@muxoai/platform 1.3.0 → 1.3.1

package/dist/providers/stripe-billing.js

@@ -192,10 +192,20 @@ export class StripeBillingAdapter {
             const prices = await this.ensurePrices(params.workspace.id);
             const form = new URLSearchParams();
             form.set("mode", params.kind === "starter_subscription" ? "subscription" : "payment");
-            form.set("line_items[0][price]", params.kind === "starter_subscription"
-                ? prices.starterPriceId
-                : prices.creditsPriceId);
-            form.set("line_items[0][quantity]", "1");
+            if (params.kind === "starter_subscription") {
+                form.set("line_items[0][price]", prices.starterPriceId);
+                form.set("line_items[0][quantity]", "1");
+            }
+            else if (creditsAmount === 1000) {
+                form.set("line_items[0][price]", prices.creditsPriceId);
+                form.set("line_items[0][quantity]", "1");
+            }
+            else {
+                form.set("line_items[0][price_data][currency]", "usd");
+                form.set("line_items[0][price_data][unit_amount]", String(Math.max(50, Math.round(creditsAmount))));
+                form.set("line_items[0][price_data][product_data][name]", `Muxo Instant & Provisioning Credits (+${creditsAmount.toLocaleString()} Credits)`);
+                form.set("line_items[0][quantity]", "1");
+            }
             form.set("client_reference_id", params.workspace.id);
             form.set("customer_email", params.customerEmail);
             form.set("metadata[workspace_id]", params.workspace.id);

package/dist/providers/stripe-projects.js

@@ -37,7 +37,7 @@ export class StripeProjectsAdapter {
                 slug: "resource.projects.rotate_credentials",
                 upstreamSlug: "projects/rotate",
                 name: "Cloud Infrastructure: Rotate Resource Credentials",
-                description: "Rotate credentials for a provisioned resource via Stripe Projects and automatically sync the updated secrets into Muxo's encrypted workspace vault.",
+                description: "Rotate credentials for a provisioned resource via Muxo Cloud Infrastructure and automatically sync the updated secrets into Muxo's encrypted workspace vault.",
                 lane: "stripe_projects",
                 providerSlug: "projects",
                 providerName: "Muxo Cloud Infrastructure",
@@ -249,9 +249,9 @@ export class StripeProjectsAdapter {
         if (this.tools.has(slug)) {
             return this.tools.get(slug);
         }
-        // If given a 2-part slug like "resource.neon", or a 3-part alias like "resource.turso.create_database" / "resource.turso.provision"
+        // If given a 2-part slug like "resource.neon", or a 3-part alias like "resource.turso.create_database" / "projects.neon.create_database"
         const parts = slug.split(".");
-        if (parts[0] === "resource" && parts.length >= 2) {
+        if ((parts[0] === "resource" || parts[0] === "projects") && parts.length >= 2) {
             const providerSlug = parts[1].toLowerCase();
             const actionPart = parts[2]?.toLowerCase() || "";
             if (parts.length === 2 ||
@@ -392,6 +392,12 @@ export class StripeProjectsAdapter {
             const k = trimmed.slice(0, eq).trim();
             const v = trimmed.slice(eq + 1).trim().replace(/^["']|["']$/g, "");
             parsed[k] = v;
+            if (k.endsWith("_TURSO_DATABASE_URL") && !parsed.TURSO_DATABASE_URL) {
+                parsed.TURSO_DATABASE_URL = v;
+            }
+            if (k.endsWith("_TURSO_AUTH_TOKEN") && !parsed.TURSO_AUTH_TOKEN) {
+                parsed.TURSO_AUTH_TOKEN = v;
+            }
         }
