agor-live 0.23.1 → 0.23.2

package/dist/executor/sdk-handlers/base/mcp-scoping.d.ts

@@ -17,7 +17,7 @@
  * truly global and available to all sessions regardless of who created them.
  */
 import type { MCPServer, SessionID } from '@agor/core/types';
-import type { MCPServerRepository, SessionMCPServerRepository } from '../../db/feathers-repositories.js';
+import type { MCPOAuthAuthHeadersRepository, MCPServerRepository, SessionMCPServerRepository } from '../../db/feathers-repositories.js';
 /**
  * MCP server with source metadata
  */
@@ -31,6 +31,13 @@ export interface MCPServerWithSource {
 export interface MCPResolutionDeps {
     sessionMCPRepo?: SessionMCPServerRepository;
     mcpServerRepo?: MCPServerRepository;
+    /**
+     * Trusted executor-only route for hydrating OAuth Authorization headers.
+     *
+     * Normal session MCP server payloads redact OAuth access tokens, so executor
+     * paths must not rely on `server.auth.oauth_access_token` being present.
+     */
+    mcpOAuthAuthHeadersRepo?: MCPOAuthAuthHeadersRepository;
     /**
      * User ID to use for fetching per-user OAuth tokens.
      * When provided, MCP servers with per-user OAuth will have tokens injected.

package/dist/executor/sdk-handlers/base/mcp-scoping.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mcp-scoping.d.ts","sourceRoot":"","sources":["../../../src/sdk-handlers/base/mcp-scoping.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAGH,OAAO,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC7D,OAAO,KAAK,EACV,mBAAmB,EACnB,0BAA0B,EAC3B,MAAM,mCAAmC,CAAC;AAe3C;;GAEG;AACH,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,SAAS,CAAC;IAClB,MAAM,EAAE,kBAAkB,GAAG,QAAQ,CAAC;CACvC;AAED;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC,cAAc,CAAC,EAAE,0BAA0B,CAAC;IAC5C,aAAa,CAAC,EAAE,mBAAmB,CAAC;IACpC;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAsB,uBAAuB,CAC3C,SAAS,EAAE,SAAS,EACpB,IAAI,EAAE,iBAAiB,GACtB,OAAO,CAAC,mBAAmB,EAAE,CAAC,CA0JhC"}
+{"version":3,"file":"mcp-scoping.d.ts","sourceRoot":"","sources":["../../../src/sdk-handlers/base/mcp-scoping.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAOH,OAAO,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC7D,OAAO,KAAK,EACV,6BAA6B,EAC7B,mBAAmB,EACnB,0BAA0B,EAC3B,MAAM,mCAAmC,CAAC;AAe3C;;GAEG;AACH,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,SAAS,CAAC;IAClB,MAAM,EAAE,kBAAkB,GAAG,QAAQ,CAAC;CACvC;AAED;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC,cAAc,CAAC,EAAE,0BAA0B,CAAC;IAC5C,aAAa,CAAC,EAAE,mBAAmB,CAAC;IACpC;;;;;OAKG;IACH,uBAAuB,CAAC,EAAE,6BAA6B,CAAC;IACxD;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAsB,uBAAuB,CAC3C,SAAS,EAAE,SAAS,EACpB,IAAI,EAAE,iBAAiB,GACtB,OAAO,CAAC,mBAAmB,EAAE,CAAC,CA+NhC"}

package/dist/executor/sdk-handlers/base/mcp-scoping.js

@@ -16,7 +16,7 @@
  * Note: owner_user_id on MCP servers is NOT used for filtering. Global MCPs are
  * truly global and available to all sessions regardless of who created them.
  */
-import { buildMCPTemplateContextFromEnv, resolveMcpServerTemplates } from '@agor/core/mcp';
+import { buildMCPTemplateContextFromEnv, resolveMcpServerTemplates, TEMPLATE_RESOLVABLE_MCP_AUTH_SECRET_FIELDS, } from '@agor/core/mcp';
 const DEBUG_MCP_SCOPING = process.env.AGOR_DEBUG_MCP_SCOPING === '1' || process.env.DEBUG?.includes('mcp-scoping');
 function mcpDebug(...args) {
     if (DEBUG_MCP_SCOPING) {
@@ -68,7 +68,7 @@ export async function getMcpServersForSession(sessionId, deps) {
             console.warn(`   ⚠️  Skipping duplicate ${source} MCP server: ${server.name} (${server.mcp_server_id})`);
         };
         if (typeof deps.sessionMCPRepo.listEffectiveServers === 'function') {
-            const effectiveServers = await deps.sessionMCPRepo.listEffectiveServers(sessionId, true);
+            const effectiveServers = await deps.sessionMCPRepo.listEffectiveServers(sessionId, true, deps.forUserId);
             mcpDebug(`   📍 Effective session scope: ${effectiveServers.length} server(s)`);
             for (const server of effectiveServers) {
                 addServer(server, server.scope === 'global' ? 'global' : 'session-assigned');
@@ -110,6 +110,16 @@ export async function getMcpServersForSession(sessionId, deps) {
         let templatesResolved = 0;
         let serversSkipped = 0;
         const containsTemplate = (v) => v?.includes('{{') && v?.includes('}}');
+        // Every auth field `resolveMcpServerTemplates` substitutes. Driven from the
+        // canonical secret set plus the non-secret auth templates the resolver also
+        // handles, so this trigger cannot drift from what resolution resolves.
+        const AUTH_TEMPLATE_FIELDS = [
+            ...TEMPLATE_RESOLVABLE_MCP_AUTH_SECRET_FIELDS,
+            'api_url',
+            'oauth_token_url',
+            'oauth_client_id',
+            'oauth_scope',
+        ];
         // Process servers in reverse to safely remove invalid ones
         for (let i = servers.length - 1; i >= 0; i--) {
             const original = servers[i].server;
@@ -119,10 +129,7 @@ export async function getMcpServersForSession(sessionId, deps) {
             const hasEnvTemplates = envValues.some(containsTemplate);
             const hasHeaderTemplates = headerValues.some(containsTemplate);
             const hasUrlTemplate = containsTemplate(original.url);
-            const hasAuthTemplates = containsTemplate(original.auth?.token) ||
-                containsTemplate(original.auth?.api_url) ||
-                containsTemplate(original.auth?.api_token) ||
-                containsTemplate(original.auth?.api_secret);
+            const hasAuthTemplates = AUTH_TEMPLATE_FIELDS.some((field) => containsTemplate(original.auth?.[field]));
             if (hasEnvTemplates || hasHeaderTemplates || hasUrlTemplate || hasAuthTemplates) {
                 const result = resolveMcpServerTemplates(original, templateContext);
                 if (!result.isValid) {
@@ -150,6 +157,51 @@ export async function getMcpServersForSession(sessionId, deps) {
         if (serversSkipped > 0) {
             console.warn(`   ⚠️  Skipped ${serversSkipped} MCP server(s) due to unresolved required templates`);
         }
+        const oauthServers = servers
+            .map(({ server }) => server)
+            .filter((server) => server.auth?.type === 'oauth');
+        if (oauthServers.length > 0) {
+            if (!deps.mcpOAuthAuthHeadersRepo) {
+                mcpDebug(`   ℹ️  ${oauthServers.length} OAuth MCP server(s) resolved without executor auth-header hydrator`);
+            }
+            else {
+                try {
+                    const authHeaders = await deps.mcpOAuthAuthHeadersRepo.getAuthHeaders(oauthServers.map((server) => server.mcp_server_id));
+                    let hydrated = 0;
+                    for (let i = 0; i < servers.length; i++) {
+                        const server = servers[i].server;
+                        if (server.auth?.type !== 'oauth')
+                            continue;
+                        const header = authHeaders[server.mcp_server_id];
+                        const bearer = /^Bearer\s+(.+)$/i.exec(header?.authorization ?? '')?.[1];
+                        if (!bearer) {
+                            if (header?.error && header.error !== 'needs_reauth') {
+                                console.warn(`   ⚠️  OAuth MCP server "${server.name}" auth unavailable: ${header.error}`);
+                            }
+                            else if (header?.error) {
+                                mcpDebug(`   ℹ️  OAuth MCP server "${server.name}" auth unavailable: ${header.error}`);
+                            }
+                            continue;
+                        }
+                        servers[i] = {
+                            ...servers[i],
+                            server: {
+                                ...server,
+                                auth: {
+                                    ...server.auth,
+                                    oauth_access_token: bearer,
+                                },
+                            },
+                        };
+                        hydrated++;
+                    }
+                    mcpDebug(`   🔐 Hydrated OAuth auth headers for ${hydrated} MCP server(s)`);
+                }
+                catch (error) {
+                    console.warn(`   ⚠️  Failed to hydrate OAuth MCP auth headers: ${error instanceof Error ? error.message : String(error)}`);
+                }
+            }
+        }
         // Keep MCP config order stable across turns. Provider SDKs serialize MCP
         // tools into the prompt prefix, so DB/default ordering drift can reduce
         // server-side prompt-cache hits even when the effective server set is the

package/dist/executor/sdk-handlers/claude/claude-tool.d.ts

@@ -6,7 +6,7 @@
  * - ✅ Live execution via Anthropic SDK
  * - ❌ Create new sessions (waiting for SDK)
  */
-import type { BranchRepository, MCPServerRepository, MessagesRepository, RepoRepository, SessionMCPServerRepository, SessionRepository } from '../../db/feathers-repositories.js';
+import type { BranchRepository, MCPOAuthAuthHeadersRepository, MCPServerRepository, MessagesRepository, RepoRepository, SessionMCPServerRepository, SessionRepository } from '../../db/feathers-repositories.js';
 import type { PermissionService } from '../../permissions/permission-service.js';
 import type { NormalizedSdkResponse, RawSdkResponse } from '../../types/sdk-response.js';
 import type { TokenUsage } from '../../types/token-usage.js';
@@ -22,7 +22,7 @@ export declare class ClaudeTool implements ITool {
     readonly name = "Claude Code";
     private promptService?;
     constructor(messagesRepo?: MessagesRepository | undefined, sessionsRepo?: SessionRepository | undefined, apiKey?: string, messagesService?: MessagesService | undefined, sessionMCPRepo?: SessionMCPServerRepository, mcpServerRepo?: MCPServerRepository, permissionService?: PermissionService, tasksService?: TasksService | undefined, tasksStreamingService?: TasksStreamingService | undefined, sessionsService?: SessionsPatchClient, branchesRepo?: BranchRepository, reposRepo?: RepoRepository, mcpEnabled?: boolean, _useNativeAuth?: boolean, // Claude supports `claude login` OAuth, but no special handling needed in tool
-    usersRepo?: import('../../db/feathers-repositories').UsersRepository);
+    usersRepo?: import('../../db/feathers-repositories').UsersRepository, mcpOAuthAuthHeadersRepo?: MCPOAuthAuthHeadersRepository);
     getCapabilities(): ToolCapabilities;
     checkInstalled(): Promise<boolean>;
     private emitTaskEvent;

