@corenel/mcp 0.5.0 → 0.6.0

package/dist/asAgentTools.d.ts

@@ -1,5 +1,17 @@
-import type { AgentTool } from '@corenel/protocol';
+import type { AgentTool, JsonSchema } from '@corenel/protocol';
 import type { McpRegistry } from './registry';
+/** `McpTool.inputSchema` is `unknown` -- some servers send no schema at all,
+ *  or something that isn't a JSON Schema object. Never pass that through as
+ *  `undefined`: an `AgentTool` with no `parameters` is one a model can call
+ *  with any arguments at all, which is worse than an (accurate) empty one. */
+export declare function toParameters(inputSchema: unknown): JsonSchema;
+/** MCP's `tools/call` result content is `unknown` by the time it reaches
+ *  here (httpClient.ts passes the JSON-RPC `result.content` through as-is).
+ *  The common shape per the MCP spec is an array of content blocks
+ *  (`{ type: 'text', text }` and friends); join the text blocks the way the
+ *  model expects a tool result to read, and fall back to JSON for anything
+ *  that isn't that shape rather than losing the payload. */
+export declare function formatContent(content: unknown): string;
 /** Build one `AgentTool` per registry entry, in the registry's order.
  *
  * A server/tool pair whose name can't be safely packed into a wire name

package/dist/asAgentTools.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"asAgentTools.d.ts","sourceRoot":"","sources":["../src/asAgentTools.ts"],"names":[],"mappings":"AAoBA,OAAO,KAAK,EAAE,SAAS,EAAc,MAAM,mBAAmB,CAAC;AAC/D,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAoC9C;;;;;;;oDAOoD;AACpD,wBAAgB,YAAY,CAAC,QAAQ,EAAE,WAAW,GAAG,SAAS,EAAE,CAa/D"}
+{"version":3,"file":"asAgentTools.d.ts","sourceRoot":"","sources":["../src/asAgentTools.ts"],"names":[],"mappings":"AAoBA,OAAO,KAAK,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAC/D,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAQ9C;;;8EAG8E;AAC9E,wBAAgB,YAAY,CAAC,WAAW,EAAE,OAAO,GAAG,UAAU,CAG7D;AAED;;;;;4DAK4D;AAC5D,wBAAgB,aAAa,CAAC,OAAO,EAAE,OAAO,GAAG,MAAM,CAWtD;AAED;;;;;;;oDAOoD;AACpD,wBAAgB,YAAY,CAAC,QAAQ,EAAE,WAAW,GAAG,SAAS,EAAE,CAa/D"}

package/dist/asAgentTools.js

@@ -6,7 +6,7 @@ function isPlainObject(v) {
  *  or something that isn't a JSON Schema object. Never pass that through as
  *  `undefined`: an `AgentTool` with no `parameters` is one a model can call
  *  with any arguments at all, which is worse than an (accurate) empty one. */
-function toParameters(inputSchema) {
+export function toParameters(inputSchema) {
     if (isPlainObject(inputSchema))
         return inputSchema;
     return { type: 'object', properties: {} };
@@ -17,7 +17,7 @@ function toParameters(inputSchema) {
  *  (`{ type: 'text', text }` and friends); join the text blocks the way the
  *  model expects a tool result to read, and fall back to JSON for anything
  *  that isn't that shape rather than losing the payload. */
-function formatContent(content) {
+export function formatContent(content) {
     if (typeof content === 'string')
         return content;
     if (Array.isArray(content)) {

package/dist/asAgentTools.js.map

@@ -1 +1 @@
-{"version":3,"file":"asAgentTools.js","sourceRoot":"","sources":["../src/asAgentTools.ts"],"names":[],"mappings":"AAuBA,OAAO,EAAE,oBAAoB,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAEhF,SAAS,aAAa,CAAC,CAAU;IAC/B,OAAO,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;AAClE,CAAC;AAED;;;8EAG8E;AAC9E,SAAS,YAAY,CAAC,WAAoB;IACxC,IAAI,aAAa,CAAC,WAAW,CAAC;QAAE,OAAO,WAAW,CAAC;IACnD,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC;AAC5C,CAAC;AAED;;;;;4DAK4D;AAC5D,SAAS,aAAa,CAAC,OAAgB;IACrC,IAAI,OAAO,OAAO,KAAK,QAAQ;QAAE,OAAO,OAAO,CAAC;IAChD,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QAC3B,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;YAClC,IAAI,aAAa,CAAC,KAAK,CAAC,IAAI,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ;gBAAE,OAAO,KAAK,CAAC,IAAI,CAAC;YAC9E,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QAC/B,CAAC,CAAC,CAAC;QACH,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1B,CAAC;IACD,IAAI,OAAO,IAAI,IAAI;QAAE,OAAO,EAAE,CAAC;IAC/B,OAAO,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;AACjC,CAAC;AAED;;;;;;;oDAOoD;AACpD,MAAM,UAAU,YAAY,CAAC,QAAqB;IAChD,MAAM,GAAG,GAAgB,EAAE,CAAC;IAC5B,KAAK,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,QAAQ,CAAC,KAAK,EAAE,EAAE,CAAC;QAChD,IAAI,CAAC,oBAAoB,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAC7C,OAAO,CAAC,KAAK,CACX,6BAA6B,MAAM,WAAW,IAAI,CAAC,IAAI,qCAAqC;gBAC1F,iFAAiF,CACpF,CAAC;YACF,SAAS;QACX,CAAC;QACD,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC;IAChD,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,WAAW,CAAC,QAAqB,EAAE,MAAc,EAAE,IAAa;IACvE,MAAM,IAAI,GAAG,WAAW,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;IAC5C,MAAM,OAAO,GAAG,cAAc,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;IAClD,OAAO;QACL,IAAI;QACJ,SAAS,EAAE,KAAK;QAChB,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,IAAI,EAAE,IAAI,aAAa,IAAI,CAAC,IAAI,gBAAgB,MAAM,MAAM,OAAO,IAAI;QACtG,UAAU,EAAE,YAAY,CAAC,IAAI,CAAC,WAAW,CAAC;QAC1C,OAAO,EAAE,IAAI;QACb,KAAK,CAAC,GAAG,CAAC,IAAI;YACZ,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;YAC5D,MAAM,IAAI,GAAG,aAAa,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;YAC3C,OAAO,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;QAClD,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"asAgentTools.js","sourceRoot":"","sources":["../src/asAgentTools.ts"],"names":[],"mappings":"AAuBA,OAAO,EAAE,oBAAoB,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAEhF,SAAS,aAAa,CAAC,CAAU;IAC/B,OAAO,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;AAClE,CAAC;AAED;;;8EAG8E;AAC9E,MAAM,UAAU,YAAY,CAAC,WAAoB;IAC/C,IAAI,aAAa,CAAC,WAAW,CAAC;QAAE,OAAO,WAAW,CAAC;IACnD,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC;AAC5C,CAAC;AAED;;;;;4DAK4D;AAC5D,MAAM,UAAU,aAAa,CAAC,OAAgB;IAC5C,IAAI,OAAO,OAAO,KAAK,QAAQ;QAAE,OAAO,OAAO,CAAC;IAChD,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QAC3B,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;YAClC,IAAI,aAAa,CAAC,KAAK,CAAC,IAAI,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ;gBAAE,OAAO,KAAK,CAAC,IAAI,CAAC;YAC9E,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QAC/B,CAAC,CAAC,CAAC;QACH,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1B,CAAC;IACD,IAAI,OAAO,IAAI,IAAI;QAAE,OAAO,EAAE,CAAC;IAC/B,OAAO,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;AACjC,CAAC;AAED;;;;;;;oDAOoD;AACpD,MAAM,UAAU,YAAY,CAAC,QAAqB;IAChD,MAAM,GAAG,GAAgB,EAAE,CAAC;IAC5B,KAAK,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,QAAQ,CAAC,KAAK,EAAE,EAAE,CAAC;QAChD,IAAI,CAAC,oBAAoB,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAC7C,OAAO,CAAC,KAAK,CACX,6BAA6B,MAAM,WAAW,IAAI,CAAC,IAAI,qCAAqC;gBAC1F,iFAAiF,CACpF,CAAC;YACF,SAAS;QACX,CAAC;QACD,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC;IAChD,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,WAAW,CAAC,QAAqB,EAAE,MAAc,EAAE,IAAa;IACvE,MAAM,IAAI,GAAG,WAAW,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;IAC5C,MAAM,OAAO,GAAG,cAAc,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;IAClD,OAAO;QACL,IAAI;QACJ,SAAS,EAAE,KAAK;QAChB,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,IAAI,EAAE,IAAI,aAAa,IAAI,CAAC,IAAI,gBAAgB,MAAM,MAAM,OAAO,IAAI;QACtG,UAAU,EAAE,YAAY,CAAC,IAAI,CAAC,WAAW,CAAC;QAC1C,OAAO,EAAE,IAAI;QACb,KAAK,CAAC,GAAG,CAAC,IAAI;YACZ,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;YAC5D,MAAM,IAAI,GAAG,aAAa,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;YAC3C,OAAO,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;QAClD,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/auth.d.ts

