@debugg-ai/debugg-ai-mcp 4.2.2 → 4.3.0

package/README.md

@@ -92,6 +92,8 @@ Naming an account only in `description` does **not** make the agent use it — i
 
 Set `useEnvironmentCredentials: false` when a silent fallback to the default test user would invalidate the check.
 
+**Cross-domain SSO?** A run only types credentials on the app's own host and its subdomains; a sign-in page on another domain is refused as `offscope_host`. Add the identity provider's host to the environment's `authorizedCredentialHosts` (see [`environment`](#environment)).
+
 **Checking a page that needs no login at all?** Pass `useEnvironmentCredentials: false` and name no account. That combination means exactly what it says — *do not log in* — and the run skips authentication entirely instead of hunting for a login form. Use it for public pages, marketing sites, docs, and anything pre-auth. It is also faster: on the default (`auto`) the agent will follow a "Log in" link off your page and try the environment's stored account before it evaluates anything.
 
 ##### Session reuse: why a check can report "no login form"
@@ -109,7 +111,9 @@ Results report the identity actually used, so a wrong one is visible rather than
 
 ```json
 "logins": [
-  { "username": "qa+invitefix@example.com", "source": "task", "submitted": true, "authenticated": true }
+  { "username": "qa+invitefix@example.com", "source": "task", "submitted": true, "authenticated": true },
+  { "username": "qatest123@example.com", "source": "env_default", "submitted": false, "authenticated": false,
+    "reason": "offscope_host", "detail": "refused to enter credentials on auth.idp.example: not part of this run's scope …" }
 ],
 "credentialWarning": {
   "requested": "qa+invitefix@example.com",
@@ -118,7 +122,7 @@ Results report the identity actually used, so a wrong one is visible rather than
 }
 ```
 
-`source` is `task` | `explicit` | `credential_id` (an account you named) or `env` | `env_default` (the environment's stored account). `credentialWarning` appears only when you named an account and an environment default was used anyway. `loginError` appears when a named account could not be resolved and the run declined to substitute a different one.
+`source` is `task` | `explicit` | `credential_id` (an account you named) or `env` | `env_default` (the environment's stored account). `submitted` is true only when credentials were actually typed and submitted; `reason` says what happened (e.g. `offscope_host`, `restored_session`), and `detail`, when present, is a human-readable explanation of it — for an `offscope_host` refusal it names the host and how to authorize it. `credentialWarning` appears only when you named an account and an environment default for a **different** account was actually submitted — never for a login that was refused or skipped. `loginError` appears when a named account could not be resolved and the run declined to substitute a different one.
 
 Every successful run returns a `browserSession` block alongside the screenshot — presigned S3 URLs for the captured **HAR** (full network trace) and **console log** (every JS console message). Use them to detect refetch loops, hydration errors, and other runtime issues that pass type-checks and unit tests:
 
@@ -176,14 +180,16 @@ Team and repo resolve by **either** uuid **or** name (case-insensitive exact mat
 |--------|--------|--------|
 | `get` | `{uuid, projectUuid?}` | Env with credentials inlined (passwords never returned) |
 | `list` | `{projectUuid?, q?, page?, pageSize?}` | Paginated envs, each with a credentials array |
-| `create` | `{name, url, description?, projectUuid?, credentials?}` | Created env (optionally seeds credentials) |
-| `update` | `{uuid, name?, url?, description?, addCredentials?, updateCredentials?, removeCredentialIds?}` | Patched env; credential ops run **remove → update → add** |
+| `create` | `{name, url, description?, projectUuid?, credentials?, authorizedCredentialHosts?}` | Created env (optionally seeds credentials) |
+| `update` | `{uuid, name?, url?, description?, addCredentials?, updateCredentials?, removeCredentialIds?, authorizedCredentialHosts?}` | Patched env; credential ops run **remove → update → add** |
 | `delete` | `{uuid, projectUuid?, confirm?}` | Deletes env (cascades credentials) — **requires confirmation** |
 | `sessions` | `{uuid, username?, credentialId?}` | Captured login sessions the env holds, per account, with `isUsable` and a `usableCount` |
 | `clearSessions` | `{uuid, username?, credentialId?, confirm?}` | Invalidates them so the next run logs in for real — **unscoped clears require confirmation** |
 
 `projectUuid` auto-resolves from the git repo when omitted. Per-cred failures surface in `credentialWarnings[]` without blocking the env op.
 