package/dist/executor/sdk-handlers/claude/claude-tool.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"claude-tool.d.ts","sourceRoot":"","sources":["../../../src/sdk-handlers/claude/claude-tool.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAQH,OAAO,KAAK,EACV,gBAAgB,EAChB,mBAAmB,EACnB,kBAAkB,EAClB,cAAc,EACd,0BAA0B,EAC1B,iBAAiB,EAClB,MAAM,mCAAmC,CAAC;AAC3C,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,yCAAyC,CAAC;AACjF,OAAO,KAAK,EAAE,qBAAqB,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAEzF,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,4BAA4B,CAAC;AAC7D,OAAO,EACL,KAAK,SAAS,EAEd,KAAK,aAAa,EAClB,KAAK,cAAc,EACnB,KAAK,SAAS,EACd,KAAK,MAAM,EAEZ,MAAM,gBAAgB,CAAC;AAExB,OAAO,KAAK,EACV,aAAa,EACb,KAAK,EACL,eAAe,EACf,WAAW,EACX,mBAAmB,EACnB,YAAY,EACZ,qBAAqB,EACrB,gBAAgB,EACjB,MAAM,kBAAkB,CAAC;AAkF1B,qBAAa,UAAW,YAAW,KAAK;IAOpC,OAAO,CAAC,YAAY,CAAC;IACrB,OAAO,CAAC,YAAY,CAAC;IAErB,OAAO,CAAC,eAAe,CAAC;IAIxB,OAAO,CAAC,YAAY,CAAC;IACrB,OAAO,CAAC,qBAAqB,CAAC;IAdhC,QAAQ,CAAC,QAAQ,EAAG,aAAa,CAAU;IAC3C,QAAQ,CAAC,IAAI,iBAAiB;IAE9B,OAAO,CAAC,aAAa,CAAC,CAAsB;gBAGlC,YAAY,CAAC,EAAE,kBAAkB,YAAA,EACjC,YAAY,CAAC,EAAE,iBAAiB,YAAA,EACxC,MAAM,CAAC,EAAE,MAAM,EACP,eAAe,CAAC,EAAE,eAAe,YAAA,EACzC,cAAc,CAAC,EAAE,0BAA0B,EAC3C,aAAa,CAAC,EAAE,mBAAmB,EACnC,iBAAiB,CAAC,EAAE,iBAAiB,EAC7B,YAAY,CAAC,EAAE,YAAY,YAAA,EAC3B,qBAAqB,CAAC,EAAE,qBAAqB,YAAA,EACrD,eAAe,CAAC,EAAE,mBAAmB,EACrC,YAAY,CAAC,EAAE,gBAAgB,EAC/B,SAAS,CAAC,EAAE,cAAc,EAC1B,UAAU,CAAC,EAAE,OAAO,EACpB,cAAc,CAAC,EAAE,OAAO,EAAE,+EAA+E;IACzG,SAAS,CAAC,EAAE,OAAO,gCAAgC,EAAE,eAAe;IAqBtE,eAAe,IAAI,gBAAgB;IAY7B,cAAc,IAAI,OAAO,CAAC,OAAO,CAAC;YAW1B,aAAa;IAarB,aAAa,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,WAAW,CAAC;IA6BrF;;;;;;;;;;;;;;OAcG;IACG,0BAA0B,CAC9B,SAAS,EAAE,SAAS,EACpB,MAAM,EAAE,MAAM,EACd,MAAM,CAAC,EAAE,MAAM,EACf,cAAc,CAAC,EAAE,cAAc,EAC/B,kBAAkB,CAAC,EAAE,OAAO,SAAS,EAAE,kBAAkB,EACzD,eAAe,CAAC,EAAE,eAAe,EACjC,aAAa,CAAC,EAAE,aAAa,GAC5B,OAAO,CAAC;QACT,aAAa,EAAE,SAAS,CAAC;QACzB,mBAAmB,EAAE,SAAS,EAAE,CAAC;QACjC,UAAU,CAAC,EAAE,UAAU,CAAC;QACxB,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,aAAa,CAAC,EAAE,MAAM,CAAC;QACvB,kBAAkB,CAAC,EAAE,MAAM,CAAC;QAC5B,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,UAAU,CAAC,EAAE,OAAO,CAAC;QACrB,cAAc,CAAC,EAAE,OAAO,gBAAgB,EAAE,gBAAgB,CAAC;QAC3D,mFAAmF;QACnF,eAAe,CAAC,EAAE,OAAO,gBAAgB,EAAE,iCAAiC,CAAC;QAC7E,UAAU,CAAC,EAAE,OAAO,CAAC;QACrB,QAAQ,CAAC,EAAE,OAAO,CAAC;QACnB,oGAAoG;QACpG,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;KACzB,CAAC;IAkmBF;;;OAGG;YACW,qBAAqB;IAwCnC;;;;;;;;OAQG;IACG,aAAa,CACjB,SAAS,EAAE,SAAS,EACpB,MAAM,EAAE,MAAM,EACd,MAAM,CAAC,EAAE,MAAM,EACf,cAAc,CAAC,EAAE,cAAc,EAC/B,aAAa,CAAC,EAAE,aAAa,GAC5B,OAAO,CAAC;QACT,aAAa,EAAE,SAAS,CAAC;QACzB,mBAAmB,EAAE,SAAS,EAAE,CAAC;QACjC,UAAU,CAAC,EAAE,UAAU,CAAC;QACxB,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,aAAa,CAAC,EAAE,MAAM,CAAC;QACvB,kBAAkB,CAAC,EAAE,MAAM,CAAC;QAC5B,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,UAAU,CAAC,EAAE,OAAO,CAAC;QACrB,cAAc,CAAC,EAAE,OAAO,gBAAgB,EAAE,gBAAgB,CAAC;QAC3D,mFAAmF;QACnF,eAAe,CAAC,EAAE,OAAO,gBAAgB,EAAE,iCAAiC,CAAC;QAC7E,UAAU,CAAC,EAAE,OAAO,CAAC;QACrB,QAAQ,CAAC,EAAE,OAAO,CAAC;QACnB,oGAAoG;QACpG,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;KACzB,CAAC;IA+PF;;;;;;;;OAQG;IACG,QAAQ,CACZ,SAAS,EAAE,MAAM,EACjB,MAAM,CAAC,EAAE,MAAM,GACd,OAAO,CAAC;QACT,OAAO,EAAE,OAAO,CAAC;QACjB,aAAa,CAAC,EAAE,OAAO,CAAC;YAAE,MAAM,EAAE,MAAM,CAAC;YAAC,MAAM,EAAE,WAAW,GAAG,QAAQ,GAAG,WAAW,CAAA;SAAE,CAAC,CAAC;QAC1F,MAAM,CAAC,EAAE,MAAM,CAAC;KACjB,CAAC;IA2BF;;;;;OAKG;IACH,qBAAqB,CAAC,YAAY,EAAE,cAAc,GAAG,qBAAqB;IAM1E;;;;;;;;;;;;;;;;;;;OAmBG;IACH;;;;;;;;;;;;;;;OAeG;IACG,oBAAoB,CACxB,SAAS,EAAE,MAAM,EACjB,cAAc,CAAC,EAAE,MAAM,EACvB,sBAAsB,CAAC,EAAE,OAAO,GAC/B,OAAO,CAAC,MAAM,CAAC;CAMnB"}
+{"version":3,"file":"claude-tool.d.ts","sourceRoot":"","sources":["../../../src/sdk-handlers/claude/claude-tool.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAQH,OAAO,KAAK,EACV,gBAAgB,EAChB,6BAA6B,EAC7B,mBAAmB,EACnB,kBAAkB,EAClB,cAAc,EACd,0BAA0B,EAC1B,iBAAiB,EAClB,MAAM,mCAAmC,CAAC;AAC3C,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,yCAAyC,CAAC;AACjF,OAAO,KAAK,EAAE,qBAAqB,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAEzF,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,4BAA4B,CAAC;AAC7D,OAAO,EACL,KAAK,SAAS,EAEd,KAAK,aAAa,EAClB,KAAK,cAAc,EACnB,KAAK,SAAS,EACd,KAAK,MAAM,EAEZ,MAAM,gBAAgB,CAAC;AAExB,OAAO,KAAK,EACV,aAAa,EACb,KAAK,EACL,eAAe,EACf,WAAW,EACX,mBAAmB,EACnB,YAAY,EACZ,qBAAqB,EACrB,gBAAgB,EACjB,MAAM,kBAAkB,CAAC;AAkF1B,qBAAa,UAAW,YAAW,KAAK;IAOpC,OAAO,CAAC,YAAY,CAAC;IACrB,OAAO,CAAC,YAAY,CAAC;IAErB,OAAO,CAAC,eAAe,CAAC;IAIxB,OAAO,CAAC,YAAY,CAAC;IACrB,OAAO,CAAC,qBAAqB,CAAC;IAdhC,QAAQ,CAAC,QAAQ,EAAG,aAAa,CAAU;IAC3C,QAAQ,CAAC,IAAI,iBAAiB;IAE9B,OAAO,CAAC,aAAa,CAAC,CAAsB;gBAGlC,YAAY,CAAC,EAAE,kBAAkB,YAAA,EACjC,YAAY,CAAC,EAAE,iBAAiB,YAAA,EACxC,MAAM,CAAC,EAAE,MAAM,EACP,eAAe,CAAC,EAAE,eAAe,YAAA,EACzC,cAAc,CAAC,EAAE,0BAA0B,EAC3C,aAAa,CAAC,EAAE,mBAAmB,EACnC,iBAAiB,CAAC,EAAE,iBAAiB,EAC7B,YAAY,CAAC,EAAE,YAAY,YAAA,EAC3B,qBAAqB,CAAC,EAAE,qBAAqB,YAAA,EACrD,eAAe,CAAC,EAAE,mBAAmB,EACrC,YAAY,CAAC,EAAE,gBAAgB,EAC/B,SAAS,CAAC,EAAE,cAAc,EAC1B,UAAU,CAAC,EAAE,OAAO,EACpB,cAAc,CAAC,EAAE,OAAO,EAAE,+EAA+E;IACzG,SAAS,CAAC,EAAE,OAAO,gCAAgC,EAAE,eAAe,EACpE,uBAAuB,CAAC,EAAE,6BAA6B;IAsBzD,eAAe,IAAI,gBAAgB;IAY7B,cAAc,IAAI,OAAO,CAAC,OAAO,CAAC;YAW1B,aAAa;IAarB,aAAa,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,WAAW,CAAC;IA6BrF;;;;;;;;;;;;;;OAcG;IACG,0BAA0B,CAC9B,SAAS,EAAE,SAAS,EACpB,MAAM,EAAE,MAAM,EACd,MAAM,CAAC,EAAE,MAAM,EACf,cAAc,CAAC,EAAE,cAAc,EAC/B,kBAAkB,CAAC,EAAE,OAAO,SAAS,EAAE,kBAAkB,EACzD,eAAe,CAAC,EAAE,eAAe,EACjC,aAAa,CAAC,EAAE,aAAa,GAC5B,OAAO,CAAC;QACT,aAAa,EAAE,SAAS,CAAC;QACzB,mBAAmB,EAAE,SAAS,EAAE,CAAC;QACjC,UAAU,CAAC,EAAE,UAAU,CAAC;QACxB,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,aAAa,CAAC,EAAE,MAAM,CAAC;QACvB,kBAAkB,CAAC,EAAE,MAAM,CAAC;QAC5B,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,UAAU,CAAC,EAAE,OAAO,CAAC;QACrB,cAAc,CAAC,EAAE,OAAO,gBAAgB,EAAE,gBAAgB,CAAC;QAC3D,mFAAmF;QACnF,eAAe,CAAC,EAAE,OAAO,gBAAgB,EAAE,iCAAiC,CAAC;QAC7E,UAAU,CAAC,EAAE,OAAO,CAAC;QACrB,QAAQ,CAAC,EAAE,OAAO,CAAC;QACnB,oGAAoG;QACpG,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;KACzB,CAAC;IAkmBF;;;OAGG;YACW,qBAAqB;IAwCnC;;;;;;;;OAQG;IACG,aAAa,CACjB,SAAS,EAAE,SAAS,EACpB,MAAM,EAAE,MAAM,EACd,MAAM,CAAC,EAAE,MAAM,EACf,cAAc,CAAC,EAAE,cAAc,EAC/B,aAAa,CAAC,EAAE,aAAa,GAC5B,OAAO,CAAC;QACT,aAAa,EAAE,SAAS,CAAC;QACzB,mBAAmB,EAAE,SAAS,EAAE,CAAC;QACjC,UAAU,CAAC,EAAE,UAAU,CAAC;QACxB,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,aAAa,CAAC,EAAE,MAAM,CAAC;QACvB,kBAAkB,CAAC,EAAE,MAAM,CAAC;QAC5B,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,UAAU,CAAC,EAAE,OAAO,CAAC;QACrB,cAAc,CAAC,EAAE,OAAO,gBAAgB,EAAE,gBAAgB,CAAC;QAC3D,mFAAmF;QACnF,eAAe,CAAC,EAAE,OAAO,gBAAgB,EAAE,iCAAiC,CAAC;QAC7E,UAAU,CAAC,EAAE,OAAO,CAAC;QACrB,QAAQ,CAAC,EAAE,OAAO,CAAC;QACnB,oGAAoG;QACpG,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;KACzB,CAAC;IA+PF;;;;;;;;OAQG;IACG,QAAQ,CACZ,SAAS,EAAE,MAAM,EACjB,MAAM,CAAC,EAAE,MAAM,GACd,OAAO,CAAC;QACT,OAAO,EAAE,OAAO,CAAC;QACjB,aAAa,CAAC,EAAE,OAAO,CAAC;YAAE,MAAM,EAAE,MAAM,CAAC;YAAC,MAAM,EAAE,WAAW,GAAG,QAAQ,GAAG,WAAW,CAAA;SAAE,CAAC,CAAC;QAC1F,MAAM,CAAC,EAAE,MAAM,CAAC;KACjB,CAAC;IA2BF;;;;;OAKG;IACH,qBAAqB,CAAC,YAAY,EAAE,cAAc,GAAG,qBAAqB;IAM1E;;;;;;;;;;;;;;;;;;;OAmBG;IACH;;;;;;;;;;;;;;;OAeG;IACG,oBAAoB,CACxB,SAAS,EAAE,MAAM,EACjB,cAAc,CAAC,EAAE,MAAM,EACvB,sBAAsB,CAAC,EAAE,OAAO,GAC/B,OAAO,CAAC,MAAM,CAAC;CAMnB"}

