@vybestack/llxprt-code-mcp 0.10.0 → 0.11.0-nightly.260727.c4abf5792

package/dist/auth/src/proxy/framing.d.ts

@@ -22,11 +22,13 @@ export interface FrameDecoderOptions {
      * callback returns. Use this to close the connection or log the error.
      */
     onPartialFrameTimeout?: () => void;
+    maxFramesPerFeed?: number;
 }
 export declare class FrameDecoder {
     private buffer;
     private partialFrameTimer;
     private readonly onPartialFrameTimeout?;
+    private readonly maxFramesPerFeed?;
     constructor(options?: FrameDecoderOptions);
     feed(chunk: Buffer): Array<Record<string, unknown>>;
     reset(): void;

package/dist/auth/src/proxy/framing.js

@@ -34,8 +34,10 @@ export class FrameDecoder {
     buffer = Buffer.alloc(0);
     partialFrameTimer = null;
     onPartialFrameTimeout;
+    maxFramesPerFeed;
     constructor(options = {}) {
         this.onPartialFrameTimeout = options.onPartialFrameTimeout;
+        this.maxFramesPerFeed = options.maxFramesPerFeed;
     }
     feed(chunk) {
         this.buffer = Buffer.concat([this.buffer, chunk]);
@@ -60,6 +62,10 @@ export class FrameDecoder {
                 throw new FrameError(`Invalid JSON in frame: ${e.message}`);
             }
             frames.push(parsed);
+            if (this.maxFramesPerFeed !== undefined &&
+                frames.length > this.maxFramesPerFeed) {
+                throw new FrameError('Too many frames in one chunk');
+            }
         }
         return frames;
     }

package/dist/auth/src/proxy/framing.js.map

@@ -1 +1 @@
-{"version":3,"file":"framing.js","sourceRoot":"","sources":["../../../../../auth/src/proxy/framing.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH;;;;;;GAMG;AAEH,gFAAgF;AAEhF,MAAM,CAAC,MAAM,cAAc,GAAG,KAAK,CAAC;AACpC,MAAM,CAAC,MAAM,wBAAwB,GAAG,IAAI,CAAC;AAE7C,gFAAgF;AAEhF,MAAM,OAAO,UAAW,SAAQ,KAAK;IACnC,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;IACjB,CAAC;CACF;AAED,gFAAgF;AAEhF,MAAM,UAAU,WAAW,CAAC,OAAgC;IAC1D,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;IACrC,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAC5C,IAAI,SAAS,CAAC,MAAM,GAAG,cAAc,EAAE,CAAC;QACtC,MAAM,IAAI,UAAU,CAAC,4BAA4B,CAAC,CAAC;IACrD,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC/B,MAAM,CAAC,aAAa,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IAC1C,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC;AAC5C,CAAC;AAYD,MAAM,OAAO,YAAY;IACf,MAAM,GAAW,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACjC,iBAAiB,GAAyC,IAAI,CAAC;IACtD,qBAAqB,CAAc;IAEpD,YAAY,UAA+B,EAAE;QAC3C,IAAI,CAAC,qBAAqB,GAAG,OAAO,CAAC,qBAAqB,CAAC;IAC7D,CAAC;IAED,IAAI,CAAC,KAAa;QAChB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC;QAClD,MAAM,MAAM,GAAmC,EAAE,CAAC;QAElD,OAAO,IAAI,CAAC,MAAM,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC;YAC/B,MAAM,aAAa,GAAG,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;YAClD,IAAI,aAAa,GAAG,cAAc,EAAE,CAAC;gBACnC,MAAM,IAAI,UAAU,CAAC,4BAA4B,CAAC,CAAC;YACrD,CAAC;YACD,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,GAAG,aAAa,EAAE,CAAC;gBAC3C,IAAI,CAAC,sBAAsB,EAAE,CAAC;gBAC9B,MAAM;YACR,CAAC;YACD,IAAI,CAAC,uBAAuB,EAAE,CAAC;YAC/B,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,GAAG,aAAa,CAAC,CAAC;YAC7D,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,GAAG,aAAa,CAAC,CAAC;YACtD,IAAI,MAA+B,CAAC;YACpC,IAAI,CAAC;gBACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,CAG7C,CAAC;YACJ,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,MAAM,IAAI,UAAU,CAAC,0BAA2B,CAAW,CAAC,OAAO,EAAE,CAAC,CAAC;YACzE,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACtB,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,KAAK;QACH,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAC9B,IAAI,CAAC,uBAAuB,EAAE,CAAC;IACjC,CAAC;IAEO,sBAAsB;QAC5B,IAAI,IAAI,CAAC,iBAAiB,KAAK,IAAI;YAAE,OAAO;QAC5C,IAAI,CAAC,iBAAiB,GAAG,UAAU,CAAC,GAAG,EAAE;YACvC,IAAI,CAAC,iBAAiB,GAAG,IAAI,CAAC;YAC9B,IAAI,CAAC,qBAAqB,EAAE,EAAE,CAAC;YAC/B,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAChC,CAAC,EAAE,wBAAwB,CAAC,CAAC;IAC/B,CAAC;IAEO,uBAAuB;QAC7B,IAAI,IAAI,CAAC,iBAAiB,KAAK,IAAI,EAAE,CAAC;YACpC,YAAY,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;YACrC,IAAI,CAAC,iBAAiB,GAAG,IAAI,CAAC;QAChC,CAAC;IACH,CAAC;CACF"}
+{"version":3,"file":"framing.js","sourceRoot":"","sources":["../../../../../auth/src/proxy/framing.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH;;;;;;GAMG;AAEH,gFAAgF;AAEhF,MAAM,CAAC,MAAM,cAAc,GAAG,KAAK,CAAC;AACpC,MAAM,CAAC,MAAM,wBAAwB,GAAG,IAAI,CAAC;AAE7C,gFAAgF;AAEhF,MAAM,OAAO,UAAW,SAAQ,KAAK;IACnC,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;IACjB,CAAC;CACF;AAED,gFAAgF;AAEhF,MAAM,UAAU,WAAW,CAAC,OAAgC;IAC1D,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;IACrC,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAC5C,IAAI,SAAS,CAAC,MAAM,GAAG,cAAc,EAAE,CAAC;QACtC,MAAM,IAAI,UAAU,CAAC,4BAA4B,CAAC,CAAC;IACrD,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC/B,MAAM,CAAC,aAAa,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IAC1C,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC;AAC5C,CAAC;AAaD,MAAM,OAAO,YAAY;IACf,MAAM,GAAW,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACjC,iBAAiB,GAAyC,IAAI,CAAC;IACtD,qBAAqB,CAAc;IACnC,gBAAgB,CAAU;IAE3C,YAAY,UAA+B,EAAE;QAC3C,IAAI,CAAC,qBAAqB,GAAG,OAAO,CAAC,qBAAqB,CAAC;QAC3D,IAAI,CAAC,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,CAAC;IACnD,CAAC;IAED,IAAI,CAAC,KAAa;QAChB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC;QAClD,MAAM,MAAM,GAAmC,EAAE,CAAC;QAElD,OAAO,IAAI,CAAC,MAAM,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC;YAC/B,MAAM,aAAa,GAAG,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;YAClD,IAAI,aAAa,GAAG,cAAc,EAAE,CAAC;gBACnC,MAAM,IAAI,UAAU,CAAC,4BAA4B,CAAC,CAAC;YACrD,CAAC;YACD,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,GAAG,aAAa,EAAE,CAAC;gBAC3C,IAAI,CAAC,sBAAsB,EAAE,CAAC;gBAC9B,MAAM;YACR,CAAC;YACD,IAAI,CAAC,uBAAuB,EAAE,CAAC;YAC/B,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,GAAG,aAAa,CAAC,CAAC;YAC7D,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,GAAG,aAAa,CAAC,CAAC;YACtD,IAAI,MAA+B,CAAC;YACpC,IAAI,CAAC;gBACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,CAG7C,CAAC;YACJ,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,MAAM,IAAI,UAAU,CAAC,0BAA2B,CAAW,CAAC,OAAO,EAAE,CAAC,CAAC;YACzE,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACpB,IACE,IAAI,CAAC,gBAAgB,KAAK,SAAS;gBACnC,MAAM,CAAC,MAAM,GAAG,IAAI,CAAC,gBAAgB,EACrC,CAAC;gBACD,MAAM,IAAI,UAAU,CAAC,8BAA8B,CAAC,CAAC;YACvD,CAAC;QACH,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,KAAK;QACH,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAC9B,IAAI,CAAC,uBAAuB,EAAE,CAAC;IACjC,CAAC;IAEO,sBAAsB;QAC5B,IAAI,IAAI,CAAC,iBAAiB,KAAK,IAAI;YAAE,OAAO;QAC5C,IAAI,CAAC,iBAAiB,GAAG,UAAU,CAAC,GAAG,EAAE;YACvC,IAAI,CAAC,iBAAiB,GAAG,IAAI,CAAC;YAC9B,IAAI,CAAC,qBAAqB,EAAE,EAAE,CAAC;YAC/B,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAChC,CAAC,EAAE,wBAAwB,CAAC,CAAC;IAC/B,CAAC;IAEO,uBAAuB;QAC7B,IAAI,IAAI,CAAC,iBAAiB,KAAK,IAAI,EAAE,CAAC;YACpC,YAAY,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;YACrC,IAAI,CAAC,iBAAiB,GAAG,IAAI,CAAC;QAChC,CAAC;IACH,CAAC;CACF"}

