@otto-code/protocol 0.7.5 → 0.8.0

package/dist/model-tiers.d.ts

@@ -1,12 +1,12 @@
 /**
  * Model → tier classification, shared by the daemon (stamps `model.tier` at
- * ingest) and the app (reads `model.tier`). Pure and dependency-free — no zod,
+ * ingest) and the app (reads `model.tier`). Pure and dependency-free - no zod,
  * no I/O.
  *
  * Deliberately NO name-pattern guessing: the official model ids are public
  * record, so we classify what we KNOW (the shipped catalog) and leave everything
  * else `undefined` = "Unknown". Size-in-the-name heuristics are unreliable
- * (a Qwen-32B coder ≠ a Qwen-32B instruct), so we don't pretend — the user tags
+ * (a Qwen-32B coder ≠ a Qwen-32B instruct), so we don't pretend - the user tags
  * an Unknown model with an override and that's it.
  *
  * Resolution order for a single model:
@@ -21,7 +21,7 @@ export declare const KNOWN_MODEL_TIERS: Readonly<Record<string, ModelTier>>;
 export declare function catalogTier(modelId: string): ModelTier | undefined;
 /**
  * Infer a model's tier from the shipped catalog alone (no guessing). Undefined
- * for models we don't ship an id for — those read as "Unknown" until the user
+ * for models we don't ship an id for - those read as "Unknown" until the user
  * tags one.
  */
 export declare function inferModelTier(model: Pick<AgentModelDefinition, "id">): ModelTier | undefined;

package/dist/model-tiers.js

@@ -1,12 +1,12 @@
 /**
  * Model → tier classification, shared by the daemon (stamps `model.tier` at
- * ingest) and the app (reads `model.tier`). Pure and dependency-free — no zod,
+ * ingest) and the app (reads `model.tier`). Pure and dependency-free - no zod,
  * no I/O.
  *
  * Deliberately NO name-pattern guessing: the official model ids are public
  * record, so we classify what we KNOW (the shipped catalog) and leave everything
  * else `undefined` = "Unknown". Size-in-the-name heuristics are unreliable
- * (a Qwen-32B coder ≠ a Qwen-32B instruct), so we don't pretend — the user tags
+ * (a Qwen-32B coder ≠ a Qwen-32B instruct), so we don't pretend - the user tags
  * an Unknown model with an override and that's it.
  *
  * Resolution order for a single model:
@@ -20,7 +20,7 @@
 // case-insensitively against the exact model id; decorated ids that miss here
 // fall through to patterns.
 export const KNOWN_MODEL_TIERS = {
-    // Anthropic (Claude) — the full Claude Code manifest. Tiering rule: 1M-context
+    // Anthropic (Claude) - the full Claude Code manifest. Tiering rule: 1M-context
     // Opus variants are "deep", non-1M Opus and Sonnet are "standard", Haiku is
     // "fast". Fable (1M, most powerful) is "deep".
     "claude-fable-5": "deep",
@@ -84,7 +84,7 @@ export function catalogTier(modelId) {
 }
 /**
  * Infer a model's tier from the shipped catalog alone (no guessing). Undefined
- * for models we don't ship an id for — those read as "Unknown" until the user
+ * for models we don't ship an id for - those read as "Unknown" until the user
  * tags one.
  */
 export function inferModelTier(model) {

package/dist/observed-subagent-title.d.ts

@@ -4,7 +4,7 @@ export declare function normalizeObservedTitleSource(value: string | undefined |
 export declare function normalizeObservedSubagentType(value: string | undefined | null): string | null;
 /**
  * Derive the frozen row name for an observed subagent. Prefer the stable
- * `subAgentType` (e.g. "code-explorer") over the description — a
+ * `subAgentType` (e.g. "code-explorer") over the description - a
  * `task_progress` description is the ever-changing AI summary, which must
  * never become the label. Generic catch-all types ("general-purpose") are
  * skipped in favor of the description. Callers freeze the result at the first
@@ -16,7 +16,7 @@ export declare function deriveObservedSubagentTitle(update: {
 }): string;
 /**
  * True when this update carries a real name source we can freeze the title on.
- * A generic catch-all type alone doesn't count — freezing "general-purpose"
+ * A generic catch-all type alone doesn't count - freezing "general-purpose"
  * would lock out the description a later update may carry.
  */
 export declare function observedUpdateHasTitleSource(update: {

