elanous 0.2.22 → 0.2.23

package/src/loops/budget.ts

@@ -1,4 +1,61 @@
 import { ORCHESTRATOR_DEFAULTS, type OrchestratorSeat } from '../user-config.js';
+import type { ChecklistItem } from '../release-loop/checklist.js';
+import type { TrafficCell, TrafficProcess, TrafficResult, TrafficSeatRow } from './orchestrator/traffic.js';
+
+const RESOURCE_SEATS: readonly OrchestratorSeat[] = ['OP', 'TC', 'MK', 'UX'];
+
+type WorkCell = Pick<ChecklistItem, 'owner' | 'status'>;
+
+/** Allocate whole base slots by remaining work; this calculation does not decide launches. */
+export function calculateSeatBaseShares({ totalSlots, currentRound, nextRound, seatCaps }: {
+  totalSlots: number;
+  currentRound: readonly WorkCell[];
+  nextRound: readonly WorkCell[];
+  seatCaps: Readonly<Record<OrchestratorSeat, number>>;
+}): Record<OrchestratorSeat, number> {
+  if (!Number.isSafeInteger(totalSlots) || totalSlots < 0 ||
+    RESOURCE_SEATS.some(seat => !Number.isSafeInteger(seatCaps[seat]) || seatCaps[seat] < 0)) {
+    throw new RangeError('totalSlots and seatCaps must be nonnegative safe integers');
+  }
+  const shares: Record<OrchestratorSeat, number> = { OP: 0, TC: 0, MK: 0, UX: 0 };
+  const weights: Record<OrchestratorSeat, number> = { OP: 0, TC: 0, MK: 0, UX: 0 };
+  for (const [cells, weight] of [[currentRound, 2], [nextRound, 1]] as const) {
+    for (const cell of cells) {
+      if (cell.status !== 'yellow') continue;
+      const seat = cell.owner?.split('/')[0];
+      if (RESOURCE_SEATS.some(id => id === seat)) weights[seat as OrchestratorSeat] += weight;
+    }
+  }
+
+  let available = Math.min(totalSlots, RESOURCE_SEATS.reduce((sum, seat) => sum + seatCaps[seat], 0));
+  let eligible = RESOURCE_SEATS.filter(seat => weights[seat] > 0 && seatCaps[seat] > 0);
+  while (available > 0 && eligible.length > 0) {
+    const totalWeight = eligible.reduce((sum, seat) => sum + weights[seat], 0);
+    const ideal = (seat: OrchestratorSeat) => available * weights[seat] / totalWeight;
+    const capped = eligible.filter(seat => ideal(seat) >= seatCaps[seat]);
+    if (capped.length > 0) {
+      for (const seat of capped) {
+        shares[seat] = seatCaps[seat];
+        available -= seatCaps[seat];
+      }
+      eligible = eligible.filter(seat => !capped.includes(seat));
+      continue;
+    }
+    const remainders = eligible.map(seat => ({ seat, exact: ideal(seat) }));
+    for (const { seat, exact } of remainders) {
+      shares[seat] = Math.floor(exact);
+      available -= shares[seat];
+    }
+    remainders.sort((a, b) => (b.exact - Math.floor(b.exact)) - (a.exact - Math.floor(a.exact)));
+    for (const { seat } of remainders) {
+      if (available === 0) break;
+      shares[seat]++;
+      available--;
+    }
+    break;
+  }
+  return shares;
+}
 
