@yanlinglabs/winter-agent-runtime 0.0.29 → 0.0.30

package/dist/embedded-worker.js

@@ -1,13 +1,15 @@
-import"./index-jz5d90c6.js";
+import"./index-51673qbw.js";
 import {
   liveProcessGroups,
   onProcessGroupChange
-} from "./index-8jgwp1px.js";
+} from "./index-9s68t0pd.js";
+import"./index-z6s3r4xm.js";
+import"./index-bgeqc7ax.js";
 import"./index-bef62z3r.js";
-import"./index-gmxxtqpe.js";
+import"./index-9df1q7j4.js";
 import {
   runEmbeddedSession2
-} from "./index-eyddzcgs.js";
+} from "./index-wsfqsrh5.js";
 import {
   Queue
 } from "./index-97t2rmtf.js";

package/dist/embedded.js

@@ -1,10 +1,12 @@
 import {
   runEmbeddedSession2
-} from "./index-eyddzcgs.js";
-import"./index-gmxxtqpe.js";
-import"./index-jz5d90c6.js";
+} from "./index-wsfqsrh5.js";
+import"./index-9df1q7j4.js";
+import"./index-51673qbw.js";
+import"./index-bgeqc7ax.js";
 import"./index-bef62z3r.js";
-import"./index-8jgwp1px.js";
+import"./index-9s68t0pd.js";
+import"./index-z6s3r4xm.js";
 export {
   runEmbeddedSession2 as runEmbeddedSession
 };

package/dist/engine.d.ts

@@ -12,6 +12,8 @@ import { type StructuredOutputSeam } from "./structured/seam.js";
 import { type FileCheckpointSink } from "./checkpoint/seam.js";
 import { type CommandResolver } from "./commands/seam.js";
 import { type McpServerSource } from "./mcp/lifecycle.js";
+import type { McpOAuthStore } from "./mcp-auth/store.js";
+import type { HostCredentialChannel } from "./provider/host-credentials.js";
 import { type ChildHandle } from "./subagents/child-handle.js";
 import { type SourcedRuleEntry } from "./permissions/ruleset.js";
 import { type AutoAuditRecorder, type ClassifierInterface } from "./permissions/auto/engine.js";
@@ -981,6 +983,20 @@ export interface EngineOptions {
      * clone connects freely.
      */
     extraMcpServerSources?: readonly McpServerSource[];
+    /**
+     * WS-25 (MCP OAuth): where this session READS its MCP sign-ins -- the session's own Keychain service,
+     * supplied by production wiring (`resolveSessionMcpOAuthStore`). Present, every remote (`http`/`sse`)
+     * server without a static `Authorization` header connects with a read-only bearer provider that asks
+     * the host (`mcp_oauth_refresh`) to refresh. ABSENT -- every direct `runEngine` caller, every unit test --
+     * no provider is attached anywhere, the Keychain is never touched, and a 401 is `needs-auth` as before.
+     */
+    mcpOAuthStore?: McpOAuthStore;
+    /**
+     * WS-25 §7: the host-credential channel production wiring built for a host-brokered session
+     * (`RuntimeConfig.hostCredentials`). Bound to this run's control bridge the moment it exists, so every
+     * `credential_resolve` rides the session's own stdio pipe. Absent: nothing to bind.
+     */
+    hostCredentialChannel?: HostCredentialChannel;
     /**
      * `system/init.slash_commands`. Produced by `slashCommandNames(resolver, cwd)`, which ALREADY
      * includes the engine's own `/compact` -- the engine must not prepend it a second time.

package/dist/{index-jz5d90c6.js → index-51673qbw.js}

@@ -1,9 +1,13 @@
 import {
   trackProcessGroup,
   createElicitationAsker2,
+  createSessionAuthProvider,
+  mcpSignInHint,
   McpConnectError2,
-  connectMcpServer2
-} from "./index-8jgwp1px.js";
+  connectMcpServer2,
+  insufficientScopeOf,
+  classifyMcpAuthFailure
+} from "./index-9s68t0pd.js";
 import {
   promptKey,
   RunJournal,
@@ -14,6 +18,12 @@ import {
   WORKFLOW_WORKER_ARGV_FLAG2,
   WORKFLOW_WORKER_BRIDGE_FLAG2
 } from "./index-bef62z3r.js";
+import {
+  keychainAccountName
+} from "./index-z6s3r4xm.js";
+import {
+  validateMcpOAuthConfig2
+} from "./index-bgeqc7ax.js";
 import {
   Queue
 } from "./index-97t2rmtf.js";
@@ -4946,6 +4956,14 @@ function validateServerConfig(raw) {
       return { ok: false, reason: `MCP server config 'versionNegotiation' must be "legacy", "auto" or { "pin": "<YYYY-MM-DD revision>" }; got ${JSON.stringify(negotiation)}` };
     }
   }
+  const oauth = raw.oauth;
+  if (oauth !== undefined) {
+    if (type !== "http" && type !== "sse")
+      return { ok: false, reason: "'oauth' applies only to a remote (http/sse) MCP server" };
+    const reason = validateMcpOAuthConfig2(oauth, raw.url);
+    if (reason !== undefined)
+      return { ok: false, reason };
+  }
   return { ok: true, config: raw };
 }
 function resolveMcpServerSources(sources, opts) {
