@dev-mainsequence/codex-plugin 0.0.0-stage → 0.4.2

package/dist/vendor/devtools/shared/session.js

@@ -0,0 +1,532 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MachineSessionService = void 0;
+exports.requireBackend = requireBackend;
+exports.createSessionService = createSessionService;
+// Extracted from ms-vscode-extension/src/api.ts and authSession.ts (0.1.45).
+// Host-independent machine mode; the VS Code legacy fallback stays with that host.
+const crypto = __importStar(require("crypto"));
+const mcpTransport_1 = require("./mcpTransport.js");
+const http = __importStar(require("http"));
+const config_1 = require("./config.js");
+const machineSession_1 = require("./machineSession.js");
+const models_1 = require("./models.js");
+const accountScope_1 = require("./accountScope.js");
+class AccountChangedError extends models_1.ToolingError {
+    constructor() { super('AUTH_REJECTED', 'The MainSequence account or session changed. Refresh the current view before continuing.'); }
+}
+function requireBackend(input) {
+    const backend = (0, config_1.normalizeBackendUrl)(input);
+    let url;
+    try {
+        url = new URL(backend);
+    }
+    catch {
+        throw new models_1.ToolingError('INVALID_REQUEST', 'An HTTP(S) backend URL is required.');
+    }
+    if (!['http:', 'https:'].includes(url.protocol) || url.username || url.password || url.search || url.hash || /[\r\n]/.test(backend)) {
+        throw new models_1.ToolingError('INVALID_REQUEST', 'The backend must be an HTTP(S) URL without credentials, query, or fragment.');
+    }
+    // Keep the original normalized text: URL serialization would change the session account hash.
+    return backend;
+}
+function expiry(access) {
+    try {
+        const exp = JSON.parse(Buffer.from(access.split('.')[1], 'base64url').toString()).exp;
+        return typeof exp === 'number' && Number.isFinite(exp) ? new Date(exp * 1000).toISOString() : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+/** " on 2026-09-30 18:45 UTC" when the token carries an expiry that has passed. */
+function expiredOn(token) {
+    const at = expiry(token);
+    return at && Date.parse(at) <= Date.now() ? ` on ${at.slice(0, 16).replace('T', ' ')} UTC` : '';
+}
+/** Say which credentials the backend refused and how to repair them; no token value is included. */
+function refusedCredentials(source, backend, token) {
+    const when = expiredOn(token);
+    if (source === 'environment') {
+        return new models_1.ToolingError('AUTH_REJECTED', `The backend refused the credentials set in this process's environment (MAINSEQUENCE_ACCESS_TOKEN / MAINSEQUENCE_REFRESH_TOKEN) for ${backend}` +
+            (when ? `: they expired${when}.` : '.') +
+            ' They win over the saved session. Start the process without them to use the saved session, or sign in again and set a current pair.');
+    }
+    return new models_1.ToolingError('AUTH_REJECTED', `The backend refused the saved session for ${backend}` + (when ? `: it expired${when}.` : ': it was revoked or belongs to another backend.') +
+        ' Sign in again.');
+}
+function tokenPair(data, previous) {
+    const access = data?.access || data?.access_token || data?.token || data?.jwt;
+    const refresh = data?.refresh || data?.refresh_token || previous?.refresh;
+    const user = data?.user || data?.profile || data?.metadata?.user || data?.user_metadata || {};
+    const username = data?.username || data?.user_name || user?.username || user?.user_name || previous?.username || '';
+    if (typeof access !== 'string' || !access || typeof refresh !== 'string' || !refresh) {
+        throw new models_1.ToolingError('API_ERROR', 'The backend did not return a valid session pair.');
+    }
+    return { access, refresh, username: typeof username === 'string' ? username : '' };
+}
+class MachineSessionService {
+    host;
+    options;
+    store;
+    env;
+    renewals = new Map();
+    secrets = new Set();
+    verifiedAccounts = new Map();
+    constructor(host, options = {}) {