package/dist/auth/src/proxy/proxy-socket-client.d.ts

@@ -15,6 +15,7 @@ export type ProxyResponse = {
 };
 export declare class ProxySocketClient {
     private readonly socketPath;
+    private readonly capabilityToken;
     private socket;
     private decoder;
     private pendingRequests;
@@ -22,7 +23,7 @@ export declare class ProxySocketClient {
     private idleTimer;
     private connectingPromise;
     private handshakeResolver;
-    constructor(socketPath: string);
+    constructor(socketPath: string, capabilityToken?: string);
     ensureConnected(): Promise<void>;
     private isConnected;
     request(op: string, payload: Record<string, unknown>): Promise<ProxyResponse>;
@@ -33,6 +34,12 @@ export declare class ProxySocketClient {
     private connect;
     private handshake;
     private onData;
+    /**
+     * Processes a single decoded frame. Returns true if the socket was
+     * destroyed and the caller should stop iterating.
+     */
+    private processFrame;
+    private resolveHandshake;
     private resolvePendingRequest;
     private onError;
     private onClose;

package/dist/auth/src/proxy/proxy-socket-client.js

@@ -16,8 +16,28 @@ import { encodeFrame, FrameDecoder } from './framing.js';
 export const REQUEST_TIMEOUT_MS = 30000;
 export const IDLE_TIMEOUT_MS = 300000;
 export const PROTOCOL_VERSION = 1;
+/** Validates that a decoded frame has the shape of a ProxyResponse, guarding
+ *  against adversarial or malformed server responses with unexpected types
+ *  for `ok`, `code`, or `error`. */
+function isProxyResponseFrame(frame) {
+    if (typeof frame.ok !== 'boolean')
+        return false;
+    if (frame.code !== undefined && typeof frame.code !== 'string')
+        return false;
+    if (frame.error !== undefined && typeof frame.error !== 'string')
+        return false;
+    if (frame.retryAfter !== undefined && typeof frame.retryAfter !== 'number')
+        return false;
+    if (frame.data !== undefined &&
+        (typeof frame.data !== 'object' ||
+            frame.data === null ||
+            Array.isArray(frame.data)))
+        return false;
+    return true;
+}
 export class ProxySocketClient {
     socketPath;
+    capabilityToken;
     socket = null;
     decoder = new FrameDecoder({
         onPartialFrameTimeout: () => this.handlePartialFrameTimeout(),
@@ -27,8 +47,9 @@ export class ProxySocketClient {
     idleTimer = null;
     connectingPromise = null;
     handshakeResolver = null;
-    constructor(socketPath) {
+    constructor(socketPath, capabilityToken) {
         this.socketPath = socketPath;
+        this.capabilityToken = capabilityToken;
     }
     async ensureConnected() {
         if (this.socket !== null && this.handshakeComplete) {
@@ -99,8 +120,19 @@ export class ProxySocketClient {
         this.decoder.reset();
     }
     async connectAndHandshake() {
-        await this.connect();
-        await this.handshake();
+        try {
+            await this.connect();
+            await this.handshake();
+        }
+        catch (err) {
+            try {
+                this.destroy(err instanceof Error ? err.message : 'Handshake failed');
+            }
+            catch {
+                // Swallow cleanup errors so the original failure is not masked
+            }
+            throw err;
+        }
     }
     async connect() {
         this.socket = net.createConnection(this.socketPath);
@@ -118,10 +150,14 @@ export class ProxySocketClient {
         this.socket.unref();
     }
     async handshake() {
+        const payload = { minVersion: 1, maxVersion: 1 };
+        if (this.capabilityToken) {
+            payload.capabilityToken = this.capabilityToken;
+        }
         const request = {
             v: PROTOCOL_VERSION,
             op: 'handshake',
-            payload: { minVersion: 1, maxVersion: 1 },
+            payload,
         };
         this.socket.write(encodeFrame(request));
         const response = await new Promise((resolve, reject) => {
@@ -142,7 +178,15 @@ export class ProxySocketClient {
             };
         });
         if (response.ok !== true) {
-            throw new Error('Version mismatch: ' + (response.error ?? 'unknown error'));
+            if (response.code === 'UNAUTHORIZED') {
+                throw new Error('Credential proxy authentication failed: ' +
+                    (response.error ?? 'invalid or missing capability token'));
+            }
+            const codeInfo = response.code ? ` [${response.code}]` : '';
+            throw new Error('Handshake failed' +
+                codeInfo +
+                ': ' +
+                (response.error ?? 'unknown error'));
         }
         this.handshakeComplete = true;
         this.resetIdleTimer();
@@ -151,19 +195,42 @@ export class ProxySocketClient {
         try {
             const frames = this.decoder.feed(chunk);
             for (const frame of frames) {
-                if (this.handshakeResolver) {
-                    const resolver = this.handshakeResolver;
-                    this.handshakeResolver = null;
-                    resolver.resolve(frame);
-                    continue;
-                }
-                this.resolvePendingRequest(frame);
+                if (this.processFrame(frame))
+                    return;
             }
         }
         catch {
             this.destroy('Frame decode error');
         }
     }
+    /**
+     * Processes a single decoded frame. Returns true if the socket was
+     * destroyed and the caller should stop iterating.
+     */
+    processFrame(frame) {
+        if (this.handshakeResolver) {
+            this.resolveHandshake(frame);
+            return this.socket === null;
+        }
+        this.resolvePendingRequest(frame);
+        return this.socket === null;
+    }
+    resolveHandshake(frame) {
+        const resolver = this.handshakeResolver;
+        if (resolver === null) {
+            return;
+        }
+        this.handshakeResolver = null;
+        if (isProxyResponseFrame(frame)) {
+            resolver.resolve(frame);
+        }
+        else {
+            // Reject first, then clean up. destroy() will not double-reject
+            // because handshakeResolver was already nulled above.
+            resolver.reject(new Error('Malformed handshake response from proxy'));
+            this.destroy('Malformed handshake response from proxy');
+        }
+    }
     resolvePendingRequest(frame) {
         const id = frame.id;
         if (!id) {
@@ -173,7 +240,14 @@ export class ProxySocketClient {
         if (pending) {
             clearTimeout(pending.timer);
             this.pendingRequests.delete(id);
-            pending.resolve(frame);
+            if (isProxyResponseFrame(frame)) {
+                pending.resolve(frame);
+            }
+            else {
+                pending.reject(new Error(`Malformed response for request ${id}`));
+                this.destroy('Malformed response from proxy — connection reset');
+                return;
+            }
         }
     }
     onError(_err) {