+`authorizedCredentialHosts` lists hosts where a run may enter this environment's credentials besides the app's own host — **for cross-domain SSO, add the IdP host here** (e.g. `["auth.example.com"]`). Bare hostnames only: no scheme, path, port or wildcard (subdomains of the app's host are already in scope). On `update` it replaces the list; `[]` clears it. `get`/`list` return it when the server supports it. The response echoes the saved list; if the server did not persist it (older servers ignore the field), the result carries an `authorizedCredentialHostsWarning` saying so instead of a silent success.
+
 `sessions` / `clearSessions` manage the warm authenticated sessions the backend reuses to skip login (see [Session reuse](#session-reuse-why-a-check-can-report-no-login-form)). Session contents are never returned — a session cookie is a bearer credential. `clearSessions` marks sessions invalid rather than deleting the rows, so reuse stops immediately while the capture history stays readable.
 
 ### `test_suite`

package/dist/handlers/createEnvironmentHandler.js

@@ -3,6 +3,7 @@ import { handleExternalServiceError } from '../utils/errors.js';
 import { DebuggAIServerClient } from '../services/index.js';
 import { config } from '../config/index.js';
 import { detectRepoName } from '../utils/gitContext.js';
+import { checkAuthorizedCredentialHostsEcho } from '../utils/authorizedCredentialHosts.js';
 const logger = new Logger({ module: 'createEnvironmentHandler' });
 export async function createEnvironmentHandler(input, _context) {
     const start = Date.now();
@@ -38,6 +39,7 @@ export async function createEnvironmentHandler(input, _context) {
             name: input.name,
             url: input.url,
             description: input.description,
+            authorizedCredentialHosts: input.authorizedCredentialHosts,
         });
         const payload = {
             created: true,
@@ -77,6 +79,14 @@ export async function createEnvironmentHandler(input, _context) {
             if (warnings.length > 0)
                 payload.credentialWarnings = warnings;
         }
+        // Bead q4d4: only the echo proves the backend kept the hosts.
+        if (input.authorizedCredentialHosts !== undefined) {
+            const hostsWarning = checkAuthorizedCredentialHostsEcho(input.authorizedCredentialHosts, env.authorizedCredentialHosts, 'create');
+            if (hostsWarning) {
+                payload.authorizedCredentialHostsWarning = hostsWarning;
+                logger.warn(`create_environment: ${hostsWarning.message}`);
+            }
+        }
         logger.toolComplete('create_environment', Date.now() - start);
         return { content: [{ type: 'text', text: JSON.stringify(payload, null, 2) }] };
     }

package/dist/handlers/testPageChangesHandler.js

@@ -10,7 +10,7 @@ import { handleExternalServiceError } from '../utils/errors.js';
 import { fetchImageAsBase64, imageContentBlock, resourceLinkBlock, artifactResourceLinks } from '../utils/imageUtils.js';
 import { DebuggAIServerClient } from '../services/index.js';
 import { getEvalTemplateSlug } from '../services/workflows.js';
-import { adaptVerdict, isEnvironmentDefault } from '../services/verdictAdapter.js';
+import { adaptVerdict, credentialSubstitutions } from '../services/verdictAdapter.js';
 import { TunnelProvisionError } from '../services/tunnels.js';
 import { resolveTargetUrl, buildContext, findExistingTunnel, ensureTunnel, acquirePortRoute, releasePortRoute, sanitizeResponseUrls, touchTunnelById, retargetAuxiliaryUrl, } from '../utils/tunnelContext.js';
 import { randomUUID } from 'node:crypto';
@@ -794,20 +794,28 @@ async function testPageChangesHandlerInner(input, context, rawProgressCallback)
             responsePayload.logins = verdict.logins;
         if (verdict.loginError)
             responsePayload.loginError = verdict.loginError;
+        // Bead b5x6: only a SUBMITTED env-default login under a DIFFERENT account
+        // counts. A refused/skipped login (offscope_host, no form) typed nothing,
+        // and the env's stored credential may be the very account that was named —
+        // warning on either states something that did not happen.
         const requestedIdentity = input.username
             ?? input.auth?.username
             ?? input.loginCredentials?.[0]?.username;
-        const substituted = (verdict.logins ?? []).filter(isEnvironmentDefault);
+        const substituted = credentialSubstitutions(verdict.logins, [
+            input.username,
+            input.auth?.username,
+            ...(input.loginCredentials ?? []).map(c => c.username),
+        ]);
         if (requestedIdentity && substituted.length > 0) {
             responsePayload.credentialWarning = {
                 requested: requestedIdentity,
-                used: substituted.map(l => l.username).filter(Boolean),
+                used: [...new Set(substituted.map(l => l.username))],
                 message: `This run signed in with an environment default credential even though ` +
                     `'${requestedIdentity}' was specified. Treat a login failure here as a ` +
                     `credential-resolution problem, not an application failure.`,
             };
             logger.warn(`check_app_in_browser: requested identity '${requestedIdentity}' but the run used ` +
-                `environment-default credential(s): ${substituted.map(l => l.username).join(', ')}`);
+                `environment-default credential(s): ${responsePayload.credentialWarning.used.join(', ')}`);
         }
         // Bug z15n: OUR tunnel died mid-run, so this 'fail' describes our error page,
         // not the user's app. Relay it as a distinct, retryable infrastructure class