+        this.host = host;
+        this.options = options;
+        this.env = { ...(options.env ?? process.env) };
+        this.store = options.store === undefined ? (0, machineSession_1.openCredentialStore)({ env: this.env }) : options.store;
+        for (const [key, value] of Object.entries(this.env)) {
+            if (value && /TOKEN|CREDENTIAL_SECRET/i.test(key))
+                this.secrets.add(value);
+        }
+    }
+    /** Only for internal error/output sanitization; never a token transport. */
+    sanitize(text) {
+        let output = text;
+        for (const secret of this.secrets) {
+            if (output === secret)
+                return '[redacted]';
+            if (secret.length >= 8)
+                output = output.split(secret).join('[redacted]');
+        }
+        return output
+            .replace(/\beyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\b/g, '[redacted]')
+            .replace(/(https?:\/\/)[^/\s@]+@/gi, '$1[redacted]@')
+            .replace(/([?&](?:access_token|refresh_token|token|credential_secret|client_secret)=)[^&#\s]+/gi, '$1[redacted]');
+    }
+    remember(session) {
+        if (session.access)
+            this.secrets.add(session.access);
+        if (session.refresh)
+            this.secrets.add(session.refresh);
+        return session;
+    }
+    requireStore() {
+        if (!this.store)
+            throw new models_1.ToolingError('STORE_UNAVAILABLE', 'A machine credential store is required: macOS Keychain or Linux Secret Service with secret-tool.');
+        return this.store;
+    }
+    async saved(backend) {
+        try {
+            const value = this.options.persistence ? await this.options.persistence.read(backend) : (0, machineSession_1.readSession)(this.requireStore(), backend);
+            return value ? this.remember(value) : null;
+        }
+        catch (error) {
+            if (error instanceof models_1.ToolingError)
+                throw error;
+            throw new models_1.ToolingError('STORE_ERROR', error instanceof machineSession_1.ForeignEntryError
+                ? 'The saved entry belongs to an older tool. Sign in to replace it.'
+                : 'The machine session could not be read. Check that the credential store is unlocked and available.');
+        }
+    }
+    environment(backend) {
+        if (this.env.MAINSEQUENCE_RUNTIME_CREDENTIAL_ID || this.env.MAINSEQUENCE_RUNTIME_CREDENTIAL_SECRET) {
+            throw new models_1.ToolingError('UNSUPPORTED_ACTION', 'Runtime credentials are not a developer session. Use a separate developer process.');
+        }
+        if (this.env.MAINSEQUENCE_TOKEN)
+            throw new models_1.ToolingError('INVALID_REQUEST', 'MAINSEQUENCE_TOKEN is unsupported; use explicit MAINSEQUENCE_ACCESS_TOKEN and MAINSEQUENCE_ENDPOINT.');
+        if (!this.env.MAINSEQUENCE_ACCESS_TOKEN && !this.env.MAINSEQUENCE_REFRESH_TOKEN)
+            return null;
+        if (!this.env.MAINSEQUENCE_ENDPOINT || requireBackend(this.env.MAINSEQUENCE_ENDPOINT) !== backend) {
+            throw new models_1.ToolingError('BACKEND_MISMATCH', 'Process credentials must name the same backend with MAINSEQUENCE_ENDPOINT.');
+        }
+        return this.remember({ access: this.env.MAINSEQUENCE_ACCESS_TOKEN || '', refresh: this.env.MAINSEQUENCE_REFRESH_TOKEN || '', username: '' });
+    }
+    async selected(backend) {
+        const explicit = this.environment(backend);
+        if (explicit)
+            return { session: explicit, source: 'environment' };
+        const session = await this.saved(backend);
+        if (!session)
+            throw new models_1.ToolingError('NOT_AUTHENTICATED', 'No session is saved for this backend. Run login.');
+        return { session, source: 'machine' };
+    }
+    async http(backend, method, apiPath, body, access, timeoutMs) {
+        this.options.signal?.throwIfAborted();
+        if ((apiPath !== '/mcp' && !/^\/(api|auth)\//.test(apiPath)) || apiPath.includes('..'))
