@koda-sl/baker-bridge 0.109.0-dev.afb6a264b → 0.109.0-dev.f7ef4c7e1

package/dist/hono/bridge-job.js

@@ -11,15 +11,18 @@ import { avatarAwaitingItsFace, avatarCreatedInAssistantMessage, avatarHandleFro
 import { accentContradictsUser } from "./avatar-accent.js";
 import { AVATAR_CASTING_TOOL_NAME, normalizeAvatarCastingToolInput, } from "./avatar-casting.js";
 import { asksForAvatarFace, FACE_QUESTION_MESSAGE } from "./avatar-face-question.js";
-import { CONNECTION_INPUT_TOOL_NAME, CONNECTION_PLATFORMS, normalizeConnectionInputToolInput, } from "./connection-input.js";
+import { CONNECTION_INPUT_TOOL_NAME, CONNECTION_PLATFORMS, connectedButNotLoaded, normalizeConnectionInputToolInput, toolsConnected, } from "./connection-input.js";
 import { messageContextTokens, pickContextWindow, streamEventContextUsage, turnContextUsage, } from "./context-usage.js";
-import { FLOW_INPUT_TOOL_NAME, nodeTargetRefusals, normalizeFlowInputToolInput, readRawFlowTree, sanitizeFlowRequests, } from "./flow-input.js";
+import { CREDENTIAL_INPUT_TOOL_NAME, normalizeCredentialInputToolInput, } from "./credential-input.js";
+import { credentialScrubHooks } from "./credential-scrub.js";
+import { agentStatedFlowMessage, FLOW_INPUT_TOOL_NAME, nodeTargetRefusals, normalizeFlowInputToolInput, readRawFlowTree, sanitizeFlowRequests, unknownFlowPrefillMessage, } from "./flow-input.js";
 import { writesInventedLogo } from "./invented-logo.js";
-import { installedLatitudeHook, latitudeTelemetryFor } from "./latitude-telemetry.js";
+import { jevJudge } from "./jev.js";
 import { composioScopesToInvalidate, failedCustomServers, reportMcpInvalid, serversConnectedWithNoTools, } from "./mcp-servers.js";
 import { agentModelOverride, autoCompactWindowForModel, betasForModel, contextWindowForModel, } from "./model-capabilities.js";
+import { agentShellPrefixEnv, killFirstWrapper } from "./oom-priority.js";
 import { BEDROCK_SERVABLE_CAPABILITIES, buildAgentExtraBody, EXTRA_BODY_ENV, MODEL_CAPABILITIES_ENV, } from "./openrouter-session.js";
-import { currentReferenceReminder } from "./prompt-context.js";
+import { credentialReminder, currentReferenceReminder } from "./prompt-context.js";
 import { bridgeRuntimeFiles } from "./runtime-files.js";
 import { applyCurrentSenderAttribution, buildCleanBoundary, buildRehydratedPrompt, compactionRetryAttempt, emptyInProgressSession, isContextOverflowError, isResumeSessionError, observeInProgressSession, prepareSessionAttempt, stallContinuationAttempt, } from "./session-continuity.js";
 import { readSessionSkills } from "./session-skills.js";
@@ -44,6 +47,35 @@ export function parsePlanDecision(value) {
     }
     return null;
 }
+/**
+ * How long a mid-turn MCP reload may hold the card's answer. Connecting a
+ * handful of HTTP servers takes seconds; past this the tools arrive next
+ * message instead, and the turn goes on.
