agor-live 0.22.0 → 0.23.2

package/dist/executor/db/feathers-repositories.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"feathers-repositories.d.ts","sourceRoot":"","sources":["../../src/db/feathers-repositories.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AACjD,OAAO,KAAK,EACV,MAAM,EACN,QAAQ,EACR,SAAS,EACT,gBAAgB,EAChB,WAAW,EACX,OAAO,EACP,SAAS,EACT,IAAI,EACJ,OAAO,EACP,SAAS,EACT,gBAAgB,EAChB,IAAI,EACL,MAAM,kBAAkB,CAAC;AAE1B;;GAEG;AACH,qBAAa,0BAA0B;IACzB,OAAO,CAAC,MAAM;gBAAN,MAAM,EAAE,UAAU;IAEhC,eAAe,CAAC,SAAS,EAAE,SAAS,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC;IAYzD,QAAQ,CAAC,SAAS,EAAE,SAAS,GAAG,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC;IASvD,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,YAAY,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC;CAIrE;AAED;;GAEG;AACH,qBAAa,0BAA0B;IACzB,OAAO,CAAC,MAAM;gBAAN,MAAM,EAAE,UAAU;IAEhC,QAAQ,CAAC,SAAS,EAAE,SAAS,GAAG,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC;IASvD,MAAM,CAAC,SAAS,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,CAAC,OAAO,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC;CAI7E;AAED;;GAEG;AACH,qBAAa,0BAA0B;IACzB,OAAO,CAAC,MAAM;gBAAN,MAAM,EAAE,UAAU;IAEhC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;CAQ3D;AAED;;GAEG;AACH,qBAAa,uBAAuB;IACtB,OAAO,CAAC,MAAM;gBAAN,MAAM,EAAE,UAAU;IAEhC,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC;CAQrD;AAED;;GAEG;AACH,qBAAa,4BAA4B;IAC3B,OAAO,CAAC,MAAM;gBAAN,MAAM,EAAE,UAAU;IAEhC,QAAQ,CAAC,WAAW,EAAE,WAAW,GAAG,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC;IAS7D,OAAO,CAAC,OAAO,CAAC,EAAE,gBAAgB,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC;CA+BpF;AAED;;GAEG;AACH,qBAAa,mCAAmC;IAClC,OAAO,CAAC,MAAM;gBAAN,MAAM,EAAE,UAAU;IAEhC,eAAe,CAAC,SAAS,EAAE,SAAS,GAAG,OAAO,CAAC,gBAAgB,EAAE,CAAC;IAWlE,iBAAiB,CAAC,WAAW,EAAE,WAAW,GAAG,OAAO,CAAC,gBAAgB,EAAE,CAAC;IAW9E;;;;;OAKG;IACG,WAAW,CAAC,SAAS,EAAE,SAAS,EAAE,WAAW,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC;IAYpF;;;;OAIG;IACG,oBAAoB,CAAC,SAAS,EAAE,SAAS,EAAE,WAAW,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC;IAY7F;;;;;;OAMG;IACG,uBAAuB,CAC3B,SAAS,EAAE,SAAS,EACpB,WAAW,UAAQ,GAClB,OAAO,CAAC,KAAK,CAAC;QAAE,MAAM,EAAE,SAAS,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;CAe7E;AAED;;GAEG;AACH,qBAAa,uBAAuB;IACtB,OAAO,CAAC,MAAM;gBAAN,MAAM,EAAE,UAAU;IAEhC,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC;CAQrD;AAMD;;;GAGG;AACH,MAAM,MAAM,kBAAkB,GAAG,0BAA0B,CAAC;AAC5D,MAAM,MAAM,iBAAiB,GAAG,0BAA0B,CAAC;AAC3D,MAAM,MAAM,gBAAgB,GAAG,0BAA0B,CAAC;AAC1D,MAAM,MAAM,cAAc,GAAG,uBAAuB,CAAC;AACrD,MAAM,MAAM,mBAAmB,GAAG,4BAA4B,CAAC;AAC/D,MAAM,MAAM,0BAA0B,GAAG,mCAAmC,CAAC;AAC7E,MAAM,MAAM,eAAe,GAAG,uBAAuB,CAAC;AAEtD;;GAEG;AACH,wBAAgB,gCAAgC,CAAC,MAAM,EAAE,UAAU;;;;;;;;;;;;EAkBlE"}
+{"version":3,"file":"feathers-repositories.d.ts","sourceRoot":"","sources":["../../src/db/feathers-repositories.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AACjD,OAAO,KAAK,EACV,MAAM,EACN,QAAQ,EACR,SAAS,EACT,gBAAgB,EAChB,WAAW,EACX,OAAO,EACP,SAAS,EACT,IAAI,EACJ,OAAO,EACP,SAAS,EACT,gBAAgB,EAChB,IAAI,EACL,MAAM,kBAAkB,CAAC;AAE1B;;GAEG;AACH,qBAAa,0BAA0B;IACzB,OAAO,CAAC,MAAM;gBAAN,MAAM,EAAE,UAAU;IAEhC,eAAe,CAAC,SAAS,EAAE,SAAS,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC;IAYzD,QAAQ,CAAC,SAAS,EAAE,SAAS,GAAG,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC;IASvD,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,YAAY,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC;CAIrE;AAED;;GAEG;AACH,qBAAa,0BAA0B;IACzB,OAAO,CAAC,MAAM;gBAAN,MAAM,EAAE,UAAU;IAEhC,QAAQ,CAAC,SAAS,EAAE,SAAS,GAAG,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC;IASvD,MAAM,CAAC,SAAS,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,CAAC,OAAO,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC;CAI7E;AAED;;GAEG;AACH,qBAAa,0BAA0B;IACzB,OAAO,CAAC,MAAM;gBAAN,MAAM,EAAE,UAAU;IAEhC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;CAQ3D;AAED;;GAEG;AACH,qBAAa,uBAAuB;IACtB,OAAO,CAAC,MAAM;gBAAN,MAAM,EAAE,UAAU;IAEhC,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC;CAQrD;AAED;;GAEG;AACH,qBAAa,4BAA4B;IAC3B,OAAO,CAAC,MAAM;gBAAN,MAAM,EAAE,UAAU;IAEhC,QAAQ,CAAC,WAAW,EAAE,WAAW,GAAG,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC;IAS7D,OAAO,CAAC,OAAO,CAAC,EAAE,gBAAgB,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC;CA+BpF;AAED;;GAEG;AACH,qBAAa,mCAAmC;IAClC,OAAO,CAAC,MAAM;gBAAN,MAAM,EAAE,UAAU;IAEhC,eAAe,CAAC,SAAS,EAAE,SAAS,GAAG,OAAO,CAAC,gBAAgB,EAAE,CAAC;IAWlE,iBAAiB,CAAC,WAAW,EAAE,WAAW,GAAG,OAAO,CAAC,gBAAgB,EAAE,CAAC;IAW9E;;;;;OAKG;IACG,WAAW,CAAC,SAAS,EAAE,SAAS,EAAE,WAAW,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC;IAYpF;;;;OAIG;IACG,oBAAoB,CACxB,SAAS,EAAE,SAAS,EACpB,WAAW,CAAC,EAAE,OAAO,EACrB,SAAS,CAAC,EAAE,MAAM,GACjB,OAAO,CAAC,SAAS,EAAE,CAAC;IAevB;;;;;;OAMG;IACG,uBAAuB,CAC3B,SAAS,EAAE,SAAS,EACpB,WAAW,UAAQ,GAClB,OAAO,CAAC,KAAK,CAAC;QAAE,MAAM,EAAE,SAAS,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;CAe7E;AAMD;;;;;;;GAOG;AACH,qBAAa,qCAAqC;IACpC,OAAO,CAAC,MAAM;gBAAN,MAAM,EAAE,UAAU;IAEhC,cAAc,CAClB,YAAY,EAAE,WAAW,EAAE,GAC1B,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE;QAAE,aAAa,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAavE;AAED;;GAEG;AACH,qBAAa,uBAAuB;IACtB,OAAO,CAAC,MAAM;gBAAN,MAAM,EAAE,UAAU;IAEhC,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC;CAQrD;AAMD;;;GAGG;AACH,MAAM,MAAM,kBAAkB,GAAG,0BAA0B,CAAC;AAC5D,MAAM,MAAM,iBAAiB,GAAG,0BAA0B,CAAC;AAC3D,MAAM,MAAM,gBAAgB,GAAG,0BAA0B,CAAC;AAC1D,MAAM,MAAM,cAAc,GAAG,uBAAuB,CAAC;AACrD,MAAM,MAAM,mBAAmB,GAAG,4BAA4B,CAAC;AAC/D,MAAM,MAAM,0BAA0B,GAAG,mCAAmC,CAAC;AAC7E,MAAM,MAAM,6BAA6B,GAAG,qCAAqC,CAAC;AAClF,MAAM,MAAM,eAAe,GAAG,uBAAuB,CAAC;AAEtD;;GAEG;AACH,wBAAgB,gCAAgC,CAAC,MAAM,EAAE,UAAU;;;;;;;;;;;;;EAmBlE"}

package/dist/executor/db/feathers-repositories.js

@@ -191,12 +191,15 @@ export class FeathersSessionMCPServersRepository {
      * Executors use the session-scoped route so session-token callers can receive
      * the raw config needed to launch only their own session's MCP servers.
      */
-    async listEffectiveServers(sessionId, enabledOnly) {
+    async listEffectiveServers(sessionId, enabledOnly, forUserId) {
         const service = this.client.service(`/sessions/${sessionId}/mcp-servers`);
         const query = { includeGlobal: true };
         if (enabledOnly) {
             query.enabledOnly = true;
         }
+        if (forUserId) {
+            query.forUserId = forUserId;
+        }
         const result = await service.find({ query });
         return (Array.isArray(result) ? result : result.data);
     }
@@ -217,6 +220,32 @@ export class FeathersSessionMCPServersRepository {
         return (Array.isArray(result) ? result : result.data);
     }
 }
+/**
+ * MCP OAuth auth headers repository - proxies to the trusted executor route.
+ *
+ * Session-scoped MCP server reads intentionally redact OAuth access tokens in
+ * normal API payloads. Executors use this narrow route to retrieve just the
+ * launch-time Authorization header for OAuth servers that are already in the
+ * session's effective MCP scope.
+ */
+export class FeathersMCPOAuthAuthHeadersRepository {
+    client;
+    constructor(client) {
+        this.client = client;
+    }
+    async getAuthHeaders(mcpServerIds) {
+        if (mcpServerIds.length === 0)
+            return {};
+        const service = this.client.service('mcp-servers/oauth-auth-headers');
+        const executorSessionToken = this.client
+            .executorSessionToken;
+        const result = (await service.create({
+            mcp_server_ids: mcpServerIds,
+            ...(executorSessionToken ? { executorSessionToken } : {}),
+        }));
+        return result.headers ?? {};
+    }
+}
 /**
  * Users Repository - proxies to 'users' Feathers service
  */
@@ -248,6 +277,7 @@ export function createFeathersBackedRepositories(client) {
         users: new FeathersUsersRepository(client),
         mcpServers: new FeathersMCPServersRepository(client),
         sessionMCP: new FeathersSessionMCPServersRepository(client),
+        mcpOAuthAuthHeaders: new FeathersMCPOAuthAuthHeadersRepository(client),
         // Services (direct Feathers service access)
         // SDK handlers can use these services directly with proper typing
         messagesService: client.service('messages'),

