@superblocksteam/gateway 2.0.166 → 2.0.168-next.0

package/README.md

@@ -1,7 +1,8 @@
 # Gateway v0
 
 Standalone Superblocks entry point for a **single MCP connector** (Admin + Builder)
-over **stdio**, running as the already-logged-in Superblocks CLI user.
+over **stdio**, running as the Superblocks user authenticated through browser
+login or a personal API key.
 
 Builder tools (`upload_artifact`, `start_app`, `edit_app`,
 `check_app_progress`, `ask_user`, `get_app`, `build_app`,
@@ -10,13 +11,15 @@ Admin tools from `@superblocksteam/mcp-server` share this process.
 
 The MCP host owns process lifecycle: it spawns `superblocks mcp serve`. The
 unified Gateway has no foreground HTTP `/mcp`, no OAuth resource server, and no
-linked-grant exchange. Personal API keys here are the CLI session
-(`~/.superblocks/auth.json` / `SUPERBLOCKS_AUTH_FILE` / `just worktree auth`).
+linked-grant exchange. Browser login uses authorization code + PKCE to obtain
+Server-audience access tokens. Personal API keys remain supported through
+`SUPERBLOCKS_API_TOKEN` or the CLI session (`~/.superblocks/auth.json` /
+`SUPERBLOCKS_AUTH_FILE` / `just worktree auth`).
 
 Scope notes:
 
 - In-memory stores only; no Redis (ENG-5594).
-- CLI identity only. Linked MCP grants, static `GATEWAY_DEV_SUPERBLOCKS_API_KEY`,
+- One authenticated user per process. Linked MCP grants, static `GATEWAY_DEV_SUPERBLOCKS_API_KEY`,
   and on-behalf-of exchange are not supported.
 - Missing Playwright Chromium does not block start (ENG-5796). Screenshots fail
   closed when Chromium is absent.
@@ -76,8 +79,8 @@ permission to run local MCP servers. See [Anthropic's organization plugin guide]
 ## Internal review
 
 ```bash
-# Log in if needed (same CLI session the Gateway will use)
-superblocks login
+# Sign in through the browser for this Server origin
+superblocks mcp login --server-url https://app.superblocks.com
 
 # Write a stdio MCP entry into the client config
 superblocks mcp setup --client claude
@@ -97,8 +100,8 @@ Published `bin/run.js` is the MCP `command` (its `node` shebang applies).
 Worktree `bin/dev.js` is launched with `tsx` and without `--watch`: the
 dev shebang is a file-watcher, which would kill stdio on source edits and
 corrupt JSON-RPC on stdout. When `SUPERBLOCKS_AUTH_FILE` is set (worktree
-auth), it is copied into the MCP `env` block. Gateway derives both control
-plane and remote UI URLs from `superblocksBaseUrl` in that auth file.
+auth), it is copied into the MCP `env` block. Gateway derives control plane and
+remote UI URLs from the selected browser or personal-key session.
 
 Optional: `mcp setup --with-screenshots` downloads Playwright Chromium for
 preview captures. Omit it; MCP setup still succeeds.
@@ -117,13 +120,15 @@ Against a remote Superblocks domain (EE / SaaS IR):
 
 ```bash
 cd packages/cli/packages/cli
-./bin/dev.js config set domain <host>
-./bin/dev.js login
+./bin/dev.js mcp login --server-url https://<host>
 ./bin/dev.js mcp setup --client claude
 ```
 
 Against a local control plane, start the stack first (`just up <worktree>`),
-then login and `mcp setup` the same way.
+then use its Server origin with `mcp login --server-url <origin>` and run
+`mcp setup`. Browser login requires the Server/Auth0 setup below. Existing
+`superblocks login` and worktree personal keys still work when browser login
+is not configured.
 
 The standalone `superblocks-mcp` Admin-only server is deprecated; prefer
 `superblocks mcp setup`.