package/dist/observed-subagent-title.js

@@ -1,5 +1,5 @@
 // Shared naming rule for provider-managed (observed) subagents. This is the
-// single source of truth for how an observed subagent is titled — the daemon
+// single source of truth for how an observed subagent is titled - the daemon
 // uses it to freeze the track-row label (agent-projections.ts), and the app's
 // visualizer uses it so page-side child labels (subagent_dispatch/return
 // particles ride an edge keyed by child NAME) resolve to exactly the same
@@ -9,7 +9,7 @@
 /** Hard cap so no provider summary can produce a wall-of-text label. */
 export const OBSERVED_SUBAGENT_TITLE_MAX = 60;
 /**
- * Catch-all subagent types that make lousy row labels — Claude's default Task
+ * Catch-all subagent types that make lousy row labels - Claude's default Task
  * runs as "general-purpose". These never become the title; the task
  * description names the row instead (user-locked).
  */
@@ -36,7 +36,7 @@ export function normalizeObservedSubagentType(value) {
 }
 /**
  * Derive the frozen row name for an observed subagent. Prefer the stable
- * `subAgentType` (e.g. "code-explorer") over the description — a
+ * `subAgentType` (e.g. "code-explorer") over the description - a
  * `task_progress` description is the ever-changing AI summary, which must
  * never become the label. Generic catch-all types ("general-purpose") are
  * skipped in favor of the description. Callers freeze the result at the first
@@ -53,7 +53,7 @@ export function deriveObservedSubagentTitle(update) {
 }
 /**
  * True when this update carries a real name source we can freeze the title on.
- * A generic catch-all type alone doesn't count — freezing "general-purpose"
+ * A generic catch-all type alone doesn't count - freezing "general-purpose"
  * would lock out the description a later update may carry.
  */
 export function observedUpdateHasTitleSource(update) {

package/dist/orchestration.d.ts

@@ -10,9 +10,9 @@ export declare const RUN_STATUSES: readonly ["draft", "pending", "running", "pau
 export type RunStatus = (typeof RUN_STATUSES)[number];
 export declare function isRunPhaseStatus(value: string): value is RunPhaseStatus;
 export declare function isRunStatus(value: string): value is RunStatus;
-/** Terminal run statuses — no further phases will run. */
+/** Terminal run statuses - no further phases will run. */
 export declare function isTerminalRunStatus(value: string): boolean;
-/** Terminal phase statuses — the phase will not change again on its own. */
+/** Terminal phase statuses - the phase will not change again on its own. */
 export declare function isTerminalPhaseStatus(value: string): boolean;
 export declare const RunPhaseJudgeSpecSchema: z.ZodObject<{
     role: z.ZodOptional<z.ZodString>;
@@ -412,7 +412,7 @@ export declare function validateOrchestrationGraph(graph: OrchestrationGraph): s
 /**
  * Advisory findings: things that are almost certainly authoring mistakes but
  * leave the graph executable. Separate from `validateOrchestrationGraph`
- * because that one is the daemon's hard gate — anything it returns stops a run,
+ * because that one is the daemon's hard gate - anything it returns stops a run,
  * and none of these should.
  *
  * Expression *syntax* is not checked here: the JSONata parser is daemon-side,