package/dist/executor/sdk-handlers/claude/claude-tool.js

@@ -82,14 +82,14 @@ export class ClaudeTool {
     name = 'Claude Code';
     promptService;
     constructor(messagesRepo, sessionsRepo, apiKey, messagesService, sessionMCPRepo, mcpServerRepo, permissionService, tasksService, tasksStreamingService, sessionsService, branchesRepo, reposRepo, mcpEnabled, _useNativeAuth, // Claude supports `claude login` OAuth, but no special handling needed in tool
-    usersRepo) {
+    usersRepo, mcpOAuthAuthHeadersRepo) {
         this.messagesRepo = messagesRepo;
         this.sessionsRepo = sessionsRepo;
         this.messagesService = messagesService;
         this.tasksService = tasksService;
         this.tasksStreamingService = tasksStreamingService;
         if (messagesRepo && sessionsRepo) {
-            this.promptService = new ClaudePromptService(messagesRepo, sessionsRepo, apiKey, sessionMCPRepo, mcpServerRepo, permissionService, tasksService, sessionsService, branchesRepo, reposRepo, messagesService, mcpEnabled, usersRepo);
+            this.promptService = new ClaudePromptService(messagesRepo, sessionsRepo, apiKey, sessionMCPRepo, mcpServerRepo, permissionService, tasksService, sessionsService, branchesRepo, reposRepo, messagesService, mcpEnabled, usersRepo, mcpOAuthAuthHeadersRepo);
         }
     }
     getCapabilities() {

package/dist/executor/sdk-handlers/claude/prompt-service.d.ts

@@ -5,7 +5,7 @@
  * Automatically loads CLAUDE.md and uses preset system prompts matching Claude Code CLI.
  */
 import type { PermissionMode } from '@agor/core/sdk';
-import type { BranchRepository, MCPServerRepository, MessagesRepository, SessionMCPServerRepository, SessionRepository, UsersRepository } from '../../db/feathers-repositories.js';
+import type { BranchRepository, MCPOAuthAuthHeadersRepository, MCPServerRepository, MessagesRepository, SessionMCPServerRepository, SessionRepository, UsersRepository } from '../../db/feathers-repositories.js';
 import type { PermissionService } from '../../permissions/permission-service.js';
 import type { SessionID, TaskID } from '../../types.js';
 import type { MessagesService, SessionsPatchClient, TasksService } from '../base/index.js';
@@ -45,15 +45,25 @@ export declare class ClaudePromptService {
     private messagesService?;
     private mcpEnabled?;
     private usersRepo?;
+    private mcpOAuthAuthHeadersRepo?;
     /** Enable token-level streaming from Claude Agent SDK */
     private static readonly ENABLE_TOKEN_STREAMING;
-    /** Idle timeout for SDK event loop - throws error if no messages received for this duration */
+    /**
+     * Idle timeout for SDK event loop - throws error if no messages are received
+     * for this duration.
+     *
+     * This is only a guard for a truly stuck SDK stream. Executor liveness is
+     * tracked separately by task heartbeats, so this must be long enough for
+     * legitimate silent tool calls (for example, a foreground Bash `sleep` or a
+     * long-running test command) to finish without Agor misclassifying the turn
+     * as hung.
+     */
     private static readonly IDLE_TIMEOUT_MS;
     /** Serialize permission checks per session to prevent duplicate prompts for concurrent tool calls */
     private permissionLocks;
     constructor(messagesRepo: MessagesRepository, sessionsRepo: SessionRepository, apiKey?: string | undefined, sessionMCPRepo?: SessionMCPServerRepository | undefined, mcpServerRepo?: MCPServerRepository | undefined, permissionService?: PermissionService | undefined, tasksService?: TasksService | undefined, sessionsService?: SessionsPatchClient | undefined, // FeathersJS Sessions service for WebSocket broadcasting
     branchesRepo?: BranchRepository | undefined, reposRepo?: import("../../db/feathers-repositories").RepoRepository | undefined, messagesService?: MessagesService | undefined, // FeathersJS Messages service for creating permission requests
-    mcpEnabled?: boolean | undefined, usersRepo?: UsersRepository | undefined);
+    mcpEnabled?: boolean | undefined, usersRepo?: UsersRepository | undefined, mcpOAuthAuthHeadersRepo?: MCPOAuthAuthHeadersRepository | undefined);
     /**
      * Build help message for CLI-only commands that don't work through the SDK
      */

package/dist/executor/sdk-handlers/claude/prompt-service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"prompt-service.d.ts","sourceRoot":"","sources":["../../../src/sdk-handlers/claude/prompt-service.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,KAAK,EAAE,cAAc,EAAoB,MAAM,gBAAgB,CAAC;AACvE,OAAO,KAAK,EACV,gBAAgB,EAChB,mBAAmB,EACnB,kBAAkB,EAClB,0BAA0B,EAC1B,iBAAiB,EACjB,eAAe,EAChB,MAAM,mCAAmC,CAAC;AAC3C,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,yCAAyC,CAAC;AACjF,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,gBAAgB,CAAC;AAExD,OAAO,KAAK,EAAE,eAAe,EAAE,mBAAmB,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAC3F,OAAO,EAAE,KAAK,cAAc,EAAuB,MAAM,wBAAwB,CAAC;AAGlF,MAAM,WAAW,YAAY;IAC3B,2EAA2E;IAC3E,QAAQ,EAAE,KAAK,CAAC;QACd,OAAO,EAAE,KAAK,CAAC;YACb,IAAI,EAAE,MAAM,CAAC;YACb,IAAI,CAAC,EAAE,MAAM,CAAC;YACd,EAAE,CAAC,EAAE,MAAM,CAAC;YACZ,IAAI,CAAC,EAAE,MAAM,CAAC;YACd,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;SACjC,CAAC,CAAC;QACH,QAAQ,CAAC,EAAE,KAAK,CAAC;YACf,EAAE,EAAE,MAAM,CAAC;YACX,IAAI,EAAE,MAAM,CAAC;YACb,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;SAChC,CAAC,CAAC;KACJ,CAAC,CAAC;IACH,6BAA6B;IAC7B,WAAW,EAAE,MAAM,CAAC;IACpB,8BAA8B;IAC9B,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,qBAAa,mBAAmB;IAW5B,OAAO,CAAC,YAAY;IACpB,OAAO,CAAC,YAAY;IACpB,OAAO,CAAC,MAAM,CAAC;IACf,OAAO,CAAC,cAAc,CAAC;IACvB,OAAO,CAAC,aAAa,CAAC;IACtB,OAAO,CAAC,iBAAiB,CAAC;IAC1B,OAAO,CAAC,YAAY,CAAC;IACrB,OAAO,CAAC,eAAe,CAAC;IACxB,OAAO,CAAC,YAAY,CAAC;IACrB,OAAO,CAAC,SAAS,CAAC;IAClB,OAAO,CAAC,eAAe,CAAC;IACxB,OAAO,CAAC,UAAU,CAAC;IACnB,OAAO,CAAC,SAAS,CAAC;IAtBpB,yDAAyD;IACzD,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,sBAAsB,CAAQ;IAEtD,+FAA+F;IAC/F,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,eAAe,CAAU;IAEjD,qGAAqG;IACrG,OAAO,CAAC,eAAe,CAAuC;gBAGpD,YAAY,EAAE,kBAAkB,EAChC,YAAY,EAAE,iBAAiB,EAC/B,MAAM,CAAC,EAAE,MAAM,YAAA,EACf,cAAc,CAAC,EAAE,0BAA0B,YAAA,EAC3C,aAAa,CAAC,EAAE,mBAAmB,YAAA,EACnC,iBAAiB,CAAC,EAAE,iBAAiB,YAAA,EACrC,YAAY,CAAC,EAAE,YAAY,YAAA,EAC3B,eAAe,CAAC,EAAE,mBAAmB,YAAA,EAAE,yDAAyD;IAChG,YAAY,CAAC,EAAE,gBAAgB,YAAA,EAC/B,SAAS,CAAC,EAAE,OAAO,gCAAgC,EAAE,cAAc,YAAA,EACnE,eAAe,CAAC,EAAE,eAAe,YAAA,EAAE,+DAA+D;IAClG,UAAU,CAAC,EAAE,OAAO,YAAA,EACpB,SAAS,CAAC,EAAE,eAAe,YAAA;IAKrC;;OAEG;IACH,OAAO,CAAC,0BAA0B;IAoBlC;;;;;;;;;;;;;OAaG;IACI,sBAAsB,CAC3B,SAAS,EAAE,SAAS,EACpB,MAAM,EAAE,MAAM,EACd,MAAM,CAAC,EAAE,MAAM,EACf,cAAc,CAAC,EAAE,cAAc,EAC/B,cAAc,CAAC,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,KAAK,IAAI,EAC3D,eAAe,CAAC,EAAE,eAAe,GAChC,cAAc,CAAC,cAAc,CAAC;IAmNjC;;;;;;;;;;;OAWG;IACG,aAAa,CAAC,SAAS,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC;IAwHhF;;;;;;;;;;OAUG;IACG,QAAQ,CAAC,SAAS,EAAE,SAAS,GAAG,OAAO,CAAC;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CAQrF"}
+{"version":3,"file":"prompt-service.d.ts","sourceRoot":"","sources":["../../../src/sdk-handlers/claude/prompt-service.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,KAAK,EAAE,cAAc,EAAoB,MAAM,gBAAgB,CAAC;AACvE,OAAO,KAAK,EACV,gBAAgB,EAChB,6BAA6B,EAC7B,mBAAmB,EACnB,kBAAkB,EAClB,0BAA0B,EAC1B,iBAAiB,EACjB,eAAe,EAChB,MAAM,mCAAmC,CAAC;AAC3C,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,yCAAyC,CAAC;AACjF,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,gBAAgB,CAAC;AAExD,OAAO,KAAK,EAAE,eAAe,EAAE,mBAAmB,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAC3F,OAAO,EAAE,KAAK,cAAc,EAAuB,MAAM,wBAAwB,CAAC;AAGlF,MAAM,WAAW,YAAY;IAC3B,2EAA2E;IAC3E,QAAQ,EAAE,KAAK,CAAC;QACd,OAAO,EAAE,KAAK,CAAC;YACb,IAAI,EAAE,MAAM,CAAC;YACb,IAAI,CAAC,EAAE,MAAM,CAAC;YACd,EAAE,CAAC,EAAE,MAAM,CAAC;YACZ,IAAI,CAAC,EAAE,MAAM,CAAC;YACd,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;SACjC,CAAC,CAAC;QACH,QAAQ,CAAC,EAAE,KAAK,CAAC;YACf,EAAE,EAAE,MAAM,CAAC;YACX,IAAI,EAAE,MAAM,CAAC;YACb,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;SAChC,CAAC,CAAC;KACJ,CAAC,CAAC;IACH,6BAA6B;IAC7B,WAAW,EAAE,MAAM,CAAC;IACpB,8BAA8B;IAC9B,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,qBAAa,mBAAmB;IAoB5B,OAAO,CAAC,YAAY;IACpB,OAAO,CAAC,YAAY;IACpB,OAAO,CAAC,MAAM,CAAC;IACf,OAAO,CAAC,cAAc,CAAC;IACvB,OAAO,CAAC,aAAa,CAAC;IACtB,OAAO,CAAC,iBAAiB,CAAC;IAC1B,OAAO,CAAC,YAAY,CAAC;IACrB,OAAO,CAAC,eAAe,CAAC;IACxB,OAAO,CAAC,YAAY,CAAC;IACrB,OAAO,CAAC,SAAS,CAAC;IAClB,OAAO,CAAC,eAAe,CAAC;IACxB,OAAO,CAAC,UAAU,CAAC;IACnB,OAAO,CAAC,SAAS,CAAC;IAClB,OAAO,CAAC,uBAAuB,CAAC;IAhClC,yDAAyD;IACzD,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,sBAAsB,CAAQ;IAEtD;;;;;;;;;OASG;IACH,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,eAAe,CAAkB;IAEzD,qGAAqG;IACrG,OAAO,CAAC,eAAe,CAAuC;gBAGpD,YAAY,EAAE,kBAAkB,EAChC,YAAY,EAAE,iBAAiB,EAC/B,MAAM,CAAC,EAAE,MAAM,YAAA,EACf,cAAc,CAAC,EAAE,0BAA0B,YAAA,EAC3C,aAAa,CAAC,EAAE,mBAAmB,YAAA,EACnC,iBAAiB,CAAC,EAAE,iBAAiB,YAAA,EACrC,YAAY,CAAC,EAAE,YAAY,YAAA,EAC3B,eAAe,CAAC,EAAE,mBAAmB,YAAA,EAAE,yDAAyD;IAChG,YAAY,CAAC,EAAE,gBAAgB,YAAA,EAC/B,SAAS,CAAC,EAAE,OAAO,gCAAgC,EAAE,cAAc,YAAA,EACnE,eAAe,CAAC,EAAE,eAAe,YAAA,EAAE,+DAA+D;IAClG,UAAU,CAAC,EAAE,OAAO,YAAA,EACpB,SAAS,CAAC,EAAE,eAAe,YAAA,EAC3B,uBAAuB,CAAC,EAAE,6BAA6B,YAAA;IAKjE;;OAEG;IACH,OAAO,CAAC,0BAA0B;IAoBlC;;;;;;;;;;;;;OAaG;IACI,sBAAsB,CAC3B,SAAS,EAAE,SAAS,EACpB,MAAM,EAAE,MAAM,EACd,MAAM,CAAC,EAAE,MAAM,EACf,cAAc,CAAC,EAAE,cAAc,EAC/B,cAAc,CAAC,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,KAAK,IAAI,EAC3D,eAAe,CAAC,EAAE,eAAe,GAChC,cAAc,CAAC,cAAc,CAAC;IAoNjC;;;;;;;;;;;OAWG;IACG,aAAa,CAAC,SAAS,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC;IAyHhF;;;;;;;;;;OAUG;IACG,QAAQ,CAAC,SAAS,EAAE,SAAS,GAAG,OAAO,CAAC;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CAQrF"}

