@gajae-code/coding-agent 0.11.7 → 0.11.9

package/src/modes/shared/agent-wire/workflow-gate-broker.ts

@@ -95,7 +95,7 @@ export interface AskSelectedAckRecoveryParticipant {
 
 /** SDK-native surface for emitting a workflow gate and awaiting its answer. */
 export interface WorkflowGateEmitter {
-	isUnattended(): boolean;
+	supportsRemoteGateAnswers(): boolean;
 	emitGate(input: OpenGateInput): Promise<unknown>;
 	onGateEmitted?(listener: (gate: WorkflowGate) => void): () => void;
 	resolveGate?(response: WorkflowGateResponse): Promise<WorkflowGateResolution>;
@@ -167,7 +167,7 @@ export class BrokerWorkflowGateEmitter implements WorkflowGateEmitter {
 		});
 	}
 
-	isUnattended(): boolean {
+	supportsRemoteGateAnswers(): boolean {
 		return true;
 	}
 	setRuntimeTurnProvider(provider: (() => string | undefined) | null): void {

package/src/modes/types.ts

@@ -32,6 +32,7 @@ import type { ToolExecutionHandle } from "./components/tool-execution";
 import type { StatusLineComponent } from "./components/tool-status-header";
 import type { IrcObservationLedger } from "./irc-observation-ledger";
 import type { OAuthManualInputManager } from "./oauth-manual-input";
+import type { PromptSuggestionController } from "./prompt-suggestion-controller";
 import type { Theme } from "./theme/theme";
 import type { ParsedIrcMessage } from "./utils/irc-message";
 
@@ -156,6 +157,8 @@ export interface InteractiveModeContext {
 	skillCommands: Map<string, Skill>;
 	oauthManualInput: OAuthManualInputManager;
 	todoPhases: TodoPhase[];
+	/** Ghost-text next-prompt prediction; absent in ACP/lightweight test contexts. */
+	promptSuggestion?: PromptSuggestionController;
 
 	// Lifecycle
 	init(): Promise<void>;

package/src/modes/utils/hotkeys-markdown.ts

@@ -1,60 +1,88 @@
+import type { Keybinding } from "@gajae-code/tui";
 import type { AppKeybinding, KeybindingsManager } from "../../config/keybindings";
 
 export interface HotkeysMarkdownBindings {
-	keybindings: Pick<KeybindingsManager, "getDisplayString">;
+	keybindings: Pick<KeybindingsManager, "formatAccessibleKeyHint" | "getAccessibleDisplayString">;
+}
+
+function key(bindings: HotkeysMarkdownBindings, action: Keybinding): string {
+	return bindings.keybindings.getAccessibleDisplayString(action) || "Disabled";
 }
 
 function appKey(bindings: HotkeysMarkdownBindings, action: AppKeybinding): string {
-	return bindings.keybindings.getDisplayString(action) || "Disabled";
+	return key(bindings, action);
+}
+
+export function formatHotkeyMarkdownCode(label: string, escapeTablePipes = true): string {
+	const escaped = escapeTablePipes ? label.replace(/\|/g, "\\|") : label;
+	let longestBacktickRun = 0;
+	for (const match of escaped.matchAll(/`+/g)) {
+		longestBacktickRun = Math.max(longestBacktickRun, match[0].length);
+	}
+	const fence = "`".repeat(longestBacktickRun + 1);
+	const padding = escaped.startsWith("`") || escaped.endsWith("`") ? " " : "";
+	return `${fence}${padding}${escaped}${padding}${fence}`;
 }
 