@@ -135,8 +140,7 @@ Log in and run setup from the worktree CLI (not a globally installed `superblock
 
 ```bash
 cd packages/cli/packages/cli
-./bin/dev.js config set domain <host>
-./bin/dev.js login
+./bin/dev.js mcp login --server-url https://<host>
 ./bin/dev.js mcp setup --client cursor
 # or: --client claude
 ```
@@ -165,7 +169,8 @@ for Cursor, `~/.claude.json` for Claude Code):
 `command` is `tsx` without `--watch`: the `bin/dev.js` shebang is a file
 watcher, which would kill stdio on source edits and corrupt JSON-RPC on
 stdout. `env` only copies the worktree CLI session path
-(`SUPERBLOCKS_AUTH_FILE`). Gateway reads `superblocksBaseUrl` from that file.
+(`SUPERBLOCKS_AUTH_FILE`). Gateway reads the selected browser session from the
+adjacent `.mcp-oauth` file, or `superblocksBaseUrl` from the personal-key file.
 Do not add `SUPERBLOCKS_GATEWAY_FROM_SOURCE`.
 Optional stderr tees (`2>> ~/.cursor/superblocks-gateway.err`) are host
 specific; `setup` does not write them.
@@ -194,12 +199,95 @@ at boot. A crash that `@superblocksteam/shared` does not export
 
 ## Authentication
 
-Gateway tools call the Superblocks control plane with the personal API key from
-the CLI session. Log in first (`superblocks login`). There is no issuer env, no
-consent page, and no second PAT.
+Desktop-local Claude Code plugins launch `mcp serve --browser-login` automatically. Leave
+the plugin's API token blank to use browser sign-in. Other MCP hosts can opt in
+by adding `--browser-login` to their launch arguments, or sign in explicitly
+before setup:
+
+```bash
+superblocks mcp login --server-url https://app.superblocks.com
+superblocks mcp setup --client claude
+# Restart the MCP host after setup.
+```
+
+The CLI reads public configuration from `GET /api/v1/mcp/oauth/config`, opens
+the system browser, and receives an authorization code on an OS-assigned
+`http://127.0.0.1:<port>/callback`. It exchanges that code with S256 PKCE and
+requests `openid profile email offline_access`. Gateway uses the resulting
+Server-audience access token directly; it does not retrieve a personal API key.
+The MCP connection stays on stdio. The callback port is used only during login.
+
+Credential selection, in order:
+
+1. Nonblank `SUPERBLOCKS_API_TOKEN` (including a plugin-supplied personal key).
+2. Saved browser login, provided it matches an explicit `SUPERBLOCKS_SERVER_URL`
+   or `SUPERBLOCKS_BASE_URL`. With neither set, its saved server URL is used.
+3. With `--browser-login`, ask the user to call `Login` explicitly to open
+   browser sign-in. Without the flag, use the existing CLI personal-key session.
+
+With `--browser-login`, an unusable matching browser session reports that
+`Login` is required. No account-dependent tool opens browser sign-in on its own.
+Without the flag, an unusable session reports an error instead of silently
+changing identity. Signing in manually or running `superblocks mcp logout` requires
+restarting the MCP host. Logout clears the local browser session only; it does
+not clear the legacy CLI personal key, log out the browser, or revoke Auth0
+credentials.
+
+The plugin's `set_server` tool signs in to the chosen server, saves its URL with
+the browser session, and updates the current Cowork task. When no browser
+session or explicit server URL exists, browser sign-in defaults to
+`https://app.superblocks.com`.
+
+Browser credentials are stored at `~/.superblocks/auth.json.mcp-oauth`, or
+`${SUPERBLOCKS_AUTH_FILE}.mcp-oauth` when the worktree override is set. The file
+contains access and refresh tokens and is written atomically with owner-only
+`0600` permissions; newly created parent directories use `0700`. A file lock
+coordinates refresh-token rotation across Gateway processes. A persistent random
+session ID keeps plan approvals and native-browser presence shared across those
+processes when the access token changes. A new login gets a new session ID.
+
+Server calls, Admin tools, orchestrator requests, and telemetry obtain the current
+credential before sending authenticated requests. New screenshots and Clark
+browser contexts receive the current credential as well. An already-running
+isolated browser holds a snapshot and cannot renew that token during its run;
+browser actions can fail if it expires before the run finishes. Existing scoped
+JWTs for live edit, previews, and integration execution retain their own lifetimes.
