@cursor/july 0.1.96 → 0.1.97

package/dist/internal/http-channel.js

@@ -22,7 +22,7 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
 import { samePrincipal } from "./auth.js";
 import { formatContinuationToken, parseContinuationToken } from "./ids.js";
 import { isLoopbackAddress } from "./net.js";
-import { ApprovalInterruptedError, ApprovalNotFoundError, HTTP_CHANNEL_ID, SessionAuthError, } from "./session-engine.js";
+import { ApprovalInterruptedError, ApprovalNotFoundError, AuthInterruptedError, AuthNotFoundError, HTTP_CHANNEL_ID, SessionAuthError, } from "./session-engine.js";
 import { eventsUrlForSession, playgroundUrlForSession, } from "./session-urls.js";
 const SESSION_ID_HEADER = "x-agent-serve-session-id";
 export function buildHttpChannelRoutes(args) {
@@ -324,6 +324,84 @@ export function buildHttpChannelRoutes(args) {
             return jsonResponse({ ok: true, interrupted }, { headers: { [SESSION_ID_HEADER]: sessionId } });
         }),
     };
+    const listAuths = {
+        method: "GET",
+        pattern: `${base}/v1/session/:sessionId/auths`,
+        auth,
+        handler: (_request, ctx) => __awaiter(this, void 0, void 0, function* () {
+            var _a;
+            const sessionId = (_a = ctx.params.sessionId) !== null && _a !== void 0 ? _a : "";
+            const record = yield engine.getOrRestoreSession(sessionId);
+            if (record === undefined) {
+                return errorResponse(404, "session_not_found", `Unknown session ${sessionId}.`);
+            }
+            const ownership = requireSessionOwner(record, ctx.auth, {
+                relax: relaxSessionReadAuth,
+                beyondLoopback: relaxSessionReadAuthBeyondLoopback,
+                requestIp: ctx.requestIp,
+            });
+            if (ownership !== undefined) {
+                return ownership;
+            }
+            const pending = yield engine.listPendingAuths(sessionId);
+            return jsonResponse({ ok: true, sessionId, pending });
+        }),
+    };
+    const resolveAuth = {
+        method: "POST",
+        pattern: `${base}/v1/session/:sessionId/auths/:callId`,
+        auth,
+        handler: (request, ctx) => __awaiter(this, void 0, void 0, function* () {
+            var _a;
+            var _b, _c;
+            const sessionId = (_b = ctx.params.sessionId) !== null && _b !== void 0 ? _b : "";
+            const callId = (_c = ctx.params.callId) !== null && _c !== void 0 ? _c : "";
+            const record = yield engine.getOrRestoreSession(sessionId);
+            if (record === undefined) {
+                return errorResponse(404, "session_not_found", `Unknown session ${sessionId}.`);
+            }
+            const bridgeSlackAuth = relaxSessionApprovalAuth === true &&
+                ((_a = record.auth) === null || _a === void 0 ? void 0 : _a.authenticator) === "slack" &&
+                (relaxSessionReadAuthBeyondLoopback === true ||
+                    (typeof ctx.requestIp === "string" &&
+                        isLoopbackAddress(ctx.requestIp)));
+            const ownership = requireSessionOwner(record, ctx.auth, {
+                relax: bridgeSlackAuth,
+                beyondLoopback: relaxSessionReadAuthBeyondLoopback,
+                requestIp: ctx.requestIp,
+            });
+            if (ownership !== undefined) {
+                return ownership;
+            }
+            const body = yield readJsonObject(request);
+            const decision = body === null || body === void 0 ? void 0 : body.decision;
+            if (decision !== "approve" && decision !== "deny") {
+                return errorResponse(400, "invalid_request", 'Expected a JSON body with `decision`: "approve" | "deny".');
+            }
+            try {
+                const pending = yield engine.resolveAuth(sessionId, callId, decision, ctx.auth, bridgeSlackAuth ? { asSessionOwner: true } : undefined);
+                return jsonResponse({
+                    ok: true,
+                    sessionId,
+                    callId,
+                    decision,
+                    connection: pending.connection,
+                });
+            }
+            catch (error) {
+                if (error instanceof AuthNotFoundError) {
+                    return errorResponse(404, "auth_not_found", error.message);
+                }
+                if (error instanceof AuthInterruptedError) {
+                    return errorResponse(409, "auth_interrupted", error.message);
+                }
+                if (error instanceof SessionAuthError) {
+                    return errorResponse(403, "forbidden", error.message);
+                }
+                throw error;
+            }
+        }),
+    };
     return [
         createSession,
         followUp,
@@ -333,6 +411,8 @@ export function buildHttpChannelRoutes(args) {
         cost,
         listApprovals,
         resolveApproval,
+        listAuths,
+        resolveAuth,
     ];
 }
 export function requireSessionOwner(record, caller, options) {

