@saadnvd1/agent-os 0.3.664 → 0.3.671

package/components/Chat/McpSignIn.tsx

@@ -0,0 +1,122 @@
+"use client";
+
+import { useState } from "react";
+import { ExternalLink } from "lucide-react";
+import type { useMcpSignIn } from "@/data/chat/mcpAuth";
+
+const LINK =
+  "bg-primary text-primary-foreground inline-flex h-11 items-center justify-center gap-2 rounded-lg px-4 text-sm font-medium md:h-9";
+const GHOST =
+  "text-muted-foreground hover:text-foreground h-11 rounded-lg px-3 text-xs md:h-9";
+
+// What happens after Sign in is pressed on one server: the link to open, and
+// what to do if the provider can't return to AgentOS by itself. The list row
+// turns connected on its own, over the chat socket, when it's done.
+export function McpSignIn({
+  flow: { start, finish, recheck },
+  server,
+  onClose,
+}: {
+  // Started by the Sign in press (not on mount: a dev double-mount would
+  // drop the request's result).
+  flow: ReturnType<typeof useMcpSignIn>;
+  server: string;
+  onClose: () => void;
+}) {
+  const [pasted, setPasted] = useState("");
+
+  const mode = start.data?.mode;
+  const authUrl = start.data?.authUrl;
+  const error = start.error ?? finish.error ?? recheck.error;
+  const busy = start.isPending || finish.isPending || recheck.isPending;
+
+  return (
+    <div className="space-y-2 pt-1 pr-2 pb-2 pl-6.5 text-xs">
+      {start.isPending && (
+        <p className="text-muted-foreground">Starting sign-in…</p>
+      )}
+      {mode === "done" && (
+        <p className="text-muted-foreground">
+          Already signed in; reconnecting.
+        </p>
+      )}
+      {(mode === "callback" || mode === "paste" || mode === "external") &&
+        authUrl && (
+          <div className="flex flex-wrap items-center gap-2">
+            <a
+              href={authUrl}
+              target="_blank"
+              rel="noopener noreferrer"
+              className={LINK}
+            >
+              {mode === "external" ? "Open claude.ai" : "Open sign-in page"}
+              <ExternalLink className="size-4" />
+            </a>
+            {mode === "external" && (
+              <button
+                type="button"
+                disabled={busy}
+                onClick={() => recheck.mutate()}
+                className={GHOST}
+              >
+                Check again
+              </button>
+            )}
+          </div>
+        )}
+      {mode === "callback" && (
+        <p className="text-muted-foreground">
+          Approve it there. This list updates by itself.
+        </p>
+      )}
+      {mode === "external" && (
+        <p className="text-muted-foreground">
+          This server signs in on claude.ai. Finish there, then come back.
+        </p>
+      )}
+      {mode === "paste" && (
+        <>
+          <p className="text-muted-foreground">
+            This server only sends the sign-in back to the machine running the
+            session. On this device the page you land on won&apos;t load: copy
+            its address and paste it here.
+          </p>
+          <form
+            className="flex items-center gap-2"
+            onSubmit={(e) => {
+              e.preventDefault();
+              if (pasted.trim()) finish.mutate(pasted.trim());
+            }}
+          >
+            <input
+              value={pasted}
+              onChange={(e) => setPasted(e.target.value)}
+              inputMode="url"
+              autoComplete="off"
+              autoCapitalize="off"
+              spellCheck={false}
+              placeholder="Address of the page after approving"
+              aria-label={`Address after signing in to ${server}`}
+              className="bg-background hairline h-11 min-w-0 flex-1 rounded-lg px-3 text-base md:h-9 md:text-xs"
+            />
+            <button
+              type="submit"
+              disabled={busy || !pasted.trim()}
+              className="bg-secondary text-secondary-foreground hairline h-11 shrink-0 rounded-lg px-3 text-xs font-medium disabled:opacity-50 md:h-9"
+            >
+              Finish
+            </button>
+          </form>
+        </>
+      )}
+      {error && (
+        <p className="text-destructive whitespace-pre-wrap" role="alert">
+          {error.message}
+        </p>
+      )}
+      <button type="button" onClick={onClose} className={GHOST}>
+        {error ? "Close" : "Cancel"}
+      </button>
+    </div>
+  );
+}

