@dev-mainsequence/codex-plugin 0.3.0 → 0.4.2

package/dist/vendor/devtools/shared/accountScope.js

@@ -0,0 +1,19 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.validateExpectedAccount = validateExpectedAccount;
+exports.bindSessionAccount = bindSessionAccount;
+const models_1 = require("./models.js");
+function validateExpectedAccount(value) {
+    if (typeof value !== 'string' || !value.trim() || value.length > 300 || /[\r\n\0]/.test(value)) {
+        throw new models_1.ToolingError('INVALID_REQUEST', 'Use the account returned by verified session status.');
+    }
+}
+/** Opt-in account scope for domain operations; never silently weaken a custom transport. */
+async function bindSessionAccount(session, backend, expectedAccount) {
+    if (expectedAccount === undefined)
+        return session;
+    validateExpectedAccount(expectedAccount);
+    if (!session.withAccount)
+        throw new models_1.ToolingError('UNSUPPORTED_ACTION', 'This session transport does not support account-bound operations. Upgrade its session implementation.');
+    return session.withAccount(backend, expectedAccount);
+}

package/dist/vendor/devtools/shared/actions.js

@@ -10,6 +10,7 @@ const repositories_1 = require("./repositories.js");
 const projects_1 = require("./projects.js");
 const organizationProjects_1 = require("./organizationProjects.js");
 const organizationProjectWorkspace_1 = require("./organizationProjectWorkspace.js");
+const accountScope_1 = require("./accountScope.js");
 function createDevTools(options) {
     const { host, session: suppliedSession, allowMcpSkills, allowLegacyProjectCredentials, mcpConnectionsPath, ...sessionOptions } = options;
     const session = suppliedSession ?? new session_1.MachineSessionService(host, sessionOptions);
@@ -23,7 +24,8 @@ function createDevTools(options) {
             if (action.startsWith('organization-')) {
                 const input = request;
                 const backend = await (0, repositories_1.resolveBackend)(request.backend, undefined, env);
-                const client = new organizationProjects_1.OrganizationProjectClient(session, backend, options.signal);
+                const scoped = await (0, accountScope_1.bindSessionAccount)(session, backend, input.expectedAccount);
+                const client = new organizationProjects_1.OrganizationProjectClient(scoped, backend, options.signal);
                 let data;
                 if (input.action === 'organization-environments')
                     data = await client.environments();
@@ -33,14 +35,18 @@ function createDevTools(options) {
                     data = await client.getProject(input.environmentUid, input.projectUid);
                 else if (input.action === 'organization-project-link') {
                     const url = await client.link(input);
+                    if (input.expectedAccount !== undefined)
+                        await scoped.status(backend, true);
                     if (!await host.openBrowser(url))
                         throw new models_1.ToolingError('BROWSER_FAILED', 'The resource link could not open.');
                     data = { url };
                 }
                 else if (input.action === 'organization-project-setup')
-                    data = await (0, organizationProjectWorkspace_1.setupOrganizationProject)({ ...input, backend }, { host, session, env, signal: options.signal, state });
+                    data = await (0, organizationProjectWorkspace_1.setupOrganizationProject)({ ...input, backend }, { host, session: scoped, env, signal: options.signal, state });
                 else
                     throw new models_1.ToolingError('INVALID_REQUEST', 'Unknown organization project action.');
+                if (input.expectedAccount !== undefined)
+                    await scoped.status(backend, true);
                 return safeResult({ schemaVersion: 1, action, status: 'success', summary: input.action === 'organization-project-setup' ? 'Project checkouts are prepared on their assigned branches. Claude must attach them when its workspace session starts.' : 'Projects loaded.', data });
             }
             if ((0, agents_1.isAgentAction)(action)) {
@@ -49,7 +55,9 @@ function createDevTools(options) {
             }
             if (action.startsWith('mcp-')) {
                 const backend = await (0, repositories_1.resolveBackend)(request.backend, process.cwd(), env);
-                return safeResult(await new mcp_1.McpConnections(session, { connectionsPath: mcpConnectionsPath, env, fetch: options.fetch, signal: options.signal, requestTimeoutMs: options.requestTimeoutMs }).dispatch(request, backend));
+                const input = request, scoped = await (0, accountScope_1.bindSessionAccount)(session, backend, input.expectedAccount);
+                return safeResult(await new mcp_1.McpConnections(scoped, { connectionsPath: mcpConnectionsPath, env, fetch: options.fetch, signal: options.signal, requestTimeoutMs: options.requestTimeoutMs,
+                    checkAccount: input.expectedAccount === undefined ? undefined : () => scoped.status(backend, true).then(() => { }) }).dispatch(input, backend));
             }
             let data;
             if (['login', 'logout', 'refresh-token', 'auth-status', 'repositories'].includes(action)) {