package/dist/internal/init-project.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"init-project.d.ts","sourceRoot":"","sources":["../../src/internal/init-project.ts"],"names":[],"mappings":"AAAA;;GAEG;AAoBH,OAAO,EAKL,KAAK,gBAAgB,EAEtB,MAAM,qBAAqB,CAAC;AAQ7B,MAAM,WAAW,kBAAkB;IACjC,gDAAgD;IAChD,GAAG,EAAE,MAAM,CAAC;IACZ,8DAA8D;IAC9D,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,+CAA+C;IAC/C,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,oDAAoD;IACpD,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,QAAQ,CAAC,EAAE,gBAAgB,CAAC;CAC7B;AAED,MAAM,MAAM,cAAc,GAAG,QAAQ,GAAG,OAAO,CAAC;AAEhD,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,cAAc,CAAC;CACxB;AAED,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,MAAM,CAAC;IAChB,iEAAiE;IACjE,KAAK,EAAE,aAAa,EAAE,CAAC;IACvB,2BAA2B;IAC3B,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,qDAAqD;IACrD,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB;AAkBD,wBAAgB,kBAAkB,IAAI,MAAM,EAAE,CAE7C;AAED,MAAM,MAAM,kBAAkB,GAC1B;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAA;CAAE,GAC5D;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAEnC,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,kBAAkB,CAyBhE;AAWD,MAAM,MAAM,eAAe,GAAG;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAE5E;;;;;GAKG;AACH,wBAAgB,eAAe,CAC7B,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,MAAM,GAAG,SAAS,GAC3B,eAAe,CAgCjB;AAUD,wBAAsB,WAAW,CAC/B,OAAO,EAAE,kBAAkB,GAC1B,OAAO,CAAC,iBAAiB,CAAC,CA6E5B;AAwDD,wBAAgB,QAAQ,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAEhD;AAWD,MAAM,WAAW,kCAAkC;IACjD;;;OAGG;IACH,KAAK,CAAC,EAAE,SAAS,GAAG,MAAM,CAAC;IAC3B,yDAAyD;IACzD,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE;QACd,OAAO,EAAE,MAAM,CAAC;QAChB,IAAI,EAAE,MAAM,EAAE,CAAC;QACf,GAAG,EAAE,MAAM,CAAC;QACZ,KAAK,EAAE,SAAS,GAAG,MAAM,CAAC;KAC3B,KAAK,OAAO,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACrD;AAED,MAAM,WAAW,iCAAiC;IAChD,EAAE,EAAE,OAAO,CAAC;IACZ,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED;;;GAGG;AACH,wBAAsB,2BAA2B,CAC/C,OAAO,EAAE,MAAM,EACf,OAAO,GAAE,kCAAuC,GAC/C,OAAO,CAAC,iCAAiC,CAAC,CAW5C;AAED,MAAM,WAAW,sBAAsB;IACrC,KAAK,CAAC,EAAE,SAAS,GAAG,MAAM,CAAC;IAC3B,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE;QACd,OAAO,EAAE,MAAM,CAAC;QAChB,IAAI,EAAE,MAAM,EAAE,CAAC;QACf,GAAG,EAAE,MAAM,CAAC;QACZ,KAAK,EAAE,SAAS,GAAG,MAAM,CAAC;KAC3B,KAAK,OAAO,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACpD,gEAAgE;IAChE,SAAS,CAAC,EAAE,CACV,OAAO,EAAE,MAAM,KACZ,MAAM,GAAG,SAAS,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;CACvD;AAED,MAAM,WAAW,qBAAqB;IACpC,EAAE,EAAE,OAAO,CAAC;IACZ,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,wEAAwE;IACxE,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED;;;;;GAKG;AACH,wBAAsB,eAAe,CACnC,OAAO,EAAE,MAAM,EACf,OAAO,GAAE,sBAA2B,GACnC,OAAO,CAAC,qBAAqB,CAAC,CAgChC;AAwHD,MAAM,WAAW,0BAA0B;IACzC,0CAA0C;IAC1C,OAAO,EAAE,MAAM,CAAC;IAChB,0DAA0D;IAC1D,KAAK,EAAE,aAAa,EAAE,CAAC;IACvB,+DAA+D;IAC/D,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAED,MAAM,WAAW,oBAAoB;IACnC,0CAA0C;IAC1C,OAAO,EAAE,MAAM,CAAC;IAChB,sCAAsC;IACtC,GAAG,EAAE,MAAM,CAAC;IACZ;;;OAGG;IACH,QAAQ,EAAE,OAAO,CAAC;IAClB;;;OAGG;IACH,SAAS,EAAE,OAAO,CAAC;IACnB,+DAA+D;IAC/D,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAED,MAAM,MAAM,kBAAkB,GAAG,0BAA0B,GACzD,oBAAoB,CAAC;AAMvB;;;GAGG;AACH,wBAAgB,yBAAyB,CACvC,OAAO,EAAE,0BAA0B,GAClC,MAAM,CAkBR;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,oBAAoB,GAAG,MAAM,CAgBzE;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,kBAAkB,GAAG,MAAM,CAErE;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAC7B,GAAG,EAAE,MAAM,EACX,OAAO,EAAE,MAAM,GACd,MAAM,GAAG,SAAS,CAQpB;AA8BD;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE;IACxC,OAAO,EAAE,MAAM,CAAC;IAChB,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,EAAE,OAAO,CAAC;IAClB,SAAS,EAAE,OAAO,CAAC;CACpB,GAAG,MAAM,EAAE,CAEX;AAED;;;GAGG;AACH,wBAAgB,cAAc,IAAI,IAAI,CAkCrC"}