package/components/Chat/session.ts

@@ -0,0 +1,8 @@
+"use client";
+
+import { createContext, useContext } from "react";
+
+// The session this chat belongs to, for rows that call its API (a context,
+// not a prop through every item).
+export const ChatSessionId = createContext<string | null>(null);
+export const useChatSessionId = () => useContext(ChatSessionId);

package/components/Health/SweepRuns.tsx

@@ -17,6 +17,7 @@ const KIND: Record<string, string> = {
   database: "task database",
   spare: "dependency spare",
   temp: "temp folder",
+  "test-temp": "test temp folder",
   "derived-data": "Xcode build folder",
 };
 

package/components/Workspaces/WorkspaceSettings.tsx

@@ -55,6 +55,12 @@ export function WorkspaceSettings() {
             checked={w.wake_tasks_on_pr}
             onChange={(on) => update.mutate({ id: w.id, wakeTasksOnPR: on })}
           />
+          <SettingToggle
+            title="Orchestrator full access"
+            detail="Its shell and file writes aren't checked: it can push, commit, edit any repository or file on this machine, and merge a PR directly. Off: the deny list, write limits, quick-change cap and merge-only-through-the-gates apply."
+            checked={w.orch_full_access}
+            onChange={(on) => update.mutate({ id: w.id, orchFullAccess: on })}
+          />
         </section>
       ))}
       <FreshStartForm />

package/data/chat/mcpAuth.ts

@@ -0,0 +1,42 @@
+import { useMutation } from "@tanstack/react-query";
+import type { McpSignInStart } from "@/lib/chat/events";
+
+type Body = {
+  action: "start" | "submit" | "reconnect";
+  server: string;
+  itemId: string;
+  url?: string;
+};
+
+async function post<T>(sessionId: string, body: Body): Promise<T> {
+  const res = await fetch(`/api/sessions/${sessionId}/mcp-auth`, {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify(body),
+  });
+  const data = await res.json().catch(() => ({}));
+  if (!res.ok) throw new Error(data.error || `Request failed (${res.status})`);
+  return data as T;
+}
+
+// Sign in to one MCP server of a chat's /mcp list. The list itself updates
+// over the chat socket once the server is back.
+export function useMcpSignIn(
+  sessionId: string,
+  itemId: string,
+  server: string
+) {
+  const start = useMutation({
+    mutationFn: () =>
+      post<McpSignInStart>(sessionId, { action: "start", server, itemId }),
+  });
+  const finish = useMutation({
+    mutationFn: (url: string) =>
+      post<{ ok: true }>(sessionId, { action: "submit", server, itemId, url }),
+  });
+  const recheck = useMutation({
+    mutationFn: () =>
+      post<{ ok: true }>(sessionId, { action: "reconnect", server, itemId }),
+  });
+  return { start, finish, recheck };
+}

package/data/workspaces/index.ts

@@ -66,6 +66,8 @@ export function useUpdateWorkspace() {
       maxRunningTasks?: number | null;
       // Message tasks about failing checks and reviews on their PRs.
       wakeTasksOnPR?: boolean;
+      // Its orchestrator runs without guards.
+      orchFullAccess?: boolean;
       // MCP servers its orchestrator may use, by name.
       mcpServers?: string[];
     }) =>
@@ -80,6 +82,7 @@ export function useUpdateWorkspace() {
       id,
       maxRunningTasks,
       wakeTasksOnPR,
+      orchFullAccess,
       mcpServers,
       ...updates
     }) => {
@@ -96,6 +99,9 @@ export function useUpdateWorkspace() {
                 ...(wakeTasksOnPR !== undefined && {
                   wake_tasks_on_pr: wakeTasksOnPR,
                 }),
+                ...(orchFullAccess !== undefined && {
+                  orch_full_access: orchFullAccess,
+                }),
                 ...(mcpServers !== undefined && {
                   orch_mcp_servers: mcpServers,
                 }),

package/lib/chat/driver.ts

@@ -11,9 +11,26 @@ import type {
   ChatModel,
   DriverEvent,
   FileSuggestion,
+  McpServerView,
+  McpSignInStart,
   UndoPreview,
 } from "./events";
 