package/dist/orchestration.js

@@ -1,12 +1,12 @@
 import { z } from "zod";
 import { JudgeVerdictSchema } from "./judge-verdict.js";
-// The orchestration data model — a daemon-owned "Run": one execution of a
+// The orchestration data model - a daemon-owned "Run": one execution of a
 // declared multi-agent plan, and its observable/resumable projection to clients.
 // See projects/agent-orchestration/agent-orchestration.md. This is Otto's
 // provider-agnostic answer to a harness "Workflow": the conductor (an
 // orchestrator-role agent) DECLARES the shape (typed phases, assignments, the
-// loop target) via `start_run`, and the daemon runtime drives control flow —
-// fan-out, gather-barrier, gate, loop — in code, so orchestrating is cheaper
+// loop target) via `start_run`, and the daemon runtime drives control flow -
+// fan-out, gather-barrier, gate, loop - in code, so orchestrating is cheaper
 // than hand-tracking N agent ids across async notifications.
 //
 // Wire-forward-compat, per the protocol contract: every open vocabulary (phase
@@ -32,7 +32,7 @@ const PHASE_TYPE_SET = new Set(RUN_PHASE_TYPES);
 export function isRunPhaseType(value) {
     return PHASE_TYPE_SET.has(value);
 }
-// The default role that fills each phase type. `gate` has no role — it's a human
+// The default role that fills each phase type. `gate` has no role - it's a human
 // approval point. `deliver` defaults to coder (a writer may cover small text
 // deliverables; the conductor can override per phase).
 const PHASE_TYPE_DEFAULT_ROLE = {
@@ -75,11 +75,11 @@ export function isRunPhaseStatus(value) {
 export function isRunStatus(value) {
     return RUN_STATUS_SET.has(value);
 }
-/** Terminal run statuses — no further phases will run. */
+/** Terminal run statuses - no further phases will run. */
 export function isTerminalRunStatus(value) {
     return value === "done" || value === "failed" || value === "canceled";
 }
-/** Terminal phase statuses — the phase will not change again on its own. */
+/** Terminal phase statuses - the phase will not change again on its own. */
 export function isTerminalPhaseStatus(value) {
     return value === "done" || value === "failed" || value === "skipped";
 }
@@ -120,7 +120,7 @@ export const RunPhaseDeclarationSchema = z
 export const RunPlanSchema = z
     .object({
     title: z.string().min(1),
-    // Immutable acceptance criteria — the run is "not done until every one is
+    // Immutable acceptance criteria - the run is "not done until every one is
     // met." Carried onto the Run and shown at gates.
     requirements: z.array(z.string().min(1)).optional(),
     // Attended by default: the run pauses at `gate` phases for the user.
@@ -138,11 +138,11 @@ export const RunPhaseCandidateSchema = z
     // The personality that filled the role for this candidate, if resolved.
     personalityId: z.string().min(1).optional(),
     verdict: JudgeVerdictSchema.optional(),
-    // The candidate's final message (synthesis input); may be large — clients
+    // The candidate's final message (synthesis input); may be large - clients
     // truncate for display.
     summary: z.string().optional(),
     // Validated output fields, when the node declared them (GraphNode.output).
-    // Values only — anything large belongs in a file the next node reads.
+    // Values only - anything large belongs in a file the next node reads.
     outputFields: z.record(z.string(), z.unknown()).optional(),
 })
     .passthrough();
@@ -162,7 +162,7 @@ export const RunPhaseSchema = z
     candidates: z.array(RunPhaseCandidateSchema).optional(),
     // Free-text runtime notes (why it blocked, which cap tripped, gap named).
     notes: z.string().optional(),
-    // Machine-readable reason a phase is "skipped" — the human sentence stays in
+    // Machine-readable reason a phase is "skipped" - the human sentence stays in
     // `notes`. Absent on a skipped phase means an older daemon wrote it (read it
     // as "upstream-failed", the only skip that existed then). Open vocabulary,
     // plain string on the wire; known values in GRAPH_SKIP_REASONS.
@@ -170,7 +170,7 @@ export const RunPhaseSchema = z
     // How many extra attempts a node's retry policy spent (0/absent = none).
     retryAttempts: z.number().int().min(0).optional(),
     // True when the phase's last attempt ended at its time limit rather than
-    // by failing on its own — a different diagnosis, so a different flag.
+    // by failing on its own - a different diagnosis, so a different flag.
     timedOut: z.boolean().optional(),
     startedAt: z.string().optional(),
     completedAt: z.string().optional(),
@@ -222,7 +222,7 @@ export const RunSchema = z
     // or runs without the run-summary feature.
     summary: z.string().optional(),
     summaryStatus: z.string().optional(),
-    // Total child agents this run spawned (makers + judgers) — a complexity
+    // Total child agents this run spawned (makers + judgers) - a complexity
     // signal surfaced in the Runs display. Grows as the run executes.
