@m1a0rz/agent-identity 0.1.8 → 0.2.0

package/README-cn.md

@@ -243,7 +243,7 @@ TIP token 通过 `GetWorkloadAccessTokenForJWT` 获取。工作负载行为：
 
 - **before_agent_start** - 获取 TIP token；按 credential-env-bindings（按 session）将凭据注入到 `process.env`
 - **subagent_spawned** - 在子 agent 创建时将 TIP 传播到子会话
-- **before_tool_call** - 当 authz.enable 时可选 AuthZ（TIP + CheckPermission + 风险审批）。评估用户提供的命令/路径风险（规则 + 可选 LLM）。高风险调用需审批；LLM 风险原因会出现在审批提示和拦截消息中。
+- **before_tool_call** - 当 authz.toolCheck、authz.skillReadCheck 或 authz.requireRiskApproval 时可选 AuthZ。TIP + CheckPermission 工具/skill；高风险工具需审批。评估命令/路径风险（规则 + 可选 LLM via authz.enableLlmRiskCheck）。
 
 ## 数据存储
 

package/README.md

@@ -243,7 +243,7 @@ Follow-up messages (login success, credential fetch done) are not delivered when
 
 - **before_agent_start** - Fetch TIP token; inject credentials into `process.env` per credential-env-bindings (per-session)
 - **subagent_spawned** - Propagate TIP to child session on subagent spawn
-- **before_tool_call** - Optional AuthZ (TIP + CheckPermission + risk approval) when authz.enable. Evaluates user-provided commands/paths for risk (rules + optional LLM). High-risk calls require approval; the LLM risk reason is included in approval prompts and block messages when available.
+- **before_tool_call** - Optional AuthZ when authz.toolCheck, authz.skillReadCheck, or authz.requireRiskApproval. TIP + CheckPermission for tools/skills; risk approval for high-risk tools. Evaluates user-provided commands/paths (rules + optional LLM via authz.enableLlmRiskCheck).
 
 ## Data Storage
 

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AA0D7D,MAAM,CAAC,OAAO,UAAU,QAAQ,CAAC,GAAG,EAAE,iBAAiB,QAyUtD"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AA6D7D,MAAM,CAAC,OAAO,UAAU,QAAQ,CAAC,GAAG,EAAE,iBAAiB,QAoWtD"}

package/dist/index.js

@@ -11,10 +11,12 @@
  */
 import { createIdentityCommand, createIdCommand } from "./src/commands/identity-commands.js";
 import { createBeforeAgentStartHandler } from "./src/hooks/before-agent-start.js";
+import { createLlmInputHandler } from "./src/hooks/llm-input.js";
 import { createSessionsSendPropagationHandler } from "./src/hooks/sessions-send-propagation.js";
 import { createSessionsSpawnPropagationHandler } from "./src/hooks/sessions-spawn-propagation.js";
 import { createSubagentEndedCleanupHandler } from "./src/hooks/subagent-ended-cleanup.js";
 import { createBeforeToolCallHandler } from "./src/hooks/before-tool-call.js";
+import * as skillPathStore from "./src/store/skill-path-store.js";
 import { createOIDCCallbackHandler, createOIDCCallbackHandlerLazy, } from "./src/routes/oidc-login.js";
 import { IdentityClient, resolveOIDCConfig, } from "./src/services/identity-client.js";
 import { IdentityService } from "./src/services/identity-service.js";
@@ -33,6 +35,7 @@ import { createIdentityStatusTool } from "./src/tools/identity-status.js";
 import { createIdentityUnsetBindingTool } from "./src/tools/identity-unset-binding.js";
 import { createIdentityWhoamiTool } from "./src/tools/identity-whoami.js";
 import { parseSessionKeyToDeliveryTarget, } from "./src/utils/derive-session-key.js";
+import { logInfo, logWarn } from "./src/utils/logger.js";
 const PLUGIN_STORE_DIR = "~/.openclaw/plugins/identity";
 /**
  * Whether Identity should be enabled.
@@ -186,7 +189,7 @@ export default function register(api) {
             ? targetOrSessionKey
             : parseSessionKeyToDeliveryTarget(targetOrSessionKey);
         if (!target) {
-            api.logger.warn(`agent-identity: Cannot deliver to channel (sessionKey not parseable). Set session.dmScope to per-channel-peer or per-account-channel-peer so approval messages reach Feishu/Telegram/etc.`);
+            logWarn(api.logger, "Cannot deliver to channel (sessionKey not parseable). Set session.dmScope to per-channel-peer or per-account-channel-peer so approval messages reach Feishu/Telegram/etc.");
             return;
         }
         if (target.channel === "feishu") {
@@ -195,7 +198,7 @@ export default function register(api) {
                 await sendNotificationFeishu(cfg, target.to, text, target.accountId);
             }
             catch (err) {
-                api.logger.warn(`agent-identity: Feishu notification failed (to=${target.to}): ${String(err)}`);
+                logWarn(api.logger, `Feishu notification failed (to=${target.to}): ${String(err)}`);
             }
             return;
         }
@@ -257,6 +260,8 @@ export default function register(api) {
         storeDir,
         identityService,
         getOidcConfig: getOidcConfigForCommand,
+        getOidcConfigForRefresh: getOidcConfigForRefresh ?? undefined,
+        configWorkloadName: identityCfg?.workloadName,
         identityClient: hasIdentity ? identityClient : undefined,
         logger: api.logger,
         pluginConfig,
@@ -264,7 +269,7 @@ export default function register(api) {
     };
     api.registerCommand(createIdentityCommand(identityCommandsDeps));
     api.registerCommand(createIdCommand(identityCommandsDeps));
-    api.logger.info("agent-identity: commands /identity, /id (login, status, logout, list-tips, list-credentials, fetch, set, unset); HTTP callback /identity/oauth/callback (credential OAuth uses Identity callback)");
+    logInfo(api.logger, "commands /identity, /id (login, status, logout, list-tips, list-credentials, fetch, set, unset); HTTP callback /identity/oauth/callback (credential OAuth uses Identity callback)");
     // Tools (share deps with commands). Optional = only included when agent allowlist explicitly adds them.
     api.registerTool(createIdentityWhoamiTool(identityCommandsDeps), { optional: false });
     api.registerTool(createIdentityLogoutTool(identityCommandsDeps), { optional: false });
@@ -297,12 +302,16 @@ export default function register(api) {
             storeDir,
             identityService,
             configWorkloadName: identityCfg?.workloadName,
+            getOidcConfigForRefresh: getOidcConfigForRefresh ?? undefined,
+            subagentTipPropagation: identityCfg?.subagentTipPropagation,
             logger: api.logger,
         }));
         api.on("subagent_spawned", createSessionsSpawnPropagationHandler({
             storeDir,
             identityService,
             configWorkloadName: identityCfg?.workloadName,
+            getOidcConfigForRefresh: getOidcConfigForRefresh ?? undefined,
+            subagentTipPropagation: identityCfg?.subagentTipPropagation,
             logger: api.logger,
         }));
         api.on("subagent_ended", createSubagentEndedCleanupHandler({
@@ -310,15 +319,32 @@ export default function register(api) {
             logger: api.logger,
         }));
     }
-    if (authz?.enable) {
+    const toolCheck = authz?.toolCheck ?? false;
+    const skillReadCheck = authz?.skillReadCheck ?? false;
+    const requireRiskApproval = authz?.requireRiskApproval ?? false;
+    const hasAuthz = toolCheck || skillReadCheck || requireRiskApproval;
+    if (skillReadCheck) {
+        api.on("llm_input", createLlmInputHandler({
+            enabled: true,
+            logger: api.logger,
+        }));
+        api.on("session_end", (_event, ctx) => {
+            if (ctx.sessionId)
+                skillPathStore.clearSessionById(ctx.sessionId);
+        });
+    }
+    if (hasAuthz) {
         api.on("before_tool_call", createBeforeToolCallHandler({
             storeDir,
             identityClient: hasIdentity ? identityClient : undefined,
-            namespaceName: authz.namespaceName ?? "default",
+            namespaceName: authz?.namespaceName ?? "default",
             logger: api.logger,
             sendToSession,
             authz,
             approvalTtlMs,
+            identityService: hasIdentity ? identityService : undefined,
+            getOidcConfigForRefresh: getOidcConfigForRefresh ?? undefined,
+            configWorkloadName: identityCfg?.workloadName,
         }));
     }
 }