package/dist/executor/sdk-handlers/claude/prompt-service.js

@@ -22,15 +22,25 @@ export class ClaudePromptService {
     messagesService;
     mcpEnabled;
     usersRepo;
+    mcpOAuthAuthHeadersRepo;
     /** Enable token-level streaming from Claude Agent SDK */
     static ENABLE_TOKEN_STREAMING = true;
-    /** Idle timeout for SDK event loop - throws error if no messages received for this duration */
-    static IDLE_TIMEOUT_MS = 300000; // 5 minutes
+    /**
+     * Idle timeout for SDK event loop - throws error if no messages are received
+     * for this duration.
+     *
+     * This is only a guard for a truly stuck SDK stream. Executor liveness is
+     * tracked separately by task heartbeats, so this must be long enough for
+     * legitimate silent tool calls (for example, a foreground Bash `sleep` or a
+     * long-running test command) to finish without Agor misclassifying the turn
+     * as hung.
+     */
+    static IDLE_TIMEOUT_MS = 60 * 60 * 1000; // 60 minutes
     /** Serialize permission checks per session to prevent duplicate prompts for concurrent tool calls */
     permissionLocks = new Map();
     constructor(messagesRepo, sessionsRepo, apiKey, sessionMCPRepo, mcpServerRepo, permissionService, tasksService, sessionsService, // FeathersJS Sessions service for WebSocket broadcasting
     branchesRepo, reposRepo, messagesService, // FeathersJS Messages service for creating permission requests
-    mcpEnabled, usersRepo) {
+    mcpEnabled, usersRepo, mcpOAuthAuthHeadersRepo) {
         this.messagesRepo = messagesRepo;
         this.sessionsRepo = sessionsRepo;
         this.apiKey = apiKey;
@@ -44,6 +54,7 @@ export class ClaudePromptService {
         this.messagesService = messagesService;
         this.mcpEnabled = mcpEnabled;
         this.usersRepo = usersRepo;
+        this.mcpOAuthAuthHeadersRepo = mcpOAuthAuthHeadersRepo;
         // No client initialization needed - Agent SDK is stateless
     }
     /**
@@ -148,6 +159,7 @@ If you continue to see authentication errors, please contact your Agor administr
             messagesService: this.messagesService,
             branchesRepo: this.branchesRepo,
             usersRepo: this.usersRepo,
+            mcpOAuthAuthHeadersRepo: this.mcpOAuthAuthHeadersRepo,
             permissionLocks: this.permissionLocks,
         }, {
             taskId,
@@ -285,6 +297,7 @@ If you continue to see authentication errors, please contact your Agor administr
             messagesService: this.messagesService,
             branchesRepo: this.branchesRepo,
             usersRepo: this.usersRepo,
+            mcpOAuthAuthHeadersRepo: this.mcpOAuthAuthHeadersRepo,
             permissionLocks: this.permissionLocks,
         }, {
             taskId: undefined,

package/dist/executor/sdk-handlers/claude/query-builder.d.ts

@@ -6,7 +6,7 @@
  */
 import { Claude } from '@agor/core/sdk';
 type PermissionMode = Claude.PermissionMode;
-import type { BranchRepository, MCPServerRepository, MessagesRepository, RepoRepository, SessionMCPServerRepository, SessionRepository, UsersRepository } from '../../db/feathers-repositories.js';
+import type { BranchRepository, MCPOAuthAuthHeadersRepository, MCPServerRepository, MessagesRepository, RepoRepository, SessionMCPServerRepository, SessionRepository, UsersRepository } from '../../db/feathers-repositories.js';
 import type { PermissionService } from '../../permissions/permission-service.js';
 import type { SessionID, TaskID } from '../../types.js';
 import type { MessagesService, SessionsPatchClient, TasksService } from '../base/index.js';
@@ -18,6 +18,7 @@ export interface QuerySetupDeps {
     apiKey?: string;
     sessionMCPRepo?: SessionMCPServerRepository;
     mcpServerRepo?: MCPServerRepository;
+    mcpOAuthAuthHeadersRepo?: MCPOAuthAuthHeadersRepository;
     permissionService?: PermissionService;
     tasksService?: TasksService;
     sessionsService?: SessionsPatchClient;

package/dist/executor/sdk-handlers/claude/query-builder.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"query-builder.d.ts","sourceRoot":"","sources":["../../../src/sdk-handlers/claude/query-builder.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAKH,OAAO,EAAE,MAAM,EAAE,MAAM,gBAAgB,CAAC;AAOxC,KAAK,cAAc,GAAG,MAAM,CAAC,cAAc,CAAC;AAI5C,OAAO,KAAK,EACV,gBAAgB,EAChB,mBAAmB,EACnB,kBAAkB,EAClB,cAAc,EACd,0BAA0B,EAC1B,iBAAiB,EACjB,eAAe,EAChB,MAAM,mCAAmC,CAAC;AAC3C,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,yCAAyC,CAAC;AACjF,OAAO,KAAK,EAAoB,SAAS,EAAE,MAAM,EAAE,MAAM,gBAAgB,CAAC;AAE1E,OAAO,KAAK,EAAE,eAAe,EAAE,mBAAmB,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AA+B3F,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,QAAQ,SAAI,GAAG,MAAM,CAKtE;AAgDD,MAAM,WAAW,cAAc;IAC7B,YAAY,EAAE,iBAAiB,CAAC;IAChC,SAAS,CAAC,EAAE,cAAc,CAAC;IAC3B,YAAY,CAAC,EAAE,kBAAkB,CAAC;IAClC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,cAAc,CAAC,EAAE,0BAA0B,CAAC;IAC5C,aAAa,CAAC,EAAE,mBAAmB,CAAC;IACpC,iBAAiB,CAAC,EAAE,iBAAiB,CAAC;IACtC,YAAY,CAAC,EAAE,YAAY,CAAC;IAC5B,eAAe,CAAC,EAAE,mBAAmB,CAAC;IACtC,eAAe,CAAC,EAAE,eAAe,CAAC;IAClC,YAAY,CAAC,EAAE,gBAAgB,CAAC;IAChC,SAAS,CAAC,EAAE,eAAe,CAAC;IAC5B,eAAe,EAAE,GAAG,CAAC,SAAS,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;IAC/C,UAAU,CAAC,EAAE,OAAO,CAAC;CACtB;AAED;;;GAGG;AACH;;;;;GAKG;AACH,MAAM,WAAW,kBAAkB;IACjC,SAAS,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3B,eAAe,IAAI,OAAO,CAAC,OAAO,gBAAgB,EAAE,iCAAiC,CAAC,CAAC;IACvF;;;;OAIG;IACH,YAAY,IAAI,IAAI,CAAC;IAErB,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI,aAAa,CAAC,GAAG,CAAC,CAAC;CAC9C;AAED,wBAAsB,UAAU,CAC9B,SAAS,EAAE,SAAS,EACpB,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,cAAc,EACpB,OAAO,GAAE;IACP,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,cAAc,CAAC,EAAE,cAAc,CAAC;IAChC,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,eAAe,CAAC,EAAE,eAAe,CAAC;CAC9B,GACL,OAAO,CAAC;IACT,KAAK,EAAE,kBAAkB,CAAC;IAC1B,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,MAAM,MAAM,CAAC;CACzB,CAAC,CAqjBD"}
+{"version":3,"file":"query-builder.d.ts","sourceRoot":"","sources":["../../../src/sdk-handlers/claude/query-builder.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAKH,OAAO,EAAE,MAAM,EAAE,MAAM,gBAAgB,CAAC;AAOxC,KAAK,cAAc,GAAG,MAAM,CAAC,cAAc,CAAC;AAI5C,OAAO,KAAK,EACV,gBAAgB,EAChB,6BAA6B,EAC7B,mBAAmB,EACnB,kBAAkB,EAClB,cAAc,EACd,0BAA0B,EAC1B,iBAAiB,EACjB,eAAe,EAChB,MAAM,mCAAmC,CAAC;AAC3C,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,yCAAyC,CAAC;AACjF,OAAO,KAAK,EAAoB,SAAS,EAAE,MAAM,EAAE,MAAM,gBAAgB,CAAC;AAE1E,OAAO,KAAK,EAAE,eAAe,EAAE,mBAAmB,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AA+B3F,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,QAAQ,SAAI,GAAG,MAAM,CAKtE;AAgDD,MAAM,WAAW,cAAc;IAC7B,YAAY,EAAE,iBAAiB,CAAC;IAChC,SAAS,CAAC,EAAE,cAAc,CAAC;IAC3B,YAAY,CAAC,EAAE,kBAAkB,CAAC;IAClC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,cAAc,CAAC,EAAE,0BAA0B,CAAC;IAC5C,aAAa,CAAC,EAAE,mBAAmB,CAAC;IACpC,uBAAuB,CAAC,EAAE,6BAA6B,CAAC;IACxD,iBAAiB,CAAC,EAAE,iBAAiB,CAAC;IACtC,YAAY,CAAC,EAAE,YAAY,CAAC;IAC5B,eAAe,CAAC,EAAE,mBAAmB,CAAC;IACtC,eAAe,CAAC,EAAE,eAAe,CAAC;IAClC,YAAY,CAAC,EAAE,gBAAgB,CAAC;IAChC,SAAS,CAAC,EAAE,eAAe,CAAC;IAC5B,eAAe,EAAE,GAAG,CAAC,SAAS,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;IAC/C,UAAU,CAAC,EAAE,OAAO,CAAC;CACtB;AAED;;;GAGG;AACH;;;;;GAKG;AACH,MAAM,WAAW,kBAAkB;IACjC,SAAS,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3B,eAAe,IAAI,OAAO,CAAC,OAAO,gBAAgB,EAAE,iCAAiC,CAAC,CAAC;IACvF;;;;OAIG;IACH,YAAY,IAAI,IAAI,CAAC;IAErB,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI,aAAa,CAAC,GAAG,CAAC,CAAC;CAC9C;AAED,wBAAsB,UAAU,CAC9B,SAAS,EAAE,SAAS,EACpB,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,cAAc,EACpB,OAAO,GAAE;IACP,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,cAAc,CAAC,EAAE,cAAc,CAAC;IAChC,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,eAAe,CAAC,EAAE,eAAe,CAAC;CAC9B,GACL,OAAO,CAAC;IACT,KAAK,EAAE,kBAAkB,CAAC;IAC1B,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,MAAM,MAAM,CAAC;CACzB,CAAC,CAujBD"}

package/dist/executor/sdk-handlers/claude/query-builder.js

@@ -422,6 +422,7 @@ export async function setupQuery(sessionId, prompt, deps, options = {}) {
             const serversWithSource = await getMcpServersForSession(sessionId, {
                 sessionMCPRepo: deps.sessionMCPRepo,
                 mcpServerRepo: deps.mcpServerRepo,
+                mcpOAuthAuthHeadersRepo: deps.mcpOAuthAuthHeadersRepo,
                 forUserId: contextUserId,
             });
             if (serversWithSource.length > 0) {
@@ -447,7 +448,7 @@ export async function setupQuery(sessionId, prompt, deps, options = {}) {
                         type: transport,
                         env: server.env,
                     };
-                    let canAlwaysLoad = shouldBlockOnMcpStartup;
+                    let canAlwaysLoad = shouldBlockOnMcpStartup || (transport !== 'stdio' && server.auth?.type === 'oauth');
                     // Add transport-specific fields
                     if (transport === 'stdio') {
                         serverConfig.command = server.command;