 export function buildHotkeysMarkdown(bindings: HotkeysMarkdownBindings): string {
+	const displayKey = (action: Keybinding): string => formatHotkeyMarkdownCode(key(bindings, action));
+	const displayAppKey = (action: AppKeybinding): string => formatHotkeyMarkdownCode(appKey(bindings, action));
+	const displayKeys = (...labels: string[]): string => formatHotkeyMarkdownCode(labels.join("/"));
+	const formatFixedKey = (key: string): string => bindings.keybindings.formatAccessibleKeyHint(key);
+	const displayKeyWithFixed = (action: Keybinding, fixedKey: string): string => {
+		const configured = key(bindings, action);
+		const fixed = formatFixedKey(fixedKey);
+		const labels = configured.split("/");
+		if (!labels.includes(fixed)) labels.push(fixed);
+		return displayKeys(...labels);
+	};
+
 	return [
 		"**Navigation**",
 		"| Key | Action |",
 		"|-----|--------|",
-		"| `Arrow keys` | Move cursor / browse history (Up when empty) |",
-		"| `Option+Left/Right` | Move by word |",
-		"| `Ctrl+A` / `Home` / `Cmd+Left` | Start of line |",
-		"| `Ctrl+E` / `End` / `Cmd+Right` | End of line |",
+		`| ${displayKeys(key(bindings, "tui.editor.cursorUp"), key(bindings, "tui.editor.cursorDown"))} | Move cursor / browse history (Up when empty) |`,
+		`| ${displayKeys(key(bindings, "tui.editor.cursorWordLeft"), key(bindings, "tui.editor.cursorWordRight"))} | Move by word |`,
+		`| ${displayKeyWithFixed("tui.editor.cursorLineStart", "ctrl+a")} | Start of line |`,
+		`| ${displayKeyWithFixed("tui.editor.cursorLineEnd", "ctrl+e")} | End of line |`,
 		"",
 		"**Editing**",
 		"| Key | Action |",
 		"|-----|--------|",
-		"| `Enter` | Send / queue while busy |",
-		`| \`${appKey(bindings, "app.message.queue")}\` | Queue message for next turn |`,
-		`| \`${appKey(bindings, "app.message.dequeue")}\` | Select queued message to edit |`,
-		"| `Shift+Enter` / `Ctrl+J` | New line |",
-		"| `Ctrl+W` / `Option+Backspace` | Delete word backwards |",
-		"| `Ctrl+U` | Delete to start of line |",
-		"| `Ctrl+K` | Delete to end of line |",
-		`| \`${appKey(bindings, "app.clipboard.copyLine")}\` | Copy current line |`,
-		`| \`${appKey(bindings, "app.clipboard.copyPrompt")}\` | Copy whole prompt |`,
+		`| ${displayKey("tui.input.submit")} | Send / queue while busy |`,
+		`| ${displayAppKey("app.message.queue")} | Queue message for next turn |`,
+		`| ${displayAppKey("app.message.dequeue")} | Select queued message to edit |`,
+		`| ${displayKeys(key(bindings, "tui.input.newLine"), formatFixedKey("ctrl+j"))} | New line |`,
+		`| ${displayKeys(formatFixedKey("ctrl+w"), formatFixedKey("alt+backspace"))} | Delete word backwards |`,
+		`| ${displayKeys(formatFixedKey("ctrl+u"))} | Delete to start of line |`,
+		`| ${displayKeys(formatFixedKey("ctrl+k"))} | Delete to end of line |`,
+		`| ${displayAppKey("app.clipboard.copyLine")} | Copy current line |`,
+		`| ${displayAppKey("app.clipboard.copyPrompt")} | Copy whole prompt |`,
 		"",
 		"**Other**",
 		"| Key | Action |",
 		"|-----|--------|",
-		"| `Tab` | Path completion / accept autocomplete |",
-		`| \`${appKey(bindings, "app.interrupt")}\` | Cancel autocomplete / interrupt active work |`,
-		`| \`${appKey(bindings, "app.clear")}\` | Clear editor (first) / exit (second) |`,
-		`| \`${appKey(bindings, "app.exit")}\` | Exit (when editor is empty) |`,
-		`| \`${appKey(bindings, "app.suspend")}\` | Suspend to background |`,
-		`| \`${appKey(bindings, "app.commandPalette.open")}\` | Open command palette |`,
-		`| \`${appKey(bindings, "app.session.new")}\` | Start a fresh session |`,
-		`| \`${appKey(bindings, "app.thinking.cycle")}\` | Cycle thinking level |`,
-		`| \`${appKey(bindings, "app.model.cycleForward")}\` | Cycle configured model roles |`,
-		`| \`${appKey(bindings, "app.model.cycleBackward")}\` | Cycle configured model roles temporarily |`,
-		`| \`${appKey(bindings, "app.model.selectTemporary")}\` | Select model (temporary) |`,
-		`| \`${appKey(bindings, "app.model.select")}\` | Select default model |`,
-		`| \`${appKey(bindings, "app.plan.toggle")}\` | Toggle plan mode |`,
-		`| \`${appKey(bindings, "app.history.search")}\` | Search prompt history |`,
-		`| \`${appKey(bindings, "app.tools.expand")}\` | Toggle tool output expansion |`,
-		`| \`${appKey(bindings, "app.tool.backgroundFold")}\` twice | Fold supported foreground bash into a background job |`,
-		`| \`${appKey(bindings, "app.thinking.toggle")}\` | Toggle thinking block visibility |`,
-		`| \`${appKey(bindings, "app.editor.external")}\` | Edit message in external editor |`,
-		`| \`${appKey(bindings, "app.clipboard.pasteImage")}\` | Paste image from clipboard |`,
-		`| \`${appKey(bindings, "app.stt.toggle")}\` | Toggle speech-to-text recording |`,
-		`| \`${appKey(bindings, "app.irc.sidebar.toggle")}\` | Toggle IRC sidebar |`,
+		`| ${displayKey("tui.input.tab")} | Path completion / accept autocomplete |`,
+		`| ${displayAppKey("app.interrupt")} | Cancel autocomplete / interrupt active work |`,
+		`| ${displayAppKey("app.clear")} | Clear editor (first) / exit (second) |`,
+		`| ${displayAppKey("app.exit")} | Exit (when editor is empty) |`,
+		`| ${displayAppKey("app.suspend")} | Suspend to background |`,
+		`| ${displayAppKey("app.commandPalette.open")} | Open command palette |`,
+		`| ${displayAppKey("app.session.new")} | Start a fresh session |`,
+		`| ${displayAppKey("app.thinking.cycle")} | Cycle thinking level |`,
+		`| ${displayAppKey("app.model.cycleForward")} | Cycle configured model roles |`,
+		`| ${displayAppKey("app.model.cycleBackward")} | Cycle configured model roles temporarily |`,
+		`| ${displayAppKey("app.model.selectTemporary")} | Select model (temporary) |`,
+		`| ${displayAppKey("app.model.select")} | Select default model |`,
+		`| ${displayAppKey("app.plan.toggle")} | Toggle plan mode |`,
+		`| ${displayAppKey("app.history.search")} | Search prompt history |`,
+		`| ${displayAppKey("app.tools.expand")} | Toggle tool output expansion |`,
+		`| ${displayAppKey("app.tool.backgroundFold")} twice | Fold supported foreground bash into a background job |`,
+		`| ${displayAppKey("app.thinking.toggle")} | Toggle thinking block visibility |`,
+		`| ${displayAppKey("app.editor.external")} | Edit message in external editor |`,
+		`| ${displayAppKey("app.clipboard.pasteImage")} | Paste image from clipboard |`,
+		`| ${displayAppKey("app.stt.toggle")} | Toggle speech-to-text recording |`,
+		`| ${displayAppKey("app.irc.sidebar.toggle")} | Toggle IRC sidebar |`,
 		"| `?` | Show help / shortcuts |",
 		"| `#` | Prompt actions (command-palette style actions) |",
 		"| `/` | Slash commands (try `/help` or `/new`) |",