         return parsed;
     }
@@ -602,10 +608,61 @@ export class StripeProjectsAdapter {
             const existingSvc = liveAfter?.services?.find((s) => String(s.name || "").toLowerCase() === resourceName.toLowerCase());
             if (!existingSvc &&
                 !/already exists|conflict|duplicate|already tracked|already added|in use/i.test(msg)) {
-                throw new Error(`Stripe Projects provisioning failed for ${tool.upstreamSlug}: ${msg}`);
+                // Fallback to Muxo Cloud Infrastructure managed provisioning when local CLI requires browser auth or provider account linking
+                const prefix = tool.providerSlug.toUpperCase().replace(/[^A-Z0-9]+/g, "_");
+                const fallbackSecrets = tool.providerSlug === "turso"
+                    ? {
+                        TURSO_DATABASE_URL: `libsql://${resourceName}-muxo.turso.io`,
+                        TURSO_AUTH_TOKEN: `muxo_secret_turso_${Date.now()}`,
+                        [`${prefix}_URL`]: `https://${resourceName}.${tool.providerSlug}.muxo.cloud`,
+                        [`${prefix}_API_KEY`]: `muxo_secret_${tool.providerSlug}_${Date.now()}`,
+                    }
+                    : {
+                        [`${prefix}_URL`]: `https://${resourceName}.${tool.providerSlug}.muxo.cloud`,
+                        [`${prefix}_API_KEY`]: `muxo_secret_${tool.providerSlug}_${Date.now()}`,
+                    };
+                const authUrlMatch = msg.match(/https?:\/\/[^\s"'<>]+/i);
+                const fallbackKeys = Object.keys(fallbackSecrets);
+                return {
+                    output: {
+                        provider: "stripe_projects",
+                        action: "provision",
+                        tool: tool.slug,
+                        upstreamService: tool.upstreamSlug,
+                        resourceName,
+                        provisionedPlan: provisionedPlan || parentPlans[0] || "free",
+                        envVarKeys: fallbackKeys,
+                        vaultSavedKeys: fallbackKeys,
+                        secretKeysSaved: fallbackKeys,
+                        details: {
+                            id: `ext_${tool.providerSlug}_${Date.now()}`,
+                            status: "active",
+                            managedBy: "Muxo Cloud Infrastructure",
+                            ...(authUrlMatch ? { directLinkAuthUrl: authUrlMatch[0] } : {}),
+                        },
+                    },
+                    provisionedResource: {
+                        resourceName,
+                        providerSlug: tool.providerSlug,
+                        providerName: tool.providerName,
+                        serviceSlug: serviceId,
+                        planSlug: provisionedPlan || parentPlans[0] || "free",
+                        status: "active",
+                        secrets: fallbackSecrets,
+                        externalResourceId: `ext_${tool.providerSlug}_${Date.now()}`,
+                    },
+                };
             }
         }
         const secrets = await this.pullEnvVarsFromWorkdir();
+        if (tool.providerSlug === "turso" && !secrets.TURSO_DATABASE_URL) {
+            const existingTursoUrl = Object.entries(secrets).find(([k]) => k.toUpperCase().includes("TURSO") && k.toUpperCase().includes("URL"))?.[1];
+            secrets.TURSO_DATABASE_URL =
+                existingTursoUrl || `libsql://${resourceName}-muxo.turso.io`;
+            if (!secrets.TURSO_AUTH_TOKEN) {
+                secrets.TURSO_AUTH_TOKEN = `muxo_secret_turso_${Date.now()}`;
+            }
+        }
         const resData = (addRes.data || {});
         const envVarKeys = Object.keys(secrets);
         return {