package/dist/src/actions/identity-actions.d.ts

@@ -5,6 +5,7 @@
 import type { OpenClawConfig } from "openclaw/plugin-sdk";
 import type { IdentityClientInterface } from "../services/identity-client.js";
 import type { IdentityService } from "../services/identity-service.js";
+import type { OIDCConfigForRefresh } from "../services/session-refresh.js";
 import type { PluginConfig } from "../types.js";
 import type { SessionKeyDeliveryTarget } from "../utils/derive-session-key.js";
 import { type CredentialEntry } from "../store/credential-store.js";
@@ -24,6 +25,8 @@ export type IdentityActionsDeps = {
     storeDir: string;
     identityService: IdentityService;
     getOidcConfig: () => Promise<OIDCConfigForCommand>;
+    getOidcConfigForRefresh?: () => Promise<OIDCConfigForRefresh>;
+    configWorkloadName?: string;
     identityClient?: IdentityClientInterface;
     logger?: IdentityActionsLogger;
     pluginConfig?: PluginConfig;

package/dist/src/actions/identity-actions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"identity-actions.d.ts","sourceRoot":"","sources":["../../../src/actions/identity-actions.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAE1D,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,gCAAgC,CAAC;AAC9E,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,iCAAiC,CAAC;AACvE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAChD,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,gCAAgC,CAAC;AAY/E,OAAO,EAKL,KAAK,eAAe,EACrB,MAAM,8BAA8B,CAAC;AAUtC,MAAM,MAAM,oBAAoB,GAAG;IACjC,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;CACrB,CAAC;AAEF,MAAM,MAAM,qBAAqB,GAAG;IAClC,IAAI,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;IAC7B,IAAI,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;IAC7B,KAAK,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;CAC/B,CAAC;AAEF,MAAM,MAAM,mBAAmB,GAAG;IAChC,QAAQ,EAAE,MAAM,CAAC;IACjB,eAAe,EAAE,eAAe,CAAC;IACjC,aAAa,EAAE,MAAM,OAAO,CAAC,oBAAoB,CAAC,CAAC;IACnD,cAAc,CAAC,EAAE,uBAAuB,CAAC;IACzC,MAAM,CAAC,EAAE,qBAAqB,CAAC;IAC/B,YAAY,CAAC,EAAE,YAAY,CAAC;IAC5B,qBAAqB,CAAC,EAAE,CACtB,kBAAkB,EAAE,wBAAwB,GAAG,MAAM,EACrD,IAAI,EAAE,MAAM,KACT,OAAO,CAAC,IAAI,CAAC,CAAC;CACpB,CAAC;AAEF,MAAM,MAAM,SAAS,GAAG,aAAa,GAAG,YAAY,GAAG,QAAQ,CAAC;AA+EhE,MAAM,MAAM,YAAY,GAAG;IACzB,QAAQ,EAAE,OAAO,CAAC;IAClB,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IACnB,MAAM,EAAE,OAAO,CAAC;IAChB,2CAA2C;IAC3C,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,wDAAwD;IACxD,gBAAgB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,4BAA4B;IAC5B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,uBAAuB;IACvB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,wCAAwC;IACxC,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;IAC7C,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAClC,CAAC;AAEF,wBAAsB,SAAS,CAC7B,IAAI,EAAE,mBAAmB,EACzB,UAAU,EAAE,MAAM,EAClB,MAAM,CAAC,EAAE,cAAc,GACtB,OAAO,CAAC,YAAY,CAAC,CAwDvB;AAED,MAAM,MAAM,WAAW,GACnB;IAAE,IAAI,EAAE,mBAAmB,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GAC1C;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GACrC;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAEvC,wBAAsB,QAAQ,CAC5B,IAAI,EAAE,mBAAmB,EACzB,UAAU,EAAE,MAAM,EAClB,OAAO,CAAC,EAAE;IAAE,MAAM,CAAC,EAAE,cAAc,CAAC;IAAC,cAAc,CAAC,EAAE,wBAAwB,GAAG,IAAI,CAAA;CAAE,GACtF,OAAO,CAAC,WAAW,CAAC,CAmDtB;AAED,MAAM,MAAM,YAAY,GAAG;IAAE,EAAE,EAAE,OAAO,CAAA;CAAE,CAAC;AAE3C,wBAAsB,SAAS,CAC7B,IAAI,EAAE,mBAAmB,EACzB,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,YAAY,CAAC,CAWvB;AAID,MAAM,MAAM,qBAAqB,GAAG;IAClC,SAAS,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAClG,UAAU,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACtE,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,OAAO,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,CAAC;AAEF,wBAAsB,kBAAkB,CACtC,IAAI,EAAE,mBAAmB,EACzB,UAAU,EAAE,MAAM,EAClB,IAAI,GAAE,MAAU,GACf,OAAO,CAAC,qBAAqB,CAAC,CA2EhC;AAED,MAAM,MAAM,cAAc,GAAG;IAC3B,IAAI,EAAE,KAAK,CAAC;QACV,UAAU,EAAE,MAAM,CAAC;QACnB,GAAG,EAAE,MAAM,CAAC;QACZ,KAAK,EAAE,MAAM,EAAE,CAAC;QAChB,SAAS,EAAE,MAAM,CAAC;QAClB,MAAM,EAAE,MAAM,CAAC;KAChB,CAAC,CAAC;IACH,oDAAoD;IACpD,iBAAiB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;CAC3D,CAAC;AAEF,wBAAsB,WAAW,CAAC,IAAI,EAAE,mBAAmB,GAAG,OAAO,CAAC,cAAc,CAAC,CAsBpF;AAED,MAAM,MAAM,YAAY,GAAG;IACzB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACnC,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACnC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACjC,CAAC;AAEF,wBAAsB,SAAS,CAAC,IAAI,EAAE,mBAAmB,GAAG,OAAO,CAAC,YAAY,CAAC,CAyChF;AAED,MAAM,MAAM,WAAW,GACnB;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GACpC;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GACtD;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAEvC,wBAAsB,QAAQ,CAC5B,IAAI,EAAE,mBAAmB,EACzB,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE;IACN,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,SAAS,CAAC;IAChB,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,cAAc,CAAC,EAAE,wBAAwB,GAAG,IAAI,CAAC;IACjD,MAAM,CAAC,EAAE,cAAc,CAAC;CACzB,GACA,OAAO,CAAC,WAAW,CAAC,CA4GtB;AAED,MAAM,MAAM,gBAAgB,GAAG;IAAE,EAAE,EAAE,OAAO,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAEjF,wBAAsB,aAAa,CACjC,IAAI,EAAE,mBAAmB,EACzB,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAC3C,OAAO,CAAC,gBAAgB,CAAC,CAkC3B;AAED,MAAM,MAAM,kBAAkB,GAAG;IAAE,EAAE,EAAE,OAAO,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAEnF,wBAAsB,eAAe,CACnC,IAAI,EAAE,mBAAmB,EACzB,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE;IAAE,QAAQ,EAAE,MAAM,CAAA;CAAE,GAC3B,OAAO,CAAC,kBAAkB,CAAC,CAW7B"}
