefix} Unable to resolve authentication provider for session removal: ${authorizationServer}`,
+                error
+            );
+        }
+    }
+    return false;
+}
+async function authenticateProtectedResourceWithServices(authenticationService, logService, resource, options) {
+    throwIfAuthenticationStale(options);
+    const resolution = await resolveSessionForProtectedResource(authenticationService, logService, resource, options);
+    throwIfAuthenticationStale(options);
+    if (resolution.kind !== "resolved") {
+        logAuthenticationSessionResolution(logService, options.logPrefix, resource.resource, resolution);
+        return false;
+    }
+    const authenticated = await forwardAuthenticationToken(
+        options,
+        resource.resource,
+        resource.scopes_supported ?? [],
+        resolution.session
+    );
+    if (!authenticated) {
+        logService.trace(
+            `${options.logPrefix} Authentication state for ${resource.resource} unchanged; skipping authenticate RPC`
+        );
+        return false;
+    }
+    logService.info(`${options.logPrefix} Authenticating for resource: ${resource.resource}`);
+    return true;
+}
+async function resolveSessionForProtectedResource(authenticationService, logService, resource, options) {
+    return resolveAuthenticationSessionForResource(( URI.parse(resource.resource)), resource.authorization_servers ?? [], resource.scopes_supported ?? [], authenticationService, logService, options.logPrefix);
+}
+function logAuthenticationSessionResolution(logService, logPrefix, resource, resolution) {
+    if (resolution.kind === "unavailable") {
+        logService.info(
+            `${logPrefix} Authentication provider is not ready for resource: ${resource}; deferring authentication`
+        );
+    } else {
+        logService.info(`${logPrefix} No signed-in session resolved for resource: ${resource}`);
+    }
+}
+async function resolveAuthenticationInteractively(accessor, protectedResources, options) {
+    const authenticationService = accessor.get(IAuthenticationService);
+    const commandService = accessor.get(ICommandService);
+    const logService = accessor.get(ILogService);
+    for (const resource of protectedResources) {
+        throwIfAuthenticationStale(options);
+        const resourceUri = ( URI.parse(resource.resource));
+        const scopes = resource.scopes_supported ?? [];
+        const existingSession = await resolveSessionForResource(
+            resourceUri,
+            resource.authorization_servers ?? [],
+            scopes,
+            authenticationService,
+            logService,
+            options.logPrefix
+        );
+        throwIfAuthenticationStale(options);
+        if (existingSession) {
+            await forwardAuthenticationToken(options, resource.resource, scopes, existingSession);
+            logService.info(
+                `${options.logPrefix} Interactive authentication succeeded for ${resource.resource}`
+            );
+            return true;
+        }
+        return (await forceAuthenticationInteractively(authenticationService, commandService, logService, resource, options)) !== undefined;
+    }
+    return false;
+}
+async function forceAuthenticationInteractively(authenticationService, commandService, logService, resource, options) {
+    throwIfAuthenticationStale(options);
+    const scopes = resource.scopes_supported ?? [];
+    const setupResult = await commandService.executeCommand(CHAT_SETUP_ACTION_ID, undefined, {
+        forceSignInDialog: true,
+        additionalScopes: scopes,
+        dialogTitle: ( localize(5986, "Sign in to use GitHub Copilot")),
+        disableChatViewReveal: true,
+        returnResult: true
+    });
+    throwIfAuthenticationStale(options);
+    if (setupResult?.success === undefined) {
+        return undefined;
+    }
+    if (!setupResult.success) {
+        throw setupResult.error ?? ( new Error(( localize(5987, "Failed to sign in to use GitHub Copilot."))));
+    }
+    const session = await resolveSessionForResource(( URI.parse(resource.resource)), resource.authorization_servers ?? [], scopes, authenticationService, logService, options.logPrefix);
+    throwIfAuthenticationStale(options);
+    if (!session) {
+        logService.info(
+            `${options.logPrefix} Interactive authentication did not provide a token for ${resource.resource}`
+        );
+        return undefined;
+    }
+    options.authTokenCache?.clear(resource.resource, scopes);
+    if (!(await forwardAuthenticationToken(options, resource.resource, scopes, session))) {
+        return undefined;
+    }
+    logService.info(
+        `${options.logPrefix} Interactive authentication completed for ${resource.resource}`
+    );
+    return session;
+}
+async function resolveMcpServerAuthentication(accessor, protectedResource, options) {
+    const authenticationService = accessor.get(IAuthenticationService);