package/dist/handlers/updateEnvironmentHandler.js

@@ -3,6 +3,7 @@ import { handleExternalServiceError } from '../utils/errors.js';
 import { DebuggAIServerClient } from '../services/index.js';
 import { config } from '../config/index.js';
 import { detectRepoName } from '../utils/gitContext.js';
+import { checkAuthorizedCredentialHostsEcho } from '../utils/authorizedCredentialHosts.js';
 const logger = new Logger({ module: 'updateEnvironmentHandler' });
 function notFound(uuid, context) {
     return {
@@ -27,7 +28,7 @@ export async function updateEnvironmentHandler(input, _context) {
     const start = Date.now();
     logger.toolStart('update_environment', {
         uuid: input.uuid,
-        hasEnvPatch: !!(input.name || input.url || input.description),
+        hasEnvPatch: !!(input.name || input.url || input.description || input.authorizedCredentialHosts),
         addCount: input.addCredentials?.length ?? 0,
         updateCount: input.updateCredentials?.length ?? 0,
         removeCount: input.removeCredentialIds?.length ?? 0,
@@ -47,12 +48,16 @@ export async function updateEnvironmentHandler(input, _context) {
             projectUuid = project.uuid;
         }
         // ── Env field patch (only if any env field is present) ──────────────────
-        const hasEnvPatch = input.name !== undefined || input.url !== undefined || input.description !== undefined;
+        // authorizedCredentialHosts counts: an update that sets ONLY it must still
+        // PATCH, or it would return a silent no-op (bead q4d4).
+        const hasEnvPatch = input.name !== undefined || input.url !== undefined
+            || input.description !== undefined || input.authorizedCredentialHosts !== undefined;
         let environment = null;
         if (hasEnvPatch) {
             try {
                 environment = await client.updateEnvironment(projectUuid, input.uuid, {
                     name: input.name, url: input.url, description: input.description,
+                    authorizedCredentialHosts: input.authorizedCredentialHosts,
                 });
             }
             catch (err) {
@@ -128,6 +133,13 @@ export async function updateEnvironmentHandler(input, _context) {
             payload.removedCredentialIds = removedCredentialIds;
         if (warnings.length > 0)
             payload.credentialWarnings = warnings;
+        if (input.authorizedCredentialHosts !== undefined) {
+            const hostsWarning = checkAuthorizedCredentialHostsEcho(input.authorizedCredentialHosts, environment?.authorizedCredentialHosts, 'update');
+            if (hostsWarning) {
+                payload.authorizedCredentialHostsWarning = hostsWarning;
+                logger.warn(`update_environment: ${hostsWarning.message}`);
+            }
+        }
         logger.toolComplete('update_environment', Date.now() - start);
         return { content: [{ type: 'text', text: JSON.stringify(payload, null, 2) }] };
     }