@@ -5109,6 +5127,24 @@ function toolInfoToDefinition(tool) {
     ...tool._meta !== undefined ? { _meta: tool._meta } : {}
   };
 }
+function hasStaticAuthorization(config) {
+  if (config.type !== "http" && config.type !== "sse")
+    return false;
+  return Object.keys(config.headers ?? {}).some((h) => h.toLowerCase() === "authorization");
+}
+function sessionAuthFor(name, config, oauth) {
+  if (oauth === undefined || config.type !== "http" && config.type !== "sse" || hasStaticAuthorization(config))
+    return;
+  try {
+    return createSessionAuthProvider({ serverName: name, serverUrl: config.url, oauth });
+  } catch {
+    return;
+  }
+}
+function displayScope(scope) {
+  const cleaned = (scope ?? "").replace(/[^A-Za-z0-9:._/ -]/g, "").trim().slice(0, 200);
+  return cleaned === "" ? "unstated" : cleaned;
+}
 function createInMemoryDiscoveryCache() {
   const map = new Map;
   return {
@@ -5199,6 +5235,15 @@ function createMcpLifecycle(deps) {
             });
             return { output: capped.text, ...result.isError === true ? { isError: true } : {} };
           } catch (err) {
+            const authFailure = classifyMcpAuthFailure(err);
+            if (authFailure === "needs_auth")
+              return { output: `Error: ${markNeedsAuth(slot, slot.client, err)}`, isError: true };
+            if (authFailure === "insufficient_scope") {
+              const challenge = insufficientScopeOf(err);
+              slot.auth?.reportInsufficientScope(challenge?.requiredScope);
+              const hint = deps.oauth?.signInHint(slot.name) ?? "";
+              return { output: `Error: mcp tool call "${toolName}" on server "${slot.name}" needs additional permission the current sign-in does not grant (scope: ${displayScope(challenge?.requiredScope)}). ${hint}`.trim(), isError: true };
+            }
             const message = err instanceof Error ? err.message : String(err);
             return { output: `Error: mcp tool call "${toolName}" on server "${slot.name}" failed: ${message}`, isError: true };
           }
@@ -5209,6 +5254,18 @@ function createMcpLifecycle(deps) {
   function isCurrentAttempt(slot, gen) {
     return slots.get(slot.name) === slot && slot.gen === gen;
   }
+  function markNeedsAuth(slot, failed, err) {
+    const hint = deps.oauth?.signInHint(slot.name) ?? "";
+    const message = err instanceof McpConnectError2 || err instanceof Error && err.name === "McpNeedsAuthError" ? err.message : `MCP server "${slot.name}" needs sign-in (the server answered 401). ${hint}`.trim();
+    if (slots.get(slot.name) !== slot || failed === undefined || slot.client !== failed)
+      return message;
+    slot.gen++;
+    slot.client = undefined;
+    failed.close().catch(() => {});
+    unregisterMcpServerTools(slot.name);
+    setSlotState(slot.name, "needsAuth", { errorCode: "needs_auth", error: message });
+    return `${message} Its tools are unavailable until then.`;
+  }
   function beginAttempt(slot) {
     return ++slot.gen;
   }
@@ -5241,6 +5298,7 @@ function createMcpLifecycle(deps) {
   async function connectSlotForReal(slot, gen) {
     let connection;
     slot.toolListStale = false;
+    const auth = sessionAuthFor(slot.name, slot.config, deps.oauth);
     const client = await connectMcpServer2({
       name: slot.name,
       config: slot.config,
@@ -5248,7 +5306,8 @@ function createMcpLifecycle(deps) {
       elicitationAsk: deps.elicitationAsk,
       onToolListChanged: onToolListChangedFor(slot, () => connection),
       ...deps.inProcessServers?.[slot.name] !== undefined ? { inProcessServer: deps.inProcessServers[slot.name] } : {},
-      ...deps.cwd !== undefined ? { cwd: deps.cwd } : {}
+      ...deps.cwd !== undefined ? { cwd: deps.cwd } : {},
+      ...auth !== undefined ? { auth } : {}
     });
     connection = client;
     const tools = await client.listTools();
@@ -5257,6 +5316,7 @@ function createMcpLifecycle(deps) {
       return false;
     }
     slot.client = client;
+    slot.auth = auth;
     slot.toolNames = tools.map((t) => t.name);
     slot.savedTools = tools;
     registerMcpServerTools(slot.name, tools.map(toolInfoToDefinition), {
@@ -5386,6 +5446,8 @@ function createMcpLifecycle(deps) {
       setSlotState(name, "connected", { toolNames: slot.toolNames });
       return { ok: true, toolNames: slot.toolNames };
     } catch (err) {
+      if (classifyMcpAuthFailure(err) === "needs_auth")