+
+### Server and Auth0 setup
+
+Configure each environment before enabling browser login:
+
+1. Create a dedicated first-party native Auth0 application with
+   `token_endpoint_auth_method: none`, the `authorization_code` and `refresh_token`
+   grants, and callback `http://127.0.0.1:8485/callback`. No client secret belongs
+   in the CLI or plugin. Auth0's native loopback matching accepts the CLI's
+   runtime-selected port for this registered URI. Enable rotating refresh tokens
+   with expiration.
+2. Enable offline access on the Server API audience (normally
+   `https://superblocks/api`) and enable the sign-in connections this application
+   needs. Keep the existing connections' client assignments when adding it.
+3. Set Server's `SUPERBLOCKS_SERVER_AUTH_NATIVE_CLIENT_ID` to the new client ID.
+   `SUPERBLOCKS_SERVER_AUTH_ISSUER_URL` and `SUPERBLOCKS_SERVER_AUTH_AUDIENCE` must
+   identify that environment's issuer and Server API. Cloud-Prem configuration
+   also includes `SUPERBLOCKS_CLOUD_PREM_AUTH0_ORG_ID` when configured.
+
+The public configuration route returns only the issuer, audience, native client
+ID, and optional organization ID, wrapped in `data`. It returns HTTP 503 when
+browser login is not configured. The system browser must be able to reach the
+loopback callback in the environment running the desktop plugin or `mcp login`;
+logging in on the host does not authenticate a separate VM or container
+filesystem.
+
+The CLI accepts Superblocks' first-party native clients only for known
+Superblocks server origins. A Cloud-Prem server on a custom domain needs a
+personal API key; its organization ID alone does not establish that the domain
+can safely receive first-party tokens.
 
 ## Cloud-Prem laptop agent
 
+On-prem deployments with signing enabled still require a personal API key.
+Their signing RPCs do not accept identity-provider access tokens.
+
 Set `GATEWAY_LOCAL_AGENT=true` for a single-user corp laptop process. Stores are
 always in-memory; suspended turns and progress cursors do not survive a restart.
 `SUPERBLOCKS_SERVER_URL` (or `GATEWAY_SERVER_URL`) points at the in-VPC control
@@ -259,23 +347,70 @@ plugin Clark cannot use as a tool.
 ## Env
 
 See `.env.example`. Stores are in-memory only. Identity comes from the CLI
-session, not from these variables.
-
-| Variable                     | Purpose                                                    |
-| ---------------------------- | ---------------------------------------------------------- |
-| `SUPERBLOCKS_SERVER_URL`     | Control plane URL (default from `auth.json` or localhost). |
-| `GATEWAY_PROFILE_KEY`        | Integration profile key (default `default`).               |
-| `GATEWAY_LOCAL_AGENT`        | Cloud-Prem laptop agent mode.                              |
-| `GATEWAY_ADMIN_TOOLS_ONLY`   | Admin tools only; skip Builder surface.                    |
-| `GATEWAY_IMPORT_SEARCH_DIRS` | Fallback folders for bare or sandbox attachment paths.     |
-| `SUPERBLOCKS_AUTH_FILE`      | Worktree-local CLI session (from `just worktree auth`).    |
-| `NODE_DEBUG=gateway`         | Tool call stacks and conditional-flow logs on stderr.      |
+session or `SUPERBLOCKS_API_TOKEN`.
+
+| Variable                     | Purpose                                                     |
+| ---------------------------- | ----------------------------------------------------------- |
+| `SUPERBLOCKS_API_TOKEN`      | Personal API key; takes precedence over saved sessions.     |
+| `SUPERBLOCKS_SERVER_URL`     | Control plane URL; browser sessions must match this origin. |
+| `GATEWAY_PROFILE_KEY`        | Integration profile key (default `default`).                |
+| `GATEWAY_LOCAL_AGENT`        | Cloud-Prem laptop agent mode.                               |
+| `GATEWAY_ADMIN_TOOLS_ONLY`   | Admin tools only; skip Builder surface.                     |
+| `GATEWAY_IMPORT_SEARCH_DIRS` | Fallback folders for bare or sandbox attachment paths.      |
+| `SUPERBLOCKS_AUTH_FILE`      | Worktree-local CLI session (from `just worktree auth`).     |
+| `NODE_DEBUG=gateway`         | Tool call stacks and conditional-flow logs on stderr.       |
 
 Gateway debug logs include tool names, result states, decision branches, and
 entry-point stacks. They intentionally omit credentials, prompts, answers, and
 result payloads. Run `superblocks mcp setup --client <client> --debug`, then
 restart the MCP host. Re-run setup without `--debug` to turn them off.