@@ -1,3 +1,4 @@
+import { type McpCredentialSlot } from './config';
 import type { McpServer } from './types';
 /** True when `url` is an https URL on the ORIGIN of one of `bases` and its path
  *  is a hosted-relay path (`.../mcp/hosted/<name>`). Origin, not suffix: a
@@ -31,5 +32,5 @@ export interface AuthProvider {
  * a stub without a real socket -- production callers (Task 6) pass none and
  * get the real network.
  */
-export declare function authProviderFor(stateDir: string, server: McpServer, fetchImpl?: typeof fetch, accountToken?: () => Promise<string | null>, relayBases?: () => Promise<readonly string[]>, devApiBases?: readonly string[]): AuthProvider;
+export declare function authProviderFor(stateDir: string, server: McpServer, fetchImpl?: typeof fetch, accountToken?: () => Promise<string | null>, relayBases?: () => Promise<readonly string[]>, devApiBases?: readonly string[], slot?: McpCredentialSlot): AuthProvider;
 //# sourceMappingURL=auth.d.ts.map

package/dist/auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":"AA4BA,OAAO,KAAK,EAAE,SAAS,EAAsB,MAAM,SAAS,CAAC;AAS7D;;;;;;;;+DAQ+D;AAC/D,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,MAAM,EAAE,EAAE,WAAW,GAAE,SAAS,MAAM,EAAO,GAAG,OAAO,CAUrH;AAOD,MAAM,WAAW,YAAY;IAC3B;;;8EAG0E;IAC1E,OAAO,IAAI,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC,CAAC;IACtD;;;mEAG+D;IAC/D,cAAc,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC;CACpC;AASD;;;;;;GAMG;AACH,wBAAgB,eAAe,CAC7B,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,SAAS,EACjB,SAAS,GAAE,OAAO,KAAa,EAW/B,YAAY,GAAE,MAAM,OAAO,CAAC,MAAM,GAAG,IAAI,CAAoB,EAG7D,UAAU,GAAE,MAAM,OAAO,CAAC,SAAS,MAAM,EAAE,CAAkB,EAG7D,WAAW,GAAE,SAAS,MAAM,EAAO,GAClC,YAAY,CA0Dd"}
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":"AA2BA,OAAO,EAAsE,KAAK,iBAAiB,EAAE,MAAM,UAAU,CAAC;AACtH,OAAO,KAAK,EAAE,SAAS,EAAsB,MAAM,SAAS,CAAC;AAS7D;;;;;;;;+DAQ+D;AAC/D,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,MAAM,EAAE,EAAE,WAAW,GAAE,SAAS,MAAM,EAAO,GAAG,OAAO,CAUrH;AAOD,MAAM,WAAW,YAAY;IAC3B;;;8EAG0E;IAC1E,OAAO,IAAI,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC,CAAC;IACtD;;;mEAG+D;IAC/D,cAAc,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC;CACpC;AASD;;;;;;GAMG;AACH,wBAAgB,eAAe,CAC7B,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,SAAS,EACjB,SAAS,GAAE,OAAO,KAAa,EAW/B,YAAY,GAAE,MAAM,OAAO,CAAC,MAAM,GAAG,IAAI,CAAoB,EAG7D,UAAU,GAAE,MAAM,OAAO,CAAC,SAAS,MAAM,EAAE,CAAkB,EAG7D,WAAW,GAAE,SAAS,MAAM,EAAO,EAGnC,IAAI,GAAE,iBAA+B,GACpC,YAAY,CAuEd"}

