auto-model-router 0.35.0 → 0.37.0

package/src/cli/connect.ts

@@ -37,11 +37,12 @@ import { appendFileSync, cpSync, existsSync, mkdirSync, readFileSync, writeFileS
 import { homedir, hostname } from "node:os";
 import { dirname, join, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
-import { refreshAccountOf, remoteFilePath } from "../../omp-extension/remote-logic.ts";
+import { readRemoteRouter, refreshAccountOf, remoteFilePath } from "../../omp-extension/remote-logic.ts";
 import { ORIGIN_ENV, SCOPE_ENV } from "../context/scope.ts";
 import { executablePath, materializePackage, readEmbeddedPackage } from "./embedded.ts";
 import { fetchSkills, installSkills, type SkillsBundle, type SkillsInstallReport, type SkillsTarget } from "./skills.ts";
-import { pickStore, saveRefreshToken, type StoreDeps, type StoreKind } from "./credential-store.ts";
+import { contextAccountOf, pickStore, saveContextToken, saveRefreshToken, type StoreDeps, type StoreKind } from "./credential-store.ts";
+import { ensureContextToken, type ContextToken, type McpAuth } from "./context-token.ts";
 import { flagString, type CliArgs } from "./args.ts";
 import { cursorSnippet, mergeClineProviders, mergeContinueConfig, mergeOpenCodeConfig, windsurfSnippet, type ManualSnippet } from "./harnesses.ts";
 
@@ -80,10 +81,17 @@ export interface ConnectOptions {
 	skills?: SkillsBundle;
 	/**
 	 * The remote's MCP endpoint (a team edition serving shared context): written as the
-	 * `team-context` server for omp and Claude Code with the member key, rewritten on every
-	 * refresh like models.yml. `null` removes an entry a previous connect wrote.
+	 * `team-context` server for omp and Claude Code. `null` removes an entry a previous
+	 * connect wrote.
+	 *
+	 * `token` is the team's **context token** when it mints them (`/setup/info` says
+	 * `mcpAuth: "context-token"`): a year-long credential good for nothing but that member's
+	 * shared context, which is what the entry carries so a key rotation every 72 hours does
+	 * not kill a running MCP client. It is filed in the OS credential store like the refresh
+	 * token, and remote.json records only the store, the expiry and the id. Without one —
+	 * an older team edition — the entry carries the access key exactly as it always did.
 	 */
-	mcp?: { url: string | null };
+	mcp?: { url: string | null; token?: string; tokenExpiresAtMs?: number; tokenId?: string };
 	platform: string;
 	pathHas: (bin: string) => boolean;
 }
@@ -112,9 +120,10 @@ export const MCP_SERVER_NAME = "team-context";
 /**
  * Merges the team-context server into an `mcpServers` JSON file (omp's mcp.json, Claude
  * Code's ~/.claude.json), leaving every other key and server alone; `url` null removes it.
+ * `bearer` is the team's context token when it mints one, else the member's access key.
  * Returns the new text, or null when nothing changes.
  */
-export function mergeMcpServers(before: string, url: string | null, key: string): string | null {
+export function mergeMcpServers(before: string, url: string | null, bearer: string): string | null {
 	let root: Record<string, unknown> = {};
 	if (before.trim() !== "") {
 		try {
@@ -130,7 +139,7 @@ export function mergeMcpServers(before: string, url: string | null, key: string)
 		if (!(MCP_SERVER_NAME in servers)) return null;
 		delete servers[MCP_SERVER_NAME];
 	} else {
-		const next = { type: "http", url, headers: { Authorization: `Bearer ${key}` } };
+		const next = { type: "http", url, headers: { Authorization: `Bearer ${bearer}` } };
 		if (JSON.stringify(servers[MCP_SERVER_NAME]) === JSON.stringify(next)) return null;
 		servers[MCP_SERVER_NAME] = next;
 	}
@@ -315,6 +324,27 @@ export function connectRemote(o: ConnectOptions): ConnectReport {
 		refreshTokenStore = saveRefreshToken(rh, refreshAccount, o.refreshToken, wanted, o.storeDeps ?? { pathHas: o.pathHas });
 		if (refreshTokenStore !== wanted) report.notes.push(`the ${wanted} credential store was not usable; the refresh token is in ${join(rh, "refresh.token")} (owner-readable only)`);
 	} else if (o.refreshToken !== undefined && o.refreshToken !== "") refreshTokenStore = o.store ?? pickStore(o.platform, o.pathHas);
+	// The context token is the other long-lived secret and goes to the same store, in its own
+	// slot. When this connect learned nothing about one (a plain router, or a /setup/info that
+	// did not answer) what the previous remote.json recorded is carried forward rather than
+	// dropped: the store still holds that token, and forgetting it would orphan it for a year.
+	let contextTokenStore: StoreKind | undefined;
+	const contextAccount = contextAccountOf(refreshAccount);
+	const contextToken = o.mcp?.token !== undefined && o.mcp.token !== "" ? o.mcp.token : undefined;
+	if (contextToken !== undefined && !o.dryRun) {
+		const wanted = o.store ?? pickStore(o.platform, o.pathHas);
+		contextTokenStore = saveContextToken(rh, contextAccount, contextToken, wanted, o.storeDeps ?? { pathHas: o.pathHas });
+		if (contextTokenStore !== wanted) report.notes.push(`the ${wanted} credential store was not usable; the shared-context token is in ${join(rh, "context.token")} (owner-readable only)`);
+	} else if (contextToken !== undefined) contextTokenStore = o.store ?? pickStore(o.platform, o.pathHas);
+	const contextFields =
+		contextToken !== undefined
+			? { contextTokenStore: contextTokenStore!, contextAccount, ...(o.mcp?.tokenExpiresAtMs === undefined ? {} : { contextTokenExpiresAtMs: o.mcp.tokenExpiresAtMs }), ...(o.mcp?.tokenId === undefined ? {} : { contextTokenId: o.mcp.tokenId }) }
+			: {
+					...(typeof previous.contextTokenStore === "string" ? { contextTokenStore: previous.contextTokenStore } : {}),
+					...(typeof previous.contextAccount === "string" ? { contextAccount: previous.contextAccount } : {}),
+					...(typeof previous.contextTokenExpiresAtMs === "number" ? { contextTokenExpiresAtMs: previous.contextTokenExpiresAtMs } : {}),
+					...(typeof previous.contextTokenId === "string" ? { contextTokenId: previous.contextTokenId } : {}),
+				};
 	write(
 		report.remoteFile,
 		`${JSON.stringify(
@@ -325,6 +355,7 @@ export function connectRemote(o: ConnectOptions): ConnectReport {
 				name: o.name,
 				joinedAtMs: typeof previous.joinedAtMs === "number" ? previous.joinedAtMs : Date.now(),
 				...(refreshTokenStore !== undefined ? { refreshTokenStore, refreshAccount } : {}),
+				...contextFields,
 				...(o.keyExpiresAtMs !== undefined ? { keyExpiresAtMs: o.keyExpiresAtMs } : {}),
 				...(o.refreshExpiresAtMs !== undefined ? { refreshExpiresAtMs: o.refreshExpiresAtMs } : {}),
 				...(o.device !== undefined && o.device !== "" ? { device: o.device } : {}),
@@ -438,8 +469,10 @@ export function connectRemote(o: ConnectOptions): ConnectReport {
 	}
 