     agentCount: z.number().int().min(0).optional(),
     createdAt: z.string().optional(),
@@ -232,7 +232,7 @@ export const RunSchema = z
 // Summary generation lifecycle (plain-string on the wire; see RunSchema.summaryStatus).
 export const RUN_SUMMARY_STATUSES = ["pending", "ready", "failed"];
 // ── Orchestration graphs (user orchestrations) ──────────────────────────────
-// The reusable template a User orchestration executes — authored in the graph
+// The reusable template a User orchestration executes - authored in the graph
 // designer, stored host-level, parameterized by declared inputs. Executing a
 // graph starts an orchestration (a Run with kind "graph"). See
 // projects/orchestration-graphs. Same wire-forward-compat posture as the Run
@@ -253,7 +253,7 @@ export const GraphInputSchema = z
 // ── Prompt templates ────────────────────────────────────────────────────────
 // Host-level reusable prompts, stored like Graphs. A template with
 // `snippet: true` is meant to be included by other templates rather than bound
-// to a node directly — the shared "how to submit your output" block is the
+// to a node directly - the shared "how to submit your output" block is the
 // motivating case, since repeating it in every node is both duplication and
 // tokens on every dispatch.
 export const PromptTemplateSchema = z
@@ -261,7 +261,7 @@ export const PromptTemplateSchema = z
     id: z.string().min(1),
     name: z.string().min(1),
     description: z.string().optional(),
-    // EJS source. Rendered with HTML escaping disabled — these are prompts,
+    // EJS source. Rendered with HTML escaping disabled - these are prompts,
     // not markup, and characters like & must survive verbatim.
     content: z.string(),
     // Variables the template expects, so the designer can render a binding
@@ -282,10 +282,10 @@ export const NodePromptTemplateRefSchema = z
     variables: z.record(z.string(), z.string()).optional(),
 })
     .passthrough();
-// Node kinds (open vocabulary): "orchestrator" — the single root that hosts
-// the orchestration chat and anchors the Visualizer; "agent" — a worker node.
+// Node kinds (open vocabulary): "orchestrator" - the single root that hosts
+// the orchestration chat and anchors the Visualizer; "agent" - a worker node.
 export const GRAPH_NODE_KINDS = ["orchestrator", "agent"];
-// Loop annotation — exactly one of `times` (fixed repeat) or `until` (bounded
+// Loop annotation - exactly one of `times` (fixed repeat) or `until` (bounded
 // retry graded by a structured judge between iterations; self-grading is not
 // an exit test). `max` is a hard cap in both readings.
 export const GraphNodeLoopSchema = z
@@ -305,7 +305,7 @@ export const GraphNodeLoopSchema = z
     .passthrough();
 // ── Output fields (the value plane) ─────────────────────────────────────────
 // What a node declares it will produce. Plain JSON descriptors, never a
-// serialized Zod schema: they have to be three things at once — wire-safe, a
+// serialized Zod schema: they have to be three things at once - wire-safe, a
 // form the designer can render, and compilable to both Zod (validation) and
 // JSON Schema (the submit_output tool's input). `type` is an open string
 // vocabulary so a new type can never break an old parser.
@@ -314,7 +314,7 @@ export const GraphOutputFieldSchema = z
     .object({
     key: z.string().min(1),
     type: z.string().min(1),
-    // Shown to the node's agent as the field's description — this is the whole
+    // Shown to the node's agent as the field's description - this is the whole
     // instruction it gets about what to put here, so it earns its place.
     description: z.string().optional(),
     // Absent ⇒ required. You declared the field; producing it is the contract.
@@ -331,7 +331,7 @@ export const GraphNodeOutputSchema = z
 // be given exactly the lookup it needs instead of the whole workspace.
 //
 // Three kinds, all read-only by construction:
-//   command    argv array only — no shell, so no operators and no injection
+//   command    argv array only - no shell, so no operators and no injection
 //              surface. A pipeline belongs in a script the tool points at.
 //   http-get   GET only, no author-supplied headers (credentials can't leak
 //              into a graph template).
@@ -348,7 +348,7 @@ export const GraphQueryToolSchema = z
     parameters: z.array(GraphOutputFieldSchema).optional(),
     // kind "command": the executable plus its arguments, each argument a
     // separate entry. `{{param}}` substitutes a declared parameter's value as
-    // one argument — never as a fragment the shell could re-split.
+    // one argument - never as a fragment the shell could re-split.
     command: z.array(z.string()).optional(),
     // kind "http-get": the URL, with `{{param}}` substitution (encoded).
     url: z.string().optional(),
@@ -393,14 +393,14 @@ export const GraphNodeSchema = z
     // How much of the workspace this node's agent may touch: "none" (no
     // filesystem), "read", or "write". Absent ⇒ "write", today's behaviour.