package/dist/auth.js

@@ -19,16 +19,16 @@
  *     static header that was just rejected is pure latency, never a fix.
  *
  * This module owns the refresh (`oauth/tokens.ts`) and expiry decision, and
- * persists a refreshed credential back through `writeMcpCredential` before
+ * persists a refreshed credential back through `replaceMcpCredentialIfUnchanged` before
  * handing out its headers -- Task 6's client must never read or write
  * auth.json itself, or the two would drift the way daemon.json/auth.json
  * already drift when two writers touch one file without a merge (see
  * mcp/config.ts's module comment).
  */
-import { readMcpCredential, writeMcpCredential } from './config.js';
+import { readMcpCredentialFor, replaceMcpCredentialIfUnchanged, SERVER_SLOT } from './config.js';
 import { discoverAuthMetadata } from './oauth/discovery.js';
 import { refresh as refreshOAuthToken, isExpired } from './oauth/tokens.js';
-import { DEFAULT_API_BASE } from '@corenel/protocol';
+import { DEFAULT_API_BASE, AGENT_CREDENTIAL_MISSING } from '@corenel/protocol';
 function safeOrigin(url) {
     try {
         return new URL(url).origin;
@@ -98,19 +98,32 @@ accountToken = async () => null,
 relayBases = async () => [], 
 /* The source-run dev profile's API base, when the daemon is on it (see
  * isCorenelRelayUrl). Empty in a production run. */
-devApiBases = []) {
+devApiBases = [], 
+/* Whose credential (spec 2026-10-01 Part D). An agent slot reads only that
+ * agent's entry and never the server's own. */
+slot = SERVER_SLOT) {
     async function doRefresh(cred) {
         if (!cred.refreshToken) {
+            /* An agent's sign-in is its owner's to redo; the server-slot command
+             * below would sign the DAEMON in, not the agent. */
+            if (slot.kind === 'agent') {
+                throw new Error(`${AGENT_CREDENTIAL_MISSING}: the agent credential for MCP server "${server.name}" has expired and has no refresh token; the agent's owner must sign the agent in again.`);
+            }
             throw new Error(`"${server.name}" has no refresh token on file -- run: corenel mcp login ${server.name}`);
         }
         const meta = await discoverAuthMetadata(cred.authServer, fetchImpl);
         const refreshed = await refreshOAuthToken(meta, cred, fetchImpl);
-        await writeMcpCredential(stateDir, server.name, refreshed);
+        /* Written only if the stored credential is still the one refreshed: a
+         * clear or replace that landed while the refresh was in flight wins, and
+         * this refreshed token (of the old credential) is discarded. */
+        if (!(await replaceMcpCredentialIfUnchanged(stateDir, server.name, slot, cred, refreshed))) {
+            throw new Error(`The credential for MCP server "${server.name}" changed while it was being refreshed; retry the call.`);
+        }
         return refreshed;
     }
     return {
         async headers() {
-            const cred = await readMcpCredential(stateDir, server.name);
+            const cred = await readMcpCredentialFor(stateDir, server.name, slot);
             /* A HOSTED server may legitimately have no credential yet: the relay is
              * still reachable with the account token alone, and the upstream 401 is
              * what carries the WWW-Authenticate that starts the OAuth flow. A direct
@@ -122,6 +135,9 @@ devApiBases = []) {
             if (server.hosted && !isCorenelRelayUrl(server.url, [DEFAULT_API_BASE, ...(await relayBases())], devApiBases)) {
                 throw new Error(`"${server.name}" is marked hosted but ${safeOrigin(server.url)} is not a Corenel relay; refusing to send the account token there.`);
             }
+            if (!cred && slot.kind === 'agent') {
+                throw new Error(`${AGENT_CREDENTIAL_MISSING}: no agent credential is set for MCP server "${server.name}"`);
+            }
             if (!cred && !server.hosted) {
                 throw new Error(`No credential stored for MCP server "${server.name}" -- run: corenel mcp login ${server.name} (or set-header, for a static token).`);
             }
@@ -138,7 +154,7 @@ devApiBases = []) {
             return account ? [...moved, { name: 'Authorization', value: `Bearer ${account}` }] : moved;
         },
         async onUnauthorized() {
-            const cred = await readMcpCredential(stateDir, server.name);
+            const cred = await readMcpCredentialFor(stateDir, server.name, slot);
             // Nothing to refresh: no credential at all, or a static header --
             // retrying a header the server just rejected fixes nothing.
             if (!cred || cred.kind !== 'oauth')

