@fungi.computer/truffle 0.1.1 → 0.2.1

package/dist/private-files-patch.d.ts

@@ -1,3 +1,4 @@
 import type { FilesPatch, FilesPort } from "@fungi.computer/knapsack";
+import { type LocalSandboxLaunch } from "./private-invocation-computer.js";
 /** Advertise only a packaged native engine; never install tools during a model call. */
-export declare function createPrivateFilesPatch(root: string, read: FilesPort["read"]): Promise<FilesPatch | undefined>;
+export declare function createPrivateFilesPatch(root: string, read: FilesPort["read"], sandbox?: LocalSandboxLaunch): Promise<FilesPatch | undefined>;

package/dist/private-files-patch.js

@@ -5,7 +5,7 @@ import process from "node:process";
 import * as ChildProcess from "effect/process/ChildProcess";
 import { parsePatch } from "diff";
 import * as Stream from "effect/Stream";
-import { runPrivateInvocationProcess } from "./private-invocation-computer.js";
+import { runPrivateInvocationProcess, } from "./private-invocation-computer.js";
 function patchExecutable() {
     if (process.env.FUNGI_BUNDLED_CLI) {
         const name = `@fungi.computer/spore-native-${process.platform}-${process.arch}`;
@@ -33,6 +33,8 @@ async function unifiedDiffContext(patch, read, context) {
         if (path === undefined || hunk === undefined || path === "/dev/null")
             return "\nInclude *** Update File: path/to/file before @@ to identify the target.\n";
         const current = await read({ path, offset: 0, limit: maximumPatchBytes }, context);
+        if ("image" in current)
+            throw new Error(`${path} is an image, not text`);
         const lines = current.content.split(/\r?\n/u);
         const from = Math.min(Math.max(0, hunk.oldStart - 3), Math.max(0, lines.length - 7));
         const nearby = lines
@@ -46,7 +48,7 @@ async function unifiedDiffContext(patch, read, context) {
     }
 }
 /** Advertise only a packaged native engine; never install tools during a model call. */
-export async function createPrivateFilesPatch(root, read) {
+export async function createPrivateFilesPatch(root, read, sandbox) {
     const executable = patchExecutable();
     try {
         await access(executable, constants.X_OK);
@@ -61,9 +63,25 @@ export async function createPrivateFilesPatch(root, read) {
         const bytes = new TextEncoder().encode(patch);
         if (bytes.byteLength > maximumPatchBytes)
             throw new Error("Patch exceeds the 128 KiB input bound");
-        const command = ChildProcess.make(executable, {
+        const launch = sandbox?.(root, [executable]);
+        const env = { ...process.env, ...launch?.environment };
+        if (launch !== undefined) {
+            delete env.XDG_RUNTIME_DIR;
+            delete env.DBUS_SESSION_BUS_ADDRESS;
+        }
+        const command = ChildProcess.make(launch?.executable ?? executable, launch?.args ?? [], {
             cwd: root,
+            env,
+            extendEnv: false,
             stdin: Stream.make(bytes),
+            additionalFds: launch?.seccompFilter === undefined
+                ? undefined
+                : {
+                    fd3: {
+                        type: "input",
+                        stream: Stream.make(launch.seccompFilter),
+                    },
+                },
         });
         const result = await runPrivateInvocationProcess(command, context.signal, 30_000);
         if (result.status === "deadline_exceeded")

package/dist/private-fungi-account.d.ts

@@ -1,6 +1,8 @@
 import { type AuthProvider, type FetchLike, type OAuthClientProvider, type StoredOAuthClientInformation } from "@modelcontextprotocol/client";
 import { z } from "zod";
 import type { Credential, CredentialStore, OAuthAuth } from "@earendil-works/pi-ai";
+import { type LocalMachineEnrollmentAccount } from "./private-local-mesh-record.js";
+import { type FungiAccountLogoutResult } from "./private-fungi-service-logout.js";
 /**
  * One folder attached to a Team Computer. The absolute folder path and the
  * device's private key never leave this file; the Hub holds only the public
@@ -35,10 +37,18 @@ export type PrivateFungiAccountOAuthProviderOptions = {
     redirectUrl?: string;
     openBrowser?: (url: URL) => void;
 };
+/**
+ * Enrollment uses the account file and lock, without Pi's selected-payer view.