 	// 6c. The remote's MCP endpoint (shared context tools), for the harnesses configured above
-	// that read a user-level mcpServers file; the member key travels in the header and is
-	// rewritten with every refresh, like models.yml.
+	// that read a user-level mcpServers file. The bearer is the team's context token when it
+	// mints one — an MCP client reads its configuration once at startup, so an entry carrying
+	// the 72-hour access key 401s mid-session every few days. Without a context token (an
+	// older team edition) it is the access key, rewritten by every refresh as it always was.
 	if (o.mcp !== undefined) {
 		const files: string[] = [];
 		if (report.configured.some((c) => c.startsWith("omp ("))) files.push(join(agentDir, "mcp.json"));
@@ -447,7 +480,7 @@ export function connectRemote(o: ConnectOptions): ConnectReport {
 		report.mcp = [];
 		for (const path of files) {
 			const before = existsSync(path) ? readFileSync(path, "utf8") : "";
-			const after = mergeMcpServers(before, o.mcp.url, o.key);
+			const after = mergeMcpServers(before, o.mcp.url, contextToken ?? o.key);
 			if (after === null) continue;
 			write(path, after);
 			report.mcp.push(path);
@@ -595,6 +628,14 @@ export interface IssuedCredential {
 	refreshExpiresAtMs?: number;
 	userId: string;
 	name: string;
+	/**
+	 * The team's shared-context credential, when it mints them: handed over with the rest so
+	 * onboarding costs no extra round trip. Absent from an older team edition's answer, and
+	 * then `connect` either mints one at /me/context-tokens or keeps using the access key.
+	 */
+	contextToken?: string;
+	contextTokenExpiresAtMs?: number;
+	contextTokenId?: string;
 }
 