package/dist/executor/git/index.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Executor-facing operational git helpers.
+ *
+ * The implementation lives in @agor/git so executor and daemon compatibility
+ * paths share one audited implementation instead of drifting copies.
+ */
+export * from '@agor/git';
+//# sourceMappingURL=index.d.ts.map

package/dist/executor/git/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/git/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,cAAc,WAAW,CAAC"}

package/dist/executor/git/index.js

@@ -0,0 +1,7 @@
+/**
+ * Executor-facing operational git helpers.
+ *
+ * The implementation lives in @agor/git so executor and daemon compatibility
+ * paths share one audited implementation instead of drifting copies.
+ */
+export * from '@agor/git';

package/dist/executor/handlers/sdk/base-executor.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"base-executor.d.ts","sourceRoot":"","sources":["../../../src/handlers/sdk/base-executor.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,KAAK,UAAU,EAAiB,MAAM,mBAAmB,CAAC;AAGnE,OAAO,KAAK,EACV,eAAe,EACf,oBAAoB,EACpB,SAAS,EACT,aAAa,EACb,cAAc,EACd,SAAS,EAGT,MAAM,EACP,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EAAE,gCAAgC,EAAE,MAAM,mCAAmC,CAAC;AACrF,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,kCAAkC,CAAC;AAE3E,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,mCAAmC,CAAC;AAYpE;;GAEG;AACH,MAAM,WAAW,QAAQ;IACvB,0BAA0B,CACxB,SAAS,EAAE,SAAS,EACpB,MAAM,EAAE,MAAM,EACd,MAAM,CAAC,EAAE,MAAM,EACf,cAAc,CAAC,EAAE,cAAc,EAC/B,SAAS,CAAC,EAAE,kBAAkB,EAC9B,eAAe,CAAC,EAAE,eAAe,EACjC,aAAa,CAAC,EAAE,aAAa,GAC5B,OAAO,CAAC;QACT,aAAa,EAAE,SAAS,CAAC;QACzB,mBAAmB,EAAE,SAAS,EAAE,CAAC;QACjC,UAAU,CAAC,EAAE;YACX,YAAY,CAAC,EAAE,MAAM,CAAC;YACtB,aAAa,CAAC,EAAE,MAAM,CAAC;YACvB,iBAAiB,CAAC,EAAE,MAAM,CAAC;YAC3B,qBAAqB,CAAC,EAAE,MAAM,CAAC;SAChC,CAAC;QACF,UAAU,CAAC,EAAE,OAAO,CAAC;QACrB,8EAA8E;QAC9E,QAAQ,CAAC,EAAE,OAAO,CAAC;QACnB,mDAAmD;QACnD,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;QACxB,oEAAoE;QACpE,cAAc,CAAC,EAAE,OAAO,CAAC;QACzB;;;;;;WAMG;QACH,eAAe,CAAC,EAAE,oBAAoB,CAAC;QACvC;;;;WAIG;QACH,KAAK,CAAC,EAAE,MAAM,CAAC;KAChB,CAAC,CAAC;IAGH,QAAQ,CAAC,CACP,SAAS,EAAE,SAAS,EACpB,MAAM,CAAC,EAAE,MAAM,GACd,OAAO,CAAC;QACT,OAAO,EAAE,OAAO,CAAC;QACjB,aAAa,CAAC,EAAE,OAAO,CAAC;YAAE,MAAM,EAAE,MAAM,CAAC;YAAC,MAAM,EAAE,WAAW,GAAG,QAAQ,GAAG,WAAW,CAAA;SAAE,CAAC,CAAC;QAC1F,MAAM,CAAC,EAAE,MAAM,CAAC;KACjB,CAAC,CAAC;IAEH;;;;;;;OAOG;IACH,oBAAoB,CAAC,CACnB,SAAS,EAAE,MAAM,EACjB,aAAa,CAAC,EAAE,MAAM,EACtB,qBAAqB,CAAC,EAAE,OAAO,GAC9B,OAAO,CAAC,MAAM,CAAC,CAAC;CACpB;AAED;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,UAAU,CAAC;IACnB,KAAK,EAAE,UAAU,CAAC,OAAO,gCAAgC,CAAC,CAAC;IAC3D,SAAS,EAAE,kBAAkB,CAAC;CAC/B;AAED;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CACtC,MAAM,EAAE,UAAU,EAClB,QAAQ,EAAE,MAAM,EAChB,SAAS,EAAE,SAAS,GACnB,kBAAkB,CAoFpB;AAED;;GAEG;AACH,wBAAgB,sBAAsB,CACpC,MAAM,EAAE,UAAU,EAClB,QAAQ,EAAE,MAAM,EAChB,SAAS,EAAE,SAAS,GACnB,gBAAgB,CAMlB;AAiED,wBAAsB,wBAAwB,CAC5C,MAAM,EAAE,UAAU,EAClB,SAAS,EAAE,SAAS,GACnB,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAG7B;AAED,wBAAsB,wBAAwB,CAC5C,MAAM,EAAE,UAAU,EAClB,SAAS,EAAE,SAAS,EACpB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,IAAI,CAAC,CAcf;AA6BD,wBAAsB,oBAAoB,CACxC,OAAO,EAAE,UAAU,EACnB,MAAM,EAAE,UAAU,EAClB,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,eAAe,GACpB,OAAO,CAAC,OAAO,mBAAmB,EAAE,mBAAmB,CAAC,CAwB1D;AAED;;GAEG;AACH,wBAAsB,eAAe,CAAC,MAAM,EAAE;IAC5C,MAAM,EAAE,UAAU,CAAC;IACnB,SAAS,EAAE,SAAS,CAAC;IACrB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,cAAc,CAAC,EAAE,cAAc,CAAC;IAChC,eAAe,EAAE,eAAe,CAAC;IACjC,YAAY,EAAE,UAAU,CAAC;IACzB,QAAQ,EAAE,eAAe,CAAC;IAC1B,aAAa,CAAC,EAAE,aAAa,CAAC;IAC9B,UAAU,EAAE,CACV,KAAK,EAAE,UAAU,CAAC,OAAO,gCAAgC,CAAC,EAC1D,MAAM,EAAE,MAAM,EACd,aAAa,EAAE,OAAO,KACnB,QAAQ,CAAC;CACf,GAAG,OAAO,CAAC,IAAI,CAAC,CAkQhB"}
+{"version":3,"file":"base-executor.d.ts","sourceRoot":"","sources":["../../../src/handlers/sdk/base-executor.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,KAAK,UAAU,EAAiB,MAAM,mBAAmB,CAAC;AAEnE,OAAO,KAAK,EACV,eAAe,EACf,oBAAoB,EACpB,SAAS,EACT,aAAa,EACb,cAAc,EACd,SAAS,EAGT,MAAM,EACP,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EAAE,gCAAgC,EAAE,MAAM,mCAAmC,CAAC;AAErF,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,kCAAkC,CAAC;AAE3E,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,mCAAmC,CAAC;AAYpE;;GAEG;AACH,MAAM,WAAW,QAAQ;IACvB,0BAA0B,CACxB,SAAS,EAAE,SAAS,EACpB,MAAM,EAAE,MAAM,EACd,MAAM,CAAC,EAAE,MAAM,EACf,cAAc,CAAC,EAAE,cAAc,EAC/B,SAAS,CAAC,EAAE,kBAAkB,EAC9B,eAAe,CAAC,EAAE,eAAe,EACjC,aAAa,CAAC,EAAE,aAAa,GAC5B,OAAO,CAAC;QACT,aAAa,EAAE,SAAS,CAAC;QACzB,mBAAmB,EAAE,SAAS,EAAE,CAAC;QACjC,UAAU,CAAC,EAAE;YACX,YAAY,CAAC,EAAE,MAAM,CAAC;YACtB,aAAa,CAAC,EAAE,MAAM,CAAC;YACvB,iBAAiB,CAAC,EAAE,MAAM,CAAC;YAC3B,qBAAqB,CAAC,EAAE,MAAM,CAAC;SAChC,CAAC;QACF,UAAU,CAAC,EAAE,OAAO,CAAC;QACrB,8EAA8E;QAC9E,QAAQ,CAAC,EAAE,OAAO,CAAC;QACnB,mDAAmD;QACnD,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;QACxB,oEAAoE;QACpE,cAAc,CAAC,EAAE,OAAO,CAAC;QACzB;;;;;;WAMG;QACH,eAAe,CAAC,EAAE,oBAAoB,CAAC;QACvC;;;;WAIG;QACH,KAAK,CAAC,EAAE,MAAM,CAAC;KAChB,CAAC,CAAC;IAGH,QAAQ,CAAC,CACP,SAAS,EAAE,SAAS,EACpB,MAAM,CAAC,EAAE,MAAM,GACd,OAAO,CAAC;QACT,OAAO,EAAE,OAAO,CAAC;QACjB,aAAa,CAAC,EAAE,OAAO,CAAC;YAAE,MAAM,EAAE,MAAM,CAAC;YAAC,MAAM,EAAE,WAAW,GAAG,QAAQ,GAAG,WAAW,CAAA;SAAE,CAAC,CAAC;QAC1F,MAAM,CAAC,EAAE,MAAM,CAAC;KACjB,CAAC,CAAC;IAEH;;;;;;;OAOG;IACH,oBAAoB,CAAC,CACnB,SAAS,EAAE,MAAM,EACjB,aAAa,CAAC,EAAE,MAAM,EACtB,qBAAqB,CAAC,EAAE,OAAO,GAC9B,OAAO,CAAC,MAAM,CAAC,CAAC;CACpB;AAED;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,UAAU,CAAC;IACnB,KAAK,EAAE,UAAU,CAAC,OAAO,gCAAgC,CAAC,CAAC;IAC3D,SAAS,EAAE,kBAAkB,CAAC;CAC/B;AAED;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CACtC,MAAM,EAAE,UAAU,EAClB,QAAQ,EAAE,MAAM,EAChB,SAAS,EAAE,SAAS,GACnB,kBAAkB,CAoFpB;AAED;;GAEG;AACH,wBAAgB,sBAAsB,CACpC,MAAM,EAAE,UAAU,EAClB,QAAQ,EAAE,MAAM,EAChB,SAAS,EAAE,SAAS,GACnB,gBAAgB,CAMlB;AAiED,wBAAsB,wBAAwB,CAC5C,MAAM,EAAE,UAAU,EAClB,SAAS,EAAE,SAAS,GACnB,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAG7B;AAED,wBAAsB,wBAAwB,CAC5C,MAAM,EAAE,UAAU,EAClB,SAAS,EAAE,SAAS,EACpB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,IAAI,CAAC,CAcf;AA6BD,wBAAsB,oBAAoB,CACxC,OAAO,EAAE,UAAU,EACnB,MAAM,EAAE,UAAU,EAClB,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,eAAe,GACpB,OAAO,CAAC,OAAO,mBAAmB,EAAE,mBAAmB,CAAC,CA2B1D;AAED;;GAEG;AACH,wBAAsB,eAAe,CAAC,MAAM,EAAE;IAC5C,MAAM,EAAE,UAAU,CAAC;IACnB,SAAS,EAAE,SAAS,CAAC;IACrB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,cAAc,CAAC,EAAE,cAAc,CAAC;IAChC,eAAe,EAAE,eAAe,CAAC;IACjC,YAAY,EAAE,UAAU,CAAC;IACzB,QAAQ,EAAE,eAAe,CAAC;IAC1B,aAAa,CAAC,EAAE,aAAa,CAAC;IAC9B,UAAU,EAAE,CACV,KAAK,EAAE,UAAU,CAAC,OAAO,gCAAgC,CAAC,EAC1D,MAAM,EAAE,MAAM,EACd,aAAa,EAAE,OAAO,KACnB,QAAQ,CAAC;CACf,GAAG,OAAO,CAAC,IAAI,CAAC,CAkQhB"}