+ * Fungi enrollments are partitioned by issuer in the origin-keyed enrollment
+ * records: only the signed-in issuer's partition is ever read for dialing, so
+ * a switch never lends one issuer's Team or device identifiers to another,
+ * and signing in to an issuer again finds its own partition.
+ */
+export declare function createLocalMachineEnrollmentAccount(credentialPath: string): LocalMachineEnrollmentAccount;
 /** Hand a Fungi sign-in page to the platform browser; callers show the URL. */
 export declare function launchPlatformBrowser(url: URL): void;
 /** Persisted OAuth state uses Local's existing owner-only Pi credential file. */
-export declare function privateFungiAccountOAuthProvider(options?: PrivateFungiAccountOAuthProviderOptions): OAuthClientProvider & {
+export declare function privateFungiAccountOAuthProvider(input?: PrivateFungiAccountOAuthProviderOptions): OAuthClientProvider & {
     saveClientInformation(information: StoredOAuthClientInformation): Promise<void>;
     expectedState(): string | undefined;
     authorizationUrl(): URL | undefined;
@@ -58,14 +68,13 @@ export type PrivateFungiAccountLoginOptions = {
     /** Opens the Hub pages; the default launches the platform browser. */
     openBrowser?: (url: URL) => void;
 };
-export type PrivateFungiAccountLogoutResult = Readonly<{
-    kind: "not-logged-in" | "removed" | "revoked";
-    message: string;
-    unconfirmedComputers: readonly Readonly<{
-        name: string;
-        url: string;
-    }>[];
+export type PrivateFungiAccountLogoutResult = FungiAccountLogoutResult;
+/** An in-process account change the service owner reacts to. */
+export type FungiAccountChange = Readonly<{
+    type: "signed-out";
 }>;
+/** Installed only by the service holding this home's owner lease. */
+export declare function registerFungiAccountOwner(credentialPath: string, changed: (event: FungiAccountChange) => Promise<void>): () => void;
 export type FungiAccountStatus = {
     issuer: string;
     accessExpiresAt: Date;
@@ -73,14 +82,22 @@ export type FungiAccountStatus = {
     teamCount?: number;
 };
 /** Non-secret status of the shared Fungi account. */
-export declare function readFungiAccountStatus(options?: {
+export declare function readFungiAccountStatus(input?: {
     credentialPath?: string;
 }): Promise<FungiAccountStatus | undefined>;
 /**
- * Remove the saved Fungi MCP login for the endpoint's origin and ask that
- * issuer to revoke its refresh grant. A login for another origin is kept.
+ * Ask the running Local account owner to remove this origin's login and revoke
+ * its refresh grant. Without a service, clear offline; never start one for
+ * logout. A login for another origin is kept. Explicit standalone stores have
+ * no service home; clients with a custom service directory name it explicitly.