package/dist/auth/src/proxy/proxy-socket-client.js.map

@@ -1 +1 @@
-{"version":3,"file":"proxy-socket-client.js","sourceRoot":"","sources":["../../../../../auth/src/proxy/proxy-socket-client.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH;;;;;;GAMG;AAEH,OAAO,KAAK,GAAG,MAAM,UAAU,CAAC;AAChC,OAAO,KAAK,MAAM,MAAM,aAAa,CAAC;AACtC,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAEzD,MAAM,CAAC,MAAM,kBAAkB,GAAG,KAAK,CAAC;AACxC,MAAM,CAAC,MAAM,eAAe,GAAG,MAAM,CAAC;AACtC,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC;AAgBlC,MAAM,OAAO,iBAAiB;IACX,UAAU,CAAS;IAC5B,MAAM,GAAsB,IAAI,CAAC;IACjC,OAAO,GAAiB,IAAI,YAAY,CAAC;QAC/C,qBAAqB,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,yBAAyB,EAAE;KAC9D,CAAC,CAAC;IACK,eAAe,GAAgC,IAAI,GAAG,EAAE,CAAC;IACzD,iBAAiB,GAAY,KAAK,CAAC;IACnC,SAAS,GAAyC,IAAI,CAAC;IACvD,iBAAiB,GAAyB,IAAI,CAAC;IAC/C,iBAAiB,GAGd,IAAI,CAAC;IAEhB,YAAY,UAAkB;QAC5B,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;IAC/B,CAAC;IAED,KAAK,CAAC,eAAe;QACnB,IAAI,IAAI,CAAC,MAAM,KAAK,IAAI,IAAI,IAAI,CAAC,iBAAiB,EAAE,CAAC;YACnD,IAAI,CAAC,cAAc,EAAE,CAAC;YACtB,OAAO;QACT,CAAC;QACD,IAAI,IAAI,CAAC,iBAAiB,EAAE,CAAC;YAC3B,MAAM,IAAI,CAAC,iBAAiB,CAAC;YAC7B,OAAO;QACT,CAAC;QACD,IAAI,CAAC,iBAAiB,GAAG,IAAI,CAAC,mBAAmB,EAAE,CAAC;QACpD,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,iBAAiB,CAAC;QAC/B,CAAC;gBAAS,CAAC;YACT,IAAI,CAAC,iBAAiB,GAAG,IAAI,CAAC;QAChC,CAAC;IACH,CAAC;IAEO,WAAW;QACjB,OAAO,IAAI,CAAC,MAAM,KAAK,IAAI,IAAI,IAAI,CAAC,iBAAiB,CAAC;IACxD,CAAC;IAED,KAAK,CAAC,OAAO,CACX,EAAU,EACV,OAAgC;QAEhC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;YACxB,MAAM,IAAI,CAAC,eAAe,EAAE,CAAC;QAC/B,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,cAAc,EAAE,CAAC;QACxB,CAAC;QACD,OAAO,IAAI,CAAC,WAAW,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;IACvC,CAAC;IAEO,WAAW,CACjB,EAAU,EACV,OAAgC;QAEhC,MAAM,EAAE,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;QAC/B,MAAM,KAAK,GAAG,EAAE,CAAC,EAAE,gBAAgB,EAAE,EAAE,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC;QAEvD,MAAM,OAAO,GAAG,IAAI,OAAO,CAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YAC7D,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;gBAC5B,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;gBAChC,MAAM,CAAC,IAAI,KAAK,CAAC,2BAA2B,kBAAkB,IAAI,CAAC,CAAC,CAAC;YACvE,CAAC,EAAE,kBAAkB,CAAC,CAAC;YACvB,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;QAC3D,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC,MAAO,CAAC,KAAK,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC;QACvC,IAAI,CAAC,cAAc,EAAE,CAAC;QACtB,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,KAAK;QACH,IAAI,CAAC,eAAe,EAAE,CAAC;QACvB,IAAI,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;IAChC,CAAC;IAED,aAAa;QACX,IAAI,CAAC,iBAAiB,GAAG,KAAK,CAAC;QAC/B,8BAA8B;QAC9B,KAAK,MAAM,CAAC,EAAE,OAAO,CAAC,IAAI,IAAI,CAAC,eAAe,EAAE,CAAC;YAC/C,YAAY,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;YAC5B,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAC,CAAC;QAClD,CAAC;QACD,IAAI,CAAC,eAAe,CAAC,KAAK,EAAE,CAAC;QAC7B,IAAI,IAAI,CAAC,iBAAiB,EAAE,CAAC;YAC3B,MAAM,QAAQ,GAAG,IAAI,CAAC,iBAAiB,CAAC;YACxC,IAAI,CAAC,iBAAiB,GAAG,IAAI,CAAC;YAC9B,QAAQ,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAC,CAAC;QACnD,CAAC;QACD,IAAI,IAAI,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC;YACzB,gFAAgF;YAChF,IAAI,CAAC,MAAM,CAAC,kBAAkB,EAAE,CAAC;YACjC,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC;YAClB,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;QACrB,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;IACvB,CAAC;IAEO,KAAK,CAAC,mBAAmB;QAC/B,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;QACrB,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC;IACzB,CAAC;IAEO,KAAK,CAAC,OAAO;QACnB,IAAI,CAAC,MAAM,GAAG,GAAG,CAAC,gBAAgB,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACpD,IAAI,CAAC,OAAO,GAAG,IAAI,YAAY,CAAC;YAC9B,qBAAqB,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,yBAAyB,EAAE;SAC9D,CAAC,CAAC;QACH,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QAC9D,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAU,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;QAC3D,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC;QAC5C,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC;QAC9C,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YAC1C,IAAI,CAAC,MAAO,CAAC,IAAI,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;YACtC,IAAI,CAAC,MAAO,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QACrC,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;IACtB,CAAC;IAEO,KAAK,CAAC,SAAS;QACrB,MAAM,OAAO,GAAG;YACd,CAAC,EAAE,gBAAgB;YACnB,EAAE,EAAE,WAAW;YACf,OAAO,EAAE,EAAE,UAAU,EAAE,CAAC,EAAE,UAAU,EAAE,CAAC,EAAE;SAC1C,CAAC;QACF,IAAI,CAAC,MAAO,CAAC,KAAK,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC;QAEzC,MAAM,QAAQ,GAAG,MAAM,IAAI,OAAO,CAChC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YAClB,IAAI,CAAC,iBAAiB,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;YAC7C,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;gBAC5B,IAAI,CAAC,iBAAiB,GAAG,IAAI,CAAC;gBAC9B,MAAM,CACJ,IAAI,KAAK,CAAC,6BAA6B,kBAAkB,IAAI,CAAC,CAC/D,CAAC;YACJ,CAAC,EAAE,kBAAkB,CAAC,CAAC;YAEvB,MAAM,eAAe,GAAG,IAAI,CAAC,iBAAiB,CAAC,OAAO,CAAC;YACvD,IAAI,CAAC,iBAAiB,CAAC,OAAO,GAAG,CAAC,KAAK,EAAE,EAAE;gBACzC,YAAY,CAAC,KAAK,CAAC,CAAC;gBACpB,eAAe,CAAC,KAAK,CAAC,CAAC;YACzB,CAAC,CAAC;YACF,MAAM,cAAc,GAAG,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC;YACrD,IAAI,CAAC,iBAAiB,CAAC,MAAM,GAAG,CAAC,MAAM,EAAE,EAAE;gBACzC,YAAY,CAAC,KAAK,CAAC,CAAC;gBACpB,cAAc,CAAC,MAAM,CAAC,CAAC;YACzB,CAAC,CAAC;QACJ,CAAC,CACF,CAAC;QAEF,IAAI,QAAQ,CAAC,EAAE,KAAK,IAAI,EAAE,CAAC;YACzB,MAAM,IAAI,KAAK,CACb,oBAAoB,GAAG,CAAC,QAAQ,CAAC,KAAK,IAAI,eAAe,CAAC,CAC3D,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,iBAAiB,GAAG,IAAI,CAAC;QAC9B,IAAI,CAAC,cAAc,EAAE,CAAC;IACxB,CAAC;IAEO,MAAM,CAAC,KAAa;QAC1B,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACxC,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;gBAC3B,IAAI,IAAI,CAAC,iBAAiB,EAAE,CAAC;oBAC3B,MAAM,QAAQ,GAAG,IAAI,CAAC,iBAAiB,CAAC;oBACxC,IAAI,CAAC,iBAAiB,GAAG,IAAI,CAAC;oBAC9B,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;oBACxB,SAAS;gBACX,CAAC;gBAED,IAAI,CAAC,qBAAqB,CAAC,KAAK,CAAC,CAAC;YACpC,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,CAAC,OAAO,CAAC,oBAAoB,CAAC,CAAC;QACrC,CAAC;IACH,CAAC;IAEO,qBAAqB,CAAC,KAA8B;QAC1D,MAAM,EAAE,GAAG,KAAK,CAAC,EAAwB,CAAC;QAC1C,IAAI,CAAC,EAAE,EAAE,CAAC;YACR,OAAO;QACT,CAAC;QACD,MAAM,OAAO,GAAG,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC7C,IAAI,OAAO,EAAE,CAAC;YACZ,YAAY,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;YAC5B,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YAChC,OAAO,CAAC,OAAO,CAAC,KAAiC,CAAC,CAAC;QACrD,CAAC;IACH,CAAC;IAEO,OAAO,CAAC,IAAW;QACzB,IAAI,CAAC,OAAO,CAAC,wDAAwD,CAAC,CAAC;IACzE,CAAC;IAEO,OAAO;QACb,IAAI,IAAI,CAAC,iBAAiB,IAAI,IAAI,CAAC,iBAAiB,EAAE,CAAC;YACrD,IAAI,CAAC,OAAO,CAAC,wDAAwD,CAAC,CAAC;QACzE,CAAC;IACH,CAAC;IAEO,yBAAyB;QAC/B,IAAI,CAAC,OAAO,CACV,mEAAmE,CACpE,CAAC;IACJ,CAAC;IAEO,OAAO,CAAC,OAAe;QAC7B,IAAI,CAAC,eAAe,EAAE,CAAC;QAEvB,KAAK,MAAM,CAAC,EAAE,OAAO,CAAC,IAAI,IAAI,CAAC,eAAe,EAAE,CAAC;YAC/C,YAAY,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;YAC5B,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;QACrC,CAAC;QACD,IAAI,CAAC,eAAe,CAAC,KAAK,EAAE,CAAC;QAE7B,IAAI,CAAC,iBAAiB,GAAG,KAAK,CAAC;QAE/B,IAAI,IAAI,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC;YACzB,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACtB,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;QACrB,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;QAErB,IAAI,IAAI,CAAC,iBAAiB,EAAE,CAAC;YAC3B,MAAM,QAAQ,GAAG,IAAI,CAAC,iBAAiB,CAAC;YACxC,IAAI,CAAC,iBAAiB,GAAG,IAAI,CAAC;YAC9B,QAAQ,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;QACtC,CAAC;IACH,CAAC;IAEO,cAAc;QACpB,IAAI,CAAC,eAAe,EAAE,CAAC;QACvB,IAAI,CAAC,SAAS,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,aAAa,EAAE,EAAE,eAAe,CAAC,CAAC;QACzE,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC;IACzB,CAAC;IAEO,eAAe;QACrB,IAAI,IAAI,CAAC,SAAS,KAAK,IAAI,EAAE,CAAC;YAC5B,YAAY,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YAC7B,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC;QACxB,CAAC;IACH,CAAC;CACF"}
+{"version":3,"file":"proxy-socket-client.js","sourceRoot":"","sources":["../../../../../auth/src/proxy/proxy-socket-client.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH;;;;;;GAMG;AAEH,OAAO,KAAK,GAAG,MAAM,UAAU,CAAC;AAChC,OAAO,KAAK,MAAM,MAAM,aAAa,CAAC;AACtC,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAEzD,MAAM,CAAC,MAAM,kBAAkB,GAAG,KAAK,CAAC;AACxC,MAAM,CAAC,MAAM,eAAe,GAAG,MAAM,CAAC;AACtC,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC;AAUlC;;oCAEoC;AACpC,SAAS,oBAAoB,CAC3B,KAA8B;IAE9B,IAAI,OAAO,KAAK,CAAC,EAAE,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IAChD,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,IAAI,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC7E,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS,IAAI,OAAO,KAAK,CAAC,KAAK,KAAK,QAAQ;QAC9D,OAAO,KAAK,CAAC;IACf,IAAI,KAAK,CAAC,UAAU,KAAK,SAAS,IAAI,OAAO,KAAK,CAAC,UAAU,KAAK,QAAQ;QACxE,OAAO,KAAK,CAAC;IACf,IACE,KAAK,CAAC,IAAI,KAAK,SAAS;QACxB,CAAC,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ;YAC7B,KAAK,CAAC,IAAI,KAAK,IAAI;YACnB,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAE5B,OAAO,KAAK,CAAC;IACf,OAAO,IAAI,CAAC;AACd,CAAC;AAQD,MAAM,OAAO,iBAAiB;IACX,UAAU,CAAS;IACnB,eAAe,CAAqB;IAC7C,MAAM,GAAsB,IAAI,CAAC;IACjC,OAAO,GAAiB,IAAI,YAAY,CAAC;QAC/C,qBAAqB,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,yBAAyB,EAAE;KAC9D,CAAC,CAAC;IACK,eAAe,GAAgC,IAAI,GAAG,EAAE,CAAC;IACzD,iBAAiB,GAAY,KAAK,CAAC;IACnC,SAAS,GAAyC,IAAI,CAAC;IACvD,iBAAiB,GAAyB,IAAI,CAAC;IAC/C,iBAAiB,GAGd,IAAI,CAAC;IAEhB,YAAY,UAAkB,EAAE,eAAwB;QACtD,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;QAC7B,IAAI,CAAC,eAAe,GAAG,eAAe,CAAC;IACzC,CAAC;IAED,KAAK,CAAC,eAAe;QACnB,IAAI,IAAI,CAAC,MAAM,KAAK,IAAI,IAAI,IAAI,CAAC,iBAAiB,EAAE,CAAC;YACnD,IAAI,CAAC,cAAc,EAAE,CAAC;YACtB,OAAO;QACT,CAAC;QACD,IAAI,IAAI,CAAC,iBAAiB,EAAE,CAAC;YAC3B,MAAM,IAAI,CAAC,iBAAiB,CAAC;YAC7B,OAAO;QACT,CAAC;QACD,IAAI,CAAC,iBAAiB,GAAG,IAAI,CAAC,mBAAmB,EAAE,CAAC;QACpD,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,iBAAiB,CAAC;QAC/B,CAAC;gBAAS,CAAC;YACT,IAAI,CAAC,iBAAiB,GAAG,IAAI,CAAC;QAChC,CAAC;IACH,CAAC;IAEO,WAAW;QACjB,OAAO,IAAI,CAAC,MAAM,KAAK,IAAI,IAAI,IAAI,CAAC,iBAAiB,CAAC;IACxD,CAAC;IAED,KAAK,CAAC,OAAO,CACX,EAAU,EACV,OAAgC;QAEhC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;YACxB,MAAM,IAAI,CAAC,eAAe,EAAE,CAAC;QAC/B,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,cAAc,EAAE,CAAC;QACxB,CAAC;QACD,OAAO,IAAI,CAAC,WAAW,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;IACvC,CAAC;IAEO,WAAW,CACjB,EAAU,EACV,OAAgC;QAEhC,MAAM,EAAE,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;QAC/B,MAAM,KAAK,GAAG,EAAE,CAAC,EAAE,gBAAgB,EAAE,EAAE,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC;QAEvD,MAAM,OAAO,GAAG,IAAI,OAAO,CAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YAC7D,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;gBAC5B,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;gBAChC,MAAM,CAAC,IAAI,KAAK,CAAC,2BAA2B,kBAAkB,IAAI,CAAC,CAAC,CAAC;YACvE,CAAC,EAAE,kBAAkB,CAAC,CAAC;YACvB,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;QAC3D,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC,MAAO,CAAC,KAAK,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC;QACvC,IAAI,CAAC,cAAc,EAAE,CAAC;QACtB,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,KAAK;QACH,IAAI,CAAC,eAAe,EAAE,CAAC;QACvB,IAAI,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;IAChC,CAAC;IAED,aAAa;QACX,IAAI,CAAC,iBAAiB,GAAG,KAAK,CAAC;QAC/B,8BAA8B;QAC9B,KAAK,MAAM,CAAC,EAAE,OAAO,CAAC,IAAI,IAAI,CAAC,eAAe,EAAE,CAAC;YAC/C,YAAY,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;YAC5B,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAC,CAAC;QAClD,CAAC;QACD,IAAI,CAAC,eAAe,CAAC,KAAK,EAAE,CAAC;QAC7B,IAAI,IAAI,CAAC,iBAAiB,EAAE,CAAC;YAC3B,MAAM,QAAQ,GAAG,IAAI,CAAC,iBAAiB,CAAC;YACxC,IAAI,CAAC,iBAAiB,GAAG,IAAI,CAAC;YAC9B,QAAQ,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAC,CAAC;QACnD,CAAC;QACD,IAAI,IAAI,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC;YACzB,gFAAgF;YAChF,IAAI,CAAC,MAAM,CAAC,kBAAkB,EAAE,CAAC;YACjC,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC;YAClB,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;QACrB,