agor-live 0.23.1 → 0.23.2

package/dist/daemon/widgets/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/widgets/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAIH,YAAY,EAAE,mBAAmB,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAC1E,OAAO,EAAE,SAAS,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAC3E,YAAY,EACV,mBAAmB,EACnB,sBAAsB,EACtB,sBAAsB,EACtB,iBAAiB,EACjB,kBAAkB,GACnB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAEnE;;;GAGG;AACH,wBAAgB,kBAAkB,IAAI,IAAI,CAEzC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/widgets/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAKH,YAAY,EAAE,mBAAmB,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAC1E,OAAO,EAAE,SAAS,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAC3E,YAAY,EACV,mBAAmB,EACnB,sBAAsB,EACtB,sBAAsB,EACtB,iBAAiB,EACjB,kBAAkB,GACnB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAEnE;;;GAGG;AACH,wBAAgB,kBAAkB,IAAI,IAAI,CAGzC"}

package/dist/daemon/widgets/index.js

@@ -14727,16 +14727,186 @@ function registerEnvVarsWidget() {
   registerWidget(envVarsWidget);
 }
 
+// src/widgets/gateway-token/index.ts
+import { Forbidden } from "@agor/core/feathers";
+import {
+  GATEWAY_SENSITIVE_CONFIG_FIELDS,
+  hasMinimumRole,
+  ROLES
+} from "@agor/core/types";
+var SUPPORTED_CHANNEL_TYPES = [
+  "slack",
+  "github",
+  "teams"
+];
+function isSupportedGatewayTokenChannelType(channelType) {
+  return SUPPORTED_CHANNEL_TYPES.includes(channelType);
+}
+var MAX_TOKEN_LENGTH = 8192;
+function orderedFields(fields) {
+  return [...fields].sort();
+}
+var gatewayTokenParamsSchema = external_exports.object({
+  gatewayChannelId: external_exports.string().min(1).describe("Gateway channel whose credentials are being set."),
+  channelType: external_exports.enum(["slack", "discord", "whatsapp", "telegram", "github", "teams"]).describe("Platform type of the channel; drives per-field placeholders."),
+  channelName: external_exports.string().min(1).max(200).describe("Human-readable channel name for the form heading and prompts."),
+  fields: external_exports.array(external_exports.enum(GATEWAY_SENSITIVE_CONFIG_FIELDS)).min(1).max(GATEWAY_SENSITIVE_CONFIG_FIELDS.length).refine((fields) => new Set(fields).size === fields.length, {
+    message: "Token field names must be unique"
+  }).describe("Secret config field names to collect (subset of the sensitive fields)."),
+  reason: external_exports.string().min(1).max(200).describe("One sentence explaining why the tokens are needed. Renders as a muted line.")
+}).strict();
+var gatewayTokenSubmitSchema = external_exports.object({
+  tokens: external_exports.partialRecord(
+    external_exports.enum(GATEWAY_SENSITIVE_CONFIG_FIELDS),
+    external_exports.string().min(1).max(MAX_TOKEN_LENGTH)
+  ).describe("Map of sensitive field name \u2192 credential value.")
+}).strict();
+var submitOutcomes = /* @__PURE__ */ new WeakMap();
+var HARD_CREDENTIAL_SLACK_ERRORS = /* @__PURE__ */ new Set([
+  "invalid_auth",
+  "account_inactive",
+  "token_revoked",
+  "token_expired",
+  "not_authed",
+  "no_permission"
+]);
+function classifyGatewayTokenTest(result, appTokenExpected) {
+  const unprobable = result.failures.some((failure) => failure.capability === "connector");
+  if (unprobable) {
+    return {
+      enable: false,
+      status: "unverifiable",
+      summary: "credentials cannot be auto-verified for this channel type yet"
+    };
+  }
+  const isAppTokenFailure = (failure) => failure.capability === "app_token";
+  const hardFailure = result.failures.find(
+    (failure) => failure.slackError && HARD_CREDENTIAL_SLACK_ERRORS.has(failure.slackError) || failure.capability === "config" || appTokenExpected && isAppTokenFailure(failure)
+  );
+  if (hardFailure) {
+    return { enable: false, status: "failed", summary: hardFailure.reason };
+  }
+  if (appTokenExpected && result.appTokenValid === false) {
+    return {
+      enable: false,
+      status: "failed",
+      summary: "The app-level token is missing or invalid; Socket Mode cannot connect."
+    };
+  }
+  if (result.ok) {
+    return { enable: true, status: "verified", summary: "passed" };
+  }
+  const followUps = result.failures.filter((failure) => appTokenExpected || !isAppTokenFailure(failure)).map((failure) => failure.reason).filter(Boolean);
+  return {
+    enable: true,
+    status: "verified",
+    summary: followUps.length > 0 ? `passed, with follow-ups: ${followUps.join("; ")}` : "passed"
+  };
+}
+function assertGatewayTokenAdmin(ctx) {
+  if (!hasMinimumRole(ctx.submitterRole, ROLES.ADMIN)) {
+    throw new Forbidden("Only admins can set gateway channel tokens");
+  }
+}
+async function applyGatewayTokenSubmit(ctx, submit, params) {
+  assertGatewayTokenAdmin(ctx);
+  const channelsService = ctx.app.service("gateway-channels");
+  const channel = await channelsService.get(params.gatewayChannelId);
+  if (!channel) {
+    throw new Forbidden(`Gateway channel ${params.gatewayChannelId} not found`);
+  }
+  if (!isSupportedGatewayTokenChannelType(channel.channel_type)) {
+    throw new Forbidden(
+      `Gateway channel type "${channel.channel_type}" does not support token entry`
+    );
+  }
+  if (channel.channel_type !== params.channelType) {
+    throw new Forbidden("Gateway channel type does not match the widget request");
+  }
+  const sessionsService = ctx.app.service("sessions");
+  const session = await sessionsService.get(ctx.sessionId);
+  if (!session.branch_id || channel.target_branch_id !== session.branch_id) {
+    throw new Forbidden("Gateway channel is not bound to this session's branch");
+  }
+  const requested = new Set(params.fields);
+  const extra = Object.keys(submit.tokens).filter((field) => !requested.has(field));
+  if (extra.length > 0) {
+    throw new Forbidden(
+      `Submitted token fields were not requested: ${orderedFields(extra).join(", ")}`
+    );
+  }
+  const testService = ctx.app.service(
+    "gateway-channels/test"
+  );
+  const testResult = await testService.create({
+    gatewayChannelId: params.gatewayChannelId,
+    config: submit.tokens
+  });
+  const appTokenExpected = params.fields.includes("app_token");
+  const { enable, status, summary } = classifyGatewayTokenTest(testResult, appTokenExpected);
+  await channelsService.patch(
+    params.gatewayChannelId,
+    { config: submit.tokens, enabled: enable },
+    { user: { user_id: ctx.submitterUserId, role: ctx.submitterRole } }
+  );
+  submitOutcomes.set(submit, {
+    channelId: channel.id,
+    channelName: channel.name,
+    channelType: channel.channel_type,
+    enabled: enable,
+    unverified: status === "unverifiable",
+    test: { ok: testResult.ok, summary }
+  });
+}
+var gatewayTokenWidget = {
+  type: "gateway_token",
+  schemaVersion: 1,
+  paramsSchema: gatewayTokenParamsSchema,
+  submitSchema: gatewayTokenSubmitSchema,
+  buildResultMeta: (submit) => {
+    const outcome = submitOutcomes.get(submit);
+    return {
+      channelId: outcome?.channelId ?? "",
+      channelName: outcome?.channelName ?? "",
+      channelType: outcome?.channelType ?? "slack",
+      fieldsSet: orderedFields(Object.keys(submit.tokens)),
+      enabled: outcome?.enabled ?? false,
+      unverified: outcome?.unverified ?? false,
+      test: outcome?.test ?? { ok: false, summary: "" }
+    };
+  },
+  applySubmit: applyGatewayTokenSubmit,
+  buildAutoResumePrompt: (rm, params) => {
+    const fields = orderedFields(rm.fieldsSet).join(", ");
+    const name = rm.channelName || params.channelName;
+    const channelType = rm.channelType || params.channelType;
+    if (rm.enabled) {
+      return `[Agor] User set the ${channelType} tokens (${fields}) for channel "${name}". Channel enabled. Connection test: ${rm.test.summary || "passed"}.`;
+    }
+    if (rm.unverified) {
+      return `[Agor] Tokens saved for "${name}" (${fields}); ${channelType} credentials can't be auto-verified yet, so the channel is left disabled \u2014 enable it manually once confirmed.`;
+    }
+    return `[Agor] User set the ${channelType} tokens (${fields}) for channel "${name}", but it was left disabled; test failed: ${rm.test.summary || "unknown error"}. Ask the user to double-check the tokens/scopes.`;
+  },
+  buildDismissedPrompt: (params) => `[Agor] User declined to provide tokens for "${params.channelName}"; it stays disabled. Don't immediately re-ask.`,
+  // Dismissal is admin-only too — otherwise a member could terminally decline
+  // an admin-only credential flow via the generic dismiss endpoint.
+  authorizeDismiss: (ctx) => assertGatewayTokenAdmin(ctx)
+};
+function registerGatewayTokenWidget() {
+  registerWidget(gatewayTokenWidget);
+}
+
 // src/widgets/submissions.ts
-import { Forbidden as Forbidden2, NotAuthenticated as NotAuthenticated2, NotFound as NotFound2 } from "@agor/core/feathers";
+import { Forbidden as Forbidden3, NotAuthenticated as NotAuthenticated2, NotFound as NotFound2 } from "@agor/core/feathers";
 