  */
-export declare function signOutFungiAccount(rawEndpoint?: string | URL, options?: {
+export declare function signOutFungiAccount(rawEndpoint?: string | URL, input?: {
+    credentialPath?: string;
+    serviceDirectory?: string;
+    fetch?: FetchLike;
+}): Promise<PrivateFungiAccountLogoutResult>;
+/** Store mutation for the service owner or a verified no-service caller. */
+export declare function signOutOwnedFungiAccount(rawEndpoint?: string | URL, input?: {
     credentialPath?: string;
     fetch?: FetchLike;
 }): Promise<PrivateFungiAccountLogoutResult>;
@@ -101,20 +118,20 @@ export declare function fungiMcpTeamEndpoint(rawEndpoint: string | URL): {
     teamId: string;
 };
 /** The machine's attached folders, as Local keeps them. */
-export declare function readFungiMcpLocalBackends(options?: Readonly<{
+export declare function readFungiMcpLocalBackends(input?: Readonly<{
     credentialPath?: string;
 }>): Promise<Readonly<{
     issuer: string | undefined;
     backends: LocalBackendRecord[];
 }>>;
 /** Replace the attached folder records in the owner-only credential file. */
-export declare function writeFungiMcpLocalBackends(update: (current: readonly LocalBackendRecord[]) => LocalBackendRecord[], options?: Readonly<{
+export declare function writeFungiMcpLocalBackends(update: (current: readonly LocalBackendRecord[]) => LocalBackendRecord[], input?: Readonly<{
     credentialPath?: string;
 }>): Promise<void>;
 /** Complete first-party registration and OAuth authorization in a foreground TUI. */
-export declare function signInFungiAccount(rawEndpoint: string | URL, options?: PrivateFungiAccountLoginOptions): Promise<void>;
+export declare function signInFungiAccount(rawEndpoint: string | URL, input?: PrivateFungiAccountLoginOptions): Promise<void>;
 /** Switch only to a fresh membership; failure preserves the prior selected Team. */
-export declare function switchFungiAccountTeam(teamId: string, options?: {
+export declare function switchFungiAccountTeam(teamId: string, input?: {
     credentialPath?: string;
     fetch?: FetchLike;
 }): Promise<void>;
@@ -123,7 +140,7 @@ export type FungiAccountTeams = Readonly<{
     selectedTeamId?: string;
 }>;
 /** Fresh memberships for the saved account, with the Team that pays for models. */
-export declare function readFungiAccountTeams(options?: {
+export declare function readFungiAccountTeams(input?: {
     credentialPath?: string;
     fetch?: FetchLike;
 }): Promise<FungiAccountTeams>;
@@ -192,7 +209,7 @@ export type FungiTeamBalance = Readonly<{
     kind: "not-available";
     reason: "no-team" | "not-a-member" | "sign-in-again" | "sign-in-not-admitted";
 }>;
-export declare function readFungiTeamBalance(options?: {
+export declare function readFungiTeamBalance(input?: {
     credentialPath?: string;
     fetch?: FetchLike;
 }): Promise<FungiTeamBalance>;
@@ -201,7 +218,7 @@ export declare function readFungiTeamBalance(options?: {
  * when the saved access token actually needs it: a plain read never takes
  * the lock or rewrites the file, so a still-valid credential stays untouched.
  */
-export declare function freshFungiAccess(rawHub: string | URL, options?: {
+export declare function freshFungiAccess(rawHub: string | URL, input?: {
     credentialPath?: string;
     fetch?: FetchLike;
     signal?: AbortSignal;
@@ -209,13 +226,13 @@ export declare function freshFungiAccess(rawHub: string | URL, options?: {
     rejectedAccess?: string;
 }): Promise<string>;
 /** Retry an explicitly refused request once; the cloned body is replayable. */
-export declare function fungiAccountFetch(rawHub: string | URL, options?: {
+export declare function fungiAccountFetch(rawHub: string | URL, input?: {
     credentialPath?: string;
     fetch?: FetchLike;
     signal?: AbortSignal;
 }): typeof globalThis.fetch;
 /** The SDK owns exactly one retry; this hook rotates only the refused credential. */