package/dist/executor/handlers/sdk/base-executor.js

@@ -6,9 +6,9 @@
  */
 import { resolveApiKey } from '@agor/core/config';
 import { generateId, shortId } from '@agor/core/db';
-import { getCurrentBranch, getGitState } from '@agor/core/git';
 import { MessageRole } from '@agor/core/types';
 import { createFeathersBackedRepositories } from '../../db/feathers-repositories.js';
+import { getCurrentBranch, getGitState } from '../../git/index.js';
 import { normalizeRawSdkResponse } from '../../sdk-handlers/normalizer-factory.js';
 import { configureSessionGitSafeDirectories } from './git-safe-directory.js';
 const DEBUG_SDK_EXECUTOR = process.env.AGOR_DEBUG_SDK_EXECUTOR === '1' || process.env.DEBUG?.includes('sdk-executor');
@@ -206,10 +206,13 @@ export async function resolveApiKeyForTask(keyName, client, taskId, tool) {
     // `tool` scopes the per-user lookup to the calling SDK's bucket so a Codex spawn
     // never resolves a key stored under `agentic_tools['claude-code']`, and vice versa.
     try {
+        const executorSessionToken = client
+            .executorSessionToken;
         const result = (await client.service('config/resolve-api-key').create({
             taskId,
             keyName,
             tool,
+            ...(executorSessionToken ? { executorSessionToken } : {}),
         }));
         sdkDebug(`[API Key Resolution] Resolved ${keyName} via daemon (source: ${result.source})`);
         return result;

package/dist/executor/handlers/sdk/claude.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"claude.d.ts","sourceRoot":"","sources":["../../../src/handlers/sdk/claude.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAEzF,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAIlE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,mCAAmC,CAAC;AAEpE;;;;GAIG;AACH,wBAAsB,qBAAqB,CAAC,MAAM,EAAE;IAClD,MAAM,EAAE,UAAU,CAAC;IACnB,SAAS,EAAE,SAAS,CAAC;IACrB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,cAAc,CAAC,EAAE,cAAc,CAAC;IAChC,eAAe,EAAE,eAAe,CAAC;IACjC,aAAa,CAAC,EAAE,aAAa,CAAC;IAC9B,cAAc,CAAC,EAAE,mBAAmB,CAAC;CACtC,GAAG,OAAO,CAAC,IAAI,CAAC,CA8ChB"}
+{"version":3,"file":"claude.d.ts","sourceRoot":"","sources":["../../../src/handlers/sdk/claude.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAEzF,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAIlE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,mCAAmC,CAAC;AAEpE;;;;GAIG;AACH,wBAAsB,qBAAqB,CAAC,MAAM,EAAE;IAClD,MAAM,EAAE,UAAU,CAAC;IACnB,SAAS,EAAE,SAAS,CAAC;IACrB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,cAAc,CAAC,EAAE,cAAc,CAAC;IAChC,eAAe,EAAE,eAAe,CAAC;IACjC,aAAa,CAAC,EAAE,aAAa,CAAC;IAC9B,cAAc,CAAC,EAAE,mBAAmB,CAAC;CACtC,GAAG,OAAO,CAAC,IAAI,CAAC,CA+ChB"}

package/dist/executor/handlers/sdk/claude.js

@@ -33,7 +33,7 @@ export async function executeClaudeCodeTask(params) {
             toolName: 'claude-code',
             createTool: (repos, apiKey, useNativeAuth) => new ClaudeTool(repos.messages, repos.sessions, apiKey, repos.messagesService, repos.sessionMCP, repos.mcpServers, permissionService, repos.tasksService, repos.tasksStreamingService, repos.sessionsService, repos.branches, repos.repos, true, // mcpEnabled
             useNativeAuth, // Flag for Claude CLI OAuth (`claude login`)
-            repos.users),
+            repos.users, repos.mcpOAuthAuthHeaders),
         });
     }
     finally {

package/dist/executor/handlers/sdk/codex.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"codex.d.ts","sourceRoot":"","sources":["../../../src/handlers/sdk/codex.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAGzF,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,mCAAmC,CAAC;AAEpE;;;;GAIG;AACH,wBAAsB,gBAAgB,CAAC,MAAM,EAAE;IAC7C,MAAM,EAAE,UAAU,CAAC;IACnB,SAAS,EAAE,SAAS,CAAC;IACrB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,cAAc,CAAC,EAAE,cAAc,CAAC;IAChC,eAAe,EAAE,eAAe,CAAC;IACjC,aAAa,CAAC,EAAE,aAAa,CAAC;CAC/B,GAAG,OAAO,CAAC,IAAI,CAAC,CAyBhB"}
+{"version":3,"file":"codex.d.ts","sourceRoot":"","sources":["../../../src/handlers/sdk/codex.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAGzF,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,mCAAmC,CAAC;AAEpE;;;;GAIG;AACH,wBAAsB,gBAAgB,CAAC,MAAM,EAAE;IAC7C,MAAM,EAAE,UAAU,CAAC;IACnB,SAAS,EAAE,SAAS,CAAC;IACrB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,cAAc,CAAC,EAAE,cAAc,CAAC;IAChC,eAAe,EAAE,eAAe,CAAC;IACjC,aAAa,CAAC,EAAE,aAAa,CAAC;CAC/B,GAAG,OAAO,CAAC,IAAI,CAAC,CA0BhB"}

package/dist/executor/handlers/sdk/codex.js

@@ -20,6 +20,6 @@ export async function executeCodexTask(params) {
         toolName: 'codex',
         createTool: (repos, apiKey, useNativeAuth) => new CodexTool(repos.messages, repos.sessions, repos.sessionMCP, repos.branches, repos.repos, apiKey, repos.messagesService, repos.tasksService, repos.tasksStreamingService, useNativeAuth, // Flag for native auth (if applicable)
         repos.mcpServers, // MCPServerRepository for global MCP server resolution
-        repos.users),
+        repos.users, repos.mcpOAuthAuthHeaders),
     });
 }

package/dist/executor/handlers/sdk/copilot.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"copilot.d.ts","sourceRoot":"","sources":["../../../src/handlers/sdk/copilot.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAEzF,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAIlE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,mCAAmC,CAAC;AAEpE;;;;GAIG;AACH,wBAAsB,kBAAkB,CAAC,MAAM,EAAE;IAC/C,MAAM,EAAE,UAAU,CAAC;IACnB,SAAS,EAAE,SAAS,CAAC;IACrB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,cAAc,CAAC,EAAE,cAAc,CAAC;IAChC,eAAe,EAAE,eAAe,CAAC;IACjC,aAAa,CAAC,EAAE,aAAa,CAAC;IAC9B,cAAc,CAAC,EAAE,mBAAmB,CAAC;CACtC,GAAG,OAAO,CAAC,IAAI,CAAC,CA6ChB"}
+{"version":3,"file":"copilot.d.ts","sourceRoot":"","sources":["../../../src/handlers/sdk/copilot.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAEzF,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAIlE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,mCAAmC,CAAC;AAEpE;;;;GAIG;AACH,wBAAsB,kBAAkB,CAAC,MAAM,EAAE;IAC/C,MAAM,EAAE,UAAU,CAAC;IACnB,SAAS,EAAE,SAAS,CAAC;IACrB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,cAAc,CAAC,EAAE,cAAc,CAAC;IAChC,eAAe,EAAE,eAAe,CAAC;IACjC,aAAa,CAAC,EAAE,aAAa,CAAC;IAC9B,cAAc,CAAC,EAAE,mBAAmB,CAAC;CACtC,GAAG,OAAO,CAAC,IAAI,CAAC,CA8ChB"}

package/dist/executor/handlers/sdk/copilot.js

@@ -32,7 +32,7 @@ export async function executeCopilotTask(params) {
             ...params,
             apiKeyEnvVar: TOOL_API_KEY_NAMES.copilot,
             toolName: 'copilot',
-            createTool: (repos, apiKey, useNativeAuth) => new CopilotTool(repos.messages, repos.sessions, repos.sessionMCP, repos.branches, repos.repos, apiKey, repos.messagesService, repos.tasksService, useNativeAuth, repos.mcpServers, repos.users, permissionService, repos.sessionsService),
+            createTool: (repos, apiKey, useNativeAuth) => new CopilotTool(repos.messages, repos.sessions, repos.sessionMCP, repos.branches, repos.repos, apiKey, repos.messagesService, repos.tasksService, useNativeAuth, repos.mcpServers, repos.users, permissionService, repos.sessionsService, repos.mcpOAuthAuthHeaders),
         });
     }
     finally {