 /**
@@ -615,18 +656,27 @@ export async function exchangeSetupToken(url: string, token: string, device: str
 		...(typeof body.refreshExpiresAtMs === "number" ? { refreshExpiresAtMs: body.refreshExpiresAtMs } : {}),
 		userId: typeof body.userId === "string" ? body.userId : "",
 		name: typeof body.name === "string" ? body.name : "",
+		...(typeof body.contextToken === "string" && body.contextToken !== "" ? { contextToken: body.contextToken } : {}),
+		...(typeof body.contextTokenExpiresAtMs === "number" ? { contextTokenExpiresAtMs: body.contextTokenExpiresAtMs } : {}),
+		...(typeof body.contextTokenId === "string" && body.contextTokenId !== "" ? { contextTokenId: body.contextTokenId } : {}),
 	};
 }
 
-/** What a team edition says about itself at /setup/info; a plain router answers nothing. */
-export async function fetchSetupInfo(url: string, fetchImpl: typeof fetch = fetch): Promise<{ mcp: boolean }> {
+/**
+ * What a team edition says about itself at /setup/info; a plain router answers nothing.
+ *
+ * `mcpAuth` says which credential belongs in the MCP entry. It is `member-key` whenever the
+ * field is missing — a team edition older than context tokens, a plain router, an
+ * unreachable remote — so nothing about those deployments changes.
+ */
+export async function fetchSetupInfo(url: string, fetchImpl: typeof fetch = fetch): Promise<{ mcp: boolean; mcpAuth: McpAuth }> {
 	try {
 		const res = await fetchImpl(`${url}/setup/info`, { signal: AbortSignal.timeout(10_000) });
-		if (!res.ok) return { mcp: false };
-		const body = (await res.json()) as { mcp?: unknown };
-		return { mcp: body.mcp === true };
+		if (!res.ok) return { mcp: false, mcpAuth: "member-key" };
+		const body = (await res.json()) as { mcp?: unknown; mcpAuth?: unknown };
+		return { mcp: body.mcp === true, mcpAuth: body.mcpAuth === "context-token" ? "context-token" : "member-key" };
 	} catch {
-		return { mcp: false };
+		return { mcp: false, mcpAuth: "member-key" };
 	}
 }
 
@@ -666,6 +716,8 @@ export async function connectCommand(args: CliArgs): Promise<void> {
 	let refreshToken = flagString(args, "refresh-token") ?? "";
 	let keyExpires = Number.parseInt(flagString(args, "key-expires") ?? "", 10);
 	let refreshExpires = Number.parseInt(flagString(args, "refresh-expires") ?? "", 10);
+	// The team's shared-context credential, when the exchange hands one over.
+	let issuedContext: ContextToken | undefined;
 	if (setupToken !== "") {
 		if (device === "") device = hostname();
 		const issued = await exchangeSetupToken(url, setupToken, device);
@@ -675,6 +727,12 @@ export async function connectCommand(args: CliArgs): Promise<void> {
 		refreshExpires = issued.refreshExpiresAtMs ?? Number.NaN;
 		if (issued.userId !== "") userId = issued.userId;
 		if (issued.name !== "") name = issued.name;
+		if (issued.contextToken !== undefined)
+			issuedContext = {
+				value: issued.contextToken,
+				...(issued.contextTokenExpiresAtMs === undefined ? {} : { expiresAtMs: issued.contextTokenExpiresAtMs }),
+				...(issued.contextTokenId === undefined ? {} : { id: issued.contextTokenId }),
+			};
 		console.log(`credential issued for ${name === "" ? userId : name} (device ${device})`);
 	}
 	// Verify the key against the route every router serves before touching anything.
@@ -694,6 +752,17 @@ export async function connectCommand(args: CliArgs): Promise<void> {
 	const skills = await fetchSkills(url, key, fetchImpl);
 	// Its shared-context MCP endpoint, when it is a team edition serving one.
 	const info = await fetchSetupInfo(url, fetchImpl);
+	// The credential that entry carries. A setup token's exchange hands one over; a credential
+	// given with --key has no exchange, so one is minted at /me/context-tokens with the key —
+	// both paths end up with a year-long token instead of the 72-hour access key. A machine
+	// that already holds one keeps it (see ensureContextToken), so re-running connect does not
+	// leave a trail of tokens in the member's portal.
+	const rh = expand(process.env.AUTO_MODEL_ROUTER_HOME ?? join(home, ".auto-model-router"), home);
+	const contextToken =
+		info.mcp && info.mcpAuth === "context-token"
+			? await ensureContextToken({ url, key, mcpAuth: info.mcpAuth, routerHome: rh, remote: readRemoteRouter(rh), issued: issuedContext, name: device === "" ? hostname() : device, fetchImpl, mint: !args.flags.has("dry-run") })
+			: null;
+	if (contextToken !== null) console.log(`shared context uses a context token (${contextToken.id ?? "new"}), not the access key: a key rotation no longer restarts your MCP client`);
 	const report = connectRemote({
 		url,
 		key,
@@ -714,7 +783,10 @@ export async function connectCommand(args: CliArgs): Promise<void> {
 		...(device === "" ? {} : { device }),
 		...(exePath === null ? {} : { exePath }),
 		...(skills.bundle === null ? {} : { skills: skills.bundle }),
-		mcp: { url: info.mcp ? `${url}/mcp` : null },
+		mcp: {
+			url: info.mcp ? `${url}/mcp` : null,
+			...(contextToken === null ? {} : { token: contextToken.value, ...(contextToken.expiresAtMs === undefined ? {} : { tokenExpiresAtMs: contextToken.expiresAtMs }), ...(contextToken.id === undefined ? {} : { tokenId: contextToken.id }) }),
+		},
 	});
 	if (skills.note !== undefined) report.notes.push(skills.note);
 	if (exePath !== null) console.log(`executable ${exePath}; package files under ${packageDir}`);