-export declare function fungiMcpAccountAuth(endpoint: URL, options?: {
+export declare function fungiMcpAccountAuth(endpoint: URL, input?: {
     credentialPath?: string;
     fetch?: FetchLike;
     signal?: AbortSignal;
@@ -223,12 +240,12 @@ export declare function fungiMcpAccountAuth(endpoint: URL, options?: {
 /** Selected payer metadata belongs to the shared account, never a model request body. */
 export declare function fungiAccountTeam(credential: Credential): FungiAccountTeam;
 /** Pi uses its own locked modify; this owner supplies the same refresh as MCP. */
-export declare function createFungiAccountOAuth(options?: {
+export declare function createFungiAccountOAuth(input?: {
     credentialPath?: string;
     fetch?: FetchLike;
 }): OAuthAuth;
 /** Pi deletion clears Local custody and reports unconfirmed remote revocation. */
-export declare function createFungiAccountCredentialStore(options?: {
+export declare function createFungiAccountCredentialStore(input?: {
     credentialPath?: string;
     fetch?: FetchLike;
 }): CredentialStore;

package/dist/private-fungi-account.js

@@ -4,12 +4,16 @@ import { createServer, } from "node:http";
 import { randomBytes } from "node:crypto";
 import { spawn } from "node:child_process";
 import process from "node:process";
+import { dirname, resolve } from "node:path";
 import { auth, Client, discoverOAuthServerInfo, refreshAuthorization, OAuthError, StreamableHTTPClientTransport, } from "@modelcontextprotocol/client";
 import { z } from "zod";
 import { createPrivateCredentialStore } from "./private-file-credential-store.js";
+import { capturePrivateLocalConfigRoot } from "./private-local-config-root.js";
 import { parseFungiMcpEndpoint } from "./private-fungi-mcp-endpoint.js";
 import { logEvent } from "./log-event.js";
+import { machineEnrollmentAuthoritySchema, machineEnrollmentRecordKind, } from "./private-local-mesh-record.js";
 import { fungiMcpClientInfo, fungiMcpReachableFetch, rejectedFungiMcpAccess, } from "./private-fungi-mcp-connection.js";
+import { signOutFungiThroughLocalService, } from "./private-fungi-service-logout.js";
 const credentialId = "fungi";
 const localScopes = "openid profile email offline_access models:invoke git:tracker billing:read";
 const callbackHost = "127.0.0.1";
@@ -46,7 +50,8 @@ const teamChoiceSchema = z.object({
     handle: z.string().min(1).max(256),
     name: z.string().min(1).max(256),
 });
-const savedCredentialSchema = z.looseObject({
+const savedCredentialSchema = z
+    .looseObject({
     type: z.literal("oauth"),
     access: z.string(),
     refresh: z.string(),
@@ -59,6 +64,14 @@ const savedCredentialSchema = z.looseObject({
     localBackends: z.array(localBackendRecordSchema).max(16).optional(),
     team: teamChoiceSchema.optional(),
     teamCount: z.number().int().min(0).max(1000).optional(),
+})
+    .transform((credential) => {
+    // Preview credentials saved device enrollments here without an issuer
+    // binding, private keys included. They cannot be attributed to an issuer,
+    // so they are never read and the next write of this credential drops them.
+    const current = { ...credential };
+    delete current.machineEnrollments;
+    return current;
 });
 function jsonValue(value) {
     const serialized = JSON.stringify(value);
@@ -87,6 +100,63 @@ async function readCredential(path) {
         throw new Error("Fungi Local credential data is invalid");
     return result.data;
 }
+/**
+ * Enrollment uses the account file and lock, without Pi's selected-payer view.
+ * Fungi enrollments are partitioned by issuer in the origin-keyed enrollment
+ * records: only the signed-in issuer's partition is ever read for dialing, so
+ * a switch never lends one issuer's Team or device identifiers to another,
+ * and signing in to an issuer again finds its own partition.