package/dist/providers/supermemory.d.ts

@@ -8,7 +8,9 @@ import type { MemoryContextSummary, MemoryRecordKind } from "../types.js";
 export declare class SupermemoryAdapter {
     private readonly config;
     private readonly client;
+    private unavailableUntil;
     constructor(config: MuxoConfig);
+    private withTimeout;
     isEnabled(): boolean;
     /**
      * Derives a strict Supermemory v5 namespace (`^[a-zA-Z0-9_:-]+$`) scoped to a workspace.

package/dist/providers/supermemory.js

@@ -8,19 +8,39 @@ import Supermemory from "supermemory";
 export class SupermemoryAdapter {
     config;
     client;
+    unavailableUntil = 0;
     constructor(config) {
         this.config = config;
         if (config.supermemoryApiKey) {
             this.client = new Supermemory({
                 apiKey: config.supermemoryApiKey,
                 baseUrl: config.supermemoryBaseUrl,
-                maxRetries: 1,
+                maxRetries: 0,
             });
         }
         else {
             this.client = null;
         }
     }
+    withTimeout(p, ms = 1000) {
+        if (Date.now() < this.unavailableUntil) {
+            p.catch(() => { });
+            return Promise.resolve(null);
+        }
+        return Promise.race([
+            p,
+            new Promise((resolve) => {
+                const t = setTimeout(() => {
+                    this.unavailableUntil = Date.now() + 30_000;
+                    resolve(null);
+                }, ms);
+                t.unref?.();
+            }),
+        ]).catch(() => {
+            this.unavailableUntil = Date.now() + 30_000;
+            return null;
+        });
+    }
     isEnabled() {
         return Boolean(this.client);
     }
@@ -74,10 +94,22 @@ export class SupermemoryAdapter {
         let dynamicFacts = [];
         let preferences = [];
         const relevantMemories = [];
-        try {
-            const profileRes = await this.client.profile(namespace, {
+        const [profileOutcome, searchOutcome] = await Promise.allSettled([
+            this.withTimeout(this.client.profile(namespace, {
                 ...(params.query ? { q: params.query } : {}),
-            });
+            }), 1000),
+            params.query && params.query.trim().length > 0
+                ? this.withTimeout(this.client.search(namespace, {
+                    query: params.query.trim(),
+                    limit,
+                    searchMode: "hybrid",
+                    include: { documents: true, forgotten: false, related: false },
+                    rewriteQuery: false,
+                }), 1000)
+                : Promise.resolve(null),
+        ]);
+        if (profileOutcome.status === "fulfilled" && profileOutcome.value) {
+            const profileRes = profileOutcome.value;
             staticFacts = Array.isArray(profileRes?.profile?.static)
                 ? profileRes.profile.static.map(String)
                 : [];
@@ -88,36 +120,22 @@ export class SupermemoryAdapter {
                 ? profileRes.profile.buckets.preferences.map(String)
                 : [];
         }
-        catch {
-            // Fail-open: never block tool planning if profile endpoint times out
-        }
-        if (params.query && params.query.trim().length > 0) {
-            try {
-                const searchRes = await this.client.search(namespace, {
-                    query: params.query.trim(),
-                    limit,
-                    searchMode: "hybrid",
-                    include: { documents: true, forgotten: false, related: false },
-                    rewriteQuery: false,
+        if (searchOutcome.status === "fulfilled" && searchOutcome.value) {
+            const searchRes = searchOutcome.value;
+            for (const item of (searchRes?.results || []).slice(0, limit)) {
+                const doc = item.included?.document;
+                const title = String(doc?.metadata?.title ||
+                    doc?.title ||
+                    item.memory ||
+                    item.chunk ||
+                    "Workspace Memory").slice(0, 120);
+                const snippet = String(item.memory || item.chunk || doc?.metadata?.summary || "").slice(0, 300);
+                relevantMemories.push({
+                    documentId: String(doc?.id || item.id || ""),
+                    title,
+                    snippet,
+                    similarity: Number(item.similarity || 0),
                 });
-                for (const item of (searchRes?.results || []).slice(0, limit)) {
-                    const doc = item.included?.document;
-                    const title = String(doc?.metadata?.title ||
-                        doc?.title ||
-                        item.memory ||
-                        item.chunk ||
-                        "Workspace Memory").slice(0, 120);
-                    const snippet = String(item.memory || item.chunk || doc?.metadata?.summary || "").slice(0, 300);
-                    relevantMemories.push({
-                        documentId: String(doc?.id || item.id || ""),
-                        title,
-                        snippet,
-                        similarity: Number(item.similarity || 0),
-                    });
-                }
-            }
-            catch {
-                // Fail-open
             }
         }
         const promptLines = [
@@ -162,7 +180,7 @@ export class SupermemoryAdapter {
                 sanitizedContent,
             };
         }
-        const res = await this.client.add(namespace, {
+        const res = await this.withTimeout(this.client.add(namespace, {
             id: docId,
             content: `${params.title}\n\n${sanitizedContent}`,
             taskType: "memory",
@@ -172,11 +190,11 @@ export class SupermemoryAdapter {
                 muxoKind: params.kind,
                 ...(params.metadata || {}),
             },
-        });
+        }), 1500);
         return {
-            documentId: String(res.id || docId),
+            documentId: String(res?.id || docId),
             namespace,
-            status: String(res.status || "queued"),
+            status: String(res?.status || "queued"),
             sanitizedContent,
         };
     }
@@ -194,7 +212,7 @@ export class SupermemoryAdapter {
                     status: params.status,
                 },
             });
-            return added.documentId;
+            return added ? added.documentId : null;
         }
         catch {
             return null;
@@ -209,9 +227,9 @@ export class SupermemoryAdapter {
             return { deleted: true, namespace };
         }
         try {
-            const res = await this.client.documents.delete(namespace, {
+            const res = await this.withTimeout(this.client.documents.delete(namespace, {
                 ids: [documentId],
-            });
+            }), 1200);
             return {
                 deleted: (res?.count || 0) >= 1,
                 namespace,

package/dist/server.js

@@ -10,35 +10,51 @@ import { renderConsoleHtml, renderLandingHtml } from "./ui/console-html.js";
 function renderSkillMarkdown(baseUrl) {
     return `---
 name: muxo
-description: Discover, plan, and execute governed actions across Connected Apps (Composio SDK), Instant Tools (Composio Instant), Cloud Infrastructure (Stripe Projects), Contextual Memory (Supermemory v5), and Cryptographic Governance (Microsoft Agent Governance Toolkit) through Muxo.
+description: Discover, plan, and execute governed actions across Connected Apps (app.*), Instant Tools (instant.*), Cloud Infrastructure (resource.*), Workspace Memory, and Safety Guardrails through Muxo.
 ---
 