package/src/cli/context-token.ts

@@ -0,0 +1,133 @@
+/**
+ * The team edition's **context token** — the credential the `team-context` MCP
+ * server holds.
+ *
+ * An MCP client substitutes its configuration ONCE, at startup. A member access
+ * key is short-lived (the team edition rotates it roughly every 72 hours), so a
+ * `team-context` entry carrying the access key dies mid-session every few days
+ * with a 401 that reads to the member as "re-authorise". The team edition
+ * therefore mints a second credential, `amrctx_…`, that lasts a year and can do
+ * exactly one thing: read and write that member's shared project context. It is
+ * refused on turns, on the admin API, on the portal and on SCIM.
+ *
+ * This module is the router's side of that:
+ *
+ *   - `/setup/info` says `mcpAuth: "context-token"` when the team mints them.
+ *     A team edition that predates them says `"member-key"` or nothing at all,
+ *     and then everything below is skipped and the MCP entry keeps the access
+ *     key exactly as before.
+ *   - `/setup/exchange` hands one over beside the credential, so onboarding
+ *     costs no extra round trip.
+ *   - `POST /me/context-tokens {name}` mints one with the member key, for the
+ *     paths that have no exchange: `connect --key`, and a refresh whose token
+ *     is missing or close to expiry. The team binds it to the CALLING device,
+ *     so revoking the machine revokes the token with it.
+ *
+ * The token is a long-lived secret and goes where the refresh token goes: the
+ * OS credential store, in its own slot (see credential-store.ts). remote.json
+ * records only which store holds it, its expiry and its id.
+ */
+
+import { contextAccountOf, loadContextToken, type StoreDeps } from "./credential-store.ts";
+import { refreshAccountOf, type RemoteRouter } from "../../omp-extension/remote-logic.ts";
+
+/** What `/setup/info` says belongs in the MCP entry. Absent ⇒ `member-key`: an older team edition is unaffected. */
+export type McpAuth = "context-token" | "member-key";
+
+/** A context token and what is known about it. */
+export interface ContextToken {
+	value: string;
+	expiresAtMs?: number;
+	id?: string;
+}
+
+/**
+ * How close to expiry a context token is renewed. A year long and renewed with
+ * a month to spare: a machine that connects once a month never carries a dead
+ * one, and a machine used daily still renews only twelve times a year.
+ */
+export const CONTEXT_TOKEN_RENEW_AHEAD_MS = 30 * 24 * 3_600_000;
+
+/** The token this machine already holds, read out of the store remote.json names. */
+export function storedContextToken(remote: RemoteRouter, routerHome: string, storeDeps: StoreDeps = {}): ContextToken | null {
+	if (remote.contextTokenStore === undefined) return null;
+	const account = remote.contextAccount ?? contextAccountOf(remote.refreshAccount ?? refreshAccountOf(remote.url, remote.userId));
+	const value = loadContextToken(routerHome, account, remote.contextTokenStore, storeDeps);
+	if (value === null || value === "") return null;
+	return {
+		value,
+		...(remote.contextTokenExpiresAtMs === undefined ? {} : { expiresAtMs: remote.contextTokenExpiresAtMs }),
+		...(remote.contextTokenId === undefined ? {} : { id: remote.contextTokenId }),
+	};
+}
+
+/** True when a held token should be replaced: no expiry recorded, or inside the renewal window. */
+export function dueForRenewal(token: ContextToken | null, nowMs = Date.now()): boolean {
+	if (token === null || token.value === "") return true;
+	// An expiry we never learned is an expiry we cannot trust; minting records one, so this converges.
+	if (token.expiresAtMs === undefined) return true;
+	return token.expiresAtMs - nowMs <= CONTEXT_TOKEN_RENEW_AHEAD_MS;
+}
+
+/**
+ * Mints one with the member key. Returns null on anything unexpected — an older