+ */
+export function createLocalMachineEnrollmentAccount(credentialPath) {
+    return {
+        read: async () => {
+            const saved = await readCredential(credentialPath);
+            const records = await credentialStore(credentialPath).readMachineEnrollments();
+            const issuer = saved?.issuer !== undefined && saved.access !== ""
+                ? saved.issuer
+                : undefined;
+            const partition = records.find((record) => record.origin === issuer &&
+                machineEnrollmentRecordKind(record) === "oauth");
+            return [
+                ...(issuer !== undefined
+                    ? [
+                        {
+                            kind: "oauth",
+                            origin: issuer,
+                            enrollments: partition?.enrollments ?? [],
+                        },
+                    ]
+                    : []),
+                ...records.flatMap((record) => machineEnrollmentRecordKind(record) === "oyster"
+                    ? [
+                        {
+                            kind: "oyster",
+                            origin: record.origin,
+                            enrollments: record.enrollments,
+                        },
+                    ]
+                    : []),
+            ];
+        },
+        update: async (rawAuthority, edit) => {
+            const authority = machineEnrollmentAuthoritySchema.parse(rawAuthority);
+            if (authority.kind === "oyster") {
+                await credentialStore(credentialPath).modifyMachineEnrollments(authority.origin, edit);
+                return;
+            }
+            await credentialStore(credentialPath).modifyMachineEnrollments(authority.origin, edit, {
+                providerId: credentialId,
+                admit: (current) => {
+                    const parsed = savedCredentialSchema.safeParse(current);
+                    if (!parsed.success ||
+                        parsed.data.access === "" ||
+                        parsed.data.issuer !== authority.origin)
+                        throw new Error("Fungi sign-in changed before machine enrollment was persisted");
+                },
+            });
+        },
+    };
+}
 async function updateCredential(patch, path) {
     const store = credentialStore(path);
     await store.modify(credentialId, (current) => {
@@ -128,7 +198,11 @@ function respond(response, status, message) {
     response.end(`<!doctype html><meta charset="utf-8"><title>Fungi Local</title><p>${message}</p>`);
 }
 /** Persisted OAuth state uses Local's existing owner-only Pi credential file. */
-export function privateFungiAccountOAuthProvider(options = {}) {
+export function privateFungiAccountOAuthProvider(input = {}) {
+    const options = {
+        ...input,
+        credentialPath: input.credentialPath ?? capturePrivateLocalConfigRoot().credentialPath,
+    };
     const interactive = options.interactive ?? false;
     const credentialPath = options.credentialPath;
     const issuer = options.issuer ?? options.endpoint?.origin;
@@ -278,6 +352,17 @@ export function privateFungiAccountOAuthProvider(options = {}) {
 function validateEndpoint(value) {
     return parseFungiMcpEndpoint(value);
 }
+const accountOwners = new Map();
+/** Installed only by the service holding this home's owner lease. */
+export function registerFungiAccountOwner(credentialPath, changed) {
+    const path = resolve(credentialPath);
+    if (accountOwners.has(path))
+        throw new Error("Fungi account already has an in-process owner");
+    accountOwners.set(path, changed);
+    return () => {
+        accountOwners.delete(path);
+    };
+}
 function logoutResult(kind, issuer, unconfirmedComputers = []) {
     const status = kind === "not-logged-in"
         ? `Fungi was not logged in${issuer ? ` to ${issuer}` : ""}.`
@@ -413,6 +498,10 @@ async function removeSavedLogin(saved, options) {
         }
         return value;
     });
+    // Publish after the committed removal, before remote revocation can stall.
+    await accountOwners.get(resolve(options.credentialPath))?.({
+        type: "signed-out",
+    });
     if (latest === undefined || latest.refresh === "")
         return logoutResult("not-logged-in", saved.issuer, unconfirmed);
     let revoked = await revokeSavedGrant(latest, options.fetch);
@@ -430,7 +519,11 @@ async function removeSavedLogin(saved, options) {
     return logoutResult(revoked ? "revoked" : "removed", latest.issuer, unconfirmed);
 }
 /** Non-secret status of the shared Fungi account. */
-export async function readFungiAccountStatus(options = {}) {
+export async function readFungiAccountStatus(input = {}) {
+    const options = {
+        ...input,
+        credentialPath: input.credentialPath ?? capturePrivateLocalConfigRoot().credentialPath,
+    };
     const saved = await readCredential(options.credentialPath);
     if (saved?.issuer === undefined || saved.access === "")
         return undefined;
@@ -445,16 +538,60 @@ export async function readFungiAccountStatus(options = {}) {
     return status;
 }
 /**
- * Remove the saved Fungi MCP login for the endpoint's origin and ask that
- * issuer to revoke its refresh grant. A login for another origin is kept.