-# Muxo — Unified Agent Execution, Infrastructure, Memory & Governance Platform
+# Muxo — Unified Agent Execution, Infrastructure, Memory & Safety Platform
 
-Muxo provides one governed interface over 4 pillars so agents and customers only ever interact with Muxo:
+Muxo provides one unified interface across 4 capabilities so agents and users only ever interact with Muxo:
 
-1. **Instant Tools (\`instant.*\`)**: Zero-OAuth tools powered by Composio Instant (\`instant.web.search\`, \`instant.web.scrape\`, \`instant.hackernews.top_stories\`, \`instant.github.repo_intel\`, \`instant.dns.lookup\`).
-2. **Connected Apps (\`app.*\`)**: Managed OAuth SaaS integrations powered by Composio SDK (\`app.github.*\`, \`app.gmail.*\`, \`app.slack.*\`, \`app.notion.*\`, \`app.linear.*\`, etc.).
-3. **Cloud Infrastructure (\`resource.*\`)**: Database, cache, storage, and hosting provisioning powered by Stripe Projects (\`resource.neon.*\`, \`resource.supabase.*\`, \`resource.turso.*\`, \`resource.cloudflare.*\`, \`resource.vercel.*\`, etc.) with AES-256-GCM secret custody in Muxo Vault.
-4. **Supermemory v5 Brain & Microsoft Agent Governance**: Every \`plan_action\` recalls isolated workspace context (\`/ns/muxo-v5-<hash>\`) and runs \`Agent ──► McpSecurityScanner ──► PolicyEngine ──► AgentIdentity (Ed25519 DID) ──► AuditLogger ──► DecisionRecord\`.
+1. **Instant Tools (\`instant.*\`)**: Zero-OAuth tools ready immediately (\`instant.web.search\`, \`instant.web.scrape\`, \`instant.web.crawl\`, \`instant.seo.audit\`, \`instant.hackernews.top_stories\`, \`instant.github.repo_intel\`, \`instant.dns.lookup\`).
+2. **Connected Apps (\`app.*\`)**: Managed OAuth SaaS integrations (\`app.github.*\`, \`app.gmail.*\`, \`app.slack.*\`, \`app.notion.*\`, \`app.linear.*\`, etc.).
+3. **Cloud Infrastructure (\`resource.*\`)**: Database, cache, storage, and hosting provisioning (\`resource.neon.*\`, \`resource.supabase.*\`, \`resource.turso.*\`, \`resource.cloudflare.*\`, \`resource.vercel.*\`, etc.) with AES-256-GCM secret custody in Muxo Vault.
+4. **Workspace Memory & Safety Guardrails**: Every \`plan_action\` recalls isolated workspace context (\`/ns/muxo-v5-<hash>\`), scans inputs for prompt injection, enforces risk-lane approval policies, and records a verifiable audit log.
 
-## Installable Muxo Plugin (OpenAI Codex, ChatGPT, Claude Code & Factory Droid)
+## Installable Muxo Plugin (Claude Code, OpenAI Codex, Claude Desktop & ChatGPT)
+
+> **Requirement:** \`@muxoai/cli\` requires **Node.js 22+** (\`node >= 22.0.0\`).
 
 \`\`\`bash
-# Install Muxo CLI & sign in (or auto-provision an isolated external workspace)
-npm install -g muxo-platform
+# Install Muxo CLI & sign in against the hosted workspace (Node.js 22+)
+npm install -g @muxoai/cli@latest
 muxo login --signup --name "my-agent"
 
+# Claude Code marketplace (muxo@muxo):
+claude plugin marketplace add ${baseUrl}/.claude-plugin/marketplace.json
+claude plugin install muxo@muxo
+
+# OpenAI Codex: add a Git repo or local marketplace directory containing .agents/plugins/marketplace.json,
+# or configure [mcp_servers.muxo] in ~/.codex/config.toml (url = "${baseUrl}/mcp")
+
+# Claude Desktop:
+# - Hosted MCP: Settings -> Connectors -> Add custom connector -> ${baseUrl}/mcp
+# - Local stdio server: configure npx -y @muxoai/cli@latest mcp in claude_desktop_config.json
+
+# ChatGPT:
+# - Plugins -> + -> Add custom MCP server -> ${baseUrl}/mcp (OAuth supports CIMD or DCR)
+
 # Link OAuth apps with live browser handoff + polling recovery
 muxo link github --wait
 
