@debugg-ai/debugg-ai-mcp 4.2.2 → 4.4.0

package/README.md

@@ -92,6 +92,8 @@ Naming an account only in `description` does **not** make the agent use it — i
 
 Set `useEnvironmentCredentials: false` when a silent fallback to the default test user would invalidate the check.
 
+**Cross-domain SSO?** A run only types credentials on the app's own host and its subdomains; a sign-in page on another domain is refused as `offscope_host`. Add the identity provider's host to the environment's `authorizedCredentialHosts` (see [`environment`](#environment)).
+
 **Checking a page that needs no login at all?** Pass `useEnvironmentCredentials: false` and name no account. That combination means exactly what it says — *do not log in* — and the run skips authentication entirely instead of hunting for a login form. Use it for public pages, marketing sites, docs, and anything pre-auth. It is also faster: on the default (`auto`) the agent will follow a "Log in" link off your page and try the environment's stored account before it evaluates anything.
 
 ##### Session reuse: why a check can report "no login form"
@@ -109,7 +111,9 @@ Results report the identity actually used, so a wrong one is visible rather than
 
 ```json
 "logins": [
-  { "username": "qa+invitefix@example.com", "source": "task", "submitted": true, "authenticated": true }
+  { "username": "qa+invitefix@example.com", "source": "task", "submitted": true, "authenticated": true },
+  { "username": "qatest123@example.com", "source": "env_default", "submitted": false, "authenticated": false,
+    "reason": "offscope_host", "detail": "refused to enter credentials on auth.idp.example: not part of this run's scope …" }
 ],
 "credentialWarning": {
   "requested": "qa+invitefix@example.com",
@@ -118,7 +122,7 @@ Results report the identity actually used, so a wrong one is visible rather than
 }
 ```
 
-`source` is `task` | `explicit` | `credential_id` (an account you named) or `env` | `env_default` (the environment's stored account). `credentialWarning` appears only when you named an account and an environment default was used anyway. `loginError` appears when a named account could not be resolved and the run declined to substitute a different one.
+`source` is `task` | `explicit` | `credential_id` (an account you named) or `env` | `env_default` (the environment's stored account). `submitted` is true only when credentials were actually typed and submitted; `reason` says what happened (e.g. `offscope_host`, `restored_session`), and `detail`, when present, is a human-readable explanation of it — for an `offscope_host` refusal it names the host and how to authorize it. `credentialWarning` appears only when you named an account and an environment default for a **different** account was actually submitted — never for a login that was refused or skipped. `loginError` appears when a named account could not be resolved and the run declined to substitute a different one.
 
 Every successful run returns a `browserSession` block alongside the screenshot — presigned S3 URLs for the captured **HAR** (full network trace) and **console log** (every JS console message). Use them to detect refetch loops, hydration errors, and other runtime issues that pass type-checks and unit tests:
 
@@ -176,14 +180,16 @@ Team and repo resolve by **either** uuid **or** name (case-insensitive exact mat
 |--------|--------|--------|
 | `get` | `{uuid, projectUuid?}` | Env with credentials inlined (passwords never returned) |
 | `list` | `{projectUuid?, q?, page?, pageSize?}` | Paginated envs, each with a credentials array |
-| `create` | `{name, url, description?, projectUuid?, credentials?}` | Created env (optionally seeds credentials) |
-| `update` | `{uuid, name?, url?, description?, addCredentials?, updateCredentials?, removeCredentialIds?}` | Patched env; credential ops run **remove → update → add** |
+| `create` | `{name, url, description?, projectUuid?, credentials?, authorizedCredentialHosts?}` | Created env (optionally seeds credentials) |
+| `update` | `{uuid, name?, url?, description?, addCredentials?, updateCredentials?, removeCredentialIds?, authorizedCredentialHosts?}` | Patched env; credential ops run **remove → update → add** |
 | `delete` | `{uuid, projectUuid?, confirm?}` | Deletes env (cascades credentials) — **requires confirmation** |
 | `sessions` | `{uuid, username?, credentialId?}` | Captured login sessions the env holds, per account, with `isUsable` and a `usableCount` |
 | `clearSessions` | `{uuid, username?, credentialId?, confirm?}` | Invalidates them so the next run logs in for real — **unscoped clears require confirmation** |
 
 `projectUuid` auto-resolves from the git repo when omitted. Per-cred failures surface in `credentialWarnings[]` without blocking the env op.
 