+        return { ok: false, reason: markNeedsAuth(slot, client, err) };
       const message = err instanceof Error ? err.message : String(err);
       return { ok: false, reason: `refreshing server "${name}" failed: ${message}` };
     }
@@ -5462,6 +5524,68 @@ function createMcpLifecycle(deps) {
   };
 }
 
+// src/mcp-auth/engine-wiring.ts
+import { MCP_OAUTH_REFRESH_SUBTYPE, WinterRpcError as WinterRpcError2 } from "@yanlinglabs/winter-agent-sdk";
+var MCP_OAUTH_HOST_REFRESH_TIMEOUT_MS = 60000;
+function isAnswer(value) {
+  if (typeof value !== "object" || value === null)
+    return false;
+  const v = value;
+  return v.ok === true || v.ok === false && (v.reason === "needs_auth" || v.reason === "transient");
+}
+function createSessionMcpOAuth(opts) {
+  return {
+    store: opts.store,
+    ...opts.hostOwnsRefresh === true ? { hostOwnsRefresh: true } : {},
+    signInHint: (serverName) => mcpSignInHint(opts.brand, serverName),
+    askHost: async (request) => {
+      try {
+        const answer = await opts.sender.request(MCP_OAUTH_REFRESH_SUBTYPE, request, { timeoutMs: MCP_OAUTH_HOST_REFRESH_TIMEOUT_MS });
+        return isAnswer(answer) ? answer : { ok: false, reason: "transient" };
+      } catch (err) {
+        if (err instanceof WinterRpcError2 && err.code === "unhandled_subtype")
+          return "unhandled";
+        return { ok: false, reason: "transient" };
+      }
+    }
+  };
+}
+function needsAuthServers(states) {
+  return (states ?? []).filter((s) => s.state === "needsAuth").map((s) => s.name).sort();
+}
+function needsAuthToolHint(states, toolName, brand) {
+  const server = needsAuthServers(states).find((name) => toolName.startsWith(`mcp__${name}__`));
+  if (server === undefined)
+    return "";
+  return `. The MCP server '${server}' needs sign-in, so its tools are unavailable. ${mcpSignInHint(brand, server)}`;
+}
+var SERVER_PLACEHOLDER = "<server>";
+function displayName(name) {
+  return name.replace(/[^A-Za-z0-9_.:-]/g, "_").slice(0, 64);
+}
+registerAttachmentRenderer("mcp_needs_auth", (attachment) => {
+  const servers = Array.isArray(attachment.servers) ? attachment.servers.filter((s) => typeof s === "string").map(displayName) : [];
+  const door = typeof attachment.door === "string" ? attachment.door : "";
+  if (servers.length === 0)
+    return "The MCP servers that needed sign-in are signed in now; their tools are available again.";
+  return `These MCP servers need the user to sign in, so their tools are not available: ${servers.join(", ")}. Do not try to authenticate on the user's behalf. If the user needs one of them, tell them how to sign in: ${door}`;
+});
+function lastAnnounced(messages) {
+  let last = [];
+  for (const a of attachmentsIn(messages)) {
+    if (a.type === "mcp_needs_auth" && Array.isArray(a.servers))
+      last = a.servers.filter((s) => typeof s === "string");
+  }
+  return last;
+}
+function mcpNeedsAuthAttachment(states, messages, brand) {
+  const now = needsAuthServers(states);
+  const before = lastAnnounced(messages);
+  if (now.length === before.length && now.every((name, i) => name === before[i]))
+    return;
+  return { type: "mcp_needs_auth", servers: now, door: mcpSignInHint(brand, SERVER_PLACEHOLDER) };
+}
+
 // src/subagents/child-handle.ts
 var childEngineFactory;
 function registerChildEngineFactory(factory) {
@@ -21788,6 +21912,8 @@ async function runEngineBody(opts, facetDisposers, registerBackgroundShellSweep)
     extraHookEntries,
     subagentHooks,
     extraMcpServerSources,
+    mcpOAuthStore,
+    hostCredentialChannel,
     initSlashCommands,
     initSkills,
     initPlugins,
@@ -21907,6 +22033,7 @@ ${escapeAttributionText(msg.body)}
   const policyStateStore = new PolicyStateStore({ mode: initialMode, rules: initialRules }, bypassGate);
   const permissionHome = homedir();
   const bridge = createRpcBridge2(output);
+  hostCredentialChannel?.bind(bridge);
   const bridgePromptStage = createBridgePromptStage(bridge);
   const realPromptStage = {
     async prompt(call, evalCtx, meta) {
@@ -22763,7 +22890,8 @@ ${escapeAttributionText(msg.body)}
       envConfig: mcpEnvConfig,
       elicitationAsk: createElicitationAsker2(bridge),
       reservedServerName: sessionBrand.mcpServerName,
-      cwd: config.cwd
+      cwd: config.cwd,
+      ...mcpOAuthStore !== undefined ? { oauth: createSessionMcpOAuth({ store: mcpOAuthStore, sender: bridge, brand: sessionBrand, ...config.hostCredentials === true ? { hostOwnsRefresh: true } : {} }) } : {}