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;IACvB,CAAC;IAEO,KAAK,CAAC,mBAAmB;QAC/B,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;YACrB,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC;QACzB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC;gBACH,IAAI,CAAC,OAAO,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC;YACxE,CAAC;YAAC,MAAM,CAAC;gBACP,+DAA+D;YACjE,CAAC;YACD,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,OAAO;QACnB,IAAI,CAAC,MAAM,GAAG,GAAG,CAAC,gBAAgB,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACpD,IAAI,CAAC,OAAO,GAAG,IAAI,YAAY,CAAC;YAC9B,qBAAqB,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,yBAAyB,EAAE;SAC9D,CAAC,CAAC;QACH,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QAC9D,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAU,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;QAC3D,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC;QAC5C,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC;QAC9C,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YAC1C,IAAI,CAAC,MAAO,CAAC,IAAI,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;YACtC,IAAI,CAAC,MAAO,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QACrC,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;IACtB,CAAC;IAEO,KAAK,CAAC,SAAS;QACrB,MAAM,OAAO,GAA4B,EAAE,UAAU,EAAE,CAAC,EAAE,UAAU,EAAE,CAAC,EAAE,CAAC;QAC1E,IAAI,IAAI,CAAC,eAAe,EAAE,CAAC;YACzB,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC,eAAe,CAAC;QACjD,CAAC;QACD,MAAM,OAAO,GAAG;YACd,CAAC,EAAE,gBAAgB;YACnB,EAAE,EAAE,WAAW;YACf,OAAO;SACR,CAAC;QACF,IAAI,CAAC,MAAO,CAAC,KAAK,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC;QAEzC,MAAM,QAAQ,GAAG,MAAM,IAAI,OAAO,CAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACpE,IAAI,CAAC,iBAAiB,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;YAC7C,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;gBAC5B,IAAI,CAAC,iBAAiB,GAAG,IAAI,CAAC;gBAC9B,MAAM,CAAC,IAAI,KAAK,CAAC,6BAA6B,kBAAkB,IAAI,CAAC,CAAC,CAAC;YACzE,CAAC,EAAE,kBAAkB,CAAC,CAAC;YAEvB,MAAM,eAAe,GAAG,IAAI,CAAC,iBAAiB,CAAC,OAAO,CAAC;YACvD,IAAI,CAAC,iBAAiB,CAAC,OAAO,GAAG,CAAC,KAAK,EAAE,EAAE;gBACzC,YAAY,CAAC,KAAK,CAAC,CAAC;gBACpB,eAAe,CAAC,KAAK,CAAC,CAAC;YACzB,CAAC,CAAC;YACF,MAAM,cAAc,GAAG,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC;YACrD,IAAI,CAAC,iBAAiB,CAAC,MAAM,GAAG,CAAC,MAAM,EAAE,EAAE;gBACzC,YAAY,CAAC,KAAK,CAAC,CAAC;gBACpB,cAAc,CAAC,MAAM,CAAC,CAAC;YACzB,CAAC,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,IAAI,QAAQ,CAAC,EAAE,KAAK,IAAI,EAAE,CAAC;YACzB,IAAI,QAAQ,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;gBACrC,MAAM,IAAI,KAAK,CACb,0CAA0C;oBACxC,CAAC,QAAQ,CAAC,KAAK,IAAI,qCAAqC,CAAC,CAC5D,CAAC;YACJ,CAAC;YACD,MAAM,QAAQ,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,QAAQ,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;YAC5D,MAAM,IAAI,KAAK,CACb,kBAAkB;gBAChB,QAAQ;gBACR,IAAI;gBACJ,CAAC,QAAQ,CAAC,KAAK,IAAI,eAAe,CAAC,CACtC,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,iBAAiB,GAAG,IAAI,CAAC;QAC9B,IAAI,CAAC,cAAc,EAAE,CAAC;IACxB,CAAC;IAEO,MAAM,CAAC,KAAa;QAC1B,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACxC,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;gBAC3B,IAAI,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC;oBAAE,OAAO;YACvC,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,CAAC,OAAO,CAAC,oBAAoB,CAAC,CAAC;QACrC,CAAC;IACH,CAAC;IAED;;;OAGG;IACK,YAAY,CAAC,KAA8B;QACjD,IAAI,IAAI,CAAC,iBAAiB,EAAE,CAAC;YAC3B,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC;YAC7B,OAAO,IAAI,CAAC,MAAM,KAAK,IAAI,CAAC;QAC9B,CAAC;QACD,IAAI,CAAC,qBAAqB,CAAC,KAAK,CAAC,CAAC;QAClC,OAAO,IAAI,CAAC,MAAM,KAAK,IAAI,CAAC;IAC9B,CAAC;IAEO,gBAAgB,CAAC,KAA8B;QACrD,MAAM,QAAQ,GAAG,IAAI,CAAC,iBAAiB,CAAC;QACxC,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;YACtB,OAAO;QACT,CAAC;QACD,IAAI,CAAC,iBAAiB,GAAG,IAAI,CAAC;QAC9B,IAAI,oBAAoB,CAAC,KAAK,CAAC,EAAE,CAAC;YAChC,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QAC1B,CAAC;aAAM,CAAC;YACN,gEAAgE;YAChE,sDAAsD;YACtD,QAAQ,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC,CAAC;YACtE,IAAI,CAAC,OAAO,CAAC,yCAAyC,CAAC,CAAC;QAC1D,CAAC;IACH,CAAC;IAEO,qBAAqB,CAAC,KAA8B;QAC1D,MAAM,EAAE,GAAG,KAAK,CAAC,EAAwB,CAAC;QAC1C,IAAI,CAAC,EAAE,EAAE,CAAC;YACR,OAAO;QACT,CAAC;QACD,MAAM,OAAO,GAAG,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC7C,IAAI,OAAO,EAAE,CAAC;YACZ,YAAY,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;YAC5B,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YAChC,IAAI,oBAAoB,CAAC,KAAK,CAAC,EAAE,CAAC;gBAChC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;YACzB,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,kCAAkC,EAAE,EAAE,CAAC,CAAC,CAAC;gBAClE,IAAI,CAAC,OAAO,CAAC,kDAAkD,CAAC,CAAC;gBACjE,OAAO;YACT,CAAC;QACH,CAAC;IACH,CAAC;IAEO,OAAO,CAAC,IAAW;QACzB,IAAI,CAAC,OAAO,CAAC,wDAAwD,CAAC,CAAC;IACzE,CAAC;IAEO,OAAO;QACb,IAAI,IAAI,CAAC,iBAAiB,IAAI,IAAI,CAAC,iBAAiB,EAAE,CAAC;YACrD,IAAI,CAAC,OAAO,CAAC,wDAAwD,CAAC,CAAC;QACzE,CAAC;IACH,CAAC;IAEO,yBAAyB;QAC/B,IAAI,CAAC,OAAO,CACV,mEAAmE,CACpE,CAAC;IACJ,CAAC;IAEO,OAAO,CAAC,OAAe;QAC7B,IAAI,CAAC,eAAe,EAAE,CAAC;QAEvB,KAAK,MAAM,CAAC,EAAE,OAAO,CAAC,IAAI,IAAI,CAAC,eAAe,EAAE,CAAC;YAC/C,YAAY,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;YAC5B,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;QACrC,CAAC;QACD,IAAI,CAAC,eAAe,CAAC,KAAK,EAAE,CAAC;QAE7B,IAAI,CAAC,iBAAiB,GAAG,KAAK,CAAC;QAE/B,IAAI,IAAI,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC;YACzB,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACtB,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;QACrB,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;QAErB,IAAI,IAAI,CAAC,iBAAiB,EAAE,CAAC;YAC3B,MAAM,QAAQ,GAAG,IAAI,CAAC,iBAAiB,CAAC;YACxC,IAAI,CAAC,iBAAiB,GAAG,IAAI,CAAC;YAC9B,QAAQ,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;QACtC,CAAC;IACH,CAAC;IAEO,cAAc;QACpB,IAAI,CAAC,eAAe,EAAE,CAAC;QACvB,IAAI,CAAC,SAAS,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,aAAa,EAAE,EAAE,eAAe,CAAC,CAAC;QACzE,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC;IACzB,CAAC;IAEO,eAAe;QACrB,IAAI,IAAI,CAAC,SAAS,KAAK,IAAI,EAAE,CAAC;YAC5B,YAAY,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YAC7B,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC;QACxB,CAAC;IACH,CAAC;CACF"}