package/dist/auth.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth.js","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,OAAO,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,MAAM,UAAU,CAAC;AAEjE,OAAO,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AACzD,OAAO,EAAE,OAAO,IAAI,iBAAiB,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AACzE,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAErD,SAAS,UAAU,CAAC,GAAW;IAC7B,IAAI,CAAC;QAAC,OAAO,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,SAAS,CAAC;IAAC,CAAC;AACjE,CAAC;AAED;;;;;;;;+DAQ+D;AAC/D,MAAM,UAAU,iBAAiB,CAAC,GAAW,EAAE,KAAwB,EAAE,cAAiC,EAAE;IAC1G,IAAI,CAAM,CAAC;IACX,IAAI,CAAC;QAAC,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,KAAK,CAAC;IAAC,CAAC;IACjD,IAAI,CAAC,0BAA0B,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC;QAAE,OAAO,KAAK,CAAC;IAC/D,MAAM,UAAU,GAAG,CAAC,CAAS,EAAW,EAAE;QACxC,IAAI,CAAC;YAAC,OAAO,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC;YAAC,OAAO,KAAK,CAAC;QAAC,CAAC;IACxE,CAAC,CAAC;IACF,IAAI,CAAC,CAAC,QAAQ,KAAK,QAAQ;QAAE,OAAO,CAAC,GAAG,KAAK,EAAE,GAAG,WAAW,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAChF,IAAI,CAAC,CAAC,QAAQ,KAAK,OAAO,IAAI,cAAc,CAAC,CAAC,CAAC,QAAQ,CAAC;QAAE,OAAO,WAAW,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAC9F,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,cAAc,CAAC,QAAgB;IACtC,MAAM,CAAC,GAAG,QAAQ,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IACzD,OAAO,CAAC,KAAK,WAAW,IAAI,CAAC,KAAK,WAAW,IAAI,CAAC,KAAK,KAAK,CAAC;AAC/D,CAAC;AAsBD;;;;;;GAMG;AACH,MAAM,UAAU,eAAe,CAC7B,QAAgB,EAChB,MAAiB,EACjB,YAA0B,KAAK;AAC/B;;;;;;;;;sBASsB;AACtB,eAA6C,KAAK,IAAI,EAAE,CAAC,IAAI;AAC7D;sEACsE;AACtE,aAA+C,KAAK,IAAI,EAAE,CAAC,EAAE;AAC7D;oDACoD;AACpD,cAAiC,EAAE;IAEnC,KAAK,UAAU,SAAS,CAAC,IAAwB;QAC/C,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;YACvB,MAAM,IAAI,KAAK,CAAC,IAAI,MAAM,CAAC,IAAI,4DAA4D,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;QAC5G,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,oBAAoB,CAAC,IAAI,CAAC,UAAU,EAAE,SAAsC,CAAC,CAAC;QACjG,MAAM,SAAS,GAAG,MAAM,iBAAiB,CAAC,IAAI,EAAE,IAAI,EAAE,SAAoC,CAAC,CAAC;QAC5F,MAAM,kBAAkB,CAAC,QAAQ,EAAE,MAAM,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;QAC3D,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,OAAO;QACL,KAAK,CAAC,OAAO;YACX,MAAM,IAAI,GAAG,MAAM,iBAAiB,CAAC,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;YAC5D;;;mFAGuE;YACvE;;;wCAG4B;YAC5B,IAAI,MAAM,CAAC,MAAM,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,gBAAgB,EAAE,GAAG,CAAC,MAAM,UAAU,EAAE,CAAC,CAAC,EAAE,WAAW,CAAC,EAAE,CAAC;gBAC9G,MAAM,IAAI,KAAK,CAAC,IAAI,MAAM,CAAC,IAAI,0BAA0B,UAAU,CAAC,MAAM,CAAC,GAAG,CAAC,oEAAoE,CAAC,CAAC;YACvJ,CAAC;YACD,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;gBAC5B,MAAM,IAAI,KAAK,CAAC,wCAAwC,MAAM,CAAC,IAAI,+BAA+B,MAAM,CAAC,IAAI,uCAAuC,CAAC,CAAC;YACxJ,CAAC;YAED,MAAM,UAAU,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE;gBAC3B,CAAC,CAAC,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO;oBACtC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,KAAK,EAAE,UAAU,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;YAE/H,IAAI,CAAC,MAAM,CAAC,MAAM;gBAAE,OAAO,UAAU,CAAC;YAEtC;;mEAEuD;YACvD,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAClC,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,eAAe,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,qBAAqB,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,CAC/F,CAAC,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,YAAY,EAAE,CAAC;YACrC,OAAO,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,KAAK,EAAE,EAAE,IAAI,EAAE,eAAe,EAAE,KAAK,EAAE,UAAU,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;QAC7F,CAAC;QAED,KAAK,CAAC,cAAc;YAClB,MAAM,IAAI,GAAG,MAAM,iBAAiB,CAAC,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;YAC5D,kEAAkE;YAClE,4DAA4D;YAC5D,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,KAAK,OAAO;gBAAE,OAAO,KAAK,CAAC;YACjD,IAAI,CAAC;gBACH,MAAM,SAAS,CAAC,IAAI,CAAC,CAAC;gBACtB,OAAO,IAAI,CAAC;YACd,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,KAAK,CAAC;YACf,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,OAAO,EAAE,oBAAoB,EAAE,+BAA+B,EAAE,WAAW,EAA0B,MAAM,UAAU,CAAC;AAEtH,OAAO,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AACzD,OAAO,EAAE,OAAO,IAAI,iBAAiB,