     });
     await mcpLifecycle.start();
     disposeSessionMcpLifecycle = registerSessionMcpLifecycle(sessionStateKey, mcpLifecycle);
@@ -24108,6 +24236,11 @@ ${escapeAttributionText(msg.body)}
       const plan = planModeAttachment();
       if (plan !== undefined)
         produced.push(plan);
+      if (effectiveMcpStateSource !== undefined) {
+        const needsAuth = mcpNeedsAuthAttachment(effectiveMcpStateSource.snapshot(), messages, sessionBrand);
+        if (needsAuth !== undefined)
+          produced.push(needsAuth);
+      }
     }
     if (phase === "tool-round") {
       const attachment = taskNotificationAttachment(notifications.drainFor(config.agentId, { maxPriority: "next" }), {
@@ -24375,6 +24508,8 @@ ${escapeAttributionText(msg.body)}
       if (pending !== undefined)
         hint = `. The MCP server '${pending.name}' is still connecting. Call WaitForMcpServers to wait for it, then try again.`;
     }
+    if (hint === "" && toolName.startsWith("mcp__"))
+      hint = needsAuthToolHint(effectiveMcpStateSource?.snapshot(), toolName, sessionBrand);
     return `<tool_use_error>Error: No such tool available: ${toolName}${hint}</tool_use_error>`;
   };
   const assertMessagesWithinCap = (msgs) => {
@@ -26367,7 +26502,7 @@ class TranscriptWriter2 {
     return entries;
   }
 }
-var RUNTIME_ENGINE_VERSION2 = "0.0.29";
+var RUNTIME_ENGINE_VERSION2 = "0.0.30";
 function withPermissionJournal(writer, location) {
   return {
     transcriptPath: join25(location.winterHome, "projects", location.projectKey, `${location.sessionId}.jsonl`),
@@ -26506,117 +26641,13 @@ function resolveProductionStoreHome(config, env) {
 // src/provider/credential-api.ts
 import {
   ANTHROPIC_CONSOLE_ACCOUNT_ID,
-  CredentialResolutionError as CredentialResolutionError2,
+  CredentialResolutionError,
   WinterProviderResolutionError as WinterProviderResolutionError3,
   startAnthropicConsoleBrokerLogin,
   startCodexLogin,
   startXaiLogin
 } from "@yanlinglabs/winter-provider-runtime";
 
-// src/provider/keychain-store.ts
-import { CredentialResolutionError, redactRef } from "@yanlinglabs/winter-provider-runtime";
-import { DEFAULT_KEYCHAIN_SERVICE } from "@yanlinglabs/winter-agent-sdk";
-function defaultSecretsBackend() {
-  const secrets = globalThis.Bun?.secrets;
-  if (secrets === undefined) {
-    throw new CredentialResolutionError("unsupported", "the Keychain credential store requires Bun.secrets, which is unavailable in this runtime");
-  }
-  return secrets;
-}
-function createKeychainCredentialStore(service = DEFAULT_KEYCHAIN_SERVICE, opts = {}) {
-  const backend = () => opts.secrets ?? defaultSecretsBackend();
-  return {
-    async get(ref) {
-      if (ref.kind !== "keychain")
-        return null;
-      let raw;
-      try {
-        raw = await backend().get({ service: ref.service ?? service, name: ref.account });
-      } catch (err) {
-        if (err instanceof CredentialResolutionError)
-          throw err;
-        throw new CredentialResolutionError("io", `keychain lookup failed for ${redactRef(ref)}`);
-      }
-      if (raw === null)
-        return null;
-      let parsed;
-      try {
-        parsed = JSON.parse(raw);
-      } catch {
-        throw new CredentialResolutionError("malformed", `the keychain record for ${redactRef(ref)} is not valid JSON credential material`);
-      }
-      const material = coerceMaterial(parsed);
-      if (material === undefined)
-        throw new CredentialResolutionError("malformed", `the keychain record for ${redactRef(ref)} is not a recognized credential material shape`);
-      return material;
-    },
-    async set(ref, material) {
-      try {
-        await backend().set({ service: ref.service ?? service, name: ref.account, value: JSON.stringify(material) });
-      } catch (err) {
-        if (err instanceof CredentialResolutionError)
-          throw err;
-        throw new CredentialResolutionError("io", `keychain write failed for ${redactRef(ref)}`);
-      }
-    },
-    async delete(ref) {
-      try {
-        await backend().delete({ service: ref.service ?? service, name: ref.account });
-      } catch (err) {
-        if (err instanceof CredentialResolutionError)
-          throw err;
-        throw new CredentialResolutionError("io", `keychain delete failed for ${redactRef(ref)}`);