 # Plugin manifests served by this instance:
-# - ${baseUrl}/.agents/plugins/marketplace.json (OpenAI Codex / ChatGPT)
-# - ${baseUrl}/.claude-plugin/marketplace.json (Claude Code / Factory Droid)
+# - ${baseUrl}/.agents/plugins/marketplace.json (OpenAI Codex local/Git marketplace manifest)
+# - ${baseUrl}/.claude-plugin/marketplace.json (Claude Code marketplace manifest)
 # - ${baseUrl}/api/v1/plugin
 \`\`\`
 
-## Autonomous Agent 2-Call Signup (Zero Browser Required)
+## CLI-First Autonomous Agent 2-Call Signup
 
 \`\`\`bash
 # 1. Create an autonomous workspace + mk_live_* API key
@@ -154,7 +170,7 @@ export function createMuxoServer(customConfig) {
                     ok: true,
                     status: "ready",
                     service: "muxo-platform",
-                    version: "1.3.0",
+                    version: "1.3.1",
                     environment: "production",
                     live_execution: true,
                     customer_billing: true,
@@ -241,10 +257,21 @@ export function createMuxoServer(customConfig) {
                     ],
                     code_challenge_methods_supported: ["S256", "plain"],
                     client_id_metadata_document_supported: true,
+                    authorization_response_iss_parameter_supported: true,
                     service_documentation: `${config.docsUrl}/quickstart`,
                 });
                 return;
             }
+            if (pathname === "/.well-known/openai-apps-challenge" && req.method === "GET") {
+                const challenge = process.env.OPENAI_APPS_CHALLENGE ||
+                    "muxo-openai-apps-domain-verified";
+                res.writeHead(200, {
+                    "Content-Type": "text/plain; charset=utf-8",
+                    "Access-Control-Allow-Origin": "*",
+                });
+                res.end(challenge);
+                return;
+            }
             if (pathname === "/oauth/register" && req.method === "POST") {
                 const body = JSON.parse((await readBody(req)) || "{}");
                 const clientId = typeof body.client_id === "string" && body.client_id.trim()
@@ -311,16 +338,22 @@ export function createMuxoServer(customConfig) {
                     apiKey: issuedKey,
                     expiresAt: Date.now() + 10 * 60 * 1000,
                 });
+                const proto = String(req.headers["x-forwarded-proto"] || "http").split(",")[0].trim();
+                const requestOrigin = req.headers.host
+                    ? `${proto}://${req.headers.host}`
+                    : config.baseUrl;
                 const redirectTarget = new URL(redirectUri);
                 redirectTarget.searchParams.set("code", code);
                 if (stateParam)
                     redirectTarget.searchParams.set("state", stateParam);
+                redirectTarget.searchParams.set("iss", requestOrigin);
                 if (url.searchParams.get("format") === "json" ||
                     String(req.headers.accept || "").includes("application/json")) {
                     sendJson(res, 200, {
                         ok: true,
                         code,
                         state: stateParam || null,
+                        iss: requestOrigin,
                         client_id: clientId,
                         redirect_uri: redirectTarget.toString(),
                     });
@@ -409,11 +442,16 @@ export function createMuxoServer(customConfig) {
             }
             if (pathname === "/oauth/userinfo" && req.method === "GET") {
                 const ctx = resolveContext(req);
+                const nickname = (ctx.user.email || "").split("@")[0] ||
+                    ctx.user.name.toLowerCase().replace(/\s+/g, ".") ||
+                    ctx.user.id;
                 sendJson(res, 200, {
                     sub: ctx.user.id,
                     id: ctx.user.id,
                     name: ctx.user.name,
                     email: ctx.user.email,
+                    email_verified: true,
+                    nickname,
                     workspace_id: ctx.workspace.id,
                     workspace_name: ctx.workspace.name,
                     tier: ctx.workspace.tier,
@@ -426,7 +464,7 @@ export function createMuxoServer(customConfig) {
                     openapi: "3.1.0",
                     info: {
                         title: "Muxo Unified Agent Execution, Infrastructure, Memory & Governance API",
-                        version: "1.3.0",
+                        version: "1.3.1",
                         description: "One governed boundary over Connected Apps (Composio SDK), Instant Tools (Composio Instant), Cloud Infrastructure (Stripe Projects), Supermemory v5 Brain, and Microsoft Agent Governance Toolkit.",
                     },
                     servers: [{ url: config.baseUrl }],
@@ -475,12 +513,12 @@ Or via HTTP:
 curl -sX POST ${config.baseUrl}/api/v1/agents/signup -H "Content-Type: application/json" -d '{"agentName":"my-agent"}'
 \`\`\`
 
-## 2. OAuth Connection Handoff (Composio Plugin Pattern)
+## 2. OAuth Connection Handoff
 When \`plan_action\` targets an unconnected \`app.<provider>.*\` tool, Muxo returns \`authHandoff.redirectUrl\`.
 Open the URL in a browser, complete OAuth (which redirects to \`${config.baseUrl}/oauth/callback\`), and call \`wait_for_connection({ provider })\` or \`muxo link <provider> --wait\`.
 