+// An agent's way of signing in to an MCP server that needs it, without
+// restarting the conversation. Tokens stay with the agent; the host only
+// sees the link to open and, later, the address the provider returned to.
+export interface McpAuth {
+  // `state` ties the provider's return to this attempt; it stays server-side.
+  start(
+    server: string,
+    redirectUri?: string
+  ): Promise<McpSignInStart & { state?: string }>;
+  // Hands over the address the provider returned the browser to.
+  submit(server: string, callbackUrl: string): Promise<void>;
+  reconnect(server: string): Promise<void>;
+  servers(): Promise<McpServerView[]>;
+}
+
 export interface ChatStartOptions {
   cwd: string;
   model: string;
@@ -39,7 +56,8 @@ export interface ChatStartOptions {
   // can't be changed for this conversation.
   permissionMode?: PermissionMode;
   // Checked before every tool call, whatever the permissions say: why it's
-  // refused, or null to let it go on to them.
+  // refused, null to let it go on to them, or a warning the agent is shown
+  // while the call still goes on.
   toolGuard?: ToolGuard;
   // The note handed back to the agent right after its context is compacted
   // (lib/chat/compact-context), empty for none. Only Claude Code has a hook
@@ -47,10 +65,12 @@ export interface ChatStartOptions {
   compactContext?: () => Promise<string>;
 }
 
+export type ToolGuardResult = string | null | { warning: string };
+
 export type ToolGuard = (
   tool: string,
   input: Record<string, unknown>
-) => Promise<string | null>;
+) => Promise<ToolGuardResult>;
 
 // One live conversation with an agent. Messages sent while a turn runs are
 // queued by the provider and folded into the conversation.
@@ -88,6 +108,8 @@ export interface ChatConversation {
   backgroundTask?(toolUseId?: string): Promise<boolean>;
   // Puts files back as they were before a message (dryRun: only say what).
   undo(checkpoint: string, dryRun: boolean): Promise<UndoResult>;
+  // Signing in to an MCP server that needs it (Claude's).
+  mcpAuth?: McpAuth;
   close(): void;
   events: AsyncIterable<DriverEvent>;
 }

package/lib/chat/drivers/claude-approvals.ts

@@ -248,6 +248,13 @@ export function guardHook(guard: ToolGuard): HookCallback {
       (input.tool_input ?? {}) as Record<string, unknown>
     ).catch((e: Error) => `Couldn't check this call: ${e.message}`);
     if (reason === null) return {};
+    if (typeof reason !== "string")
+      return {
+        hookSpecificOutput: {
+          hookEventName: "PreToolUse",
+          additionalContext: reason.warning,
+        },
+      };
     return {
       hookSpecificOutput: {
         hookEventName: "PreToolUse",

package/lib/chat/drivers/claude-mcp-auth.ts

@@ -0,0 +1,82 @@
+import type { McpServerStatus, Query } from "@anthropic-ai/claude-agent-sdk";
+import type { McpAuth } from "../driver";
+import type { McpServerView, McpSignInStart } from "../events";
+
+// The CLI takes these as control requests and the SDK's Query has the
+// methods, but its type declarations don't list them.
+type AuthQuery = Query & {
+  mcpAuthenticate?(server: string, redirectUri?: string): Promise<unknown>;
+  mcpSubmitOAuthCallbackUrl?(server: string, url: string): Promise<unknown>;
+};
+
+const LOOPBACK = new Set(["localhost", "127.0.0.1", "[::1]"]);
+
+// Only a link a person can safely open: https, or http to this machine.
+export function safeAuthUrl(value: unknown): string | null {
+  if (typeof value !== "string") return null;
+  try {
+    const url = new URL(value);
+    if (url.protocol === "https:") return url.href;
+    if (url.protocol === "http:" && LOOPBACK.has(url.hostname)) return url.href;
+  } catch {
+    // Not a URL.
+  }
+  return null;
+}
+
+// The CLI's answer to mcp_authenticate, as what the UI needs.
+export function toSignInStart(
+  response: unknown
+): McpSignInStart & { state?: string } {
+  const r = (response ?? {}) as {
+    authUrl?: unknown;
+    requiresUserAction?: unknown;
+    callbackExpected?: unknown;
+    redirectScheme?: unknown;
+    state?: unknown;
+  };
+  if (!r.requiresUserAction && r.authUrl === undefined) return { mode: "done" };
+  const authUrl = safeAuthUrl(r.authUrl);
+  if (!authUrl)
+    throw new Error("The server gave a sign-in link AgentOS won't open");
+  if (!r.callbackExpected) return { mode: "external", authUrl };
+  const state = typeof r.state === "string" ? r.state : undefined;
+  return r.redirectScheme === "custom"
+    ? { mode: "callback", authUrl, state }
+    : { mode: "paste", authUrl, state };
+}
+
+// Whether a server can be signed in to: it speaks OAuth over HTTP.
+export function canSignIn(s: McpServerStatus): boolean {
+  if (s.status !== "needs-auth") return false;
+  const c = s.config as { type?: string; command?: unknown } | undefined;
+  if (!c) return true;
+  return c.type === "http" || c.type === "sse" || c.type === "claudeai-proxy";
+}
+
+export function claudeMcpAuth(
+  q: Query,
+  view: (s: McpServerStatus) => McpServerView
+): McpAuth {
+  const auth = q as AuthQuery;
+  return {
+    async start(server, redirectUri) {
+      if (!auth.mcpAuthenticate)
+        throw new Error(
+          "This Claude Code version can't sign in to MCP servers from AgentOS"
+        );
+      return toSignInStart(await auth.mcpAuthenticate(server, redirectUri));
+    },
+    async submit(server, callbackUrl) {
+      if (!auth.mcpSubmitOAuthCallbackUrl)
+        throw new Error(
+          "This Claude Code version can't sign in to MCP servers from AgentOS"
+        );
+      await auth.mcpSubmitOAuthCallbackUrl(server, callbackUrl);
+    },
+    reconnect: (server) => q.reconnectMcpServer(server),
+    async servers() {
+      return (await q.mcpServerStatus()).map(view);
+    },
+  };
+}