+    const authenticationMcpAccessService = accessor.get(IAuthenticationMcpAccessService);
+    const authenticationMcpService = accessor.get(IAuthenticationMcpService);
+    const authenticationMcpUsageService = accessor.get(IAuthenticationMcpUsageService);
+    const dynamicAuthenticationProviderStorageService = accessor.get(IDynamicAuthenticationProviderStorageService);
+    const logService = accessor.get(ILogService);
+    const agentHostMeta = options.agentHost ? {
+        authority: options.agentHost.authority,
+        label: accessor.get(ILabelService).getHostLabel(options.agentHost.scheme, options.agentHost.authority)
+    } : undefined;
+    const scopes = options.scopes.length > 0 || isGitHubMcpResource(protectedResource) ? options.scopes : protectedResource.scopes_supported ?? [];
+    const authenticationOperations = getMcpAuthenticationOperations(authenticationService);
+    for (const authorizationServer of protectedResource.authorization_servers ?? []) {
+        const authorizationServerUri = ( URI.parse(authorizationServer));
+        const providerOperationId = getDynamicAuthenticationProviderId(authorizationServerUri, protectedResource);
+        const authenticated = await authenticationOperations.queue(providerOperationId, async () => {
+            const providerId = await getOrCreateProviderForMcpResource(
+                authorizationServerUri,
+                protectedResource,
+                options.oauthClient,
+                authenticationService,
+                dynamicAuthenticationProviderStorageService,
+                logService,
+                options.logPrefix,
+                options.allowInteraction,
+                options.authorizationServerMetadataFetcher ?? fetchAuthorizationServerMetadata
+            );
+            if (!providerId) {
+                return false;
+            }
+            const oauthClientOptions = options.oauthClient ? {
+                clientId: options.oauthClient.clientId,
+                clientSecret: options.oauthClient.clientSecret
+            } : {};
+            const sessions = await authenticationService.getSessions(providerId, [...scopes], {
+                authorizationServer: authorizationServerUri,
+                resource: protectedResource.resource,
+                ...oauthClientOptions,
+                silent: !options.allowInteraction
+            }, true);
+            const allowedSession = getAllowedMcpSession(
+                providerId,
+                sessions,
+                authenticationMcpAccessService,
+                authenticationMcpService,
+                options
+            );
+            if (allowedSession) {
+                await authenticateMcpSession(
+                    providerId,
+                    allowedSession,
+                    scopes,
+                    authenticationMcpAccessService,
+                    authenticationMcpService,
+                    authenticationMcpUsageService,
+                    logService,
+                    options,
+                    false,
+                    agentHostMeta
+                );
+                return true;
+            }
+            if (!options.allowInteraction) {
+                return false;
+            }
+            const provider = authenticationService.getProvider(providerId);
+            const session = sessions.length ? provider.supportsMultipleAccounts ? await authenticationMcpService.selectSession(
+                providerId,
+                options.mcpServerId,
+                options.mcpServerName,
+                [...scopes],
+                sessions
+            ) : sessions[0] : await authenticationService.createSession(providerId, [...scopes], {
+                activateImmediate: true,
+                authorizationServer: authorizationServerUri,
+                resource: protectedResource.resource,
+                ...oauthClientOptions
+            });
+            await authenticateMcpSession(
+                providerId,
+                session,
+                scopes,
+                authenticationMcpAccessService,
+                authenticationMcpService,
+                authenticationMcpUsageService,
+                logService,
+                options,
+                true,
+                agentHostMeta
+            );
+            return true;
+        });
+        if (authenticated) {
+            return true;
+        }
+    }
+    return false;
+}
+const mcpAuthenticationOperations = ( new WeakMap());
+function getMcpAuthenticationOperations(authenticationService) {
+    let operations = mcpAuthenticationOperations.get(authenticationService);
+    if (!operations) {
+        operations = ( new SequencerByKey());
+        mcpAuthenticationOperations.set(authenticationService, operations);
+    }
+    return operations;
+}
+function isGitHubMcpResource(resource) {
+    return resource.resource_name === "GitHub MCP Server";