 export interface SpawnBudgetInput {
   seat: OrchestratorSeat;
@@ -97,3 +154,96 @@ export function seatCapExclusion(subject: SeatCapSubject, now: number,
   if (idle !== null && now - subject.progressAt! >= staleRunMinutes * 60_000) return { reason: 'stale', idleMin: idle };
   return null;
 }
+
+/** Only harness ask/say launches occupy ORCH traffic seats. */
+export const isTrafficLaunch = (command: string): boolean =>
+  /(?:^|\s)(?:\S*\/)?elanous\.mjs\s+(?:(?:--test|--config-dir\s+\S+)\s+)?harness\s+(?:ask|say)(?=\s|$)/.test(command);
+
+/** ORCH traffic supplies a physical cap, which can exceed the default spawn release gate. */
+function decideTrafficLaunch(row: TrafficSeatRow): boolean {
+  return decideSpawn({ seat: row.seat, running: row.running, caps: { [row.seat]: row.cap },
+    gate: { [row.seat]: row.cap }, injectedCap: row.launchCap }).allow;
+}
+
+/** Process-to-seat resolution occurs at the boundary; this decision does no IO. */
+export function budgetTrafficTick({ processes, now, caps, lastLaunchAt, idleSince, openCells, nextRound, totalSlots, idleMinutes = 30, retainQueuedCells = false }: {
+  processes: readonly TrafficProcess[];
+  now: Date;
+  caps: Readonly<Record<OrchestratorSeat, number>>;
+  lastLaunchAt?: Partial<Record<OrchestratorSeat, Date | null>>;
+  idleSince?: Partial<Record<OrchestratorSeat, Date | null>>;
+  openCells: readonly TrafficCell[];
+  nextRound?: readonly TrafficCell[];
+  totalSlots?: number;
+  idleMinutes?: number;
+  /** Observation only: expose queued work even when no launch has been observed yet. */
+  retainQueuedCells?: boolean;
+}): TrafficResult {
+  const launches = processes.filter(process => isTrafficLaunch(process.command));
+  const slotBudget = totalSlots ?? RESOURCE_SEATS.reduce((sum, seat) => sum + caps[seat], 0);
+  // A missing next round is unknown, not an empty round with zero remaining work.
+  const baseShares = nextRound === undefined ? null : calculateSeatBaseShares({
+    totalSlots: slotBudget, currentRound: openCells, nextRound, seatCaps: caps,
+  });
+  const seats = RESOURCE_SEATS.map((seat): TrafficSeatRow => {
+    const owned = launches.filter(process => process.seat === seat);
+    const latest = owned.reduce<number | null>((current, process) => {
+      if (!Number.isFinite(process.elapsedSeconds) || process.elapsedSeconds < 0) return current;
+      const start = now.getTime() - process.elapsedSeconds * 1000;
+      return current === null ? start : Math.max(current, start);
+    }, null);
+    const fallback = owned.length ? lastLaunchAt?.[seat]?.getTime() : undefined;
+    const idleStart = idleSince?.[seat]?.getTime();
+    const last = idleStart !== undefined && Number.isFinite(idleStart) ? idleStart
+      : latest ?? (fallback !== undefined && Number.isFinite(fallback) ? fallback : null);
+    const idleFor = last === null ? null : Math.max(0, Math.floor((now.getTime() - last) / 60_000));
+    const nextCell = openCells.find(cell => cell.status !== 'done' && cell.owner?.split('/')[0] === seat) ?? null;
+    const baseShare = baseShares?.[seat] ?? null;
+    return { seat, running: owned.length, cap: caps[seat], baseShare, borrowed: 0, lent: 0,
+      launchCap: baseShare === null ? caps[seat] : Math.max(owned.length, baseShare), idleFor,
+      idle: decideSpawn({ seat, running: owned.length, caps: { [seat]: caps[seat] },
+        gate: { [seat]: caps[seat] } }).allow && last !== null && now.getTime() - last > idleMinutes * 60_000, nextCell };
+  });
+  if (baseShares !== null) {
+    // Account for outstanding loans before lending new capacity. A returning
+    // lender cannot launch into a slot still occupied by the borrower's run.
+    for (const borrower of seats) {
+      let excess = Math.max(0, borrower.running - borrower.baseShare!);
+      borrower.borrowed += excess;
+      for (const lender of seats) {
+        if (!excess) break;
+        if (lender === borrower) continue;
+        const amount = Math.min(excess, Math.max(0, lender.baseShare! - lender.running - lender.lent));
+        lender.lent += amount;
+        excess -= amount;
+      }
+    }
+    for (const lender of seats) {
+      if (lender.nextCell) continue;
+      let available = Math.max(0, lender.baseShare! - lender.running - lender.lent);
+      for (const borrower of seats) {
+        if (!available) break;
+        if (borrower === lender || !borrower.nextCell) continue;
+        const needed = Math.max(0, Math.min(borrower.cap, borrower.running + 1) - borrower.launchCap);
+        const amount = Math.min(available, needed);
+        lender.lent += amount;
+        borrower.borrowed += amount;
+        borrower.launchCap += amount;
+        available -= amount;
+      }
+    }
+    for (const lender of seats) lender.launchCap = Math.max(lender.running, lender.launchCap - lender.lent);
+  }
+  // Reserve one available global slot per possible request, including unknown-seat
+  // launches in the occupied count; returning a lent share does not end its old run.
+  let freeSlots = Math.max(0, slotBudget - launches.length);
+  for (const row of seats) {
+    if (row.nextCell && row.idle && decideTrafficLaunch(row)) {
+      if (freeSlots > 0) freeSlots--;
+      else row.launchCap = row.running;
+    }
+    row.idle = row.idle && (row.nextCell === null || decideTrafficLaunch(row));
+    if (!row.idle && !retainQueuedCells) row.nextCell = null;
+  }
+  return { seats, unassigned: launches.filter(process => process.seat === null).length, now, idleMinutes };
+}