package/lib/chat/drivers/claude.ts

@@ -29,6 +29,7 @@ import { NO_ATTRIBUTION } from "../../agents/attribution";
 import { SUBAGENTS_ENV } from "../../models/subagent-env";
 import { parseSubagentEnv, subagentModelHook } from "../../models/subagents";
 import { callFromAssistant } from "../../usage/calls";
+import { canSignIn, claudeMcpAuth } from "./claude-mcp-auth";
 
 // Claude Code through the Agent SDK, signed in with the user's own Claude
 // Code login. Asks for approval through chat cards unless given full access,
@@ -71,6 +72,10 @@ function cleanError(text?: string): string | undefined {
   return line.length > 300 ? `${line.slice(0, 299)}…` : line;
 }
 
+export function cleanMcpError(text?: string): string | undefined {
+  return cleanError(text);
+}
+
 export function mcpView(s: McpServerStatus): McpServerView {
   return {
     name: s.name,
@@ -78,6 +83,7 @@ export function mcpView(s: McpServerStatus): McpServerView {
     scope: s.source ?? s.scope,
     version: s.serverInfo?.version,
     error: cleanError(s.error),
+    ...(canSignIn(s) && { signIn: true }),
     tools: (s.tools ?? []).map((t) => ({
       name: t.name,
       description: firstLine(t.description),
@@ -346,6 +352,7 @@ export const claudeDriver: ChatDriver = {
           },
         ]);
       },
+      mcpAuth: claudeMcpAuth(q, mcpView),
       async interrupt() {
         await q.interrupt();
       },

package/lib/chat/events.ts

@@ -104,9 +104,21 @@ export interface McpServerView {
   scope?: string;
   version?: string;
   error?: string;
+  // Needs sign-in and AgentOS can start it (the driver can, and the server
+  // speaks OAuth over HTTP). Decided by the server, never by its name.
+  signIn?: boolean;
   tools: { name: string; description?: string }[];
 }
 
+// What starting an MCP server's sign-in came back with: "callback" (open the
+// link; the provider returns to AgentOS), "paste" (the provider only returns
+// to the machine running the session: paste the address it ends on),
+// "external" (finish on claude.ai) or "done" (signed in without asking).
+export interface McpSignInStart {
+  mode: "callback" | "paste" | "external" | "done";
+  authUrl?: string;
+}
+
 // How full the conversation's context window is, as the agent last measured.
 export interface ChatContext {
   usedTokens: number;