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AACzE,OAAO,EAAE,gBAAgB,EAAE,wBAAwB,EAAE,MAAM,mBAAmB,CAAC;AAE/E,SAAS,UAAU,CAAC,GAAW;IAC7B,IAAI,CAAC;QAAC,OAAO,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,SAAS,CAAC;IAAC,CAAC;AACjE,CAAC;AAED;;;;;;;;+DAQ+D;AAC/D,MAAM,UAAU,iBAAiB,CAAC,GAAW,EAAE,KAAwB,EAAE,cAAiC,EAAE;IAC1G,IAAI,CAAM,CAAC;IACX,IAAI,CAAC;QAAC,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,KAAK,CAAC;IAAC,CAAC;IACjD,IAAI,CAAC,0BAA0B,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC;QAAE,OAAO,KAAK,CAAC;IAC/D,MAAM,UAAU,GAAG,CAAC,CAAS,EAAW,EAAE;QACxC,IAAI,CAAC;YAAC,OAAO,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC;YAAC,OAAO,KAAK,CAAC;QAAC,CAAC;IACxE,CAAC,CAAC;IACF,IAAI,CAAC,CAAC,QAAQ,KAAK,QAAQ;QAAE,OAAO,CAAC,GAAG,KAAK,EAAE,GAAG,WAAW,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAChF,IAAI,CAAC,CAAC,QAAQ,KAAK,OAAO,IAAI,cAAc,CAAC,CAAC,CAAC,QAAQ,CAAC;QAAE,OAAO,WAAW,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAC9F,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,cAAc,CAAC,QAAgB;IACtC,MAAM,CAAC,GAAG,QAAQ,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IACzD,OAAO,CAAC,KAAK,WAAW,IAAI,CAAC,KAAK,WAAW,IAAI,CAAC,KAAK,KAAK,CAAC;AAC/D,CAAC;AAsBD;;;;;;GAMG;AACH,MAAM,UAAU,eAAe,CAC7B,QAAgB,EAChB,MAAiB,EACjB,YAA0B,KAAK;AAC/B;;;;;;;;;sBASsB;AACtB,eAA6C,KAAK,IAAI,EAAE,CAAC,IAAI;AAC7D;sEACsE;AACtE,aAA+C,KAAK,IAAI,EAAE,CAAC,EAAE;AAC7D;oDACoD;AACpD,cAAiC,EAAE;AACnC;+CAC+C;AAC/C,OAA0B,WAAW;IAErC,KAAK,UAAU,SAAS,CAAC,IAAwB;QAC/C,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;YACvB;gEACoD;YACpD,IAAI,IAAI,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;gBAC1B,MAAM,IAAI,KAAK,CAAC,GAAG,wBAAwB,0CAA0C,MAAM,CAAC,IAAI,yFAAyF,CAAC,CAAC;YAC7L,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,IAAI,MAAM,CAAC,IAAI,4DAA4D,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;QAC5G,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,oBAAoB,CAAC,IAAI,CAAC,UAAU,EAAE,SAAsC,CAAC,CAAC;QACjG,MAAM,SAAS,GAAG,MAAM,iBAAiB,CAAC,IAAI,EAAE,IAAI,EAAE,SAAoC,CAAC,CAAC;QAC5F;;wEAEgE;QAChE,IAAI,CAAC,CAAC,MAAM,+BAA+B,CAAC,QAAQ,EAAE,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC,EAAE,CAAC;YAC3F,MAAM,IAAI,KAAK,CAAC,kCAAkC,MAAM,CAAC,IAAI,yDAAyD,CAAC,CAAC;QAC1H,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,OAAO;QACL,KAAK,CAAC,OAAO;YACX,MAAM,IAAI,GAAG,MAAM,oBAAoB,CAAC,QAAQ,EAAE,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;YACrE;;;mFAGuE;YACvE;;;wCAG4B;YAC5B,IAAI,MAAM,CAAC,MAAM,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,gBAAgB,EAAE,GAAG,CAAC,MAAM,UAAU,EAAE,CAAC,CAAC,EAAE,WAAW,CAAC,EAAE,CAAC;gBAC9G,MAAM,IAAI,KAAK,CAAC,IAAI,MAAM,CAAC,IAAI,0BAA0B,UAAU,CAAC,MAAM,CAAC,GAAG,CAAC,oEAAoE,CAAC,CAAC;YACvJ,CAAC;YACD,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;gBACnC,MAAM,IAAI,KAAK,CAAC,GAAG,wBAAwB,gDAAgD,MAAM,CAAC,IAAI,GAAG,CAAC,CAAC;YAC7G,CAAC;YACD,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;gBAC5B,MAAM,IAAI,KAAK,CAAC,wCAAwC,MAAM,CAAC,IAAI,+BAA+B,MAAM,CAAC,IAAI,uCAAuC,CAAC,CAAC;YACxJ,CAAC;YAED,MAAM,UAAU,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE;gBAC3B,CAAC,CAAC,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO;oBACtC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,KAAK,EAAE,UAAU,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;YAE/H,IAAI,CAAC,MAAM,CAAC,MAAM;gBAAE,OAAO,UAAU,CAAC;YAEtC;;mEAEuD;YACvD,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAClC,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,eAAe,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,qBAAqB,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,CAC/F,CAAC,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,YAAY,EAAE,CAAC;YACrC,OAAO,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,KAAK,EAAE,EAAE,IAAI,EAAE,eAAe,EAAE,KAAK,EAAE,UAAU,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;QAC7F,CAAC;QAED,KAAK,CAAC,cAAc;YAClB,MAAM,IAAI,GAAG,MAAM,oBAAoB,CAAC,QAAQ,EAAE,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;YACrE,kEAAkE;YAClE,4DAA4D;YAC5D,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,KAAK,OAAO;gBAAE,OAAO,KAAK,CAAC;YACjD,IAAI,CAAC;gBACH,MAAM,SAAS,CAAC,IAAI,CAAC,CAAC;gBACtB,OAAO,IAAI,CAAC;YACd,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,KAAK,CAAC;YACf,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/config.d.ts