+            throw new models_1.ToolingError('INVALID_REQUEST', 'Only existing /api/, /auth/, or central /mcp endpoints can be requested.');
+        const controller = new AbortController();
+        const abort = () => controller.abort();
+        this.options.signal?.addEventListener('abort', abort, { once: true });
+        const timer = setTimeout(abort, this.options.requestTimeoutMs ?? timeoutMs ?? 30_000);
+        try {
+            const response = await (this.options.fetch ?? fetch)(backend + apiPath, {
+                method, redirect: 'error', signal: controller.signal,
+                headers: { 'Content-Type': 'application/json', ...(apiPath === '/mcp' ? { Accept: 'application/json, text/event-stream', 'MCP-Protocol-Version': '2025-11-25' } : {}), ...(access ? { Authorization: `Bearer ${access}` } : {}) },
+                body: body === undefined ? undefined : JSON.stringify(body)
+            });
+            if (response.status === 401 || response.status === 403)
+                throw new models_1.ToolingError('AUTH_REJECTED', 'The backend rejected the selected credentials.');
+            if (!response.ok)
+                throw new models_1.ToolingError('API_ERROR', `The backend returned HTTP ${response.status}.`);
+            if (apiPath === '/mcp')
+                return await (0, mcpTransport_1.readMcpResponse)(response, body);
+            if (response.status === 204)
+                return undefined;
+            try {
+                return await response.json();
+            }
+            catch {
+                throw new models_1.ToolingError('API_ERROR', 'The backend returned an invalid JSON response.');
+            }
+        }
+        catch (error) {
+            if (this.options.signal?.aborted)
+                throw new models_1.ToolingError('CANCELLED', 'The action was cancelled.');
+            if (error instanceof models_1.ToolingError)
+                throw error;
+            throw new models_1.ToolingError('BACKEND_UNREACHABLE', 'The backend could not be reached. The saved session has been kept.');
+        }
+        finally {
+            clearTimeout(timer);
+            this.options.signal?.removeEventListener('abort', abort);
+        }
+    }
+    renew(backend, expectedAccount) {
+        const renewalKey = JSON.stringify([backend, expectedAccount]);
+        const running = this.renewals.get(renewalKey);
+        if (running)
+            return running;
+        const task = (async () => {
+            // Bypass cached state: another SDK process may have rotated the refresh token.
+            const previous = await this.saved(backend);
+            if (!previous?.refresh)
+                throw new models_1.ToolingError('NOT_AUTHENTICATED', 'No refreshable machine session is saved for this backend.');
+            if (expectedAccount !== undefined && previous.username && previous.username !== expectedAccount)
+                throw this.accountChanged();
+            let data;
+            try {
+                data = await this.http(backend, 'POST', '/auth/jwt-token/token/refresh/', { refresh: previous.refresh });
+            }
+            catch (error) {
+                if (error instanceof models_1.ToolingError && error.code === 'AUTH_REJECTED')
+                    throw refusedCredentials('machine', backend, previous.refresh);
+                throw error;
+            }
+            const session = this.remember(tokenPair(data, previous));
+            if (expectedAccount !== undefined) {
+                const current = await this.saved(backend);
+                if (!current || current.access !== previous.access || current.refresh !== previous.refresh)
+                    throw this.accountChanged();
+            }
+            // Refresh may rotate the old token. Keep the new pair even if the subsequent
+            // profile check is unavailable; no domain request runs before that check passes.