+`authorizedCredentialHosts` lists hosts where a run may enter this environment's credentials besides the app's own host — **for cross-domain SSO, add the IdP host here** (e.g. `["auth.example.com"]`). Bare hostnames only: no scheme, path, port or wildcard (subdomains of the app's host are already in scope). On `update` it replaces the list; `[]` clears it. `get`/`list` return it when the server supports it. The response echoes the saved list; if the server did not persist it (older servers ignore the field), the result carries an `authorizedCredentialHostsWarning` saying so instead of a silent success.
+
 `sessions` / `clearSessions` manage the warm authenticated sessions the backend reuses to skip login (see [Session reuse](#session-reuse-why-a-check-can-report-no-login-form)). Session contents are never returned — a session cookie is a bearer credential. `clearSessions` marks sessions invalid rather than deleting the rows, so reuse stops immediately while the capture history stays readable.
 
 ### `test_suite`

package/dist/handlers/createEnvironmentHandler.js

@@ -3,6 +3,7 @@ import { handleExternalServiceError } from '../utils/errors.js';
 import { DebuggAIServerClient } from '../services/index.js';
 import { config } from '../config/index.js';
 import { detectRepoName } from '../utils/gitContext.js';
+import { checkAuthorizedCredentialHostsEcho } from '../utils/authorizedCredentialHosts.js';
 const logger = new Logger({ module: 'createEnvironmentHandler' });
 export async function createEnvironmentHandler(input, _context) {
     const start = Date.now();
@@ -38,6 +39,7 @@ export async function createEnvironmentHandler(input, _context) {
             name: input.name,
             url: input.url,
             description: input.description,
+            authorizedCredentialHosts: input.authorizedCredentialHosts,
         });
         const payload = {
             created: true,
@@ -77,6 +79,14 @@ export async function createEnvironmentHandler(input, _context) {
             if (warnings.length > 0)
                 payload.credentialWarnings = warnings;
         }
+        // Bead q4d4: only the echo proves the backend kept the hosts.
+        if (input.authorizedCredentialHosts !== undefined) {
+            const hostsWarning = checkAuthorizedCredentialHostsEcho(input.authorizedCredentialHosts, env.authorizedCredentialHosts, 'create');
+            if (hostsWarning) {
+                payload.authorizedCredentialHostsWarning = hostsWarning;
+                logger.warn(`create_environment: ${hostsWarning.message}`);
+            }
+        }
         logger.toolComplete('create_environment', Date.now() - start);
         return { content: [{ type: 'text', text: JSON.stringify(payload, null, 2) }] };
     }

package/dist/handlers/probePageHandler.js

@@ -104,7 +104,10 @@ export async function probePageHandler(input, context, rawProgressCallback) {
     // Per-target tunnel contexts. Index aligns with input.targets[].
     const targetContexts = [];
     // Tunnel keys we provisioned this call (for cleanup if creation fails after key acquired).
-    const acquiredKeyIds = [];
+    // The provisions this call acquired, in target order. Provisions rather than
+    // bare key ids because revoking follows the transport the backend picked
+    // (ngrok keys and debugg tunnels have different endpoints).
+    const acquiredProvisions = [];
     // Progress budget: 1 pre-flight + 1 template + 1 execute + N per-target captures + 1 done
     const TOTAL_STEPS = 3 + input.targets.length + 1;
     let progressStep = 0;
@@ -157,10 +160,10 @@ export async function probePageHandler(input, context, rawProgressCallback) {
                             throw new Error(`Failed to provision tunnel for ${ctx.originalUrl}. ` +
                                 `(Detail: ${msg})${diag}`);
                         }
-                        acquiredKeyIds.push(tunnel.keyId);
+                        acquiredProvisions.push(tunnel);
                         let tunneled;
                         try {
-                            tunneled = await ensureTunnel(ctx, tunnel.tunnelKey, tunnel.tunnelId, tunnel.keyId, () => client.revokeNgrokKey(tunnel.keyId));
+                            tunneled = await ensureTunnel(ctx, tunnel.tunnelKey, tunnel.tunnelId, tunnel.keyId, () => client.tunnels.revoke(tunnel), tunnel);
                         }
                         catch (tunnelError) {
                             const msg = tunnelError instanceof Error ? tunnelError.message : String(tunnelError);
@@ -463,11 +466,15 @@ export async function probePageHandler(input, context, rawProgressCallback) {
         // Tunnels intentionally NOT torn down — reuse pattern (bead vwd) +
         // 55-min idle auto-shutoff. Revoke only orphaned keys (we acquired the
         // key but tunnel creation failed before ensureTunnel completed).
-        for (let i = 0; i < acquiredKeyIds.length; i++) {
-            const keyId = acquiredKeyIds[i];
+        // NOTE (bead debugg_ai_mcp-xkoh.9): `tc` is undefined when ensureTunnel
+        // threw, so this condition does not fire on the very path it describes.
+        // That is a pre-existing defect with its own bead and is deliberately NOT
+        // fixed here; only the endpoint the revoke goes to changed.
+        for (let i = 0; i < acquiredProvisions.length; i++) {
+            const provision = acquiredProvisions[i];
             const tc = targetContexts[i];
-            if (tc && !tc.tunnelId && keyId) {
-                client.revokeNgrokKey(keyId).catch(err => logger.warn(`Failed to revoke unused ngrok key ${keyId}: ${err}`));
+            if (tc && !tc.tunnelId && provision) {
+                client.tunnels.revoke(provision).catch(err => logger.warn(`Failed to revoke unused tunnel ${provision.tunnelId}: ${err}`));
             }
         }
     }