+{"version":3,"file":"init-project.d.ts","sourceRoot":"","sources":["../../src/internal/init-project.ts"],"names":[],"mappings":"AAAA;;GAEG;AAoBH,OAAO,EAKL,KAAK,gBAAgB,EAEtB,MAAM,qBAAqB,CAAC;AAQ7B,MAAM,WAAW,kBAAkB;IACjC,gDAAgD;IAChD,GAAG,EAAE,MAAM,CAAC;IACZ,8DAA8D;IAC9D,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,+CAA+C;IAC/C,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,oDAAoD;IACpD,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,QAAQ,CAAC,EAAE,gBAAgB,CAAC;CAC7B;AAED,MAAM,MAAM,cAAc,GAAG,QAAQ,GAAG,OAAO,CAAC;AAEhD,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,cAAc,CAAC;CACxB;AAED,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,MAAM,CAAC;IAChB,iEAAiE;IACjE,KAAK,EAAE,aAAa,EAAE,CAAC;IACvB,2BAA2B;IAC3B,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,qDAAqD;IACrD,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB;AAmBD,wBAAgB,kBAAkB,IAAI,MAAM,EAAE,CAE7C;AAED,MAAM,MAAM,kBAAkB,GAC1B;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAA;CAAE,GAC5D;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAEnC,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,kBAAkB,CAyBhE;AAWD,MAAM,MAAM,eAAe,GAAG;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAE5E;;;;;GAKG;AACH,wBAAgB,eAAe,CAC7B,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,MAAM,GAAG,SAAS,GAC3B,eAAe,CAgCjB;AAUD,wBAAsB,WAAW,CAC/B,OAAO,EAAE,kBAAkB,GAC1B,OAAO,CAAC,iBAAiB,CAAC,CA6E5B;AAwDD,wBAAgB,QAAQ,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAEhD;AAWD,MAAM,WAAW,kCAAkC;IACjD;;;OAGG;IACH,KAAK,CAAC,EAAE,SAAS,GAAG,MAAM,CAAC;IAC3B,yDAAyD;IACzD,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE;QACd,OAAO,EAAE,MAAM,CAAC;QAChB,IAAI,EAAE,MAAM,EAAE,CAAC;QACf,GAAG,EAAE,MAAM,CAAC;QACZ,KAAK,EAAE,SAAS,GAAG,MAAM,CAAC;KAC3B,KAAK,OAAO,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACrD;AAED,MAAM,WAAW,iCAAiC;IAChD,EAAE,EAAE,OAAO,CAAC;IACZ,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED;;;GAGG;AACH,wBAAsB,2BAA2B,CAC/C,OAAO,EAAE,MAAM,EACf,OAAO,GAAE,kCAAuC,GAC/C,OAAO,CAAC,iCAAiC,CAAC,CAW5C;AAED,MAAM,WAAW,sBAAsB;IACrC,KAAK,CAAC,EAAE,SAAS,GAAG,MAAM,CAAC;IAC3B,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE;QACd,OAAO,EAAE,MAAM,CAAC;QAChB,IAAI,EAAE,MAAM,EAAE,CAAC;QACf,GAAG,EAAE,MAAM,CAAC;QACZ,KAAK,EAAE,SAAS,GAAG,MAAM,CAAC;KAC3B,KAAK,OAAO,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACpD,gEAAgE;IAChE,SAAS,CAAC,EAAE,CACV,OAAO,EAAE,MAAM,KACZ,MAAM,GAAG,SAAS,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;CACvD;AAED,MAAM,WAAW,qBAAqB;IACpC,EAAE,EAAE,OAAO,CAAC;IACZ,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,wEAAwE;IACxE,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED;;;;;GAKG;AACH,wBAAsB,eAAe,CACnC,OAAO,EAAE,MAAM,EACf,OAAO,GAAE,sBAA2B,GACnC,OAAO,CAAC,qBAAqB,CAAC,CAgChC;AAwHD,MAAM,WAAW,0BAA0B;IACzC,0CAA0C;IAC1C,OAAO,EAAE,MAAM,CAAC;IAChB,0DAA0D;IAC1D,KAAK,EAAE,aAAa,EAAE,CAAC;IACvB,+DAA+D;IAC/D,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAED,MAAM,WAAW,oBAAoB;IACnC,0CAA0C;IAC1C,OAAO,EAAE,MAAM,CAAC;IAChB,sCAAsC;IACtC,GAAG,EAAE,MAAM,CAAC;IACZ;;;OAGG;IACH,QAAQ,EAAE,OAAO,CAAC;IAClB;;;OAGG;IACH,SAAS,EAAE,OAAO,CAAC;IACnB,+DAA+D;IAC/D,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAED,MAAM,MAAM,kBAAkB,GAAG,0BAA0B,GACzD,oBAAoB,CAAC;AAMvB;;;GAGG;AACH,wBAAgB,yBAAyB,CACvC,OAAO,EAAE,0BAA0B,GAClC,MAAM,CAkBR;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,oBAAoB,GAAG,MAAM,CAgBzE;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,kBAAkB,GAAG,MAAM,CAErE;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAC7B,GAAG,EAAE,MAAM,EACX,OAAO,EAAE,MAAM,GACd,MAAM,GAAG,SAAS,CAQpB;AA8BD;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE;IACxC,OAAO,EAAE,MAAM,CAAC;IAChB,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,EAAE,OAAO,CAAC;IAClB,SAAS,EAAE,OAAO,CAAC;CACpB,GAAG,MAAM,EAAE,CAEX;AAED;;;GAGG;AACH,wBAAgB,cAAc,IAAI,IAAI,CAmCrC"}