+ * team edition answers 404, a deployment that does not issue them answers 503 —
+ * and the caller then falls back to what it holds, or to the access key.
+ */
+export async function mintContextToken(url: string, key: string, name: string, fetchImpl: typeof fetch = fetch): Promise<ContextToken | null> {
+	try {
+		const res = await fetchImpl(`${url}/me/context-tokens`, {
+			method: "POST",
+			headers: { authorization: `Bearer ${key}`, "content-type": "application/json" },
+			body: JSON.stringify({ name }),
+			signal: AbortSignal.timeout(15_000),
+		});
+		if (!res.ok) return null;
+		const body = (await res.json().catch(() => null)) as { token?: unknown; id?: unknown; expiresAtMs?: unknown } | null;
+		if (body === null || typeof body.token !== "string" || body.token === "") return null;
+		return {
+			value: body.token,
+			...(typeof body.expiresAtMs === "number" ? { expiresAtMs: body.expiresAtMs } : {}),
+			...(typeof body.id === "string" && body.id !== "" ? { id: body.id } : {}),
+		};
+	} catch {
+		return null;
+	}
+}
+
+export interface EnsureContextTokenOptions {
+	url: string;
+	/** A member key good right now: the one just issued, or just refreshed. */
+	key: string;
+	mcpAuth: McpAuth;
+	routerHome: string;
+	/** What this machine already recorded, when it has connected before. */
+	remote?: RemoteRouter | null;
+	/** One the setup exchange just handed over; it wins, and nothing is minted. */
+	issued?: ContextToken | undefined;
+	/** What the team should call it — the device name, so the member recognises it in the portal. */
+	name: string;
+	/** False on a dry run: report what is held, but never mint — a rehearsal must not leave a credential behind at the team. */
+	mint?: boolean;
+	fetchImpl?: typeof fetch;
+	storeDeps?: StoreDeps;
+	nowMs?: number;
+}
+
+/**
+ * The token the MCP entry should carry, or null to keep using the access key.
+ *
+ * Never mints when one that is held is still far from expiry: that is the whole
+ * point — a refresh every three days must leave the MCP configuration alone.
+ */
+export async function ensureContextToken(o: EnsureContextTokenOptions): Promise<ContextToken | null> {
+	if (o.mcpAuth !== "context-token") return null;
+	if (o.issued !== undefined && o.issued.value !== "") return o.issued;
+	const held = o.remote === undefined || o.remote === null ? null : storedContextToken(o.remote, o.routerHome, o.storeDeps ?? {});
+	if (!dueForRenewal(held, o.nowMs ?? Date.now())) return held;
+	if (o.mint === false) return held;
+	const minted = await mintContextToken(o.url, o.key, o.name, o.fetchImpl ?? fetch);
+	// A mint that fails leaves what we hold in place: a token good for another day
+	// beats none, and none beats breaking a member's context tools over a hiccup.
+	return minted ?? held;
+}

package/src/cli/credential-store.ts

@@ -20,6 +20,14 @@
  * account name; it never holds the token itself once a store other than
  * `file` is in use. A remote.json written before this existed may still carry
  * the token inline; reading honours that until the next refresh moves it.
+ *
+ * The team edition's CONTEXT TOKEN (`amrctx_…`, a year long, good for nothing
+ * but that member's shared project context) is the same kind of secret and
+ * gets the same treatment, in its own slot: its own account name
+ * (`<refresh account>#context`) in the OS store, its own `context.token` /
+ * `context.dpapi` beside the refresh token's files, and its own names in
+ * remote.json (`contextTokenStore`, `contextAccount`). One slot never
+ * overwrites the other, and revoking one leaves the other alone.
  */
 
 import { spawnSync } from "node:child_process";
@@ -60,8 +68,14 @@ function dpapiUnprotect(blob: string, pathHas: (bin: string) => boolean): string
 	return r.stdout.replace(/\r?\n$/, "");
 }
 