package/dist/executor/handlers/sdk/cursor.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cursor.d.ts","sourceRoot":"","sources":["../../../src/handlers/sdk/cursor.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAMH,OAAO,KAAK,EACV,YAAY,EAGZ,aAAa,EACb,cAAc,EACd,SAAS,EAET,MAAM,EACP,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EAAyC,KAAK,UAAU,EAAE,MAAM,aAAa,CAAC;AAGrF,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAGlE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,mCAAmC,CAAC;AAiCpE,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CA2B5D;AAED,wBAAgB,wBAAwB,CACtC,KAAK,EAAE,OAAO,CAAC,UAAU,EAAE;IAAE,IAAI,EAAE,WAAW,CAAA;CAAE,CAAC,GAChD,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAmCzB;AAED,wBAAgB,2BAA2B,CAAC,IAAI,EAAE;IAChD,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB,GAAG,YAAY,EAAE,CAgBjB;AAgRD;;GAEG;AACH,wBAAsB,iBAAiB,CAAC,MAAM,EAAE;IAC9C,MAAM,EAAE,UAAU,CAAC;IACnB,SAAS,EAAE,SAAS,CAAC;IACrB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,cAAc,CAAC,EAAE,cAAc,CAAC;IAChC,eAAe,EAAE,eAAe,CAAC;IACjC,aAAa,CAAC,EAAE,aAAa,CAAC;IAC9B,cAAc,CAAC,EAAE,mBAAmB,CAAC;CACtC,GAAG,OAAO,CAAC,IAAI,CAAC,CA+MhB"}
+{"version":3,"file":"cursor.d.ts","sourceRoot":"","sources":["../../../src/handlers/sdk/cursor.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAMH,OAAO,KAAK,EACV,YAAY,EAGZ,aAAa,EACb,cAAc,EACd,SAAS,EAET,MAAM,EACP,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EAAyC,KAAK,UAAU,EAAE,MAAM,aAAa,CAAC;AAGrF,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAGlE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,mCAAmC,CAAC;AAiCpE,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CA2B5D;AAED,wBAAgB,wBAAwB,CACtC,KAAK,EAAE,OAAO,CAAC,UAAU,EAAE;IAAE,IAAI,EAAE,WAAW,CAAA;CAAE,CAAC,GAChD,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAmCzB;AAED,wBAAgB,2BAA2B,CAAC,IAAI,EAAE;IAChD,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB,GAAG,YAAY,EAAE,CAgBjB;AAiRD;;GAEG;AACH,wBAAsB,iBAAiB,CAAC,MAAM,EAAE;IAC9C,MAAM,EAAE,UAAU,CAAC;IACnB,SAAS,EAAE,SAAS,CAAC;IACrB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,cAAc,CAAC,EAAE,cAAc,CAAC;IAChC,eAAe,EAAE,eAAe,CAAC;IACjC,aAAa,CAAC,EAAE,aAAa,CAAC;IAC9B,cAAc,CAAC,EAAE,mBAAmB,CAAC;CACtC,GAAG,OAAO,CAAC,IAAI,CAAC,CA+MhB"}

package/dist/executor/handlers/sdk/cursor.js

@@ -154,6 +154,7 @@ async function buildCursorMcpServers(args) {
     const serversWithSource = await getMcpServersForSession(args.sessionId, {
         sessionMCPRepo: args.repos.sessionMCP,
         mcpServerRepo: args.repos.mcpServers,
+        mcpOAuthAuthHeadersRepo: args.repos.mcpOAuthAuthHeaders,
         forUserId: args.forUserId,
     });
     for (const { server } of serversWithSource) {

package/dist/executor/handlers/sdk/gemini.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"gemini.d.ts","sourceRoot":"","sources":["../../../src/handlers/sdk/gemini.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAGzF,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,mCAAmC,CAAC;AAEpE;;;;GAIG;AACH,wBAAsB,iBAAiB,CAAC,MAAM,EAAE;IAC9C,MAAM,EAAE,UAAU,CAAC;IACnB,SAAS,EAAE,SAAS,CAAC;IACrB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,cAAc,CAAC,EAAE,cAAc,CAAC;IAChC,eAAe,EAAE,eAAe,CAAC;IACjC,aAAa,CAAC,EAAE,aAAa,CAAC;CAC/B,GAAG,OAAO,CAAC,IAAI,CAAC,CAyBhB"}
+{"version":3,"file":"gemini.d.ts","sourceRoot":"","sources":["../../../src/handlers/sdk/gemini.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAGzF,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,mCAAmC,CAAC;AAEpE;;;;GAIG;AACH,wBAAsB,iBAAiB,CAAC,MAAM,EAAE;IAC9C,MAAM,EAAE,UAAU,CAAC;IACnB,SAAS,EAAE,SAAS,CAAC;IACrB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,cAAc,CAAC,EAAE,cAAc,CAAC;IAChC,eAAe,EAAE,eAAe,CAAC;IACjC,aAAa,CAAC,EAAE,aAAa,CAAC;CAC/B,GAAG,OAAO,CAAC,IAAI,CAAC,CA0BhB"}

package/dist/executor/handlers/sdk/gemini.js

@@ -20,6 +20,6 @@ export async function executeGeminiTask(params) {
         toolName: 'gemini',
         createTool: (repos, apiKey, useNativeAuth) => new GeminiTool(repos.messages, repos.sessions, apiKey, repos.messagesService, repos.tasksService, repos.branches, repos.repos, repos.mcpServers, repos.sessionMCP, true, // mcpEnabled
         useNativeAuth, // Flag to use OAuth when no API key
-        repos.users),
+        repos.users, repos.mcpOAuthAuthHeaders),
     });
 }

package/dist/executor/handlers/sdk/git-safe-directory.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"git-safe-directory.d.ts","sourceRoot":"","sources":["../../../src/handlers/sdk/git-safe-directory.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,mCAAmC,CAAC;AA6BpE;;;;;;;;;;;;;GAaG;AACH,wBAAsB,kCAAkC,CACtD,MAAM,EAAE,UAAU,EAClB,SAAS,EAAE,SAAS,EACpB,SAAS,SAAyB,GACjC,OAAO,CAAC,MAAM,EAAE,CAAC,CAyCnB"}
+{"version":3,"file":"git-safe-directory.d.ts","sourceRoot":"","sources":["../../../src/handlers/sdk/git-safe-directory.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAElD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,mCAAmC,CAAC;AA6BpE;;;;;;;;;;;;;GAaG;AACH,wBAAsB,kCAAkC,CACtD,MAAM,EAAE,UAAU,EAClB,SAAS,EAAE,SAAS,EACpB,SAAS,SAAyB,GACjC,OAAO,CAAC,MAAM,EAAE,CAAC,CAyCnB"}

package/dist/executor/handlers/sdk/git-safe-directory.js

@@ -1,4 +1,4 @@
-import { buildGitConfigParameters } from '@agor/core/git';
+import { buildGitConfigParameters } from '../../git/index.js';
 const DEBUG_GIT_SAFE_DIRECTORY = process.env.AGOR_DEBUG_GIT_SAFE_DIRECTORY === '1' ||
     process.env.DEBUG?.includes('git-safe-directory');
 function gitSafeDirectoryDebug(...args) {

package/dist/executor/handlers/sdk/opencode.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"opencode.d.ts","sourceRoot":"","sources":["../../../src/handlers/sdk/opencode.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAGH,OAAO,KAAK,EAAa,cAAc,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAGrF,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAElE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,mCAAmC,CAAC;AAGpE;;;;GAIG;AACH,wBAAsB,mBAAmB,CAAC,MAAM,EAAE;IAChD,MAAM,EAAE,UAAU,CAAC;IACnB,SAAS,EAAE,SAAS,CAAC;IACrB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,cAAc,CAAC,EAAE,cAAc,CAAC;IAChC,eAAe,EAAE,eAAe,CAAC;IACjC,cAAc,CAAC,EAAE,mBAAmB,CAAC;CACtC,GAAG,OAAO,CAAC,IAAI,CAAC,CAuJhB"}
+{"version":3,"file":"opencode.d.ts","sourceRoot":"","sources":["../../../src/handlers/sdk/opencode.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAGH,OAAO,KAAK,EAAa,cAAc,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAGrF,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAElE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,mCAAmC,CAAC;AAGpE;;;;GAIG;AACH,wBAAsB,mBAAmB,CAAC,MAAM,EAAE;IAChD,MAAM,EAAE,UAAU,CAAC;IACnB,SAAS,EAAE,SAAS,CAAC;IACrB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,cAAc,CAAC,EAAE,cAAc,CAAC;IAChC,eAAe,EAAE,eAAe,CAAC;IACjC,cAAc,CAAC,EAAE,mBAAmB,CAAC;CACtC,GAAG,OAAO,CAAC,IAAI,CAAC,CAwJhB"}

package/dist/executor/handlers/sdk/opencode.js

@@ -56,7 +56,7 @@ export async function executeOpenCodeTask(params) {
         const tool = new OpenCodeTool({
             enabled: true,
             serverUrl,
-        }, repos.messagesService, repos.sessionMCP, repos.mcpServers);
+        }, repos.messagesService, repos.sessionMCP, repos.mcpServers, repos.mcpOAuthAuthHeaders);
         let opencodeSessionId;
         // Check if we already have an OpenCode session (stored in sdk_session_id)
         if (session.sdk_session_id) {

package/dist/executor/payload-types.d.ts

@@ -14,11 +14,11 @@ export { type ResolvedConfigSlice, ResolvedConfigSliceSchema };
  * Tool types supported by the prompt command
  */
 export declare const ToolTypeSchema: z.ZodEnum<{
+    opencode: "opencode";
     "claude-code": "claude-code";
     "claude-code-cli": "claude-code-cli";
     gemini: "gemini";
     codex: "codex";
-    opencode: "opencode";
     copilot: "copilot";
     cursor: "cursor";
 }>;
@@ -103,11 +103,11 @@ export declare const PromptPayloadSchema: z.ZodObject<{
         taskId: z.ZodString;
         prompt: z.ZodString;
         tool: z.ZodEnum<{
+            opencode: "opencode";
             "claude-code": "claude-code";
             "claude-code-cli": "claude-code-cli";
             gemini: "gemini";
             codex: "codex";
-            opencode: "opencode";
             copilot: "copilot";
             cursor: "cursor";
         }>;
@@ -460,8 +460,8 @@ export declare const EnvironmentLifecyclePayloadSchema: z.ZodObject<{
         action: z.ZodEnum<{
             start: "start";
             stop: "stop";
-            restart: "restart";
             nuke: "nuke";
+            restart: "restart";
         }>;
         startCommand: z.ZodOptional<z.ZodString>;
         stopCommand: z.ZodOptional<z.ZodString>;
@@ -821,11 +821,11 @@ export declare const ExecutorPayloadSchema: z.ZodDiscriminatedUnion<[z.ZodObject
         taskId: z.ZodString;
         prompt: z.ZodString;
         tool: z.ZodEnum<{
+            opencode: "opencode";
             "claude-code": "claude-code";
             "claude-code-cli": "claude-code-cli";
             gemini: "gemini";
             codex: "codex";
-            opencode: "opencode";
             copilot: "copilot";
             cursor: "cursor";
         }>;
@@ -1116,8 +1116,8 @@ export declare const ExecutorPayloadSchema: z.ZodDiscriminatedUnion<[z.ZodObject
         action: z.ZodEnum<{
             start: "start";
             stop: "stop";
-            restart: "restart";
             nuke: "nuke";
+            restart: "restart";
         }>;
         startCommand: z.ZodOptional<z.ZodString>;
         stopCommand: z.ZodOptional<z.ZodString>;