package/dist/auth/src/proxy/proxy-token-store.d.ts

@@ -16,7 +16,7 @@ import { type TokenStore } from '../token-store.js';
 import { ProxySocketClient } from './proxy-socket-client.js';
 export declare class ProxyTokenStore implements TokenStore {
     private readonly client;
-    constructor(socketPath: string);
+    constructor(socketPath: string, capabilityToken?: string);
     getToken(provider: string, bucket?: string): Promise<OAuthToken | null>;
     saveToken(provider: string, token: OAuthToken, bucket?: string): Promise<void>;
     removeToken(provider: string, bucket?: string): Promise<void>;

package/dist/auth/src/proxy/proxy-token-store.js

@@ -6,8 +6,8 @@
 import { ProxySocketClient } from './proxy-socket-client.js';
 export class ProxyTokenStore {
     client;
-    constructor(socketPath) {
-        this.client = new ProxySocketClient(socketPath);
+    constructor(socketPath, capabilityToken) {
+        this.client = new ProxySocketClient(socketPath, capabilityToken);
     }
     async getToken(provider, bucket) {
         const response = await this.client.request('get_token', {

package/dist/auth/src/proxy/proxy-token-store.js.map

@@ -1 +1 @@
-{"version":3,"file":"proxy-token-store.js","sourceRoot":"","sources":["../../../../../auth/src/proxy/proxy-token-store.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAaH,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAE7D,MAAM,OAAO,eAAe;IACT,MAAM,CAAoB;IAE3C,YAAY,UAAkB;QAC5B,IAAI,CAAC,MAAM,GAAG,IAAI,iBAAiB,CAAC,UAAU,CAAC,CAAC;IAClD,CAAC;IAED,KAAK,CAAC,QAAQ,CACZ,QAAgB,EAChB,MAAe;QAEf,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,WAAW,EAAE;YACtD,QAAQ;YACR,MAAM;SACP,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,QAAQ,CAAC,IAAI,KAAK,WAAW;YAAE,OAAO,IAAI,CAAC;QAC/D,IAAI,CAAC,QAAQ,CAAC,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,QAAQ,CAAC,KAAK,IAAI,aAAa,CAAC,CAAC;QACnE,OAAO,QAAQ,CAAC,IAA6B,CAAC;IAChD,CAAC;IAED,KAAK,CAAC,SAAS,CACb,QAAgB,EAChB,KAAiB,EACjB,MAAe;QAEf,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,YAAY,EAAE;YACvD,QAAQ;YACR,MAAM;YACN,KAAK;SACN,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,QAAQ,CAAC,KAAK,IAAI,aAAa,CAAC,CAAC;IACrE,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,QAAgB,EAAE,MAAe;QACjD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,cAAc,EAAE;YACzD,QAAQ;YACR,MAAM;SACP,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,QAAQ,CAAC,KAAK,IAAI,aAAa,CAAC,CAAC;IACrE,CAAC;IAED,KAAK,CAAC,aAAa;QACjB,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,gBAAgB,EAAE,EAAE,CAAC,CAAC;QACjE,IAAI,CAAC,QAAQ,CAAC,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,QAAQ,CAAC,KAAK,IAAI,aAAa,CAAC,CAAC;QACnE,OAAQ,QAAQ,CAAC,IAAgC,CAAC,SAAqB,CAAC;IAC1E,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,QAAgB;QAChC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC;QACzE,IAAI,CAAC,QAAQ,CAAC,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,QAAQ,CAAC,KAAK,IAAI,aAAa,CAAC,CAAC;QACnE,OAAQ,QAAQ,CAAC,IAAgC,CAAC,OAAmB,CAAC;IACxE,CAAC;IAED,KAAK,CAAC,cAAc,CAClB,QAAgB,EAChB,MAAc;QAEd,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,kBAAkB,EAAE;YAC7D,QAAQ;YACR,MAAM;SACP,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,QAAQ,CAAC,IAAI,KAAK,WAAW;YAAE,OAAO,IAAI,CAAC;QAC/D,IAAI,CAAC,QAAQ,CAAC,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,QAAQ,CAAC,KAAK,IAAI,aAAa,CAAC,CAAC;QACnE,MAAM,IAAI,GAAG,QAAQ,CAAC,IAA+B,CAAC;QACtD,OAAO;YACL,MAAM;YACN,YAAY,EACV,OAAO,IAAI,CAAC,YAAY,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;YAC/D,UAAU,EAAE,OAAO,IAAI,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;YACrE,QAAQ,EAAE,IAAI,CAAC,QAA8B;SAC9C,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,kBAAkB,CACtB,SAAiB,EACjB,QAA+C;QAE/C,OAAO,IAAI,CAAC;IACd,CAAC;IAED,KAAK,CAAC,kBAAkB,CAAC,SAAiB,EAAE,OAAgB;QAC1D,8CAA8C;IAChD,CAAC;IAED,KAAK,CAAC,eAAe,CACnB,SAAiB,EACjB,QAA+C;QAE/C,OAAO,IAAI,CAAC;IACd,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,SAAiB,EAAE,OAAgB;QACvD,2CAA2C;IAC7C,CAAC;IAED,SAAS;QACP,OAAO,IAAI,CAAC,MAAM,CAAC;IACrB,CAAC;CACF"}
+{"version":3,"file":"proxy-token-store.js","sourceRoot":"","sources":["../../../../../auth/src/proxy/proxy-token-store.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAaH,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAE7D,MAAM,OAAO,eAAe;IACT,MAAM,CAAoB;IAE3C,YAAY,UAAkB,EAAE,eAAwB;QACtD,IAAI,CAAC,MAAM,GAAG,IAAI,iBAAiB,CAAC,UAAU,EAAE,eAAe,CAAC,CAAC;IACnE,CAAC;IAED,KAAK,CAAC,QAAQ,CACZ,QAAgB,EAChB,MAAe;QAEf,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,WAAW,EAAE;YACtD,QAAQ;YACR,MAAM;SACP,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,QAAQ,CAAC,IAAI,KAAK,WAAW;YAAE,OAAO,IAAI,CAAC;QAC/D,IAAI,CAAC,QAAQ,CAAC,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,QAAQ,CAAC,KAAK,IAAI,aAAa,CAAC,CAAC;QACnE,OAAO,QAAQ,CAAC,IAA6B,CAAC;IAChD,CAAC;IAED,KAAK,CAAC,SAAS,CACb,QAAgB,EAChB,KAAiB,EACjB,MAAe;QAEf,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,YAAY,EAAE;YACvD,QAAQ;YACR,MAAM;YACN,KAAK;SACN,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,QAAQ,CAAC,KAAK,IAAI,aAAa,CAAC,CAAC;IACrE,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,QAAgB,EAAE,MAAe;QACjD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,cAAc,EAAE;YACzD,QAAQ;YACR,MAAM;SACP,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,QAAQ,CAAC,KAAK,IAAI,aAAa,CAAC,CAAC;IACrE,CAAC;IAED,KAAK,CAAC,aAAa;QACjB,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,gBAAgB,EAAE,EAAE,CAAC,CAAC;QACjE,IAAI,CAAC,QAAQ,CAAC,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,QAAQ,CAAC,KAAK,IAAI,aAAa,CAAC,CAAC;QACnE,OAAQ,QAAQ,CAAC,IAAgC,CAAC,SAAqB,CAAC;IAC1E,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,QAAgB;QAChC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC;QACzE,IAAI,CAAC,QAAQ,CAAC,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,QAAQ,CAAC,KAAK,IAAI,aAAa,CAAC,CAAC;QACnE,OAAQ,QAAQ,CAAC,IAAgC,CAAC,OAAmB,CAAC;IACxE,CAAC;IAED,KAAK,CAAC,cAAc,CAClB,QAAgB,EAChB,MAAc;QAEd,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,kBAAkB,EAAE;YAC7D,QAAQ;YACR,MAAM;SACP,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,QAAQ,CAAC,IAAI,KAAK,WAAW;YAAE,OAAO,IAAI,CAAC;QAC/D,IAAI,CAAC,QAAQ,CAAC,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,QAAQ,CAAC,KAAK,IAAI,aAAa,CAAC,CAAC;QACnE,MAAM,IAAI,GAAG,QAAQ,CAAC,IAA+B,CAAC;QACtD,OAAO;YACL,MAAM;YACN,YAAY,EACV,OAAO,IAAI,CAAC,YAAY,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;YAC/D,UAAU,EAAE,OAAO,IAAI,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;YACrE,QAAQ,EAAE,IAAI,CAAC,QAA8B;SAC9C,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,kBAAkB,CACtB,SAAiB,EACjB,QAA+C;QAE/C,OAAO,IAAI,CAAC;IACd,CAAC;IAED,KAAK,CAAC,kBAAkB,CAAC,SAAiB,EAAE,OAAgB;QAC1D,8CAA8C;IAChD,CAAC;IAED,KAAK,CAAC,eAAe,CACnB,SAAiB,EACjB,QAA+C;QAE/C,OAAO,IAAI,CAAC;IACd,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,SAAiB,EAAE,OAAgB;QACvD,2CAA2C;IAC7C,CAAC;IAED,SAAS;QACP,OAAO,IAAI,CAAC,MAAM,CAAC;IACrB,CAAC;CACF"}