 // src/utils/branch-authorization.ts
 import { shortId } from "@agor/core/db";
-import { Forbidden, NotAuthenticated, NotFound } from "@agor/core/feathers";
-import { BRANCH_PERMISSION_LEVELS, hasMinimumRole, ROLES } from "@agor/core/types";
+import { Forbidden as Forbidden2, NotAuthenticated, NotFound } from "@agor/core/feathers";
+import { BRANCH_PERMISSION_LEVELS, hasMinimumRole as hasMinimumRole2, ROLES as ROLES2 } from "@agor/core/types";
 function isSuperAdmin(role, allowSuperadmin = true) {
   if (!allowSuperadmin) return false;
-  return role === ROLES.SUPERADMIN || role === "owner";
+  return role === ROLES2.SUPERADMIN || role === "owner";
 }
 var PERMISSION_RANK = Object.fromEntries(
   BRANCH_PERMISSION_LEVELS.map((level, i) => [level, i - 1])
@@ -14803,18 +14973,26 @@ async function doResolveWidget(widgetId, action, caller, deps) {
   const isOwner = await deps.isBranchOwner(branch.branch_id, caller.user_id);
   const effectivePermission = await deps.resolveBranchPermission?.(branch, caller.user_id);
   if (!canResolveWidget(caller, session, branch, isOwner, effectivePermission)) {
-    throw new Forbidden2(
+    throw new Forbidden3(
       `You need to be the session creator, a branch owner, or have 'prompt' permission on the branch to resolve this widget.`
     );
   }
   if (widget.status !== "pending") {
-    throw new Forbidden2(
+    throw new Forbidden3(
       `Widget ${widgetId} is already ${widget.status}; cannot ${action.kind} again.`
     );
   }
   const entry = getWidget(widget.widget_type);
   let resultMeta;
   let autoResumePrompt;
+  const ctx = {
+    // biome-ignore lint/suspicious/noExplicitAny: Pass-through Feathers Application
+    app: deps.app,
+    sessionId: message.session_id,
+    submitterUserId: caller.user_id,
+    submitterRole: caller.role,
+    sessionCreatorUserId: session.created_by
+  };
   if (action.kind === "submit") {
     if (!entry) {
       throw new NotFound2(
@@ -14823,21 +15001,16 @@ async function doResolveWidget(widgetId, action, caller, deps) {
     }
     const parsed = entry.submitSchema.safeParse(action.body);
     if (!parsed.success) {
-      throw new Forbidden2(`Invalid submit payload: ${parsed.error.message}`);
+      throw new Forbidden3(`Invalid submit payload: ${parsed.error.message}`);
     }
     const submit = parsed.data;
-    const submitCtx = {
-      // biome-ignore lint/suspicious/noExplicitAny: Pass-through Feathers Application
-      app: deps.app,
-      sessionId: message.session_id,
-      submitterUserId: caller.user_id,
-      submitterRole: caller.role,
-      sessionCreatorUserId: session.created_by
-    };
-    await entry.applySubmit(submitCtx, submit, widget.params);
+    await entry.applySubmit(ctx, submit, widget.params);
     resultMeta = entry.buildResultMeta(submit);
     autoResumePrompt = entry.buildAutoResumePrompt(resultMeta, widget.params);
   } else {
+    if (entry?.authorizeDismiss) {
+      await entry.authorizeDismiss(ctx, widget.params);
+    }
     autoResumePrompt = entry ? entry.buildDismissedPrompt(widget.params) : `[Agor] User dismissed a widget request. Do not re-request immediately \u2014 ask whether to proceed without, or move on to other work.`;
   }
   const newStatus = action.kind === "submit" ? "submitted" : "dismissed";
@@ -14895,6 +15068,7 @@ async function doResolveWidget(widgetId, action, caller, deps) {
 // src/widgets/index.ts
 function registerAllWidgets() {
   registerEnvVarsWidget();
+  registerGatewayTokenWidget();
 }
 export {
   canResolveWidget,

package/dist/daemon/widgets/registry.d.ts

@@ -84,6 +84,13 @@ export interface WidgetRegistryEntry<TParams, TSubmit, TResultMeta> {
      * explicit ("don't immediately re-ask") to avoid agent loops.
      */
     buildDismissedPrompt: (params: TParams) => string;
+    /**
+     * Optional gate on WHO may dismiss this widget, run before the message is
+     * marked 'dismissed'; throw (e.g. Forbidden) to reject. Absent means any
+     * caller allowed to reach the resolve endpoint may dismiss. Admin-only
+     * widgets set this so a dismissal can't sidestep the submit-side role check.
+     */
+    authorizeDismiss?: (ctx: WidgetSubmitCtx, params: TParams) => void | Promise<void>;
 }
 type AnyWidgetEntry = WidgetRegistryEntry<unknown, unknown, unknown>;
 /**