+ * Ask the running Local account owner to remove this origin's login and revoke
+ * its refresh grant. Without a service, clear offline; never start one for
+ * logout. A login for another origin is kept. Explicit standalone stores have
+ * no service home; clients with a custom service directory name it explicitly.
  */
-export async function signOutFungiAccount(rawEndpoint, options = {}) {
+export async function signOutFungiAccount(rawEndpoint, input = {}) {
+    const credentialPath = resolve(input.credentialPath ?? capturePrivateLocalConfigRoot().credentialPath);
+    if (accountOwners.has(credentialPath))
+        return await signOutOwnedFungiAccount(rawEndpoint, {
+            ...input,
+            credentialPath,
+        });
+    // The ordinary CLI supplies this canonical path, including for an explicitly
+    // selected home. Do not reselect ambient HOME after that boundary.
+    const root = capturePrivateLocalConfigRoot(dirname(dirname(dirname(credentialPath))));
+    const directory = input.serviceDirectory ??
+        (root.credentialPath === credentialPath
+            ? root.serviceDirectory
+            : undefined);
+    if (directory !== undefined) {
+        return await signOutFungiThroughLocalService(rawEndpoint, {
+            ...input,
+            credentialPath,
+            directory,
+            clearOffline: signOutOwnedFungiAccount,
+        });
+    }
+    // Explicit standalone credential stores have no service home. A client using
+    // a custom service directory supplies it above; the server checks the path.
+    return await signOutOwnedFungiAccount(rawEndpoint, {
+        ...input,
+        credentialPath,
+    });
+}
+/** Store mutation for the service owner or a verified no-service caller. */
+export async function signOutOwnedFungiAccount(rawEndpoint, input = {}) {
+    const options = {
+        ...input,
+        credentialPath: input.credentialPath ?? capturePrivateLocalConfigRoot().credentialPath,
+    };
     const saved = await readCredential(options.credentialPath);
     const origin = rawEndpoint === undefined
         ? saved?.issuer
         : validateEndpoint(rawEndpoint).origin;
-    if (saved === undefined || saved.issuer !== origin)
-        return logoutResult("not-logged-in", origin);
+    const removedMachine = origin !== undefined &&
+        (await credentialStore(options.credentialPath).removeMachineEnrollments(origin));
+    if (saved === undefined || saved.issuer !== origin) {
+        if (removedMachine)
+            await accountOwners.get(resolve(options.credentialPath))?.({
+                type: "signed-out",
+            });
+        // Local custody ended; this is not a claim of remote device revocation.
+        return logoutResult(removedMachine ? "removed" : "not-logged-in", origin);
+    }
     return removeSavedLogin(saved, options);
 }
 /**
@@ -523,7 +660,11 @@ export function fungiMcpTeamEndpoint(rawEndpoint) {
     return { endpoint, teamId };
 }
 /** The machine's attached folders, as Local keeps them. */
-export async function readFungiMcpLocalBackends(options = {}) {
+export async function readFungiMcpLocalBackends(input = {}) {
+    const options = {
+        ...input,
+        credentialPath: input.credentialPath ?? capturePrivateLocalConfigRoot().credentialPath,
+    };
     const saved = await readCredential(options.credentialPath);
     return {
         issuer: saved?.issuer,
@@ -531,7 +672,11 @@ export async function readFungiMcpLocalBackends(options = {}) {
     };
 }
 /** Replace the attached folder records in the owner-only credential file. */
-export async function writeFungiMcpLocalBackends(update, options = {}) {
+export async function writeFungiMcpLocalBackends(update, input = {}) {
+    const options = {
+        ...input,
+        credentialPath: input.credentialPath ?? capturePrivateLocalConfigRoot().credentialPath,
+    };
     await credentialStore(options.credentialPath).modify(credentialId, (current) => {
         const saved = savedCredentialSchema.parse(current);
         if (saved.access === "")
@@ -585,7 +730,11 @@ async function retryPendingLogout(endpoint, options) {
     }
 }
 /** Complete first-party registration and OAuth authorization in a foreground TUI. */
-export async function signInFungiAccount(rawEndpoint, options = {}) {
+export async function signInFungiAccount(rawEndpoint, input = {}) {
+    const options = {
+        ...input,
+        credentialPath: input.credentialPath ?? capturePrivateLocalConfigRoot().credentialPath,
+    };
     options.signal?.throwIfAborted();
     const endpoint = validateEndpoint(rawEndpoint);
     // Check the Hub before offering a browser handoff or replacing a saved login.