+            await this.persist(backend, session);
+            if (expectedAccount !== undefined)
+                await this.verifyAccount(backend, session, expectedAccount);
+            return session;
+        })();
+        this.renewals.set(renewalKey, task);
+        void task.finally(() => this.renewals.delete(renewalKey)).catch(() => { });
+        return task;
+    }
+    async persist(backend, session) {
+        try {
+            if (this.options.persistence)
+                await this.options.persistence.write(backend, session);
+            else
+                (0, machineSession_1.saveSession)(this.requireStore(), backend, session);
+            const saved = await this.saved(backend);
+            if (!saved || saved.access !== session.access || saved.refresh !== session.refresh)
+                throw new Error('verification failed');
+        }
+        catch {
+            throw new models_1.ToolingError('PERSISTENCE_FAILED', 'Authorization completed but the machine session could not be saved and verified.');
+        }
+    }
+    async status(input, check = false) {
+        const backend = requireBackend(input);
+        const explicit = this.environment(backend);
+        let session = explicit || ((this.store || this.options.persistence) ? await this.saved(backend) : null);
+        const source = explicit ? 'environment' : session ? (this.options.persistence?.mode ?? 'machine') : 'none';
+        let expiresAt = expiry(session?.access || '');
+        let authenticated = Boolean(session?.access && (!expiresAt || Date.parse(expiresAt) > Date.now()) || (!explicit && session?.refresh));
+        if (check) {
+            if (!authenticated)
+                throw new models_1.ToolingError('NOT_AUTHENTICATED', 'No usable session is selected for this backend.');
+            if (authenticated) {
+                const profile = await this.request(backend, 'GET', '/api/v1/users/me/');
+                const username = profile?.user?.username || profile?.username;
+                if (typeof username === 'string')
+                    session = { ...session, username };
+                authenticated = true;
+                expiresAt = expiry((explicit || await this.saved(backend))?.access || '');
+            }
+        }
+        return {
+            backend, authenticated, source,
+            persistence: explicit ? 'environment' : this.options.persistence?.mode ?? (this.store ? 'machine' : 'unavailable'),
+            store: this.options.persistence?.name ?? this.store?.name ?? null,
+            ...(session?.username ? { username: session.username } : {}),
+            ...(expiresAt ? { expiresAt } : {}), ...(check ? { checked: true } : {})
+        };
+    }
+    async request(input, method, apiPath, body, retrySafe = method === 'GET', options) {
+        return this.accountRequest(input, method, apiPath, body, retrySafe, options);
+    }
+    accountChanged() {
+        return new AccountChangedError();
+    }
+    recordAccount(backend, session, profile, expectedAccount) {
+        const username = profile?.user?.username || profile?.username;
+        if (username !== expectedAccount) {
+            this.verifiedAccounts.delete(JSON.stringify([backend, session.access]));
+            throw this.accountChanged();
+        }
+        if (this.verifiedAccounts.size >= 32)
+            this.verifiedAccounts.delete(this.verifiedAccounts.keys().next().value);
+        this.verifiedAccounts.set(JSON.stringify([backend, session.access]), username);
+    }
+    async verifyAccount(backend, session, expectedAccount) {
+        if (this.verifiedAccounts.get(JSON.stringify([backend, session.access])) === expectedAccount)
+            return;
+        this.recordAccount(backend, session, await this.http(backend, 'GET', '/api/v1/users/me/', undefined, session.access), expectedAccount);
+    }
+    /** The same selected credential is verified and used. A 401 retry must verify its new credential too. */
+    async withAccount(input, expectedAccount) {
+        const backend = requireBackend(input);
+        (0, accountScope_1.validateExpectedAccount)(expectedAccount);
+        const target = (value) => { if (requireBackend(value) !== backend)
+            throw new models_1.ToolingError('BACKEND_MISMATCH', 'The request belongs to another backend.'); };
+        const unsupported = async () => { throw new models_1.ToolingError('UNSUPPORTED_ACTION', 'Account-bound operations cannot change authentication.'); };