-const filePath = (routerHome: string): string => join(routerHome, "refresh.token");
-const dpapiPath = (routerHome: string): string => join(routerHome, "refresh.dpapi");
+/** Which secret is being stored: they share the machinery and share nothing else. */
+export type SecretSlot = "refresh" | "context";
+
+const filePath = (routerHome: string, slot: SecretSlot = "refresh"): string => join(routerHome, slot === "refresh" ? "refresh.token" : "context.token");
+const dpapiPath = (routerHome: string, slot: SecretSlot = "refresh"): string => join(routerHome, slot === "refresh" ? "refresh.dpapi" : "context.dpapi");
+
+/** The store account a member's context token is filed under, derived from the refresh token's. */
+export const contextAccountOf = (refreshAccount: string): string => `${refreshAccount}#context`;
 
 export interface StoreDeps {
 	pathHas?: (bin: string) => boolean;
@@ -70,11 +84,12 @@ export interface StoreDeps {
 }
 
 /**
- * Saves the refresh token and returns the store that took it. A store that
- * fails (keychain locked, tool missing) falls back to the file, so a member is
- * never left without a refresh token; the caller records what was used.
+ * Saves a secret in the slot named and returns the store that took it. A store
+ * that fails (keychain locked, tool missing) falls back to the file, so a
+ * member is never left without their credential; the caller records what was
+ * used.
  */
-export function saveRefreshToken(routerHome: string, account: string, secret: string, kind: StoreKind, deps: StoreDeps = {}): StoreKind {
+export function saveSecret(routerHome: string, account: string, secret: string, kind: StoreKind, slot: SecretSlot, deps: StoreDeps = {}): StoreKind {
 	const pathHas = deps.pathHas ?? ((bin) => Bun.which(bin) !== null);
 	mkdirSync(routerHome, { recursive: true });
 	try {
@@ -84,19 +99,19 @@ export function saveRefreshToken(routerHome: string, account: string, secret: st
 		}
 		switch (kind) {
 			case "dpapi":
-				writeFileSync(dpapiPath(routerHome), `${dpapiProtect(secret, pathHas)}\n`, { encoding: "utf8", mode: 0o600 });
-				rmSync(filePath(routerHome), { force: true });
+				writeFileSync(dpapiPath(routerHome, slot), `${dpapiProtect(secret, pathHas)}\n`, { encoding: "utf8", mode: 0o600 });
+				rmSync(filePath(routerHome, slot), { force: true });
 				return "dpapi";
 			case "keychain": {
 				const r = spawnSync("security", ["add-generic-password", "-U", "-a", account, "-s", SERVICE, "-w", secret], { encoding: "utf8" });
 				if (r.status !== 0) throw new Error(r.stderr.trim());
-				rmSync(filePath(routerHome), { force: true });
+				rmSync(filePath(routerHome, slot), { force: true });
 				return "keychain";
 			}
 			case "secret-service": {
 				const r = spawnSync("secret-tool", ["store", `--label=${SERVICE} ${account}`, "service", SERVICE, "account", account], { encoding: "utf8", input: secret });
 				if (r.status !== 0) throw new Error(r.stderr.trim());
-				rmSync(filePath(routerHome), { force: true });
+				rmSync(filePath(routerHome, slot), { force: true });
 				return "secret-service";
 			}
 			case "file":
@@ -105,23 +120,33 @@ export function saveRefreshToken(routerHome: string, account: string, secret: st
 	} catch {
 		// fall through to the file
 	}
-	writeFileSync(filePath(routerHome), `${secret}\n`, { encoding: "utf8", mode: 0o600 });
+	writeFileSync(filePath(routerHome, slot), `${secret}\n`, { encoding: "utf8", mode: 0o600 });
 	try {
-		chmodSync(filePath(routerHome), 0o600);
+		chmodSync(filePath(routerHome, slot), 0o600);
 	} catch {
 		/* Windows */
 	}
 	return "file";
 }
 