 
+## Metrics
+
+`startGatewayTelemetry` registers the OpenTelemetry MeterProvider through
+`@superblocksteam/telemetry`, so every counter in `src/telemetry/metrics.ts`
+exports over OTLP through the authenticated Server `/api/v1/metrics` proxy
+(same path and policy as traces). `service.name=gateway` and
+`deployment.environment.name` ride on the SDK resource, not on each data point.
+
+| Metric                                        | Labels                                                                                                             |
+| --------------------------------------------- | ------------------------------------------------------------------------------------------------------------------ |
+| `gateway.identity.read.outcomes`              | `gateway.outcome`: `cached`, `resolved`, `refused`, `credential_error`, `breaker_open`, `caller_timeout`, `outage` |
+| `gateway.server.read_retry.outcomes`          | `gateway.server.read_retry.outcome`, `gateway.server.read_retry.cause`, `gateway.server.read_retry.operation`      |
+| `gateway.clark.facts_flag_bootstrap.outcomes` | `gateway.clark.facts_flag_bootstrap.outcome`: `enabled`, `disabled`, `invalid`                                     |
+| `gateway.integration_profile.resolutions`     | `gateway.profile.source`, `gateway.profile.reason`, `gateway.profile.scope`                                        |
+| `gateway.mcp.tool_calls`                      | `tool.name`, `tool.status`, `mcp.client.name`                                                                      |
+| `gateway.mcp.tool_call_duration_seconds`      | same as `gateway.mcp.tool_calls`                                                                                   |
+| `gateway.checkpoint.outcomes`                 | `gateway.checkpoint.outcome`                                                                                       |
+| `gateway.process.faults`                      | `gateway.fault.kind`, `gateway.fault.fatal`                                                                        |
+| `gateway.readiness.verdicts`                  | `gateway.readiness.probe`, `gateway.readiness.ready`, `gateway.readiness.dispatch`, `gateway.readiness.upstream`   |
+
+Locally, the Server forwards the proxy to the OTel collector on `:4318`. The
+workspace `just up` (any profile) starts the LGTM stack from
+`profiles/lib/otel-lgtm.yaml`, whose collector writes to Mimir. The monorepo's
+own `docker-compose.yml` collector (`local-otel.yaml`) exports to Datadog
+instead, so the queries below assume the workspace stack. Prometheus naming applies:
+dots become underscores and counters gain `_total`. Query in Grafana
+(`http://localhost:4000`, datasource `mimir`):
+
+```promql
+# Identity-read outcome ratio: how much traffic is served from cache versus
+# failing fast on an open breaker or timing out on the caller side.
+sum by (gateway_outcome) (
+  rate(gateway_identity_read_outcomes_total{
+    service_name="gateway",
+    gateway_outcome=~"cached|breaker_open|caller_timeout"
+  }[5m])
+)
+/ ignoring(gateway_outcome) group_left
+sum(rate(gateway_identity_read_outcomes_total{service_name="gateway"}[5m]))
+```
+
+A `breaker_open` or `caller_timeout` share that climbs while `cached` falls is
+the ENG-5806 signature: the identity endpoint is failing and the cache is not
+absorbing it. Add a `deployment_environment_name` matcher to scope the panel to
+one environment.
+
 ## Remote traceability
 
 Gateway exports one OpenTelemetry trace per MCP process through the authenticated

package/dist/agents/resolve-orchestrator-url.js

@@ -7,14 +7,13 @@ export const AGENT_TYPE_ONPREMISE = 2;
 /**
  * Control-plane hosts whose `/agent` path is not the orchestrator. US prod is
  * the exception to `agent.<control-plane>` (`app.` → `agent.superblocks.com`).
- * EU/staging/dev follow the prefix and are listed so operator overrides that
+ * EU/staging follow the prefix and are listed so operator overrides that
  * omit `agentType` still rewrite.