+        const scoped = {
+            request: (value, method, apiPath, body, retrySafe = method === 'GET', options) => {
+                target(value);
+                return this.accountRequest(backend, method, apiPath, body, retrySafe, options, expectedAccount);
+            },
+            status: async (value) => {
+                target(value);
+                await this.accountRequest(backend, 'GET', '/api/v1/users/me/', undefined, true, undefined, expectedAccount);
+                const current = await this.selected(backend);
+                await this.verifyAccount(backend, current.session, expectedAccount);
+                const status = await this.status(backend);
+                if (!status.authenticated)
+                    throw this.accountChanged();
+                return { ...status, username: expectedAccount, checked: true };
+            },
+            login: unsupported, logout: unsupported, refresh: unsupported,
+            sanitize: text => this.sanitize(text),
+        };
+        await scoped.status(backend, true);
+        return scoped;
+    }
+    async accountRequest(input, method, apiPath, body, retrySafe, options, expectedAccount) {
+        if (options?.timeoutMs !== undefined && (!Number.isFinite(options.timeoutMs) || options.timeoutMs <= 0 || options.timeoutMs > 300000))
+            throw new models_1.ToolingError('INVALID_REQUEST', 'Request timeout must be between 1 and 300000 milliseconds.');
+        const backend = requireBackend(input);
+        let { session, source } = await this.selected(backend);
+        if (!session.access || (expiry(session.access) && Date.parse(expiry(session.access)) <= Date.now() + 30_000)) {
+            if (source === 'machine')
+                session = await this.renew(backend, expectedAccount);
+            else if (!session.access)
+                throw new models_1.ToolingError('NOT_AUTHENTICATED', 'The explicit environment has no access token.');
+        }
+        const send = async (selected) => {
+            const checkSelected = async () => {
+                if (expectedAccount === undefined)
+                    return;
+                const current = await this.selected(backend);
+                if (current.source !== source || current.session.access !== selected.access || current.session.refresh !== selected.refresh)
+                    throw this.accountChanged();
+            };
+            if (expectedAccount !== undefined && apiPath !== '/api/v1/users/me/')
+                await this.verifyAccount(backend, selected, expectedAccount);
+            await checkSelected();
+            const value = await this.http(backend, method, apiPath, body, selected.access, options?.timeoutMs);
+            if (expectedAccount !== undefined && apiPath === '/api/v1/users/me/')
+                this.recordAccount(backend, selected, value, expectedAccount);
+            await checkSelected();
+            return value;
+        };
+        try {
+            return await send(session);
+        }
+        catch (error) {
+            if (!(error instanceof models_1.ToolingError) || error.code !== 'AUTH_REJECTED')
+                throw error;
+            // Scope failures are not expired-token failures and must never trigger a replay.
+            if (error instanceof AccountChangedError)
+                throw error;
+            if (source === 'environment')
+                throw refusedCredentials('environment', backend, session.access);
+            if (!retrySafe)
+                throw error;
+            const latest = await this.saved(backend);
+            const retry = latest?.access && latest.access !== session.access ? latest : await this.renew(backend, expectedAccount);
+            try {
+                return await send(retry);
+            }
+            catch (retryError) {
+                if (retryError instanceof AccountChangedError)
+                    throw retryError;
+                if (retryError instanceof models_1.ToolingError && retryError.code === 'AUTH_REJECTED')
+                    throw refusedCredentials('machine', backend, retry.refresh || retry.access);
+                throw retryError;
+            }
+        }
+    }
+    async refresh(input) {
+        const backend = requireBackend(input);
+        await this.renew(backend); // Explicitly renew the saved machine pair, not a user process override.