package/dist/vendor/devtools/shared/agents.js

@@ -54,12 +54,16 @@ class AgentClient {
             if (['agent-session', 'agent-readiness', 'agent-send', 'agent-task-get', 'agent-task-wait', 'agent-task-cancel'].includes(input.action) && !input.expectedAccount) {
                 throw new models_1.ToolingError('INVALID_REQUEST', 'Agent conversations must be bound to the account returned by discovery.');
             }
+            // The built-in session binds every request/retry to the selected account. Legacy
+            // custom agent transports retain their existing account-check contract.
+            const session = input.expectedAccount !== undefined && this.session.withAccount
+                ? await this.session.withAccount(backend, input.expectedAccount) : this.session;
             const timeouts = new Map();
             const client = new mcpTransport_1.McpTransport(message => {
                 const remaining = readinessDeadline === undefined ? undefined : Math.ceil(readinessDeadline - performance.now());
                 if (remaining !== undefined && remaining <= 0)
                     throw new models_1.ToolingError('PROCESS_TIMEOUT', 'The agent did not become ready in time. No message was sent. Try again.');
-                return this.session.request(backend, 'POST', '/mcp', message, message.method !== 'tools/call' || !['a2a.send_message', 'a2a.cancel_task'].includes(message.params?.name), remaining !== undefined ? { timeoutMs: Math.min(30000, remaining) }
+                return session.request(backend, 'POST', '/mcp', message, message.method !== 'tools/call' || !['a2a.send_message', 'a2a.cancel_task'].includes(message.params?.name), remaining !== undefined ? { timeoutMs: Math.min(30000, remaining) }
                     : message.method === 'tools/call' && timeouts.has(message.params?.name) ? { timeoutMs: timeouts.get(message.params.name) } : undefined);
             });
             await client.initialize();

package/dist/vendor/devtools/shared/environments.js

@@ -0,0 +1,38 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.listEnvironments = listEnvironments;
+const models_1 = require("./models.js");
+const session_1 = require("./session.js");
+/** One bounded directory reader for all hosts and domain clients. No settings writes. */
+async function listEnvironments(session, inputBackend, signal) {
+    const backend = (0, session_1.requireBackend)(inputBackend), items = [], seen = new Set();
+    let expectedCount;
+    for (let offset = 0;;) {
+        signal?.throwIfAborted();
+        const page = await session.request(backend, 'GET', `/api/v1/organization-environments/?limit=100&offset=${offset}`);
+        signal?.throwIfAborted();
+        const rows = Array.isArray(page) ? page : page?.results;
+        const count = Array.isArray(page) ? page.length : page?.count;
+        if (!Array.isArray(rows) || !Number.isSafeInteger(count) || count < 0 || count > 10_000 || offset + rows.length > count
+            || (expectedCount !== undefined && expectedCount !== count) || (offset > 0 && Array.isArray(page))) {
+            throw new models_1.ToolingError('API_ERROR', 'The environment pagination is invalid or changed. Refresh the directory.');
+        }
+        expectedCount = count;
+        for (const row of rows) {
+            if (typeof row?.uid !== 'string' || !/^[a-f0-9]{8}(?:-[a-f0-9]{4}){3}-[a-f0-9]{12}$/i.test(row.uid)
+                || typeof row.name !== 'string' || !row.name.trim() || /[\r\n\0]/.test(row.name)) {
+                throw new models_1.ToolingError('API_ERROR', 'The backend returned an invalid organization environment.');
+            }
+            const uid = row.uid.toLowerCase();
+            if (seen.has(uid))
+                throw new models_1.ToolingError('API_ERROR', 'Environment pagination returned duplicate rows.');
+            seen.add(uid);
+            items.push({ uid, name: row.name.trim(), isProduction: row.is_production === true });
+        }
+        offset += rows.length;
+        if (offset === count)
+            return items;
+        if (!rows.length)
+            throw new models_1.ToolingError('API_ERROR', 'Environment pagination stopped before completion.');
+    }
+}