package/src/loops/orchestrator/seat-share.ts

@@ -1,56 +1,13 @@
 import type { ChecklistItem } from '../../release-loop/checklist.js';
 import type { OrchestratorSeat } from '../../user-config.js';
+import { calculateSeatBaseShares as budgetSeatBaseShares } from '../budget.js';
 
-const SEATS: readonly OrchestratorSeat[] = ['OP', 'TC', 'MK', 'UX'];
-type WorkCell = Pick<ChecklistItem, 'owner' | 'status'>;
-
-/** Allocate whole base slots by remaining work; this calculation does not decide launches. */
-export function calculateSeatBaseShares({ totalSlots, currentRound, nextRound, seatCaps }: {
+/** Existing orchestrator callers keep their signature; the resource loop owns the decision. */
+export function calculateSeatBaseShares(input: {
   totalSlots: number;
-  currentRound: readonly WorkCell[];
-  nextRound: readonly WorkCell[];
+  currentRound: readonly Pick<ChecklistItem, 'owner' | 'status'>[];
+  nextRound: readonly Pick<ChecklistItem, 'owner' | 'status'>[];
   seatCaps: Readonly<Record<OrchestratorSeat, number>>;
 }): Record<OrchestratorSeat, number> {
-  if (!Number.isSafeInteger(totalSlots) || totalSlots < 0 ||
-    SEATS.some(seat => !Number.isSafeInteger(seatCaps[seat]) || seatCaps[seat] < 0)) {
-    throw new RangeError('totalSlots and seatCaps must be nonnegative safe integers');
-  }
-  const shares: Record<OrchestratorSeat, number> = { OP: 0, TC: 0, MK: 0, UX: 0 };
-  const weights: Record<OrchestratorSeat, number> = { OP: 0, TC: 0, MK: 0, UX: 0 };
-  for (const [cells, weight] of [[currentRound, 2], [nextRound, 1]] as const) {
-    for (const cell of cells) {
-      if (cell.status !== 'yellow') continue;
-      const seat = cell.owner?.split('/')[0];
-      if (SEATS.some(id => id === seat)) weights[seat as OrchestratorSeat] += weight;
-    }
-  }
-
-  let available = Math.min(totalSlots, SEATS.reduce((sum, seat) => sum + seatCaps[seat], 0));
-  let eligible = SEATS.filter(seat => weights[seat] > 0 && seatCaps[seat] > 0);
-  while (available > 0 && eligible.length > 0) {
-    const totalWeight = eligible.reduce((sum, seat) => sum + weights[seat], 0);
-    const ideal = (seat: OrchestratorSeat) => available * weights[seat] / totalWeight;
-    const capped = eligible.filter(seat => ideal(seat) >= seatCaps[seat]);
-    if (capped.length > 0) {
-      for (const seat of capped) {
-        shares[seat] = seatCaps[seat];
-        available -= seatCaps[seat];
-      }
-      eligible = eligible.filter(seat => !capped.includes(seat));
-      continue;
-    }
-    const remainders = eligible.map(seat => ({ seat, exact: ideal(seat) }));
-    for (const { seat, exact } of remainders) {
-      shares[seat] = Math.floor(exact);
-      available -= shares[seat];
-    }
-    remainders.sort((a, b) => (b.exact - Math.floor(b.exact)) - (a.exact - Math.floor(a.exact)));
-    for (const { seat } of remainders) {
-      if (available === 0) break;
-      shares[seat]++;
-      available--;
-    }
-    break;
-  }
-  return shares;
+  return budgetSeatBaseShares(input);
 }