package/src/modes/utils/ui-helpers.ts

@@ -916,9 +916,11 @@ export class UiHelpers {
 				const queuedText = theme.fg("dim", `${entry.label}: ${entry.message}`);
 				this.ctx.pendingMessagesContainer.addChild(new TruncatedText(queuedText, 1, 0));
 			}
-			const dequeueKey = this.ctx.keybindings.getDisplayString("app.message.dequeue") || "Alt+Up/Alt+Down";
-			const hintText = theme.fg("dim", `${theme.tree.hook} ${dequeueKey} to select/edit/reorder`);
-			this.ctx.pendingMessagesContainer.addChild(new TruncatedText(hintText, 1, 0));
+			const dequeueKey = this.ctx.keybindings.getDisplayString("app.message.dequeue");
+			if (dequeueKey) {
+				const hintText = theme.fg("dim", `${theme.tree.hook} ${dequeueKey} to select/edit/reorder`);
+				this.ctx.pendingMessagesContainer.addChild(new TruncatedText(hintText, 1, 0));
+			}
 		}
 	}
 

package/src/prompts/agents/architect.md

@@ -33,7 +33,6 @@ You may receive a forked parent-conversation snapshot as background. Your read-o
 - Never approve CRITICAL or HIGH severity issues.
 - Do not skip spec compliance to jump to style nitpicks.
 - Be constructive: explain why an issue matters and how to fix it or strengthen the design.
-- Practical sufficiency beats endless logical completeness: treat preemptive logic for edge cases with no observed or evidenced trigger as over-engineering, but never downgrade genuine CRITICAL/HIGH architecture, extensibility, or robustness risks that have observability-based evidence.
 </constraints>
 