+        return this.machineStatus(backend);
+    }
+    async machineStatus(backend) {
+        const session = await this.saved(backend);
+        return { backend, authenticated: Boolean(session?.access || session?.refresh), source: session ? (this.options.persistence?.mode ?? 'machine') : 'none', persistence: this.options.persistence?.mode ?? 'machine', store: this.options.persistence?.name ?? this.store?.name ?? null, username: session?.username, expiresAt: expiry(session?.access || '') };
+    }
+    async logout(input) {
+        const backend = requireBackend(input);
+        const session = await this.saved(backend);
+        let revoked = false;
+        try {
+            if (session?.refresh) {
+                await this.http(backend, 'POST', '/auth/cli/revoke/', { refresh: session.refresh });
+                revoked = true;
+            }
+        }
+        catch { /* local logout is still useful offline; report revocation separately */ }
+        if (this.options.signal?.aborted)
+            throw new models_1.ToolingError('CANCELLED', 'The action was cancelled.');
+        try {
+            if (this.options.persistence)
+                await this.options.persistence.remove(backend);
+            else
+                (0, machineSession_1.clearSession)(this.requireStore(), backend);
+        }
+        catch {
+            throw new models_1.ToolingError('STORE_ERROR', 'The machine session could not be removed.');
+        }
+        return { revoked };
+    }
+    async login(input) {
+        const backend = requireBackend(input);
+        if (!this.options.persistence)
+            this.requireStore();
+        // Probe before opening the browser. An old marked entry can be replaced by explicit login.
+        try {
+            await this.saved(backend);
+        }
+        catch (error) {
+            if (!(error instanceof machineSession_1.ForeignEntryError) && !(error instanceof models_1.ToolingError && error.code === 'STORE_ERROR' && error.message.includes('older tool')))
+                throw new models_1.ToolingError('STORE_ERROR', 'The credential store is unavailable. Unlock it before signing in.');
+        }
+        this.options.signal?.throwIfAborted();
+        const state = crypto.randomBytes(32).toString('base64url');
+        const verifier = crypto.randomBytes(64).toString('base64url');
+        const challenge = crypto.createHash('sha256').update(verifier).digest('base64url');
+        let resolveCallback;
+        let rejectCallback;
+        const callback = new Promise((resolve, reject) => { resolveCallback = resolve; rejectCallback = reject; });
+        void callback.catch(() => { });
+        let completed = false;
+        const server = http.createServer((req, res) => {
+            const parsed = new URL(req.url || '/', 'http://127.0.0.1');
+            res.setHeader('Content-Type', 'text/plain; charset=utf-8');
+            res.setHeader('Cache-Control', 'no-store');
+            if (parsed.pathname !== '/callback') {
+                res.writeHead(404).end('Not found');
+                return;
+            }
+            if (parsed.searchParams.get('state') !== state) {
+                res.writeHead(400).end('Invalid authorization state');
+                return;
+            }
+            if (completed) {
+                res.writeHead(409).end('Callback already handled');
+                return;
+            }
+            completed = true;
+            const code = parsed.searchParams.get('code');
+            if (!code || parsed.searchParams.has('error')) {
+                rejectCallback(new models_1.ToolingError('INVALID_CALLBACK', 'Browser authorization did not return an authorization code.'));
+                res.writeHead(400).end('MainSequence authorization failed. Return to your developer tool.');
+            }
+            else {
+                resolveCallback(code);
+                res.end('MainSequence authorization received. Return to your developer tool to check that it was saved.');
+            }
+        });
+        const abort = () => rejectCallback(new models_1.ToolingError('CANCELLED', 'Login was cancelled.'));
+        this.options.signal?.addEventListener('abort', abort, { once: true });
+        const timer = setTimeout(() => rejectCallback(new models_1.ToolingError('LOGIN_TIMEOUT', 'Timed out waiting for browser authorization.')), this.options.loginTimeoutMs ?? 300_000);
+        try {
+            await new Promise((resolve, reject) => { server.once('error', reject); server.listen(0, '127.0.0.1', resolve); });
+            const address = server.address();
+            if (!address || typeof address === 'string')
+                throw new models_1.ToolingError('BROWSER_FAILED', 'Could not start the loopback callback.');
+            const redirectUri = `http://127.0.0.1:${address.port}/callback`;