package/dist/core/src/config/config.d.ts

@@ -19,6 +19,7 @@ import type { ShellExecutionConfig } from '../services/shellExecutionService.js'
 import type { ToolSchedulerContract } from '../core/toolSchedulerContract.js';
 export declare class Config extends ConfigBase {
     private static readonly logger;
+    private readonly liveTrustTransitionLifecycle;
     constructor(params: ConfigParameters);
     private mcpDiscoveryPromise;
     private initializationPromise;
@@ -80,6 +81,13 @@ export declare class Config extends ConfigBase {
      * 'false' for untrusted.
      */
     isTrustedFolder(): boolean;
+    getIdeTrust(): boolean | undefined;
+    /**
+     * Updates the local trust fallback. IDE trust remains authoritative, so this
+     * only triggers a transition when the effective trust value changes.
+     */
+    setTrustedFolderLive(trusted: boolean): Promise<void>;
+    private reconcileEffectiveTrust;
     setPtyTerminalSize(width: number | undefined, height: number | undefined): void;
     getShellExecutionConfig(): ShellExecutionConfig;
     getJitContextEnabled(): boolean;
@@ -136,6 +144,18 @@ export declare class Config extends ConfigBase {
      * @requirement:HOOK-010 - Zero CPU/memory overhead when hooks are disabled
      */
     getHookSystem(): HookSystem | undefined;
+    private ideTrust;
+    private cachedEffectiveTrust;
+    /**
+     * Resolves once any pending trust-transition side-effects have settled.
+     */
+    whenTrustTransitionSettled(): Promise<void>;
+    private ideTrustChangeListener;
+    /**
+     * Subscribes to live IDE trust changes so that MCP servers, hooks, and
+     * approval mode are updated immediately without requiring a restart.
+     */
+    private registerIdeTrustListener;
     dispose(): Promise<void>;
 }
 export { type SchedulerCallbacks, type SchedulerOptions };