package/dist/daemon/widgets/registry.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"registry.d.ts","sourceRoot":"","sources":["../../src/widgets/registry.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AACvD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AACtE,OAAO,KAAK,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAE7B;;;;GAIG;AACH,MAAM,WAAW,eAAe;IAC9B,GAAG,EAAE,WAAW,CAAC;IACjB,yCAAyC;IACzC,SAAS,EAAE,SAAS,CAAC;IACrB,2EAA2E;IAC3E,eAAe,EAAE,MAAM,CAAC;IACxB;;;;mEAI+D;IAC/D,aAAa,EAAE,MAAM,GAAG,SAAS,CAAC;IAClC,kEAAkE;IAClE,oBAAoB,EAAE,MAAM,CAAC;CAC9B;AAED;;;;;GAKG;AACH,MAAM,WAAW,mBAAmB,CAAC,OAAO,EAAE,OAAO,EAAE,WAAW;IAChE,2DAA2D;IAC3D,IAAI,EAAE,UAAU,CAAC;IACjB,yEAAyE;IACzE,aAAa,EAAE,MAAM,CAAC;IACtB,wEAAwE;IACxE,YAAY,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IACjC,wDAAwD;IACxD,YAAY,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IACjC;;;;OAIG;IACH,eAAe,EAAE,CAAC,MAAM,EAAE,OAAO,KAAK,WAAW,CAAC;IAClD;;;;;;;;OAQG;IACH,WAAW,EAAE,CAAC,GAAG,EAAE,eAAe,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACvF;;;;OAIG;IACH,qBAAqB,EAAE,CAAC,UAAU,EAAE,WAAW,EAAE,MAAM,EAAE,OAAO,KAAK,MAAM,CAAC;IAC5E;;;OAGG;IACH,oBAAoB,EAAE,CAAC,MAAM,EAAE,OAAO,KAAK,MAAM,CAAC;CACnD;AAID,KAAK,cAAc,GAAG,mBAAmB,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;AAIrE;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAAE,OAAO,EAAE,WAAW,EAC1D,KAAK,EAAE,mBAAmB,CAAC,OAAO,EAAE,OAAO,EAAE,WAAW,CAAC,GACxD,IAAI,CASN;AAED,uEAAuE;AACvE,wBAAgB,SAAS,CAAC,IAAI,EAAE,UAAU,GAAG,cAAc,GAAG,SAAS,CAEtE;AAED,6DAA6D;AAC7D,wBAAgB,eAAe,IAAI,UAAU,EAAE,CAE9C;AAED;;GAEG;AACH,wBAAgB,4BAA4B,IAAI,IAAI,CAEnD"}
+{"version":3,"file":"registry.d.ts","sourceRoot":"","sources":["../../src/widgets/registry.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AACvD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AACtE,OAAO,KAAK,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAE7B;;;;GAIG;AACH,MAAM,WAAW,eAAe;IAC9B,GAAG,EAAE,WAAW,CAAC;IACjB,yCAAyC;IACzC,SAAS,EAAE,SAAS,CAAC;IACrB,2EAA2E;IAC3E,eAAe,EAAE,MAAM,CAAC;IACxB;;;;mEAI+D;IAC/D,aAAa,EAAE,MAAM,GAAG,SAAS,CAAC;IAClC,kEAAkE;IAClE,oBAAoB,EAAE,MAAM,CAAC;CAC9B;AAED;;;;;GAKG;AACH,MAAM,WAAW,mBAAmB,CAAC,OAAO,EAAE,OAAO,EAAE,WAAW;IAChE,2DAA2D;IAC3D,IAAI,EAAE,UAAU,CAAC;IACjB,yEAAyE;IACzE,aAAa,EAAE,MAAM,CAAC;IACtB,wEAAwE;IACxE,YAAY,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IACjC,wDAAwD;IACxD,YAAY,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IACjC;;;;OAIG;IACH,eAAe,EAAE,CAAC,MAAM,EAAE,OAAO,KAAK,WAAW,CAAC;IAClD;;;;;;;;OAQG;IACH,WAAW,EAAE,CAAC,GAAG,EAAE,eAAe,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACvF;;;;OAIG;IACH,qBAAqB,EAAE,CAAC,UAAU,EAAE,WAAW,EAAE,MAAM,EAAE,OAAO,KAAK,MAAM,CAAC;IAC5E;;;OAGG;IACH,oBAAoB,EAAE,CAAC,MAAM,EAAE,OAAO,KAAK,MAAM,CAAC;IAClD;;;;;OAKG;IACH,gBAAgB,CAAC,EAAE,CAAC,GAAG,EAAE,eAAe,EAAE,MAAM,EAAE,OAAO,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACpF;AAID,KAAK,cAAc,GAAG,mBAAmB,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;AAIrE;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAAE,OAAO,EAAE,WAAW,EAC1D,KAAK,EAAE,mBAAmB,CAAC,OAAO,EAAE,OAAO,EAAE,WAAW,CAAC,GACxD,IAAI,CASN;AAED,uEAAuE;AACvE,wBAAgB,SAAS,CAAC,IAAI,EAAE,UAAU,GAAG,cAAc,GAAG,SAAS,CAEtE;AAED,6DAA6D;AAC7D,wBAAgB,eAAe,IAAI,UAAU,EAAE,CAE9C;AAED;;GAEG;AACH,wBAAgB,4BAA4B,IAAI,IAAI,CAEnD"}

package/dist/daemon/widgets/submissions.js

@@ -92,6 +92,14 @@ async function doResolveWidget(widgetId, action, caller, deps) {
   const entry = getWidget(widget.widget_type);
   let resultMeta;
   let autoResumePrompt;
+  const ctx = {
+    // biome-ignore lint/suspicious/noExplicitAny: Pass-through Feathers Application
+    app: deps.app,
+    sessionId: message.session_id,
+    submitterUserId: caller.user_id,
+    submitterRole: caller.role,
+    sessionCreatorUserId: session.created_by
+  };
   if (action.kind === "submit") {
     if (!entry) {
       throw new NotFound2(
@@ -103,18 +111,13 @@ async function doResolveWidget(widgetId, action, caller, deps) {
       throw new Forbidden2(`Invalid submit payload: ${parsed.error.message}`);
     }
     const submit = parsed.data;
-    const submitCtx = {
-      // biome-ignore lint/suspicious/noExplicitAny: Pass-through Feathers Application
-      app: deps.app,
-      sessionId: message.session_id,
-      submitterUserId: caller.user_id,
-      submitterRole: caller.role,
-      sessionCreatorUserId: session.created_by
-    };
-    await entry.applySubmit(submitCtx, submit, widget.params);
+    await entry.applySubmit(ctx, submit, widget.params);
     resultMeta = entry.buildResultMeta(submit);
     autoResumePrompt = entry.buildAutoResumePrompt(resultMeta, widget.params);
   } else {
+    if (entry?.authorizeDismiss) {
+      await entry.authorizeDismiss(ctx, widget.params);
+    }
     autoResumePrompt = entry ? entry.buildDismissedPrompt(widget.params) : `[Agor] User dismissed a widget request. Do not re-request immediately \u2014 ask whether to proceed without, or move on to other work.`;
   }
   const newStatus = action.kind === "submit" ? "submitted" : "dismissed";