package/lib/chat/mcp-auth.ts

@@ -0,0 +1,193 @@
+/**
+ * Signing in to an MCP server from the browser. The agent starts the
+ * sign-in and gives a link; the provider then sends the browser back to
+ * AgentOS (/api/mcp-auth/callback), which hands that address to the agent.
+ * What ties the return to the attempt is the OAuth `state`, kept in SQLite
+ * (the start and callback routes are separate bundles, so memory isn't
+ * shared), used once, and dropped after PENDING_MS. The agent holds the
+ * tokens; nothing here stores or logs the address it was given.
+ */
+
+import { db } from "../db";
+import { getItem } from "./store";
+import { mcpAuthWorker } from "./runner";
+import type { McpSignInStart } from "./events";
+
+export const PENDING_MS = 15 * 60 * 1000;
+export const CALLBACK_PATH = "/api/mcp-auth/callback";
+
+interface Pending {
+  sessionId: string;
+  itemId: string;
+  server: string;
+  origin: string | null;
+  at: number;
+}
+
+interface PendingRow {
+  session_id: string;
+  item_id: string;
+  server: string;
+  origin: string | null;
+  at: number;
+}
+
+export function resetMcpSignIns(): void {
+  db.prepare(`DELETE FROM mcp_sign_ins`).run();
+}
+
+function sweep(now = Date.now()): void {
+  db.prepare(`DELETE FROM mcp_sign_ins WHERE at < ?`).run(now - PENDING_MS);
+}
+
+function savePending(state: string, p: Pending): void {
+  db.prepare(
+    `DELETE FROM mcp_sign_ins WHERE session_id = ? AND server = ?`
+  ).run(p.sessionId, p.server);
+  db.prepare(
+    `INSERT OR REPLACE INTO mcp_sign_ins (state, session_id, item_id, server, origin, at)
+     VALUES (?, ?, ?, ?, ?, ?)`
+  ).run(state, p.sessionId, p.itemId, p.server, p.origin, p.at);
+}
+
+function peekPending(state: string): Pending | undefined {
+  const r = db
+    .prepare(`SELECT * FROM mcp_sign_ins WHERE state = ?`)
+    .get(state) as PendingRow | undefined;
+  return (
+    r && {
+      sessionId: r.session_id,
+      itemId: r.item_id,
+      server: r.server,
+      origin: r.origin,
+      at: r.at,
+    }
+  );
+}
+
+// Single use: only the caller whose delete changed a row may go on.
+function takePending(state: string): boolean {
+  return (
+    db.prepare(`DELETE FROM mcp_sign_ins WHERE state = ?`).run(state).changes >
+    0
+  );
+}
+
+// `http(s)://host[:port]`, nothing else: the browser's own address for
+// AgentOS, so the provider returns to wherever the user is.
+export function cleanOrigin(value: string | null | undefined): string | null {
+  if (!value) return null;
+  try {
+    const url = new URL(value);
+    if (url.protocol !== "https:" && url.protocol !== "http:") return null;
+    return url.origin === value ? url.origin : null;
+  } catch {
+    return null;
+  }
+}
+
+function serverOf(sessionId: string, itemId: string, server: string) {
+  const item = getItem(sessionId, itemId);
+  if (item?.kind !== "mcp") throw new Error("That list is gone");
+  const view = item.servers.find((s) => s.name === server);
+  if (!view) throw new Error(`${server} isn't in that list`);
+  return view;
+}
+
+export async function startMcpSignIn(
+  sessionId: string,
+  input: { itemId: string; server: string; origin?: string | null }
+): Promise<McpSignInStart> {
+  if (!serverOf(sessionId, input.itemId, input.server).signIn)
+    throw new Error("AgentOS can't sign in to this server");
+  const worker = mcpAuthWorker(sessionId);
+  const origin = cleanOrigin(input.origin);
+  const { start, error } = await worker.mcpAuth(
+    {
+      action: "start",
+      server: input.server,
+      itemId: input.itemId,
+      redirectUri: origin ? `${origin}${CALLBACK_PATH}` : undefined,
+    },
+    30_000
+  );
+  if (error || !start) throw new Error(error ?? "Sign-in didn't start");
+  sweep();
+  const { state, ...result } = start;
+  if (state)
+    savePending(state, {
+      sessionId,
+      itemId: input.itemId,
+      server: input.server,
+      origin,
+      at: Date.now(),
+    });
+  return result;
+}
+
+// The provider returned the browser (or the user pasted the address it
+// ended on). `expect` pins a pasted address to the row it was typed in.
+export async function finishMcpSignIn(
+  callbackUrl: string,
+  expect?: { sessionId: string; server: string }
+): Promise<{ server: string }> {
+  sweep();
+  let state: string | null = null;
+  try {
+    state = new URL(callbackUrl).searchParams.get("state");
+  } catch {
+    throw new Error("That isn't a web address");
+  }
+  const p = state ? peekPending(state) : undefined;
+  if (!state || !p)
+    throw new Error(
+      "That sign-in expired or was already used. Press Sign in again."
+    );
+  if (
+    expect &&
+    (expect.sessionId !== p.sessionId || expect.server !== p.server)
+  )
+    throw new Error("That address belongs to a different sign-in");
+  if (!takePending(state))
+    throw new Error(
+      "That sign-in expired or was already used. Press Sign in again."
+    );
+  const { error } = await mcpAuthWorker(p.sessionId).mcpAuth({
+    action: "submit",
+    server: p.server,
+    itemId: p.itemId,
+    url: callbackUrl,
+  });
+  if (error) throw new Error(error);
+  return { server: p.server };
+}
+
+// The provider's redirect reached our callback route. Rebuild the address
+// from the origin the sign-in started with, not from the request (behind the
+// custom server Next may derive it from Host), so it matches the
+// redirect_uri the provider was given exactly.
+export async function finishMcpSignInFromRedirect(
+  search: string
+): Promise<{ server: string }> {
+  sweep();
+  const state = new URLSearchParams(search).get("state");
+  const origin = state ? peekPending(state)?.origin : null;
+  if (!origin)
+    throw new Error(
+      "That sign-in expired or was already used. Press Sign in again."
+    );
+  return finishMcpSignIn(`${origin}${CALLBACK_PATH}${search}`);
+}
+
+// "Check again": reconnect and refresh the list.
+export async function reconnectMcpServer(
+  sessionId: string,
+  input: { itemId: string; server: string }
+): Promise<void> {
+  serverOf(sessionId, input.itemId, input.server);
+  const { error } = await mcpAuthWorker(sessionId).mcpAuth(
+    { action: "reconnect", ...input },
+    30_000
+  );
+  if (error) throw new Error(error);
+}