-      }
-    }
-  };
-}
-function createKeychainSecretReader(service = DEFAULT_KEYCHAIN_SERVICE, opts = {}) {
-  const backend = () => opts.secrets ?? defaultSecretsBackend();
-  return async (ref) => {
-    try {
-      return await backend().get({ service: ref.service ?? service, name: ref.account });
-    } catch (err) {
-      if (err instanceof CredentialResolutionError)
-        throw err;
-      throw new CredentialResolutionError("io", `keychain lookup failed for ${redactRef(ref)}`);
-    }
-  };
-}
-function keychainAccountName(providerId, accountId) {
-  return `${providerId}:${accountId}`;
-}
-var MATERIAL_KINDS = new Set(["api-key", "bearer", "oauth", "aws", "gcp-service-account", "gcp-access-token"]);
-function coerceMaterial(value) {
-  if (typeof value !== "object" || value === null)
-    return;
-  const v = value;
-  if (typeof v.kind !== "string" || !MATERIAL_KINDS.has(v.kind))
-    return;
-  switch (v.kind) {
-    case "api-key":
-      return typeof v.key === "string" ? { kind: "api-key", key: v.key } : undefined;
-    case "bearer":
-      return typeof v.token === "string" ? { kind: "bearer", token: v.token, ...typeof v.expiresAt === "number" ? { expiresAt: v.expiresAt } : {} } : undefined;
-    case "oauth":
-      return typeof v.accessToken === "string" ? {
-        kind: "oauth",
-        accessToken: v.accessToken,
-        ...typeof v.refreshToken === "string" ? { refreshToken: v.refreshToken } : {},
-        ...typeof v.expiresAt === "number" ? { expiresAt: v.expiresAt } : {},
-        ...typeof v.accountId === "string" ? { accountId: v.accountId } : {},
-        ...typeof v.idToken === "string" ? { idToken: v.idToken } : {}
-      } : undefined;
-    case "aws":
-      return typeof v.accessKeyId === "string" && typeof v.secretAccessKey === "string" ? { kind: "aws", accessKeyId: v.accessKeyId, secretAccessKey: v.secretAccessKey, ...typeof v.sessionToken === "string" ? { sessionToken: v.sessionToken } : {} } : undefined;
-    case "gcp-service-account":
-      return typeof v.clientEmail === "string" && typeof v.privateKeyPem === "string" && typeof v.tokenUri === "string" ? { kind: "gcp-service-account", clientEmail: v.clientEmail, privateKeyPem: v.privateKeyPem, tokenUri: v.tokenUri } : undefined;
-    case "gcp-access-token":
-      return typeof v.token === "string" ? { kind: "gcp-access-token", token: v.token } : undefined;
-    default:
-      return;
-  }
-}
-
 // src/provider/selection.ts
 import { WinterProviderResolutionError as WinterProviderResolutionError2, createRegistry } from "@yanlinglabs/winter-provider-runtime";
 import { DEFAULT_PROVIDER_STALL_TIMEOUT_MS } from "@yanlinglabs/winter-agent-sdk";
@@ -26829,22 +26860,22 @@ var FORBIDDEN = /[\u0000-\u001f\u007f]/;
 function assertLocator(locator) {
   const { providerId, accountId, service } = locator;
   if (typeof providerId !== "string" || providerId.trim().length === 0)
-    throw new CredentialResolutionError2("malformed", "a provider credential needs a non-empty providerId");
+    throw new CredentialResolutionError("malformed", "a provider credential needs a non-empty providerId");
   if (typeof accountId !== "string" || accountId.trim().length === 0)
-    throw new CredentialResolutionError2("malformed", `a provider credential for "${providerId}" needs a non-empty accountId`);
+    throw new CredentialResolutionError("malformed", `a provider credential for "${providerId}" needs a non-empty accountId`);
   if (providerId.includes(":")) {
-    throw new CredentialResolutionError2("malformed", `providerId "${providerId}" contains ":", which is the separator in the "<providerId>:<accountId>" keychain account name (R6-10) and would make the record ambiguous`);
+    throw new CredentialResolutionError("malformed", `providerId "${providerId}" contains ":", which is the separator in the "<providerId>:<accountId>" keychain account name (R6-10) and would make the record ambiguous`);
   }
   if (FORBIDDEN.test(providerId) || FORBIDDEN.test(accountId) || service !== undefined && FORBIDDEN.test(service)) {
-    throw new CredentialResolutionError2("malformed", `a provider credential locator may not contain control characters (provider "${providerId}")`);
+    throw new CredentialResolutionError("malformed", `a provider credential locator may not contain control characters (provider "${providerId}")`);
   }
   if (service !== undefined && service.trim().length === 0)