 <review_stages>

package/src/prompts/agents/critic.md

@@ -23,7 +23,6 @@ Review plan clarity, completeness, verification, big-picture fit, referenced fil
 - Do not invent problems; report no issues found when the plan passes.
 - Escalate routing needs upward: planner for plan revision, the deep-interview skill for requirements gathering, architect for code analysis.
 - For consensus planning, reject shallow alternatives, driver contradictions, vague risks, weak verification, missing acceptance criteria, or under-specified areas needing expansion before execution.
-- Prefer practical sufficiency over endless logical completeness: do not demand preemptive logic for edge cases that are not actually observed or evidenced, yet still require extensibility and robustness when observability-based evidence shows the investment is worth the token and time.
 </constraints>
 
 <execution_loop>

package/src/prompts/system/prompt-suggestion-system.md

@@ -0,0 +1,32 @@
+[SUGGESTION MODE: Suggest what the user might naturally type next into the coding agent.]
+
+FIRST: Look at the user's recent messages and original request.
+
+Your job is to predict what THEY would type - not what you think they should do.
+
+THE TEST: Would they think "I was just about to type that"?
+
+EXAMPLES:
+User asked "fix the bug and run tests", bug is fixed → "run the tests"
+After code written → "try it out"
+Agent offers options → suggest the one the user would likely pick, based on conversation
+Agent asks to continue → "yes" or "go ahead"
+Task complete, obvious follow-up → "commit this" or "push it"
+After error or misunderstanding → silence (let them assess/correct)
+
+Be specific: "run the tests" beats "continue".
+
+NEVER SUGGEST:
+- Evaluative ("looks good", "thanks")
+- Questions ("what about…?")
+- Agent-voice ("Let me…", "I'll…", "Here's…")
+- New ideas they didn't ask about
+- Multiple sentences
+
+Stay silent if the next step isn't obvious from what the user said.
+
+Stay silent if a suggestion could be unsafe or inappropriate — including any sensitive topic (security incidents, credentials, harm, private data). Even when the user is doing legitimate security or cybersecurity work, do not predict potentially unsafe actions.
+
+Format: 2-12 words, match the user's style. Or nothing.
+
+Reply with ONLY the suggestion, no quotes or explanation.

package/src/prompts/system/system-prompt.md

@@ -19,12 +19,16 @@ Optimize for correctness first, maintainability second, and brevity third. Prefe
 {{#unless subagent}}
 <gjc-runtime>
 <routing>
-- Clear, low-risk implementation requests use direct tools and focused verification; do not invoke workflows or role agents for ceremony.
+- Clear, low-risk implementation requests use direct tools and focused verification; do not invoke workflows or role agents for ceremony. Small verification needs do not turn a clear request into a planning workflow.
+- Ambiguous implementation asks with a missing target, scope, acceptance criteria, or safety boundary require clarification or the appropriate planning workflow before mutation.
 - Informational questions are answer-only/read-only unless the user explicitly requests a change, command, or execution.
-- Vague requirements use `/skill:deep-interview`; clear work with non-trivial architecture or sequencing risk uses `/skill:ralplan --deliberate` and stops pending approval.
+- Vague requirements use `/skill:deep-interview`: a requirements-only workflow that must not mutate product code. Its spec hands off as deep-interview → ralplan consensus → pending approval → separately approved execution.
+- Clear work with non-trivial architecture or sequencing risk uses `/skill:ralplan --deliberate` and stops pending approval.
+- Deep-interview state is runtime-owned: diagnose with `gjc deep-interview sanity-check`, inspect only the affected bounded selector, and repair through typed operations using CLI-generated/edited drafts (`draft create|edit|show|check|rebase|discard`) consumed with `--draft-id`. Inline JSON request flags are compatibility-only; normal flow must never reconstruct a payload or full envelope.
 - Use `/skill:ultragoal` for durable goal ledgers and `/skill:team` for approved coordinated persistent work.
 - Delegate large implementation slices to `executor`; use `planner`, `architect`, or `critic` for bounded planning and review.
-- Active skills are authoritative: read and follow them; planning and read-only skills do not mutate before approval.
+- Active skills are authoritative: never ignore an invoked skill; read the full skill text and follow it exactly.
+- Before explicit execution approval, planning and interview workflows NEVER edit product source, run mutating shell commands, commit, push, open PRs, or delegate implementation.
 </routing>
 </gjc-runtime>
 {{/unless}}
@@ -206,7 +210,6 @@ Guardrails? None. Restrictions? None. Freedom? Unlimited.
 - **Do your homework first** - Read the files, search, and understand the context before asking
 - **Don’t Stop at Analysis** - Once you’ve assessed the situation, take the next step (session, comment, merge, fix, cleanup) on your own
 - **No Inflating Operational/Meta Issues** - Just because the backlog is empty doesn’t mean you should force operational follow-ups, verifiability checks, or meta issues. Only raise issues for actual repository problems; otherwise, stop.
-- **Practical sufficiency over completeness** - Don’t add logic that preemptively handles edge cases you haven’t actually observed; endless logical completeness loses to practical sufficiency. Extensibility and robustness matter, but they must be observability-based and evidence-based—any engineering without underlying evidence that it’s worth the token and time is over-engineering.
 - **Always maintain execution** - Do not end your turn with just reporting, summarizing, or analyzing. If an action is possible, execute it immediately during the same turn.
 - **Always be in action mode** - The default stance is intervention, not observation. If you see something that needs cleaning up, clean it up; if you see a session that needs opening, open it; if you see a PR that needs blocking, block it; if you see a PR that needs merging, review it and merge it.
 - **No begging for permission** - For obvious follow-up actions (cleaning up sessions, marking items as stale, fixing routing, updating documentation to reflect Doctrine), don’t ask—just do it.