@@ -82,4 +82,33 @@ export declare function clearMcpCredential(stateDir: string, server: string): Pr
  *  registered OAuth client. Called whenever a server is removed. */
 export declare function forgetMcpServerSecrets(stateDir: string, server: string): Promise<void>;
 export declare function writeMcpCredential(stateDir: string, server: string, cred: McpCredential): Promise<void>;
+/** Whose credential a call uses: the server's own (auth.json `mcp`), or one
+ * team agent's (auth.json `agents[accessKey]`, spec 2026-10-01 Part D). An
+ * agent slot NEVER falls back to the server's: that would be the daemon's
+ * credential acting for the agent. */
+export type McpCredentialSlot = {
+    kind: 'server';
+} | {
+    kind: 'agent';
+    accessKey: string;
+};
+export declare const SERVER_SLOT: McpCredentialSlot;
+export declare function readMcpCredentialFor(stateDir: string, server: string, slot: McpCredentialSlot): Promise<McpCredential | null>;
+export declare function writeMcpCredentialFor(stateDir: string, server: string, slot: McpCredentialSlot, cred: McpCredential): Promise<void>;
+/**
+ * Write `next` into `slot`'s credential for `server` ONLY if the stored one is
+ * still `expected`, in one read-modify-write (Task 9 review fix round 1).
+ *
+ * A token refresh reads a credential, goes to the network, and writes the
+ * result back. If the owner cleared or replaced the credential meanwhile, an
+ * unconditional write would bring the revoked one back and persist it. Returns
+ * false, writing nothing, when the slot is empty or holds something else.
+ * Reads strictly (docForClear): an unreadable auth.json throws, and a missing
+ * or corrupt one holds nothing to replace.
+ */
+export declare function replaceMcpCredentialIfUnchanged(stateDir: string, server: string, slot: McpCredentialSlot, expected: McpCredential, next: McpCredential): Promise<boolean>;
+/** Forget one agent's credential for one server. */
+export declare function clearAgentCredential(stateDir: string, accessKey: string, server: string): Promise<void>;
+/** Forget every credential of one agent (the agent was deleted). */
+export declare function clearAgentCredentials(stateDir: string, accessKey: string): Promise<void>;
 //# sourceMappingURL=config.d.ts.map

package/dist/config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAoCA,OAAO,KAAK,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAUxD;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,cAAc,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC,CAyBzF;AAED;;gDAEgD;AAChD,wBAAsB,eAAe,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAG3F;AAmDD;;;;uBAIuB;AACvB,wBAAsB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,CAMvG;AAED;;;;;GAKG;AACH,mFAAmF;AACnF,MAAM,WAAW,mBAAmB;IAClC,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;yEAEqE;IACrE,UAAU,EAAE,MAAM,CAAC;IACnB;;;;;;;;sDAQkD;IAClD,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAaD;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,aAAa,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,GAAG,IAAI,CAAC,CAMzG;AAED;;+DAE+D;AAC/D,wBAAsB,cAAc,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,mBAAmB,GAAG,OAAO,CAAC,IAAI,CAAC,CAiBjH;AAED;;gEAEgE;AAChE,wBAAsB,cAAc,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAYpF;AAED;;yDAEyD;AACzD,wBAAsB,kBAAkB,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAWxF;AAED;oEACoE;AACpE,wBAAsB,sBAAsB,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAG5F;AAED,wBAAsB,kBAAkB,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CAa7G"}
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAqCA,OAAO,KAAK,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAUxD;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,cAAc,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC,CAyBzF;AAED;;gDAEgD;AAChD,wBAAsB,eAAe,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAG3F;AAqFD;;;;uBAIuB;AACvB,wBAAsB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,CAMvG;AAED;;;;;GAKG;AACH,mFAAmF;AACnF,MAAM,WAAW,mBAAmB;IAClC,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;yEAEqE;IACrE,UAAU,EAAE,MAAM,CAAC;IACnB;;;;;;;;sDAQkD;IAClD,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAaD;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,aAAa,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,GAAG,IAAI,CAAC,CAMzG;AAED;;+DAE+D;AAC/D,wBAAsB,cAAc,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,mBAAmB,GAAG,OAAO,CAAC,IAAI,CAAC,CAWjH;AAED;;gEAEgE;AAChE,wBAAsB,cAAc,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAWpF;AAED;;yDAEyD;AACzD,wBAAsB,kBAAkB,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAUxF;AAED;oEACoE;AACpE,wBAAsB,sBAAsB,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAI5F;AAED,wBAAsB,kBAAkB,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CAQ7G;AAED;;;sCAGsC;AACtC,MAAM,MAAM,iBAAiB,GAAG;IAAE,IAAI,EAAE,QAAQ,CAAA;CAAE,GAAG;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAAC;AAE1F,eAAO,MAAM,WAAW,EAAE,iBAAsC,CAAC;AAkDjE,wBAAsB,oBAAoB,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,iBAAiB,GAAG,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,CAWnI;AAED,wBAAsB,qBAAqB,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,iBAAiB,EAAE,IAAI,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CAczI;AAiBD;;;;;;;;;;GAUG;AACH,wBAAsB,+BAA+B,CACnD,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,iBAAiB,EACvB,QAAQ,EAAE,aAAa,EACvB,IAAI,EAAE,aAAa,GAClB,OAAO,CAAC,OAAO,CAAC,CAIlB;AAkCD,oDAAoD;AACpD,wBAAsB,oBAAoB,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAe7G;AAED,oEAAoE;AACpE,wBAAsB,qBAAqB,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAU9F"}