package/dist/vendor/devtools/shared/mcp.js

@@ -41,12 +41,22 @@ const node_crypto_1 = require("node:crypto");
 const models_1 = require("./models.js");
 const session_1 = require("./session.js");
 const mcpTransport_1 = require("./mcpTransport.js");
+const repositoryModels_1 = require("./repositoryModels.js");
+const environments_1 = require("./environments.js");
+const UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
 function uuid(value) {
-    if (typeof value !== 'string' || !/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(value)) {
+    if (typeof value !== 'string' || !UUID.test(value)) {
         throw new models_1.ToolingError('INVALID_REQUEST', 'Select an exact resource release UUID from MCP discovery or saved connections.');
     }
     return value.toLowerCase();
 }
+/** Optional labels: an absent or malformed value is dropped, never an error. */
+function labels(row) {
+    const text = (value) => typeof value === 'string' && value.trim() && !/[\r\n\0]/.test(value) ? value.trim() : undefined;
+    const name = text(row?.name), display = text(row?.display_name);
+    const branch = typeof row?.code_repository_branch_uid === 'string' && UUID.test(row.code_repository_branch_uid) ? row.code_repository_branch_uid.toLowerCase() : undefined;
+    return { ...(name ? { name } : {}), ...(display ? { display_name: display } : {}), ...(branch ? { code_repository_branch_uid: branch } : {}) };
+}
 function endpoint(value, metadata = false) {
     if (typeof value !== 'string')
         throw new models_1.ToolingError('API_ERROR', 'The backend returned no MCP endpoint.');
@@ -76,8 +86,7 @@ function connection(backend, row) {
     if ([...metadataQuery.keys()].some(key => key !== 'resource_release_uid') || metadataQuery.getAll('resource_release_uid').length !== 1
         || metadataQuery.get('resource_release_uid') !== releaseUid)
         throw new models_1.ToolingError('API_ERROR', 'The MCP metadata targets another release.');
-    return { backend: (0, session_1.requireBackend)(backend), resource_release_uid: releaseUid,
-        ...(typeof row.name === 'string' && row.name.trim() ? { name: row.name } : {}),
+    return { backend: (0, session_1.requireBackend)(backend), resource_release_uid: releaseUid, ...labels(row),
         mcp_connection: { url, transport: 'streamable-http', resource_metadata_url: metadataUrl,
             organization_environment_uid: uuid(c.organization_environment_uid),
             ...(typeof c.organization_environment_name === 'string' && c.organization_environment_name.trim() ? { organization_environment_name: c.organization_environment_name.trim() } : {}), active_revision_uid: uuid(c.active_revision_uid) } };
@@ -128,6 +137,7 @@ class McpConnections {
     }
     async update(change) {
         this.options.signal?.throwIfAborted();
+        await this.options.checkAccount?.();
         await fs.mkdir(path.dirname(this.file), { recursive: true, mode: 0o700 });
         const lock = this.file + '.lock', temporary = this.file + '.' + (0, node_crypto_1.randomUUID)() + '.tmp';
         let handle;
@@ -174,15 +184,113 @@ class McpConnections {
         if (new URL(endpoint(grant.rpc_url)).origin !== new URL(value.mcp_connection.url).origin) {
             throw new models_1.ToolingError('API_ERROR', 'The release credential targets a different endpoint.');
         }
-        const client = new mcpTransport_1.McpTransport(message => (0, mcpTransport_1.sendProjectMcp)(value.mcp_connection.url, grant.token, message, this.options));
+        const client = new mcpTransport_1.McpTransport(async (message) => {
+            await this.options.checkAccount?.();
+            const result = await (0, mcpTransport_1.sendProjectMcp)(value.mcp_connection.url, grant.token, message, this.options);
+            await this.options.checkAccount?.();
+            return result;
+        });
         await client.initialize();
         return client;
     }
+    /** The release's name and repository from the release directory and its branch. Whatever
+     * cannot be read is left out: labels never make a working MCP unavailable. */
+    async resolveLabels(value) {
+        const found = {};
+        const read = async (apiPath) => {
+            try {
+                return await this.session.request(value.backend, 'GET', apiPath, undefined, true);
+            }
+            catch {
+                this.options.signal?.throwIfAborted();
+                return undefined;
+            }
+        };
+        // The release detail carries no name or repository; the directory projection does.
+        const page = await read('/api/v1/resource-releases/?search=' + encodeURIComponent(value.resource_release_uid) + '&limit=100');
+        const row = Array.isArray(page?.results) ? page.results.find((item) => typeof item?.uid === 'string' && item.uid.toLowerCase() === value.resource_release_uid) : undefined;
+        if (row)
+            Object.assign(found, labels({ name: row.name, code_repository_branch_uid: row.code_repository_branch_uid }));