package/dist/services/index.js

@@ -29,6 +29,17 @@ class DebuggTransport extends AxiosTransport {
         });
     }
 }
+/**
+ * authorizedCredentialHosts from an environment response (bead q4d4), or {} when
+ * the backend sent none. OMITTED rather than defaulted to [] — a backend that
+ * does not support the field yet must not read as "this env trusts no extra
+ * hosts", and the create/update handlers rely on its absence to detect that.
+ */
+function pickAuthorizedCredentialHosts(e) {
+    return Array.isArray(e?.authorizedCredentialHosts)
+        ? { authorizedCredentialHosts: e.authorizedCredentialHosts }
+        : {};
+}
 export class DebuggAIServerClient {
     userApiKey;
     tx;
@@ -222,6 +233,7 @@ export class DebuggAIServerClient {
                 name: e.name,
                 url: e.url || e.activeUrl || '',
                 isActive: e.isActive,
+                ...pickAuthorizedCredentialHosts(e),
             })),
         };
     }
@@ -237,12 +249,16 @@ export class DebuggAIServerClient {
             body.url = input.url;
         if (input.description)
             body.description = input.description;
+        // Wire: authorized_credential_hosts (snake_cased by the transport).
+        if (input.authorizedCredentialHosts !== undefined)
+            body.authorizedCredentialHosts = input.authorizedCredentialHosts;
         const response = await this.tx.post(`api/v1/projects/${projectUuid}/environments/`, body);
         return {
             uuid: response.uuid,
             name: response.name,
             url: response.url || response.activeUrl || '',
             isActive: response.isActive,
+            ...pickAuthorizedCredentialHosts(response),
         };
     }
     /**
@@ -301,6 +317,7 @@ export class DebuggAIServerClient {
             activeUrl: e.activeUrl ?? null,
             timestamp: e.timestamp,
             lastMod: e.lastMod,
+            ...pickAuthorizedCredentialHosts(e),
         };
     }
     /**
@@ -316,6 +333,9 @@ export class DebuggAIServerClient {
             body.url = patch.url;
         if (patch.description !== undefined)
             body.description = patch.description;
+        // Wire: authorized_credential_hosts. [] is meaningful (clears the list).
+        if (patch.authorizedCredentialHosts !== undefined)
+            body.authorizedCredentialHosts = patch.authorizedCredentialHosts;
         const e = await this.tx.patch(`api/v1/projects/${projectUuid}/environments/${envUuid}/`, body);
         return {
             uuid: envUuid, // echo from input; backend PATCH response omits it
@@ -324,6 +344,7 @@ export class DebuggAIServerClient {
             isActive: e.isActive,
             description: e.description ?? null,
             endpointType: e.endpointType,
+            ...pickAuthorizedCredentialHosts(e),
         };
     }
     /**

package/dist/services/verdictAdapter.js

@@ -27,10 +27,34 @@ export const KNOWN_OUTCOMES = ['pass', 'fail', 'inconclusive', 'error', 'timeout
 const KNOWN = new Set(KNOWN_OUTCOMES);
 /** Credential sources that mean "the caller named this account for this run". */
 const CALLER_SPECIFIED_SOURCES = new Set(['task', 'explicit', 'credential_id']);
-/** True when this login used an environment default rather than a named account. */
+/**
+ * True when this login's credential CAME FROM the environment rather than a
+ * named account. Says nothing about whether it was ever used — a refused
+ * `offscope_host` skip carries an env source too. See credentialSubstitutions.
+ */
 export function isEnvironmentDefault(login) {
     return !!login.source && !CALLER_SPECIFIED_SOURCES.has(login.source);
 }
+/**
+ * The logins that really did substitute an environment default for an account
+ * the caller named (bead b5x6). All three must hold:
+ *   - the credential came from the environment (isEnvironmentDefault);
+ *   - it was actually submitted — a refused or skipped login typed nothing, so
+ *     "signed in with an environment default" would be false (client runs
+ *     2d4970a6, 146f081f);
+ *   - it names an account, and not one the caller asked for — the environment's
+ *     stored credential can BE the requested account, and a warning that lists
+ *     X as both requested and used contradicts itself (client run 146f081f).
+ * Identities compare trimmed and case-insensitively (they are emails).
+ */
+export function credentialSubstitutions(logins, namedIdentities) {
+    const norm = (s) => s.trim().toLowerCase();
+    const named = new Set(namedIdentities.filter((u) => typeof u === 'string' && u.trim() !== '').map(norm));
+    return (logins ?? []).filter((l) => isEnvironmentDefault(l)
+        && l.submitted === true
+        && typeof l.username === 'string' && l.username.trim() !== ''
+        && !named.has(norm(l.username)));
+}
 /**
  * Map a workflow execution onto the MCP relay verdict. Never throws.
  */