package/dist/internal/init-project.js

@@ -22,6 +22,7 @@ import { agentsMd, GITIGNORE, writeDefaultScaffold } from "./init-scaffold.js";
 import { makePalette, stdoutPalette, } from "./terminal-style.js";
 const TEMPLATES = {
     "agentic-owners": { dir: "agentic-owners" },
+    "agents-md": { dir: "agents-md" },
     "code-wiki": { dir: "code-wiki" },
     demo: { dir: "demo" },
     "pr-autofixer": { dir: "pr-autofixer" },
@@ -499,6 +500,7 @@ Scaffold a project, then open the playground:
   npx ${PACKAGE_NAME} init ./my-agent   # installs deps + links agent-sdk onto PATH
   npx ${PACKAGE_NAME} init ./my-demo --template demo              # record a PR walkthrough
   npx ${PACKAGE_NAME} init ./code-wiki --template code-wiki       # keep wiki pages current after merge
+  npx ${PACKAGE_NAME} init ./agents-md --template agents-md       # keep AGENTS.md current from last week's PRs and Slack
   npx ${PACKAGE_NAME} init ./my-reviewer --template security-reviewer   # review PRs for security bugs
   npx ${PACKAGE_NAME} init ./security-help --template security-help   # answer security questions in Slack
   npx ${PACKAGE_NAME} init ./my-triage --template triage-linear   # comment on Linear issues

package/dist/internal/logs-client.d.ts

@@ -26,6 +26,11 @@ export declare function sanitizeCustomerError(message: string): string;
 /**
  * One-line label for `agent-sdk deploy` polling (TTY spinner / non-TTY
  * transitions). Uses statusMessage → progress → raw status.
+ *
+ * Deliberately does NOT include `lastError`. The spinner redraws with
+ * `\r\x1b[2K`, which clears one physical row, so a reason long enough to
+ * soft-wrap would leave the earlier rows on screen. Callers print the
+ * reason once on the final line instead.
  */
 export declare function deployProgressLabel(detail: {
     status: string;

package/dist/internal/logs-client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"logs-client.d.ts","sourceRoot":"","sources":["../../src/internal/logs-client.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAEL,KAAK,gBAAgB,EACrB,KAAK,kBAAkB,EACxB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAuB,KAAK,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAW7E,MAAM,WAAW,YAAY;IAC3B,KAAK,EAAE,MAAM,CAAC;IACd,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE,YAAY,EAAE,CAAC;IACxB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,MAAM,YAAY,GACpB,kBAAkB,GAClB,QAAQ,GACR,WAAW,GACX,UAAU,GACV,UAAU,GACV,UAAU,GACV,YAAY,GACZ,SAAS,GACT,QAAQ,GACR,UAAU,GACV,SAAS,GACT,UAAU,GACV,UAAU,CAAC;AAiBf;;;;GAIG;AACH,wBAAgB,eAAe,CAC7B,QAAQ,EAAE,YAAY,EACtB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,EACzB,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,GAC5B,MAAM,CAuBR;AAED,0EAA0E;AAC1E,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAa7D;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE;IAC1C,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,kBAAkB,CAAC;IAC9B,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC/B,GAAG,MAAM,CAiBT;AAED,wBAAsB,SAAS,CAAC,IAAI,EAAE;IACpC,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,WAAW,CAAC;IACnB,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IACzB,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB,GAAG,OAAO,CAAC,YAAY,CAAC,CA0BxB;AAED,MAAM,WAAW,kBAAkB;IACjC,+DAA+D;IAC/D,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IACzB,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,iCAAiC;IACjC,KAAK,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC/B,iCAAiC;IACjC,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC7B;;;OAGG;IACH,aAAa,CAAC,EAAE,MAAM,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAChD,mEAAmE;IACnE,cAAc,CAAC,EAAE,MAAM,OAAO,CAAC;QAC7B,QAAQ,EAAE,MAAM,CAAC;QACjB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;KAClC,CAAC,CAAC;IACH,KAAK,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,WAAW,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CAC7D;AAED,wBAAsB,WAAW,CAAC,OAAO,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC,CAoC5E"}
+{"version":3,"file":"logs-client.d.ts","sourceRoot":"","sources":["../../src/internal/logs-client.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAEL,KAAK,gBAAgB,EACrB,KAAK,kBAAkB,EACxB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAuB,KAAK,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAW7E,MAAM,WAAW,YAAY;IAC3B,KAAK,EAAE,MAAM,CAAC;IACd,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE,YAAY,EAAE,CAAC;IACxB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,MAAM,YAAY,GACpB,kBAAkB,GAClB,QAAQ,GACR,WAAW,GACX,UAAU,GACV,UAAU,GACV,UAAU,GACV,YAAY,GACZ,SAAS,GACT,QAAQ,GACR,UAAU,GACV,SAAS,GACT,UAAU,GACV,UAAU,CAAC;AAiBf;;;;GAIG;AACH,wBAAgB,eAAe,CAC7B,QAAQ,EAAE,YAAY,EACtB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,EACzB,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,GAC5B,MAAM,CAuBR;AAED,0EAA0E;AAC1E,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAa7D;AAED;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE;IAC1C,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,kBAAkB,CAAC;IAC9B,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC/B,GAAG,MAAM,CAiBT;AAED,wBAAsB,SAAS,CAAC,IAAI,EAAE;IACpC,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,WAAW,CAAC;IACnB,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IACzB,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB,GAAG,OAAO,CAAC,YAAY,CAAC,CA0BxB;AAED,MAAM,WAAW,kBAAkB;IACjC,+DAA+D;IAC/D,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IACzB,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,iCAAiC;IACjC,KAAK,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC/B,iCAAiC;IACjC,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC7B;;;OAGG;IACH,aAAa,CAAC,EAAE,MAAM,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAChD,mEAAmE;IACnE,cAAc,CAAC,EAAE,MAAM,OAAO,CAAC;QAC7B,QAAQ,EAAE,MAAM,CAAC;QACjB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;KAClC,CAAC,CAAC;IACH,KAAK,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,WAAW,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CAC7D;AAED,wBAAsB,WAAW,CAAC,OAAO,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC,CAoC5E"}