package/src/loops/orchestrator/traffic.ts

@@ -9,7 +9,7 @@ import { withFileLockSync } from '../../storage/file-lock.js';
 import { getUserConfig, ORCHESTRATOR_DEFAULTS, type OrchestratorLoopConfig, type OrchestratorSeat } from '../../user-config.js';
 import { finishAdvice, measureFinish, type FinishAdvice, type FinishMetrics, type MeasureFinishDeps } from './finish-rate.js';
 import { collectAuthorDepth, type AuthorDepthResult, type CollectAuthorDepthDeps } from './author-depth.js';
-import { calculateSeatBaseShares } from './seat-share.js';
+import { budgetTrafficTick } from '../budget.js';
 
 export const TRAFFIC_SEATS = ['OP', 'TC', 'MK', 'UX'] as const;
 export type TrafficCell = Pick<ChecklistItem, 'id' | 'title' | 'owner' | 'status'>;
@@ -49,88 +49,12 @@ function realOrResolved(path: string): string {
   try { return realpathSync(path); } catch { return resolve(path); }
 }
 
-const IS_LAUNCH = /(?:^|\s)(?:\S*\/)?elanous\.mjs\s+(?:(?:--test|--config-dir\s+\S+)\s+)?harness\s+(?:ask|say)(?=\s|$)/;
 /** A `harness ask|say` launch command line — the only processes `trafficTick` counts. */
-export const isTrafficLaunch = (command: string): boolean => IS_LAUNCH.test(command);
+export { isTrafficLaunch } from '../budget.js';
 
-/** Process-to-seat resolution occurs at the boundary; this decision does no IO. */
-export function trafficTick({ processes, now, caps, lastLaunchAt, idleSince, openCells, nextRound, totalSlots, idleMinutes = 30 }: {
-  processes: readonly TrafficProcess[];
-  now: Date;
-  caps: Readonly<Record<OrchestratorSeat, number>>;
-  lastLaunchAt?: Partial<Record<OrchestratorSeat, Date | null>>;
-  idleSince?: Partial<Record<OrchestratorSeat, Date | null>>;
-  openCells: readonly TrafficCell[];
-  nextRound?: readonly TrafficCell[];
-  totalSlots?: number;
-  idleMinutes?: number;
-}): TrafficResult {
-  const launches = processes.filter(process => IS_LAUNCH.test(process.command));
-  const slotBudget = totalSlots ?? TRAFFIC_SEATS.reduce((sum, seat) => sum + caps[seat], 0);
-  // A missing next round is unknown, not an empty round with zero remaining work.
-  const baseShares = nextRound === undefined ? null : calculateSeatBaseShares({
-    totalSlots: slotBudget, currentRound: openCells, nextRound, seatCaps: caps,
-  });
-  const seats = TRAFFIC_SEATS.map((seat): TrafficSeatRow => {
-    const owned = launches.filter(process => process.seat === seat);
-    const latest = owned.reduce<number | null>((current, process) => {
-      if (!Number.isFinite(process.elapsedSeconds) || process.elapsedSeconds < 0) return current;
-      const start = now.getTime() - process.elapsedSeconds * 1000;
-      return current === null ? start : Math.max(current, start);
-    }, null);
-    const fallback = owned.length ? lastLaunchAt?.[seat]?.getTime() : undefined;
-    const idleStart = idleSince?.[seat]?.getTime();
-    const last = idleStart !== undefined && Number.isFinite(idleStart) ? idleStart
-      : latest ?? (fallback !== undefined && Number.isFinite(fallback) ? fallback : null);
-    const idleFor = last === null ? null : Math.max(0, Math.floor((now.getTime() - last) / 60_000));
-    const nextCell = openCells.find(cell => cell.status !== 'done' && cell.owner?.split('/')[0] === seat) ?? null;
-    const baseShare = baseShares?.[seat] ?? null;
-    return { seat, running: owned.length, cap: caps[seat], baseShare, borrowed: 0, lent: 0,
-      launchCap: baseShare === null ? caps[seat] : Math.max(owned.length, baseShare), idleFor,
-      idle: owned.length < caps[seat] && last !== null && now.getTime() - last > idleMinutes * 60_000, nextCell };
-  });
-  if (baseShares !== null) {
-    // Account for outstanding loans before lending new capacity. A returning
-    // lender cannot launch into a slot still occupied by the borrower's run.
-    for (const borrower of seats) {
-      let excess = Math.max(0, borrower.running - borrower.baseShare!);
-      borrower.borrowed += excess;
-      for (const lender of seats) {
-        if (!excess) break;
-        if (lender === borrower) continue;
-        const amount = Math.min(excess, Math.max(0, lender.baseShare! - lender.running - lender.lent));
-        lender.lent += amount;
-        excess -= amount;
-      }
-    }
-    for (const lender of seats) {
-      if (lender.nextCell) continue;
-      let available = Math.max(0, lender.baseShare! - lender.running - lender.lent);
-      for (const borrower of seats) {
-        if (!available) break;
-        if (borrower === lender || !borrower.nextCell) continue;
-        const needed = Math.max(0, Math.min(borrower.cap, borrower.running + 1) - borrower.launchCap);
-        const amount = Math.min(available, needed);
-        lender.lent += amount;
-        borrower.borrowed += amount;
-        borrower.launchCap += amount;
-        available -= amount;
-      }
-    }
-    for (const lender of seats) lender.launchCap = Math.max(lender.running, lender.launchCap - lender.lent);
-  }
-  // Reserve one available global slot per possible request, including unknown-seat
-  // launches in the occupied count; returning a lent share does not end its old run.
-  let freeSlots = Math.max(0, slotBudget - launches.length);
-  for (const row of seats) {
-    if (row.nextCell && row.idle && row.running < row.launchCap) {
-      if (freeSlots > 0) freeSlots--;
-      else row.launchCap = row.running;
-    }
-    row.idle = row.idle && (row.nextCell === null || row.running < row.launchCap);
-    if (!row.idle) row.nextCell = null;
-  }
-  return { seats, unassigned: launches.filter(process => process.seat === null).length, now, idleMinutes };
+/** Process observation stays at the boundary; the shared resource loop owns the decision. */
+export function trafficTick(input: Parameters<typeof budgetTrafficTick>[0]): TrafficResult {
+  return budgetTrafficTick(input);
 }
 