package/dist/handlers/runTestSuiteHandler.js

@@ -18,7 +18,7 @@ export async function runTestSuiteHandler(input, _context) {
     logger.toolStart('run_test_suite', input);
     const client = new DebuggAIServerClient(config.api.key);
     await client.init();
-    let acquiredKeyId = null;
+    let acquiredProvision = null;
     let tunnelId;
     // Used ONLY to scope the defensive sanitizeResponseUrls call below (bead
     // debugg_ai_mcp-6cfv.7) — never fed into acquirePortRoute/PortLock. This
@@ -79,10 +79,10 @@ export async function runTestSuiteHandler(input, _context) {
                         const diag = provisionError instanceof TunnelProvisionError ? ` ${provisionError.diagnosticSuffix()}` : '';
                         return errorResp('TunnelProvisionFailed', `Failed to provision tunnel for ${input.targetUrl}. (Detail: ${msg})${diag}`);
                     }
-                    acquiredKeyId = tunnel.keyId;
+                    acquiredProvision = tunnel;
                     let dedicated;
                     try {
-                        dedicated = await tunnelManager.acquireDedicatedTunnel(ctx.originalUrl, tunnel.tunnelKey, tunnel.keyId, () => client.revokeNgrokKey(tunnel.keyId));
+                        dedicated = await tunnelManager.acquireDedicatedTunnel(ctx.originalUrl, tunnel.tunnelKey, tunnel.keyId, () => client.tunnels.revoke(tunnel), tunnel);
                     }
                     catch (tunnelError) {
                         const msg = tunnelError instanceof Error ? tunnelError.message : String(tunnelError);
@@ -142,8 +142,9 @@ export async function runTestSuiteHandler(input, _context) {
     finally {
         // Tunnels are NOT torn down — reuse pattern + 55-min idle auto-shutoff.
         // Only revoke an orphaned key (acquired but tunnel creation failed).
-        if (acquiredKeyId && !tunnelId) {
-            client.revokeNgrokKey(acquiredKeyId).catch((err) => logger.warn(`Failed to revoke unused ngrok key ${acquiredKeyId}: ${err}`));
+        if (acquiredProvision && !tunnelId) {
+            const orphan = acquiredProvision;
+            client.tunnels.revoke(orphan).catch((err) => logger.warn(`Failed to revoke unused tunnel ${orphan.tunnelId}: ${err}`));
         }
     }
 }