package/dist/tools/environment.js

@@ -12,12 +12,14 @@ const CRED_ITEM = {
 const DESCRIPTION = `Manage environments (and their login credentials) under a project. Pass an "action":
   - "get"    {uuid, projectUuid?} → one environment with credentials inline (passwords never returned).
   - "list"   {projectUuid?, q?, page?, pageSize?} → paginated environments. projectUuid auto-resolves from the git repo if omitted.
-  - "create" {name, url, description?, projectUuid?, credentials?} → create an env, optionally seeding credentials.
-  - "update" {uuid, name?, url?, description?, addCredentials?, updateCredentials?, removeCredentialIds?} → patch env + manage credentials.
+  - "create" {name, url, description?, projectUuid?, credentials?, authorizedCredentialHosts?} → create an env, optionally seeding credentials.
+  - "update" {uuid, name?, url?, description?, addCredentials?, updateCredentials?, removeCredentialIds?, authorizedCredentialHosts?} → patch env + manage credentials.
   - "delete" {uuid, projectUuid?, confirm?} → delete env (DESTRUCTIVE; requires confirmation).
   - "sessions" {uuid, username?, credentialId?} → captured login sessions this env is holding, and whether each would be reused.
   - "clearSessions" {uuid, username?, credentialId?, confirm?} → invalidate them so the next run logs in for real.
 
+CROSS-DOMAIN SSO: a run only types this environment's credentials on the app's own host (and its subdomains); a login on any other host is refused as offscope_host. If your identity provider lives on a different domain than the app, add the IdP host to authorizedCredentialHosts — bare hostnames like "auth.example.com", no scheme/path/port/wildcard. The response echoes the saved list; if it reports authorizedCredentialHostsWarning, the server did not persist it.
+
 SESSIONS: runs reuse a warm authenticated session per account instead of logging in every time. That is why a check can report "no login form" — it was already signed in. Use "sessions" to see whose session is held, "clearSessions" to drop it, or pass freshSession:true on a single check_app_in_browser call to bypass reuse without clearing anything.`;
 export function buildEnvironmentTool() {
     return {
@@ -41,6 +43,7 @@ export function buildEnvironmentTool() {
                 addCredentials: { type: 'array', items: CRED_ITEM, description: '[update] Add credentials.' },
                 updateCredentials: { type: 'array', items: { type: 'object', properties: { uuid: { type: 'string' }, label: { type: 'string' }, username: { type: 'string' }, password: { type: 'string' }, role: { type: 'string' } }, required: ['uuid'], additionalProperties: false }, description: '[update] Patch credentials by UUID.' },
                 removeCredentialIds: { type: 'array', items: { type: 'string' }, description: '[update] Delete credentials by UUID.' },
+                authorizedCredentialHosts: { type: 'array', items: { type: 'string' }, description: "[create/update] Hosts where the run may enter this environment's credentials besides the app's own host, e.g. your identity provider for cross-domain SSO. Bare hostnames only (auth.example.com). On update this REPLACES the list; [] clears it." },
                 username: { type: 'string', description: '[sessions/clearSessions] Narrow to one account. Matched case-insensitively.' },
                 credentialId: { type: 'string', description: '[sessions/clearSessions] Narrow to one stored credential by UUID.' },
                 confirm: { type: 'boolean', description: '[delete/clearSessions] Set true to confirm (when the client cannot prompt). clearSessions only needs it when no username/credentialId narrows it.' },