-/** The refresh token from the store `remote.json` names, or null when it is gone. */
-export function loadRefreshToken(routerHome: string, account: string, kind: StoreKind, deps: StoreDeps = {}): string | null {
+/** Saves the refresh token; see saveSecret. */
+export function saveRefreshToken(routerHome: string, account: string, secret: string, kind: StoreKind, deps: StoreDeps = {}): StoreKind {
+	return saveSecret(routerHome, account, secret, kind, "refresh", deps);
+}
+
+/** Saves the team's long-lived context token, in its own slot. */
+export function saveContextToken(routerHome: string, account: string, secret: string, kind: StoreKind, deps: StoreDeps = {}): StoreKind {
+	return saveSecret(routerHome, account, secret, kind, "context", deps);
+}
+
+/** The secret in that slot from the store `remote.json` names, or null when it is gone. */
+export function loadSecret(routerHome: string, account: string, kind: StoreKind, slot: SecretSlot, deps: StoreDeps = {}): string | null {
 	const pathHas = deps.pathHas ?? ((bin) => Bun.which(bin) !== null);
 	try {
 		if (deps.backend !== undefined) return deps.backend.load(account);
 		switch (kind) {
 			case "dpapi": {
-				const p = dpapiPath(routerHome);
+				const p = dpapiPath(routerHome, slot);
 				if (!existsSync(p)) return null;
 				return dpapiUnprotect(readFileSync(p, "utf8").trim(), pathHas);
 			}
@@ -134,7 +159,7 @@ export function loadRefreshToken(routerHome: string, account: string, kind: Stor
 				return r.status === 0 && r.stdout !== "" ? r.stdout.replace(/\r?\n$/, "") : null;
 			}
 			case "file": {
-				const p = filePath(routerHome);
+				const p = filePath(routerHome, slot);
 				return existsSync(p) ? readFileSync(p, "utf8").trim() : null;
 			}
 		}
@@ -144,10 +169,20 @@ export function loadRefreshToken(routerHome: string, account: string, kind: Stor
 	return null;
 }
 
-/** Forgets the token everywhere it might be. */
-export function removeRefreshToken(routerHome: string, account: string, deps: StoreDeps = {}): void {
-	rmSync(filePath(routerHome), { force: true });
-	rmSync(dpapiPath(routerHome), { force: true });
+/** The refresh token from the store `remote.json` names, or null when it is gone. */
+export function loadRefreshToken(routerHome: string, account: string, kind: StoreKind, deps: StoreDeps = {}): string | null {
+	return loadSecret(routerHome, account, kind, "refresh", deps);
+}
+
+/** The context token from the store `remote.json` names, or null when it is gone. */
+export function loadContextToken(routerHome: string, account: string, kind: StoreKind, deps: StoreDeps = {}): string | null {
+	return loadSecret(routerHome, account, kind, "context", deps);
+}
+
+/** Forgets the secret in that slot everywhere it might be. */
+export function removeSecret(routerHome: string, account: string, slot: SecretSlot, deps: StoreDeps = {}): void {
+	rmSync(filePath(routerHome, slot), { force: true });
+	rmSync(dpapiPath(routerHome, slot), { force: true });
 	if (deps.backend !== undefined) {
 		deps.backend.remove(account);
 		return;
@@ -155,3 +190,13 @@ export function removeRefreshToken(routerHome: string, account: string, deps: St
 	if (process.platform === "darwin") spawnSync("security", ["delete-generic-password", "-a", account, "-s", SERVICE], { encoding: "utf8" });
 	if (process.platform === "linux") spawnSync("secret-tool", ["clear", "service", SERVICE, "account", account], { encoding: "utf8" });
 }
+
+/** Forgets the refresh token everywhere it might be. */
+export function removeRefreshToken(routerHome: string, account: string, deps: StoreDeps = {}): void {
+	removeSecret(routerHome, account, "refresh", deps);
+}
+
+/** Forgets the context token everywhere it might be. */
+export function removeContextToken(routerHome: string, account: string, deps: StoreDeps = {}): void {
+	removeSecret(routerHome, account, "context", deps);
+}

package/src/cli/refresh.ts

@@ -11,6 +11,11 @@
  *
  * A refresh a day early costs nothing: the remote keeps the old key valid until
  * its own expiry, so a session still holding it is never cut.
+ *
+ * One thing a refresh deliberately does NOT rewrite: the `team-context` MCP
+ * entry, when the team edition mints context tokens. See context-token.ts —
+ * an MCP client substitutes its configuration once at startup, so a fresh key
+ * written there every three days is a 401 mid-session, not an update.
  */
 