package/dist/handlers/testPageChangesHandler.js

@@ -10,7 +10,7 @@ import { handleExternalServiceError } from '../utils/errors.js';
 import { fetchImageAsBase64, imageContentBlock, resourceLinkBlock, artifactResourceLinks } from '../utils/imageUtils.js';
 import { DebuggAIServerClient } from '../services/index.js';
 import { getEvalTemplateSlug } from '../services/workflows.js';
-import { adaptVerdict, isEnvironmentDefault } from '../services/verdictAdapter.js';
+import { adaptVerdict, credentialSubstitutions } from '../services/verdictAdapter.js';
 import { TunnelProvisionError } from '../services/tunnels.js';
 import { resolveTargetUrl, buildContext, findExistingTunnel, ensureTunnel, acquirePortRoute, releasePortRoute, sanitizeResponseUrls, touchTunnelById, retargetAuxiliaryUrl, } from '../utils/tunnelContext.js';
 import { randomUUID } from 'node:crypto';
@@ -135,7 +135,7 @@ async function testPageChangesHandlerInner(input, context, rawProgressCallback)
     await client.init();
     const originalUrl = resolveTargetUrl(input);
     let ctx = buildContext(originalUrl);
-    let keyId;
+    let provision;
     // Cancellation is driven by the MCP request/transport lifecycle, not
     // process.stdin. The SDK aborts context.signal when the client cancels the
     // call OR the transport closes — e.g. an HTTP client drops the connection.
@@ -249,7 +249,7 @@ async function testPageChangesHandlerInner(input, context, rawProgressCallback)
                             `Make sure your dev server is running on the specified port and try again. ` +
                             `(Detail: ${msg})${diag}`);
                     }
-                    keyId = tunnel.keyId;
+                    provision = tunnel;
                     try {
                         ctx = await ensureTunnel(ctx, tunnel.tunnelKey, tunnel.tunnelId, tunnel.keyId, () => client.revokeNgrokKey(tunnel.keyId));
                     }
@@ -309,7 +309,7 @@ async function testPageChangesHandlerInner(input, context, rawProgressCallback)
                         // owned path already revokes it; if we kept the tunnel, the key is that
                         // live tunnel's own credential and revoking it would kill what we just
                         // decided to preserve.
-                        keyId = undefined;
+                        provision = undefined;
                         return { content: [{ type: 'text', text: JSON.stringify(payload, null, 2) }], isError: true };
                     }
                 }
@@ -794,20 +794,28 @@ async function testPageChangesHandlerInner(input, context, rawProgressCallback)
             responsePayload.logins = verdict.logins;
         if (verdict.loginError)
             responsePayload.loginError = verdict.loginError;
+        // Bead b5x6: only a SUBMITTED env-default login under a DIFFERENT account
+        // counts. A refused/skipped login (offscope_host, no form) typed nothing,
+        // and the env's stored credential may be the very account that was named —
+        // warning on either states something that did not happen.
         const requestedIdentity = input.username
             ?? input.auth?.username
             ?? input.loginCredentials?.[0]?.username;
-        const substituted = (verdict.logins ?? []).filter(isEnvironmentDefault);
+        const substituted = credentialSubstitutions(verdict.logins, [
+            input.username,
+            input.auth?.username,
+            ...(input.loginCredentials ?? []).map(c => c.username),
+        ]);
         if (requestedIdentity && substituted.length > 0) {
             responsePayload.credentialWarning = {
                 requested: requestedIdentity,
-                used: substituted.map(l => l.username).filter(Boolean),
+                used: [...new Set(substituted.map(l => l.username))],
                 message: `This run signed in with an environment default credential even though ` +
                     `'${requestedIdentity}' was specified. Treat a login failure here as a ` +
                     `credential-resolution problem, not an application failure.`,
             };
             logger.warn(`check_app_in_browser: requested identity '${requestedIdentity}' but the run used ` +
-                `environment-default credential(s): ${substituted.map(l => l.username).join(', ')}`);
+                `environment-default credential(s): ${responsePayload.credentialWarning.used.join(', ')}`);
         }
         // Bug z15n: OUR tunnel died mid-run, so this 'fail' describes our error page,
         // not the user's app. Relay it as a distinct, retryable infrastructure class
@@ -985,9 +993,11 @@ async function testPageChangesHandlerInner(input, context, rawProgressCallback)
         // subsequent calls to the same port and auto-shutoffs after 55 min idle.
         // Process-exit cleanup happens via stopAllTunnels() in the SIGINT/SIGTERM
         // handlers in index.ts.
-        if (!ctx.tunnelId && keyId) {
-            // Provisioned a key but tunnel creation failed — revoke the orphaned key.
-            client.revokeNgrokKey(keyId).catch(err => logger.warn(`Failed to revoke unused ngrok key ${keyId}: ${err}`));
+        if (!ctx.tunnelId && provision) {
+            // Provisioned a tunnel but creation failed — revoke it, through whichever
+            // endpoint its transport uses.
+            const orphan = provision;
+            client.tunnels.revoke(orphan).catch(err => logger.warn(`Failed to revoke unused tunnel ${orphan.tunnelId}: ${err}`));
         }
     }
 }