package/dist/executor/sdk-handlers/codex/codex-tool.d.ts

@@ -6,7 +6,7 @@
  * - ❌ Import sessions (deferred - need real session JSONL format)
  * - ❌ Session creation (handled via live execution)
  */
-import type { BranchRepository, MCPServerRepository, MessagesRepository, RepoRepository, SessionMCPServerRepository, SessionRepository, UsersRepository } from '../../db/feathers-repositories.js';
+import type { BranchRepository, MCPOAuthAuthHeadersRepository, MCPServerRepository, MessagesRepository, RepoRepository, SessionMCPServerRepository, SessionRepository, UsersRepository } from '../../db/feathers-repositories.js';
 import type { NormalizedSdkResponse, RawSdkResponse } from '../../types/sdk-response.js';
 import type { TokenUsage } from '../../types/token-usage.js';
 import { type ContextUsageSnapshot, type MessageID, type MessageSource, type PermissionMode, type SessionID, type TaskID } from '../../types.js';
@@ -32,7 +32,7 @@ export declare class CodexTool implements ITool {
     private messagesService?;
     private tasksService?;
     private tasksStreamingService?;
-    constructor(messagesRepo?: MessagesRepository, sessionsRepo?: SessionRepository, sessionMCPServerRepo?: SessionMCPServerRepository, branchesRepo?: BranchRepository, reposRepo?: RepoRepository, apiKey?: string, messagesService?: MessagesService, tasksService?: TasksService, tasksStreamingService?: TasksStreamingService, useNativeAuth?: boolean, mcpServerRepo?: MCPServerRepository, usersRepo?: UsersRepository);
+    constructor(messagesRepo?: MessagesRepository, sessionsRepo?: SessionRepository, sessionMCPServerRepo?: SessionMCPServerRepository, branchesRepo?: BranchRepository, reposRepo?: RepoRepository, apiKey?: string, messagesService?: MessagesService, tasksService?: TasksService, tasksStreamingService?: TasksStreamingService, useNativeAuth?: boolean, mcpServerRepo?: MCPServerRepository, usersRepo?: UsersRepository, mcpOAuthAuthHeadersRepo?: MCPOAuthAuthHeadersRepository);
     getCapabilities(): ToolCapabilities;
     checkInstalled(): Promise<boolean>;
     private emitTaskEvent;

package/dist/executor/sdk-handlers/codex/codex-tool.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"codex-tool.d.ts","sourceRoot":"","sources":["../../../src/sdk-handlers/codex/codex-tool.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAIH,OAAO,KAAK,EACV,gBAAgB,EAChB,mBAAmB,EACnB,kBAAkB,EAClB,cAAc,EACd,0BAA0B,EAC1B,iBAAiB,EACjB,eAAe,EAChB,MAAM,mCAAmC,CAAC;AAC3C,OAAO,KAAK,EAAE,qBAAqB,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AACzF,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,4BAA4B,CAAC;AAC7D,OAAO,EACL,KAAK,oBAAoB,EAEzB,KAAK,SAAS,EAEd,KAAK,aAAa,EAClB,KAAK,cAAc,EACnB,KAAK,SAAS,EACd,KAAK,MAAM,EACZ,MAAM,gBAAgB,CAAC;AASxB,OAAO,KAAK,EACV,KAAK,EACL,eAAe,EACf,kBAAkB,EAClB,YAAY,EACZ,qBAAqB,EACrB,gBAAgB,EACjB,MAAM,kBAAkB,CAAC;AAM1B,UAAU,oBAAoB;IAC5B,aAAa,EAAE,SAAS,CAAC;IACzB,mBAAmB,EAAE,SAAS,EAAE,CAAC;IACjC,UAAU,CAAC,EAAE,UAAU,CAAC;IACxB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,eAAe,CAAC,EAAE,oBAAoB,CAAC;IACvC,UAAU,CAAC,EAAE,OAAO,CAAC;CACtB;AAYD,qBAAa,SAAU,YAAW,KAAK;IACrC,QAAQ,CAAC,QAAQ,EAAG,OAAO,CAAU;IACrC,QAAQ,CAAC,IAAI,kBAAkB;IAE/B,OAAO,CAAC,aAAa,CAAC,CAAqB;IAC3C,OAAO,CAAC,YAAY,CAAC,CAAqB;IAC1C,OAAO,CAAC,YAAY,CAAC,CAAoB;IACzC,OAAO,CAAC,YAAY,CAAC,CAAmB;IACxC,OAAO,CAAC,eAAe,CAAC,CAAkB;IAC1C,OAAO,CAAC,YAAY,CAAC,CAAe;IACpC,OAAO,CAAC,qBAAqB,CAAC,CAAwB;gBAGpD,YAAY,CAAC,EAAE,kBAAkB,EACjC,YAAY,CAAC,EAAE,iBAAiB,EAChC,oBAAoB,CAAC,EAAE,0BAA0B,EACjD,YAAY,CAAC,EAAE,gBAAgB,EAC/B,SAAS,CAAC,EAAE,cAAc,EAC1B,MAAM,CAAC,EAAE,MAAM,EACf,eAAe,CAAC,EAAE,eAAe,EACjC,YAAY,CAAC,EAAE,YAAY,EAC3B,qBAAqB,CAAC,EAAE,qBAAqB,EAC7C,aAAa,CAAC,EAAE,OAAO,EACvB,aAAa,CAAC,EAAE,mBAAmB,EACnC,SAAS,CAAC,EAAE,eAAe;IAyB7B,eAAe,IAAI,gBAAgB;IAY7B,cAAc,IAAI,OAAO,CAAC,OAAO,CAAC;YAU1B,aAAa;IAa3B;;;;;;;;;;;;;OAaG;IACG,0BAA0B,CAC9B,SAAS,EAAE,SAAS,EACpB,MAAM,EAAE,MAAM,EACd,MAAM,CAAC,EAAE,MAAM,EACf,cAAc,CAAC,EAAE,cAAc,EAC/B,kBAAkB,CAAC,EAAE,kBAAkB,EACvC,eAAe,CAAC,EAAE,eAAe,EACjC,aAAa,CAAC,EAAE,aAAa,GAC5B,OAAO,CAAC,oBAAoB,CAAC;IAoZhC;;;;;OAKG;YACW,eAAe;IAsB7B;;;OAGG;YACW,sBAAsB;IA6CpC;;;;;;;;;;OAUG;IACG,aAAa,CACjB,SAAS,EAAE,SAAS,EACpB,MAAM,EAAE,MAAM,EACd,MAAM,CAAC,EAAE,MAAM,EACf,cAAc,CAAC,EAAE,cAAc,EAC/B,aAAa,CAAC,EAAE,aAAa,GAC5B,OAAO,CAAC,oBAAoB,CAAC;IAoJhC;;;;;;;;OAQG;IACG,QAAQ,CACZ,SAAS,EAAE,MAAM,EACjB,MAAM,CAAC,EAAE,MAAM,GACd,OAAO,CAAC;QACT,OAAO,EAAE,OAAO,CAAC;QACjB,aAAa,CAAC,EAAE,OAAO,CAAC;YAAE,MAAM,EAAE,MAAM,CAAC;YAAC,MAAM,EAAE,WAAW,GAAG,QAAQ,GAAG,WAAW,CAAA;SAAE,CAAC,CAAC;QAC1F,MAAM,CAAC,EAAE,MAAM,CAAC;KACjB,CAAC;IA2BF;;;;;OAKG;IACH,qBAAqB,CAAC,YAAY,EAAE,cAAc,GAAG,qBAAqB;IAM1E;;;;;;;;;;;;;;;;;;;OAmBG;IACG,oBAAoB,CACxB,SAAS,EAAE,MAAM,EACjB,cAAc,CAAC,EAAE,MAAM,EACvB,qBAAqB,CAAC,EAAE,OAAO,GAC9B,OAAO,CAAC,MAAM,CAAC;CAsCnB"}
+{"version":3,"file":"codex-tool.d.ts","sourceRoot":"","sources":["../../../src/sdk-handlers/codex/codex-tool.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAIH,OAAO,KAAK,EACV,gBAAgB,EAChB,6BAA6B,EAC7B,mBAAmB,EACnB,kBAAkB,EAClB,cAAc,EACd,0BAA0B,EAC1B,iBAAiB,EACjB,eAAe,EAChB,MAAM,mCAAmC,CAAC;AAC3C,OAAO,KAAK,EAAE,qBAAqB,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AACzF,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,4BAA4B,CAAC;AAC7D,OAAO,EACL,KAAK,oBAAoB,EAEzB,KAAK,SAAS,EAEd,KAAK,aAAa,EAClB,KAAK,cAAc,EACnB,KAAK,SAAS,EACd,KAAK,MAAM,EACZ,MAAM,gBAAgB,CAAC;AASxB,OAAO,KAAK,EACV,KAAK,EACL,eAAe,EACf,kBAAkB,EAClB,YAAY,EACZ,qBAAqB,EACrB,gBAAgB,EACjB,MAAM,kBAAkB,CAAC;AAM1B,UAAU,oBAAoB;IAC5B,aAAa,EAAE,SAAS,CAAC;IACzB,mBAAmB,EAAE,SAAS,EAAE,CAAC;IACjC,UAAU,CAAC,EAAE,UAAU,CAAC;IACxB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,eAAe,CAAC,EAAE,oBAAoB,CAAC;IACvC,UAAU,CAAC,EAAE,OAAO,CAAC;CACtB;AAYD,qBAAa,SAAU,YAAW,KAAK;IACrC,QAAQ,CAAC,QAAQ,EAAG,OAAO,CAAU;IACrC,QAAQ,CAAC,IAAI,kBAAkB;IAE/B,OAAO,CAAC,aAAa,CAAC,CAAqB;IAC3C,OAAO,CAAC,YAAY,CAAC,CAAqB;IAC1C,OAAO,CAAC,YAAY,CAAC,CAAoB;IACzC,OAAO,CAAC,YAAY,CAAC,CAAmB;IACxC,OAAO,CAAC,eAAe,CAAC,CAAkB;IAC1C,OAAO,CAAC,YAAY,CAAC,CAAe;IACpC,OAAO,CAAC,qBAAqB,CAAC,CAAwB;gBAGpD,YAAY,CAAC,EAAE,kBAAkB,EACjC,YAAY,CAAC,EAAE,iBAAiB,EAChC,oBAAoB,CAAC,EAAE,0BAA0B,EACjD,YAAY,CAAC,EAAE,gBAAgB,EAC/B,SAAS,CAAC,EAAE,cAAc,EAC1B,MAAM,CAAC,EAAE,MAAM,EACf,eAAe,CAAC,EAAE,eAAe,EACjC,YAAY,CAAC,EAAE,YAAY,EAC3B,qBAAqB,CAAC,EAAE,qBAAqB,EAC7C,aAAa,CAAC,EAAE,OAAO,EACvB,aAAa,CAAC,EAAE,mBAAmB,EACnC,SAAS,CAAC,EAAE,eAAe,EAC3B,uBAAuB,CAAC,EAAE,6BAA6B;IA0BzD,eAAe,IAAI,gBAAgB;IAY7B,cAAc,IAAI,OAAO,CAAC,OAAO,CAAC;YAU1B,aAAa;IAa3B;;;;;;;;;;;;;OAaG;IACG,0BAA0B,CAC9B,SAAS,EAAE,SAAS,EACpB,MAAM,EAAE,MAAM,EACd,MAAM,CAAC,EAAE,MAAM,EACf,cAAc,CAAC,EAAE,cAAc,EAC/B,kBAAkB,CAAC,EAAE,kBAAkB,EACvC,eAAe,CAAC,EAAE,eAAe,EACjC,aAAa,CAAC,EAAE,aAAa,GAC5B,OAAO,CAAC,oBAAoB,CAAC;IAoZhC;;;;;OAKG;YACW,eAAe;IAsB7B;;;OAGG;YACW,sBAAsB;IA6CpC;;;;;;;;;;OAUG;IACG,aAAa,CACjB,SAAS,EAAE,SAAS,EACpB,MAAM,EAAE,MAAM,EACd,MAAM,CAAC,EAAE,MAAM,EACf,cAAc,CAAC,EAAE,cAAc,EAC/B,aAAa,CAAC,EAAE,aAAa,GAC5B,OAAO,CAAC,oBAAoB,CAAC;IAoJhC;;;;;;;;OAQG;IACG,QAAQ,CACZ,SAAS,EAAE,MAAM,EACjB,MAAM,CAAC,EAAE,MAAM,GACd,OAAO,CAAC;QACT,OAAO,EAAE,OAAO,CAAC;QACjB,aAAa,CAAC,EAAE,OAAO,CAAC;YAAE,MAAM,EAAE,MAAM,CAAC;YAAC,MAAM,EAAE,WAAW,GAAG,QAAQ,GAAG,WAAW,CAAA;SAAE,CAAC,CAAC;QAC1F,MAAM,CAAC,EAAE,MAAM,CAAC;KACjB,CAAC;IA2BF;;;;;OAKG;IACH,qBAAqB,CAAC,YAAY,EAAE,cAAc,GAAG,qBAAqB;IAM1E;;;;;;;;;;;;;;;;;;;OAmBG;IACG,oBAAoB,CACxB,SAAS,EAAE,MAAM,EACjB,cAAc,CAAC,EAAE,MAAM,EACvB,qBAAqB,CAAC,EAAE,OAAO,GAC9B,OAAO,CAAC,MAAM,CAAC;CAsCnB"}