+{"version":3,"file":"identity-actions.d.ts","sourceRoot":"","sources":["../../../src/actions/identity-actions.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAE1D,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,gCAAgC,CAAC;AAC9E,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,iCAAiC,CAAC;AACvE,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,gCAAgC,CAAC;AAC3E,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAChD,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,gCAAgC,CAAC;AAc/E,OAAO,EAKL,KAAK,eAAe,EACrB,MAAM,8BAA8B,CAAC;AAUtC,MAAM,MAAM,oBAAoB,GAAG;IACjC,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;CACrB,CAAC;AAEF,MAAM,MAAM,qBAAqB,GAAG;IAClC,IAAI,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;IAC7B,IAAI,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;IAC7B,KAAK,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;CAC/B,CAAC;AAEF,MAAM,MAAM,mBAAmB,GAAG;IAChC,QAAQ,EAAE,MAAM,CAAC;IACjB,eAAe,EAAE,eAAe,CAAC;IACjC,aAAa,EAAE,MAAM,OAAO,CAAC,oBAAoB,CAAC,CAAC;IACnD,uBAAuB,CAAC,EAAE,MAAM,OAAO,CAAC,oBAAoB,CAAC,CAAC;IAC9D,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,cAAc,CAAC,EAAE,uBAAuB,CAAC;IACzC,MAAM,CAAC,EAAE,qBAAqB,CAAC;IAC/B,YAAY,CAAC,EAAE,YAAY,CAAC;IAC5B,qBAAqB,CAAC,EAAE,CACtB,kBAAkB,EAAE,wBAAwB,GAAG,MAAM,EACrD,IAAI,EAAE,MAAM,KACT,OAAO,CAAC,IAAI,CAAC,CAAC;CACpB,CAAC;AAEF,MAAM,MAAM,SAAS,GAAG,aAAa,GAAG,YAAY,GAAG,QAAQ,CAAC;AA+EhE,MAAM,MAAM,YAAY,GAAG;IACzB,QAAQ,EAAE,OAAO,CAAC;IAClB,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IACnB,MAAM,EAAE,OAAO,CAAC;IAChB,2CAA2C;IAC3C,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,wDAAwD;IACxD,gBAAgB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,4BAA4B;IAC5B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,uBAAuB;IACvB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,wCAAwC;IACxC,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;IAC7C,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAClC,CAAC;AAEF,wBAAsB,SAAS,CAC7B,IAAI,EAAE,mBAAmB,EACzB,UAAU,EAAE,MAAM,EAClB,MAAM,CAAC,EAAE,cAAc,GACtB,OAAO,CAAC,YAAY,CAAC,CAsCvB;AAED,MAAM,MAAM,WAAW,GACnB;IAAE,IAAI,EAAE,mBAAmB,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GAC1C;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GACrC;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAEvC,wBAAsB,QAAQ,CAC5B,IAAI,EAAE,mBAAmB,EACzB,UAAU,EAAE,MAAM,EAClB,OAAO,CAAC,EAAE;IAAE,MAAM,CAAC,EAAE,cAAc,CAAC;IAAC,cAAc,CAAC,EAAE,wBAAwB,GAAG,IAAI,CAAA;CAAE,GACtF,OAAO,CAAC,WAAW,CAAC,CAqDtB;AAED,MAAM,MAAM,YAAY,GAAG;IAAE,EAAE,EAAE,OAAO,CAAA;CAAE,CAAC;AAE3C,wBAAsB,SAAS,CAC7B,IAAI,EAAE,mBAAmB,EACzB,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,YAAY,CAAC,CAWvB;AAID,MAAM,MAAM,qBAAqB,GAAG;IAClC,SAAS,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAClG,UAAU,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACtE,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,OAAO,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,CAAC;AAEF,wBAAsB,kBAAkB,CACtC,IAAI,EAAE,mBAAmB,EACzB,UAAU,EAAE,MAAM,EAClB,IAAI,GAAE,MAAU,GACf,OAAO,CAAC,qBAAqB,CAAC,CA2EhC;AAED,MAAM,MAAM,cAAc,GAAG;IAC3B,IAAI,EAAE,KAAK,CAAC;QACV,UAAU,EAAE,MAAM,CAAC;QACnB,GAAG,EAAE,MAAM,CAAC;QACZ,KAAK,EAAE,MAAM,EAAE,CAAC;QAChB,SAAS,EAAE,MAAM,CAAC;QAClB,MAAM,EAAE,MAAM,CAAC;KAChB,CAAC,CAAC;IACH,oDAAoD;IACpD,iBAAiB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;CAC3D,CAAC;AAEF,wBAAsB,WAAW,CAAC,IAAI,EAAE,mBAAmB,GAAG,OAAO,CAAC,cAAc,CAAC,CAsBpF;AAED,MAAM,MAAM,YAAY,GAAG;IACzB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACnC,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACnC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACjC,CAAC;AAEF,wBAAsB,SAAS,CAAC,IAAI,EAAE,mBAAmB,GAAG,OAAO,CAAC,YAAY,CAAC,CA2ChF;AAED,MAAM,MAAM,WAAW,GACnB;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GACpC;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GACtD;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAEvC,wBAAsB,QAAQ,CAC5B,IAAI,EAAE,mBAAmB,EACzB,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE;IACN,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,SAAS,CAAC;IAChB,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,cAAc,CAAC,EAAE,wBAAwB,GAAG,IAAI,CAAC;IACjD,MAAM,CAAC,EAAE,cAAc,CAAC;CACzB,GACA,OAAO,CAAC,WAAW,CAAC,CAsHtB;AAED,MAAM,MAAM,gBAAgB,GAAG;IAAE,EAAE,EAAE,OAAO,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAEjF,wBAAsB,aAAa,CACjC,IAAI,EAAE,mBAAmB,EACzB,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAC3C,OAAO,CAAC,gBAAgB,CAAC,CAkC3B;AAED,MAAM,MAAM,kBAAkB,GAAG;IAAE,EAAE,EAAE,OAAO,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAEnF,wBAAsB,eAAe,CACnC,IAAI,EAAE,mBAAmB,EACzB,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE;IAAE,QAAQ,EAAE,MAAM,CAAA;CAAE,GAC3B,OAAO,CAAC,kBAAkB,CAAC,CAW7B"}