+        const branchUid = found.code_repository_branch_uid ?? value.code_repository_branch_uid;
+        if (branchUid) {
+            const branch = await read('/api/v1/code-repository-branches/' + encodeURIComponent(branchUid) + '/');
+            try {
+                const parsed = (0, repositoryModels_1.codeRepositoryBranchFromResponse)(branch, 'CodeRepositoryBranch response');
+                if (parsed.uid.toLowerCase() === branchUid)
+                    Object.assign(found, labels({ display_name: parsed.code_repository_name, code_repository_branch_uid: branchUid }));
+            }
+            catch { /* an unreadable branch leaves the repository name out */ }
+        }
+        return found;
+    }
+    labelled(value, found) {
+        return connection(value.backend, { ...value, ...found });
+    }
+    /** Optional discovery labels, deduplicated by branch. Never writes connection metadata. */
+    async discoveryNames(rows) {
+        const pending = [...new Set(rows.filter(row => !row.display_name).flatMap(row => row.code_repository_branch_uid ? [row.code_repository_branch_uid] : []))];
+        const names = new Map();
+        await Promise.all(Array.from({ length: Math.min(4, pending.length) }, async () => {
+            while (pending.length) {
+                this.options.signal?.throwIfAborted();
+                const uid = pending.shift();
+                try {
+                    const raw = await this.session.request(rows[0].backend, 'GET', '/api/v1/code-repository-branches/' + uid + '/');
+                    const branch = (0, repositoryModels_1.codeRepositoryBranchFromResponse)(raw, 'CodeRepositoryBranch response');
+                    if (branch.uid.toLowerCase() === uid)
+                        names.set(uid, branch.code_repository_name);
+                }
+                catch (error) {
+                    this.options.signal?.throwIfAborted();
+                    if (error instanceof models_1.ToolingError && error.code === 'CANCELLED')
+                        throw error;
+                    await this.options.checkAccount?.();
+                    // Unavailable optional names must not hide usable endpoints.
+                }
+            }
+        }));
+        return rows.map(row => !row.display_name && row.code_repository_branch_uid && names.has(row.code_repository_branch_uid)
+            ? this.labelled(row, { display_name: names.get(row.code_repository_branch_uid) }) : row);
+    }
+    /** Records saved before labels were stored are completed once, when the backend answers. */
+    async backfill(rows) {
+        const pending = rows.filter(row => !row.display_name);
+        if (!pending.length)
+            return rows;
+        const found = new Map();
+        await Promise.all(Array.from({ length: Math.min(4, pending.length) }, async () => {
+            while (pending.length) {
+                const row = pending.shift();
+                const resolved = await this.resolveLabels(row);
+                const added = Object.entries(resolved).filter(([key, item]) => item !== row[key]);
+                if (added.length)
+                    found.set(row.backend + ' ' + row.resource_release_uid, Object.fromEntries(added));
+            }
+        }));
+        if (!found.size)
+            return rows;
+        const key = (row) => row.backend + ' ' + row.resource_release_uid;
+        const merge = (row) => found.has(key(row)) ? this.labelled(row, { ...found.get(key(row)) }) : row;
+        try {
+            await this.update(all => all.map(merge));
+        }
+        catch (error) {
+            // A held lock or a failed write keeps the listing itself available.
+            if (error instanceof models_1.ToolingError && error.code === 'CANCELLED')
+                throw error;
+            this.options.signal?.throwIfAborted();
+        }
+        return rows.map(merge);
+    }
     async dispatch(request, inputBackend) {
         let callStarted = false, resultData;
         try {
             const backend = (0, session_1.requireBackend)(inputBackend);
             this.options.signal?.throwIfAborted();
+            if (request.action === 'mcp-list' && request.readOnly !== undefined && typeof request.readOnly !== 'boolean'
+                || request.action === 'mcp-discover' && request.enrichNames !== undefined && typeof request.enrichNames !== 'boolean') {
+                throw new models_1.ToolingError('INVALID_REQUEST', 'Discovery and listing options must be booleans.');
+            }
             const environmentUid = request.environmentUid === undefined ? undefined : uuid(request.environmentUid);
             const belongs = (value) => !environmentUid || value.mcp_connection.organization_environment_uid === environmentUid;
             const requireEnvironment = (value) => {
@@ -191,31 +299,7 @@ class McpConnections {
             };
             let data, summary;
             if (request.action === 'mcp-environments') {
-                const environments = new Map();