package/dist/executor/commands/git.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"git.d.ts","sourceRoot":"","sources":["../../src/commands/git.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAuBH,OAAO,KAAK,EACV,0BAA0B,EAC1B,0BAA0B,EAC1B,sBAAsB,EACtB,oBAAoB,EACpB,cAAc,EACd,mBAAmB,EACnB,qBAAqB,EACrB,sBAAsB,EACtB,eAAe,EACf,oBAAoB,EACpB,2BAA2B,EAC5B,MAAM,qBAAqB,CAAC;AAG7B,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AA2FjD;;;GAGG;AACH,wBAAsB,qBAAqB,CACzC,OAAO,EAAE,sBAAsB,EAC/B,OAAO,EAAE,cAAc,GACtB,OAAO,CAAC,cAAc,CAAC,CA4DzB;AAED;;;GAGG;AACH,wBAAsB,mBAAmB,CACvC,OAAO,EAAE,oBAAoB,EAC7B,OAAO,EAAE,cAAc,GACtB,OAAO,CAAC,cAAc,CAAC,CA6DzB;AAkID;;;GAGG;AACH,wBAAsB,yBAAyB,CAC7C,OAAO,EAAE,0BAA0B,EACnC,OAAO,EAAE,cAAc,GACtB,OAAO,CAAC,cAAc,CAAC,CAuCzB;AAED;;;GAGG;AACH,wBAAsB,yBAAyB,CAC7C,OAAO,EAAE,0BAA0B,EACnC,OAAO,EAAE,cAAc,GACtB,OAAO,CAAC,cAAc,CAAC,CAuCzB;AAED;;;GAGG;AACH,wBAAsB,0BAA0B,CAC9C,OAAO,EAAE,2BAA2B,EACpC,OAAO,EAAE,cAAc,GACtB,OAAO,CAAC,cAAc,CAAC,CA6DzB;AAED;;;GAGG;AACH,wBAAsB,mBAAmB,CACvC,OAAO,EAAE,oBAAoB,EAC7B,OAAO,EAAE,cAAc,GACtB,OAAO,CAAC,cAAc,CAAC,CA+EzB;AAED;;;;;GAKG;AACH,wBAAsB,cAAc,CAClC,OAAO,EAAE,eAAe,EACxB,OAAO,EAAE,cAAc,GACtB,OAAO,CAAC,cAAc,CAAC,CA8OzB;AAyFD;;;;;;GAMG;AACH,wBAAsB,kBAAkB,CACtC,OAAO,EAAE,mBAAmB,EAC5B,OAAO,EAAE,cAAc,GACtB,OAAO,CAAC,cAAc,CAAC,CA+TzB;AAED;;;;;GAKG;AACH,wBAAsB,qBAAqB,CACzC,OAAO,EAAE,sBAAsB,EAC/B,OAAO,EAAE,cAAc,GACtB,OAAO,CAAC,cAAc,CAAC,CAkMzB;AAED;;;;;;GAMG;AACH,wBAAsB,oBAAoB,CACxC,OAAO,EAAE,qBAAqB,EAC9B,OAAO,EAAE,cAAc,GACtB,OAAO,CAAC,cAAc,CAAC,CA6CzB"}
+{"version":3,"file":"git.d.ts","sourceRoot":"","sources":["../../src/commands/git.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAuBH,OAAO,KAAK,EACV,0BAA0B,EAC1B,0BAA0B,EAC1B,sBAAsB,EACtB,oBAAoB,EACpB,cAAc,EACd,mBAAmB,EACnB,qBAAqB,EACrB,sBAAsB,EACtB,eAAe,EACf,oBAAoB,EACpB,2BAA2B,EAC5B,MAAM,qBAAqB,CAAC;AAG7B,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AA2FjD;;;GAGG;AACH,wBAAsB,qBAAqB,CACzC,OAAO,EAAE,sBAAsB,EAC/B,OAAO,EAAE,cAAc,GACtB,OAAO,CAAC,cAAc,CAAC,CA4DzB;AAED;;;GAGG;AACH,wBAAsB,mBAAmB,CACvC,OAAO,EAAE,oBAAoB,EAC7B,OAAO,EAAE,cAAc,GACtB,OAAO,CAAC,cAAc,CAAC,CA6DzB;AAkID;;;GAGG;AACH,wBAAsB,yBAAyB,CAC7C,OAAO,EAAE,0BAA0B,EACnC,OAAO,EAAE,cAAc,GACtB,OAAO,CAAC,cAAc,CAAC,CAuCzB;AAED;;;GAGG;AACH,wBAAsB,yBAAyB,CAC7C,OAAO,EAAE,0BAA0B,EACnC,OAAO,EAAE,cAAc,GACtB,OAAO,CAAC,cAAc,CAAC,CAuCzB;AAED;;;GAGG;AACH,wBAAsB,0BAA0B,CAC9C,OAAO,EAAE,2BAA2B,EACpC,OAAO,EAAE,cAAc,GACtB,OAAO,CAAC,cAAc,CAAC,CA6DzB;AAED;;;GAGG;AACH,wBAAsB,mBAAmB,CACvC,OAAO,EAAE,oBAAoB,EAC7B,OAAO,EAAE,cAAc,GACtB,OAAO,CAAC,cAAc,CAAC,CA+EzB;AAED;;;;;GAKG;AACH,wBAAsB,cAAc,CAClC,OAAO,EAAE,eAAe,EACxB,OAAO,EAAE,cAAc,GACtB,OAAO,CAAC,cAAc,CAAC,CA8OzB;AA2FD;;;;;;GAMG;AACH,wBAAsB,kBAAkB,CACtC,OAAO,EAAE,mBAAmB,EAC5B,OAAO,EAAE,cAAc,GACtB,OAAO,CAAC,cAAc,CAAC,CA+TzB;AAED;;;;;GAKG;AACH,wBAAsB,qBAAqB,CACzC,OAAO,EAAE,sBAAsB,EAC/B,OAAO,EAAE,cAAc,GACtB,OAAO,CAAC,cAAc,CAAC,CAkMzB;AAED;;;;;;GAMG;AACH,wBAAsB,oBAAoB,CACxC,OAAO,EAAE,qBAAqB,EAC9B,OAAO,EAAE,cAAc,GACtB,OAAO,CAAC,cAAc,CAAC,CA6CzB"}

package/dist/executor/commands/git.js

@@ -792,6 +792,8 @@ async function renderEnvironmentTemplates(client, branchId, repoId, unixGroup, c
             custom_context: branch.custom_context,
             unix_gid: unixGid,
             host_ip_address: hostIpAddress,
+            base_ref: branch.base_ref,
+            ref_type: branch.ref_type,
         }, branch.environment_variant);
     }
     catch (err) {

package/dist/executor/db/feathers-repositories.d.ts

@@ -71,7 +71,7 @@ export declare class FeathersSessionMCPServersRepository {
      * Executors use the session-scoped route so session-token callers can receive
      * the raw config needed to launch only their own session's MCP servers.
      */
-    listEffectiveServers(sessionId: SessionID, enabledOnly?: boolean): Promise<MCPServer[]>;
+    listEffectiveServers(sessionId: SessionID, enabledOnly?: boolean, forUserId?: string): Promise<MCPServer[]>;
     /**
      * List MCP servers for a session with relationship metadata (added_at timestamp)
      * Used to detect if servers were added after session creation
@@ -85,6 +85,22 @@ export declare class FeathersSessionMCPServersRepository {
         enabled: boolean;
     }>>;
 }
+/**
+ * MCP OAuth auth headers repository - proxies to the trusted executor route.
+ *
+ * Session-scoped MCP server reads intentionally redact OAuth access tokens in
+ * normal API payloads. Executors use this narrow route to retrieve just the
+ * launch-time Authorization header for OAuth servers that are already in the
+ * session's effective MCP scope.
+ */
+export declare class FeathersMCPOAuthAuthHeadersRepository {
+    private client;
+    constructor(client: AgorClient);
+    getAuthHeaders(mcpServerIds: MCPServerID[]): Promise<Record<string, {
+        authorization?: string;
+        error?: string;
+    }>>;
+}
 /**
  * Users Repository - proxies to 'users' Feathers service
  */
@@ -103,6 +119,7 @@ export type BranchRepository = FeathersBranchesRepository;
 export type RepoRepository = FeathersReposRepository;
 export type MCPServerRepository = FeathersMCPServersRepository;
 export type SessionMCPServerRepository = FeathersSessionMCPServersRepository;
+export type MCPOAuthAuthHeadersRepository = FeathersMCPOAuthAuthHeadersRepository;
 export type UsersRepository = FeathersUsersRepository;
 /**
  * Create all Feathers-backed repositories and services
@@ -115,6 +132,7 @@ export declare function createFeathersBackedRepositories(client: AgorClient): {
     users: FeathersUsersRepository;
     mcpServers: FeathersMCPServersRepository;
     sessionMCP: FeathersSessionMCPServersRepository;
+    mcpOAuthAuthHeaders: FeathersMCPOAuthAuthHeadersRepository;
     messagesService: import("@agor/core").MessagesService;
     tasksService: import("@agor/core").TasksService;
     tasksStreamingService: import("@agor/core").AgorService<unknown, Partial<unknown>, unknown, import("@agor/core").PatchPayload<unknown>>;