@@ -664,12 +813,11 @@ export async function signInFungiAccount(rawEndpoint, options = {}) {
     const redirectUrl = `${callbackOrigin}${callbackPath}`;
     const providerOptions = {
         interactive: true,
+        credentialPath: options.credentialPath,
         endpoint,
         redirectUrl,
         openBrowser: launchBrowser,
     };
-    if (options.credentialPath !== undefined)
-        providerOptions.credentialPath = options.credentialPath;
     const provider = privateFungiAccountOAuthProvider(providerOptions);
     // The browser is opened only after this handler is attached.
     server.on("request", (request, response) => {
@@ -835,7 +983,11 @@ async function chooseFungiAccountTeam(rawHub, options) {
     await saveSelectedTeam(issuer, team, teams.length, options.credentialPath);
 }
 /** Switch only to a fresh membership; failure preserves the prior selected Team. */
-export async function switchFungiAccountTeam(teamId, options = {}) {
+export async function switchFungiAccountTeam(teamId, input = {}) {
+    const options = {
+        ...input,
+        credentialPath: input.credentialPath ?? capturePrivateLocalConfigRoot().credentialPath,
+    };
     const saved = await readCredential(options.credentialPath);
     if (saved?.issuer === undefined)
         throw new Error("Sign in to Fungi to choose a Team");
@@ -846,7 +998,11 @@ export async function switchFungiAccountTeam(teamId, options = {}) {
     await saveSelectedTeam(saved.issuer, selected, teams.length, options.credentialPath);
 }
 /** Fresh memberships for the saved account, with the Team that pays for models. */
-export async function readFungiAccountTeams(options = {}) {
+export async function readFungiAccountTeams(input = {}) {
+    const options = {
+        ...input,
+        credentialPath: input.credentialPath ?? capturePrivateLocalConfigRoot().credentialPath,
+    };
     const saved = await readCredential(options.credentialPath);
     if (saved?.issuer === undefined || saved.access === "")
         throw new Error("Sign in to Fungi to list your Teams");
@@ -881,7 +1037,11 @@ const teamBalanceSchema = z.object({
     reserved: moneySnapshotSchema,
     available: moneySnapshotSchema,
 });
-export async function readFungiTeamBalance(options = {}) {
+export async function readFungiTeamBalance(input = {}) {
+    const options = {
+        ...input,
+        credentialPath: input.credentialPath ?? capturePrivateLocalConfigRoot().credentialPath,
+    };
     const saved = await readCredential(options.credentialPath);
     if (saved?.issuer === undefined || saved.access === "")
         throw new Error("Sign in to Fungi to read your Team balance");
@@ -973,7 +1133,11 @@ function cachedFungiAccess(cached, issuer, rejectedAccess) {
  * when the saved access token actually needs it: a plain read never takes
  * the lock or rewrites the file, so a still-valid credential stays untouched.