package/dist/src/actions/identity-actions.js

@@ -2,12 +2,14 @@
  * Shared identity actions: pure logic returning structured data.
  * Used by both commands (format to text) and tools (return jsonResult).
  */
+import { logDebug, logInfo, logWarn } from "../utils/logger.js";
+import { getOrRefreshTIPToken } from "../services/tip-with-refresh.js";
 import { fetchOIDCDiscovery, buildAuthorizationUrl, generateState, } from "../services/oidc-client.js";
 import { loadCredentialEnvBindings, loadAllCredentialEnvBindings, setCredentialEnvBinding, deleteCredentialEnvBinding, } from "../store/credential-env-bindings.js";
 import { loadCredentials, setCredential, getCredential, deleteCredentialsForSession, } from "../store/credential-store.js";
 import { getSession, deleteSession } from "../store/session-store.js";
 import { createState } from "../store/oidc-state-store.js";
-import { getTIPToken, setTIPToken, loadTIPTokens, saveTIPTokens } from "../store/tip-store.js";
+import { loadTIPTokens, saveTIPTokens } from "../store/tip-store.js";
 import { extractDelegationChainFromJwt } from "../utils/auth.js";
 import { resolveAgentId, } from "../utils/derive-session-key.js";
 function inferFlowFromProvider(info) {
@@ -49,46 +51,26 @@ async function pollOAuthAndNotify(params) {
             }
         }
         catch (err) {
-            logger?.debug?.(`[identity fetch] poll attempt failed: ${String(err)}`);
+            logDebug(logger, `fetch poll attempt failed: ${String(err)}`);
         }
     }
     const target = deliveryTarget ?? sessionKey;
     await sendCredentialMessage?.(target, `⚠️ Authorization timed out for \`${provider}\`. Run \`/identity fetch ${provider}\` again.`);
 }
 export async function runStatus(deps, sessionKey, config) {
-    const { storeDir, identityService, logger } = deps;
+    const { storeDir, identityService, getOidcConfigForRefresh, configWorkloadName, logger } = deps;
     const session = await getSession(storeDir, sessionKey);
-    let tip = await getTIPToken(storeDir, sessionKey);
-    if (session && identityService.parseUserToken(session.userToken).valid && !tip) {
-        try {
-            const agentId = resolveAgentId({ sessionKey, config: config });
-            const fresh = await identityService.getWorkloadAccessToken({
-                agentId,
-                userToken: session.userToken,
-                sub: session.sub,
-            });
-            await setTIPToken(storeDir, sessionKey, fresh);
-            tip = fresh;
-        }
-        catch (err) {
-            logger?.debug?.(`[identity status] TIP refresh failed: ${err.message}`);
+    const ctxAgentId = resolveAgentId({ sessionKey, config: config });
+    const tipRefreshOptions = getOidcConfigForRefresh
+        ? {
+            identityService,
+            getOidcConfigForRefresh,
+            configWorkloadName,
+            ctxAgentId,
+            logger,
         }
-    }
-    else if (session && tip && tip.expiresAt - Date.now() < 5 * 60 * 1000) {
-        try {
-            const agentId = resolveAgentId({ sessionKey, config: config });
-            const fresh = await identityService.getWorkloadAccessToken({
-                agentId,
-                userToken: session.userToken,
-                sub: session.sub,
-            });
-            await setTIPToken(storeDir, sessionKey, fresh);
-            tip = fresh;
-        }
-        catch (err) {
-            logger?.debug?.(`[identity status] TIP refresh failed: ${err.message}`);
-        }
-    }
+        : undefined;
+    const tip = await getOrRefreshTIPToken(storeDir, sessionKey, tipRefreshOptions);
     const credentials = await loadCredentials(storeDir, sessionKey);
     const bindings = await loadCredentialEnvBindings(storeDir, sessionKey);
     const tipChain = tip
@@ -117,22 +99,24 @@ export async function runLogin(deps, sessionKey, options) {
     const session = await getSession(storeDir, sessionKey);
     const hasValidCred = session && identityService.parseUserToken(session.userToken).valid;
     if (hasValidCred && session) {
-        try {
-            const agentId = resolveAgentId({ sessionKey, config: config });
-            const tip = await identityService.getWorkloadAccessToken({
-                agentId,
-                userToken: session.userToken,
-                sub: session.sub,
-            });
-            await setTIPToken(storeDir, sessionKey, tip);
+        const ctxAgentId = resolveAgentId({ sessionKey, config: config });
+        const tipRefreshOptions = deps.getOidcConfigForRefresh
+            ? {
+                identityService,
+                getOidcConfigForRefresh: deps.getOidcConfigForRefresh,
+                configWorkloadName: deps.configWorkloadName,
+                ctxAgentId,
+                logger,
+            }
+            : undefined;
+        const tip = await getOrRefreshTIPToken(storeDir, sessionKey, tipRefreshOptions);
+        if (tip) {
             return { kind: "already_logged_in", sub: session.sub };
         }