     //
-    // Enforced by withholding tools at spawn, never by asking the model — and a
+    // Enforced by withholding tools at spawn, never by asking the model - and a
     // provider that can't enforce it refuses the node at compile time rather
     // than running it with full access. Open string vocabulary; known values in
     // WORKSPACE_ACCESS_LEVELS (protocol/agent-types).
     access: z.string().optional(),
     // Per-node Otto tool allowlist, by group (see OTTO_TOOL_GROUPS). Absent ⇒
     // whatever the node's tool policy already allows. Present ⇒ only these
-    // groups, intersected with that policy and the daemon-wide allowlist — a
+    // groups, intersected with that policy and the daemon-wide allowlist - a
     // node can narrow its own authority, never widen it.
     //
     // Narrowing is a cost lever as much as a safety one: the tool catalog is
@@ -413,7 +413,7 @@ export const GraphNodeSchema = z
     // quality iteration: a loop re-runs work that succeeded but wasn't good
     // enough; a retry re-runs work that never completed. Retry wraps the whole
     // node including its loop, and every attempt is charged to the run's agent
-    // cap — a retry is never a private allowance.
+    // cap - a retry is never a private allowance.
     retry: GraphNodeRetrySchema.optional(),
     // Wall-clock ceiling for one attempt of this node. On expiry the agent is
     // really cancelled (not merely stopped being awaited) and the node fails,
@@ -433,7 +433,7 @@ export const GraphEdgeConditionSchema = z
 })
     .passthrough();
 // A directed edge: `from`'s final output becomes labeled input material for
-// `to`. Fan-in is an all-inputs barrier held by the daemon — agents never know
+// `to`. Fan-in is an all-inputs barrier held by the daemon - agents never know
 // about waiting.
 export const GraphEdgeSchema = z
     .object({
@@ -455,7 +455,7 @@ export const GraphEdgeSchema = z
     // always delivers, which is every edge today.
     //
     // The condition lives on the edge rather than inside a node so the branch
-    // is visible as a labelled wire — the graph shows its own control flow.
+    // is visible as a labelled wire - the graph shows its own control flow.
     when: GraphEdgeConditionSchema.optional(),
     // Which of the upstream node's output fields this edge carries. Absent ⇒
     // all of them. Selection only, never renaming: downstream is a prompt, not
@@ -520,7 +520,7 @@ function validateGraphEdges(graph, nodeIds) {
         if (edge.from === edge.to)
             problems.push(`Node "${edge.from}" connects to itself.`);
         // Edges INTO the orchestrator are passive answer-delivery, not execution
-        // dependencies — excluding them here keeps "root kicks off A, A delivers
+        // dependencies - excluding them here keeps "root kicks off A, A delivers
         // back to root" from reading as a cycle.
         if (edge.to === rootId)
             continue;
@@ -535,7 +535,7 @@ function validateGraphEdges(graph, nodeIds) {
 /**
  * Advisory findings: things that are almost certainly authoring mistakes but
  * leave the graph executable. Separate from `validateOrchestrationGraph`
- * because that one is the daemon's hard gate — anything it returns stops a run,
+ * because that one is the daemon's hard gate - anything it returns stops a run,
  * and none of these should.
  *
  * Expression *syntax* is not checked here: the JSONata parser is daemon-side,
@@ -549,7 +549,7 @@ export function reviewOrchestrationGraph(graph) {
         }
         const source = graph.nodes.find((node) => node.id === edge.from);
         if (source && !source.output?.fields?.length) {
-            warnings.push(`The edge from "${source.title}" has a condition, but "${source.title}" declares no output fields — the condition can only test its prose as \`output\`.`);
+            warnings.push(`The edge from "${source.title}" has a condition, but "${source.title}" declares no output fields - the condition can only test its prose as \`output\`.`);
         }
     }
     return warnings;
@@ -580,7 +580,7 @@ function validateGraphNode(node, declaredInputs) {
         return []; // unknown kinds pass through
     const problems = [];
     // Autonomous nodes may feed results onward via edges; what they must not
-    // do is orchestrate deterministic children — which edges don't express, so
+    // do is orchestrate deterministic children - which edges don't express, so
     // autonomy is allowed on any node except the root.
     if (node.autonomous && isRoot) {
         problems.push("The Orchestrator node can't be autonomous.");
@@ -626,7 +626,7 @@ function validateGraphNodeLoop(node) {
         return [`Node "${node.title}" has a loop with neither "times" nor "until".`];
     }
     if (node.loop.times !== undefined && node.loop.until !== undefined) {
-        return [`Node "${node.title}" has both loop forms — pick "times" or "until".`];
+        return [`Node "${node.title}" has both loop forms - pick "times" or "until".`];
     }
     return [];
 }