 import { executablePath, materializePackage, readEmbeddedPackage } from "./embedded.ts";
@@ -21,6 +26,7 @@ import { dirname, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 import { hasRefresh, readRemoteRouter, refreshAccountOf, type RemoteRouter } from "../../omp-extension/remote-logic.ts";
 import { loadRefreshToken, type StoreDeps } from "./credential-store.ts";
+import { ensureContextToken } from "./context-token.ts";
 import { routerHome } from "../../omp-extension/router-url.ts";
 import type { CliArgs } from "./args.ts";
 import { connectRemote } from "./connect.ts";
@@ -101,6 +107,22 @@ export async function refreshAndRewrite(opts: { remote: RemoteRouter; fetchImpl?
 	// A refresh is when the team's skills reach a machine that has not re-run connect.
 	const skills = await fetchSkills(opts.remote.url, fresh.key, opts.fetchImpl ?? fetch);
 	const info = await fetchSetupInfo(opts.remote.url, opts.fetchImpl ?? fetch);
+	// The MCP entry must NOT take the new access key: an MCP client reads its configuration
+	// once, at startup, so rewriting the entry every 72 hours is what makes the context tools
+	// die mid-session. The team's context token is held for a year and reused here untouched;
+	// it is minted (or renewed) only when there is none or it is within a month of expiring.
+	const context = info.mcp
+		? await ensureContextToken({
+				url: opts.remote.url,
+				key: fresh.key,
+				mcpAuth: info.mcpAuth,
+				routerHome: rh,
+				remote: opts.remote,
+				name: fresh.device ?? opts.remote.device ?? "this machine",
+				fetchImpl: opts.fetchImpl ?? fetch,
+				...(opts.storeDeps === undefined ? {} : { storeDeps: opts.storeDeps }),
+			})
+		: null;
 	connectRemote({
 		url: opts.remote.url,
 		key: fresh.key,
@@ -123,7 +145,10 @@ export async function refreshAndRewrite(opts: { remote: RemoteRouter; fetchImpl?
 		...(opts.storeDeps !== undefined ? { storeDeps: opts.storeDeps } : {}),
 		...(exePath !== undefined ? { exePath } : {}),
 		...(skills.bundle === null ? {} : { skills: skills.bundle }),
-		mcp: { url: info.mcp ? `${opts.remote.url}/mcp` : null },
+		mcp: {
+			url: info.mcp ? `${opts.remote.url}/mcp` : null,
+			...(context === null ? {} : { token: context.value, ...(context.expiresAtMs === undefined ? {} : { tokenExpiresAtMs: context.expiresAtMs }), ...(context.id === undefined ? {} : { tokenId: context.id }) }),
+		},
 		// undefined keeps whatever scope the managed models.yml block already carries.
 	});
 	return fresh;

package/src/config/defaults.ts

@@ -105,6 +105,7 @@ export const DEFAULT_CONFIG: RouterConfig = {
 	filters: {
 		allow: [],
 		deny: [],
+		providerLocks: {},
 		// Free models are rate-limited hard enough that retries cost more than they save.
 		includeFree: false,
 		requireToolSupport: true,

package/src/config/schema.ts

@@ -1,5 +1,6 @@
 import { z } from "zod";
 import { MAX_REDACTION_RULES, validateRedactionRule } from "./redaction.ts";
+import { MAX_EXTRA_SCORES } from "../catalog/benchmark-feeds.ts";
 
 /**
  * Input schema for `$AUTO_MODEL_ROUTER_HOME/config.yml`: a deep partial of
@@ -99,6 +100,26 @@ const upstream = z.strictObject({
 	models: z.array(upstreamModel),
 });
 
+const axisScore = z.number().min(0).max(100).optional();
+
+/**
+ * One `benchmarks.extraScores` row, as a config FILE may write it. Strict here
+ * on purpose: a typo in a file the operator edits is an error they want told,
+ * exactly like every other key. The same rows arriving over `reconfigure` from a
+ * front door skip this schema and are sanitised at use instead (`suppliedScores`),
+ * where a bad row is dropped with a warning rather than failing the whole patch.
+ */
+const extraScore = z.strictObject({
+	key: z.string().min(1),
+	// Only ever a tie-break between two rows sharing a key; absent is normal.
+	creator: z.string().default(""),
+	coding: axisScore,
+	intelligence: axisScore,
+	agentic: axisScore,
+	// Config supplies provenance; it may not claim a fetched feed or the local lane.
+	source: z.enum(["neutral", "vendor"]),
+});
+
 const benchmarks = z.strictObject({
 	enabled: z.boolean().optional(),
 	artificialAnalysisApiKey: z.string().optional(),
@@ -106,6 +127,7 @@ const benchmarks = z.strictObject({
 	refreshMs: z.number().nonnegative().optional(),
 	timeoutMs: z.number().positive().optional(),
 	useLocalScores: z.boolean().optional(),
+	extraScores: z.array(extraScore).max(MAX_EXTRA_SCORES).optional(),
 });
 
 const tierConfig = z.strictObject({