package/dist/executor/sdk-handlers/base/diff-enrichment.js

@@ -19,8 +19,8 @@
  */
 import * as fs from 'node:fs';
 import * as path from 'node:path';
-import { createGit } from '@agor/core/git';
 import { structuredPatch } from 'diff';
+import { createGit } from '../../git/index.js';
 /** Maximum file size we'll read for diff computation (1 MB) */
 const MAX_FILE_SIZE_BYTES = 1_048_576;
 /** Context lines around changes (same as Claude Code CLI) */

package/dist/executor/sdk-handlers/base/mcp-scoping.d.ts

@@ -17,7 +17,7 @@
  * truly global and available to all sessions regardless of who created them.
  */
 import type { MCPServer, SessionID } from '@agor/core/types';
-import type { MCPServerRepository, SessionMCPServerRepository } from '../../db/feathers-repositories.js';
+import type { MCPOAuthAuthHeadersRepository, MCPServerRepository, SessionMCPServerRepository } from '../../db/feathers-repositories.js';
 /**
  * MCP server with source metadata
  */
@@ -31,6 +31,13 @@ export interface MCPServerWithSource {
 export interface MCPResolutionDeps {
     sessionMCPRepo?: SessionMCPServerRepository;
     mcpServerRepo?: MCPServerRepository;
+    /**
+     * Trusted executor-only route for hydrating OAuth Authorization headers.
+     *
+     * Normal session MCP server payloads redact OAuth access tokens, so executor
+     * paths must not rely on `server.auth.oauth_access_token` being present.
+     */
+    mcpOAuthAuthHeadersRepo?: MCPOAuthAuthHeadersRepository;
     /**
      * User ID to use for fetching per-user OAuth tokens.
      * When provided, MCP servers with per-user OAuth will have tokens injected.

package/dist/executor/sdk-handlers/base/mcp-scoping.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mcp-scoping.d.ts","sourceRoot":"","sources":["../../../src/sdk-handlers/base/mcp-scoping.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAGH,OAAO,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC7D,OAAO,KAAK,EACV,mBAAmB,EACnB,0BAA0B,EAC3B,MAAM,mCAAmC,CAAC;AAe3C;;GAEG;AACH,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,SAAS,CAAC;IAClB,MAAM,EAAE,kBAAkB,GAAG,QAAQ,CAAC;CACvC;AAED;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC,cAAc,CAAC,EAAE,0BAA0B,CAAC;IAC5C,aAAa,CAAC,EAAE,mBAAmB,CAAC;IACpC;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAsB,uBAAuB,CAC3C,SAAS,EAAE,SAAS,EACpB,IAAI,EAAE,iBAAiB,GACtB,OAAO,CAAC,mBAAmB,EAAE,CAAC,CA0JhC"}
+{"version":3,"file":"mcp-scoping.d.ts","sourceRoot":"","sources":["../../../src/sdk-handlers/base/mcp-scoping.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAOH,OAAO,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC7D,OAAO,KAAK,EACV,6BAA6B,EAC7B,mBAAmB,EACnB,0BAA0B,EAC3B,MAAM,mCAAmC,CAAC;AAe3C;;GAEG;AACH,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,SAAS,CAAC;IAClB,MAAM,EAAE,kBAAkB,GAAG,QAAQ,CAAC;CACvC;AAED;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC,cAAc,CAAC,EAAE,0BAA0B,CAAC;IAC5C,aAAa,CAAC,EAAE,mBAAmB,CAAC;IACpC;;;;;OAKG;IACH,uBAAuB,CAAC,EAAE,6BAA6B,CAAC;IACxD;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAsB,uBAAuB,CAC3C,SAAS,EAAE,SAAS,EACpB,IAAI,EAAE,iBAAiB,GACtB,OAAO,CAAC,mBAAmB,EAAE,CAAC,CA+NhC"}

package/dist/executor/sdk-handlers/base/mcp-scoping.js

@@ -16,7 +16,7 @@
  * Note: owner_user_id on MCP servers is NOT used for filtering. Global MCPs are
  * truly global and available to all sessions regardless of who created them.
  */
-import { buildMCPTemplateContextFromEnv, resolveMcpServerTemplates } from '@agor/core/mcp';
+import { buildMCPTemplateContextFromEnv, resolveMcpServerTemplates, TEMPLATE_RESOLVABLE_MCP_AUTH_SECRET_FIELDS, } from '@agor/core/mcp';
 const DEBUG_MCP_SCOPING = process.env.AGOR_DEBUG_MCP_SCOPING === '1' || process.env.DEBUG?.includes('mcp-scoping');
 function mcpDebug(...args) {
     if (DEBUG_MCP_SCOPING) {
@@ -68,7 +68,7 @@ export async function getMcpServersForSession(sessionId, deps) {
             console.warn(`   ⚠️  Skipping duplicate ${source} MCP server: ${server.name} (${server.mcp_server_id})`);
         };
         if (typeof deps.sessionMCPRepo.listEffectiveServers === 'function') {
-            const effectiveServers = await deps.sessionMCPRepo.listEffectiveServers(sessionId, true);
+            const effectiveServers = await deps.sessionMCPRepo.listEffectiveServers(sessionId, true, deps.forUserId);
             mcpDebug(`   📍 Effective session scope: ${effectiveServers.length} server(s)`);
             for (const server of effectiveServers) {
                 addServer(server, server.scope === 'global' ? 'global' : 'session-assigned');
@@ -110,6 +110,16 @@ export async function getMcpServersForSession(sessionId, deps) {
         let templatesResolved = 0;
         let serversSkipped = 0;
         const containsTemplate = (v) => v?.includes('{{') && v?.includes('}}');
+        // Every auth field `resolveMcpServerTemplates` substitutes. Driven from the
+        // canonical secret set plus the non-secret auth templates the resolver also
+        // handles, so this trigger cannot drift from what resolution resolves.
+        const AUTH_TEMPLATE_FIELDS = [
+            ...TEMPLATE_RESOLVABLE_MCP_AUTH_SECRET_FIELDS,
+            'api_url',
+            'oauth_token_url',
+            'oauth_client_id',
+            'oauth_scope',
+        ];
         // Process servers in reverse to safely remove invalid ones
         for (let i = servers.length - 1; i >= 0; i--) {
             const original = servers[i].server;
@@ -119,10 +129,7 @@ export async function getMcpServersForSession(sessionId, deps) {
             const hasEnvTemplates = envValues.some(containsTemplate);
             const hasHeaderTemplates = headerValues.some(containsTemplate);
             const hasUrlTemplate = containsTemplate(original.url);
-            const hasAuthTemplates = containsTemplate(original.auth?.token) ||
-                containsTemplate(original.auth?.api_url) ||
-                containsTemplate(original.auth?.api_token) ||
-                containsTemplate(original.auth?.api_secret);
+            const hasAuthTemplates = AUTH_TEMPLATE_FIELDS.some((field) => containsTemplate(original.auth?.[field]));
             if (hasEnvTemplates || hasHeaderTemplates || hasUrlTemplate || hasAuthTemplates) {
                 const result = resolveMcpServerTemplates(original, templateContext);
                 if (!result.isValid) {
@@ -150,6 +157,51 @@ export async function getMcpServersForSession(sessionId, deps) {
         if (serversSkipped > 0) {
             console.warn(`   ⚠️  Skipped ${serversSkipped} MCP server(s) due to unresolved required templates`);
         }
+        const oauthServers = servers
+            .map(({ server }) => server)
+            .filter((server) => server.auth?.type === 'oauth');
+        if (oauthServers.length > 0) {
+            if (!deps.mcpOAuthAuthHeadersRepo) {
+                mcpDebug(`   ℹ️  ${oauthServers.length} OAuth MCP server(s) resolved without executor auth-header hydrator`);
+            }
+            else {
+                try {
+                    const authHeaders = await deps.mcpOAuthAuthHeadersRepo.getAuthHeaders(oauthServers.map((server) => server.mcp_server_id));
+                    let hydrated = 0;
+                    for (let i = 0; i < servers.length; i++) {
+                        const server = servers[i].server;
+                        if (server.auth?.type !== 'oauth')
+                            continue;
+                        const header = authHeaders[server.mcp_server_id];
+                        const bearer = /^Bearer\s+(.+)$/i.exec(header?.authorization ?? '')?.[1];
+                        if (!bearer) {
+                            if (header?.error && header.error !== 'needs_reauth') {
+                                console.warn(`   ⚠️  OAuth MCP server "${server.name}" auth unavailable: ${header.error}`);
+                            }
+                            else if (header?.error) {
+                                mcpDebug(`   ℹ️  OAuth MCP server "${server.name}" auth unavailable: ${header.error}`);
+                            }
+                            continue;
+                        }
+                        servers[i] = {
+                            ...servers[i],
+                            server: {
+                                ...server,
+                                auth: {
+                                    ...server.auth,
+                                    oauth_access_token: bearer,
+                                },
+                            },
+                        };
+                        hydrated++;
+                    }
+                    mcpDebug(`   🔐 Hydrated OAuth auth headers for ${hydrated} MCP server(s)`);
+                }
+                catch (error) {
+                    console.warn(`   ⚠️  Failed to hydrate OAuth MCP auth headers: ${error instanceof Error ? error.message : String(error)}`);
+                }
+            }
+        }
         // Keep MCP config order stable across turns. Provider SDKs serialize MCP
         // tools into the prompt prefix, so DB/default ordering drift can reduce
         // server-side prompt-cache hits even when the effective server set is the

package/dist/executor/sdk-handlers/claude/claude-tool.d.ts

@@ -6,7 +6,7 @@
  * - ✅ Live execution via Anthropic SDK
  * - ❌ Create new sessions (waiting for SDK)
  */
-import type { BranchRepository, MCPServerRepository, MessagesRepository, RepoRepository, SessionMCPServerRepository, SessionRepository } from '../../db/feathers-repositories.js';
+import type { BranchRepository, MCPOAuthAuthHeadersRepository, MCPServerRepository, MessagesRepository, RepoRepository, SessionMCPServerRepository, SessionRepository } from '../../db/feathers-repositories.js';
 import type { PermissionService } from '../../permissions/permission-service.js';
 import type { NormalizedSdkResponse, RawSdkResponse } from '../../types/sdk-response.js';
 import type { TokenUsage } from '../../types/token-usage.js';
@@ -22,7 +22,7 @@ export declare class ClaudeTool implements ITool {
     readonly name = "Claude Code";
     private promptService?;
     constructor(messagesRepo?: MessagesRepository | undefined, sessionsRepo?: SessionRepository | undefined, apiKey?: string, messagesService?: MessagesService | undefined, sessionMCPRepo?: SessionMCPServerRepository, mcpServerRepo?: MCPServerRepository, permissionService?: PermissionService, tasksService?: TasksService | undefined, tasksStreamingService?: TasksStreamingService | undefined, sessionsService?: SessionsPatchClient, branchesRepo?: BranchRepository, reposRepo?: RepoRepository, mcpEnabled?: boolean, _useNativeAuth?: boolean, // Claude supports `claude login` OAuth, but no special handling needed in tool
-    usersRepo?: import('../../db/feathers-repositories').UsersRepository);
+    usersRepo?: import('../../db/feathers-repositories').UsersRepository, mcpOAuthAuthHeadersRepo?: MCPOAuthAuthHeadersRepository);
     getCapabilities(): ToolCapabilities;
     checkInstalled(): Promise<boolean>;
     private emitTaskEvent;