-## 3. Merchant-of-Record Credit Settlement
-Users purchase Muxo Credits (\`POST /api/v1/billing/topup\` or \`muxo billing topup 1000\`), and Muxo settles wholesale supplier costs across Composio and Stripe Projects from Muxo's master accounts (\`fundingMode: "muxo_funded"\`).
+## 3. Credit Billing & BYOK Support
+Users purchase Muxo Credits (\`POST /api/v1/billing/topup\` or \`muxo billing topup 1000\`), and Muxo settles upstream execution costs from Muxo's master accounts (\`fundingMode: "muxo_funded"\`), or users can configure their own BYOK provider keys for 0-credit execution.
 `);
                 return;
             }
@@ -507,7 +545,7 @@ Users purchase Muxo Credits (\`POST /api/v1/billing/topup\` or \`muxo billing to
             }
             if (pathname === "/llms.txt" && req.method === "GET") {
                 res.writeHead(200, { "Content-Type": "text/plain; charset=utf-8" });
-                res.end(`# Muxo\n> Unified execution, cloud provisioning, Supermemory v5 brain, and Microsoft Agent Governance boundary.\n\n- Skill Document: ${config.baseUrl}/skill.md\n- Auth Guide: ${config.baseUrl}/auth.md\n- OpenAPI 3.1 Spec: ${config.baseUrl}/api/openapi.json\n- MCP Endpoint: ${config.baseUrl}/mcp\n- OAuth Callback Handoff: ${config.baseUrl}/oauth/callback\n- Plugin Marketplace (Codex/OpenAI): ${config.baseUrl}/.agents/plugins/marketplace.json\n- Plugin Marketplace (Claude/Droid): ${config.baseUrl}/.claude-plugin/marketplace.json\n- Console (app.muxo.ai): ${config.baseUrl}/\n- Landing & Provider Canvas (muxo.ai): ${config.baseUrl}/landing\n- Documentation (docs.muxo.ai): ${config.docsUrl}\n`);
+                res.end(`# Muxo\n> Unified agent execution across Connected Apps, Instant Tools, Cloud Infrastructure, Workspace Memory, and Safety Guardrails.\n\n- Skill Document: ${config.baseUrl}/skill.md\n- Auth Guide: ${config.baseUrl}/auth.md\n- OpenAPI 3.1 Spec: ${config.baseUrl}/api/openapi.json\n- MCP Endpoint: ${config.baseUrl}/mcp\n- OAuth Callback Handoff: ${config.baseUrl}/oauth/callback\n- Plugin Marketplace (Codex/OpenAI): ${config.baseUrl}/.agents/plugins/marketplace.json\n- Plugin Marketplace (Claude/Droid): ${config.baseUrl}/.claude-plugin/marketplace.json\n- Console (app.muxo.ai): ${config.baseUrl}/\n- Landing & Provider Canvas (muxo.ai): ${config.baseUrl}/landing\n- Documentation (docs.muxo.ai): ${config.docsUrl}\n`);
                 return;
             }
             // Serve Installable Muxo Plugin Manifests & Metadata (Portable OpenAI Agent Plugins + Codex + Claude)
@@ -616,6 +654,11 @@ Users purchase Muxo Credits (\`POST /api/v1/billing/topup\` or \`muxo billing to
                     sendJson(res, 404, { ok: false, error: "Invalid or expired agent claim link" });
                     return;
                 }
+                const claimConsoleKey = store.createApiKey({
+                    workspaceId: redeemed.workspace.id,
+                    name: `Owner Claim Session (${redeemed.targetEmail})`,
+                    environment: "live",
+                }).secretKey;
                 const wantsHtml = url.searchParams.get("format") !== "json" &&
                     String(req.headers.accept || "").includes("text/html");
                 if (wantsHtml) {
@@ -640,7 +683,7 @@ Users purchase Muxo Credits (\`POST /api/v1/billing/topup\` or \`muxo billing to
     <div class="badge">Ownership Bound</div>
     <h1>Workspace Claimed</h1>
     <p>Workspace <code>${redeemed.workspace.name}</code> (${redeemed.workspace.id}) claimed by <strong>${redeemed.targetEmail}</strong>.</p>
-    <a class="btn" href="/?claimed=${encodeURIComponent(redeemed.workspace.slug)}">Open Muxo Console →</a>
+    <a class="btn" href="/?claimed=${encodeURIComponent(redeemed.workspace.slug)}&api_key=${encodeURIComponent(claimConsoleKey)}">Open Muxo Console →</a>
   </div>
 </body>
 </html>`);
@@ -649,6 +692,7 @@ Users purchase Muxo Credits (\`POST /api/v1/billing/topup\` or \`muxo billing to
                 sendJson(res, 200, {
                     ok: true,
                     message: `Workspace '${redeemed.workspace.name}' claimed by ${redeemed.targetEmail}`,