  */
 const CLOUD_ORCHESTRATOR_URL_BY_CONTROL_PLANE_HOST = {
     "app.superblocks.com": "https://agent.superblocks.com/",
     "eu.superblocks.com": "https://agent.eu.superblocks.com/",
     "staging.superblocks.com": "https://agent.staging.superblocks.com/",
-    "dev.superblocks.com": "https://agent.dev.superblocks.com/",
 };
 export function cloudOrchestratorBaseUrlFromControlPlane(url) {
     if (!url) {

package/dist/agents/resolve-orchestrator-url.js.map

@@ -1 +1 @@
-{"version":3,"file":"resolve-orchestrator-url.js","sourceRoot":"","sources":["../../src/agents/resolve-orchestrator-url.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,UAAU,CAAC;AA6BhC,MAAM,aAAa,GAAG,QAAQ,CAAC;AAE/B,iEAAiE;AACjE,MAAM,sBAAsB,GAAG,CAAC,CAAC;AACjC,+DAA+D;AAC/D,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC;AAEtC;;;;;GAKG;AACH,MAAM,4CAA4C,GAA2B;IAC3E,qBAAqB,EAAE,gCAAgC;IACvD,oBAAoB,EAAE,mCAAmC;IACzD,yBAAyB,EAAE,wCAAwC;IACnE,qBAAqB,EAAE,oCAAoC;CAC5D,CAAC;AAEF,MAAM,UAAU,wCAAwC,CACtD,GAAuB;IAEvB,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,MAAW,CAAC;IAChB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IACxB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IACE,MAAM,CAAC,QAAQ,KAAK,QAAQ;QAC5B,MAAM,CAAC,IAAI;QACX,MAAM,CAAC,QAAQ,KAAK,WAAW;QAC/B,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,YAAY,CAAC;QACtC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,EAC3B,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,4CAA4C,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;AACvE,CAAC;AAED,SAAS,cAAc,CACrB,IAA8B,EAC9B,UAAkB;IAElB,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC;IAC9B,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvC,mEAAmE;QACnE,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;AACjE,CAAC;AAED,SAAS,kBAAkB,CAAC,IAA8B;IACxD,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC;IAC9B,OAAO,CAAC,QAAQ,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;AACtE,CAAC;AAED,SAAS,iBAAiB,CAAC,GAAW;IACpC,OAAO,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,GAAG,GAAG,CAAC;AAC7C,CAAC;AAED;;;;GAIG;AACH,SAAS,WAAW,CAAC,QAAgB;IACnC,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,KAAK,SAAS,CAAC;AACzD,CAAC;AAED,SAAS,YAAY,CAAC,GAAW;IAC/B,IAAI,CAAC;QACH,OAAO,WAAW,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC;IAC5C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,SAAS,2BAA2B,CAAC,QAAgB;IACnD,OAAO,QAAQ,KAAK,OAAO,IAAI,QAAQ,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;AAC/D,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,+BAA+B,CAC7C,GAAW,EACX,SAAkB;IAElB,IAAI,MAAW,CAAC;IAChB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IACxB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,GAAG,CAAC;IACb,CAAC;IACD,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;QAClC,OAAO,GAAG,CAAC;IACb,CAAC;IACD,MAAM,MAAM,GAAG,4CAA4C,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC7E,IAAI,MAAM,EAAE,CAAC;QACX,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,IACE,SAAS,KAAK,sBAAsB;QACpC,CAAC,2BAA2B,CAAC,MAAM,CAAC,QAAQ,CAAC,EAC7C,CAAC;QACD,OAAO,iBAAiB,MAAM,CAAC,QAAQ,GAAG,CAAC;IAC7C,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,+BAA+B,CAAC,KAI/C;IACC,IACE,KAAK,CAAC,SAAS,KAAK,SAAS;QAC7B,KAAK,CAAC,SAAS,KAAK,oBAAoB,EACxC,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,OAAO,CAAC,KAAK,CAAC,kBAAkB,CAAC,KAAK,OAAO,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;AAC7E,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,uBAAuB,CACrC,KAAmC;IAEnC,