package/lib/chat/registry.ts

@@ -38,6 +38,8 @@ export interface Live {
   canFresh?: boolean;
   // Whether it takes "background_task" (an older worker drops it).
   canBackground?: boolean;
+  // Whether it takes "mcp_auth" (sign in to an MCP server).
+  canMcpAuth?: boolean;
   // From an older build and idle: retired once its guess at the next
   // message is in, or this fires.
   retiring?: NodeJS.Timeout;

package/lib/chat/runner.ts

@@ -87,6 +87,7 @@ import {
 } from "./worker/client";
 import { buildId, isStaleWorker } from "../build";
 import type { WorkerEvent } from "./worker/protocol";
+import type { WorkerClient } from "./worker/client";
 import { DEMO_REFUSAL, demoMode } from "../security/demo";
 import { chatHold, chatRefusal } from "./hold";
 import { getHost } from "../hosts";
@@ -363,6 +364,7 @@ async function ensureLive(sessionId: string, spawn = true): Promise<Live> {
       canQueue: !!hello.caps?.includes("queue"),
       canFresh: !!hello.caps?.includes("fresh"),
       canBackground: !!hello.caps?.includes("background"),
+      canMcpAuth: !!hello.caps?.includes("mcp_auth"),
     };
     // From an older build and busy, or running background work: it goes at
     // its next turn boundary, by itself if it can. Messages meanwhile wait
@@ -932,6 +934,22 @@ export async function backgroundChatTask(
   });
 }
 
+// The session's running worker, when it can sign in to MCP servers; why not
+// otherwise (a chat on another machine, an idle one, one from an older build).
+export function mcpAuthWorker(sessionId: string): WorkerClient {
+  checkChattable(getSession(sessionId));
+  const live = registry.live.get(sessionId);
+  if (!live || live.retiring)
+    throw new Error(
+      "This chat's agent isn't running. Send /mcp again to wake it, then sign in."
+    );
+  if (!live.canMcpAuth)
+    throw new Error(
+      "This chat's agent is from an older AgentOS build. Send it a message or reopen the chat, then try again."
+    );
+  return live.worker;
+}
+
 export function chatTaskOutput(
   sessionId: string,
   taskId: string