package/dist/config.js

@@ -20,10 +20,11 @@
  *      replacing the whole file instead of merging into it would sign the user
  *      out (or drop an unrelated server's credential) as a side effect of an
  *      MCP write neither operation has any business touching. The other
- *      direction of that same merge matters too: auth/store.ts's
- *      `saveCredential` (every sign-in and token refresh) must preserve this
- *      module's `mcp` section rather than overwrite the whole file with just
- *      the user's own credential -- see the comment there.
+ *      direction of that same merge matters too: @corenel/tools-node's
+ *      `writeLoginCredential` (every sign-in) and `clearAllCredentials`
+ *      (every sign-out) must preserve this module's `mcp`, `mcpClients` and
+ *      `agents` sections rather than replace or delete the whole file -- see
+ *      the comments there.
  *
  *   3. readMcpCredential holds a stored entry to the SAME "never partially
  *      applied" standard as readMcpServers: `isUsableCredential` checks the
@@ -31,8 +32,8 @@
  *      half-written credential reads as absent, not as a broken one handed to
  *      a caller.
  */
-import { readFile, writeFile, mkdir, chmod } from 'node:fs/promises';
-import { credentialFilePath, credentialDir } from '@corenel/tools-node';
+import { readFile, mkdir } from 'node:fs/promises';
+import { credentialFilePath, credentialDir, writeFilePrivateAtomic, readAuthDocForWrite, backupCorruptAuthDoc, withAuthDocLock } from '@corenel/tools-node';
 import { readDaemonConfig, readDaemonConfigLayered, writeDaemonConfig } from '@corenel/config';
 /** True for a value that is a usable {name,url} server entry -- the shape
  *  `readMcpServers` requires of every element it keeps. */
@@ -95,7 +96,12 @@ export async function writeMcpServers(stateDir, servers) {
 }
 /** Read auth.json as a bag of top-level keys, never throwing -- a missing or
  *  corrupt file reads as empty, exactly like readDaemonConfig treats
- *  daemon.json, so a credential lookup can never crash the daemon. */
+ *  daemon.json, so a credential lookup can never crash the daemon.
+ *
+ *  READ-ONLY callers only. A writer must not use this: taking a file it could
+ *  not read as empty and writing the document back drops every other section
+ *  (`mcp`, `mcpClients`, `agents`, the sign-in). Writers use docForWrite or
+ *  docForClear below. */
 async function readAuthJson(stateDir) {
     let raw;
     try {
@@ -114,6 +120,34 @@ async function readAuthJson(stateDir) {
         return {};
     }
 }
+/** Every read-modify-write of auth.json below runs under this process's
+ *  auth.json lock (@corenel/tools-node withAuthDocLock, shared with sign-in
+ *  and sign-out), so two writers never read the same document and the second
+ *  rename never drops the first one's change. Not re-entrant: a locked body
+ *  never calls another locked writer. */
+function locked(stateDir, fn) {
+    return withAuthDocLock(credentialFilePath(stateDir), fn);
+}
+/** auth.json for a writer that ADDS or REPLACES something: the same read a
+ *  sign-in does (@corenel/tools-node readAuthDocForWrite). Missing is `{}`; a
+ *  file that exists but cannot be read throws before anything is written; a
+ *  corrupt one is backed up to `auth.json.bad-<ms>` and then reads as `{}`. */
+async function docForWrite(stateDir) {
+    const path = credentialFilePath(stateDir);
+    const read = await readAuthDocForWrite(path, 'save');
+    if (read.kind === 'doc')
+        return read.doc;
+    if (read.kind === 'corrupt')
+        await backupCorruptAuthDoc(path, read.bytes);
+    return {};
+}
+/** auth.json for a writer that only REMOVES something: null when there is
+ *  nothing to remove from (missing, or corrupt, which holds nothing usable and
+ *  is left exactly as it is). Throws on a read error, like docForWrite. */
+async function docForClear(stateDir) {
+    const read = await readAuthDocForWrite(credentialFilePath(stateDir), 'save');
+    return read.kind === 'doc' ? read.doc : null;
+}
 function isMcpAuthSection(v) {
     return typeof v === 'object' && v !== null && !Array.isArray(v);
 }
@@ -189,84 +223,265 @@ export async function readMcpClient(stateDir, server) {
  *  writeMcpCredential does -- same file, same 0600, same preservation of every
  *  other key including ones this build knows nothing about. */
 export async function writeMcpClient(stateDir, server, client) {
-    const doc = await readAuthJson(stateDir);
-    const prev = doc.mcpClients;
-    const section = (typeof prev === 'object' && prev !== null && !Array.isArray(prev))
-        ? { ...prev }
-        : {};
-    section[server] = client;
-    const next = { ...doc, mcpClients: section };
-    const path = credentialFilePath(stateDir);
-    await mkdir(credentialDir(stateDir), { recursive: true });
-    await writeFile(path, `${JSON.stringify(next, null, 2)}
-`, { mode: 0o600 });
-    try {
-        await chmod(path, 0o600);
-    }
-    catch {
-        /* best effort on platforms without POSIX modes, matching auth/store.ts */
-    }
+    assertServerName(server);
+    await locked(stateDir, async () => {
+        const doc = await docForWrite(stateDir);
+        const prev = doc.mcpClients;
+        const section = (typeof prev === 'object' && prev !== null && !Array.isArray(prev))
+            ? { ...prev }
+            : {};
+        section[server] = client;
+        await writeAuthJson(stateDir, { ...doc, mcpClients: section });
+    });
 }
 /** Forget `server`'s registered client, so the next sign-in registers afresh.
  *  Used when a server rejects the stored client_id -- the registration is gone
  *  on their side and keeping it only reproduces the failure. */
 export async function clearMcpClient(stateDir, server) {
-    const doc = await readAuthJson(stateDir);
-    const prev = doc.mcpClients;
-    if (typeof prev !== 'object' || prev === null || Array.isArray(prev))
-        return;
-    const section = { ...prev };
-    if (!(server in section))
-        return;
-    delete section[server];
-    const path = credentialFilePath(stateDir);
-    await mkdir(credentialDir(stateDir), { recursive: true });
-    await writeFile(path, `${JSON.stringify({ ...doc, mcpClients: section }, null, 2)}
-`, { mode: 0o600 });
-    try {
-        await chmod(path, 0o600);
-    }
-    catch { /* as above */ }
+    await locked(stateDir, async () => {
+        const doc = await docForClear(stateDir);
+        if (!doc)
+            return;
+        const prev = doc.mcpClients;
+        if (typeof prev !== 'object' || prev === null || Array.isArray(prev))
+            return;
+        const section = { ...prev };
+        if (!(server in section))
+            return;
+        delete section[server];
+        await writeAuthJson(stateDir, { ...doc, mcpClients: section });
+    });
 }
 /** Forget `server`'s stored credential. Credentials are keyed by NAME, so a
  *  removed server's credential must go with it: otherwise a later add under
  *  the same name -- pointing anywhere -- inherits it. */
 export async function clearMcpCredential(stateDir, server) {
-    const doc = await readAuthJson(stateDir);
-    if (!isMcpAuthSection(doc.mcp))
-        return;
-    const section = { ...doc.mcp };
-    if (!(server in section))
-        return;
-    delete section[server];
-    const path = credentialFilePath(stateDir);
-    await mkdir(credentialDir(stateDir), { recursive: true });
-    await writeFile(path, `${JSON.stringify({ ...doc, mcp: section }, null, 2)}
-`, { mode: 0o600 });
-    try {
-        await chmod(path, 0o600);
-    }
-    catch { /* best effort, as above */ }
+    await locked(stateDir, async () => {
+        const doc = await docForClear(stateDir);
+        if (!doc)
+            return;
+        if (!isMcpAuthSection(doc.mcp))
+            return;
+        const section = { ...doc.mcp };
+        if (!(server in section))
+            return;
+        delete section[server];
+        await writeAuthJson(stateDir, { ...doc, mcp: section });
+    });
 }
 /** Everything stored for `server` in auth.json: its credential and its
  *  registered OAuth client. Called whenever a server is removed. */
 export async function forgetMcpServerSecrets(stateDir, server) {
     await clearMcpCredential(stateDir, server);
     await clearMcpClient(stateDir, server);
+    await clearServerFromAllAgents(stateDir, server);
 }
 export async function writeMcpCredential(stateDir, server, cred) {
-    const doc = await readAuthJson(stateDir);
-    const section = isMcpAuthSection(doc.mcp) ? { ...doc.mcp } : {};
-    section[server] = cred;
-    const next = { ...doc, mcp: section };
-    const path = credentialFilePath(stateDir);
+    assertServerName(server);
+    await locked(stateDir, async () => {
+        const doc = await docForWrite(stateDir);
+        const section = isMcpAuthSection(doc.mcp) ? { ...doc.mcp } : {};
+        section[server] = cred;
+        await writeAuthJson(stateDir, { ...doc, mcp: section });