+ */
+const MCP_RELOAD_TIMEOUT_MS = 30_000;
+/** The card's resolution, with what the reload did: ready now, or which servers would not start. */
+function withReload(resolution, reload) {
+    const missing = reload?.ready ? connectedButNotLoaded(resolution, reload.loaded) : [];
+    const failed = [...(reload?.failed ?? []), ...missing];
+    return {
+        ...resolution,
+        toolsReady: reload?.ready === true && missing.length === 0,
+        ...(failed.length > 0 ? { failedToLoad: failed } : {}),
+    };
+}
+/** The promise's value, or `undefined` once `ms` pass without one. */
+async function settleWithin(promise, ms) {
+    let timer;
+    const timedOut = new Promise((resolve) => {
+        timer = setTimeout(() => resolve(undefined), ms);
+    });
+    try {
+        return await Promise.race([promise, timedOut]);
+    }
+    finally {
+        clearTimeout(timer);
+    }
+}
 /**
  * The Agent SDK matches AskUserQuestion answers to their questions by the
  * question TEXT (see `AskUserQuestionInput.answers`), but the dashboard submits
@@ -118,11 +150,10 @@ const BASE_DISALLOWED_TOOLS = [
     //
     // Since CLI 2.1.233 the CLI additionally withholds these from
     // Sonnet-5-and-newer models — so on Opus 5.5 this list is now
-    // belt-and-braces. It is NOT redundant, because development runs on
-    // Haiku 4.5, which predates that gate: read off the session's own
-    // `init` tool list on 2.1.239, Haiku is offered all four and Opus 5
-    // none. Removing them would hand the dev agent the backlog the
-    // production agent cannot see.
+    // belt-and-braces. It is NOT redundant: Haiku 4.5 predates that gate
+    // (read off the session's own `init` tool list on 2.1.239, it is offered
+    // all four and Opus 5 none), and any override naming it would hand that
+    // agent the backlog the production agent cannot see.
     //
     // `TodoWrite` is gone from both — it is absent from an SDK session's
     // tool list on either model, so in-turn planning no longer has a tool
@@ -191,6 +222,16 @@ export function reviewQueryOptions(job) {
         ? { outputFormat: { type: "json_schema", schema: job.review.outputSchema }, hooks: reviewOutputHooks() }
         : {};
 }
+/**
+ * Every job's tool results pass through the credential scrub, appended after
+ * any other PostToolUse hook so its rewrite is the one the SDK keeps.
+ */
+function withCredentialScrub(options) {
+    const scrub = credentialScrubHooks();
+    const hooks = { ...(options.hooks ?? {}) };
+    hooks.PostToolUse = [...(hooks.PostToolUse ?? []), ...(scrub.PostToolUse ?? [])];
+    return { ...options, hooks };
+}
 /**
  * The review runs on Baker's own OpenRouter credential and its own read-only
  * key, both replacing whatever the Runtime was started with — the client never
@@ -217,6 +258,12 @@ export const REVIEW_DEBUG_LOG = "/tmp/baker-review-cli.jsonl";
 // briefly; model activity cancels it (the CLI clearly isn't idle). Turns that
 // never ran a task skip the delay entirely.
 const DEFAULT_TURN_END_SETTLE_MS = 1_000;
+// When the last task settles after the clean result, the CLI wakes the model on
+// it and streams nothing until the woken turn's first token — seconds, and 30+
+// on a slow route. Ending input inside that silence strands the woken turn on a
+// closed channel, and the CLI's exit at its result kills anything it backgrounds
+// (dev, Oct 2026: a render). A settle that wakes nobody waits this long once.
+const DEFAULT_TURN_END_WAKE_MS = 45_000;
 // After input ends, a healthy idle CLI exits within seconds. If the stream is
 // still open past this window with no messages arriving, the CLI is wedged —
 // close the query so the turn can finish instead of hanging to the watchdog.
@@ -244,10 +291,10 @@ const UNATTENDED_PROMPT_MESSAGE = "This run is unattended — it was started by
  * asked for in a text prompt renders a question nobody can answer. In each case the user
  * is left waiting for something that was never going to come.
  */
-function refuseMalformedCall(toolName, input, userText, priorUserText) {
+async function refuseMalformedCall(toolName, input, judge, userText, priorUserText) {
     if (toolName === "Bash") {
         const command = typeof input?.command === "string" ? input.command : undefined;
-        return toolRunAsCommand(command) ?? accentContradictsUser(command, userText, priorUserText);
+        return toolRunAsCommand(command) ?? (await accentContradictsUser(command, userText, priorUserText, judge));
     }
     if (toolName === "Agent" || toolName === "Task") {
         return blockingToolDelegated(typeof input?.prompt === "string" ? input.prompt : undefined);
@@ -255,11 +302,18 @@ function refuseMalformedCall(toolName, input, userText, priorUserText) {
     if (toolName === "Write" || toolName === "Edit" || toolName === "MultiEdit") {
         return writesInventedLogo(typeof input?.file_path === "string" ? input.file_path : undefined);
     }
-    if (toolName === "AskUserQuestion" && asksForAvatarFace(input)) {
+    if (toolName === "AskUserQuestion" && (await asksForAvatarFace(input, judge))) {
         return FACE_QUESTION_MESSAGE;
     }
     return null;
 }
+/**
+ * Whether this Runtime has Credentials: the backend sets `BAKER_CREDENTIALS=1`
+ * alongside the credential broker's proxy env. Read per turn, not at import.