package/dist/otto-config-schema.d.ts

@@ -1,4 +1,9 @@
 import { z } from "zod";
+export declare const OttoServicePortAllocationSchema: z.ZodObject<{
+    range: z.ZodOptional<z.ZodString>;
+    portScript: z.ZodOptional<z.ZodString>;
+}, z.core.$strict>;
+export type OttoServicePortAllocation = z.infer<typeof OttoServicePortAllocationSchema>;
 export declare function normalizeLifecycleCommands(commands: unknown): string[];
 export declare const OttoLifecycleCommandRawSchema: z.ZodUnion<readonly [z.ZodString, z.ZodArray<z.ZodString>]>;
 export declare const OttoScriptEntryRawSchema: z.ZodObject<{
@@ -10,6 +15,10 @@ export declare const OttoWorktreeConfigRawSchema: z.ZodObject<{
     setup: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodArray<z.ZodString>]>>;
     teardown: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodArray<z.ZodString>]>>;
     terminals: z.ZodOptional<z.ZodUnknown>;
+    servicePorts: z.ZodOptional<z.ZodObject<{
+        range: z.ZodOptional<z.ZodString>;
+        portScript: z.ZodOptional<z.ZodString>;
+    }, z.core.$strict>>;
 }, z.core.$loose>;
 export declare const OttoMetadataGenerationEntrySchema: z.ZodCatch<z.ZodObject<{
     instructions: z.ZodOptional<z.ZodString>;
@@ -42,6 +51,10 @@ export declare const OttoConfigRawSchema: z.ZodObject<{
         setup: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodArray<z.ZodString>]>>;
         teardown: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodArray<z.ZodString>]>>;
         terminals: z.ZodOptional<z.ZodUnknown>;
+        servicePorts: z.ZodOptional<z.ZodObject<{
+            range: z.ZodOptional<z.ZodString>;
+            portScript: z.ZodOptional<z.ZodString>;
+        }, z.core.$strict>>;
     }, z.core.$loose>>;
     scripts: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
         type: z.ZodOptional<z.ZodUnknown>;
@@ -68,6 +81,10 @@ export declare const OttoConfigRawSchema: z.ZodObject<{
 }, z.core.$loose>;
 export declare const WorktreeConfigSchema: z.ZodCatch<z.ZodObject<{
     terminals: z.ZodOptional<z.ZodUnknown>;
+    servicePorts: z.ZodOptional<z.ZodObject<{
+        range: z.ZodOptional<z.ZodString>;
+        portScript: z.ZodOptional<z.ZodString>;
+    }, z.core.$strict>>;
     setup: z.ZodPipe<z.ZodOptional<z.ZodUnknown>, z.ZodTransform<string[], unknown>>;
     teardown: z.ZodPipe<z.ZodOptional<z.ZodUnknown>, z.ZodTransform<string[], unknown>>;
 }, z.core.$loose>>;
@@ -79,6 +96,10 @@ export declare const ScriptEntrySchema: z.ZodCatch<z.ZodObject<{
 export declare const OttoConfigSchema: z.ZodCatch<z.ZodObject<{
     worktree: z.ZodOptional<z.ZodCatch<z.ZodObject<{
         terminals: z.ZodOptional<z.ZodUnknown>;
+        servicePorts: z.ZodOptional<z.ZodObject<{
+            range: z.ZodOptional<z.ZodString>;
+            portScript: z.ZodOptional<z.ZodString>;
+        }, z.core.$strict>>;
         setup: z.ZodPipe<z.ZodOptional<z.ZodUnknown>, z.ZodTransform<string[], unknown>>;
         teardown: z.ZodPipe<z.ZodOptional<z.ZodUnknown>, z.ZodTransform<string[], unknown>>;
     }, z.core.$loose>>>;

package/dist/otto-config-schema.js

@@ -1,5 +1,26 @@
 import { z } from "zod";
 import { GitHostingProviderIdSchema } from "./git-hosting.js";
+const TCP_PORT_RANGE_PATTERN = /^(\d{1,5})-(\d{1,5})$/;
+// Declared ahead of OttoWorktreeConfigRawSchema because that schema references
+// it: a zod schema is a value, so a later `const` would be in its temporal dead
+// zone at module-evaluation time.
+export const OttoServicePortAllocationSchema = z
+    .object({
+    range: z.string().trim().regex(TCP_PORT_RANGE_PATTERN).optional(),
+    portScript: z.string().trim().min(1).optional(),
+})
+    .strict()
+    .refine((value) => value.range !== undefined || value.portScript !== undefined, "Expected range or portScript")
+    .refine((value) => {
+    if (!value.range)
+        return true;
+    const match = TCP_PORT_RANGE_PATTERN.exec(value.range);
+    if (!match)
+        return false;
+    const start = Number(match[1]);
+    const end = Number(match[2]);
+    return start >= 1 && end <= 65535 && start <= end;
+}, "Expected an inclusive TCP port range from 1-65535");
 export function normalizeLifecycleCommands(commands) {
     if (typeof commands === "string") {
         return commands.trim().length > 0 ? [commands] : [];
@@ -24,6 +45,7 @@ export const OttoWorktreeConfigRawSchema = z
     setup: OttoLifecycleCommandRawSchema.optional(),
     teardown: OttoLifecycleCommandRawSchema.optional(),
     terminals: z.unknown().optional(),
+    servicePorts: OttoServicePortAllocationSchema.optional(),
 })
     .passthrough();
 export const OttoMetadataGenerationEntrySchema = z
@@ -44,7 +66,7 @@ export const OttoMetadataGenerationSchema = z
     .passthrough()
     .catch({});
 // Which git hosting provider this project's PR/issue features use. Committed
-// with the repo (team-shared); credentials never live here — they belong to
+// with the repo (team-shared); credentials never live here - they belong to
 // the daemon's private config, keyed by project.
 export const OttoGitHostingConfigRawSchema = z
     .object({