-        catch (err) {
-            return {
-                kind: "error",
-                message: `Session valid but TIP refresh failed: ${err.message}`,
-            };
-        }
+        return {
+            kind: "error",
+            message: "Session valid but TIP refresh failed. Ensure userToken is valid or refresh token is available.",
+        };
     }
     try {
         const oidcConfig = await getOidcConfig();
@@ -146,11 +130,11 @@ export async function runLogin(deps, sessionKey, options) {
             scope: oidcConfig.scope ?? "openid profile email",
             state,
         });
-        logger?.info?.(`[identity login] returning IdP URL for sessionKey=${sessionKey.slice(0, 24)}...`);
+        logInfo(logger, `login returning IdP URL for sessionKey=${sessionKey.slice(0, 24)}...`);
         return { kind: "auth_url", authUrl };
     }
     catch (err) {
-        logger?.warn?.(`[identity login] error: ${String(err)}`);
+        logWarn(logger, `login error: ${String(err)}`);
         return {
             kind: "error",
             message: `${err.message}. Ensure userpool is configured (discoveryUrl+clientId+callbackUrl or userPoolName+clientName+callbackUrl).`,
@@ -159,7 +143,7 @@ export async function runLogin(deps, sessionKey, options) {
 }
 export async function runLogout(deps, sessionKey) {
     const { storeDir, logger } = deps;
-    logger?.debug?.(`[identity logout] sessionKey=${sessionKey.slice(0, 24)}...`);
+    logDebug(logger, `logout sessionKey=${sessionKey.slice(0, 24)}...`);
     await deleteSession(storeDir, sessionKey);
     const tokens = await loadTIPTokens(storeDir);
     delete tokens[sessionKey];
@@ -184,7 +168,7 @@ export async function runListCredentials(deps, sessionKey, page = 1) {
             totalCount = result.TotalCount ?? 0;
         }
         catch (e) {
-            logger?.warn?.(`[identity list] API error: ${String(e)}`);
+            logWarn(logger, `list-credentials API error: ${String(e)}`);
         }
     }
     const providerNames = new Set(providers.map((p) => p.Name));
@@ -248,7 +232,7 @@ export async function runListTips(deps) {
         tips.push({
             sessionKey: key,
             sub: entry.sub,
-            chain: chain ? [chain.principalId, ...chain.actors] : [],
+            chain: chain ? [chain.principalId, ...chain.actors.slice().reverse()] : [],
             expiresAt: entry.expiresAt,
             ttlSec: Math.floor((entry.expiresAt - now) / 1000),
         });
@@ -287,7 +271,9 @@ export async function runConfig(deps) {
     }
     if (cfg.authz) {
         out.authz = {
-            enable: cfg.authz.enable,
+            toolCheck: cfg.authz.toolCheck,
+            skillReadCheck: cfg.authz.skillReadCheck,
+            requireRiskApproval: cfg.authz.requireRiskApproval,
             namespaceName: cfg.authz.namespaceName,
         };
     }
@@ -316,7 +302,17 @@ export async function runFetch(deps, sessionKey, params) {
             // keep default
         }
     }
-    const tip = await getTIPToken(storeDir, sessionKey);
+    const ctxAgentId = resolveAgentId({ sessionKey, config: config });
+    const tipRefreshOptions = deps.getOidcConfigForRefresh
+        ? {
+            identityService: deps.identityService,
+            getOidcConfigForRefresh: deps.getOidcConfigForRefresh,
+            configWorkloadName: deps.configWorkloadName,
+            ctxAgentId,
+            logger: deps.logger,
+        }
+        : undefined;
+    const tip = await getOrRefreshTIPToken(storeDir, sessionKey, tipRefreshOptions);
     if (!tip) {
         return {
             kind: "error",
@@ -354,7 +350,7 @@ export async function runFetch(deps, sessionKey, params) {
             return { kind: "success", message: `✓ Credential for \`${provider}\` added (direct token).` };
         }
         if (oauthResult.authorizationUrl) {
-            logger?.info?.(`[identity fetch] returning auth URL for provider=${provider}, starting poll`);
+            logInfo(logger, `fetch returning auth URL for provider=${provider}, starting poll`);
             const target = deliveryTarget ?? sessionKey;
             pollOAuthAndNotify({
                 identityClient,
@@ -369,7 +365,7 @@ export async function runFetch(deps, sessionKey, params) {
                 sendCredentialMessage,
                 logger,
             }).catch((err) => {
-                logger?.warn?.(`[identity fetch] poll error: ${String(err)}`);
+                logWarn(logger, `fetch poll error: ${String(err)}`);
                 void sendCredentialMessage?.(target, `⚠️ Credential fetch failed: ${err.message}`).catch(() => { });
             });
             return {
@@ -384,7 +380,7 @@ export async function runFetch(deps, sessionKey, params) {
         };
     }
     catch (err) {
-        logger?.warn?.(`[identity fetch] error: ${String(err)}`);
+        logWarn(logger, `fetch error: ${String(err)}`);
         return {
             kind: "error",
             message: `Credential setup failed: ${err.message}`,