+ */
+function credentialsEnabled() {
+    return process.env.BAKER_CREDENTIALS === "1";
+}
 /** Blocking prompts: every tool that would leave a card the backend parks on. */
 function deniedUnattendedPrompt(toolName) {
     return (toolName === "AskUserQuestion" ||
@@ -267,6 +321,7 @@ function deniedUnattendedPrompt(toolName) {
         toolName === TAG_INPUT_TOOL_NAME ||
         toolName === FLOW_INPUT_TOOL_NAME ||
         toolName === CONNECTION_INPUT_TOOL_NAME ||
+        toolName === CREDENTIAL_INPUT_TOOL_NAME ||
         toolName === AVATAR_CASTING_TOOL_NAME);
 }
 export class StreamStallError extends Error {
@@ -343,8 +398,7 @@ function enrichImageError(message) {
     return `${message} — likely a file whose extension lies about its format (e.g. PNG renamed .jpg) or a corrupted download. Run the image validator and check magic bytes with \`file <path>\`.`;
 }
 /**
- * Which hooks a job runs. The client's agent runs the workspace's own and is
- * traced to Latitude. A Session review runs none: every workspace hook is
+ * Which hooks a job runs. The client's agent runs the workspace's own. A Session review runs none: every workspace hook is
  * written for the client's agent, and in the reviewer they speak about "this
  * Session" with the review's read-scoped key. The SessionStart probes are
  * refused on full-scope routes, and the reviewer filed its own "status unknown"
@@ -361,12 +415,11 @@ function hookSettingsForJob(job) {
     if (job.review) {
         return { disableAllHooks: true, permissions: { ask: ["Bash"] } };
     }
-    const hooks = latitudeTelemetryFor(process.env, installedLatitudeHook());
-    return hooks ? { hooks } : {};
+    return {};
 }
 // Carry a Runtime-wide model override down to the fan-out workers.
 //
-// The shared subagents pin themselves to Sonnet 5 in their own frontmatter (see
+// The shared subagents pin themselves to Sonnet 5.5 in their own frontmatter (see
 // `DEFAULT_MODEL`). Since CLI 2.1.251 `CLAUDE_CODE_SUBAGENT_MODEL` is only the
 // default beneath that pin; `CLAUDE_CODE_SUBAGENT_MODEL_FORCE` (2.1.257) makes it
 // win over the frontmatter and any per-spawn model again. Absent (production),
@@ -660,6 +713,11 @@ export function createStallDetector(input) {
     timer.unref?.();
     return {
         observeMessage: (msg) => {
+            // A tool's progress says nothing about the model: a background task's
+            // heartbeat arrives while the model's stream is stalled.
+            if (msg.type === "tool_progress") {
+                return;
+            }
             lastMessageAt = input.now();
             trackPendingToolUses(pendingToolUses, msg);
             awaitingModel = (msg.type === "user" || msg.type === "stream_event") && pendingToolUses.size === 0;
@@ -788,7 +846,7 @@ beforeEndInput) {
         }, timings.exitGuardMs);
         exitGuard.unref?.();
     };
-    const scheduleEnd = () => {
+    const scheduleEnd = (delayMs = timings.settleMs) => {
         if (settleTimer) {
             return;
         }
@@ -800,7 +858,7 @@ beforeEndInput) {
             endInput();
             return;
         }
-        settleTimer = setTimeout(endInput, timings.settleMs);
+        settleTimer = setTimeout(endInput, delayMs);
         settleTimer.unref?.();
     };
     return {
@@ -866,7 +924,7 @@ beforeEndInput) {
             // second result) would strand the turn until the watchdog. An emptied
             // background_tasks_changed level counts as a settle the same way.