package/dist/executor/sdk-handlers/codex/codex-tool.js

@@ -33,7 +33,7 @@ export class CodexTool {
     messagesService;
     tasksService;
     tasksStreamingService;
-    constructor(messagesRepo, sessionsRepo, sessionMCPServerRepo, branchesRepo, reposRepo, apiKey, messagesService, tasksService, tasksStreamingService, useNativeAuth, mcpServerRepo, usersRepo) {
+    constructor(messagesRepo, sessionsRepo, sessionMCPServerRepo, branchesRepo, reposRepo, apiKey, messagesService, tasksService, tasksStreamingService, useNativeAuth, mcpServerRepo, usersRepo, mcpOAuthAuthHeadersRepo) {
         this.messagesRepo = messagesRepo;
         this.sessionsRepo = sessionsRepo;
         this.branchesRepo = branchesRepo;
@@ -41,7 +41,7 @@ export class CodexTool {
         this.tasksService = tasksService;
         this.tasksStreamingService = tasksStreamingService;
         if (messagesRepo && sessionsRepo) {
-            this.promptService = new CodexPromptService(messagesRepo, sessionsRepo, sessionMCPServerRepo, branchesRepo, reposRepo, apiKey, mcpServerRepo, usersRepo, useNativeAuth ?? false, tasksService);
+            this.promptService = new CodexPromptService(messagesRepo, sessionsRepo, sessionMCPServerRepo, branchesRepo, reposRepo, apiKey, mcpServerRepo, usersRepo, useNativeAuth ?? false, tasksService, mcpOAuthAuthHeadersRepo);
         }
     }
     getCapabilities() {

package/dist/executor/sdk-handlers/codex/prompt-service.d.ts

@@ -23,7 +23,7 @@
  * without cleanup. See issue #133.
  */
 import type { ContextUsageSnapshot } from '@agor/core/types';
-import type { BranchRepository, MCPServerRepository, MessagesRepository, RepoRepository, SessionMCPServerRepository, SessionRepository, UsersRepository } from '../../db/feathers-repositories.js';
+import type { BranchRepository, MCPOAuthAuthHeadersRepository, MCPServerRepository, MessagesRepository, RepoRepository, SessionMCPServerRepository, SessionRepository, UsersRepository } from '../../db/feathers-repositories.js';
 import type { TokenUsage } from '../../types/token-usage.js';
 import type { PermissionMode, SessionID, TaskID } from '../../types.js';
 import type { TasksService } from '../base/index.js';
@@ -109,6 +109,7 @@ export declare class CodexPromptService {
     private branchesRepo?;
     private mcpServerRepo?;
     private tasksService?;
+    private mcpOAuthAuthHeadersRepo?;
     private codex?;
     private lastApiKey;
     private lastBaseUrl;
@@ -128,7 +129,7 @@ export declare class CodexPromptService {
      * Logged at DEBUG only (could leak internal hostnames).
      */
     private resolveBaseUrl;
-    constructor(_messagesRepo: MessagesRepository, sessionsRepo: SessionRepository, sessionMCPServerRepo?: SessionMCPServerRepository | undefined, branchesRepo?: BranchRepository | undefined, _reposRepo?: RepoRepository, apiKey?: string, mcpServerRepo?: MCPServerRepository | undefined, _usersRepo?: UsersRepository, useNativeAuth?: boolean, tasksService?: TasksService | undefined);
+    constructor(_messagesRepo: MessagesRepository, sessionsRepo: SessionRepository, sessionMCPServerRepo?: SessionMCPServerRepository | undefined, branchesRepo?: BranchRepository | undefined, _reposRepo?: RepoRepository, apiKey?: string, mcpServerRepo?: MCPServerRepository | undefined, _usersRepo?: UsersRepository, useNativeAuth?: boolean, tasksService?: TasksService | undefined, mcpOAuthAuthHeadersRepo?: MCPOAuthAuthHeadersRepository | undefined);
     /**
      * Delete `agor-codex-instructions-*.md` files in `os.tmpdir()` (and the
      * `~/.agor/tmp` fallback dir) older than 24h. Bounds the disk leak from

package/dist/executor/sdk-handlers/codex/prompt-service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"prompt-service.d.ts","sourceRoot":"","sources":["../../../src/sdk-handlers/codex/prompt-service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAWH,OAAO,KAAK,EAAoB,oBAAoB,EAAe,MAAM,kBAAkB,CAAC;AAI5F,OAAO,KAAK,EACV,gBAAgB,EAChB,mBAAmB,EACnB,kBAAkB,EAClB,cAAc,EACd,0BAA0B,EAC1B,iBAAiB,EACjB,eAAe,EAChB,MAAM,mCAAmC,CAAC;AAC3C,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,4BAA4B,CAAC;AAC7D,OAAO,KAAK,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,EAAU,MAAM,gBAAgB,CAAC;AAEhF,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAsHrD,MAAM,WAAW,iBAAiB;IAChC,6CAA6C;IAC7C,QAAQ,EAAE,KAAK,CAAC;QACd,OAAO,EAAE,KAAK,CAAC;YACb,IAAI,EAAE,MAAM,CAAC;YACb,IAAI,CAAC,EAAE,MAAM,CAAC;YACd,EAAE,CAAC,EAAE,MAAM,CAAC;YACZ,IAAI,CAAC,EAAE,MAAM,CAAC;YACd,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;SACjC,CAAC,CAAC;QACH,QAAQ,CAAC,EAAE,KAAK,CAAC;YACf,EAAE,EAAE,MAAM,CAAC;YACX,IAAI,EAAE,MAAM,CAAC;YACb,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;SAChC,CAAC,CAAC;KACJ,CAAC,CAAC;IACH,6BAA6B;IAC7B,WAAW,EAAE,MAAM,CAAC;IACpB,8BAA8B;IAC9B,YAAY,EAAE,MAAM,CAAC;IACrB,sDAAsD;IACtD,QAAQ,EAAE,MAAM,CAAC;IACjB,uCAAuC;IACvC,UAAU,CAAC,EAAE,UAAU,CAAC;IACxB,kCAAkC;IAClC,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED;;GAEG;AACH,MAAM,MAAM,gBAAgB,GACxB;IACE,IAAI,EAAE,SAAS,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB,GACD;IACE,IAAI,EAAE,YAAY,CAAC;IACnB,OAAO,EAAE;QACP,EAAE,EAAE,MAAM,CAAC;QACX,IAAI,EAAE,MAAM,CAAC;QACb,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;KAChC,CAAC;IACF,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB,GACD;IACE,IAAI,EAAE,eAAe,CAAC;IACtB,OAAO,EAAE;QACP,EAAE,EAAE,MAAM,CAAC;QACX,IAAI,EAAE,MAAM,CAAC;QACb,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAC/B,MAAM,CAAC,EAAE,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;QACjD,MAAM,CAAC,EAAE,MAAM,CAAC;KACjB,CAAC;IACF,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB,GACD;IACE,IAAI,EAAE,SAAS,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB,GACD;IACE,IAAI,EAAE,UAAU,CAAC;IACjB,OAAO,EAAE,KAAK,CAAC;QACb,IAAI,EAAE,MAAM,CAAC;QACb,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,EAAE,CAAC,EAAE,MAAM,CAAC;QACZ,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;KACjC,CAAC,CAAC;IACH,QAAQ,CAAC,EAAE,KAAK,CAAC;QACf,EAAE,EAAE,MAAM,CAAC;QACX,IAAI,EAAE,MAAM,CAAC;QACb,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;KAChC,CAAC,CAAC;IACH,QAAQ,EAAE,MAAM,CAAC;IACjB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,KAAK,CAAC,EAAE,UAAU,CAAC;IACnB,WAAW,CAAC,EAAE,OAAO,0BAA0B,EAAE,gBAAgB,CAAC;IAClE,eAAe,CAAC,EAAE,oBAAoB,CAAC;CACxC,CAAC;AAEN,qBAAa,kBAAkB;IA2B3B,OAAO,CAAC,YAAY;IACpB,OAAO,CAAC,oBAAoB,CAAC;IAC7B,OAAO,CAAC,YAAY,CAAC;IAGrB,OAAO,CAAC,aAAa,CAAC;IAGtB,OAAO,CAAC,YAAY,CAAC;IAlCvB,OAAO,CAAC,KAAK,CAAC,CAAmC;IACjD,OAAO,CAAC,UAAU,CAAuB;IACzC,OAAO,CAAC,WAAW,CAAuB;IAC1C,OAAO,CAAC,qBAAqB,CAAuB;IACpD,OAAO,CAAC,aAAa,CAAiC;IACtD,OAAO,CAAC,MAAM,CAAqB;IACnC,OAAO,CAAC,aAAa,CAAU;IAC/B,OAAO,CAAC,qBAAqB,CAAgC;IAE7D;;;;;;;;;OASG;IACH,OAAO,CAAC,cAAc;gBAMpB,aAAa,EAAE,kBAAkB,EACzB,YAAY,EAAE,iBAAiB,EAC/B,oBAAoB,CAAC,EAAE,0BAA0B,YAAA,EACjD,YAAY,CAAC,EAAE,gBAAgB,YAAA,EACvC,UAAU,CAAC,EAAE,cAAc,EAC3B,MAAM,CAAC,EAAE,MAAM,EACP,aAAa,CAAC,EAAE,mBAAmB,YAAA,EAC3C,UAAU,CAAC,EAAE,eAAe,EAC5B,aAAa,GAAE,OAAe,EACtB,YAAY,CAAC,EAAE,YAAY,YAAA;IA6CrC;;;;OAIG;YACW,2BAA2B;IA6CzC;;;;;;;;;;OAUG;IACH,OAAO,CAAC,iBAAiB;IA0BzB;;;;;;;;;OASG;IACH,OAAO,CAAC,aAAa;IAerB;;;;;;;;;;;OAWG;IACH,OAAO,CAAC,oBAAoB;IAU5B;;;;;;;;OAQG;YACW,iBAAiB;IAuB/B;;;;;OAKG;YACW,gBAAgB;YAmBhB,kBAAkB;IAShC,OAAO,CAAC,cAAc;IAOtB;;;;;;;;;;OAUG;YACW,2BAA2B;IAyBzC;;;;;;;;OAQG;IACH,OAAO,CAAC,kBAAkB;IA0B1B;;;;;;;;;;;;;;;OAeG;YACW,qBAAqB;IAyJnC;;;;OAIG;IACH,OAAO,CAAC,0BAA0B;IAwBlC;;;OAGG;IACH,OAAO,CAAC,aAAa;IA0FrB;;;;;;;OAOG;YACW,uBAAuB;IA2CrC;;;;;;;;;;;;OAYG;IACI,sBAAsB,CAC3B,SAAS,EAAE,SAAS,EACpB,MAAM,EAAE,MAAM,EACd,MAAM,CAAC,EAAE,MAAM,EACf,cAAc,CAAC,EAAE,cAAc,EAC/B,eAAe,CAAC,EAAE,eAAe,GAChC,cAAc,CAAC,gBAAgB,CAAC;IA8enC;;;;;;;;;;OAUG;IACG,aAAa,CACjB,SAAS,EAAE,SAAS,EACpB,MAAM,EAAE,MAAM,EACd,MAAM,CAAC,EAAE,MAAM,EACf,cAAc,CAAC,EAAE,cAAc,GAC9B,OAAO,CAAC,iBAAiB,CAAC;IAyC7B;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,SAAS,EAAE,SAAS,GAAG;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE;IASrE;;;;;;;;;;;;;OAaG;IACG,YAAY,CAAC,SAAS,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC;CA+BxD"}
+{"version":3,"file":"prompt-service.d.ts","sourceRoot":"","sources":["../../../src/sdk-handlers/codex/prompt-service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAWH,OAAO,KAAK,EAAoB,oBAAoB,EAAe,MAAM,kBAAkB,CAAC;AAI5F,OAAO,KAAK,EACV,gBAAgB,EAChB,6BAA6B,EAC7B,mBAAmB,EACnB,kBAAkB,EAClB,cAAc,EACd,0BAA0B,EAC1B,iBAAiB,EACjB,eAAe,EAChB,MAAM,mCAAmC,CAAC;AAC3C,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,4BAA4B,CAAC;AAC7D,OAAO,KAAK,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,EAAU,MAAM,gBAAgB,CAAC;AAEhF,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAsHrD,MAAM,WAAW,iBAAiB;IAChC,6CAA6C;IAC7C,QAAQ,EAAE,KAAK,CAAC;QACd,OAAO,EAAE,KAAK,CAAC;YACb,IAAI,EAAE,MAAM,CAAC;YACb,IAAI,CAAC,EAAE,MAAM,CAAC;YACd,EAAE,CAAC,EAAE,MAAM,CAAC;YACZ,IAAI,CAAC,EAAE,MAAM,CAAC;YACd,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;SACjC,CAAC,CAAC;QACH,QAAQ,CAAC,EAAE,KAAK,CAAC;YACf,EAAE,EAAE,MAAM,CAAC;YACX,IAAI,EAAE,MAAM,CAAC;YACb,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;SAChC,CAAC,CAAC;KACJ,CAAC,CAAC;IACH,6BAA6B;IAC7B,WAAW,EAAE,MAAM,CAAC;IACpB,8BAA8B;IAC9B,YAAY,EAAE,MAAM,CAAC;IACrB,sDAAsD;IACtD,QAAQ,EAAE,MAAM,CAAC;IACjB,uCAAuC;IACvC,UAAU,CAAC,EAAE,UAAU,CAAC;IACxB,kCAAkC;IAClC,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED;;GAEG;AACH,MAAM,MAAM,gBAAgB,GACxB;IACE,IAAI,EAAE,SAAS,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB,GACD;IACE,IAAI,EAAE,YAAY,CAAC;IACnB,OAAO,EAAE;QACP,EAAE,EAAE,MAAM,CAAC;QACX,IAAI,EAAE,MAAM,CAAC;QACb,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;KAChC,CAAC;IACF,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB,GACD;IACE,IAAI,EAAE,eAAe,CAAC;IACtB,OAAO,EAAE;QACP,EAAE,EAAE,MAAM,CAAC;QACX,IAAI,EAAE,MAAM,CAAC;QACb,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAC/B,MAAM,CAAC,EAAE,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;QACjD,MAAM,CAAC,EAAE,MAAM,CAAC;KACjB,CAAC;IACF,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB,GACD;IACE,IAAI,EAAE,SAAS,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB,GACD;IACE,IAAI,EAAE,UAAU,CAAC;IACjB,OAAO,EAAE,KAAK,CAAC;QACb,IAAI,EAAE,MAAM,CAAC;QACb,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,EAAE,CAAC,EAAE,MAAM,CAAC;QACZ,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;KACjC,CAAC,CAAC;IACH,QAAQ,CAAC,EAAE,KAAK,CAAC;QACf,EAAE,EAAE,MAAM,CAAC;QACX,IAAI,EAAE,MAAM,CAAC;QACb,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;KAChC,CAAC,CAAC;IACH,QAAQ,EAAE,MAAM,CAAC;IACjB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,KAAK,CAAC,EAAE,UAAU,CAAC;IACnB,WAAW,CAAC,EAAE,OAAO,0BAA0B,EAAE,gBAAgB,CAAC;IAClE,eAAe,CAAC,EAAE,oBAAoB,CAAC;CACxC,CAAC;AAEN,qBAAa,kBAAkB;IA2B3B,OAAO,CAAC,YAAY;IACpB,OAAO,CAAC,oBAAoB,CAAC;IAC7B,OAAO,CAAC,YAAY,CAAC;IAGrB,OAAO,CAAC,aAAa,CAAC;IAGtB,OAAO,CAAC,YAAY,CAAC;IACrB,OAAO,CAAC,uBAAuB,CAAC;IAnClC,OAAO,CAAC,KAAK,CAAC,CAAmC;IACjD,OAAO,CAAC,UAAU,CAAuB;IACzC,OAAO,CAAC,WAAW,CAAuB;IAC1C,OAAO,CAAC,qBAAqB,CAAuB;IACpD,OAAO,CAAC,aAAa,CAAiC;IACtD,OAAO,CAAC,MAAM,CAAqB;IACnC,OAAO,CAAC,aAAa,CAAU;IAC/B,OAAO,CAAC,qBAAqB,CAAgC;IAE7D;;;;;;;;;OASG;IACH,OAAO,CAAC,cAAc;gBAMpB,aAAa,EAAE,kBAAkB,EACzB,YAAY,EAAE,iBAAiB,EAC/B,oBAAoB,CAAC,EAAE,0BAA0B,YAAA,EACjD,YAAY,CAAC,EAAE,gBAAgB,YAAA,EACvC,UAAU,CAAC,EAAE,cAAc,EAC3B,MAAM,CAAC,EAAE,MAAM,EACP,aAAa,CAAC,EAAE,mBAAmB,YAAA,EAC3C,UAAU,CAAC,EAAE,eAAe,EAC5B,aAAa,GAAE,OAAe,EACtB,YAAY,CAAC,EAAE,YAAY,YAAA,EAC3B,uBAAuB,CAAC,EAAE,6BAA6B,YAAA;IA6CjE;;;;OAIG;YACW,2BAA2B;IA6CzC;;;;;;;;;;OAUG;IACH,OAAO,CAAC,iBAAiB;IA0BzB;;;;;;;;;OASG;IACH,OAAO,CAAC,aAAa;IAerB;;;;;;;;;;;OAWG;IACH,OAAO,CAAC,oBAAoB;IAU5B;;;;;;;;OAQG;YACW,iBAAiB;IAuB/B;;;;;OAKG;YACW,gBAAgB;YAmBhB,kBAAkB;IAShC,OAAO,CAAC,cAAc;IAOtB;;;;;;;;;;OAUG;YACW,2BAA2B;IAyBzC;;;;;;;;OAQG;IACH,OAAO,CAAC,kBAAkB;IA0B1B;;;;;;;;;;;;;;;OAeG;YACW,qBAAqB;IA0JnC;;;;OAIG;IACH,OAAO,CAAC,0BAA0B;IAwBlC;;;OAGG;IACH,OAAO,CAAC,aAAa;IA0FrB;;;;;;;OAOG;YACW,uBAAuB;IA2CrC;;;;;;;;;;;;OAYG;IACI,sBAAsB,CAC3B,SAAS,EAAE,SAAS,EACpB,MAAM,EAAE,MAAM,EACd,MAAM,CAAC,EAAE,MAAM,EACf,cAAc,CAAC,EAAE,cAAc,EAC/B,eAAe,CAAC,EAAE,eAAe,GAChC,cAAc,CAAC,gBAAgB,CAAC;IA+jBnC;;;;;;;;;;OAUG;IACG,aAAa,CACjB,SAAS,EAAE,SAAS,EACpB,MAAM,EAAE,MAAM,EACd,MAAM,CAAC,EAAE,MAAM,EACf,cAAc,CAAC,EAAE,cAAc,GAC9B,OAAO,CAAC,iBAAiB,CAAC;IAyC7B;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,SAAS,EAAE,SAAS,GAAG;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE;IASrE;;;;;;;;;;;;;OAaG;IACG,YAAY,CAAC,SAAS,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC;CA+BxD"}