package/dist/handlers/triggerCrawlHandler.js

@@ -60,7 +60,7 @@ export async function triggerCrawlHandler(input, context, rawProgressCallback) {
     await client.init();
     const originalUrl = resolveTargetUrl(input);
     let ctx = buildContext(originalUrl);
-    let keyId;
+    let provision;
     // Bead 56kd.7: cancellation is driven by the MCP request/transport lifecycle
     // (context.signal), NOT process.stdin. The SDK aborts context.signal when the
     // client cancels the call OR the transport closes — e.g. an HTTP client drops
@@ -123,8 +123,8 @@ export async function triggerCrawlHandler(input, context, rawProgressCallback) {
                             `The remote browser needs a secure tunnel to reach your local dev server. ` +
                             `(Detail: ${msg})${diag}`);
                     }
-                    keyId = tunnel.keyId;
-                    ctx = await ensureTunnel(ctx, tunnel.tunnelKey, tunnel.tunnelId, tunnel.keyId, () => client.revokeNgrokKey(tunnel.keyId));
+                    provision = tunnel;
+                    ctx = await ensureTunnel(ctx, tunnel.tunnelKey, tunnel.tunnelId, tunnel.keyId, () => client.tunnels.revoke(tunnel), tunnel);
                 }
                 // §2.4: acquire this session's shared Caddy route for our port BEFORE
                 // probing/dispatching — trigger_crawl polls (pollExecution below) for
@@ -169,7 +169,7 @@ export async function triggerCrawlHandler(input, context, rawProgressCallback) {
                         // owned path already revokes it; if we kept the tunnel, the key is that
                         // live tunnel's own credential and revoking it would kill what we just
                         // decided to preserve.
-                        keyId = undefined;
+                        provision = undefined;
                         return { content: [{ type: 'text', text: JSON.stringify(payload, null, 2) }], isError: true };
                     }
                 }
@@ -363,8 +363,9 @@ export async function triggerCrawlHandler(input, context, rawProgressCallback) {
         releasePortRoute(ctx);
         // Tunnel intentionally NOT torn down (reuse path per bead vwd).
         // If tunnel creation failed after key provision, revoke the orphaned key.
-        if (!ctx.tunnelId && keyId) {
-            client.revokeNgrokKey(keyId).catch(err => logger.warn(`Failed to revoke unused ngrok key ${keyId}: ${err}`));
+        if (!ctx.tunnelId && provision) {
+            const orphan = provision;
+            client.tunnels.revoke(orphan).catch(err => logger.warn(`Failed to revoke unused tunnel ${orphan.tunnelId}: ${err}`));
         }
     }
 }