             if (lastWasTaskLifecycle && cleanResultSeen && !hasInFlightWork()) {
-                scheduleEnd();
+                scheduleEnd(timings.wakeMs);
             }
         },
         hasInFlightWork,
@@ -959,12 +1017,14 @@ export class BridgeJobExecutor {
     stallCheckIntervalMs;
     recordTurnEvent;
     turnEndSettleMs;
+    turnEndWakeMs;
     turnEndExitGuardMs;
     now;
     readUsageBaseline;
     stalledCliExitMs;
     readFlowTree;
     settleWorkspace;
+    judge;
     constructor(dependencies) {
         this.sdk = dependencies.sdk;
         this.relay = dependencies.relay;
@@ -977,6 +1037,7 @@ export class BridgeJobExecutor {
         this.stallCheckIntervalMs = dependencies.stallCheckIntervalMs ?? DEFAULT_STALL_CHECK_INTERVAL_MS;
         this.recordTurnEvent = dependencies.recordTurnEvent ?? recordTurnEvent;
         this.turnEndSettleMs = dependencies.turnEndSettleMs ?? DEFAULT_TURN_END_SETTLE_MS;
+        this.turnEndWakeMs = dependencies.turnEndWakeMs ?? DEFAULT_TURN_END_WAKE_MS;
         this.turnEndExitGuardMs = dependencies.turnEndExitGuardMs ?? DEFAULT_TURN_END_EXIT_GUARD_MS;
         this.now = dependencies.now ?? Date.now;
         this.readUsageBaseline =
@@ -986,6 +1047,7 @@ export class BridgeJobExecutor {
         this.settleWorkspace = dependencies.settleWorkspace ?? (() => settleWorkspaceAfterTasks());
         this.readFlowTree =
             dependencies.readFlowTree ?? ((flowSlug) => readRawFlowTree(bridgeRuntimeFiles.flowsDir(), flowSlug));
+        this.judge = dependencies.judge ?? jevJudge(process.env.OPENROUTER_API_KEY);
     }
     async execute(job, controls) {
         const state = createBridgeJobState();
@@ -1058,7 +1120,11 @@ export class BridgeJobExecutor {
         const verbatim = verbatimSlashCommand(job.prompt) ??
             leadingSkillCommand(job.prompt, (await readSessionSkills(bridgeRuntimeFiles.projectRoot())) ?? []);
         let requestPrompt = verbatim ?? applyCurrentSenderAttribution(job.prompt, job.currentSender);
-        const reminder = verbatim === null ? currentReferenceReminder(job.currentReference) : undefined;
+        const reminders = [
+            verbatim === null ? currentReferenceReminder(job.currentReference) : undefined,
+            credentialReminder(job.credentials ?? [], credentialsEnabled()),
+        ].filter((text) => text !== undefined);
+        const reminder = reminders.length > 0 ? reminders.join("\n\n") : undefined;
         if (job.attachments && job.attachments.length > 0) {
             requestPrompt += await this.prepareAttachments(job.attachments, "message");
         }
@@ -1315,6 +1381,39 @@ export class BridgeJobExecutor {
             return undefined;
         }
     }
+    /**
+     * Load what the user just connected into the running query, so its tools
+     * answer in this turn instead of the next. Asks Convex for the whole set
+     * afresh (the same set the next turn starts from, so the tool list changes
+     * once, not twice) and hands it to the CLI with `baker_ui` kept — the SDK
+     * drops any in-process server missing from the call, and `baker_ui` is the
+     * server whose tool call is resolving right now. Never throws. A server the
+     * CLI could not start is named, because it will not start next message
+     * either; anything else that goes wrong here loads next message.