-                for (let offset = 0;; offset += 100) {
-                    this.options.signal?.throwIfAborted();
-                    if (offset >= 10000)
-                        throw new models_1.ToolingError('API_ERROR', 'The environment list is too large.');
-                    const page = await this.session.request(backend, 'GET', `/api/v1/organization-environments/?limit=100&offset=${offset}`);
-                    const items = Array.isArray(page) ? page : page?.results;
-                    if (!Array.isArray(items))
-                        throw new models_1.ToolingError('API_ERROR', 'The backend returned an invalid environment list.');
-                    for (const row of items) {
-                        if (typeof row?.name !== 'string' || !row.name.trim())
-                            throw new models_1.ToolingError('API_ERROR', 'An organization environment has no name.');
-                        const uid = uuid(row.uid);
-                        environments.set(uid, { uid, name: row.name.trim(), isProduction: row.is_production === true });
-                    }
-                    if (Array.isArray(page))
-                        break;
-                    if (!Number.isInteger(page.count) || page.count < 0)
-                        throw new models_1.ToolingError('API_ERROR', 'The environment pagination is invalid.');
-                    if (offset + 100 >= page.count)
-                        break;
-                    if (!items.length)
-                        throw new models_1.ToolingError('API_ERROR', 'The environment directory changed; refresh it.');
-                }
-                data = [...environments.values()];
+                data = await (0, environments_1.listEnvironments)(this.session, backend, this.options.signal);
                 summary = 'Organization environments available to your MainSequence account.';
             }
             else if (request.action === 'mcp-discover') {
@@ -255,10 +339,15 @@ class McpConnections {
                     const values = [...matching.values()], offset = request.offset ?? 0;
                     data = { count: values.length, results: values.slice(offset, offset + (request.limit ?? 100)) };
                 }
+                if (request.enrichNames) {
+                    const page = data;
+                    data = { ...page, results: await this.discoveryNames(page.results) };
+                }
                 summary = 'Available project MCP endpoints; discovery does not save a connection.';
             }
             else if (request.action === 'mcp-list') {
-                data = (await this.read()).filter(row => row.backend === backend && belongs(row));
+                const saved = (await this.read()).filter(row => row.backend === backend && belongs(row));
+                data = request.readOnly ? saved : await this.backfill(saved);
                 summary = 'Saved MCP connections for this backend. Availability is checked when used.';
             }
             else {
@@ -272,7 +361,7 @@ class McpConnections {
                     summary = 'The saved connection was removed.';
                 }
                 else {
-                    const value = await this.current(backend, releaseUid);
+                    let value = await this.current(backend, releaseUid);
                     requireEnvironment(value);
                     if (request.action !== 'mcp-add') {
                         const saved = (await this.read()).find(row => row.backend === backend && row.resource_release_uid === releaseUid);
@@ -280,10 +369,12 @@ class McpConnections {
                             throw new models_1.ToolingError('INVALID_REQUEST', 'Add this MCP connection before using it.');
                         if (saved.mcp_connection.url !== value.mcp_connection.url)
                             throw new models_1.ToolingError('INVALID_REQUEST', 'The MCP endpoint changed. Add the release again to confirm its new endpoint.');
+                        value = this.labelled(value, labels(saved));
                     }
                     const client = await this.open(value);
                     const tools = await client.tools();
                     if (request.action === 'mcp-add') {
+                        value = this.labelled(value, await this.resolveLabels(value));
                         await this.update(rows => [...rows.filter(row => !(row.backend === backend && row.resource_release_uid === releaseUid)), value]);
                         data = { connection: value, tools };
                         summary = 'MCP connection verified and saved. Its tools can now be used through the plugin.';
@@ -312,6 +403,7 @@ class McpConnections {
                         throw new models_1.ToolingError('INVALID_REQUEST', 'Unknown MCP action.');
                 }
             }
+            await this.options.checkAccount?.();
             return this.sanitize({ schemaVersion: 1, action: request.action, status: 'success', summary, data });
         }
         catch (error) {