package/dist/executor/sdk-handlers/codex/prompt-service.js

@@ -136,6 +136,7 @@ export class CodexPromptService {
     branchesRepo;
     mcpServerRepo;
     tasksService;
+    mcpOAuthAuthHeadersRepo;
     codex;
     lastApiKey = null;
     lastBaseUrl = null;
@@ -158,12 +159,13 @@ export class CodexPromptService {
         const raw = process.env.OPENAI_BASE_URL?.trim();
         return raw && raw.length > 0 ? raw : undefined;
     }
-    constructor(_messagesRepo, sessionsRepo, sessionMCPServerRepo, branchesRepo, _reposRepo, apiKey, mcpServerRepo, _usersRepo, useNativeAuth = false, tasksService) {
+    constructor(_messagesRepo, sessionsRepo, sessionMCPServerRepo, branchesRepo, _reposRepo, apiKey, mcpServerRepo, _usersRepo, useNativeAuth = false, tasksService, mcpOAuthAuthHeadersRepo) {
         this.sessionsRepo = sessionsRepo;
         this.sessionMCPServerRepo = sessionMCPServerRepo;
         this.branchesRepo = branchesRepo;
         this.mcpServerRepo = mcpServerRepo;
         this.tasksService = tasksService;
+        this.mcpOAuthAuthHeadersRepo = mcpOAuthAuthHeadersRepo;
         // Store API key from base-executor (already resolved with proper precedence)
         this.apiKey = apiKey || '';
         this.lastApiKey = this.apiKey;
@@ -462,6 +464,7 @@ export class CodexPromptService {
         const serversWithSource = await getMcpServersForSession(sessionId, {
             sessionMCPRepo: this.sessionMCPServerRepo,
             mcpServerRepo: this.mcpServerRepo,
+            mcpOAuthAuthHeadersRepo: this.mcpOAuthAuthHeadersRepo,
             forUserId,
         });
         const mcpServers = serversWithSource.map((s) => s.server);
@@ -903,6 +906,7 @@ export class CodexPromptService {
             let todoIdsEmittedViaUpdate = new Set();
             let latestContextUsage;
             let eventCount = 0;
+            let didStop = false;
             for await (const event of events) {
                 eventCount++;
                 codexDebug(`📨 [Codex] Event ${eventCount}: ${event.type}`);
@@ -910,6 +914,7 @@ export class CodexPromptService {
                 if (this.stopRequested.get(sessionId)) {
                     console.log(`🛑 Stop requested for session ${sessionId}, breaking event loop`);
                     this.stopRequested.delete(sessionId);
+                    didStop = true;
                     // Yield stopped event so caller knows execution was stopped early
                     yield {
                         type: 'stopped',
@@ -918,12 +923,62 @@ export class CodexPromptService {
                     break;
                 }
                 if (event.type === 'event_msg') {
-                    // Codex emits token_count as generic event_msg payloads.
-                    // Capture the latest snapshot so turn.completed can return context usage.
-                    const contextSnapshot = extractCodexContextSnapshotFromEvent(event);
-                    if (contextSnapshot) {
-                        latestContextUsage = contextSnapshot;
+                    const eventPayload = event.payload;
+                    const payloadType = eventPayload?.type;
+                    if (payloadType === 'token_count') {
+                        // Codex emits token_count as generic event_msg payloads.
+                        // Capture the latest snapshot so turn.completed can return context usage.
+                        const contextSnapshot = extractCodexContextSnapshotFromEvent(event);
+                        if (contextSnapshot) {
+                            latestContextUsage = contextSnapshot;
+                        }
+                        continue;
+                    }
+                    if (payloadType === 'agent_message') {
+                        // New Codex rollout format: final assistant text surfaces via event_msg
+                        // rather than an item.completed(agent_message) item.
+                        const text = typeof eventPayload?.content === 'string'
+                            ? eventPayload.content
+                            : typeof eventPayload?.text === 'string'
+                                ? eventPayload.text
+                                : typeof eventPayload?.message === 'string'
+                                    ? eventPayload.message
+                                    : '';
+                        if (text) {
+                            currentMessage.push({ type: 'text', text });
+                        }
+                        continue;
                     }
+                    if (payloadType === 'task_complete' || payloadType === 'turn_complete') {
+                        // Terminal completion event from new Codex rollout format.
+                        // Treat as equivalent to turn.completed.
+                        threadId = thread.id || '';
+                        const taskCompleteUsage = extractCodexTokenUsage((eventPayload?.usage ?? eventPayload?.token_usage));
+                        const contextUsage = latestContextUsage ?? (await extractLatestContextUsageFromRollout(thread.id || ''));
+                        // Synthesize final assistant text from last_agent_message unless
+                        // a preceding agent_message event already pushed the same text.
+                        // This preserves distinct progress/final messages without duplicating.
+                        const lastAgentMessage = typeof eventPayload?.last_agent_message === 'string'
+                            ? eventPayload.last_agent_message
+                            : '';
+                        const hasSameTextContent = currentMessage.some((block) => block.type === 'text' && block.text === lastAgentMessage);
+                        if (lastAgentMessage && !hasSameTextContent) {
+                            currentMessage.push({ type: 'text', text: lastAgentMessage });
+                        }
+                        codexDebug(`✅ [Codex] terminal event_msg (${payloadType}) received for session ${shortId(sessionId)}`);
+                        yield {
+                            type: 'complete',
+                            content: currentMessage,
+                            toolUses: allToolUses.length > 0 ? allToolUses : undefined,
+                            threadId,
+                            resolvedModel,
+                            usage: taskCompleteUsage,
+                            rawContextUsage: contextUsage,
+                        };
+                        return;
+                    }
+                    // Unknown event_msg payload type — ignore silently.
+                    codexDebug(`[Codex] Unknown event_msg payload type: ${String(payloadType)}`);
                     continue;
                 }
                 switch (event.type) {
@@ -1093,6 +1148,15 @@ export class CodexPromptService {
                         break;
                 }
             }
+            // If we reach here without returning, the stream ended.
+            // A user-requested stop is a valid early exit; anything else means Codex
+            // exited without emitting a terminal event (turn.completed / task_complete / turn_complete),
+            // which is the bug described in issue #1749.
+            if (!didStop) {
+                throw new Error('Codex stream ended without a terminal completion event (turn.completed, task_complete, or turn_complete). ' +
+                    'The Codex process may have exited unexpectedly (check the executor logs for exit code 0 clues). ' +
+                    'This is usually resolved by retrying the prompt; if it persists, restart the session.');
+            }
         }
         catch (error) {
             // Check if this is an AbortError from AbortController.abort()