+    });
+}
+export const SERVER_SLOT = { kind: 'server' };
+/** Bound on an access key used as a JSON key: it is wire-reachable. */
+const MAX_ACCESS_KEY_LEN = 512;
+/** `__proto__` as a key of a plain object sets its PROTOTYPE instead of an
+ *  own property, so the write would vanish (JSON.stringify skips it) or, read
+ *  back, resolve to Object.prototype. Refused wherever a wire-reachable string
+ *  becomes a key in auth.json. */
+const FORBIDDEN_KEY = '__proto__';
+function assertAccessKey(accessKey) {
+    if (typeof accessKey !== 'string' || !accessKey || accessKey.length > MAX_ACCESS_KEY_LEN || accessKey === FORBIDDEN_KEY) {
+        throw new Error('invalid agent access key');
+    }
+}
+function assertServerName(server) {
+    if (typeof server !== 'string' || !server || server === FORBIDDEN_KEY) {
+        throw new Error('invalid MCP server name');
+    }
+}
+/** auth.json `agents`, or an empty object for absent or malformed. */
+function agentsOf(doc) {
+    const s = doc.agents;
+    return typeof s === 'object' && s !== null && !Array.isArray(s) ? { ...s } : {};
+}
+/** The ONE auth.json writer in this module: a 0600 temp file beside it,
+ *  renamed over it (@corenel/tools-node writeFilePrivateAtomic, the same
+ *  publish a sign-in uses). A truncate-then-fill write is seen half-done by a
+ *  concurrent reader, and a sign-in reading a torn file to keep these sections
+ *  would read it as empty. */
+async function writeAuthJson(stateDir, next) {
     await mkdir(credentialDir(stateDir), { recursive: true });
-    await writeFile(path, `${JSON.stringify(next, null, 2)}\n`, { mode: 0o600 });
     try {
-        await chmod(path, 0o600);
+        await writeFilePrivateAtomic(credentialFilePath(stateDir), `${JSON.stringify(next, null, 2)}\n`);
     }
-    catch {
-        /* best effort on platforms without POSIX modes, matching auth/store.ts */
+    catch (err) {
+        /* Windows refuses a rename over a file another process holds open. The
+         * live file is untouched (the temp is cleaned up), so this is a retry,
+         * not a loss: say so, and keep the code for anything that branches on it. */
+        const code = typeof err === 'object' && err !== null ? err.code : undefined;
+        if (code === 'EPERM' || code === 'EBUSY') {
+            throw Object.assign(new Error(`auth.json is in use; retry (${code})`), { code });
+        }
+        throw err;
+    }
+}
+export async function readMcpCredentialFor(stateDir, server, slot) {
+    if (slot.kind === 'server')
+        return readMcpCredential(stateDir, server);
+    assertAccessKey(slot.accessKey);
+    assertServerName(server);
+    const agents = agentsOf(await readAuthJson(stateDir));
+    if (!Object.prototype.hasOwnProperty.call(agents, slot.accessKey))
+        return null;
+    const perAgent = agents[slot.accessKey];
+    if (!isMcpAuthSection(perAgent))
+        return null;
+    if (!Object.prototype.hasOwnProperty.call(perAgent, server))
+        return null;
+    const cred = perAgent[server];
+    return isUsableCredential(cred) ? cred : null;
+}
+export async function writeMcpCredentialFor(stateDir, server, slot, cred) {
+    if (slot.kind === 'server')
+        return writeMcpCredential(stateDir, server, cred);
+    assertAccessKey(slot.accessKey);
+    assertServerName(server);
+    const key = slot.accessKey;
+    await locked(stateDir, async () => {
+        const doc = await docForWrite(stateDir);
+        const agents = agentsOf(doc);
+        const prev = agents[key];
+        const perAgent = isMcpAuthSection(prev) ? { ...prev } : {};
+        perAgent[server] = cred;
+        agents[key] = perAgent;
+        await writeAuthJson(stateDir, { ...doc, agents });
+    });
+}
+/** True when `stored` is still the credential `expected` was read as: same
+ *  kind and, for OAuth, the same refresh token (or access token when there is
+ *  none); for headers, the same header list. */
+function sameCredential(stored, expected) {
+    if (stored.kind === 'oauth' && expected.kind === 'oauth') {
+        return expected.refreshToken !== undefined
+            ? stored.refreshToken === expected.refreshToken
+            : stored.refreshToken === undefined && stored.accessToken === expected.accessToken;
+    }
+    if (stored.kind === 'headers' && expected.kind === 'headers') {
+        return JSON.stringify(stored.headers) === JSON.stringify(expected.headers);
+    }
+    return false;
+}
+/**
+ * Write `next` into `slot`'s credential for `server` ONLY if the stored one is
+ * still `expected`, in one read-modify-write (Task 9 review fix round 1).
+ *
+ * A token refresh reads a credential, goes to the network, and writes the
+ * result back. If the owner cleared or replaced the credential meanwhile, an
+ * unconditional write would bring the revoked one back and persist it. Returns
+ * false, writing nothing, when the slot is empty or holds something else.
+ * Reads strictly (docForClear): an unreadable auth.json throws, and a missing
+ * or corrupt one holds nothing to replace.
+ */
+export async function replaceMcpCredentialIfUnchanged(stateDir, server, slot, expected, next) {
+    assertServerName(server);
+    if (slot.kind === 'agent')
+        assertAccessKey(slot.accessKey);
+    return locked(stateDir, () => replaceIfUnchangedLocked(stateDir, server, slot, expected, next));
+}
+async function replaceIfUnchangedLocked(stateDir, server, slot, expected, next) {
+    const doc = await docForClear(stateDir);
+    if (!doc)
+        return false;
+    if (slot.kind === 'server') {
+        if (!isMcpAuthSection(doc.mcp))
+            return false;
+        const section = { ...doc.mcp };
+        if (!Object.prototype.hasOwnProperty.call(section, server))
+            return false;
+        const stored = section[server];
+        if (!isUsableCredential(stored) || !sameCredential(stored, expected))
+            return false;
+        section[server] = next;
+        await writeAuthJson(stateDir, { ...doc, mcp: section });
+        return true;
+    }
+    const agents = agentsOf(doc);
+    if (!Object.prototype.hasOwnProperty.call(agents, slot.accessKey))
+        return false;
+    const prev = agents[slot.accessKey];
+    if (!isMcpAuthSection(prev) || !Object.prototype.hasOwnProperty.call(prev, server))
+        return false;
+    const perAgent = { ...prev };
+    const stored = perAgent[server];
+    if (!isUsableCredential(stored) || !sameCredential(stored, expected))
+        return false;
+    perAgent[server] = next;
+    agents[slot.accessKey] = perAgent;
+    await writeAuthJson(stateDir, { ...doc, agents });
+    return true;
+}
+/** Forget one agent's credential for one server. */
+export async function clearAgentCredential(stateDir, accessKey, server) {
+    assertAccessKey(accessKey);
+    assertServerName(server);
+    await locked(stateDir, async () => {
+        const doc = await docForClear(stateDir);
+        if (!doc)
+            return;
+        const agents = agentsOf(doc);
+        const prev = agents[accessKey];
+        if (!isMcpAuthSection(prev) || !Object.prototype.hasOwnProperty.call(prev, server))
+            return;
+        const perAgent = { ...prev };
+        delete perAgent[server];
+        if (Object.keys(perAgent).length)
+            agents[accessKey] = perAgent;
+        else
+            delete agents[accessKey];
+        await writeAuthJson(stateDir, { ...doc, agents });
+    });
+}
+/** Forget every credential of one agent (the agent was deleted). */
+export async function clearAgentCredentials(stateDir, accessKey) {
+    assertAccessKey(accessKey);
+    await locked(stateDir, async () => {
+        const doc = await docForClear(stateDir);
+        if (!doc)
+            return;
+        const agents = agentsOf(doc);
+        if (!Object.prototype.hasOwnProperty.call(agents, accessKey))
+            return;
+        delete agents[accessKey];
+        await writeAuthJson(stateDir, { ...doc, agents });
+    });
+}
+/** Forget `server` from every agent: a removed server's agent credentials go
+ * with it, for the same reason its own credential does. */
+async function clearServerFromAllAgents(stateDir, server) {
+    await locked(stateDir, () => clearServerFromAllAgentsLocked(stateDir, server));
+}
+async function clearServerFromAllAgentsLocked(stateDir, server) {
+    const doc = await docForClear(stateDir);
+    if (!doc)
+        return;
+    const agents = agentsOf(doc);
+    let changed = false;
+    for (const [key, prev] of Object.entries(agents)) {
+        if (!isMcpAuthSection(prev) || !Object.prototype.hasOwnProperty.call(prev, server))
+            continue;
+        const perAgent = { ...prev };
+        delete perAgent[server];
+        if (Object.keys(perAgent).length)
+            agents[key] = perAgent;
+        else
+            delete agents[key];
+        changed = true;
     }
+    if (changed)
+        await writeAuthJson(stateDir, { ...doc, agents });
 }
 //# sourceMappingURL=config.js.map