 export function withFinishAdvice(result: TrafficResult, deps: MeasureFinishDeps = {}): TrafficResult {

package/src/market/signed-index.ts

@@ -1,10 +1,31 @@
 import { createHash, createPublicKey, generateKeyPairSync, sign, verify } from 'node:crypto';
 
+export interface MarketplaceArtifact {
+  sha256: string;
+  bytes: number;
+  key: string;
+}
+
+export interface MarketplaceScopedPack {
+  name: string;
+  version: string;
+  description?: string;
+  artifact: MarketplaceArtifact;
+  visibility: 'public' | 'internal';
+  enterpriseId?: string;
+}
+
+export interface MarketplaceLoopBundle extends MarketplaceScopedPack {
+  graphs?: string[];
+}
+
 export interface MarketplaceIndex {
   name: string;
   interface: { displayName: string };
   sequence: number;
   generatedAt?: string;
+  knowledgePacks?: MarketplaceScopedPack[];
+  loopBundles?: MarketplaceLoopBundle[];
   plugins: Array<{
     name: string;
     source: { source: string; [key: string]: unknown };
@@ -57,6 +78,27 @@ function invalidIndex(value: unknown): string | null {
   if (value.generatedAt !== undefined && !string(value.generatedAt)) return 'generatedAt: expected string';
   if (!Array.isArray(value.plugins)) return 'plugins: expected array';
 
+  for (const collection of ['knowledgePacks', 'loopBundles'] as const) {
+    const entries = value[collection];
+    if (entries === undefined) continue;
+    if (!Array.isArray(entries)) return `${collection}: expected array`;
+    for (const [i, entry] of entries.entries()) {
+      const field = (name: string) => `${collection}[${i}] (${record(entry) && string(entry.name) ? entry.name : 'unnamed'}).${name}`;
+      if (!record(entry)) return field('expected object');
+      if (!string(entry.name) || !entry.name.trim()) return field('name: expected non-empty string');
+      if (!string(entry.version) || !entry.version.trim()) return field('version: expected non-empty string');
+      if (entry.description !== undefined && !string(entry.description)) return field('description: expected string');
+      if (entry.visibility !== 'public' && entry.visibility !== 'internal') return field('visibility: expected public or internal');
+      if (entry.visibility === 'internal' && (!string(entry.enterpriseId) || !entry.enterpriseId.trim())) return field('enterpriseId: required for internal entry');
+      if (entry.visibility === 'public' && entry.enterpriseId !== undefined) return field('enterpriseId: not allowed for public entry');
+      if (!record(entry.artifact)) return field('artifact: expected object');
+      if (!string(entry.artifact.sha256) || !/^[a-fA-F0-9]{64}$/.test(entry.artifact.sha256)) return field('artifact.sha256: expected 64 hex characters');
+      if (!Number.isSafeInteger(entry.artifact.bytes) || (entry.artifact.bytes as number) < 0) return field('artifact.bytes: expected non-negative integer');
+      if (!string(entry.artifact.key) || !entry.artifact.key.trim()) return field('artifact.key: expected non-empty string');
+      if (collection === 'loopBundles' && entry.graphs !== undefined && !stringArray(entry.graphs)) return field('graphs: expected string array');
+    }
+  }
+
   for (const [i, plugin] of value.plugins.entries()) {
     const field = (name: string) => `plugins[${i}] (${record(plugin) && string(plugin.name) ? plugin.name : 'unnamed'}).${name}`;
     if (!record(plugin)) return field('expected object');