+            const params = new URLSearchParams({ client_id: 'mainsequence-cli', response_type: 'code', state, redirect_uri: redirectUri, code_challenge: challenge, code_challenge_method: 'S256', prompt: 'select_account' });
+            let opened = false;
+            try {
+                opened = await this.host.openBrowser(`${backend}/auth/cli/authorize/?${params}`);
+            }
+            catch { /* safe error below */ }
+            if (!opened)
+                throw new models_1.ToolingError('BROWSER_FAILED', 'Could not open the browser. Check your desktop browser configuration.');
+            const code = await callback;
+            const session = this.remember(tokenPair(await this.http(backend, 'POST', '/auth/cli/token/', { client_id: 'mainsequence-cli', code, code_verifier: verifier, redirect_uri: redirectUri })));
+            await this.persist(backend, session);
+            if (!session.username) {
+                try {
+                    const profile = await this.request(backend, 'GET', '/api/v1/users/me/');
+                    const username = profile?.user?.username || profile?.username;
+                    const latest = await this.saved(backend);
+                    if (typeof username === 'string' && username.trim() && latest)
+                        await this.persist(backend, { ...latest, username: username.trim() });
+                }
+                catch { /* Profile is best-effort; the authorization pair is already durable. */ }
+            }
+            this.options.signal?.throwIfAborted();
+            return this.machineStatus(backend);
+        }
+        finally {
+            clearTimeout(timer);
+            this.options.signal?.removeEventListener('abort', abort);
+            server.closeAllConnections();
+            await new Promise(resolve => { if (server.listening)
+                server.close(() => resolve());
+            else
+                resolve(); });
+        }
+    }
+}
+exports.MachineSessionService = MachineSessionService;
+function createSessionService(host, options = {}) {
+    return new MachineSessionService(host, options);
+}

package/docs/adr/0002-conversational-project-mcp-client.md

@@ -0,0 +1,59 @@
+# ADR 0002: Conversational project MCP connections in the Codex plugin
+
+Date: 2026-10-09. Moved from mainsequence-devtools on 2026-10-21 with the Codex plugin; "this repository" below refers to devtools, where the MCP client (the `mcp-*` actions and the connection store) still lives. The skill, hook and bundled runner that expose it in Codex are released from this repository.
+
+Status: Accepted for implementation by the owner's instruction, "OK then extend the codex plugin", following the explicit proposal to use a bundled client instead of native Codex MCP registration.
+
+## Decision
+
+Extend this repository's shared dispatcher and bundled runner with discovery, add, list, remove, tool-catalog and tool-call actions. Package a normally discoverable mainsequence-mcp skill alongside the explicit-only ms developer-command skill. A person can ask which project MCPs exist, select one, use its tools in the same conversation, and use the saved connection in later conversations. They do not invoke /ms or edit Codex configuration for these actions.
+
+The plugin is an MCP client. Codex runs its bundled helper through its existing execution capability. Each project remains a direct remote MCP endpoint; the platform directory is not a proxy for its tools. No new service, background daemon, application deployment, backend endpoint, credential namespace, or native host modification is introduced.
+
+The distinction from native registration is part of the contract: a saved project does not appear as its own native Codex MCP server or model tool namespace. The helper discovers the live schemas and invokes the selected tool through MCP. The plugin must already be installed and its conversational skill loaded by the host. Distributing an updated plugin is separate from adding a project connection.
+
+## Authentication decision and evidence
+
+Reuse the existing developer machine session and authenticated GET /api/v1/resource-releases/{uid}/exchange-launch/. For a FastAPI release this returns mode=token, release_kind=fastapi, an opaque short-lived release credential, and rpc_url. The current project gateway accepts these release credentials on POST /mcp under current User, release and Environment permissions. Resource-bound browser OAuth remains the independent direct-client login mechanism; this client neither modifies it nor copies a central OAuth token to a project.
+
+This resolves the implementation question using an existing mechanism: an already signed-in developer needs no new browser consent per project and no new backend authorization handoff. A central MCP connection in Codex alone is not a machine session. When that session is missing or expired beyond renewal, the existing hosted developer login remains necessary; the plugin cannot promise first-time sign-in entirely within chat.