+     */
+    async reloadMcpServers(job, query) {
+        const notReady = { ready: false, loaded: [], failed: [] };
+        if (!this.mcpServersProvider || !query.setMcpServers) {
+            return notReady;
+        }
+        try {
+            const servers = await this.mcpServersProvider(job.threadId, job.currentSender?.userId, { fresh: true });
+            if (!servers) {
+                return notReady;
+            }
+            const result = await settleWithin(query.setMcpServers({ ...servers, baker_ui: createBakerUiServer({ credentials: credentialsEnabled() }) }), MCP_RELOAD_TIMEOUT_MS);
+            const failed = Object.keys(result?.errors ?? {});
+            if (failed.length > 0) {
+                console.error(`[mcp] reload after a connection could not start ${failed.join(", ")}`);
+            }
+            const loaded = Object.keys(servers).filter((name) => !failed.includes(name));
+            return { ready: result !== undefined && failed.length === 0, loaded, failed };
+        }
+        catch (error) {
+            console.error(`[mcp] reload after a connection failed: ${error instanceof Error ? error.message : String(error)}`);
+            return notReady;
+        }
+    }
     reportMcpFailures(job, msg) {
         for (const scope of composioScopesToInvalidate(msg)) {
             void reportMcpInvalid(job.threadId, { scope }, job.currentSender?.userId);
@@ -1334,7 +1433,7 @@ export class BridgeJobExecutor {
      * handlers — except on an unattended turn, where there is nobody to answer and
      * every one of them is refused up front (see `UNATTENDED_PROMPT_MESSAGE`).
      */
-    routeToolUse(job, controls, toolName, input, opts) {
+    async routeToolUse(job, controls, toolName, input, opts) {
         const refusedShell = reviewShellRefusal(job, toolName, input);
         if (refusedShell) {
             return Promise.resolve({ behavior: "deny", message: refusedShell });
@@ -1350,9 +1449,9 @@ export class BridgeJobExecutor {
             });
             return Promise.resolve({ behavior: "deny", message: UNATTENDED_PROMPT_MESSAGE });
         }
-        const malformed = refuseMalformedCall(toolName, input, job.prompt, userTurnsBefore(job));
+        const malformed = await refuseMalformedCall(toolName, input, this.judge, job.prompt, userTurnsBefore(job));
         if (malformed)
-            return Promise.resolve({ behavior: "deny", message: malformed });
+            return { behavior: "deny", message: malformed };
         // Cast what is owed FIRST, whatever comes next — including another create. Checked
         // the other way round, a second create (the agent retrying after a rejected flag,
         // which is what happens in practice) would overwrite the handle and the first
@@ -1405,6 +1504,15 @@ export class BridgeJobExecutor {
         if (toolName === CONNECTION_INPUT_TOOL_NAME) {
             return this.handleConnectionInputRequest(job, controls, input, opts.toolUseID, opts.signal);
         }
+        if (toolName === CREDENTIAL_INPUT_TOOL_NAME) {
+            if (!credentialsEnabled()) {
+                return Promise.resolve({
+                    behavior: "deny",
+                    message: "Saved credentials are not available in this workspace. Ask the user to share what you need another way, and never ask them to paste a password or key into the chat.",
+                });
+            }
+            return this.handleCredentialInputRequest(job, controls, input, opts.toolUseID, opts.signal);
+        }
         if (toolName === AVATAR_CASTING_TOOL_NAME) {
             return this.handleAvatarCastingRequest(job, controls, input, opts.toolUseID, opts.signal);
         }
@@ -1443,6 +1551,10 @@ export class BridgeJobExecutor {
             // warning to the user. Pinning it takes that threshold out of remote control.
             // See `autoCompactWindowForModel` for the full chain and its ceiling.
             ...(autoCompactWindow !== undefined ? { autoCompactWindow } : {}),
+            // Subagents, workflows and helper requests default to a 5-minute prompt
+            // cache outside a Claude subscription, so a subagent waiting on a render
+            // longer than that rewrites its whole prefix on the next call.
+            subagentPromptCacheTtl: "1h",
             // SDK rejects autoMemoryDirectory from project settings for security; must use settings tier. Gate on BAKER_CHAT_ID so local dev never writes into the monorepo.
             ...(process.env.BAKER_CHAT_ID
                 ? {
@@ -1475,11 +1587,8 @@ export class BridgeJobExecutor {
             settingSources: ["project"],
             // `baker_ui` hosts in-process interactive dashboard tools (secure tag
             // form). Always present; HTTP (Composio) servers merge alongside it.
-            mcpServers: { ...(mcpServers ?? {}), baker_ui: createBakerUiServer() },
-            // Only send the key when there is something in it: the SDK forwards
-            // `settings` to the CLI whenever it is present, so an empty object still
-            // becomes a `--settings {}` flag tier for the CLI to parse.