package/dist/src/commands/identity-commands.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"identity-commands.d.ts","sourceRoot":"","sources":["../../../src/commands/identity-commands.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AACxD,OAAO,EAUL,KAAK,mBAAmB,EACxB,KAAK,oBAAoB,EACzB,KAAK,SAAS,EACf,MAAM,gCAAgC,CAAC;AAUxC,YAAY,EAAE,oBAAoB,EAAE,SAAS,EAAE,CAAC;AAEhD,MAAM,MAAM,sBAAsB,GAAG;IACnC,IAAI,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;IAC7B,IAAI,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;IAC7B,KAAK,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;CAC/B,CAAC;AAEF,MAAM,MAAM,oBAAoB,GAAG,mBAAmB,CAAC;AAioBvD,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,oBAAoB;;;;;mBA9e3C,oBAAoB,KAAG,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;EAufpE;AAED,0CAA0C;AAC1C,wBAAgB,eAAe,CAAC,IAAI,EAAE,oBAAoB;;;;;mBA1frC,oBAAoB,KAAG,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;EAmgBpE"}
+{"version":3,"file":"identity-commands.d.ts","sourceRoot":"","sources":["../../../src/commands/identity-commands.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AACxD,OAAO,EAUL,KAAK,mBAAmB,EACxB,KAAK,oBAAoB,EACzB,KAAK,SAAS,EACf,MAAM,gCAAgC,CAAC;AAWxC,YAAY,EAAE,oBAAoB,EAAE,SAAS,EAAE,CAAC;AAEhD,MAAM,MAAM,sBAAsB,GAAG;IACnC,IAAI,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;IAC7B,IAAI,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;IAC7B,KAAK,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;CAC/B,CAAC;AAEF,MAAM,MAAM,oBAAoB,GAAG,mBAAmB,CAAC;AAioBvD,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,oBAAoB;;;;;mBA9e3C,oBAAoB,KAAG,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;EAufpE;AAED,0CAA0C;AAC1C,wBAAgB,eAAe,CAAC,IAAI,EAAE,oBAAoB;;;;;mBA1frC,oBAAoB,KAAG,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;EAmgBpE"}