package/src/prompts/tools/cron.md

@@ -1,4 +1,6 @@
-Schedule a prompt to fire on a recurring cron schedule, or one-shot at the next match. Cron tasks let you re-run a prompt automatically on an interval — poll a deployment, babysit a PR, check back on a long-running build, or remind yourself to do something later in the session.
+Schedule a prompt to fire on a recurring cron schedule, or one-shot at the next match. Cron tasks re-run an agent prompt automatically on an interval when every firing is allowed to produce a normal assistant response, such as a reminder or a scheduled status report.
+
+Cron is not a silent polling primitive. Every firing starts an agent turn, and hiding the injected cron message does not hide that turn's assistant response. For ongoing logs, file watching, or PR/CI polling that should report only meaningful state changes, use `monitor` with a script that writes a line only when there is an event to process, and set `persistent: true` so the monitor survives the first emitted event. Do not schedule a cron prompt that asks the agent to suppress routine polls; prompt wording cannot make a cron-triggered assistant turn reliably silent.
 
 Use a single `op` field to select the operation:
 

package/src/runtime-mcp/json-rpc.ts

@@ -4,9 +4,9 @@
  * Lightweight utilities for calling MCP servers directly via HTTP
  * without maintaining persistent connections.
  */
-// biome-ignore assist/source/organizeImports: Keep independent MCP security imports on separate merge anchors.
-import { cancelMCPStream, MCP_HTTP_TIMEOUT_MS, MCP_MAX_CONTENT_BYTES, readMCPResponseText } from "./content-limits";
 import { logger } from "@gajae-code/utils";
+import { cancelMCPStream, MCP_HTTP_TIMEOUT_MS, MCP_MAX_CONTENT_BYTES, readMCPResponseText } from "./content-limits";
+import { redactMCPDiagnosticValue, redactMCPEndpoint } from "./redaction";
 
 /** Parse SSE response format (lines starting with "data: ") */
 export function parseSSE(text: string): unknown {
@@ -82,7 +82,7 @@ export async function callMCP<T = unknown>(
 	if (!response.ok) {
 		cancelMCPStream(response.body);
 		const errorMsg = `MCP request failed: ${response.status} ${response.statusText}`;
-		logger.error(errorMsg, { url, method, params });
+		logger.error(errorMsg, { url: redactMCPEndpoint(url), method, params: redactMCPDiagnosticValue(params) });
 		throw new Error(errorMsg);
 	}
 