-            ...(Object.keys(settings).length > 0 ? { settings } : {}),
+            mcpServers: { ...(mcpServers ?? {}), baker_ui: createBakerUiServer({ credentials: credentialsEnabled() }) },
+            settings,
             includePartialMessages: true,
             // Only the workspace's own skills. Omitting the option is NOT "skills
             // off" — the CLI's defaults still load its built-in developer skills
@@ -1488,8 +1597,11 @@ export class BridgeJobExecutor {
             // the workspace could not be read; omit rather than allowlist nothing.
             ...(skills ? { skills } : {}),
             disallowedTools: disallowedToolsFor(job),
-            ...reviewQueryOptions(job),
-            ...(job.planMode ? { permissionMode: "plan" } : {}),
+            ...withCredentialScrub(reviewQueryOptions(job)),
+            // Never omitted: since SDK 0.3.286 an omitted mode starts a third-party-provider
+            // session (OpenRouter) in auto mode, where a classifier rather than `canUseTool`
+            // decides tool calls.
+            permissionMode: job.planMode ? "plan" : "default",
             canUseTool: (toolName, input, opts) => this.routeToolUse(job, controls, toolName, input, opts),
             // No `fallbackModel`, and no server-side refusal `fallbacks` in the extra
             // body: the CLI's refusal fallback is gated on a first-party base URL (see
@@ -1513,6 +1625,13 @@ export class BridgeJobExecutor {
                 // system-reminder repeatedly pushed the agent toward that ephemeral
                 // backlog instead of the product's own Tasks (`baker actions`).
                 CLAUDE_CODE_ENABLE_TASKS: "0",
+                // Every Bash command runs through a wrapper that makes it, not the agent
+                // or the credential broker, what the OOM killer takes first (oom-priority.ts).
+                ...agentShellPrefixEnv(killFirstWrapper(), process.env),
+                // The CLI clamps any Bash timeout to 10 minutes unless told otherwise;
+                // the workspace's `inject-timeouts` hook gives a render up to 30, and at
+                // the clamp the render was moved to the background mid-repair.
+                BASH_MAX_TIMEOUT_MS: String(30 * 60_000),
                 // `citty` writes ANSI escapes into `baker --help` unconditionally —
                 // they are never TTY-gated, so every help read the agent does inside
                 // the sandbox pays ~5-10% of its tokens on colour codes it can't see.
@@ -1534,6 +1653,7 @@ export class BridgeJobExecutor {
             ...attempt.resumeOptions,
         };
         const query = this.sdk.query({ prompt: attempt.prompt, reminder: attempt.reminder, options });
+        controls.reloadMcpServers = () => this.reloadMcpServers(job, query);
         let queryClosed = false;
         const closeQuery = () => {
             if (queryClosed) {
@@ -1555,6 +1675,7 @@ export class BridgeJobExecutor {
             throw error;
         }
         finally {
+            controls.reloadMcpServers = undefined;
             controls.abortSignal.removeEventListener("abort", closeQuery);
             // Release the held-open input if the turn-end policy never fired (the
             // stream ended on its own, or an error path closed the query). Idempotent.
@@ -1585,7 +1706,7 @@ export class BridgeJobExecutor {
         // A reading that answers after the query drained (past its timeout) belongs
         // to a query already folded into the turn — and a retry reuses `state`.
         let drained = false;
-        const turnEnd = createTurnEndController(job, query, closeQuery, { settleMs: this.turnEndSettleMs, exitGuardMs: this.turnEndExitGuardMs }, this.recordTurnEvent, async () => {
+        const turnEnd = createTurnEndController(job, query, closeQuery, { settleMs: this.turnEndSettleMs, wakeMs: this.turnEndWakeMs, exitGuardMs: this.turnEndExitGuardMs }, this.recordTurnEvent, async () => {
             const reading = await query.usage?.();
             if (reading && !drained) {
                 settledCostUsd = recordCumulativeUsage(state, reading);
@@ -1693,6 +1814,7 @@ export class BridgeJobExecutor {
                 controls.pendingTagInputs.size > 0 ||
                 controls.pendingFlowInputs.size > 0 ||
                 controls.pendingConnectionInputs.size > 0 ||
+                controls.pendingCredentialInputs.size > 0 ||
                 controls.pendingAvatarCastings.size > 0,
             onStall: () => {
                 console.error(`[BridgeJob] no stream data for ${this.stallTimeoutMs}ms while awaiting the model — closing query for retry (thread ${job.threadId})`);
@@ -2121,6 +2243,16 @@ export class BridgeJobExecutor {
         // Strip any secret values the model tried to prefill; their names still reach
         // the user as requested fields. The backend strips again.