package/dist/internal/logs-client.js

@@ -78,6 +78,11 @@ export function sanitizeCustomerError(message) {
 /**
  * One-line label for `agent-sdk deploy` polling (TTY spinner / non-TTY
  * transitions). Uses statusMessage → progress → raw status.
+ *
+ * Deliberately does NOT include `lastError`. The spinner redraws with
+ * `\r\x1b[2K`, which clears one physical row, so a reason long enough to
+ * soft-wrap would leave the earlier rows on screen. Callers print the
+ * reason once on the final line instead.
  */
 export function deployProgressLabel(detail) {
     if (detail.statusMessage !== null &&

package/dist/internal/mcp-endpoint.js

@@ -200,7 +200,7 @@ function buildConnectionBridgeMcpServer(engine, sessionId, connectionName) {
         if (reason !== undefined) {
             throw new Error(reason);
         }
-        const tools = yield engine.host.mcp.listTools(connectionName);
+        const tools = yield engine.runWithMcpPark(sessionId !== null && sessionId !== void 0 ? sessionId : "", "tools/list", () => engine.host.mcp.listTools(connectionName));
         return {
             tools: tools.map((tool) => { var _a; return (Object.assign(Object.assign(Object.assign(Object.assign({ name: tool.name }, (tool.description === undefined
                 ? {}
@@ -212,7 +212,6 @@ function buildConnectionBridgeMcpServer(engine, sessionId, connectionName) {
         };
     }));
     server.setRequestHandler(CallToolRequestSchema, (request) => __awaiter(this, void 0, void 0, function* () {
-        var _a;
         const reason = rejected();
         if (reason !== undefined) {
             return errorResult(reason);
@@ -228,7 +227,7 @@ function buildConnectionBridgeMcpServer(engine, sessionId, connectionName) {
             return sdkResultToMcpResult(answer.result);
         }
         try {
-            const result = yield engine.host.mcp.callTool(connectionName, request.params.name, (_a = request.params.arguments) !== null && _a !== void 0 ? _a : {});
+            const result = yield engine.runWithMcpPark(sessionId !== null && sessionId !== void 0 ? sessionId : "", request.params.name, () => { var _a; return engine.host.mcp.callTool(connectionName, request.params.name, (_a = request.params.arguments) !== null && _a !== void 0 ? _a : {}); });
             return Object.assign(Object.assign({ 
                 // The host client already speaks MCP, so the content array is valid
                 // CallToolResult content; HostMcpCallResult just types the tail of

package/dist/internal/mcp-host.d.ts

@@ -10,6 +10,12 @@
  * and stay on `host.mcp` plus `mcp oauth`.
  */
 import type { DiscoveredConnection, HostMcpCallResult, HostMcpRegistry, HostMcpToolInfo, McpToolAnnotations } from "../types.js";
+export declare class McpNeedsAuthError extends Error {
+    readonly connection: string;
+    constructor(connection: string, cause?: unknown);
+}
+export declare function isMcpNeedsAuthError(error: unknown): error is McpNeedsAuthError;
+export declare function hostMcpCallNeedsAuth(result: HostMcpCallResult): boolean;
 /**
  * A non-caching view of one connection: every operation opens a fresh
  * client and closes it afterwards. See {@link McpHost.oneOff}.
@@ -21,7 +27,10 @@ export interface HostMcpOneOff {
 export declare class McpHost implements HostMcpRegistry {
     private readonly byName;
     private readonly clients;
+    private oauthRedirectUrl;
     constructor(connections: DiscoveredConnection[]);
+    /** Public serve callback for host OAuth (not the CLI loopback port on pods). */
+    setOAuthRedirectUrl(url: string): void;
     /**
      * Register a connection after construction (serve-time resolved peers).
      * Clients open lazily on first use, so adding before first call is safe.
@@ -40,6 +49,7 @@ export declare class McpHost implements HostMcpRegistry {
      */
     oneOff(connection: DiscoveredConnection): HostMcpOneOff;
     callTool(connectionName: string, toolName: string, args?: Record<string, unknown>): Promise<HostMcpCallResult>;
+    dropClient(name: string): Promise<void>;
     close(): Promise<void>;
     /**
      * Run against a cached host MCP client, reconnecting once when the remote