@@ -90,7 +90,10 @@ export async function callMCP<T = unknown>(
 	const result = parseSSE(text) as JsonRpcResponse<T> | null;
 
 	if (!result) {
-		logger.error("Failed to parse MCP response", { url, method, responseText: text.slice(0, 500) });
+		logger.error("Failed to parse MCP response", {
+			url: redactMCPEndpoint(url),
+			method,
+		});
 		throw new Error("Failed to parse MCP response");
 	}
 

package/src/runtime-mcp/manager.ts

@@ -6,12 +6,12 @@
  */
 import * as path from "node:path";
 import * as url from "node:url";
-import type { TSchema } from "@gajae-code/ai";
+import { isCanonicalMCPOAuthBinding, resolveMCPOAuthResourceOrigin, type TSchema } from "@gajae-code/ai";
 import { logger } from "@gajae-code/utils";
 import type { SourceMeta } from "../capability/types";
 import * as configValue from "../config/resolve-config-value";
 import type { CustomTool } from "../extensibility/custom-tools/types";
-import type { AuthStorage } from "../session/auth-storage";
+import type { AuthStorage, OAuthCredential } from "../session/auth-storage";
 import {
 	connectToServer,
 	disconnectServer,
@@ -27,7 +27,6 @@ import {
 	unsubscribeFromResources,
 } from "./client";
 import { loadAllMCPConfigs, validateServerConfig } from "./config";
-import { refreshMCPOAuthToken } from "./oauth-flow";
 import type { MCPToolDetails } from "./tool-bridge";
 import { DeferredMCPTool, MCPTool } from "./tool-bridge";
 import type { MCPToolCache } from "./tool-cache";
@@ -1469,64 +1468,63 @@ export class MCPManager {
 		let resolved: MCPServerConfig = { ...config };
 
 		const auth = config.auth;
-		if (auth?.type === "oauth" && auth.credentialId && this.#authStorage) {
+		if (auth?.type === "oauth") {
+			if (!auth.credentialId || !this.#authStorage || (config.type !== "http" && config.type !== "sse")) {
+				throw new MCPExpectedFailure();
+			}
 			const credentialId = auth.credentialId;
 			let credential = this.#authStorage.get(credentialId);
-			if (credential?.type === "oauth") {
-				// Proactive refresh: 5-minute buffer before expiry
-				// Force refresh: on 401/403 auth errors (revoked tokens, clock skew, missing expires)
-				const REFRESH_BUFFER_MS = 5 * 60_000;
-				const shouldRefresh =
-					forceRefresh || (credential.expires && Date.now() >= credential.expires - REFRESH_BUFFER_MS);
-				let refreshedCredential:
-					| {
-							type: "oauth";
-							access: string;
-							refresh: string;
-							expires: number;
-					  }
-					| undefined;
-				if (shouldRefresh && credential.refresh && auth.tokenUrl) {
-					try {
-						const refreshed = await refreshMCPOAuthToken(
-							auth.tokenUrl,
-							credential.refresh,
-							auth.clientId,
-							auth.clientSecret,
-						);
-						refreshedCredential = { type: "oauth", ...refreshed };
-					} catch (error) {
-						if (!(error instanceof MCPExpectedFailure)) throw error;
-						if (this.#toolsOnly) {
-							logger.debug("MCP OAuth refresh failed");
-						} else {
-							logger.warn("MCP OAuth refresh failed, using existing token");
-						}
+			const binding = credential?.type === "oauth" ? credential.mcpBinding : undefined;
+			const endpointOrigin = resolveMCPOAuthResourceOrigin(config.url);
+			if (
+				credential?.type !== "oauth" ||
+				!binding ||
+				!isCanonicalMCPOAuthBinding(binding) ||
+				binding.resourceOrigin !== endpointOrigin ||
+				(auth.tokenUrl !== undefined && auth.tokenUrl !== binding.tokenEndpoint)
+			) {
+				throw new MCPExpectedFailure();
+			}
+
+			// Proactive refresh: 5-minute buffer before expiry
+			// Force refresh: on 401/403 auth errors (revoked tokens, clock skew, missing expires)
+			const REFRESH_BUFFER_MS = 5 * 60_000;
+			const shouldRefresh =
+				forceRefresh || (credential.expires && Date.now() >= credential.expires - REFRESH_BUFFER_MS);
+			if (shouldRefresh && credential.refresh) {
+				let refreshedCredential: OAuthCredential | undefined;
+				try {
+					refreshedCredential = await this.#authStorage.forceRefreshOAuthCredential(credentialId, credential, {
+						clientId: auth.clientId,
+						clientSecret: auth.clientSecret,
+					});
+				} catch {
+					if (forceRefresh) throw new MCPExpectedFailure();
+					if (this.#toolsOnly) {
+						logger.debug("MCP OAuth refresh failed");
+					} else {
+						logger.warn("MCP OAuth refresh failed, using existing token");
 					}
 				}
 				if (refreshedCredential) {
-					await this.#authStorage.set(credentialId, refreshedCredential);
+					const refreshedBinding = refreshedCredential.mcpBinding;
+					if (
+						!refreshedBinding ||
+						refreshedBinding.resourceOrigin !== binding.resourceOrigin ||
+						refreshedBinding.tokenEndpoint !== binding.tokenEndpoint
+					) {
+						throw new MCPExpectedFailure();
+					}
 					credential = refreshedCredential;
 				}
-
-				if (resolved.type === "http" || resolved.type === "sse") {
-					resolved = {
-						...resolved,
-						headers: {
-							...resolved.headers,
-							Authorization: `Bearer ${credential.access}`,
-						},
-					};
-				} else {
-					resolved = {
-						...resolved,
-						env: {
-							...resolved.env,
-							OAUTH_ACCESS_TOKEN: credential.access,
-						},
-					};
-				}
 			}
+			resolved = {
+				...config,
+				headers: {
+					...config.headers,
+					Authorization: `Bearer ${credential.access}`,
+				},
+			};
 		}
 		if (this.#toolsOnly && resolved.type === "stdio") {
 			resolved = { ...resolved, noInheritEnv: true };