package/dist/vendor/devtools/shared/mcpTransport.js

@@ -46,11 +46,24 @@ class McpTransport {
             if (!Array.isArray(page?.tools))
                 throw new models_1.ToolingError('API_ERROR', 'The MCP tool catalog is invalid.');
             for (const tool of page.tools) {
-                if (!tool || typeof tool.name !== 'string' || !tool.name || !tool.inputSchema || typeof tool.inputSchema !== 'object' || names.has(tool.name)) {
+                if (!tool || typeof tool.name !== 'string' || !tool.name || !tool.inputSchema || typeof tool.inputSchema !== 'object' || Array.isArray(tool.inputSchema) || names.has(tool.name)) {
                     throw new models_1.ToolingError('API_ERROR', 'The MCP tool catalog contains an invalid or duplicate tool.');
                 }
+                const normalized = { ...tool };
+                if (typeof normalized.description !== 'string')
+                    delete normalized.description;
+                for (const field of ['annotations', '_meta'])
+                    if (!normalized[field] || typeof normalized[field] !== 'object' || Array.isArray(normalized[field]))
+                        delete normalized[field];
+                if (normalized.annotations) {
+                    normalized.annotations = { ...normalized.annotations };
+                    for (const flag of ['readOnlyHint', 'destructiveHint', 'idempotentHint', 'openWorldHint']) {
+                        if (typeof normalized.annotations[flag] !== 'boolean')
+                            delete normalized.annotations[flag];
+                    }
+                }
                 names.add(tool.name);
-                tools.push(tool);
+                tools.push(normalized);
             }
             cursor = page.nextCursor;
             if (cursor !== undefined && (typeof cursor !== 'string' || !cursor || cursors.has(cursor))) {

package/dist/vendor/devtools/shared/organizationProjects.js

@@ -6,6 +6,7 @@ const models_1 = require("./models.js");
 const session_1 = require("./session.js");
 const repositoryModels_1 = require("./repositoryModels.js");
 const repositoryClient_1 = require("./repositoryClient.js");
+const environments_1 = require("./environments.js");
 function projectUid(value, label = 'UID') {
     if (typeof value !== 'string' || !/^[a-f0-9]{8}(?:-[a-f0-9]{4}){3}-[a-f0-9]{12}$/i.test(value))
         throw new models_1.ToolingError('INVALID_REQUEST', `${label} must be a UUID.`);
@@ -58,19 +59,7 @@ class OrganizationProjectClient {
     }
     async get(apiPath) { this.signal?.throwIfAborted(); return this.session.request(this.backend, 'GET', apiPath); }
     async environments() {
-        const items = [];
-        for (let offset = 0;;) {
-            const payload = pageValues(await this.get(`/api/v1/organization-environments/?limit=100&offset=${offset}`));
-            const rows = payload.results.map(row => ({ uid: projectUid(object(row).uid), name: line(row.name, 'environment name') }));
-            if (rows.some(row => items.some(item => item.uid === row.uid)))
-                throw new models_1.ToolingError('API_ERROR', 'Environment pagination returned duplicate rows.');
-            items.push(...rows);
-            offset += rows.length;
-            if (offset >= payload.count)
-                return items;
-            if (!rows.length)
-                throw new models_1.ToolingError('API_ERROR', 'Environment pagination stopped before completion.');
-        }
+        return (await (0, environments_1.listEnvironments)(this.session, this.backend, this.signal)).map(({ uid, name }) => ({ uid, name }));
     }
     async list(environment, options = {}) {
         const environmentUid = projectUid(environment, 'Environment UID'), limit = options.limit ?? 25, offset = options.offset ?? 0;