package/dist/internal/mcp-host.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mcp-host.d.ts","sourceRoot":"","sources":["../../src/internal/mcp-host.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAOH,OAAO,KAAK,EACV,oBAAoB,EACpB,iBAAiB,EACjB,eAAe,EACf,eAAe,EAEf,kBAAkB,EACnB,MAAM,aAAa,CAAC;AASrB;;;GAGG;AACH,MAAM,WAAW,aAAa;IAC5B,SAAS,IAAI,OAAO,CAAC,eAAe,EAAE,CAAC,CAAC;IACxC,QAAQ,CACN,QAAQ,EAAE,MAAM,EAChB,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC7B,OAAO,CAAC,iBAAiB,CAAC,CAAC;CAC/B;AAED,qBAAa,OAAQ,YAAW,eAAe;IAC7C,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA2C;IAClE,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAgD;IAExE,YAAY,WAAW,EAAE,oBAAoB,EAAE,EAI9C;IAED;;;OAGG;IACH,aAAa,CAAC,UAAU,EAAE,oBAAoB,GAAG,IAAI,CAEpD;IAED,KAAK,IAAI,MAAM,EAAE,CAEhB;IAEK,SAAS,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,EAAE,CAAC,CAKlE;IAED;;;;;;;;OAQG;IACH,MAAM,CAAC,UAAU,EAAE,oBAAoB,GAAG,aAAa,CA0BtD;IAEK,QAAQ,CACZ,cAAc,EAAE,MAAM,EACtB,QAAQ,EAAE,MAAM,EAChB,IAAI,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAM,GACjC,OAAO,CAAC,iBAAiB,CAAC,CAQ5B;IAEK,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAU3B;IAED;;;;;;;;OAQG;YACW,UAAU;IAiBxB,OAAO,CAAC,SAAS;YAYH,gBAAgB;YAiBhB,OAAO;CAUtB;AAED,+BAA+B;AAC/B,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAU9D;AAKD;;;;;;;;;;;GAWG;AACH,wBAAgB,sBAAsB,CACpC,WAAW,EAAE,OAAO,GACnB,kBAAkB,GAAG,SAAS,CAyBhC"}
+{"version":3,"file":"mcp-host.d.ts","sourceRoot":"","sources":["../../src/internal/mcp-host.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAOH,OAAO,KAAK,EACV,oBAAoB,EACpB,iBAAiB,EACjB,eAAe,EACf,eAAe,EAEf,kBAAkB,EACnB,MAAM,aAAa,CAAC;AAIrB,qBAAa,iBAAkB,SAAQ,KAAK;IAC1C,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAE5B,YAAY,UAAU,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,OAAO,EAS9C;CACF;AAED,wBAAgB,mBAAmB,CACjC,KAAK,EAAE,OAAO,GACb,KAAK,IAAI,iBAAiB,CAE5B;AAED,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,iBAAiB,GAAG,OAAO,CAQvE;AAiBD;;;GAGG;AACH,MAAM,WAAW,aAAa;IAC5B,SAAS,IAAI,OAAO,CAAC,eAAe,EAAE,CAAC,CAAC;IACxC,QAAQ,CACN,QAAQ,EAAE,MAAM,EAChB,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC7B,OAAO,CAAC,iBAAiB,CAAC,CAAC;CAC/B;AAED,qBAAa,OAAQ,YAAW,eAAe;IAC7C,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA2C;IAClE,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAgD;IACxE,OAAO,CAAC,gBAAgB,CAAqB;IAE7C,YAAY,WAAW,EAAE,oBAAoB,EAAE,EAI9C;IAED,gFAAgF;IAChF,mBAAmB,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAErC;IAED;;;OAGG;IACH,aAAa,CAAC,UAAU,EAAE,oBAAoB,GAAG,IAAI,CAEpD;IAED,KAAK,IAAI,MAAM,EAAE,CAEhB;IAEK,SAAS,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,EAAE,CAAC,CAKlE;IAED;;;;;;;;OAQG;IACH,MAAM,CAAC,UAAU,EAAE,oBAAoB,GAAG,aAAa,CA8BtD;IAEK,QAAQ,CACZ,cAAc,EAAE,MAAM,EACtB,QAAQ,EAAE,MAAM,EAChB,IAAI,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAM,GACjC,OAAO,CAAC,iBAAiB,CAAC,CAQ5B;IAEK,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAW5C;IAEK,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAU3B;IAED;;;;;;;;OAQG;YACW,UAAU;IAiBxB,OAAO,CAAC,SAAS;YAYH,gBAAgB;YAiBhB,OAAO;CAUtB;AAED,+BAA+B;AAC/B,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAU9D;AAKD;;;;;;;;;;;GAWG;AACH,wBAAgB,sBAAsB,CACpC,WAAW,EAAE,OAAO,GACnB,kBAAkB,GAAG,SAAS,CAyBhC"}