package/dist/handlers/updateEnvironmentHandler.js

@@ -3,6 +3,7 @@ import { handleExternalServiceError } from '../utils/errors.js';
 import { DebuggAIServerClient } from '../services/index.js';
 import { config } from '../config/index.js';
 import { detectRepoName } from '../utils/gitContext.js';
+import { checkAuthorizedCredentialHostsEcho } from '../utils/authorizedCredentialHosts.js';
 const logger = new Logger({ module: 'updateEnvironmentHandler' });
 function notFound(uuid, context) {
     return {
@@ -27,7 +28,7 @@ export async function updateEnvironmentHandler(input, _context) {
     const start = Date.now();
     logger.toolStart('update_environment', {
         uuid: input.uuid,
-        hasEnvPatch: !!(input.name || input.url || input.description),
+        hasEnvPatch: !!(input.name || input.url || input.description || input.authorizedCredentialHosts),
         addCount: input.addCredentials?.length ?? 0,
         updateCount: input.updateCredentials?.length ?? 0,
         removeCount: input.removeCredentialIds?.length ?? 0,
@@ -47,12 +48,16 @@ export async function updateEnvironmentHandler(input, _context) {
             projectUuid = project.uuid;
         }
         // ── Env field patch (only if any env field is present) ──────────────────
-        const hasEnvPatch = input.name !== undefined || input.url !== undefined || input.description !== undefined;
+        // authorizedCredentialHosts counts: an update that sets ONLY it must still
+        // PATCH, or it would return a silent no-op (bead q4d4).
+        const hasEnvPatch = input.name !== undefined || input.url !== undefined
+            || input.description !== undefined || input.authorizedCredentialHosts !== undefined;
         let environment = null;
         if (hasEnvPatch) {
             try {
                 environment = await client.updateEnvironment(projectUuid, input.uuid, {
                     name: input.name, url: input.url, description: input.description,
+                    authorizedCredentialHosts: input.authorizedCredentialHosts,
                 });
             }
             catch (err) {
@@ -128,6 +133,13 @@ export async function updateEnvironmentHandler(input, _context) {
             payload.removedCredentialIds = removedCredentialIds;
         if (warnings.length > 0)
             payload.credentialWarnings = warnings;
+        if (input.authorizedCredentialHosts !== undefined) {
+            const hostsWarning = checkAuthorizedCredentialHostsEcho(input.authorizedCredentialHosts, environment?.authorizedCredentialHosts, 'update');
+            if (hostsWarning) {
+                payload.authorizedCredentialHostsWarning = hostsWarning;
+                logger.warn(`update_environment: ${hostsWarning.message}`);
+            }
+        }
         logger.toolComplete('update_environment', Date.now() - start);
         return { content: [{ type: 'text', text: JSON.stringify(payload, null, 2) }] };
     }

package/dist/services/index.js

@@ -29,6 +29,17 @@ class DebuggTransport extends AxiosTransport {
         });
     }
 }
+/**
+ * authorizedCredentialHosts from an environment response (bead q4d4), or {} when
+ * the backend sent none. OMITTED rather than defaulted to [] — a backend that
+ * does not support the field yet must not read as "this env trusts no extra
+ * hosts", and the create/update handlers rely on its absence to detect that.
+ */
+function pickAuthorizedCredentialHosts(e) {
+    return Array.isArray(e?.authorizedCredentialHosts)
+        ? { authorizedCredentialHosts: e.authorizedCredentialHosts }
+        : {};
+}
 export class DebuggAIServerClient {
     userApiKey;
     tx;
@@ -222,6 +233,7 @@ export class DebuggAIServerClient {
                 name: e.name,
                 url: e.url || e.activeUrl || '',
                 isActive: e.isActive,
+                ...pickAuthorizedCredentialHosts(e),
             })),
         };
     }
@@ -237,12 +249,16 @@ export class DebuggAIServerClient {
             body.url = input.url;
         if (input.description)
             body.description = input.description;
+        // Wire: authorized_credential_hosts (snake_cased by the transport).
+        if (input.authorizedCredentialHosts !== undefined)
+            body.authorizedCredentialHosts = input.authorizedCredentialHosts;
         const response = await this.tx.post(`api/v1/projects/${projectUuid}/environments/`, body);
         return {
             uuid: response.uuid,
             name: response.name,
             url: response.url || response.activeUrl || '',
             isActive: response.isActive,
+            ...pickAuthorizedCredentialHosts(response),
         };
     }
     /**
@@ -301,6 +317,7 @@ export class DebuggAIServerClient {
             activeUrl: e.activeUrl ?? null,
             timestamp: e.timestamp,
             lastMod: e.lastMod,
+            ...pickAuthorizedCredentialHosts(e),
         };
     }
     /**
@@ -316,6 +333,9 @@ export class DebuggAIServerClient {
             body.url = patch.url;
         if (patch.description !== undefined)
             body.description = patch.description;
+        // Wire: authorized_credential_hosts. [] is meaningful (clears the list).
+        if (patch.authorizedCredentialHosts !== undefined)
+            body.authorizedCredentialHosts = patch.authorizedCredentialHosts;
         const e = await this.tx.patch(`api/v1/projects/${projectUuid}/environments/${envUuid}/`, body);
         return {
             uuid: envUuid, // echo from input; backend PATCH response omits it
@@ -324,6 +344,7 @@ export class DebuggAIServerClient {
             isActive: e.isActive,
             description: e.description ?? null,
             endpointType: e.endpointType,
+            ...pickAuthorizedCredentialHosts(e),
         };
     }
     /**