package/src/runtime-mcp/oauth-flow.ts

@@ -8,29 +8,10 @@
 import type { OAuthCallbackFlowOptions } from "@gajae-code/ai/utils/oauth/callback-server";
 import { OAuthCallbackFlow } from "@gajae-code/ai/utils/oauth/callback-server";
 import type { OAuthController, OAuthCredentials } from "@gajae-code/ai/utils/oauth/types";
-import { MCPExpectedFailure } from "./types";
 
 const DEFAULT_PORT = 3000;
 const CALLBACK_PATH = "/callback";
 const CALLBACK_BIND_HOSTNAME = "127.0.0.1";
-type RefreshTokenResponse = {
-	access_token: string;
-	refresh_token?: string;
-	expires_in?: number;
-};
-
-function isRefreshTokenResponse(value: unknown): value is RefreshTokenResponse {
-	if (typeof value !== "object" || value === null || Array.isArray(value)) return false;
-	const payload = value as Record<string, unknown>;
-	return (
-		typeof payload.access_token === "string" &&
-		payload.access_token.length > 0 &&
-		(payload.refresh_token === undefined || typeof payload.refresh_token === "string") &&
-		(payload.expires_in === undefined ||
-			(typeof payload.expires_in === "number" && Number.isFinite(payload.expires_in) && payload.expires_in >= 0))
-	);
-}
-
 function isLoopbackHostname(hostname: string): boolean {
 	return hostname === "localhost" || hostname === "127.0.0.1";
 }
@@ -384,56 +365,3 @@ export class MCPOAuthFlow extends OAuthCallbackFlow {
 		}
 	}
 }
-
-/**
- * Refresh an MCP OAuth token using the standard refresh_token grant.
- * Returns updated credentials; preserves the old refresh token if the server doesn't rotate it.
- */
-export async function refreshMCPOAuthToken(
-	tokenUrl: string,
-	refreshToken: string,
-	clientId?: string,
-	clientSecret?: string,
-): Promise<OAuthCredentials> {
-	const params = new URLSearchParams({
-		grant_type: "refresh_token",
-		refresh_token: refreshToken,
-	});
-	if (clientId) params.set("client_id", clientId);
-	if (clientSecret) params.set("client_secret", clientSecret);
-
-	let response: Response;
-	try {
-		response = await fetch(tokenUrl, {
-			method: "POST",
-			headers: { "Content-Type": "application/x-www-form-urlencoded" },
-			body: params.toString(),
-		});
-	} catch (error) {
-		throw new MCPExpectedFailure(error);
-	}
-
-	if (!response.ok) {
-		let text: string;
-		try {
-			text = await response.text();
-		} catch (error) {
-			throw new MCPExpectedFailure(error);
-		}
-		throw new MCPExpectedFailure(new Error(`MCP OAuth refresh failed: ${response.status} ${text}`));
-	}
-
-	let data: unknown;
-	try {
-		data = await response.json();
-	} catch {
-		throw new MCPExpectedFailure();
-	}
-	if (!isRefreshTokenResponse(data)) throw new MCPExpectedFailure();
-	const expiresIn = data.expires_in ?? 3600;
-	return {
-		access: data.access_token,
-		refresh: data.refresh_token ?? refreshToken,
-		expires: Date.now() + expiresIn * 1000,
-	};
-}