package/dist/internal/mcp-host.js

@@ -25,6 +25,34 @@ import { StdioClientTransport } from "@modelcontextprotocol/sdk/client/stdio.js"
 import { StreamableHTTPClientTransport } from "@modelcontextprotocol/sdk/client/streamableHttp.js";
 import { CLI_COMMAND_NAME as CLI } from "./distribution.js";
 import { createHostMcpOAuthProvider } from "./mcp-oauth.js";
+export class McpNeedsAuthError extends Error {
+    constructor(connection, cause) {
+        super(`MCP connection "${connection}" needs authorization. Run \`${CLI} mcp oauth ${connection}\`.`);
+        this.name = "McpNeedsAuthError";
+        this.connection = connection;
+        if (cause !== undefined) {
+            this.cause = cause;
+        }
+    }
+}
+export function isMcpNeedsAuthError(error) {
+    return error instanceof McpNeedsAuthError;
+}
+export function hostMcpCallNeedsAuth(result) {
+    if (result.isError !== true) {
+        return false;
+    }
+    const text = result.content
+        .map((part) => (part.type === "text" ? part.text : ""))
+        .join("\n");
+    return text.includes("needsAuth") || text.includes("needs authorization");
+}
+function throwIfCallNeedsAuth(connection, result) {
+    if (hostMcpCallNeedsAuth(result)) {
+        throw new McpNeedsAuthError(connection);
+    }
+    return result;
+}
 export class McpHost {
     constructor(connections) {
         this.byName = new Map();
@@ -33,6 +61,10 @@ export class McpHost {
             this.byName.set(connection.name, connection);
         }
     }
+    /** Public serve callback for host OAuth (not the CLI loopback port on pods). */
+    setOAuthRedirectUrl(url) {
+        this.oauthRedirectUrl = url;
+    }
     /**
      * Register a connection after construction (serve-time resolved peers).
      * Clients open lazily on first use, so adding before first call is safe.
@@ -61,8 +93,9 @@ export class McpHost {
      * mapping as registry calls.
      */
     oneOff(connection) {
+        const redirectUrl = this.oauthRedirectUrl;
         const withFreshClient = (run) => __awaiter(this, void 0, void 0, function* () {
-            const opened = yield openConnection(connection);
+            const opened = yield openConnection(connection, redirectUrl);
             try {
                 return yield run(opened.client);
             }
@@ -80,7 +113,7 @@ export class McpHost {
                     name: toolName,
                     arguments: args,
                 });
-                return normalizeCallResult(result);
+                return throwIfCallNeedsAuth(connection.name, normalizeCallResult(result));
             })),
         };
     }
@@ -91,10 +124,25 @@ export class McpHost {
                     name: toolName,
                     arguments: args,
                 });
-                return normalizeCallResult(result);
+                return throwIfCallNeedsAuth(connectionName, normalizeCallResult(result));
             }));
         });
     }
+    dropClient(name) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const pending = this.clients.get(name);
+            this.clients.delete(name);
+            if (pending === undefined) {
+                return;
+            }
+            try {
+                yield (yield pending).close();
+            }
+            catch (_a) {
+                // Best-effort teardown.
+            }
+        });
+    }
     close() {
         return __awaiter(this, void 0, void 0, function* () {
             const opened = yield Promise.allSettled([...this.clients.values()]);
@@ -165,7 +213,7 @@ export class McpHost {
                 const known = this.names().join(", ") || "(none)";
                 throw new Error(`Unknown MCP connection "${name}". Authored MCP connections: ${known}.`);
             }
-            return openConnection(connection);
+            return openConnection(connection, this.oauthRedirectUrl);
         });
     }
 }
@@ -229,20 +277,20 @@ function toToolInfo(tool) {
         ? {}
         : { outputSchema: tool.outputSchema })), (annotations === undefined ? {} : { annotations }));
 }
-function openConnection(connection) {
+function openConnection(connection, oauthRedirectUrl) {
     return __awaiter(this, void 0, void 0, function* () {
         const client = new Client({
             name: "agent-serve",
             version: "0.1.0",
         });
-        const transport = yield createTransport(connection);
+        const transport = yield createTransport(connection, oauthRedirectUrl);
         try {
             yield client.connect(transport);
         }
         catch (error) {
             if (error instanceof UnauthorizedError &&
                 isOauthHttpTransport(connection.transport)) {
-                throw new Error(`MCP connection "${connection.name}" needs authorization. Run \`${CLI} mcp oauth ${connection.name}\`.`, { cause: error });
+                throw new McpNeedsAuthError(connection.name, error);
             }
             throw error;
         }
@@ -266,7 +314,7 @@ function openConnection(connection) {
         };
     });
 }
-function createTransport(connection) {
+function createTransport(connection, oauthRedirectUrl) {
     return __awaiter(this, void 0, void 0, function* () {
         var _a;
         const transport = connection.transport;
@@ -292,6 +340,7 @@ function createTransport(connection) {
             ? yield createHostMcpOAuthProvider({
                 identifier: connection.name,
                 resourceUrl: transport.url,
+                redirectUrl: oauthRedirectUrl,
             })
             : undefined;
         if (transport.type === "sse") {