package/dist/executor/db/feathers-repositories.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"feathers-repositories.d.ts","sourceRoot":"","sources":["../../src/db/feathers-repositories.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AACjD,OAAO,KAAK,EACV,MAAM,EACN,QAAQ,EACR,SAAS,EACT,gBAAgB,EAChB,WAAW,EACX,OAAO,EACP,SAAS,EACT,IAAI,EACJ,OAAO,EACP,SAAS,EACT,gBAAgB,EAChB,IAAI,EACL,MAAM,kBAAkB,CAAC;AAE1B;;GAEG;AACH,qBAAa,0BAA0B;IACzB,OAAO,CAAC,MAAM;gBAAN,MAAM,EAAE,UAAU;IAEhC,eAAe,CAAC,SAAS,EAAE,SAAS,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC;IAYzD,QAAQ,CAAC,SAAS,EAAE,SAAS,GAAG,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC;IASvD,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,YAAY,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC;CAIrE;AAED;;GAEG;AACH,qBAAa,0BAA0B;IACzB,OAAO,CAAC,MAAM;gBAAN,MAAM,EAAE,UAAU;IAEhC,QAAQ,CAAC,SAAS,EAAE,SAAS,GAAG,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC;IASvD,MAAM,CAAC,SAAS,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,CAAC,OAAO,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC;CAI7E;AAED;;GAEG;AACH,qBAAa,0BAA0B;IACzB,OAAO,CAAC,MAAM;gBAAN,MAAM,EAAE,UAAU;IAEhC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;CAQ3D;AAED;;GAEG;AACH,qBAAa,uBAAuB;IACtB,OAAO,CAAC,MAAM;gBAAN,MAAM,EAAE,UAAU;IAEhC,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC;CAQrD;AAED;;GAEG;AACH,qBAAa,4BAA4B;IAC3B,OAAO,CAAC,MAAM;gBAAN,MAAM,EAAE,UAAU;IAEhC,QAAQ,CAAC,WAAW,EAAE,WAAW,GAAG,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC;IAS7D,OAAO,CAAC,OAAO,CAAC,EAAE,gBAAgB,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC;CA+BpF;AAED;;GAEG;AACH,qBAAa,mCAAmC;IAClC,OAAO,CAAC,MAAM;gBAAN,MAAM,EAAE,UAAU;IAEhC,eAAe,CAAC,SAAS,EAAE,SAAS,GAAG,OAAO,CAAC,gBAAgB,EAAE,CAAC;IAWlE,iBAAiB,CAAC,WAAW,EAAE,WAAW,GAAG,OAAO,CAAC,gBAAgB,EAAE,CAAC;IAW9E;;;;;OAKG;IACG,WAAW,CAAC,SAAS,EAAE,SAAS,EAAE,WAAW,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC;IAYpF;;;;OAIG;IACG,oBAAoB,CAAC,SAAS,EAAE,SAAS,EAAE,WAAW,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC;IAY7F;;;;;;OAMG;IACG,uBAAuB,CAC3B,SAAS,EAAE,SAAS,EACpB,WAAW,UAAQ,GAClB,OAAO,CAAC,KAAK,CAAC;QAAE,MAAM,EAAE,SAAS,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;CAe7E;AAED;;GAEG;AACH,qBAAa,uBAAuB;IACtB,OAAO,CAAC,MAAM;gBAAN,MAAM,EAAE,UAAU;IAEhC,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC;CAQrD;AAMD;;;GAGG;AACH,MAAM,MAAM,kBAAkB,GAAG,0BAA0B,CAAC;AAC5D,MAAM,MAAM,iBAAiB,GAAG,0BAA0B,CAAC;AAC3D,MAAM,MAAM,gBAAgB,GAAG,0BAA0B,CAAC;AAC1D,MAAM,MAAM,cAAc,GAAG,uBAAuB,CAAC;AACrD,MAAM,MAAM,mBAAmB,GAAG,4BAA4B,CAAC;AAC/D,MAAM,MAAM,0BAA0B,GAAG,mCAAmC,CAAC;AAC7E,MAAM,MAAM,eAAe,GAAG,uBAAuB,CAAC;AAEtD;;GAEG;AACH,wBAAgB,gCAAgC,CAAC,MAAM,EAAE,UAAU;;;;;;;;;;;;EAkBlE"}
+{"version":3,"file":"feathers-repositories.d.ts","sourceRoot":"","sources":["../../src/db/feathers-repositories.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AACjD,OAAO,KAAK,EACV,MAAM,EACN,QAAQ,EACR,SAAS,EACT,gBAAgB,EAChB,WAAW,EACX,OAAO,EACP,SAAS,EACT,IAAI,EACJ,OAAO,EACP,SAAS,EACT,gBAAgB,EAChB,IAAI,EACL,MAAM,kBAAkB,CAAC;AAE1B;;GAEG;AACH,qBAAa,0BAA0B;IACzB,OAAO,CAAC,MAAM;gBAAN,MAAM,EAAE,UAAU;IAEhC,eAAe,CAAC,SAAS,EAAE,SAAS,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC;IAYzD,QAAQ,CAAC,SAAS,EAAE,SAAS,GAAG,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC;IASvD,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,YAAY,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC;CAIrE;AAED;;GAEG;AACH,qBAAa,0BAA0B;IACzB,OAAO,CAAC,MAAM;gBAAN,MAAM,EAAE,UAAU;IAEhC,QAAQ,CAAC,SAAS,EAAE,SAAS,GAAG,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC;IASvD,MAAM,CAAC,SAAS,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,CAAC,OAAO,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC;CAI7E;AAED;;GAEG;AACH,qBAAa,0BAA0B;IACzB,OAAO,CAAC,MAAM;gBAAN,MAAM,EAAE,UAAU;IAEhC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;CAQ3D;AAED;;GAEG;AACH,qBAAa,uBAAuB;IACtB,OAAO,CAAC,MAAM;gBAAN,MAAM,EAAE,UAAU;IAEhC,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC;CAQrD;AAED;;GAEG;AACH,qBAAa,4BAA4B;IAC3B,OAAO,CAAC,MAAM;gBAAN,MAAM,EAAE,UAAU;IAEhC,QAAQ,CAAC,WAAW,EAAE,WAAW,GAAG,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC;IAS7D,OAAO,CAAC,OAAO,CAAC,EAAE,gBAAgB,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC;CA+BpF;AAED;;GAEG;AACH,qBAAa,mCAAmC;IAClC,OAAO,CAAC,MAAM;gBAAN,MAAM,EAAE,UAAU;IAEhC,eAAe,CAAC,SAAS,EAAE,SAAS,GAAG,OAAO,CAAC,gBAAgB,EAAE,CAAC;IAWlE,iBAAiB,CAAC,WAAW,EAAE,WAAW,GAAG,OAAO,CAAC,gBAAgB,EAAE,CAAC;IAW9E;;;;;OAKG;IACG,WAAW,CAAC,SAAS,EAAE,SAAS,EAAE,WAAW,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC;IAYpF;;;;OAIG;IACG,oBAAoB,CACxB,SAAS,EAAE,SAAS,EACpB,WAAW,CAAC,EAAE,OAAO,EACrB,SAAS,CAAC,EAAE,MAAM,GACjB,OAAO,CAAC,SAAS,EAAE,CAAC;IAevB;;;;;;OAMG;IACG,uBAAuB,CAC3B,SAAS,EAAE,SAAS,EACpB,WAAW,UAAQ,GAClB,OAAO,CAAC,KAAK,CAAC;QAAE,MAAM,EAAE,SAAS,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;CAe7E;AAMD;;;;;;;GAOG;AACH,qBAAa,qCAAqC;IACpC,OAAO,CAAC,MAAM;gBAAN,MAAM,EAAE,UAAU;IAEhC,cAAc,CAClB,YAAY,EAAE,WAAW,EAAE,GAC1B,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE;QAAE,aAAa,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAavE;AAED;;GAEG;AACH,qBAAa,uBAAuB;IACtB,OAAO,CAAC,MAAM;gBAAN,MAAM,EAAE,UAAU;IAEhC,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC;CAQrD;AAMD;;;GAGG;AACH,MAAM,MAAM,kBAAkB,GAAG,0BAA0B,CAAC;AAC5D,MAAM,MAAM,iBAAiB,GAAG,0BAA0B,CAAC;AAC3D,MAAM,MAAM,gBAAgB,GAAG,0BAA0B,CAAC;AAC1D,MAAM,MAAM,cAAc,GAAG,uBAAuB,CAAC;AACrD,MAAM,MAAM,mBAAmB,GAAG,4BAA4B,CAAC;AAC/D,MAAM,MAAM,0BAA0B,GAAG,mCAAmC,CAAC;AAC7E,MAAM,MAAM,6BAA6B,GAAG,qCAAqC,CAAC;AAClF,MAAM,MAAM,eAAe,GAAG,uBAAuB,CAAC;AAEtD;;GAEG;AACH,wBAAgB,gCAAgC,CAAC,MAAM,EAAE,UAAU;;;;;;;;;;;;;EAmBlE"}