package/dist/src/commands/identity-commands.js

@@ -4,6 +4,7 @@
  */
 import { runStatus, runLogin, runLogout, runListCredentials, runListTips, runConfig, runFetch, runSetBinding, runUnsetBinding, } from "../actions/identity-actions.js";
 import { deriveSessionKey, deriveDeliveryTargetFromContext, } from "../utils/derive-session-key.js";
+import { logDebug } from "../utils/logger.js";
 import { diagnoseRisk } from "../risk/diagnose-risk.js";
 import { getRiskPatterns } from "../risk/classify-risk.js";
 import * as toolApprovalStore from "../store/tool-approval-store.js";
@@ -142,7 +143,7 @@ function createIdentityHandler(deps) {
     const { logger } = deps;
     return async (ctx) => {
         const { sub, rest } = parseSubcommand(ctx.args);
-        logger?.debug?.(`[identity] sub=${sub} rest=${rest.slice(0, 40)}...`);
+        logDebug(logger, `command sub=${sub} rest=${rest.slice(0, 40)}...`);
         const sessionKey = deriveSessionKey({
             channel: ctx.channel,
             senderId: ctx.senderId,

package/dist/src/hooks/before-agent-start.d.ts

@@ -2,8 +2,7 @@
  * before_agent_start hook: fetch TIP token for main agent only.
  * 1. Inject credentials into process.env per credential-env-bindings
  * 2. Subagent: skip (TIP comes from sessions_send propagation)
- * 3. Main: lookup session (userToken), call getWorkloadAccessToken, store TIP
- * 4. On token expired: refresh userToken via refresh_token grant, retry
+ * 3. Main: getOrRefreshTIPToken (fetches TIP, refreshes userToken if expired)
  */
 import type { IdentityService } from "../services/identity-service.js";
 import type { OIDCConfigForRefresh } from "../services/session-refresh.js";

package/dist/src/hooks/before-agent-start.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"before-agent-start.d.ts","sourceRoot":"","sources":["../../../src/hooks/before-agent-start.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,iCAAiC,CAAC;AACvE,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,gCAAgC,CAAC;AAS3E,MAAM,MAAM,oBAAoB,GAAG;IACjC,QAAQ,EAAE,MAAM,CAAC;IACjB,eAAe,EAAE,eAAe,CAAC;IACjC,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,uBAAuB,CAAC,EAAE,MAAM,OAAO,CAAC,oBAAoB,CAAC,CAAC;IAC9D,MAAM,EAAE;QAAE,IAAI,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;QAAC,IAAI,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAA;KAAE,CAAC;CACxE,CAAC;AAOF,wBAAgB,6BAA6B,CAAC,IAAI,EAAE,oBAAoB,IAIpE,QAAQ;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,OAAO,EAAE,CAAA;CAAE,EAChD,KAAK;IAAE,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAA;CAAE,KAC7C,OAAO,CAAC;IAAE,cAAc,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAAC,CAgE/C"}
+{"version":3,"file":"before-agent-start.d.ts","sourceRoot":"","sources":["../../../src/hooks/before-agent-start.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,iCAAiC,CAAC;AACvE,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,gCAAgC,CAAC;AAO3E,MAAM,MAAM,oBAAoB,GAAG;IACjC,QAAQ,EAAE,MAAM,CAAC;IACjB,eAAe,EAAE,eAAe,CAAC;IACjC,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,uBAAuB,CAAC,EAAE,MAAM,OAAO,CAAC,oBAAoB,CAAC,CAAC;IAC9D,MAAM,EAAE;QAAE,IAAI,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;QAAC,IAAI,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAA;KAAE,CAAC;CACxE,CAAC;AAEF,wBAAgB,6BAA6B,CAAC,IAAI,EAAE,oBAAoB,IAcpE,QAAQ;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,OAAO,EAAE,CAAA;CAAE,EAChD,KAAK;IAAE,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAA;CAAE,KAC7C,OAAO,CAAC;IAAE,cAAc,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAAC,CA2B/C"}

package/dist/src/hooks/before-agent-start.js

@@ -2,22 +2,23 @@
  * before_agent_start hook: fetch TIP token for main agent only.
  * 1. Inject credentials into process.env per credential-env-bindings
  * 2. Subagent: skip (TIP comes from sessions_send propagation)
- * 3. Main: lookup session (userToken), call getWorkloadAccessToken, store TIP
- * 4. On token expired: refresh userToken via refresh_token grant, retry
+ * 3. Main: getOrRefreshTIPToken (fetches TIP, refreshes userToken if expired)
  */
-import { refreshSessionUserToken } from "../services/session-refresh.js";
+import { getOrRefreshTIPToken } from "../services/tip-with-refresh.js";
+import { logWarn } from "../utils/logger.js";
 import { loadCredentialEnvBindings } from "../store/credential-env-bindings.js";
 import { getCredential, resolveCredentialValue } from "../store/credential-store.js";
-import { getSession } from "../store/session-store.js";
-import { getTIPToken } from "../store/tip-store.js";
-import { fetchAndStoreTIP } from "../services/tip-acquisition.js";
 import { isSubagentSessionKey } from "../utils/derive-session-key.js";
-function isTokenExpiredError(err) {
-    const msg = err instanceof Error ? err.message : String(err);
-    return /token has expired|Invalid token/i.test(msg);
-}
 export function createBeforeAgentStartHandler(deps) {
     const { storeDir, identityService, configWorkloadName, getOidcConfigForRefresh, logger } = deps;
+    const tipRefreshOptions = getOidcConfigForRefresh
+        ? {
+            identityService,
+            getOidcConfigForRefresh,
+            configWorkloadName,
+            logger,
+        }
+        : undefined;
     return async (_event, ctx) => {
         const sessionKey = ctx.sessionKey;
         if (!sessionKey)
@@ -39,46 +40,14 @@ export function createBeforeAgentStartHandler(deps) {
             /* best-effort */
         }
         try {
-            const cached = await getTIPToken(storeDir, sessionKey);
-            if (cached)
-                return;
-            let session = await getSession(storeDir, sessionKey);
-            if (!session)
+            const tip = await getOrRefreshTIPToken(storeDir, sessionKey, tipRefreshOptions
+                ? { ...tipRefreshOptions, ctxAgentId: ctx.agentId }
+                : undefined);
+            if (!tip)
                 return;
-            try {
-                await fetchAndStoreTIP({
-                    storeDir,
-                    sessionKey,
-                    identityService,
-                    jwtForExchange: session.userToken,
-                    sub: session.sub,
-                    ctxAgentId: ctx.agentId,
-                    configWorkloadName,
-                });
-                logger.info?.(`agent-identity: TIP acquired for ${sessionKey.slice(0, 24)}...`);
-            }
-            catch (err) {
-                if (!isTokenExpiredError(err) || !getOidcConfigForRefresh || !session.refreshToken) {
-                    throw err;
-                }
-                const refreshed = await refreshSessionUserToken(storeDir, sessionKey, getOidcConfigForRefresh);
-                if (!refreshed)
-                    throw err;
-                session = (await getSession(storeDir, sessionKey)) ?? session;
-                await fetchAndStoreTIP({
-                    storeDir,
-                    sessionKey,
-                    identityService,
-                    jwtForExchange: refreshed,
-                    sub: session.sub,
-                    ctxAgentId: ctx.agentId,
-                    configWorkloadName,
-                });
-                logger.info?.(`agent-identity: TIP acquired after refresh for ${sessionKey.slice(0, 24)}...`);
-            }
         }
         catch (err) {
-            logger.warn?.(`agent-identity: failed to get TIP for ${sessionKey}: ${String(err)}`);
+            logWarn(logger, `failed to get TIP for ${sessionKey}: ${String(err)}`);
         }
     };
 }