+
+The inspected platform contract is owned by platform ADR-0050 sections 4 and 6. Its current text explicitly permits existing release bearer credentials at project MCP endpoints, and its gateway tests cover that path. This ADR records the decision to consume that existing contract so it can be evaluated independently of implementation. No platform ADR amendment or backend behavior change is required by this implementation. No agent-specific approval/exclusion list is introduced.
+
+The platform credential is sent only to the selected backend. The release credential is sent only to the freshly resolved canonical project endpoint, after matching the exchange's RPC origin. It is held in memory for that invocation, redacted from results, and never added to connection files, tool arguments or command lines. Existing machine-session rotation, OS-store behavior and explicit process-identity precedence remain authoritative.
+
+## Discovery and connection lifecycle
+
+Discovery initializes central POST /mcp and calls resource_release.mcp_endpoints with search, limit and offset. It returns the existing directory projection; there is no copied application tool catalog.
+
+Add selects a release UID, rereads the authenticated release detail, validates its current connection, exchanges a release credential, initializes the project and enumerates its paginated tools before saving. Repeated add replaces only the same backend/UID record. Duplicate display names require selecting a UID. Arbitrary caller-provided project URLs are not accepted.
+
+Saved records contain only backend, release UID, display name, and the canonical MCP connection metadata (URL, transport, resource metadata URL, Environment UID, active revision UID). Store them in mcp-connections.json next to the existing CLI configuration:
+
+- macOS: ~/Library/Application Support/MainSequenceCLI/
+- Linux: ~/.config/mainsequence/
+- Windows: %APPDATA%/MainSequenceCLI/ (connection metadata only; native saved authentication remains unsupported by the existing Node store).
+
+Writes use a private file, a lock, and atomic replacement. Corrupt records are preserved and reported. Library/test hosts may supply mcpConnectionsPath without changing the platform credential store.
+
+List is local and does not promise availability. Tools/call require a saved record, reread current release access and MCP capability, and reject an endpoint change until the person adds that release again. A new active revision on the same endpoint uses its current catalog. Remove forgets only the selected record; it does not log out or revoke credentials.
+
+## Transport and operation semantics
+
+Use only the platform's stateless Streamable HTTP profile, MCP 2025-11-25, including initialize, notifications/initialized, tools/list and tools/call. Support JSON and POST SSE results, bounded bodies, pagination, request timeouts and cancellation. Do not add deprecated HTTP+SSE endpoint discovery, protocol downgrade, stateful sessions, subscriptions, tasks, sampling, elicitation, native Codex registration or reload fallbacks.
+
+All server-advertised ordinary tools can be selected, including writes. Tool annotations inform the harness; they do not constitute another permission system. The server validates tool arguments and operation permissions.
+
+Project requests do not follow redirects and are never automatically replayed. Once a tools/call request starts, failure or cancellation reports potentially partial/uncertain effects. MCP isError results remain available as error data with known authentication credentials redacted.
+
+## Classification and verification
+
+A: Amend ADR 0001 to distinguish its original deterministic developer path from the newly approved conversational MCP client.
+
+B: This ADR owns the new local connection lifecycle and host limitation.
+
+C: This is an owner-requested feature, not a defect or code-only fix; no defect issue is opened.
+
+D: Update README and the conversational MCP guide in the same change.
+
+Verification uses separate loopback platform and project servers, synthetic credentials and temporary connection files. Cover discovery through the actual tool name, same-session use, persistence across client instances/processes, duplicate names, backend isolation, private renewal, revocation, endpoint changes, pagination, JSON/SSE, bounded transport failures, no write replay, cancellation, redaction and packaged runner execution. No live project operation or OpenAI inference is required. Real endpoint interoperability and automatic model selection remain deployment validation; fixture tests must not be described as live desktop end-to-end proof.