package/dist/internal/mcp-oauth-on-demand.d.ts

@@ -0,0 +1,68 @@
+/**
+ * Mid-run host MCP OAuth: mint an authUrl, finish on the public serve
+ * callback (file tokens). Deployment secrets persist from the
+ * authenticated park, not from that callback.
+ *
+ * CLI `mcp oauth` still uses the loopback callback. This path is recovery
+ * and first-use without a separate `--store` step.
+ */
+import { FileMcpOAuthStore } from "./mcp-oauth.js";
+import { type McpOauthSecretsTarget, type ResolveHostedMcpOauthSecretsArgs } from "./mcp-oauth-persist.js";
+export declare function mcpOauthServeCallbackPath(basePath?: string): string;
+export declare function mcpOauthServeCallbackUrl(origin: string, basePath?: string): string;
+export type BeginHostMcpOauthResult = {
+    status: "authorized";
+} | {
+    status: "needs_auth";
+    authUrl: string;
+    state: string;
+    finish: (code: string) => Promise<void>;
+    abort: () => Promise<void>;
+};
+export declare function beginHostMcpOauth(args: {
+    connection: string;
+    url: string;
+    type?: "http" | "sse";
+    headers?: Record<string, string>;
+    redirectUrl: string;
+    store?: FileMcpOAuthStore;
+}): Promise<BeginHostMcpOauthResult>;
+export type McpOauthCompleteResult = {
+    connection: string;
+    sessionId?: string;
+    callId?: string;
+};
+export declare class McpOauthOnDemandHub {
+    private readonly attempts;
+    private readonly completed;
+    private readonly finishing;
+    private readonly aborted;
+    callbackUrl: string | undefined;
+    secrets?: McpOauthSecretsTarget;
+    secretsBind?: ResolveHostedMcpOauthSecretsArgs;
+    logger?: (line: string) => void;
+    private store?;
+    mint(args: {
+        connection: string;
+        url: string;
+        type?: "http" | "sse";
+        headers?: Record<string, string>;
+        sessionId?: string;
+    }): Promise<{
+        authUrl: string;
+        state: string;
+    } | {
+        authorized: true;
+    }>;
+    abortCall(sessionId: string, callId: string): Promise<void>;
+    abortSession(sessionId: string): Promise<void>;
+    close(): Promise<void>;
+    private dropWhere;
+    bind(state: string, sessionId: string, callId: string): "pending" | "already_done" | "unknown";
+    complete(state: string, code: string): Promise<McpOauthCompleteResult>;
+    private finishAttempt;
+    private fileStore;
+    persistFor(connection: string, resourceUrl: string): Promise<void>;
+    handleCallback(request: Request): Promise<Response>;
+}
+//# sourceMappingURL=mcp-oauth-on-demand.d.ts.map

package/dist/internal/mcp-oauth-on-demand.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-oauth-on-demand.d.ts","sourceRoot":"","sources":["../../src/internal/mcp-oauth-on-demand.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAQH,OAAO,EAEL,iBAAiB,EAElB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,KAAK,qBAAqB,EAC1B,KAAK,gCAAgC,EAGtC,MAAM,wBAAwB,CAAC;AAEhC,wBAAgB,yBAAyB,CAAC,QAAQ,SAAK,GAAG,MAAM,CAE/D;AAED,wBAAgB,wBAAwB,CACtC,MAAM,EAAE,MAAM,EACd,QAAQ,SAAK,GACZ,MAAM,CAER;AAED,MAAM,MAAM,uBAAuB,GAC/B;IAAE,MAAM,EAAE,YAAY,CAAA;CAAE,GACxB;IACE,MAAM,EAAE,YAAY,CAAC;IACrB,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACxC,KAAK,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CAC5B,CAAC;AAEN,wBAAsB,iBAAiB,CAAC,IAAI,EAAE;IAC5C,UAAU,EAAE,MAAM,CAAC;IACnB,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,CAAC,EAAE,MAAM,GAAG,KAAK,CAAC;IACtB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,CAAC,EAAE,iBAAiB,CAAC;CAC3B,GAAG,OAAO,CAAC,uBAAuB,CAAC,CAoEnC;AAWD,MAAM,MAAM,sBAAsB,GAAG;IACnC,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,CAAC;AAEF,qBAAa,mBAAmB;IAC9B,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAmC;IAC5D,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAmC;IAC7D,OAAO,CAAC,QAAQ,CAAC,SAAS,CAGtB;IACJ,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAqB;IAC7C,WAAW,EAAE,MAAM,GAAG,SAAS,CAAC;IAChC,OAAO,CAAC,EAAE,qBAAqB,CAAC;IAEhC,WAAW,CAAC,EAAE,gCAAgC,CAAC;IAC/C,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAChC,OAAO,CAAC,KAAK,CAAC,CAAoB;IAE5B,IAAI,CAAC,IAAI,EAAE;QACf,UAAU,EAAE,MAAM,CAAC;QACnB,GAAG,EAAE,MAAM,CAAC;QACZ,IAAI,CAAC,EAAE,MAAM,GAAG,KAAK,CAAC;QACtB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACjC,SAAS,CAAC,EAAE,MAAM,CAAC;KACpB,GAAG,OAAO,CAAC;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG;QAAE,UAAU,EAAE,IAAI,CAAA;KAAE,CAAC,CAsBrE;IAEK,SAAS,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAKhE;IAEK,YAAY,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAEnD;IAEK,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAE3B;YAEa,SAAS;IAyBvB,IAAI,CACF,KAAK,EAAE,MAAM,EACb,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,MAAM,GACb,SAAS,GAAG,cAAc,GAAG,SAAS,CAcxC;IAEK,QAAQ,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAe3E;YAEa,aAAa;IAqB3B,OAAO,CAAC,SAAS;IAKX,UAAU,CAAC,UAAU,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CA4BvE;IAEK,cAAc,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,CAyBxD;CACF"}