-    throw new CredentialResolutionError2("malformed", `an explicit keychain service for provider "${providerId}" may not be blank; omit it to use the store's default`);
+    throw new CredentialResolutionError("malformed", `an explicit keychain service for provider "${providerId}" may not be blank; omit it to use the store's default`);
 }
 function assertMaterial(material, ref) {
   const empty = (value) => value === undefined || value.trim().length === 0;
   const bad = (field) => {
-    throw new CredentialResolutionError2("malformed", `the ${material.kind} credential for ${redactCredentialRef(ref)} has an empty "${field}"; an empty secret is stored happily and then fails as an opaque provider rejection on every request`);
+    throw new CredentialResolutionError("malformed", `the ${material.kind} credential for ${redactCredentialRef(ref)} has an empty "${field}"; an empty secret is stored happily and then fails as an opaque provider rejection on every request`);
   };
   switch (material.kind) {
     case "api-key":
@@ -26880,13 +26911,13 @@ function assertMaterial(material, ref) {
   }
 }
 function redactedFailure(operation, ref, err) {
-  const code = err instanceof CredentialResolutionError2 ? err.code : "io";
+  const code = err instanceof CredentialResolutionError ? err.code : "io";
   const kind = err instanceof Error ? err.name : typeof err;
-  return new CredentialResolutionError2(code, `could not ${operation} the credential for ${redactCredentialRef(ref)}: the store failed with a ${kind} (its message is withheld because a store's error text may quote the record)`);
+  return new CredentialResolutionError(code, `could not ${operation} the credential for ${redactCredentialRef(ref)}: the store failed with a ${kind} (its message is withheld because a store's error text may quote the record)`);
 }
 function statusFromThrow(err, ref, providerId) {
   const locator = redactCredentialRef(ref);
-  if (err instanceof CredentialResolutionError2) {
+  if (err instanceof CredentialResolutionError) {
     if (err.code === "malformed")
       return { ok: false, code: "invalid", message: `the credential at ${locator} is not valid material for provider "${providerId}"` };
     if (err.code === "io")
@@ -27197,4 +27228,4 @@ function selectClassifierRoute2(config, descriptorOf) {
   return { kind: "worker-eligible" };
 }
 
-export { ChildResumeModeIncomparableError, resolveChildResumeMode, ensureDefaultMessagingRuntimeRegistered, buildContinuationChain, AGENT_TOOL_CANONICAL_NAME, computeActiveSlotSet, resolveSlotToProvider, createRpcBridge2, shellWords, escapeRegExpLiteral, validatePermissionRuleString, registerTool2, getRegisteredTool, listRegisteredTools, rebrandStandingServerTools, mcpServerHasRegistrations, onCompaction2, STRUCTURED_OUTPUT_TOOL_NAME, looksLikeCommand, registerChildEngineFactory, matchFileRule, rawToRuleValue, sourceRule, resolveFileRuleAbsolutePath, resolveFileRuleAbsoluteGlobText, resolvesWithinPluginRoot, parseFrontmatter, parseAgentDefinitionFile, allowedAgentTypesFromTools, validateAgentDefinition, WinterPathsError2, sessionTempDir2, ensureTasksDir2, resolveProjectDirName2, buildForkDirectiveText, buildForkInitialMessages, capBytes, neutralizeReminderTags, readWhole, readCappedLinesAndBytes, registerAttachmentRenderer, attachmentsIn, gitInstructionsEnabled, isUserInvocable, buildSkillListing, registerPluginAgents, clearPluginAgents, registerSkillSessionRuntime, clearSkillSessionRuntime, buildHookEntriesFromSettings, defaultTrustSource, formatValidationErrors, createSchemaValidatorCache, killAllTaskProcessGroups, runGit, listWorktrees, canonicalAliases, WINTER_CANONICAL_ALIASES, DEFAULT_SKILL_BODY_BYTES, skillNameError, pluginNameError, capBytes2, parseSkillFile, validateSkillsOption, isSkillEnabled, autoSkillPermissionEntries, setHostWorkflowWorkerCommand, listWorkflowsForListing, buildWorkflowSkillPrompt, DEFAULT_CONTEXT_WINDOW_TOKENS2, ProviderTurnError, isProviderTurnError, createContextAccountant2, runEngine2, WINTER_SUMMARY_INSTRUCTION, WINTER_PREFIX_SUMMARY_INSTRUCTION, CARRIED_SUMMARY_NOTE, retainedExchangesNote, buildSummaryInstruction, redactForSummary, summarize, summarizeOverPrefix, recordedProviderSystems2, resetRecordedProviderSystems2, echoProvider2, scriptedProvider2, stubExecutor2, P5_FIXTURE_SKILL_NAME2, P5_WORKFLOW_SCRIPT2, isTestProviderName2, testProviderForNamespace, testProviderByName2, SUBAGENT_CHILD_PROBE_TEXT2, MCP_SDK_TEST_SERVER_NAME2, MCP_SDK_TEST_TOOL_NAME2, BGTASK_TEST_TOOL_NAME2, registerBgTaskTestTool2, ResumeTargetError2, ResumeTruncationError2, findContinueTarget2, findResumeTarget2, toDialectEntries2, truncateAt2, rebuildProviderMessages2, userEntry2, winterMessageIdFor2, assistantEntry2, CLAUDE_COMPACT_SUMMARY_PREAMBLE2, claudeCompactBoundaryEntry2, claudeCompactSummaryEntry2, TranscriptWriterError2, TranscriptWriter2, RUNTIME_ENGINE_VERSION2, childTranscriptSubpath, buildChildTranscriptWriter, listChildAgentIds, resolveEngineSession2, resolveProductionWinterHome2, resolveProductionStoreHome, createKeychainCredentialStore, createKeychainSecretReader, resolveSessionProvider, redactCredentialRef, createProviderContext, providerCredentialRef2, storeProviderCredential2, deleteProviderCredential2, validateProviderCredential2, CLASSIFIER_TOOL_NAME2, CLASSIFIER_VERDICT_SCHEMA2, CLASSIFIER_NO_VERDICT_REASONS2, DEFAULT_MAX_CONTEXT_CHARS2, CLASSIFIER_SYSTEM_PROMPT2, DEFAULT_CLASSIFIER_TIMEOUT_MS2, createModelClassifier2, selectClassifierRoute2 };
+export { ChildResumeModeIncomparableError, resolveChildResumeMode, ensureDefaultMessagingRuntimeRegistered, buildContinuationChain, AGENT_TOOL_CANONICAL_NAME, computeActiveSlotSet, resolveSlotToProvider, createRpcBridge2, shellWords, escapeRegExpLiteral, validatePermissionRuleString, registerTool2, getRegisteredTool, listRegisteredTools, rebrandStandingServerTools, mcpServerHasRegistrations, onCompaction2, STRUCTURED_OUTPUT_TOOL_NAME, looksLikeCommand, capBytes, neutralizeReminderTags, readWhole, readCappedLinesAndBytes, registerAttachmentRenderer, attachmentsIn, registerChildEngineFactory, matchFileRule, rawToRuleValue, sourceRule, resolveFileRuleAbsolutePath, resolveFileRuleAbsoluteGlobText, resolvesWithinPluginRoot, parseFrontmatter, parseAgentDefinitionFile, allowedAgentTypesFromTools, validateAgentDefinition, WinterPathsError2, sessionTempDir2, ensureTasksDir2, resolveProjectDirName2, buildForkDirectiveText, buildForkInitialMessages, gitInstructionsEnabled, isUserInvocable, buildSkillListing, registerPluginAgents, clearPluginAgents, registerSkillSessionRuntime, clearSkillSessionRuntime, buildHookEntriesFromSettings, defaultTrustSource, formatValidationErrors, createSchemaValidatorCache, killAllTaskProcessGroups, runGit, listWorktrees, canonicalAliases, WINTER_CANONICAL_ALIASES, DEFAULT_SKILL_BODY_BYTES, skillNameError, pluginNameError, capBytes2, parseSkillFile, validateSkillsOption, isSkillEnabled, autoSkillPermissionEntries, setHostWorkflowWorkerCommand, listWorkflowsForListing, buildWorkflowSkillPrompt, DEFAULT_CONTEXT_WINDOW_TOKENS2, ProviderTurnError, isProviderTurnError, createContextAccountant2, runEngine2, WINTER_SUMMARY_INSTRUCTION, WINTER_PREFIX_SUMMARY_INSTRUCTION, CARRIED_SUMMARY_NOTE, retainedExchangesNote, buildSummaryInstruction, redactForSummary, summarize, summarizeOverPrefix, recordedProviderSystems2, resetRecordedProviderSystems2, echoProvider2, scriptedProvider2, stubExecutor2, P5_FIXTURE_SKILL_NAME2, P5_WORKFLOW_SCRIPT2, isTestProviderName2, testProviderForNamespace, testProviderByName2, SUBAGENT_CHILD_PROBE_TEXT2, MCP_SDK_TEST_SERVER_NAME2, MCP_SDK_TEST_TOOL_NAME2, BGTASK_TEST_TOOL_NAME2, registerBgTaskTestTool2, ResumeTargetError2, ResumeTruncationError2, findContinueTarget2, findResumeTarget2, toDialectEntries2, truncateAt2, rebuildProviderMessages2, userEntry2, winterMessageIdFor2, assistantEntry2, CLAUDE_COMPACT_SUMMARY_PREAMBLE2, claudeCompactBoundaryEntry2, claudeCompactSummaryEntry2, TranscriptWriterError2, TranscriptWriter2, RUNTIME_ENGINE_VERSION2, childTranscriptSubpath, buildChildTranscriptWriter, listChildAgentIds, resolveEngineSession2, resolveProductionWinterHome2, resolveProductionStoreHome, resolveSessionProvider, redactCredentialRef, createProviderContext, providerCredentialRef2, storeProviderCredential2, deleteProviderCredential2, validateProviderCredential2, CLASSIFIER_TOOL_NAME2, CLASSIFIER_VERDICT_SCHEMA2, CLASSIFIER_NO_VERDICT_REASONS2, DEFAULT_MAX_CONTEXT_CHARS2, CLASSIFIER_SYSTEM_PROMPT2, DEFAULT_CLASSIFIER_TIMEOUT_MS2, createModelClassifier2, selectClassifierRoute2 };

package/dist/{index-gmxxtqpe.js → index-9df1q7j4.js}

@@ -15,6 +15,12 @@ import {
   mcpServerHasRegistrations,
   STRUCTURED_OUTPUT_TOOL_NAME,
   looksLikeCommand,
+  capBytes,
+  neutralizeReminderTags,
+  readWhole,
+  readCappedLinesAndBytes,