package/src/mcp/mcp-oauth.ts

@@ -5,9 +5,8 @@
 // 다시 실어 보내는 «잇는» 모듈. 주소를 코드에 박지 않는다 — 호스트는
 // 전부 그 401 안내에서 그때 얻는다.
 //
-// 경계: 브라우저에서 누르는 구간은 만들지 않는다. 인가 주소를 조립해
-// AuthorizeHandler 로 돌려주는 데까지가 이 착지다.
-// 경계: 장치 코드 흐름은 다루지 않는다.
+// 브라우저 승인은 호출자(aside/CLI)의 책임이다. 브라우저를 쓸 수 없고
+// 인가 서버가 RFC 8628 을 광고할 때는 장치 코드로 자격을 얻는다.
 // 경계: 새 CLI 하위 명령은 더하지 않는다.
 
 import { join } from 'node:path';
@@ -36,6 +35,7 @@ export type McpOAuthErrorCode =
   | 'identity-mismatch'
   | 's256-unsupported'
   | 'registration'
+  | 'device'
   | 'state-mismatch'
   | 'token'
   | 'refresh';
@@ -70,9 +70,10 @@ export interface ProtectedResourceMetadata {
 
 export interface AuthorizationServerMetadata {
   issuer: string;
-  authorizationEndpoint: string;
+  authorizationEndpoint?: string;
   tokenEndpoint: string;
   registrationEndpoint?: string;
+  deviceAuthorizationEndpoint?: string;
   codeChallengeMethodsSupported: string[];
 }
 
@@ -81,6 +82,9 @@ export interface ClientRegistration {
   clientSecret?: string;
   /** 동적 등록 때 쓴 redirect_uri. 옛 등록에는 없다. */
   redirectUri?: string;
+  /** Registered now but not stored yet: the store still holds another client's tokens, so this registration is
+   *  committed only with its own tokens (exchangeAuthorizationCode). A cancelled login leaves the store as it was. */
+  pending?: boolean;
 }
 
 export interface AuthorizationRequest {
@@ -90,6 +94,8 @@ export interface AuthorizationRequest {
   redirectUri: string;
   issuer: string;
   clientId: string;
+  /** Set when the client registration is pending (see ClientRegistration.pending); in memory only. */
+  pendingRegistration?: { clientSecret?: string };
   scope?: string;
   resource?: string;
 }
@@ -364,14 +370,14 @@ export async function discoverAuthorizationServer(
   const issuer = stringField(body, 'issuer');
   const authorizationEndpoint = stringField(body, 'authorization_endpoint');
   const tokenEndpoint = stringField(body, 'token_endpoint');
-  if (!issuer || !authorizationEndpoint || !tokenEndpoint) {
+  if (!issuer || !tokenEndpoint || (!authorizationEndpoint && !stringField(body, 'device_authorization_endpoint'))) {
     throw new McpOAuthError(
       'discovery',
       'authorization server metadata is missing issuer, authorization_endpoint, or token_endpoint',
     );
   }
   requireHttpUrl(issuer, 'issuer');
-  requireHttpUrl(authorizationEndpoint, 'authorization_endpoint');
+  if (authorizationEndpoint) requireHttpUrl(authorizationEndpoint, 'authorization_endpoint');
   requireHttpUrl(tokenEndpoint, 'token_endpoint');
   // ⛔⭐⭐ RFC 8414 §3.3 — 돌려받은 `issuer` 는 «우리가 물어본» 인가서버
   //    식별자와 «같아야» 한다. 안 대조하면 metadata 를 쥔 쪽이 남의 issuer 를
@@ -385,11 +391,14 @@ export async function discoverAuthorizationServer(
   }
   const registrationEndpoint = stringField(body, 'registration_endpoint');
   if (registrationEndpoint) requireHttpUrl(registrationEndpoint, 'registration_endpoint');
+  const deviceAuthorizationEndpoint = stringField(body, 'device_authorization_endpoint');
+  if (deviceAuthorizationEndpoint) requireHttpUrl(deviceAuthorizationEndpoint, 'device_authorization_endpoint');
   return {
     issuer,
-    authorizationEndpoint,
+    ...(authorizationEndpoint ? { authorizationEndpoint } : {}),
     tokenEndpoint,
     ...(registrationEndpoint ? { registrationEndpoint } : {}),
+    ...(deviceAuthorizationEndpoint ? { deviceAuthorizationEndpoint } : {}),
     codeChallengeMethodsSupported: stringList(body, 'code_challenge_methods_supported'),
   };
 }
@@ -468,13 +477,15 @@ export function loadStoredRegistration(
 