package/dist/vendor/devtools/shared/session.js

@@ -44,6 +44,10 @@ const http = __importStar(require("http"));
 const config_1 = require("./config.js");
 const machineSession_1 = require("./machineSession.js");
 const models_1 = require("./models.js");
+const accountScope_1 = require("./accountScope.js");
+class AccountChangedError extends models_1.ToolingError {
+    constructor() { super('AUTH_REJECTED', 'The MainSequence account or session changed. Refresh the current view before continuing.'); }
+}
 function requireBackend(input) {
     const backend = (0, config_1.normalizeBackendUrl)(input);
     let url;
@@ -101,6 +105,7 @@ class MachineSessionService {
     env;
     renewals = new Map();
     secrets = new Set();
+    verifiedAccounts = new Map();
     constructor(host, options = {}) {
         this.host = host;
         this.options = options;
@@ -213,8 +218,9 @@ class MachineSessionService {
             this.options.signal?.removeEventListener('abort', abort);
         }
     }
-    renew(backend) {
-        const running = this.renewals.get(backend);
+    renew(backend, expectedAccount) {
+        const renewalKey = JSON.stringify([backend, expectedAccount]);
+        const running = this.renewals.get(renewalKey);
         if (running)
             return running;
         const task = (async () => {
@@ -222,6 +228,8 @@ class MachineSessionService {
             const previous = await this.saved(backend);
             if (!previous?.refresh)
                 throw new models_1.ToolingError('NOT_AUTHENTICATED', 'No refreshable machine session is saved for this backend.');
+            if (expectedAccount !== undefined && previous.username && previous.username !== expectedAccount)
+                throw this.accountChanged();
             let data;
             try {
                 data = await this.http(backend, 'POST', '/auth/jwt-token/token/refresh/', { refresh: previous.refresh });
@@ -232,11 +240,20 @@ class MachineSessionService {
                 throw error;
             }
             const session = this.remember(tokenPair(data, previous));
+            if (expectedAccount !== undefined) {
+                const current = await this.saved(backend);
+                if (!current || current.access !== previous.access || current.refresh !== previous.refresh)
+                    throw this.accountChanged();
+            }
+            // Refresh may rotate the old token. Keep the new pair even if the subsequent
+            // profile check is unavailable; no domain request runs before that check passes.
             await this.persist(backend, session);
+            if (expectedAccount !== undefined)
+                await this.verifyAccount(backend, session, expectedAccount);
             return session;
         })();
-        this.renewals.set(backend, task);
-        void task.finally(() => this.renewals.delete(backend)).catch(() => { });
+        this.renewals.set(renewalKey, task);
+        void task.finally(() => this.renewals.delete(renewalKey)).catch(() => { });
         return task;
     }
     async persist(backend, session) {
@@ -281,32 +298,103 @@ class MachineSessionService {
         };
     }
     async request(input, method, apiPath, body, retrySafe = method === 'GET', options) {
+        return this.accountRequest(input, method, apiPath, body, retrySafe, options);
+    }
+    accountChanged() {
+        return new AccountChangedError();
+    }
+    recordAccount(backend, session, profile, expectedAccount) {
+        const username = profile?.user?.username || profile?.username;
+        if (username !== expectedAccount) {
+            this.verifiedAccounts.delete(JSON.stringify([backend, session.access]));
+            throw this.accountChanged();
+        }
+        if (this.verifiedAccounts.size >= 32)
+            this.verifiedAccounts.delete(this.verifiedAccounts.keys().next().value);
+        this.verifiedAccounts.set(JSON.stringify([backend, session.access]), username);
+    }
+    async verifyAccount(backend, session, expectedAccount) {
+        if (this.verifiedAccounts.get(JSON.stringify([backend, session.access])) === expectedAccount)
+            return;
+        this.recordAccount(backend, session, await this.http(backend, 'GET', '/api/v1/users/me/', undefined, session.access), expectedAccount);
+    }
+    /** The same selected credential is verified and used. A 401 retry must verify its new credential too. */
+    async withAccount(input, expectedAccount) {
+        const backend = requireBackend(input);
+        (0, accountScope_1.validateExpectedAccount)(expectedAccount);
+        const target = (value) => { if (requireBackend(value) !== backend)
+            throw new models_1.ToolingError('BACKEND_MISMATCH', 'The request belongs to another backend.'); };