package/dist/core/src/config/config.js

@@ -23,6 +23,7 @@ import { applyConfigParams, } from './configConstructor.js';
 import { ConfigBase } from './configBase.js';
 import { buildNewContentGeneratorConfig, createDetachedAgentClient, disposePreviousAgentClient, extractExistingState, requireAgentClientFactory, transferHistoryToNewClient, } from './agentClientLifecycle.js';
 import { getOrCreateAsyncTaskManager, getOrCreateAsyncTaskReminderService, setupAsyncTaskAutoTrigger, } from './asyncTaskServices.js';
+import { LiveTrustTransitionLifecycle } from './liveTrustTransitionLifecycle.js';
 import { parseSettingsSubagentDefinitions } from './subagentSettingsParser.js';
 import { ApprovalMode, } from './configTypes.js';
 // Re-export all types for backward compatibility
@@ -32,12 +33,40 @@ export { DEFAULT_FILE_FILTERING_OPTIONS, DEFAULT_MEMORY_FILE_FILTERING_OPTIONS,
 import { coreEvents, CoreEvent } from '../utils/events.js';
 import { McpClientManager } from '@vybestack/llxprt-code-mcp';
 import { getCoreVersion } from '../utils/version.js';
+import { buildMcpTrustedRules, MCP_TRUSTED_POLICY_SOURCE, } from '../policy/config.js';
 export class Config extends ConfigBase {
     static logger = new DebugLogger('llxprt:config');
+    liveTrustTransitionLifecycle;
     constructor(params) {
         super();
         applyConfigParams(this, params);
         this.syncModeDerivedPolicyRules(this.approvalMode);
+        this.cachedEffectiveTrust = this.isTrustedFolder();
+        this.liveTrustTransitionLifecycle = new LiveTrustTransitionLifecycle({
+            downgradeApprovalMode: () => {
+                if (this.approvalMode !== ApprovalMode.DEFAULT) {
+                    this.approvalMode = ApprovalMode.DEFAULT;
+                }
+            },
+            removeTrustedPolicyRules: () => this.policyEngine.removeRulesBySource(MCP_TRUSTED_POLICY_SOURCE),
+            updateTrustPolicy: (trusted) => {
+                if (trusted) {
+                    for (const rule of buildMcpTrustedRules({
+                        mcpServers: this.getMcpServers(),
+                    })) {
+                        this.policyEngine.addRule(rule);
+                    }
+                }
+                else {
+                    this.mcpClientManager?.quarantineForTrustRevocation();
+                }
+            },
+            transitionMcp: (trusted) => trusted
+                ? this.mcpClientManager?.onFolderTrustGained()
+                : this.mcpClientManager?.onFolderTrustRevoked(),
+            initializeHooks: (signal) => this.getHookSystem()?.initialize(signal),
+            emitTrustChanged: (trusted) => coreEvents.emitFolderTrustChanged(trusted),
+        });
     }
     // Issue #2325: Background MCP discovery promise started in initialize() so
     // startup is not blocked. Awaited in dispose() to avoid tearing down servers
@@ -72,7 +101,7 @@ export class Config extends ConfigBase {
         if (!initializationMessageBus) {
             throw new Error('Config.initialize requires an explicit session/runtime MessageBus dependency.');
         }
-        this.initialized = true;
+        this.cachedEffectiveTrust = this.isTrustedFolder();
         this.ideClient = await IdeClient.getInstance();
         // Initialize centralized FileDiscoveryService
         this.getFileService();
@@ -83,6 +112,8 @@ export class Config extends ConfigBase {
         this.resourceRegistry = new ResourceRegistry();
         this.toolRegistry = await this.createToolRegistry(initializationMessageBus);
         this.mcpClientManager = new McpClientManager(await getCoreVersion(), this.toolRegistry, this, this.eventEmitter);
+        this.registerIdeTrustListener();
+        this.initialized = true;
         // Issue #2325: Fire MCP discovery in the background — don't block startup.
         // Tools are gated before model turns via McpClientManager.whenDiscoverySettled().
         this.mcpDiscoveryPromise =
@@ -368,21 +399,30 @@ export class Config extends ConfigBase {
      * 'false' for untrusted.
      */
     isTrustedFolder() {
-        // isWorkspaceTrusted in cli/src/config/trustedFolder.js returns undefined
-        // when the file based trust value is unavailable, since it is mainly used
-        // in the initialization for trust dialogs, etc. Here we return true since
-        // config.isTrustedFolder() is used for the main business logic of blocking
-        // tool calls etc in the rest of the application.
-        //
-        // Default value is true since we load with trusted settings to avoid
-        // restarts in the more common path. If the user chooses to mark the folder
-        // as untrusted, the CLI will restart and we will have the trust value
-        // reloaded.
-        const context = ideContext.getIdeContext();
-        if (context?.workspaceState?.isTrusted !== undefined) {
-            return context.workspaceState.isTrusted;
-        }
-        return this.trustedFolder ?? true;
+        return this.getIdeTrust() ?? this.trustedFolder ?? true;
+    }
+    getIdeTrust() {
+        return (this.ideTrust ?? ideContext.getIdeContext()?.workspaceState?.isTrusted);
+    }
+    /**
+     * Updates the local trust fallback. IDE trust remains authoritative, so this
+     * only triggers a transition when the effective trust value changes.
+     */
+    setTrustedFolderLive(trusted) {
+        const previousEffectiveTrust = this.isTrustedFolder();
+        this.trustedFolder = trusted;
+        if (!this.initialized) {
+            return Promise.resolve();
+        }
+        return this.reconcileEffectiveTrust(previousEffectiveTrust);
+    }
+    reconcileEffectiveTrust(previousEffectiveTrust) {
+        const effectiveTrust = this.isTrustedFolder();
+        this.cachedEffectiveTrust = effectiveTrust;
+        if (previousEffectiveTrust !== effectiveTrust) {
+            return this.liveTrustTransitionLifecycle.apply(effectiveTrust);
+        }
+        return Promise.resolve();
     }
     setPtyTerminalSize(width, height) {
         if (typeof width === 'number' && Number.isFinite(width) && width > 0) {
@@ -560,10 +600,83 @@ export class Config extends ConfigBase {
         this.hookSystem ??= new HookSystem(this);
         return this.hookSystem;
     }
+    ideTrust;
+    cachedEffectiveTrust;
+    /**
+     * Resolves once any pending trust-transition side-effects have settled.
+     */
+    async whenTrustTransitionSettled() {
+        await this.liveTrustTransitionLifecycle.whenSettled();
+    }
+    ideTrustChangeListener;
+    /**
+     * Subscribes to live IDE trust changes so that MCP servers, hooks, and
+     * approval mode are updated immediately without requiring a restart.
+     */
+    registerIdeTrustListener() {
+        const client = this.ideClient;
+        const previousEffectiveTrust = this.cachedEffectiveTrust;
+        this.ideTrust = ideContext.getIdeContext()?.workspaceState?.isTrusted;
+        if (client && typeof client.addTrustChangeListener === 'function') {
+            this.ideTrustChangeListener = (isTrusted) => {
+                const priorEffectiveTrust = this.cachedEffectiveTrust;
+                this.ideTrust = isTrusted;
+                void this.reconcileEffectiveTrust(priorEffectiveTrust).catch((error) => {
+                    Config.logger.error(`IDE trust reconciliation failed: ${getErrorMessage(error)}`);
+                });
+            };
+            client.addTrustChangeListener(this.ideTrustChangeListener);
+        }
+        void this.reconcileEffectiveTrust(previousEffectiveTrust).catch((error) => {
+            Config.logger.error(`IDE trust reconciliation failed: ${getErrorMessage(error)}`);
+        });
+    }
     async dispose() {
+        const failures = [];
+        try {
+            this.liveTrustTransitionLifecycle.beginDisposal();
+        }
+        catch (error) {
+            failures.push(error);
+        }
+        if (this.ideTrustChangeListener &&
+            this.ideClient &&
+            typeof this.ideClient.removeTrustChangeListener === 'function') {
+            try {
+                this.ideClient.removeTrustChangeListener(this.ideTrustChangeListener);
+            }
+            catch (error) {
+                failures.push(error);
+            }
+            this.ideTrustChangeListener = undefined;
+        }
+        // Initiate MCP shutdown before awaiting trust-transition settlement so
+        // in-flight MCP work is cancelled and cannot block disposal.
+        const stopPromise = this.mcpClientManager?.stop();
+        try {
+            await this.whenTrustTransitionSettled();
+        }
+        catch (error) {
+            failures.push(error);
+        }
         const client = this.agentClient;
         if (client !== undefined) {
-            client.dispose();
+            try {
+                client.dispose();
+            }
+            catch (error) {
+                failures.push(error);
+            }
+        }
+        if (this.hookSystem !== undefined) {
+            const hookSystem = this.hookSystem;
+            this.hookSystem = undefined;
+            try {
+                hookSystem.dispose();
+            }
+            catch (error) {
+                failures.push(error);
+            }
         }
         if (this.mcpDiscoveryPromise !== undefined) {
             try {
@@ -573,12 +686,19 @@ export class Config extends ConfigBase {
                 Config.logger.warn(`MCP discovery rejected during dispose: ${getErrorMessage(error)}`);
             }
         }
-        // Issue #2325: Extension server discoveries fired by startExtension are
-        // tracked by whenDiscoverySettled(). Await it to avoid tearing down
-        // clients mid-connection.
-        if (this.mcpClientManager !== undefined) {
-            await this.mcpClientManager.whenDiscoverySettled();
-            await this.mcpClientManager.stop();
+        if (stopPromise !== undefined) {
+            try {
+                await stopPromise;
+            }
+            catch (error) {
+                failures.push(error);
+            }
+        }
+        if (failures.length === 1) {
+            throw failures[0];
+        }
+        if (failures.length > 1) {
+            throw new AggregateError(failures, 'Config disposal failed');
         }
     }
 }