 export async function ensureClientRegistration(
   metadata: AuthorizationServerMetadata,
-  opts: McpOAuthRuntimeOpts & { forceReregister?: boolean } = {},
+  opts: McpOAuthRuntimeOpts & { forceReregister?: boolean; deviceCode?: boolean } = {},
 ): Promise<ClientRegistration> {
   const path = storePath(opts);
   if (!opts.forceReregister) {
     const stored = loadStoredRegistration(metadata.issuer, { storePath: path });
-    // 옛 등록은 redirect_uri 기록이 없다 — 재사용하면 포트 불일치로 영원히 막힌다.
-    if (stored?.redirectUri) return stored;
+    // Browser registrations require a bound loopback URI. Device authorization reuses a client without one
+    // (a prior device client — its stored refresh token stays paired with it), or any client when it cannot register.
+    if (stored && opts.deviceCode && (!stored.redirectUri || !metadata.registrationEndpoint)) return stored;
+    if (stored?.redirectUri && !opts.deviceCode) return stored;
   }
   if (!metadata.registrationEndpoint) {
     throw new McpOAuthError(
@@ -493,9 +504,9 @@ export async function ensureClientRegistration(
       },
       body: JSON.stringify({
         client_name: CLIENT_NAME,
-        redirect_uris: [redirectUri],
-        grant_types: ['authorization_code', 'refresh_token'],
-        response_types: ['code'],
+        ...(opts.deviceCode ? {} : { redirect_uris: [redirectUri] }),
+        grant_types: opts.deviceCode ? ['urn:ietf:params:oauth:grant-type:device_code', 'refresh_token'] : ['authorization_code', 'refresh_token'],
+        response_types: opts.deviceCode ? [] : ['code'],
         token_endpoint_auth_method: 'none',
         application_type: 'native',
       }),
@@ -519,8 +530,15 @@ export async function ensureClientRegistration(
   const registration: ClientRegistration = {
     clientId,
     ...(clientSecret ? { clientSecret } : {}),
-    redirectUri,
+    ...(opts.deviceCode ? {} : { redirectUri }),
   };
+  // A device client is stored only with its first tokens (authorizeMcpDevice): until a device login succeeds,
+  // the stored registration and the refresh token paired with it stay as they were.
+  if (opts.deviceCode) return registration;
+  // A browser registration over another client's live tokens (e.g. after a device login) waits for its own
+  // tokens: storing it now would orphan the stored refresh token if this approval is cancelled or fails.
+  const existing = loadTokens(metadata.issuer, path);
+  if (existing?.tokens.refreshToken && existing.accountUuid && existing.accountUuid !== clientId) return { ...registration, pending: true };
   persistRegistration(metadata.issuer, registration, path);
   return registration;
 }
@@ -546,6 +564,7 @@ export function buildAuthorizationRequest(
       'authorization server does not advertise code_challenge_methods_supported=S256',
     );
   }
+  if (!metadata.authorizationEndpoint) throw new McpOAuthError('discovery', 'authorization server has no authorization_endpoint for browser login');
   const pkce = generatePkcePair();
   const redirectUri = opts.redirectUri ?? DEFAULT_REDIRECT_URI;
   const url = new URL(metadata.authorizationEndpoint);
@@ -565,6 +584,7 @@ export function buildAuthorizationRequest(
     redirectUri,
     issuer: metadata.issuer,
     clientId: registration.clientId,
+    ...(registration.pending ? { pendingRegistration: registration.clientSecret ? { clientSecret: registration.clientSecret } : {} } : {}),
     ...(scope ? { scope } : {}),
     ...(opts.resource ? { resource: opts.resource } : {}),
   };
@@ -673,13 +693,107 @@ function persistTokens(
       authMode: AUTH_MODE,
       ...(clientId ? { accountUuid: clientId } : {}),
       ...(clientSecret ? { organizationUuid: clientSecret } : {}),
-      ...(existing?.redirectUri ? { redirectUri: existing.redirectUri } : {}),
+      // A loopback URI belongs to the client that registered it — never carry it onto a different (device) client.
+      ...(existing?.redirectUri && (!registration || registration.clientId === existing.accountUuid) ? { redirectUri: existing.redirectUri } : {}),
       mirrorCodex: false,
     },
     path,
   );
 }
 