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,MAAM,CAChC,CAAC,SAAS,EAAE,EAAE,CACZ,SAAS,CAAC,IAAI,KAAK,KAAK,CAAC,SAAS;QAClC,SAAS,CAAC,MAAM,KAAK,aAAa;QAClC,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,CACzB,CAAC;IAEF,IAAI,MAA8C,CAAC;IACnD,IAAI,KAAK,CAAC,SAAS,KAAK,oBAAoB,EAAE,CAAC;QAC7C,MAAM,MAAM,GAAG,wCAAwC,CACrD,KAAK,CAAC,eAAe,CACtB,CAAC;QACF,IAAI,MAAM,EAAE,CAAC;YACX,OAAO,MAAM,CAAC;QAChB,CAAC;QACD,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,YAAY,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC;IACnE,CAAC;SAAM,IAAI,KAAK,CAAC,UAAU,EAAE,CAAC;QAC5B,MAAM,UAAU,GAAG,KAAK,CAAC,UAAU,CAAC;QACpC,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CACjC,cAAc,CAAC,SAAS,CAAC,IAAI,IAAI,EAAE,EAAE,UAAU,CAAC,CACjD,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,UAAU,EAAE,CAAC;QACjC,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CACjC,kBAAkB,CAAC,SAAS,CAAC,IAAI,IAAI,EAAE,CAAC,CACzC,CAAC;IACJ,CAAC;IAED,IAAI,KAAK,CAAC,SAAS,KAAK,oBAAoB,EAAE,CAAC;QAC7C,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,CAAC;IACvB,CAAC;IAED,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CACb,uCAAuC,KAAK,CAAC,SAAS,YACpD,KAAK,CAAC,UAAU,IAAI,SACtB,EAAE,CACH,CAAC;IACJ,CAAC;IAED,OAAO,iBAAiB,CACtB,+BAA+B,CAAC,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,SAAS,CAAC,CAC7D,CAAC;AACJ,CAAC"}
+{"version":3,"file":"resolve-orchestrator-url.js","sourceRoot":"","sources":["../../src/agents/resolve-orchestrator-url.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,UAAU,CAAC;AA6BhC,MAAM,aAAa,GAAG,QAAQ,CAAC;AAE/B,iEAAiE;AACjE,MAAM,sBAAsB,GAAG,CAAC,CAAC;AACjC,+DAA+D;AAC/D,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC;AAEtC;;;;;GAKG;AACH,MAAM,4CAA4C,GAA2B;IAC3E,qBAAqB,EAAE,gCAAgC;IACvD,oBAAoB,EAAE,mCAAmC;IACzD,yBAAyB,EAAE,wCAAwC;CACpE,CAAC;AAEF,MAAM,UAAU,wCAAwC,CACtD,GAAuB;IAEvB,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,MAAW,CAAC;IAChB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IACxB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IACE,MAAM,CAAC,QAAQ,KAAK,QAAQ;QAC5B,MAAM,CAAC,IAAI;QACX,MAAM,CAAC,QAAQ,KAAK,WAAW;QAC/B,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,YAAY,CAAC;QACtC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,EAC3B,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,4CAA4C,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;AACvE,CAAC;AAED,SAAS,cAAc,CACrB,IAA8B,EAC9B,UAAkB;IAElB,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC;IAC9B,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvC,mEAAmE;QACnE,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;AACjE,CAAC;AAED,SAAS,kBAAkB,CAAC,IAA8B;IACxD,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC;IAC9B,OAAO,CAAC,QAAQ,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;AACtE,CAAC;AAED,SAAS,iBAAiB,CAAC,GAAW;IACpC,OAAO,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,GAAG,GAAG,CAAC;AAC7C,CAAC;AAED;;;;GAIG;AACH,SAAS,WAAW,CAAC,QAAgB;IACnC,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,KAAK,SAAS,CAAC;AACzD,CAAC;AAED,SAAS,YAAY,CAAC,GAAW;IAC/B,IAAI,CAAC;QACH,OAAO,WAAW,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC;IAC5C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,SAAS,2BAA2B,CAAC,QAAgB;IACnD,OAAO,QAAQ,KAAK,OAAO,IAAI,QAAQ,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;AAC/D,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,+BAA+B,CAC7C,GAAW,EACX,SAAkB;IAElB,IAAI,MAAW,CAAC;IAChB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IACxB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