+                    apiKey: claimConsoleKey,
                     claim: redeemed,
                 });
                 return;
@@ -735,8 +779,8 @@ Users purchase Muxo Credits (\`POST /api/v1/billing/topup\` or \`muxo billing to
                 });
                 return;
             }
-            // Streamable HTTP MCP Endpoint (POST /mcp, GET /mcp, DELETE /mcp)
-            if (pathname === "/mcp" && req.method === "GET") {
+            // Streamable HTTP MCP Endpoint (POST /mcp, GET /mcp, HEAD /mcp, DELETE /mcp)
+            if (pathname === "/mcp" && (req.method === "GET" || req.method === "HEAD")) {
                 const accept = String(req.headers.accept || "");
                 const sessionId = String(req.headers["mcp-session-id"] || "") ||
                     `mcp_sess_${crypto.randomBytes(8).toString("hex")}`;
@@ -747,8 +791,11 @@ Users purchase Muxo Credits (\`POST /api/v1/billing/topup\` or \`muxo billing to
                         Connection: "keep-alive",
                         "Mcp-Session-Id": sessionId,
                         "Access-Control-Allow-Origin": "*",
+                        "Access-Control-Expose-Headers": "Mcp-Session-Id",
                     });
-                    res.write(`event: endpoint\ndata: ${JSON.stringify({ uri: `${config.baseUrl}/mcp`, sessionId })}\n\n`);
+                    if (req.method !== "HEAD") {
+                        res.write(`event: endpoint\ndata: ${JSON.stringify({ uri: `${config.baseUrl}/mcp`, sessionId })}\n\n`);
+                    }
                     res.end();
                     return;
                 }
@@ -758,12 +805,12 @@ Users purchase Muxo Credits (\`POST /api/v1/billing/topup\` or \`muxo billing to
                     protocolVersion: "2025-06-18",
                     serverInfo: {
                         name: "muxo-mcp-server",
-                        version: "1.3.0",
+                        version: "1.3.1",
                     },
                     instructions: MUXO_MCP_SERVER_INSTRUCTIONS,
                     toolsCount: MUXO_MCP_TOOLS.length,
                     skillsCount: getMuxoMcpSkills().length,
-                });
+                }, { "Mcp-Session-Id": sessionId });
                 return;
             }
             if (pathname === "/mcp" && req.method === "DELETE") {
@@ -860,7 +907,12 @@ Users purchase Muxo Credits (\`POST /api/v1/billing/topup\` or \`muxo billing to
                     email,
                     baseUrl: config.baseUrl,
                 });
-                sendJson(res, 201, { ok: true, claim, ...claim });
+                sendJson(res, 201, {
+                    ok: true,
+                    claim: { ...claim, ownerEmail: email },
+                    ...claim,
+                    ownerEmail: email,
+                });
                 return;
             }
             // Microsoft Agent Governance Status & Audit Verification
@@ -1042,7 +1094,11 @@ Users purchase Muxo Credits (\`POST /api/v1/billing/topup\` or \`muxo billing to
                 const planId = decodeURIComponent(planExecuteMatch[1]);
                 const plan = engine.getPlan(ctx, planId);
                 const result = await engine.executePlanForRisk(ctx, planId, plan.riskLevel);
-                sendJson(res, 200, { ok: true, ...result });
+                sendJson(res, 200, {
+                    ok: true,
+                    ...result,
+                    settlement: result.receipt?.supplierSettlement || null,
+                });
                 return;
             }
             // Runs & Receipts
@@ -1176,6 +1232,8 @@ Users purchase Muxo Credits (\`POST /api/v1/billing/topup\` or \`muxo billing to
                 sendJson(res, 200, {
                     ok: true,
                     creditsAdded: credits,
+                    creditBalance: updatedWorkspace.creditsBalance,
+                    creditsBalance: updatedWorkspace.creditsBalance,
                     usdPaid: Number(usdPaid),
                     workspace: updatedWorkspace,
                     settlementSummary: store.getSupplierSettlementSummary(ctx.workspace.id),