         const sanitizedRequests = sanitizeFlowRequests(requests);
+        // A key the card does not render is dropped there without a word, and the
+        // person retypes what the agent already knew — refuse it before the card opens.
+        const stated = agentStatedFlowMessage(sanitizedRequests);
+        if (stated) {
+            return { behavior: "deny", message: stated };
+        }
+        const unknownPrefill = unknownFlowPrefillMessage(sanitizedRequests);
+        if (unknownPrefill) {
+            return { behavior: "deny", message: unknownPrefill };
+        }
         const posted = await this.relay.flowInputRequest(target, { toolUseId, requests: sanitizedRequests });
         if (!posted) {
             console.error(`[request_flow_input] failed to post flow-input-request for ${toolUseId} — denying to avoid a hang`);
@@ -2171,7 +2303,7 @@ export class BridgeJobExecutor {
         if (connections.length === 0) {
             return {
                 behavior: "deny",
-                message: `request_connection requires \`connections: [...]\` with at least one entry { platform, reason }. Platform must be one of ${CONNECTION_PLATFORMS.join(", ")}. Retry with that shape.`,
+                message: `request_connection requires \`connections: [...]\` with at least one entry: { platform, reason } where platform is one of ${CONNECTION_PLATFORMS.join(", ")}; { server: { name, url, auth?, keyHeader?, scope? }, reason } for a remote MCP server; or { app, reason } for a managed app from \`baker mcp catalog\`. Retry with that shape.`,
             };
         }
         const posted = await this.relay.connectionInputRequest(target, { toolUseId, connections });
@@ -2193,7 +2325,43 @@ export class BridgeJobExecutor {
             return { behavior: "deny", message: PROMPT_UNANSWERED_MESSAGE };
         }
         void this.relay.connectionInputResolved(target);
-        return { behavior: "allow", updatedInput: { connections, resolution: decision.value } };
+        // Loaded before the tool answers, so the model's next request already
+        // carries the new tools. Only when an app or server came through: a
+        // platform adds no tool, and reloading for nothing rewrites the tool list.
+        const resolution = toolsConnected(decision.value)
+            ? withReload(decision.value, await controls.reloadMcpServers?.())
+            : decision.value;
+        return { behavior: "allow", updatedInput: { connections, resolution } };
+    }
+    async handleCredentialInputRequest(job, controls, input, toolUseId, signal) {
+        const target = { threadId: job.threadId, turnId: job.turnId };
+        const request = normalizeCredentialInputToolInput(input);
+        if (!request) {
+            return {
+                behavior: "deny",
+                message: "request_credential requires { label, reason, allowedHosts: [...] } (and optionally a lowercase `name`). Retry with that shape.",
+            };
+        }
+        const posted = await this.relay.credentialInputRequest(target, { toolUseId, ...request });
+        if (!posted) {
+            console.error(`[request_credential] failed to post credential-input-request for ${toolUseId} — denying`);
+            return {
+                behavior: "deny",
+                message: "The credential request could not be delivered to the dashboard — retry request_credential in a moment.",
+            };
+        }
+        const decision = await this.awaitPromptDecision({
+            label: "request_credential",
+            signal,
+            controls,
+            pending: controls.pendingCredentialInputs,
+            toolUseId,
+        });
+        if (decision.kind === "unanswered") {
+            return { behavior: "deny", message: PROMPT_UNANSWERED_MESSAGE };
+        }
+        void this.relay.credentialInputResolved(target);
+        return { behavior: "allow", updatedInput: { ...request, resolution: decision.value } };
     }
     async handlePlanReview(job, controls, input, toolUseId, signal) {
         const target = { threadId: job.threadId, turnId: job.turnId };