package/dist/provider-config.d.ts

@@ -38,7 +38,7 @@ export declare const ProviderProfileModelSchema: z.ZodObject<{
  * Coarse categories for Otto's agent-facing tool catalog. Providers that receive
  * Otto tools natively (see the openai-compat provider) can be scoped to a subset
  * of these groups; omitting the selection means all groups. Kept deliberately
- * coarse — users pick groups, not individual tools.
+ * coarse - users pick groups, not individual tools.
  */
 export declare const OTTO_TOOL_GROUPS: readonly ["preview", "browser", "web", "agents", "terminals", "schedules", "artifacts", "widgets", "workspace"];
 export type OttoToolGroup = (typeof OTTO_TOOL_GROUPS)[number];
@@ -51,7 +51,7 @@ export declare function ottoToolGroupForName(name: string): OttoToolGroup;
 /**
  * Canonical MCP server config. Shared by AgentSessionConfig (per-agent servers
  * sent at create time) and ProviderOverride (provider-level servers in the
- * daemon config). stdio entries execute arbitrary commands as the daemon user —
+ * daemon config). stdio entries execute arbitrary commands as the daemon user -
  * both sources sit behind existing trust boundaries (daemon-side config file,
  * authenticated agent-create RPC).
  */
@@ -72,6 +72,58 @@ export declare const McpServerConfigSchema: z.ZodDiscriminatedUnion<[z.ZodObject
     headers: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
     alwaysLoad: z.ZodOptional<z.ZodBoolean>;
 }, z.core.$strip>], "type">;
+/**
+ * OAuth tokens held for a connector whose MCP server authenticates over OAuth
+ * 2.1 (the "log in, don't paste a token" path). Mirrors the SDK's OAuthTokens
+ * shape. Secret-bearing, so it is host-owned like every other credential in
+ * daemon config and is redacted before the config is sent to a client.
+ *
+ * `expiresAt` is absolute epoch MILLISECONDS, not the `expires_in` duration the
+ * token endpoint returns: a duration is only meaningful next to the instant it
+ * was issued, and that instant is not on the wire.
+ */
+export declare const ConnectorOAuthTokensSchema: z.ZodObject<{
+    accessToken: z.ZodString;
+    tokenType: z.ZodOptional<z.ZodString>;
+    refreshToken: z.ZodOptional<z.ZodString>;
+    scope: z.ZodOptional<z.ZodString>;
+    expiresAt: z.ZodOptional<z.ZodNumber>;
+}, z.core.$strip>;
+/**
+ * The OAuth client identity this daemon registered with a connector's
+ * authorization server, kept so a second login reuses the registration instead
+ * of re-running dynamic client registration. Keyed alongside the redirect URI it
+ * was registered against: if the loopback port moves, the registration is stale
+ * and must be redone.
+ */
+export declare const ConnectorOAuthClientSchema: z.ZodObject<{
+    clientId: z.ZodString;
+    clientSecret: z.ZodOptional<z.ZodString>;
+    redirectUri: z.ZodString;
+}, z.core.$strip>;
+/**
+ * Everything the daemon persists about a connector's authorization. Absent means
+ * the connector either needs no credential or carries a static token in its
+ * transport (env var for stdio, Authorization header for http/sse) - this block
+ * is only for the interactive OAuth path.
+ */
+export declare const ConnectorAuthStateSchema: z.ZodObject<{
+    kind: z.ZodLiteral<"oauth">;
+    tokens: z.ZodOptional<z.ZodObject<{
+        accessToken: z.ZodString;
+        tokenType: z.ZodOptional<z.ZodString>;
+        refreshToken: z.ZodOptional<z.ZodString>;
+        scope: z.ZodOptional<z.ZodString>;
+        expiresAt: z.ZodOptional<z.ZodNumber>;
+    }, z.core.$strip>>;
+    client: z.ZodOptional<z.ZodObject<{
+        clientId: z.ZodString;
+        clientSecret: z.ZodOptional<z.ZodString>;
+        redirectUri: z.ZodString;
+    }, z.core.$strip>>;
+    account: z.ZodOptional<z.ZodString>;