+}
+async function getOrCreateProviderForMcpResource(
+    authorizationServer,
+    protectedResource,
+    oauthClient,
+    authenticationService,
+    dynamicAuthenticationProviderStorageService,
+    logService,
+    logPrefix,
+    allowCreation,
+    authorizationServerMetadataFetcher
+) {
+    const resourceUri = ( URI.parse(protectedResource.resource));
+    const dynamicProviderId = getDynamicAuthenticationProviderId(authorizationServer, protectedResource);
+    let clientId = oauthClient?.clientId;
+    let clientSecret = oauthClient?.clientSecret;
+    if (oauthClient) {
+        const isProviderActive = authenticationService.isDynamicAuthenticationProvider(dynamicProviderId);
+        const registeredClient = await dynamicAuthenticationProviderStorageService.getClientRegistration(dynamicProviderId);
+        const clientMatches = registeredClient?.clientId === oauthClient.clientId && registeredClient.clientSecret === oauthClient.clientSecret;
+        if (clientMatches) {
+            if (isProviderActive) {
+                return dynamicProviderId;
+            }
+        } else {
+            if (!allowCreation) {
+                return undefined;
+            }
+            if (isProviderActive) {
+                authenticationService.unregisterAuthenticationProvider(dynamicProviderId);
+                await dynamicAuthenticationProviderStorageService.removeDynamicProvider(dynamicProviderId);
+            }
+        }
+    } else {
+        const existing = await authenticationService.getOrActivateProviderIdForServer(authorizationServer, resourceUri);
+        if (existing) {
+            return existing;
+        }
+        const registeredClient = await dynamicAuthenticationProviderStorageService.getClientRegistration(dynamicProviderId);
+        if (!registeredClient?.clientId && !allowCreation) {
+            return undefined;
+        }
+        clientId = registeredClient?.clientId;
+        clientSecret = registeredClient?.clientSecret;
+    }
+    try {
+        const {
+            metadata
+        } = await authorizationServerMetadataFetcher(( authorizationServer.toString(true)));
+        const provider = await authenticationService.createDynamicAuthenticationProvider(authorizationServer, metadata, protectedResource, clientId, clientSecret);
+        return provider?.id;
+    } catch (err) {
+        logService.warn(`${logPrefix} Failed to create MCP auth provider for ${( authorizationServer.toString(true))}`, err);
+        return undefined;
+    }
+}
+function getAllowedMcpSession(
+    providerId,
+    sessions,
+    authenticationMcpAccessService,
+    authenticationMcpService,
+    options
+) {
+    const accountNamePreference = authenticationMcpService.getAccountPreference(options.mcpServerId, providerId);
+    if (accountNamePreference) {
+        const preferred = sessions.find(session => session.account.label === accountNamePreference);
+        if (preferred && authenticationMcpAccessService.isAccessAllowedForUrl(
+            providerId,
+            preferred.account.label,
+            options.mcpServerId,
+            options.mcpServerUrl
+        )) {
+            return preferred;
+        }
+    }
+    if (sessions.length === 1 && authenticationMcpAccessService.isAccessAllowedForUrl(
+        providerId,
+        sessions[0].account.label,
+        options.mcpServerId,
+        options.mcpServerUrl
+    )) {
+        return sessions[0];
+    }
+    return undefined;
+}
+async function authenticateMcpSession(
+    providerId,
+    session,
+    scopes,
+    authenticationMcpAccessService,
+    authenticationMcpService,
+    authenticationMcpUsageService,
+    logService,
+    options,
+    updateAccess,
+    agentHost
+) {
+    await forwardAuthenticationToken(options, options.mcpServerUrl, scopes, session);
+    if (updateAccess) {
+        authenticationMcpAccessService.updateAllowedMcpServers(providerId, session.account.label, [{
+            id: options.mcpServerId,
+            name: options.mcpServerName,
+            allowed: true,
+            url: options.mcpServerUrl,
+            agentHost
+        }]);
+        authenticationMcpService.updateAccountPreference(options.mcpServerId, providerId, session.account);
+    }
+    authenticationMcpUsageService.addAccountUsage(
+        providerId,
+        session.account.label,
+        scopes,
+        options.mcpServerId,
+        options.mcpServerName
+    );
+    logService.info(
+        `${options.logPrefix} MCP authentication succeeded for ${options.mcpServerName}`
+    );
+}
+
+export { AgentHostAuthTokenCache, AgentHostAuthenticationRecovery, agentHostMcpServerId, authenticateAgentProtectedResourcesWithToken, authenticateProtectedResources, authenticateProtectedResourcesWithToken, modelRequiresAgentAuthentication, resolveAuthenticationInteractively, resolveMcpServerAuthentication, resolveSessionForResource, revokeAuthenticationForRemovedSessions };