+        const unsupported = async () => { throw new models_1.ToolingError('UNSUPPORTED_ACTION', 'Account-bound operations cannot change authentication.'); };
+        const scoped = {
+            request: (value, method, apiPath, body, retrySafe = method === 'GET', options) => {
+                target(value);
+                return this.accountRequest(backend, method, apiPath, body, retrySafe, options, expectedAccount);
+            },
+            status: async (value) => {
+                target(value);
+                await this.accountRequest(backend, 'GET', '/api/v1/users/me/', undefined, true, undefined, expectedAccount);
+                const current = await this.selected(backend);
+                await this.verifyAccount(backend, current.session, expectedAccount);
+                const status = await this.status(backend);
+                if (!status.authenticated)
+                    throw this.accountChanged();
+                return { ...status, username: expectedAccount, checked: true };
+            },
+            login: unsupported, logout: unsupported, refresh: unsupported,
+            sanitize: text => this.sanitize(text),
+        };
+        await scoped.status(backend, true);
+        return scoped;
+    }
+    async accountRequest(input, method, apiPath, body, retrySafe, options, expectedAccount) {
         if (options?.timeoutMs !== undefined && (!Number.isFinite(options.timeoutMs) || options.timeoutMs <= 0 || options.timeoutMs > 300000))
             throw new models_1.ToolingError('INVALID_REQUEST', 'Request timeout must be between 1 and 300000 milliseconds.');
         const backend = requireBackend(input);
         let { session, source } = await this.selected(backend);
         if (!session.access || (expiry(session.access) && Date.parse(expiry(session.access)) <= Date.now() + 30_000)) {
             if (source === 'machine')
-                session = await this.renew(backend);
+                session = await this.renew(backend, expectedAccount);
             else if (!session.access)
                 throw new models_1.ToolingError('NOT_AUTHENTICATED', 'The explicit environment has no access token.');
         }
+        const send = async (selected) => {
+            const checkSelected = async () => {
+                if (expectedAccount === undefined)
+                    return;
+                const current = await this.selected(backend);
+                if (current.source !== source || current.session.access !== selected.access || current.session.refresh !== selected.refresh)
+                    throw this.accountChanged();
+            };
+            if (expectedAccount !== undefined && apiPath !== '/api/v1/users/me/')
+                await this.verifyAccount(backend, selected, expectedAccount);
+            await checkSelected();
+            const value = await this.http(backend, method, apiPath, body, selected.access, options?.timeoutMs);
+            if (expectedAccount !== undefined && apiPath === '/api/v1/users/me/')
+                this.recordAccount(backend, selected, value, expectedAccount);
+            await checkSelected();
+            return value;
+        };
         try {
-            return await this.http(backend, method, apiPath, body, session.access, options?.timeoutMs);
+            return await send(session);
         }
         catch (error) {
             if (!(error instanceof models_1.ToolingError) || error.code !== 'AUTH_REJECTED')
                 throw error;
+            // Scope failures are not expired-token failures and must never trigger a replay.
+            if (error instanceof AccountChangedError)
+                throw error;
             if (source === 'environment')
                 throw refusedCredentials('environment', backend, session.access);
             if (!retrySafe)
                 throw error;
             const latest = await this.saved(backend);
-            const retry = latest?.access && latest.access !== session.access ? latest : await this.renew(backend);
+            const retry = latest?.access && latest.access !== session.access ? latest : await this.renew(backend, expectedAccount);
             try {
-                return await this.http(backend, method, apiPath, body, retry.access, options?.timeoutMs);
+                return await send(retry);
             }
             catch (retryError) {
+                if (retryError instanceof AccountChangedError)
+                    throw retryError;
                 if (retryError instanceof models_1.ToolingError && retryError.code === 'AUTH_REJECTED')
                     throw refusedCredentials('machine', backend, retry.refresh || retry.access);
                 throw retryError;