,GAAG,CAAC;IACb,CAAC;IACD,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;QAClC,OAAO,GAAG,CAAC;IACb,CAAC;IACD,MAAM,MAAM,GAAG,4CAA4C,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC7E,IAAI,MAAM,EAAE,CAAC;QACX,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,IACE,SAAS,KAAK,sBAAsB;QACpC,CAAC,2BAA2B,CAAC,MAAM,CAAC,QAAQ,CAAC,EAC7C,CAAC;QACD,OAAO,iBAAiB,MAAM,CAAC,QAAQ,GAAG,CAAC;IAC7C,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,+BAA+B,CAAC,KAI/C;IACC,IACE,KAAK,CAAC,SAAS,KAAK,SAAS;QAC7B,KAAK,CAAC,SAAS,KAAK,oBAAoB,EACxC,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,OAAO,CAAC,KAAK,CAAC,kBAAkB,CAAC,KAAK,OAAO,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;AAC7E,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,uBAAuB,CACrC,KAAmC;IAEnC,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,MAAM,CAChC,CAAC,SAAS,EAAE,EAAE,CACZ,SAAS,CAAC,IAAI,KAAK,KAAK,CAAC,SAAS;QAClC,SAAS,CAAC,MAAM,KAAK,aAAa;QAClC,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,CACzB,CAAC;IAEF,IAAI,MAA8C,CAAC;IACnD,IAAI,KAAK,CAAC,SAAS,KAAK,oBAAoB,EAAE,CAAC;QAC7C,MAAM,MAAM,GAAG,wCAAwC,CACrD,KAAK,CAAC,eAAe,CACtB,CAAC;QACF,IAAI,MAAM,EAAE,CAAC;YACX,OAAO,MAAM,CAAC;QAChB,CAAC;QACD,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,YAAY,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC;IACnE,CAAC;SAAM,IAAI,KAAK,CAAC,UAAU,EAAE,CAAC;QAC5B,MAAM,UAAU,GAAG,KAAK,CAAC,UAAU,CAAC;QACpC,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CACjC,cAAc,CAAC,SAAS,CAAC,IAAI,IAAI,EAAE,EAAE,UAAU,CAAC,CACjD,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,UAAU,EAAE,CAAC;QACjC,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CACjC,kBAAkB,CAAC,SAAS,CAAC,IAAI,IAAI,EAAE,CAAC,CACzC,CAAC;IACJ,CAAC;IAED,IAAI,KAAK,CAAC,SAAS,KAAK,oBAAoB,EAAE,CAAC;QAC7C,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,CAAC;IACvB,CAAC;IAED,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CACb,uCAAuC,KAAK,CAAC,SAAS,YACpD,KAAK,CAAC,UAAU,IAAI,SACtB,EAAE,CACH,CAAC;IACJ,CAAC;IAED,OAAO,iBAAiB,CACtB,+BAA+B,CAAC,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,SAAS,CAAC,CAC7D,CAAC;AACJ,CAAC"}

package/dist/capabilities/lifecycle.d.ts

@@ -6,6 +6,7 @@ import type { AppState } from "../sabs/app-state.js";
 import { type SessionPeer } from "../sabs/session-peer.js";
 import type { SuperblocksServerClient } from "../server/client.js";
 import type { ProgressStore, RecentAppStore, StepUpTurnStore } from "../stores/types.js";
+import type { LiveStateAttaches } from "./live-state-attaches.js";
 import type { CapabilityResult, CheckAppProgressInput, CheckAppProgressResult, CheckPublishProgressInput, EditAppInput, EditAppResult, AskUserInput, AskUserResult, GetAppInput, GetAppResult, PreviewAppInput, PreviewAppResult, PreviewStatusInput, PreviewStatusResult, Principal, ProgressEvent, PublishAppInput, PublishAppResult, ResolvedPrincipal, StartAppInput, StartAppResult, UploadArtifactInput, UploadArtifactResult } from "./types.js";
 export { IMPORT_ZIP_MAX_BYTES } from "./types.js";
 export type CapabilityContext = {
@@ -17,6 +18,8 @@ export type CapabilityContext = {
     principal: Principal;
     /** Per-application facts that outlive any one turn. */
     appState: AppState;
+    /** Live-edit attaches still in flight, shared by every call to the process. */
+    liveStateAttaches: LiveStateAttaches;
     /** When each build last spoke, and whether its silence was reported. */
     progress?: ProgressStore;
     recentApps: RecentAppStore;