package/dist/executor/db/feathers-repositories.js

@@ -191,12 +191,15 @@ export class FeathersSessionMCPServersRepository {
      * Executors use the session-scoped route so session-token callers can receive
      * the raw config needed to launch only their own session's MCP servers.
      */
-    async listEffectiveServers(sessionId, enabledOnly) {
+    async listEffectiveServers(sessionId, enabledOnly, forUserId) {
         const service = this.client.service(`/sessions/${sessionId}/mcp-servers`);
         const query = { includeGlobal: true };
         if (enabledOnly) {
             query.enabledOnly = true;
         }
+        if (forUserId) {
+            query.forUserId = forUserId;
+        }
         const result = await service.find({ query });
         return (Array.isArray(result) ? result : result.data);
     }
@@ -217,6 +220,32 @@ export class FeathersSessionMCPServersRepository {
         return (Array.isArray(result) ? result : result.data);
     }
 }
+/**
+ * MCP OAuth auth headers repository - proxies to the trusted executor route.
+ *
+ * Session-scoped MCP server reads intentionally redact OAuth access tokens in
+ * normal API payloads. Executors use this narrow route to retrieve just the
+ * launch-time Authorization header for OAuth servers that are already in the
+ * session's effective MCP scope.
+ */
+export class FeathersMCPOAuthAuthHeadersRepository {
+    client;
+    constructor(client) {
+        this.client = client;
+    }
+    async getAuthHeaders(mcpServerIds) {
+        if (mcpServerIds.length === 0)
+            return {};
+        const service = this.client.service('mcp-servers/oauth-auth-headers');
+        const executorSessionToken = this.client
+            .executorSessionToken;
+        const result = (await service.create({
+            mcp_server_ids: mcpServerIds,
+            ...(executorSessionToken ? { executorSessionToken } : {}),
+        }));
+        return result.headers ?? {};
+    }
+}
 /**
  * Users Repository - proxies to 'users' Feathers service
  */
@@ -248,6 +277,7 @@ export function createFeathersBackedRepositories(client) {
         users: new FeathersUsersRepository(client),
         mcpServers: new FeathersMCPServersRepository(client),
         sessionMCP: new FeathersSessionMCPServersRepository(client),
+        mcpOAuthAuthHeaders: new FeathersMCPOAuthAuthHeadersRepository(client),
         // Services (direct Feathers service access)
         // SDK handlers can use these services directly with proper typing
         messagesService: client.service('messages'),

package/dist/executor/handlers/sdk/claude.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"claude.d.ts","sourceRoot":"","sources":["../../../src/handlers/sdk/claude.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAEzF,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAIlE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,mCAAmC,CAAC;AAEpE;;;;GAIG;AACH,wBAAsB,qBAAqB,CAAC,MAAM,EAAE;IAClD,MAAM,EAAE,UAAU,CAAC;IACnB,SAAS,EAAE,SAAS,CAAC;IACrB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,cAAc,CAAC,EAAE,cAAc,CAAC;IAChC,eAAe,EAAE,eAAe,CAAC;IACjC,aAAa,CAAC,EAAE,aAAa,CAAC;IAC9B,cAAc,CAAC,EAAE,mBAAmB,CAAC;CACtC,GAAG,OAAO,CAAC,IAAI,CAAC,CA8ChB"}
+{"version":3,"file":"claude.d.ts","sourceRoot":"","sources":["../../../src/handlers/sdk/claude.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAEzF,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAIlE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,mCAAmC,CAAC;AAEpE;;;;GAIG;AACH,wBAAsB,qBAAqB,CAAC,MAAM,EAAE;IAClD,MAAM,EAAE,UAAU,CAAC;IACnB,SAAS,EAAE,SAAS,CAAC;IACrB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,cAAc,CAAC,EAAE,cAAc,CAAC;IAChC,eAAe,EAAE,eAAe,CAAC;IACjC,aAAa,CAAC,EAAE,aAAa,CAAC;IAC9B,cAAc,CAAC,EAAE,mBAAmB,CAAC;CACtC,GAAG,OAAO,CAAC,IAAI,CAAC,CA+ChB"}

package/dist/executor/handlers/sdk/claude.js

@@ -33,7 +33,7 @@ export async function executeClaudeCodeTask(params) {
             toolName: 'claude-code',
             createTool: (repos, apiKey, useNativeAuth) => new ClaudeTool(repos.messages, repos.sessions, apiKey, repos.messagesService, repos.sessionMCP, repos.mcpServers, permissionService, repos.tasksService, repos.tasksStreamingService, repos.sessionsService, repos.branches, repos.repos, true, // mcpEnabled
             useNativeAuth, // Flag for Claude CLI OAuth (`claude login`)
-            repos.users),
+            repos.users, repos.mcpOAuthAuthHeaders),
         });
     }
     finally {