package/dist/executor/sdk-handlers/claude/claude-tool.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"claude-tool.d.ts","sourceRoot":"","sources":["../../../src/sdk-handlers/claude/claude-tool.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAQH,OAAO,KAAK,EACV,gBAAgB,EAChB,mBAAmB,EACnB,kBAAkB,EAClB,cAAc,EACd,0BAA0B,EAC1B,iBAAiB,EAClB,MAAM,mCAAmC,CAAC;AAC3C,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,yCAAyC,CAAC;AACjF,OAAO,KAAK,EAAE,qBAAqB,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAEzF,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,4BAA4B,CAAC;AAC7D,OAAO,EACL,KAAK,SAAS,EAEd,KAAK,aAAa,EAClB,KAAK,cAAc,EACnB,KAAK,SAAS,EACd,KAAK,MAAM,EAEZ,MAAM,gBAAgB,CAAC;AAExB,OAAO,KAAK,EACV,aAAa,EACb,KAAK,EACL,eAAe,EACf,WAAW,EACX,mBAAmB,EACnB,YAAY,EACZ,qBAAqB,EACrB,gBAAgB,EACjB,MAAM,kBAAkB,CAAC;AAkF1B,qBAAa,UAAW,YAAW,KAAK;IAOpC,OAAO,CAAC,YAAY,CAAC;IACrB,OAAO,CAAC,YAAY,CAAC;IAErB,OAAO,CAAC,eAAe,CAAC;IAIxB,OAAO,CAAC,YAAY,CAAC;IACrB,OAAO,CAAC,qBAAqB,CAAC;IAdhC,QAAQ,CAAC,QAAQ,EAAG,aAAa,CAAU;IAC3C,QAAQ,CAAC,IAAI,iBAAiB;IAE9B,OAAO,CAAC,aAAa,CAAC,CAAsB;gBAGlC,YAAY,CAAC,EAAE,kBAAkB,YAAA,EACjC,YAAY,CAAC,EAAE,iBAAiB,YAAA,EACxC,MAAM,CAAC,EAAE,MAAM,EACP,eAAe,CAAC,EAAE,eAAe,YAAA,EACzC,cAAc,CAAC,EAAE,0BAA0B,EAC3C,aAAa,CAAC,EAAE,mBAAmB,EACnC,iBAAiB,CAAC,EAAE,iBAAiB,EAC7B,YAAY,CAAC,EAAE,YAAY,YAAA,EAC3B,qBAAqB,CAAC,EAAE,qBAAqB,YAAA,EACrD,eAAe,CAAC,EAAE,mBAAmB,EACrC,YAAY,CAAC,EAAE,gBAAgB,EAC/B,SAAS,CAAC,EAAE,cAAc,EAC1B,UAAU,CAAC,EAAE,OAAO,EACpB,cAAc,CAAC,EAAE,OAAO,EAAE,+EAA+E;IACzG,SAAS,CAAC,EAAE,OAAO,gCAAgC,EAAE,eAAe;IAqBtE,eAAe,IAAI,gBAAgB;IAY7B,cAAc,IAAI,OAAO,CAAC,OAAO,CAAC;YAW1B,aAAa;IAarB,aAAa,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,WAAW,CAAC;IA6BrF;;;;;;;;;;;;;;OAcG;IACG,0BAA0B,CAC9B,SAAS,EAAE,SAAS,EACpB,MAAM,EAAE,MAAM,EACd,MAAM,CAAC,EAAE,MAAM,EACf,cAAc,CAAC,EAAE,cAAc,EAC/B,kBAAkB,CAAC,EAAE,OAAO,SAAS,EAAE,kBAAkB,EACzD,eAAe,CAAC,EAAE,eAAe,EACjC,aAAa,CAAC,EAAE,aAAa,GAC5B,OAAO,CAAC;QACT,aAAa,EAAE,SAAS,CAAC;QACzB,mBAAmB,EAAE,SAAS,EAAE,CAAC;QACjC,UAAU,CAAC,EAAE,UAAU,CAAC;QACxB,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,aAAa,CAAC,EAAE,MAAM,CAAC;QACvB,kBAAkB,CAAC,EAAE,MAAM,CAAC;QAC5B,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,UAAU,CAAC,EAAE,OAAO,CAAC;QACrB,cAAc,CAAC,EAAE,OAAO,gBAAgB,EAAE,gBAAgB,CAAC;QAC3D,mFAAmF;QACnF,eAAe,CAAC,EAAE,OAAO,gBAAgB,EAAE,iCAAiC,CAAC;QAC7E,UAAU,CAAC,EAAE,OAAO,CAAC;QACrB,QAAQ,CAAC,EAAE,OAAO,CAAC;QACnB,oGAAoG;QACpG,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;KACzB,CAAC;IAkmBF;;;OAGG;YACW,qBAAqB;IAwCnC;;;;;;;;OAQG;IACG,aAAa,CACjB,SAAS,EAAE,SAAS,EACpB,MAAM,EAAE,MAAM,EACd,MAAM,CAAC,EAAE,MAAM,EACf,cAAc,CAAC,EAAE,cAAc,EAC/B,aAAa,CAAC,EAAE,aAAa,GAC5B,OAAO,CAAC;QACT,aAAa,EAAE,SAAS,CAAC;QACzB,mBAAmB,EAAE,SAAS,EAAE,CAAC;QACjC,UAAU,CAAC,EAAE,UAAU,CAAC;QACxB,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,aAAa,CAAC,EAAE,MAAM,CAAC;QACvB,kBAAkB,CAAC,EAAE,MAAM,CAAC;QAC5B,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,UAAU,CAAC,EAAE,OAAO,CAAC;QACrB,cAAc,CAAC,EAAE,OAAO,gBAAgB,EAAE,gBAAgB,CAAC;QAC3D,mFAAmF;QACnF,eAAe,CAAC,EAAE,OAAO,gBAAgB,EAAE,iCAAiC,CAAC;QAC7E,UAAU,CAAC,EAAE,OAAO,CAAC;QACrB,QAAQ,CAAC,EAAE,OAAO,CAAC;QACnB,oGAAoG;QACpG,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;KACzB,CAAC;IA+PF;;;;;;;;OAQG;IACG,QAAQ,CACZ,SAAS,EAAE,MAAM,EACjB,MAAM,CAAC,EAAE,MAAM,GACd,OAAO,CAAC;QACT,OAAO,EAAE,OAAO,CAAC;QACjB,aAAa,CAAC,EAAE,OAAO,CAAC;YAAE,MAAM,EAAE,MAAM,CAAC;YAAC,MAAM,EAAE,WAAW,GAAG,QAAQ,GAAG,WAAW,CAAA;SAAE,CAAC,CAAC;QAC1F,MAAM,CAAC,EAAE,MAAM,CAAC;KACjB,CAAC;IA2BF;;;;;OAKG;IACH,qBAAqB,CAAC,YAAY,EAAE,cAAc,GAAG,qBAAqB;IAM1E;;;;;;;;;;;;;;;;;;;OAmBG;IACH;;;;;;;;;;;;;;;OAeG;IACG,oBAAoB,CACxB,SAAS,EAAE,MAAM,EACjB,cAAc,CAAC,EAAE,MAAM,EACvB,sBAAsB,CAAC,EAAE,OAAO,GAC/B,OAAO,CAAC,MAAM,CAAC;CAMnB"}
+{"version":3,"file":"claude-tool.d.ts","sourceRoot":"","sources":["../../../src/sdk-handlers/claude/claude-tool.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAQH,OAAO,KAAK,EACV,gBAAgB,EAChB,6BAA6B,EAC7B,mBAAmB,EACnB,kBAAkB,EAClB,cAAc,EACd,0BAA0B,EAC1B,iBAAiB,EAClB,MAAM,mCAAmC,CAAC;AAC3C,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,yCAAyC,CAAC;AACjF,OAAO,KAAK,EAAE,qBAAqB,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAEzF,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,4BAA4B,CAAC;AAC7D,OAAO,EACL,KAAK,SAAS,EAEd,KAAK,aAAa,EAClB,KAAK,cAAc,EACnB,KAAK,SAAS,EACd,KAAK,MAAM,EAEZ,MAAM,gBAAgB,CAAC;AAExB,OAAO,KAAK,EACV,aAAa,EACb,KAAK,EACL,eAAe,EACf,WAAW,EACX,mBAAmB,EACnB,YAAY,EACZ,qBAAqB,EACrB,gBAAgB,EACjB,MAAM,kBAAkB,CAAC;AAkF1B,qBAAa,UAAW,YAAW,KAAK;IAOpC,OAAO,CAAC,YAAY,CAAC;IACrB,OAAO,CAAC,YAAY,CAAC;IAErB,OAAO,CAAC,eAAe,CAAC;IAIxB,OAAO,CAAC,YAAY,CAAC;IACrB,OAAO,CAAC,qBAAqB,CAAC;IAdhC,QAAQ,CAAC,QAAQ,EAAG,aAAa,CAAU;IAC3C,QAAQ,CAAC,IAAI,iBAAiB;IAE9B,OAAO,CAAC,aAAa,CAAC,CAAsB;gBAGlC,YAAY,CAAC,EAAE,kBAAkB,YAAA,EACjC,YAAY,CAAC,EAAE,iBAAiB,YAAA,EACxC,MAAM,CAAC,EAAE,MAAM,EACP,eAAe,CAAC,EAAE,eAAe,YAAA,EACzC,cAAc,CAAC,EAAE,0BAA0B,EAC3C,aAAa,CAAC,EAAE,mBAAmB,EACnC,iBAAiB,CAAC,EAAE,iBAAiB,EAC7B,YAAY,CAAC,EAAE,YAAY,YAAA,EAC3B,qBAAqB,CAAC,EAAE,qBAAqB,YAAA,EACrD,eAAe,CAAC,EAAE,mBAAmB,EACrC,YAAY,CAAC,EAAE,gBAAgB,EAC/B,SAAS,CAAC,EAAE,cAAc,EAC1B,UAAU,CAAC,EAAE,OAAO,EACpB,cAAc,CAAC,EAAE,OAAO,EAAE,+EAA+E;IACzG,SAAS,CAAC,EAAE,OAAO,gCAAgC,EAAE,eAAe,EACpE,uBAAuB,CAAC,EAAE,6BAA6B;IAsBzD,eAAe,IAAI,gBAAgB;IAY7B,cAAc,IAAI,OAAO,CAAC,OAAO,CAAC;YAW1B,aAAa;IAarB,aAAa,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,WAAW,CAAC;IA6BrF;;;;;;;;;;;;;;OAcG;IACG,0BAA0B,CAC9B,SAAS,EAAE,SAAS,EACpB,MAAM,EAAE,MAAM,EACd,MAAM,CAAC,EAAE,MAAM,EACf,cAAc,CAAC,EAAE,cAAc,EAC/B,kBAAkB,CAAC,EAAE,OAAO,SAAS,EAAE,kBAAkB,EACzD,eAAe,CAAC,EAAE,eAAe,EACjC,aAAa,CAAC,EAAE,aAAa,GAC5B,OAAO,CAAC;QACT,aAAa,EAAE,SAAS,CAAC;QACzB,mBAAmB,EAAE,SAAS,EAAE,CAAC;QACjC,UAAU,CAAC,EAAE,UAAU,CAAC;QACxB,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,aAAa,CAAC,EAAE,MAAM,CAAC;QACvB,kBAAkB,CAAC,EAAE,MAAM,CAAC;QAC5B,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,UAAU,CAAC,EAAE,OAAO,CAAC;QACrB,cAAc,CAAC,EAAE,OAAO,gBAAgB,EAAE,gBAAgB,CAAC;QAC3D,mFAAmF;QACnF,eAAe,CAAC,EAAE,OAAO,gBAAgB,EAAE,iCAAiC,CAAC;QAC7E,UAAU,CAAC,EAAE,OAAO,CAAC;QACrB,QAAQ,CAAC,EAAE,OAAO,CAAC;QACnB,oGAAoG;QACpG,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;KACzB,CAAC;IAkmBF;;;OAGG;YACW,qBAAqB;IAwCnC;;;;;;;;OAQG;IACG,aAAa,CACjB,SAAS,EAAE,SAAS,EACpB,MAAM,EAAE,MAAM,EACd,MAAM,CAAC,EAAE,MAAM,EACf,cAAc,CAAC,EAAE,cAAc,EAC/B,aAAa,CAAC,EAAE,aAAa,GAC5B,OAAO,CAAC;QACT,aAAa,EAAE,SAAS,CAAC;QACzB,mBAAmB,EAAE,SAAS,EAAE,CAAC;QACjC,UAAU,CAAC,EAAE,UAAU,CAAC;QACxB,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,aAAa,CAAC,EAAE,MAAM,CAAC;QACvB,kBAAkB,CAAC,EAAE,MAAM,CAAC;QAC5B,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,UAAU,CAAC,EAAE,OAAO,CAAC;QACrB,cAAc,CAAC,EAAE,OAAO,gBAAgB,EAAE,gBAAgB,CAAC;QAC3D,mFAAmF;QACnF,eAAe,CAAC,EAAE,OAAO,gBAAgB,EAAE,iCAAiC,CAAC;QAC7E,UAAU,CAAC,EAAE,OAAO,CAAC;QACrB,QAAQ,CAAC,EAAE,OAAO,CAAC;QACnB,oGAAoG;QACpG,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;KACzB,CAAC;IA+PF;;;;;;;;OAQG;IACG,QAAQ,CACZ,SAAS,EAAE,MAAM,EACjB,MAAM,CAAC,EAAE,MAAM,GACd,OAAO,CAAC;QACT,OAAO,EAAE,OAAO,CAAC;QACjB,aAAa,CAAC,EAAE,OAAO,CAAC;YAAE,MAAM,EAAE,MAAM,CAAC;YAAC,MAAM,EAAE,WAAW,GAAG,QAAQ,GAAG,WAAW,CAAA;SAAE,CAAC,CAAC;QAC1F,MAAM,CAAC,EAAE,MAAM,CAAC;KACjB,CAAC;IA2BF;;;;;OAKG;IACH,qBAAqB,CAAC,YAAY,EAAE,cAAc,GAAG,qBAAqB;IAM1E;;;;;;;;;;;;;;;;;;;OAmBG;IACH;;;;;;;;;;;;;;;OAeG;IACG,oBAAoB,CACxB,SAAS,EAAE,MAAM,EACjB,cAAc,CAAC,EAAE,MAAM,EACvB,sBAAsB,CAAC,EAAE,OAAO,GAC/B,OAAO,CAAC,MAAM,CAAC;CAMnB"}