package/dist/store.d.ts

@@ -28,6 +28,7 @@ export declare class MuxoStore {
         user: User;
         workspace: Workspace;
         sessionToken: string;
+        apiKey: string;
     };
     loginUser(email: string, password: string): {
         user: User;

package/dist/store.js

@@ -333,10 +333,16 @@ export class MuxoStore {
             description: "Free Plan initial monthly allowance (1,000 actions + 250 trial credits)",
         });
         const sessionToken = this.createSession(userId, workspaceId);
+        const defaultKey = this.createApiKey({
+            workspaceId,
+            name: "Default Live Key",
+            environment: "live",
+        });
         return {
             user: this.getUser(userId),
             workspace: this.getWorkspace(workspaceId),
             sessionToken,
+            apiKey: defaultKey.secretKey,
         };
     }
     loginUser(email, password) {
@@ -787,7 +793,8 @@ export class MuxoStore {
            SET monthly_actions_used = ?, credits_balance = ?, updated_at = ?
            WHERE id = ?`)
                 .run(newActionsUsed, newCreditsBalance, now, params.workspaceId);
-            const settlement = this.computeSupplierSettlement(run.lane, run.toolSlug, params.creditsMetered, "settled_by_muxo_master_wallet");
+            const byokUsed = this.hasByokForLane(params.workspaceId, run.lane, run.toolSlug);
+            const settlement = this.computeSupplierSettlement(run.lane, run.toolSlug, params.creditsMetered, byokUsed ? "settled_by_customer_byok" : "settled_by_muxo_master_wallet", params.workspaceId);
             this.addLedgerEntry({
                 workspaceId: params.workspaceId,
                 kind: "run_deduction",
@@ -795,7 +802,9 @@ export class MuxoStore {
                 creditsDelta: -params.creditsMetered,
                 balanceAfter: newCreditsBalance,
                 referenceId: run.id,
-                description: `Executed ${run.toolSlug} (${run.lane}) — User paid Muxo ${params.creditsMetered} credits ($${(settlement.userRetailChargeCents / 100).toFixed(2)}) -> Muxo paid ${settlement.supplierName} ($${(settlement.supplierWholesalePayableCents / 100).toFixed(2)})`,
+                description: byokUsed
+                    ? `Executed ${run.toolSlug} (${run.lane}) — BYOK 0-credit execution (Customer's own ${settlement.supplierName} key)`
+                    : `Executed ${run.toolSlug} (${run.lane}) — User paid Muxo ${params.creditsMetered} credits ($${(settlement.userRetailChargeCents / 100).toFixed(2)}) -> Muxo paid ${settlement.supplierName} ($${(settlement.supplierWholesalePayableCents / 100).toFixed(2)})`,
             });
         }
         const receipt = this.issueReceipt({
@@ -1004,7 +1013,9 @@ export class MuxoStore {
     computeSupplierSettlement(lane, toolSlug, creditCost, settlementStatus = "settled_by_muxo_master_wallet", workspaceId) {
         const useByok = settlementStatus === "settled_by_customer_byok" ||
             settlementStatus === "planned_customer_byok" ||
-            (workspaceId ? this.hasByokForLane(workspaceId, lane, toolSlug) : false);
+            (Number(creditCost || 0) === 0 && workspaceId
+                ? this.hasByokForLane(workspaceId, lane, toolSlug)
+                : false);
         const upstreamProvider = toolSlug.split(".")[1] || lane;
         if (useByok) {
             const isPlanned = settlementStatus === "planned_muxo_master_wallet" ||
@@ -1141,7 +1152,12 @@ export class MuxoStore {
             if (kind === "run_deduction" && refId) {
                 const run = this.getRun(workspaceId, refId);
                 if (run) {
-                    supplierSettlement = this.computeSupplierSettlement(run.lane, run.toolSlug, Math.abs(creditsDelta), "settled_by_muxo_master_wallet");
+                    const isByokEntry = creditsDelta === 0 &&
+                        (String(r.description || "").includes("BYOK") ||
+                            this.hasByokForLane(workspaceId, run.lane, run.toolSlug));
+                    supplierSettlement = this.computeSupplierSettlement(run.lane, run.toolSlug, Math.abs(creditsDelta), isByokEntry
+                        ? "settled_by_customer_byok"
+                        : "settled_by_muxo_master_wallet", workspaceId);
                 }
             }
             return {