package/dist/src/hooks/before-tool-call.d.ts

@@ -7,6 +7,8 @@
  * @see https://github.com/volcengine/veadk-python/blob/main/veadk/tools/builtin_tools/agent_authorization.py
  */
 import type { IdentityClientInterface } from "../services/identity-client.js";
+import type { IdentityService } from "../services/identity-service.js";
+import type { OIDCConfigForRefresh } from "../services/session-refresh.js";
 import type { PluginConfig } from "../types.js";
 export type BeforeToolCallDeps = {
     storeDir: string;
@@ -20,9 +22,13 @@ export type BeforeToolCallDeps = {
     };
     /** Send message to session (Channel only). For sync approval flow. */
     sendToSession?: (targetOrSessionKey: string, text: string) => Promise<void>;
-    /** Authz config for low-risk bypass and risk approval. */
+    /** Authz config. */
     authz?: PluginConfig["authz"];
     approvalTtlMs: number;
+    /** When set, attempt TIP refresh when expired (uses session refresh_token). */
+    identityService?: IdentityService;
+    getOidcConfigForRefresh?: () => Promise<OIDCConfigForRefresh>;
+    configWorkloadName?: string;
 };
 export declare function createBeforeToolCallHandler(deps: BeforeToolCallDeps): (event: {
     toolName: string;

package/dist/src/hooks/before-tool-call.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"before-tool-call.d.ts","sourceRoot":"","sources":["../../../src/hooks/before-tool-call.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,gCAAgC,CAAC;AAC9E,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAQhD,MAAM,MAAM,kBAAkB,GAAG;IAC/B,QAAQ,EAAE,MAAM,CAAC;IACjB,uGAAuG;IACvG,cAAc,CAAC,EAAE,uBAAuB,CAAC;IACzC,kFAAkF;IAClF,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,MAAM,EAAE;QAAE,KAAK,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;QAAC,IAAI,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAA;KAAE,CAAC;IACxE,sEAAsE;IACtE,aAAa,CAAC,EAAE,CAAC,kBAAkB,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5E,0DAA0D;IAC1D,KAAK,CAAC,EAAE,YAAY,CAAC,OAAO,CAAC,CAAC;IAC9B,aAAa,EAAE,MAAM,CAAC;CACvB,CAAC;AAoBF,wBAAgB,2BAA2B,CAAC,IAAI,EAAE,kBAAkB,IAgBhE,OAAO;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAAE,EAC5D,KAAK;IAAE,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,KAC/D,OAAO,CAAC;IAAE,KAAK,CAAC,EAAE,OAAO,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAAC,CA4I7D"}
+{"version":3,"file":"before-tool-call.d.ts","sourceRoot":"","sources":["../../../src/hooks/before-tool-call.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,gCAAgC,CAAC;AAC9E,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,iCAAiC,CAAC;AACvE,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,gCAAgC,CAAC;AAC3E,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAUhD,MAAM,MAAM,kBAAkB,GAAG;IAC/B,QAAQ,EAAE,MAAM,CAAC;IACjB,uGAAuG;IACvG,cAAc,CAAC,EAAE,uBAAuB,CAAC;IACzC,kFAAkF;IAClF,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,MAAM,EAAE;QAAE,KAAK,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;QAAC,IAAI,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAA;KAAE,CAAC;IACxE,sEAAsE;IACtE,aAAa,CAAC,EAAE,CAAC,kBAAkB,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5E,oBAAoB;IACpB,KAAK,CAAC,EAAE,YAAY,CAAC,OAAO,CAAC,CAAC;IAC9B,aAAa,EAAE,MAAM,CAAC;IACtB,+EAA+E;IAC/E,eAAe,CAAC,EAAE,eAAe,CAAC;IAClC,uBAAuB,CAAC,EAAE,MAAM,OAAO,CAAC,oBAAoB,CAAC,CAAC;IAC9D,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC7B,CAAC;AAwCF,wBAAgB,2BAA2B,CAAC,IAAI,EAAE,kBAAkB,IA6BhE,OAAO;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAAE,EAC5D,KAAK;IAAE,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,KAC/D,OAAO,CAAC;IAAE,KAAK,CAAC,EAAE,OAAO,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAAC,CAyK7D"}