package/dist/executor/sdk-handlers/claude/claude-tool.js

@@ -82,14 +82,14 @@ export class ClaudeTool {
     name = 'Claude Code';
     promptService;
     constructor(messagesRepo, sessionsRepo, apiKey, messagesService, sessionMCPRepo, mcpServerRepo, permissionService, tasksService, tasksStreamingService, sessionsService, branchesRepo, reposRepo, mcpEnabled, _useNativeAuth, // Claude supports `claude login` OAuth, but no special handling needed in tool
-    usersRepo) {
+    usersRepo, mcpOAuthAuthHeadersRepo) {
         this.messagesRepo = messagesRepo;
         this.sessionsRepo = sessionsRepo;
         this.messagesService = messagesService;
         this.tasksService = tasksService;
         this.tasksStreamingService = tasksStreamingService;
         if (messagesRepo && sessionsRepo) {
-            this.promptService = new ClaudePromptService(messagesRepo, sessionsRepo, apiKey, sessionMCPRepo, mcpServerRepo, permissionService, tasksService, sessionsService, branchesRepo, reposRepo, messagesService, mcpEnabled, usersRepo);
+            this.promptService = new ClaudePromptService(messagesRepo, sessionsRepo, apiKey, sessionMCPRepo, mcpServerRepo, permissionService, tasksService, sessionsService, branchesRepo, reposRepo, messagesService, mcpEnabled, usersRepo, mcpOAuthAuthHeadersRepo);
         }
     }
     getCapabilities() {

package/dist/executor/sdk-handlers/claude/prompt-service.d.ts

@@ -5,7 +5,7 @@
  * Automatically loads CLAUDE.md and uses preset system prompts matching Claude Code CLI.
  */
 import type { PermissionMode } from '@agor/core/sdk';
-import type { BranchRepository, MCPServerRepository, MessagesRepository, SessionMCPServerRepository, SessionRepository, UsersRepository } from '../../db/feathers-repositories.js';
+import type { BranchRepository, MCPOAuthAuthHeadersRepository, MCPServerRepository, MessagesRepository, SessionMCPServerRepository, SessionRepository, UsersRepository } from '../../db/feathers-repositories.js';
 import type { PermissionService } from '../../permissions/permission-service.js';
 import type { SessionID, TaskID } from '../../types.js';
 import type { MessagesService, SessionsPatchClient, TasksService } from '../base/index.js';
@@ -45,15 +45,25 @@ export declare class ClaudePromptService {
     private messagesService?;
     private mcpEnabled?;
     private usersRepo?;
+    private mcpOAuthAuthHeadersRepo?;
     /** Enable token-level streaming from Claude Agent SDK */
     private static readonly ENABLE_TOKEN_STREAMING;
-    /** Idle timeout for SDK event loop - throws error if no messages received for this duration */
+    /**
+     * Idle timeout for SDK event loop - throws error if no messages are received
+     * for this duration.
+     *
+     * This is only a guard for a truly stuck SDK stream. Executor liveness is
+     * tracked separately by task heartbeats, so this must be long enough for
+     * legitimate silent tool calls (for example, a foreground Bash `sleep` or a
+     * long-running test command) to finish without Agor misclassifying the turn
+     * as hung.
+     */
     private static readonly IDLE_TIMEOUT_MS;
     /** Serialize permission checks per session to prevent duplicate prompts for concurrent tool calls */
     private permissionLocks;
     constructor(messagesRepo: MessagesRepository, sessionsRepo: SessionRepository, apiKey?: string | undefined, sessionMCPRepo?: SessionMCPServerRepository | undefined, mcpServerRepo?: MCPServerRepository | undefined, permissionService?: PermissionService | undefined, tasksService?: TasksService | undefined, sessionsService?: SessionsPatchClient | undefined, // FeathersJS Sessions service for WebSocket broadcasting
     branchesRepo?: BranchRepository | undefined, reposRepo?: import("../../db/feathers-repositories").RepoRepository | undefined, messagesService?: MessagesService | undefined, // FeathersJS Messages service for creating permission requests
-    mcpEnabled?: boolean | undefined, usersRepo?: UsersRepository | undefined);
+    mcpEnabled?: boolean | undefined, usersRepo?: UsersRepository | undefined, mcpOAuthAuthHeadersRepo?: MCPOAuthAuthHeadersRepository | undefined);
     /**
      * Build help message for CLI-only commands that don't work through the SDK
      */