package/dist/tools/testPageChanges.js

@@ -112,7 +112,7 @@ export function buildTestPageChangesTool(ctx) {
                 },
                 auth: {
                     type: "object",
-                    description: "Optional auth-precondition for a 'log in THEN deep-navigate' check. Set precondition:'login' to authenticate first, then land on deepUrl. Use this instead of hoping the agent signs itself in at a login wall. Pass username/password here to pin WHICH account it authenticates as; omit them to use the environment's default credential.",
+                    description: "Optional auth-precondition for a 'log in THEN deep-navigate' check. Set precondition:'login' to authenticate first, then land on deepUrl. Use this instead of hoping the agent signs itself in at a login wall. Pass username/password here to pin WHICH account it authenticates as; omit them to use the environment's default credential. Cross-domain SSO (sign-in page on a different domain than the app): add that IdP host to the environment's authorizedCredentialHosts (environment tool), or the login there is refused as offscope_host.",
                     properties: {
                         environmentId: {
                             type: "string",

package/dist/types/index.js

@@ -126,12 +126,38 @@ const CredentialSeedSchema = z.object({
     password: z.string().min(1, 'password is required'),
     role: z.string().min(1).optional(),
 }).strict();
+/**
+ * One entry of an environment's authorizedCredentialHosts (bead q4d4): a bare
+ * hostname where a run may type this environment's credentials besides the
+ * app's own host — typically the identity provider of a cross-domain SSO app.
+ * The backend matches it against a URL's lowercased hostname, exactly, so a
+ * scheme, path, port or wildcard could never match anything; reject them here
+ * with the reason instead of storing a host that silently does nothing.
+ */
+const HOSTNAME_RE = /^(?!-)[a-z0-9-]{1,63}(?<!-)(\.(?!-)[a-z0-9-]{1,63}(?<!-))*$/;
+const AuthorizedCredentialHostSchema = z.string().trim().toLowerCase().superRefine((h, ctx) => {
+    const bad = (message) => ctx.addIssue({ code: z.ZodIssueCode.custom, message });
+    if (h === '')
+        return bad('host must not be empty');
+    if (h.includes('://'))
+        return bad(`'${h}' has a scheme — pass the bare hostname (e.g. auth.example.com), not a URL`);
+    if (h.includes('/'))
+        return bad(`'${h}' has a path — pass the bare hostname only (e.g. auth.example.com)`);
+    if (h.includes('*'))
+        return bad(`'${h}' is a wildcard — list each host explicitly (subdomains of the app's own host are already in scope)`);
+    if (h.includes(':'))
+        return bad(`'${h}' has a port — pass the bare hostname; hosts are matched without a port`);
+    if (h.length > 253 || !HOSTNAME_RE.test(h))
+        return bad(`'${h}' is not a valid hostname`);
+});
+const AuthorizedCredentialHostsSchema = z.array(AuthorizedCredentialHostSchema).max(50, 'at most 50 hosts');
 export const CreateEnvironmentInputSchema = z.object({
     name: z.string().min(1, 'name is required'),
     url: z.string().url('url is required for standard environments'),
     description: z.string().optional(),
     projectUuid: z.string().uuid().optional(),
     credentials: z.array(CredentialSeedSchema).optional(),
+    authorizedCredentialHosts: AuthorizedCredentialHostsSchema.optional(),
 }).strict();
 const CredentialUpdateSchema = z.object({
     uuid: z.string().uuid(),
@@ -149,6 +175,7 @@ export const UpdateEnvironmentInputSchema = z.object({
     addCredentials: z.array(CredentialSeedSchema).optional(),
     updateCredentials: z.array(CredentialUpdateSchema).optional(),
     removeCredentialIds: z.array(z.string().uuid()).optional(),
+    authorizedCredentialHosts: AuthorizedCredentialHostsSchema.optional(),
 }).strict();
 export const DeleteEnvironmentInputSchema = z.object({
     uuid: z.string().uuid(),
@@ -326,8 +353,8 @@ export const ProjectInputSchema = z.discriminatedUnion('action', [
 export const EnvironmentInputSchema = z.discriminatedUnion('action', [
     z.object({ action: z.literal('get'), uuid: z.string().uuid(), projectUuid: z.string().uuid().optional() }).strict(),
     z.object({ action: z.literal('list'), projectUuid: z.string().uuid().optional(), q: z.string().min(1).optional(), page: _page, pageSize: _pageSize }).strict(),
-    z.object({ action: z.literal('create'), name: z.string().min(1), url: z.string().url('url is required for standard environments'), description: z.string().optional(), projectUuid: z.string().uuid().optional(), credentials: z.array(CredentialSeedSchema).optional() }).strict(),
-    z.object({ action: z.literal('update'), uuid: z.string().uuid(), name: z.string().min(1).optional(), url: z.string().url().optional(), description: z.string().optional(), projectUuid: z.string().uuid().optional(), addCredentials: z.array(CredentialSeedSchema).optional(), updateCredentials: z.array(CredentialUpdateSchema).optional(), removeCredentialIds: z.array(z.string().uuid()).optional() }).strict(),
+    z.object({ action: z.literal('create'), name: z.string().min(1), url: z.string().url('url is required for standard environments'), description: z.string().optional(), projectUuid: z.string().uuid().optional(), credentials: z.array(CredentialSeedSchema).optional(), authorizedCredentialHosts: AuthorizedCredentialHostsSchema.optional() }).strict(),
+    z.object({ action: z.literal('update'), uuid: z.string().uuid(), name: z.string().min(1).optional(), url: z.string().url().optional(), description: z.string().optional(), projectUuid: z.string().uuid().optional(), addCredentials: z.array(CredentialSeedSchema).optional(), updateCredentials: z.array(CredentialUpdateSchema).optional(), removeCredentialIds: z.array(z.string().uuid()).optional(), authorizedCredentialHosts: AuthorizedCredentialHostsSchema.optional() }).strict(),
     z.object({ action: z.literal('delete'), uuid: z.string().uuid(), projectUuid: z.string().uuid().optional(), confirm: z.boolean().optional() }).strict(),
     // Captured authenticated sessions (sentinal-cs1hn.5). The backend holds a warm
     // session per account and restores it to skip login; these two actions make that