package/src/runtime-mcp/plugin-network-boundary.ts

@@ -0,0 +1,101 @@
+import { type AddressResolver, guardedPublicFetch } from "../web/insane/url-guard";
+import { cancelMCPStream } from "./content-limits";
+import type { MCPHttpServerConfig, MCPSseServerConfig } from "./types";
+
+const PLUGIN_MCP_PUBLIC_NETWORK_BOUNDARY: unique symbol = Symbol("plugin-mcp-public-network-boundary");
+const REDIRECT_STATUSES = new Set([301, 302, 303, 307, 308]);
+const MAX_REDIRECTS = 20;
+const REQUEST_BODY_HEADERS = [
+	"content-encoding",
+	"content-language",
+	"content-length",
+	"content-location",
+	"content-type",
+] as const;
+
+/** Mark an in-memory plugin-bundle remote MCP config for connection-bound public-network enforcement. */
+export function bindPluginMcpToPublicNetwork<T extends MCPHttpServerConfig | MCPSseServerConfig>(config: T): T {
+	return Object.assign(config, { [PLUGIN_MCP_PUBLIC_NETWORK_BOUNDARY]: true });
+}
+
+/** The marker is an internal symbol, so persisted user MCP configs cannot opt into or forge this path. */
+export function isPluginMcpPublicNetworkBound(config: MCPHttpServerConfig | MCPSseServerConfig): boolean {
+	return (
+		(config as MCPHttpServerConfig & { [PLUGIN_MCP_PUBLIC_NETWORK_BOUNDARY]?: boolean })[
+			PLUGIN_MCP_PUBLIC_NETWORK_BOUNDARY
+		] === true
+	);
+}
+
+function blocked(reason: string): Error {
+	return new Error(`Plugin MCP network request blocked: ${reason}`);
+}
+
+function parseHttpsUrl(rawUrl: string): URL {
+	let url: URL;
+	try {
+		url = new URL(rawUrl);
+	} catch {
+		throw blocked("invalid URL");
+	}
+	if (url.protocol !== "https:") throw blocked("HTTPS is required");
+	return url;
+}
+
+function rewritesToGet(status: number, method: string): boolean {
+	return (
+		((status === 301 || status === 302) && method === "POST") ||
+		(status === 303 && method !== "GET" && method !== "HEAD")
+	);
+}
+
+/**
+ * Fetch a plugin-bundle MCP request through a DNS-pinned public address. Every
+ * redirect is handled manually and revalidated before the next connection.
+ */
+export async function fetchPluginMcpRequest(
+	rawUrl: string,
+	init: BunFetchRequestInit,
+	options: { resolver?: AddressResolver; maxRedirects?: number } = {},
+): Promise<Response> {
+	let currentUrl = parseHttpsUrl(rawUrl);
+	let currentInit: BunFetchRequestInit = { ...init };
+	const maxRedirects = options.maxRedirects ?? MAX_REDIRECTS;
+
+	for (let redirectCount = 0; ; redirectCount++) {
+		const dial = await guardedPublicFetch(currentUrl.toString(), currentInit, { resolver: options.resolver });
+		if (!dial.ok) throw blocked(dial.reason);
+		const { response, logicalUrl } = dial;
+		if (!REDIRECT_STATUSES.has(response.status)) return response;
+
+		const location = response.headers.get("location");
+		if (!location) return response;
+		if (redirectCount >= maxRedirects) {
+			cancelMCPStream(response.body);
+			throw blocked("redirect limit exceeded");
+		}
+
+		let nextUrl: URL;
+		try {
+			nextUrl = parseHttpsUrl(new URL(location, logicalUrl).toString());
+		} catch (error) {
+			cancelMCPStream(response.body);
+			throw error;
+		}
+		if (logicalUrl.origin !== nextUrl.origin) {
+			cancelMCPStream(response.body);
+			throw blocked("cross-origin redirects are not allowed");
+		}
+
+		const headers = new Headers(currentInit.headers);
+		const method = (currentInit.method ?? "GET").toUpperCase();
+		if (rewritesToGet(response.status, method)) {
+			for (const name of REQUEST_BODY_HEADERS) headers.delete(name);
+			currentInit = { ...currentInit, method: "GET", headers, body: undefined };
+		} else {
+			currentInit = { ...currentInit, headers };
+		}
+		currentUrl = nextUrl;
+		cancelMCPStream(response.body);
+	}
+}