package/dist/executor/sdk-handlers/claude/prompt-service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"prompt-service.d.ts","sourceRoot":"","sources":["../../../src/sdk-handlers/claude/prompt-service.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,KAAK,EAAE,cAAc,EAAoB,MAAM,gBAAgB,CAAC;AACvE,OAAO,KAAK,EACV,gBAAgB,EAChB,mBAAmB,EACnB,kBAAkB,EAClB,0BAA0B,EAC1B,iBAAiB,EACjB,eAAe,EAChB,MAAM,mCAAmC,CAAC;AAC3C,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,yCAAyC,CAAC;AACjF,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,gBAAgB,CAAC;AAExD,OAAO,KAAK,EAAE,eAAe,EAAE,mBAAmB,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAC3F,OAAO,EAAE,KAAK,cAAc,EAAuB,MAAM,wBAAwB,CAAC;AAGlF,MAAM,WAAW,YAAY;IAC3B,2EAA2E;IAC3E,QAAQ,EAAE,KAAK,CAAC;QACd,OAAO,EAAE,KAAK,CAAC;YACb,IAAI,EAAE,MAAM,CAAC;YACb,IAAI,CAAC,EAAE,MAAM,CAAC;YACd,EAAE,CAAC,EAAE,MAAM,CAAC;YACZ,IAAI,CAAC,EAAE,MAAM,CAAC;YACd,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;SACjC,CAAC,CAAC;QACH,QAAQ,CAAC,EAAE,KAAK,CAAC;YACf,EAAE,EAAE,MAAM,CAAC;YACX,IAAI,EAAE,MAAM,CAAC;YACb,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;SAChC,CAAC,CAAC;KACJ,CAAC,CAAC;IACH,6BAA6B;IAC7B,WAAW,EAAE,MAAM,CAAC;IACpB,8BAA8B;IAC9B,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,qBAAa,mBAAmB;IAW5B,OAAO,CAAC,YAAY;IACpB,OAAO,CAAC,YAAY;IACpB,OAAO,CAAC,MAAM,CAAC;IACf,OAAO,CAAC,cAAc,CAAC;IACvB,OAAO,CAAC,aAAa,CAAC;IACtB,OAAO,CAAC,iBAAiB,CAAC;IAC1B,OAAO,CAAC,YAAY,CAAC;IACrB,OAAO,CAAC,eAAe,CAAC;IACxB,OAAO,CAAC,YAAY,CAAC;IACrB,OAAO,CAAC,SAAS,CAAC;IAClB,OAAO,CAAC,eAAe,CAAC;IACxB,OAAO,CAAC,UAAU,CAAC;IACnB,OAAO,CAAC,SAAS,CAAC;IAtBpB,yDAAyD;IACzD,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,sBAAsB,CAAQ;IAEtD,+FAA+F;IAC/F,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,eAAe,CAAU;IAEjD,qGAAqG;IACrG,OAAO,CAAC,eAAe,CAAuC;gBAGpD,YAAY,EAAE,kBAAkB,EAChC,YAAY,EAAE,iBAAiB,EAC/B,MAAM,CAAC,EAAE,MAAM,YAAA,EACf,cAAc,CAAC,EAAE,0BAA0B,YAAA,EAC3C,aAAa,CAAC,EAAE,mBAAmB,YAAA,EACnC,iBAAiB,CAAC,EAAE,iBAAiB,YAAA,EACrC,YAAY,CAAC,EAAE,YAAY,YAAA,EAC3B,eAAe,CAAC,EAAE,mBAAmB,YAAA,EAAE,yDAAyD;IAChG,YAAY,CAAC,EAAE,gBAAgB,YAAA,EAC/B,SAAS,CAAC,EAAE,OAAO,gCAAgC,EAAE,cAAc,YAAA,EACnE,eAAe,CAAC,EAAE,eAAe,YAAA,EAAE,+DAA+D;IAClG,UAAU,CAAC,EAAE,OAAO,YAAA,EACpB,SAAS,CAAC,EAAE,eAAe,YAAA;IAKrC;;OAEG;IACH,OAAO,CAAC,0BAA0B;IAoBlC;;;;;;;;;;;;;OAaG;IACI,sBAAsB,CAC3B,SAAS,EAAE,SAAS,EACpB,MAAM,EAAE,MAAM,EACd,MAAM,CAAC,EAAE,MAAM,EACf,cAAc,CAAC,EAAE,cAAc,EAC/B,cAAc,CAAC,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,KAAK,IAAI,EAC3D,eAAe,CAAC,EAAE,eAAe,GAChC,cAAc,CAAC,cAAc,CAAC;IAmNjC;;;;;;;;;;;OAWG;IACG,aAAa,CAAC,SAAS,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC;IAwHhF;;;;;;;;;;OAUG;IACG,QAAQ,CAAC,SAAS,EAAE,SAAS,GAAG,OAAO,CAAC;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CAQrF"}
+{"version":3,"file":"prompt-service.d.ts","sourceRoot":"","sources":["../../../src/sdk-handlers/claude/prompt-service.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,KAAK,EAAE,cAAc,EAAoB,MAAM,gBAAgB,CAAC;AACvE,OAAO,KAAK,EACV,gBAAgB,EAChB,6BAA6B,EAC7B,mBAAmB,EACnB,kBAAkB,EAClB,0BAA0B,EAC1B,iBAAiB,EACjB,eAAe,EAChB,MAAM,mCAAmC,CAAC;AAC3C,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,yCAAyC,CAAC;AACjF,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,gBAAgB,CAAC;AAExD,OAAO,KAAK,EAAE,eAAe,EAAE,mBAAmB,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAC3F,OAAO,EAAE,KAAK,cAAc,EAAuB,MAAM,wBAAwB,CAAC;AAGlF,MAAM,WAAW,YAAY;IAC3B,2EAA2E;IAC3E,QAAQ,EAAE,KAAK,CAAC;QACd,OAAO,EAAE,KAAK,CAAC;YACb,IAAI,EAAE,MAAM,CAAC;YACb,IAAI,CAAC,EAAE,MAAM,CAAC;YACd,EAAE,CAAC,EAAE,MAAM,CAAC;YACZ,IAAI,CAAC,EAAE,MAAM,CAAC;YACd,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;SACjC,CAAC,CAAC;QACH,QAAQ,CAAC,EAAE,KAAK,CAAC;YACf,EAAE,EAAE,MAAM,CAAC;YACX,IAAI,EAAE,MAAM,CAAC;YACb,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;SAChC,CAAC,CAAC;KACJ,CAAC,CAAC;IACH,6BAA6B;IAC7B,WAAW,EAAE,MAAM,CAAC;IACpB,8BAA8B;IAC9B,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,qBAAa,mBAAmB;IAoB5B,OAAO,CAAC,YAAY;IACpB,OAAO,CAAC,YAAY;IACpB,OAAO,CAAC,MAAM,CAAC;IACf,OAAO,CAAC,cAAc,CAAC;IACvB,OAAO,CAAC,aAAa,CAAC;IACtB,OAAO,CAAC,iBAAiB,CAAC;IAC1B,OAAO,CAAC,YAAY,CAAC;IACrB,OAAO,CAAC,eAAe,CAAC;IACxB,OAAO,CAAC,YAAY,CAAC;IACrB,OAAO,CAAC,SAAS,CAAC;IAClB,OAAO,CAAC,eAAe,CAAC;IACxB,OAAO,CAAC,UAAU,CAAC;IACnB,OAAO,CAAC,SAAS,CAAC;IAClB,OAAO,CAAC,uBAAuB,CAAC;IAhClC,yDAAyD;IACzD,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,sBAAsB,CAAQ;IAEtD;;;;;;;;;OASG;IACH,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,eAAe,CAAkB;IAEzD,qGAAqG;IACrG,OAAO,CAAC,eAAe,CAAuC;gBAGpD,YAAY,EAAE,kBAAkB,EAChC,YAAY,EAAE,iBAAiB,EAC/B,MAAM,CAAC,EAAE,MAAM,YAAA,EACf,cAAc,CAAC,EAAE,0BAA0B,YAAA,EAC3C,aAAa,CAAC,EAAE,mBAAmB,YAAA,EACnC,iBAAiB,CAAC,EAAE,iBAAiB,YAAA,EACrC,YAAY,CAAC,EAAE,YAAY,YAAA,EAC3B,eAAe,CAAC,EAAE,mBAAmB,YAAA,EAAE,yDAAyD;IAChG,YAAY,CAAC,EAAE,gBAAgB,YAAA,EAC/B,SAAS,CAAC,EAAE,OAAO,gCAAgC,EAAE,cAAc,YAAA,EACnE,eAAe,CAAC,EAAE,eAAe,YAAA,EAAE,+DAA+D;IAClG,UAAU,CAAC,EAAE,OAAO,YAAA,EACpB,SAAS,CAAC,EAAE,eAAe,YAAA,EAC3B,uBAAuB,CAAC,EAAE,6BAA6B,YAAA;IAKjE;;OAEG;IACH,OAAO,CAAC,0BAA0B;IAoBlC;;;;;;;;;;;;;OAaG;IACI,sBAAsB,CAC3B,SAAS,EAAE,SAAS,EACpB,MAAM,EAAE,MAAM,EACd,MAAM,CAAC,EAAE,MAAM,EACf,cAAc,CAAC,EAAE,cAAc,EAC/B,cAAc,CAAC,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,KAAK,IAAI,EAC3D,eAAe,CAAC,EAAE,eAAe,GAChC,cAAc,CAAC,cAAc,CAAC;IAoNjC;;;;;;;;;;;OAWG;IACG,aAAa,CAAC,SAAS,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC;IAyHhF;;;;;;;;;;OAUG;IACG,QAAQ,CAAC,SAAS,EAAE,SAAS,GAAG,OAAO,CAAC;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CAQrF"}

package/dist/executor/sdk-handlers/claude/prompt-service.js

@@ -22,15 +22,25 @@ export class ClaudePromptService {
     messagesService;
     mcpEnabled;
     usersRepo;
+    mcpOAuthAuthHeadersRepo;
     /** Enable token-level streaming from Claude Agent SDK */
     static ENABLE_TOKEN_STREAMING = true;
-    /** Idle timeout for SDK event loop - throws error if no messages received for this duration */
-    static IDLE_TIMEOUT_MS = 300000; // 5 minutes
+    /**
+     * Idle timeout for SDK event loop - throws error if no messages are received
+     * for this duration.
+     *
+     * This is only a guard for a truly stuck SDK stream. Executor liveness is
+     * tracked separately by task heartbeats, so this must be long enough for
+     * legitimate silent tool calls (for example, a foreground Bash `sleep` or a
+     * long-running test command) to finish without Agor misclassifying the turn
+     * as hung.
+     */
+    static IDLE_TIMEOUT_MS = 60 * 60 * 1000; // 60 minutes
     /** Serialize permission checks per session to prevent duplicate prompts for concurrent tool calls */
     permissionLocks = new Map();
     constructor(messagesRepo, sessionsRepo, apiKey, sessionMCPRepo, mcpServerRepo, permissionService, tasksService, sessionsService, // FeathersJS Sessions service for WebSocket broadcasting
     branchesRepo, reposRepo, messagesService, // FeathersJS Messages service for creating permission requests
-    mcpEnabled, usersRepo) {
+    mcpEnabled, usersRepo, mcpOAuthAuthHeadersRepo) {
         this.messagesRepo = messagesRepo;
         this.sessionsRepo = sessionsRepo;
         this.apiKey = apiKey;
@@ -44,6 +54,7 @@ export class ClaudePromptService {
         this.messagesService = messagesService;
         this.mcpEnabled = mcpEnabled;
         this.usersRepo = usersRepo;
+        this.mcpOAuthAuthHeadersRepo = mcpOAuthAuthHeadersRepo;
         // No client initialization needed - Agent SDK is stateless
     }
     /**
@@ -148,6 +159,7 @@ If you continue to see authentication errors, please contact your Agor administr
             messagesService: this.messagesService,
             branchesRepo: this.branchesRepo,
             usersRepo: this.usersRepo,
+            mcpOAuthAuthHeadersRepo: this.mcpOAuthAuthHeadersRepo,
             permissionLocks: this.permissionLocks,
         }, {
             taskId,
@@ -285,6 +297,7 @@ If you continue to see authentication errors, please contact your Agor administr
             messagesService: this.messagesService,
             branchesRepo: this.branchesRepo,
             usersRepo: this.usersRepo,
+            mcpOAuthAuthHeadersRepo: this.mcpOAuthAuthHeadersRepo,
             permissionLocks: this.permissionLocks,
         }, {
             taskId: undefined,