  */
-export async function freshFungiAccess(rawHub, options = {}) {
+export async function freshFungiAccess(rawHub, input = {}) {
+    const options = {
+        ...input,
+        credentialPath: input.credentialPath ?? capturePrivateLocalConfigRoot().credentialPath,
+    };
     const issuer = validateEndpoint(rawHub).origin;
     options.signal?.throwIfAborted();
     const cached = await readCredential(options.credentialPath);
@@ -995,7 +1159,11 @@ export async function freshFungiAccess(rawHub, options = {}) {
     return savedCredentialSchema.parse(current).access;
 }
 /** Retry an explicitly refused request once; the cloned body is replayable. */
-export function fungiAccountFetch(rawHub, options = {}) {
+export function fungiAccountFetch(rawHub, input = {}) {
+    const options = {
+        ...input,
+        credentialPath: input.credentialPath ?? capturePrivateLocalConfigRoot().credentialPath,
+    };
     const issuer = validateEndpoint(rawHub).origin;
     const transport = ownFungiFetch(issuer, options.fetch, options.signal);
     const requestWithRetry = async (input, init) => {
@@ -1040,7 +1208,11 @@ export function fungiAccountFetch(rawHub, options = {}) {
     });
 }
 /** The SDK owns exactly one retry; this hook rotates only the refused credential. */
-export function fungiMcpAccountAuth(endpoint, options = {}) {
+export function fungiMcpAccountAuth(endpoint, input = {}) {
+    const options = {
+        ...input,
+        credentialPath: input.credentialPath ?? capturePrivateLocalConfigRoot().credentialPath,
+    };
     let lastToken;
     return {
         token: async () => {
@@ -1063,7 +1235,11 @@ export function fungiAccountTeam(credential) {
     return saved.team;
 }
 /** Pi uses its own locked modify; this owner supplies the same refresh as MCP. */
-export function createFungiAccountOAuth(options = {}) {
+export function createFungiAccountOAuth(input = {}) {
+    const options = {
+        ...input,
+        credentialPath: input.credentialPath ?? capturePrivateLocalConfigRoot().credentialPath,
+    };
     return {
         name: "Fungi",
         loginLabel: "Sign in to Fungi",
@@ -1112,7 +1288,11 @@ export function createFungiAccountOAuth(options = {}) {
     };
 }
 /** Pi deletion clears Local custody and reports unconfirmed remote revocation. */
-export function createFungiAccountCredentialStore(options = {}) {
+export function createFungiAccountCredentialStore(input = {}) {
+    const options = {
+        ...input,
+        credentialPath: input.credentialPath ?? capturePrivateLocalConfigRoot().credentialPath,
+    };
     const store = credentialStore(options.credentialPath);
     return {
         async read(id, operation) {

package/dist/private-fungi-mcp-connection.d.ts

@@ -1,5 +1,6 @@
 import { type AuthProvider, type FetchLike, type OAuthClientProvider } from "@modelcontextprotocol/client";
 import { type CapabilitySource } from "@fungi.computer/mycelium";
+import { type RequestMcpFormApproval } from "./private-mcp-form-elicitation.js";
 /** The MCP client identity Local reports to the Hub. */
 export declare const fungiMcpClientInfo: Readonly<{
     name: "fungi-local";
@@ -10,9 +11,12 @@ export declare function fungiMcpReachableFetch(endpoint: URL, fetchImpl?: FetchL
 /** Host-held selection and credentials; neither enters the model's arguments. */
 export type PrivateFungiMcpConnectionOptions = Readonly<{
     endpoint: URL;
+    authentication?: "oyster-key" | undefined;
     authProvider: AuthProvider | OAuthClientProvider;
     /** The maintained transport's fetch seam, also used by the local caller proof. */
     fetch?: FetchLike;
+    /** Trusted human interaction; never supplied by model arguments. */
+    requestApproval?: RequestMcpFormApproval | undefined;
 }>;
 /**
  * Add the existing Fungi MCP execute door to a Local run's capability scope.