package/dist/executor/sdk-handlers/copilot/copilot-tool.d.ts

@@ -11,7 +11,7 @@
  * - ❌ Session import (deferred)
  * - ❌ Session fork (emulated via new sessions in Phase 2)
  */
-import type { BranchRepository, MCPServerRepository, MessagesRepository, RepoRepository, SessionMCPServerRepository, SessionRepository, UsersRepository } from '../../db/feathers-repositories.js';
+import type { BranchRepository, MCPOAuthAuthHeadersRepository, MCPServerRepository, MessagesRepository, RepoRepository, SessionMCPServerRepository, SessionRepository, UsersRepository } from '../../db/feathers-repositories.js';
 import type { PermissionService } from '../../permissions/permission-service.js';
 import type { NormalizedSdkResponse, RawSdkResponse } from '../../types/sdk-response.js';
 import type { TokenUsage } from '../../types/token-usage.js';
@@ -35,7 +35,7 @@ export declare class CopilotTool implements ITool {
     private sessionsRepo?;
     private messagesService?;
     private tasksService?;
-    constructor(messagesRepo?: MessagesRepository, sessionsRepo?: SessionRepository, sessionMCPServerRepo?: SessionMCPServerRepository, branchesRepo?: BranchRepository, reposRepo?: RepoRepository, apiKey?: string, messagesService?: MessagesService, tasksService?: TasksService, _useNativeAuth?: boolean, mcpServerRepo?: MCPServerRepository, usersRepo?: UsersRepository, permissionService?: PermissionService, sessionsService?: SessionsPatchClient);
+    constructor(messagesRepo?: MessagesRepository, sessionsRepo?: SessionRepository, sessionMCPServerRepo?: SessionMCPServerRepository, branchesRepo?: BranchRepository, reposRepo?: RepoRepository, apiKey?: string, messagesService?: MessagesService, tasksService?: TasksService, _useNativeAuth?: boolean, mcpServerRepo?: MCPServerRepository, usersRepo?: UsersRepository, permissionService?: PermissionService, sessionsService?: SessionsPatchClient, mcpOAuthAuthHeadersRepo?: MCPOAuthAuthHeadersRepository);
     getCapabilities(): ToolCapabilities;
     checkInstalled(): Promise<boolean>;
     /**

package/dist/executor/sdk-handlers/copilot/copilot-tool.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"copilot-tool.d.ts","sourceRoot":"","sources":["../../../src/sdk-handlers/copilot/copilot-tool.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAGH,OAAO,KAAK,EACV,gBAAgB,EAChB,mBAAmB,EACnB,kBAAkB,EAClB,cAAc,EACd,0BAA0B,EAC1B,iBAAiB,EACjB,eAAe,EAChB,MAAM,mCAAmC,CAAC;AAC3C,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,yCAAyC,CAAC;AACjF,OAAO,KAAK,EAAE,qBAAqB,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AACzF,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,4BAA4B,CAAC;AAC7D,OAAO,EAEL,KAAK,SAAS,EAEd,KAAK,aAAa,EAClB,KAAK,cAAc,EACnB,KAAK,SAAS,EACd,KAAK,MAAM,EACZ,MAAM,gBAAgB,CAAC;AACxB,OAAO,KAAK,EACV,KAAK,EACL,eAAe,EACf,mBAAmB,EACnB,kBAAkB,EAClB,YAAY,EACZ,gBAAgB,EACjB,MAAM,kBAAkB,CAAC;AAK1B,UAAU,sBAAsB;IAC9B,aAAa,EAAE,SAAS,CAAC;IACzB,mBAAmB,EAAE,SAAS,EAAE,CAAC;IACjC,UAAU,CAAC,EAAE,UAAU,CAAC;IACxB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,UAAU,CAAC,EAAE,OAAO,CAAC;CACtB;AAED,qBAAa,WAAY,YAAW,KAAK;IACvC,QAAQ,CAAC,QAAQ,EAAG,SAAS,CAAU;IACvC,QAAQ,CAAC,IAAI,oBAAoB;IAEjC,OAAO,CAAC,aAAa,CAAC,CAAuB;IAC7C,OAAO,CAAC,YAAY,CAAC,CAAqB;IAC1C,OAAO,CAAC,YAAY,CAAC,CAAoB;IACzC,OAAO,CAAC,eAAe,CAAC,CAAkB;IAC1C,OAAO,CAAC,YAAY,CAAC,CAAe;gBAGlC,YAAY,CAAC,EAAE,kBAAkB,EACjC,YAAY,CAAC,EAAE,iBAAiB,EAChC,oBAAoB,CAAC,EAAE,0BAA0B,EACjD,YAAY,CAAC,EAAE,gBAAgB,EAC/B,SAAS,CAAC,EAAE,cAAc,EAC1B,MAAM,CAAC,EAAE,MAAM,EACf,eAAe,CAAC,EAAE,eAAe,EACjC,YAAY,CAAC,EAAE,YAAY,EAC3B,cAAc,CAAC,EAAE,OAAO,EACxB,aAAa,CAAC,EAAE,mBAAmB,EACnC,SAAS,CAAC,EAAE,eAAe,EAC3B,iBAAiB,CAAC,EAAE,iBAAiB,EACrC,eAAe,CAAC,EAAE,mBAAmB;IAyBvC,eAAe,IAAI,gBAAgB;IAY7B,cAAc,IAAI,OAAO,CAAC,OAAO,CAAC;IAYxC;;;;;OAKG;IACG,0BAA0B,CAC9B,SAAS,EAAE,SAAS,EACpB,MAAM,EAAE,MAAM,EACd,MAAM,CAAC,EAAE,MAAM,EACf,cAAc,CAAC,EAAE,cAAc,EAC/B,kBAAkB,CAAC,EAAE,kBAAkB,EACvC,eAAe,CAAC,EAAE,eAAe,EACjC,aAAa,CAAC,EAAE,aAAa,GAC5B,OAAO,CAAC,sBAAsB,CAAC;IA4LlC;;;OAGG;YACW,gBAAgB;IAkB9B;;;OAGG;YACW,sBAAsB;IAwCpC;;OAEG;IACG,aAAa,CACjB,SAAS,EAAE,SAAS,EACpB,MAAM,EAAE,MAAM,EACd,MAAM,CAAC,EAAE,MAAM,EACf,cAAc,CAAC,EAAE,cAAc,EAC/B,aAAa,CAAC,EAAE,aAAa,GAC5B,OAAO,CAAC,sBAAsB,CAAC;IAalC;;OAEG;IACG,QAAQ,CACZ,SAAS,EAAE,MAAM,EACjB,MAAM,CAAC,EAAE,MAAM,GACd,OAAO,CAAC;QACT,OAAO,EAAE,OAAO,CAAC;QACjB,aAAa,CAAC,EAAE,OAAO,CAAC;YAAE,MAAM,EAAE,MAAM,CAAC;YAAC,MAAM,EAAE,WAAW,GAAG,QAAQ,GAAG,WAAW,CAAA;SAAE,CAAC,CAAC;QAC1F,MAAM,CAAC,EAAE,MAAM,CAAC;KACjB,CAAC;IA2BF;;;;OAIG;IACH,qBAAqB,CAAC,YAAY,EAAE,cAAc,GAAG,qBAAqB;IAM1E;;;;;OAKG;IACG,oBAAoB,CACxB,SAAS,EAAE,MAAM,EACjB,cAAc,CAAC,EAAE,MAAM,EACvB,qBAAqB,CAAC,EAAE,OAAO,GAC9B,OAAO,CAAC,MAAM,CAAC;CAqBnB"}
+{"version":3,"file":"copilot-tool.d.ts","sourceRoot":"","sources":["../../../src/sdk-handlers/copilot/copilot-tool.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAGH,OAAO,KAAK,EACV,gBAAgB,EAChB,6BAA6B,EAC7B,mBAAmB,EACnB,kBAAkB,EAClB,cAAc,EACd,0BAA0B,EAC1B,iBAAiB,EACjB,eAAe,EAChB,MAAM,mCAAmC,CAAC;AAC3C,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,yCAAyC,CAAC;AACjF,OAAO,KAAK,EAAE,qBAAqB,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AACzF,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,4BAA4B,CAAC;AAC7D,OAAO,EAEL,KAAK,SAAS,EAEd,KAAK,aAAa,EAClB,KAAK,cAAc,EACnB,KAAK,SAAS,EACd,KAAK,MAAM,EACZ,MAAM,gBAAgB,CAAC;AACxB,OAAO,KAAK,EACV,KAAK,EACL,eAAe,EACf,mBAAmB,EACnB,kBAAkB,EAClB,YAAY,EACZ,gBAAgB,EACjB,MAAM,kBAAkB,CAAC;AAK1B,UAAU,sBAAsB;IAC9B,aAAa,EAAE,SAAS,CAAC;IACzB,mBAAmB,EAAE,SAAS,EAAE,CAAC;IACjC,UAAU,CAAC,EAAE,UAAU,CAAC;IACxB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,UAAU,CAAC,EAAE,OAAO,CAAC;CACtB;AAED,qBAAa,WAAY,YAAW,KAAK;IACvC,QAAQ,CAAC,QAAQ,EAAG,SAAS,CAAU;IACvC,QAAQ,CAAC,IAAI,oBAAoB;IAEjC,OAAO,CAAC,aAAa,CAAC,CAAuB;IAC7C,OAAO,CAAC,YAAY,CAAC,CAAqB;IAC1C,OAAO,CAAC,YAAY,CAAC,CAAoB;IACzC,OAAO,CAAC,eAAe,CAAC,CAAkB;IAC1C,OAAO,CAAC,YAAY,CAAC,CAAe;gBAGlC,YAAY,CAAC,EAAE,kBAAkB,EACjC,YAAY,CAAC,EAAE,iBAAiB,EAChC,oBAAoB,CAAC,EAAE,0BAA0B,EACjD,YAAY,CAAC,EAAE,gBAAgB,EAC/B,SAAS,CAAC,EAAE,cAAc,EAC1B,MAAM,CAAC,EAAE,MAAM,EACf,eAAe,CAAC,EAAE,eAAe,EACjC,YAAY,CAAC,EAAE,YAAY,EAC3B,cAAc,CAAC,EAAE,OAAO,EACxB,aAAa,CAAC,EAAE,mBAAmB,EACnC,SAAS,CAAC,EAAE,eAAe,EAC3B,iBAAiB,CAAC,EAAE,iBAAiB,EACrC,eAAe,CAAC,EAAE,mBAAmB,EACrC,uBAAuB,CAAC,EAAE,6BAA6B;IA0BzD,eAAe,IAAI,gBAAgB;IAY7B,cAAc,IAAI,OAAO,CAAC,OAAO,CAAC;IAYxC;;;;;OAKG;IACG,0BAA0B,CAC9B,SAAS,EAAE,SAAS,EACpB,MAAM,EAAE,MAAM,EACd,MAAM,CAAC,EAAE,MAAM,EACf,cAAc,CAAC,EAAE,cAAc,EAC/B,kBAAkB,CAAC,EAAE,kBAAkB,EACvC,eAAe,CAAC,EAAE,eAAe,EACjC,aAAa,CAAC,EAAE,aAAa,GAC5B,OAAO,CAAC,sBAAsB,CAAC;IA4LlC;;;OAGG;YACW,gBAAgB;IAkB9B;;;OAGG;YACW,sBAAsB;IAwCpC;;OAEG;IACG,aAAa,CACjB,SAAS,EAAE,SAAS,EACpB,MAAM,EAAE,MAAM,EACd,MAAM,CAAC,EAAE,MAAM,EACf,cAAc,CAAC,EAAE,cAAc,EAC/B,aAAa,CAAC,EAAE,aAAa,GAC5B,OAAO,CAAC,sBAAsB,CAAC;IAalC;;OAEG;IACG,QAAQ,CACZ,SAAS,EAAE,MAAM,EACjB,MAAM,CAAC,EAAE,MAAM,GACd,OAAO,CAAC;QACT,OAAO,EAAE,OAAO,CAAC;QACjB,aAAa,CAAC,EAAE,OAAO,CAAC;YAAE,MAAM,EAAE,MAAM,CAAC;YAAC,MAAM,EAAE,WAAW,GAAG,QAAQ,GAAG,WAAW,CAAA;SAAE,CAAC,CAAC;QAC1F,MAAM,CAAC,EAAE,MAAM,CAAC;KACjB,CAAC;IA2BF;;;;OAIG;IACH,qBAAqB,CAAC,YAAY,EAAE,cAAc,GAAG,qBAAqB;IAM1E;;;;;OAKG;IACG,oBAAoB,CACxB,SAAS,EAAE,MAAM,EACjB,cAAc,CAAC,EAAE,MAAM,EACvB,qBAAqB,CAAC,EAAE,OAAO,GAC9B,OAAO,CAAC,MAAM,CAAC;CAqBnB"}