package/dist/executor/handlers/sdk/codex.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"codex.d.ts","sourceRoot":"","sources":["../../../src/handlers/sdk/codex.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAGzF,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,mCAAmC,CAAC;AAEpE;;;;GAIG;AACH,wBAAsB,gBAAgB,CAAC,MAAM,EAAE;IAC7C,MAAM,EAAE,UAAU,CAAC;IACnB,SAAS,EAAE,SAAS,CAAC;IACrB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,cAAc,CAAC,EAAE,cAAc,CAAC;IAChC,eAAe,EAAE,eAAe,CAAC;IACjC,aAAa,CAAC,EAAE,aAAa,CAAC;CAC/B,GAAG,OAAO,CAAC,IAAI,CAAC,CAyBhB"}
+{"version":3,"file":"codex.d.ts","sourceRoot":"","sources":["../../../src/handlers/sdk/codex.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAGzF,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,mCAAmC,CAAC;AAEpE;;;;GAIG;AACH,wBAAsB,gBAAgB,CAAC,MAAM,EAAE;IAC7C,MAAM,EAAE,UAAU,CAAC;IACnB,SAAS,EAAE,SAAS,CAAC;IACrB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,cAAc,CAAC,EAAE,cAAc,CAAC;IAChC,eAAe,EAAE,eAAe,CAAC;IACjC,aAAa,CAAC,EAAE,aAAa,CAAC;CAC/B,GAAG,OAAO,CAAC,IAAI,CAAC,CA0BhB"}

package/dist/executor/handlers/sdk/codex.js

@@ -20,6 +20,6 @@ export async function executeCodexTask(params) {
         toolName: 'codex',
         createTool: (repos, apiKey, useNativeAuth) => new CodexTool(repos.messages, repos.sessions, repos.sessionMCP, repos.branches, repos.repos, apiKey, repos.messagesService, repos.tasksService, repos.tasksStreamingService, useNativeAuth, // Flag for native auth (if applicable)
         repos.mcpServers, // MCPServerRepository for global MCP server resolution
-        repos.users),
+        repos.users, repos.mcpOAuthAuthHeaders),
     });
 }

package/dist/executor/handlers/sdk/copilot.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"copilot.d.ts","sourceRoot":"","sources":["../../../src/handlers/sdk/copilot.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAEzF,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAIlE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,mCAAmC,CAAC;AAEpE;;;;GAIG;AACH,wBAAsB,kBAAkB,CAAC,MAAM,EAAE;IAC/C,MAAM,EAAE,UAAU,CAAC;IACnB,SAAS,EAAE,SAAS,CAAC;IACrB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,cAAc,CAAC,EAAE,cAAc,CAAC;IAChC,eAAe,EAAE,eAAe,CAAC;IACjC,aAAa,CAAC,EAAE,aAAa,CAAC;IAC9B,cAAc,CAAC,EAAE,mBAAmB,CAAC;CACtC,GAAG,OAAO,CAAC,IAAI,CAAC,CA6ChB"}
+{"version":3,"file":"copilot.d.ts","sourceRoot":"","sources":["../../../src/handlers/sdk/copilot.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAEzF,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAIlE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,mCAAmC,CAAC;AAEpE;;;;GAIG;AACH,wBAAsB,kBAAkB,CAAC,MAAM,EAAE;IAC/C,MAAM,EAAE,UAAU,CAAC;IACnB,SAAS,EAAE,SAAS,CAAC;IACrB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,cAAc,CAAC,EAAE,cAAc,CAAC;IAChC,eAAe,EAAE,eAAe,CAAC;IACjC,aAAa,CAAC,EAAE,aAAa,CAAC;IAC9B,cAAc,CAAC,EAAE,mBAAmB,CAAC;CACtC,GAAG,OAAO,CAAC,IAAI,CAAC,CA8ChB"}

package/dist/executor/handlers/sdk/copilot.js

@@ -32,7 +32,7 @@ export async function executeCopilotTask(params) {
             ...params,
             apiKeyEnvVar: TOOL_API_KEY_NAMES.copilot,
             toolName: 'copilot',
-            createTool: (repos, apiKey, useNativeAuth) => new CopilotTool(repos.messages, repos.sessions, repos.sessionMCP, repos.branches, repos.repos, apiKey, repos.messagesService, repos.tasksService, useNativeAuth, repos.mcpServers, repos.users, permissionService, repos.sessionsService),
+            createTool: (repos, apiKey, useNativeAuth) => new CopilotTool(repos.messages, repos.sessions, repos.sessionMCP, repos.branches, repos.repos, apiKey, repos.messagesService, repos.tasksService, useNativeAuth, repos.mcpServers, repos.users, permissionService, repos.sessionsService, repos.mcpOAuthAuthHeaders),
         });
     }
     finally {

package/dist/executor/handlers/sdk/cursor.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cursor.d.ts","sourceRoot":"","sources":["../../../src/handlers/sdk/cursor.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAMH,OAAO,KAAK,EACV,YAAY,EAGZ,aAAa,EACb,cAAc,EACd,SAAS,EAET,MAAM,EACP,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EAAyC,KAAK,UAAU,EAAE,MAAM,aAAa,CAAC;AAGrF,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAGlE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,mCAAmC,CAAC;AAiCpE,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CA2B5D;AAED,wBAAgB,wBAAwB,CACtC,KAAK,EAAE,OAAO,CAAC,UAAU,EAAE;IAAE,IAAI,EAAE,WAAW,CAAA;CAAE,CAAC,GAChD,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAmCzB;AAED,wBAAgB,2BAA2B,CAAC,IAAI,EAAE;IAChD,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB,GAAG,YAAY,EAAE,CAgBjB;AAgRD;;GAEG;AACH,wBAAsB,iBAAiB,CAAC,MAAM,EAAE;IAC9C,MAAM,EAAE,UAAU,CAAC;IACnB,SAAS,EAAE,SAAS,CAAC;IACrB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,cAAc,CAAC,EAAE,cAAc,CAAC;IAChC,eAAe,EAAE,eAAe,CAAC;IACjC,aAAa,CAAC,EAAE,aAAa,CAAC;IAC9B,cAAc,CAAC,EAAE,mBAAmB,CAAC;CACtC,GAAG,OAAO,CAAC,IAAI,CAAC,CA+MhB"}
+{"version":3,"file":"cursor.d.ts","sourceRoot":"","sources":["../../../src/handlers/sdk/cursor.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAMH,OAAO,KAAK,EACV,YAAY,EAGZ,aAAa,EACb,cAAc,EACd,SAAS,EAET,MAAM,EACP,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EAAyC,KAAK,UAAU,EAAE,MAAM,aAAa,CAAC;AAGrF,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAGlE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,mCAAmC,CAAC;AAiCpE,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CA2B5D;AAED,wBAAgB,wBAAwB,CACtC,KAAK,EAAE,OAAO,CAAC,UAAU,EAAE;IAAE,IAAI,EAAE,WAAW,CAAA;CAAE,CAAC,GAChD,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAmCzB;AAED,wBAAgB,2BAA2B,CAAC,IAAI,EAAE;IAChD,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB,GAAG,YAAY,EAAE,CAgBjB;AAiRD;;GAEG;AACH,wBAAsB,iBAAiB,CAAC,MAAM,EAAE;IAC9C,MAAM,EAAE,UAAU,CAAC;IACnB,SAAS,EAAE,SAAS,CAAC;IACrB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,cAAc,CAAC,EAAE,cAAc,CAAC;IAChC,eAAe,EAAE,eAAe,CAAC;IACjC,aAAa,CAAC,EAAE,aAAa,CAAC;IAC9B,cAAc,CAAC,EAAE,mBAAmB,CAAC;CACtC,GAAG,OAAO,CAAC,IAAI,CAAC,CA+MhB"}

package/dist/executor/handlers/sdk/cursor.js

@@ -154,6 +154,7 @@ async function buildCursorMcpServers(args) {
     const serversWithSource = await getMcpServersForSession(args.sessionId, {
         sessionMCPRepo: args.repos.sessionMCP,
         mcpServerRepo: args.repos.mcpServers,
+        mcpOAuthAuthHeadersRepo: args.repos.mcpOAuthAuthHeaders,
         forUserId: args.forUserId,
     });
     for (const { server } of serversWithSource) {

package/dist/executor/handlers/sdk/gemini.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"gemini.d.ts","sourceRoot":"","sources":["../../../src/handlers/sdk/gemini.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAGzF,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,mCAAmC,CAAC;AAEpE;;;;GAIG;AACH,wBAAsB,iBAAiB,CAAC,MAAM,EAAE;IAC9C,MAAM,EAAE,UAAU,CAAC;IACnB,SAAS,EAAE,SAAS,CAAC;IACrB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,cAAc,CAAC,EAAE,cAAc,CAAC;IAChC,eAAe,EAAE,eAAe,CAAC;IACjC,aAAa,CAAC,EAAE,aAAa,CAAC;CAC/B,GAAG,OAAO,CAAC,IAAI,CAAC,CAyBhB"}
+{"version":3,"file":"gemini.d.ts","sourceRoot":"","sources":["../../../src/handlers/sdk/gemini.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAGzF,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,mCAAmC,CAAC;AAEpE;;;;GAIG;AACH,wBAAsB,iBAAiB,CAAC,MAAM,EAAE;IAC9C,MAAM,EAAE,UAAU,CAAC;IACnB,SAAS,EAAE,SAAS,CAAC;IACrB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,cAAc,CAAC,EAAE,cAAc,CAAC;IAChC,eAAe,EAAE,eAAe,CAAC;IACjC,aAAa,CAAC,EAAE,aAAa,CAAC;CAC/B,GAAG,OAAO,CAAC,IAAI,CAAC,CA0BhB"}

package/dist/executor/handlers/sdk/gemini.js

@@ -20,6 +20,6 @@ export async function executeGeminiTask(params) {
         toolName: 'gemini',
         createTool: (repos, apiKey, useNativeAuth) => new GeminiTool(repos.messages, repos.sessions, apiKey, repos.messagesService, repos.tasksService, repos.branches, repos.repos, repos.mcpServers, repos.sessionMCP, true, // mcpEnabled
         useNativeAuth, // Flag to use OAuth when no API key
-        repos.users),
+        repos.users, repos.mcpOAuthAuthHeaders),
     });
 }

package/dist/executor/handlers/sdk/opencode.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"opencode.d.ts","sourceRoot":"","sources":["../../../src/handlers/sdk/opencode.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAGH,OAAO,KAAK,EAAa,cAAc,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAGrF,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAElE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,mCAAmC,CAAC;AAGpE;;;;GAIG;AACH,wBAAsB,mBAAmB,CAAC,MAAM,EAAE;IAChD,MAAM,EAAE,UAAU,CAAC;IACnB,SAAS,EAAE,SAAS,CAAC;IACrB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,cAAc,CAAC,EAAE,cAAc,CAAC;IAChC,eAAe,EAAE,eAAe,CAAC;IACjC,cAAc,CAAC,EAAE,mBAAmB,CAAC;CACtC,GAAG,OAAO,CAAC,IAAI,CAAC,CAuJhB"}
+{"version":3,"file":"opencode.d.ts","sourceRoot":"","sources":["../../../src/handlers/sdk/opencode.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAGH,OAAO,KAAK,EAAa,cAAc,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAGrF,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAElE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,mCAAmC,CAAC;AAGpE;;;;GAIG;AACH,wBAAsB,mBAAmB,CAAC,MAAM,EAAE;IAChD,MAAM,EAAE,UAAU,CAAC;IACnB,SAAS,EAAE,SAAS,CAAC;IACrB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,cAAc,CAAC,EAAE,cAAc,CAAC;IAChC,eAAe,EAAE,eAAe,CAAC;IACjC,cAAc,CAAC,EAAE,mBAAmB,CAAC;CACtC,GAAG,OAAO,CAAC,IAAI,CAAC,CAwJhB"}

package/dist/executor/handlers/sdk/opencode.js

@@ -56,7 +56,7 @@ export async function executeOpenCodeTask(params) {
         const tool = new OpenCodeTool({
             enabled: true,
             serverUrl,
-        }, repos.messagesService, repos.sessionMCP, repos.mcpServers);
+        }, repos.messagesService, repos.sessionMCP, repos.mcpServers, repos.mcpOAuthAuthHeaders);
         let opencodeSessionId;
         // Check if we already have an OpenCode session (stored in sdk_session_id)
         if (session.sdk_session_id) {

package/dist/executor/payload-types.d.ts

@@ -14,11 +14,11 @@ export { type ResolvedConfigSlice, ResolvedConfigSliceSchema };
  * Tool types supported by the prompt command
  */
 export declare const ToolTypeSchema: z.ZodEnum<{
+    opencode: "opencode";
     "claude-code": "claude-code";
     "claude-code-cli": "claude-code-cli";
     gemini: "gemini";
     codex: "codex";
-    opencode: "opencode";
     copilot: "copilot";
     cursor: "cursor";
 }>;
@@ -103,11 +103,11 @@ export declare const PromptPayloadSchema: z.ZodObject<{
         taskId: z.ZodString;
         prompt: z.ZodString;
         tool: z.ZodEnum<{
+            opencode: "opencode";
             "claude-code": "claude-code";
             "claude-code-cli": "claude-code-cli";
             gemini: "gemini";
             codex: "codex";
-            opencode: "opencode";
             copilot: "copilot";
             cursor: "cursor";
         }>;
@@ -460,8 +460,8 @@ export declare const EnvironmentLifecyclePayloadSchema: z.ZodObject<{
         action: z.ZodEnum<{
             start: "start";
             stop: "stop";
-            restart: "restart";
             nuke: "nuke";
+            restart: "restart";
         }>;
         startCommand: z.ZodOptional<z.ZodString>;
         stopCommand: z.ZodOptional<z.ZodString>;
@@ -821,11 +821,11 @@ export declare const ExecutorPayloadSchema: z.ZodDiscriminatedUnion<[z.ZodObject
         taskId: z.ZodString;
         prompt: z.ZodString;
         tool: z.ZodEnum<{
+            opencode: "opencode";
             "claude-code": "claude-code";
             "claude-code-cli": "claude-code-cli";
             gemini: "gemini";
             codex: "codex";
-            opencode: "opencode";
             copilot: "copilot";
             cursor: "cursor";
         }>;
@@ -1116,8 +1116,8 @@ export declare const ExecutorPayloadSchema: z.ZodDiscriminatedUnion<[z.ZodObject
         action: z.ZodEnum<{
             start: "start";
             stop: "stop";
-            restart: "restart";
             nuke: "nuke";
+            restart: "restart";
         }>;
         startCommand: z.ZodOptional<z.ZodString>;
         stopCommand: z.ZodOptional<z.ZodString>;