+  registerAttachmentRenderer,
+  attachmentsIn,
   registerChildEngineFactory,
   matchFileRule,
   rawToRuleValue,
@@ -29,12 +35,6 @@ import {
   resolveProjectDirName2,
   buildForkDirectiveText,
   buildForkInitialMessages,
-  capBytes,
-  neutralizeReminderTags,
-  readWhole,
-  readCappedLinesAndBytes,
-  registerAttachmentRenderer,
-  attachmentsIn,
   gitInstructionsEnabled,
   isUserInvocable,
   buildSkillListing,
@@ -79,15 +79,23 @@ import {
   childTranscriptSubpath,
   buildChildTranscriptWriter,
   listChildAgentIds,
-  createKeychainCredentialStore,
-  createKeychainSecretReader,
   resolveSessionProvider,
   redactCredentialRef,
   createProviderContext,
   providerCredentialRef2,
   createModelClassifier2,
   selectClassifierRoute2
-} from "./index-jz5d90c6.js";
+} from "./index-51673qbw.js";
+import {
+  createKeychainCredentialStore,
+  createKeychainSecretReader,
+  createHostCredentialChannel,
+  createHostBrokeredCredentialStore,
+  createHostBrokeredSecretReader,
+  mcpOAuthTestStoreEnvName,
+  resolveSessionMcpOAuthStore,
+  createHostBrokeredMcpOAuthStore
+} from "./index-z6s3r4xm.js";
 import {
   createInMemoryChannel2
 } from "./index-97t2rmtf.js";
@@ -1700,8 +1708,8 @@ function apiProviderFor(providerId) {
   return providerId === undefined ? undefined : API_PROVIDER_BY_PROVIDER_ID[providerId];
 }
 var DEFAULT_PROVIDER_ACCOUNT_ID = "default";
-function createProductionCredentialStore(config, env, home) {
-  const keychain = createKeychainCredentialStore(resolveSessionKeychainService(config));
+function createProductionCredentialStore(config, env, home, keychainMember) {
+  const keychain = keychainMember ?? createKeychainCredentialStore(resolveSessionKeychainService(config));
   return createCompositeCredentialStore([
     {
       ...keychain,
@@ -2201,7 +2209,8 @@ var ALL_TIER_REFUSED_ENV = [
   storeHomeEnvName(WINTER_BRAND5),
   pluginCacheDirEnvName(WINTER_BRAND5),
   providerManagedByHostEnvName(WINTER_BRAND5),
-  disableCronEnvName(WINTER_BRAND5)
+  disableCronEnvName(WINTER_BRAND5),
+  mcpOAuthTestStoreEnvName(WINTER_BRAND5)
 ];
 function escapeRegExpLiteral2(literal) {
   return literal.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
@@ -5469,6 +5478,7 @@ function describeCatalogModel(catalog, model, providerId) {
 async function buildProductionWiring(opts) {
   const { config, env } = opts;
   const brand = config.brand ?? WINTER_BRAND15;
+  const mcpOAuthTestStoreFile = env[mcpOAuthTestStoreEnvName(brand)];
   const winterHome = opts.winterHome ?? config.winterHome ?? resolveWinterHome2(env, brand);
   const storeHomeEnv = env[storeHomeEnvName2(brand)];
   const storeHome = config.storeHome ?? (isUnset(storeHomeEnv) ? undefined : storeHomeEnv);
@@ -5643,9 +5653,15 @@ async function buildProductionWiring(opts) {
     ...skillListingBudgetFraction !== undefined ? { budgetFraction: skillListingBudgetFraction } : {},
     ...config.contextWindowTokens !== undefined ? { contextWindowTokens: config.contextWindowTokens } : {}
   });
+  const hostCredentialChannel = config.hostCredentials === true ? createHostCredentialChannel() : undefined;
+  const hostCredentialOptions = hostCredentialChannel !== undefined ? {
+    credentials: createProductionCredentialStore(config, env, opts.provider?.home ?? env["HOME"] ?? "", createHostBrokeredCredentialStore(hostCredentialChannel)),
+    readKeychainSecret: createHostBrokeredSecretReader(hostCredentialChannel)
+  } : {};
   const providerWiring = buildSessionProvider({
     config,
     env,
+    ...hostCredentialOptions,
     providerSettings: () => providerSettingsFrom(settingsGetter()),
     resolveSlot: (requested, currentModelKey) => resolveSlot(requested, currentModelKey),
     advisorModelSetting: () => settingsGetter()?.advisor?.model,
@@ -5912,6 +5928,8 @@ async function buildProductionWiring(opts) {
       ...pluginWorkflows.length > 0 ? { pluginWorkflows } : {},
       ...settingSources !== undefined ? { settingSources } : {},
       extraMcpServerSources,
+      mcpOAuthStore: hostCredentialChannel !== undefined ? createHostBrokeredMcpOAuthStore(hostCredentialChannel) : resolveSessionMcpOAuthStore({ keychainService: resolveSessionKeychainService(config), testStoreFile: mcpOAuthTestStoreFile }),
+      ...hostCredentialChannel !== undefined ? { hostCredentialChannel } : {},
       initSlashCommands,
       initSkills,
       initPlugins,