package/dist/utils/authorizedCredentialHosts.js

@@ -0,0 +1,38 @@
+/**
+ * Echo check for an environment's authorizedCredentialHosts (bead q4d4).
+ *
+ * The MCP ships this field before every backend accepts it (sentinal-oj7dp.23).
+ * A backend that does not know the field ignores it and still answers 200, so a
+ * create/update "succeeds" whether or not the hosts were saved. The only proof
+ * is the response echoing them back — so when it doesn't, say so loudly instead
+ * of letting the caller believe cross-domain SSO is now configured.
+ */
+const norm = (hosts) => new Set(hosts.map((h) => h.trim().toLowerCase()));
+/**
+ * Compare the requested hosts with the backend's echo. Returns a warning when
+ * they differ (as sets, case-insensitively — the backend normalizes), or
+ * undefined when the echo confirms them. `op` shapes the advice: a create has
+ * already created the environment, so a retry of create would duplicate it.
+ */
+export function checkAuthorizedCredentialHostsEcho(requested, returned, op) {
+    const echoed = Array.isArray(returned) ? returned : null;
+    if (echoed) {
+        const want = norm(requested);
+        const got = norm(echoed);
+        if (want.size === got.size && [...want].every((h) => got.has(h)))
+            return undefined;
+    }
+    const hosts = requested.length > 0 ? requested.join(', ') : '(an empty list)';
+    const why = echoed
+        ? `The backend did not persist authorizedCredentialHosts as requested: it holds [${echoed.join(', ')}], not [${requested.join(', ')}].`
+        : 'The backend did not persist authorizedCredentialHosts: it is not yet supported on this DebuggAI server ' +
+            '(the response did not echo the hosts back).';
+    const applied = op === 'create'
+        ? 'The environment itself WAS created, with any credentials listed here — do not re-run create; ' +
+            'set the hosts later with environment {action:"update"}.'
+        : 'Everything else in this update was applied.';
+    const consequence = requested.length > 0
+        ? ` Until the hosts are saved, check_app_in_browser will still refuse to enter credentials on ${hosts} (offscope_host).`
+        : '';
+    return { requested, returned: echoed, message: `${why} ${applied}${consequence}` };
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@debugg-ai/debugg-ai-mcp",
-  "version": "4.2.2",
+  "version": "4.3.0",
   "description": "Zero-Config, Fully AI-Managed End-to-End Testing for all code gen platforms.",
   "type": "module",
   "caddy": "2.11.3",