+    authorizedAt: z.ZodOptional<z.ZodNumber>;
+}, z.core.$strip>;
 /**
  * Per-workspace state for a connector, keyed by workspace cwd in
  * ConnectorConfig.workspaces. Phase 1 leaves this inert (the daemon does not
@@ -112,6 +164,23 @@ export declare const ConnectorConfigSchema: z.ZodObject<{
     }, z.core.$strip>], "type">;
     enabled: z.ZodOptional<z.ZodBoolean>;
     disabledTools: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    auth: z.ZodOptional<z.ZodObject<{
+        kind: z.ZodLiteral<"oauth">;
+        tokens: z.ZodOptional<z.ZodObject<{
+            accessToken: z.ZodString;
+            tokenType: z.ZodOptional<z.ZodString>;
+            refreshToken: z.ZodOptional<z.ZodString>;
+            scope: z.ZodOptional<z.ZodString>;
+            expiresAt: z.ZodOptional<z.ZodNumber>;
+        }, z.core.$strip>>;
+        client: z.ZodOptional<z.ZodObject<{
+            clientId: z.ZodString;
+            clientSecret: z.ZodOptional<z.ZodString>;
+            redirectUri: z.ZodString;
+        }, z.core.$strip>>;
+        account: z.ZodOptional<z.ZodString>;
+        authorizedAt: z.ZodOptional<z.ZodNumber>;
+    }, z.core.$strip>>;
     workspaces: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
         enabled: z.ZodOptional<z.ZodBoolean>;
     }, z.core.$strip>>>;
@@ -144,6 +213,23 @@ export declare const ConnectorsConfigSchema: z.ZodObject<{
         }, z.core.$strip>], "type">;
         enabled: z.ZodOptional<z.ZodBoolean>;
         disabledTools: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        auth: z.ZodOptional<z.ZodObject<{
+            kind: z.ZodLiteral<"oauth">;
+            tokens: z.ZodOptional<z.ZodObject<{
+                accessToken: z.ZodString;
+                tokenType: z.ZodOptional<z.ZodString>;
+                refreshToken: z.ZodOptional<z.ZodString>;
+                scope: z.ZodOptional<z.ZodString>;
+                expiresAt: z.ZodOptional<z.ZodNumber>;
+            }, z.core.$strip>>;
+            client: z.ZodOptional<z.ZodObject<{
+                clientId: z.ZodString;
+                clientSecret: z.ZodOptional<z.ZodString>;
+                redirectUri: z.ZodString;
+            }, z.core.$strip>>;
+            account: z.ZodOptional<z.ZodString>;
+            authorizedAt: z.ZodOptional<z.ZodNumber>;
+        }, z.core.$strip>>;
         workspaces: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
             enabled: z.ZodOptional<z.ZodBoolean>;
         }, z.core.$strip>>>;
@@ -167,7 +253,7 @@ export declare const COMPACTION_THRESHOLD_PERCENTS: readonly [50, 60, 70, 80, 90
 /**
  * Max model→tool→model rounds per turn for providers whose tool loop the
  * daemon owns (openai-compat). The turn stops with an error after this many
- * rounds without a final answer — a runaway-loop safety valve, most often hit
+ * rounds without a final answer - a runaway-loop safety valve, most often hit
  * by smaller local models that keep calling tools instead of converging.
  * Bounds keep the setting a sane guard rail rather than an off switch.
  */
@@ -348,6 +434,9 @@ export declare const AgentProviderRuntimeSettingsMapSchema: z.ZodRecord<z.ZodStr
     disallowedTools: z.ZodOptional<z.ZodArray<z.ZodString>>;
 }, z.core.$strip>>;
 export type McpServerConfig = z.infer<typeof McpServerConfigSchema>;
+export type ConnectorOAuthTokens = z.infer<typeof ConnectorOAuthTokensSchema>;
+export type ConnectorOAuthClient = z.infer<typeof ConnectorOAuthClientSchema>;
+export type ConnectorAuthState = z.infer<typeof ConnectorAuthStateSchema>;
 export type ConnectorWorkspaceState = z.infer<typeof ConnectorWorkspaceStateSchema>;
 export type ConnectorConfig = z.infer<typeof ConnectorConfigSchema>;
 export type ConnectorsConfig = z.infer<typeof ConnectorsConfigSchema>;