+export interface McpDeviceAuthorization {
+  userCode: string;
+  verificationUri: string;
+  verificationUriComplete?: string;
+}
+
+/** RFC 8628: only an advertised endpoint enables the fallback; tokens use the same issuer store. */
+export async function authorizeMcpDevice(
+  metadata: AuthorizationServerMetadata,
+  registration: ClientRegistration,
+  opts: McpOAuthRuntimeOpts & {
+    scope?: string;
+    resource?: string;
+    onDeviceCode: (code: McpDeviceAuthorization) => Promise<void> | void;
+    sleep?: (ms: number) => Promise<void>;
+    now?: () => number;
+  },
+): Promise<OAuthTokens> {
+  const endpoint = metadata.deviceAuthorizationEndpoint;
+  if (!endpoint) throw new McpOAuthError('device', 'authorization server does not advertise device_authorization_endpoint');
+  const fetchFn = fetchImpl(opts);
+  const post = async (url: string, fields: Record<string, string | undefined>) => {
+    let response: Awaited<ReturnType<McpOAuthFetch>>;
+    try {
+      response = await fetchFn(url, {
+        method: 'POST',
+        headers: { accept: 'application/json', 'content-type': 'application/x-www-form-urlencoded' },
+        body: formBody(fields),
+      });
+    } catch (error) {
+      throw new McpOAuthError('device', `device authorization request failed: ${error instanceof Error ? error.message : String(error)}`);
+    }
+    const text = await response.text();
+    return { status: response.status, body: parseJsonObject(text, 'device authorization response', 'device') };
+  };
+  const started = await post(endpoint, {
+    client_id: registration.clientId,
+    client_secret: registration.clientSecret,
+    scope: opts.scope,
+    resource: opts.resource,
+  });
+  const deviceCode = stringField(started.body, 'device_code');
+  const userCode = stringField(started.body, 'user_code');
+  const verificationUri = stringField(started.body, 'verification_uri');
+  if (started.status < 200 || started.status >= 300 || !deviceCode || !userCode || !verificationUri) {
+    const error = stringField(started.body, 'error');
+    throw new McpOAuthError('device', `device authorization returned HTTP ${started.status}${error ? ` (${error})` : ''} or missing required fields`);
+  }
+  requireHttpUrl(verificationUri, 'verification_uri');
+  const verificationUriComplete = stringField(started.body, 'verification_uri_complete');
+  if (verificationUriComplete) requireHttpUrl(verificationUriComplete, 'verification_uri_complete');
+  const seconds = started.body.expires_in;
+  if (typeof seconds !== 'number' || !Number.isFinite(seconds) || seconds <= 0) {
+    throw new McpOAuthError('device', 'device authorization response has invalid expires_in');
+  }
+  const now = opts.now ?? Date.now;
+  const deadline = now() + Math.min(seconds * 1000, 15 * 60_000);
+  let interval = typeof started.body.interval === 'number' && Number.isFinite(started.body.interval) && started.body.interval > 0
+    ? Math.max(1000, started.body.interval * 1000) : 5000;
+  await opts.onDeviceCode({ userCode, verificationUri, ...(verificationUriComplete ? { verificationUriComplete } : {}) });
+  const sleep = opts.sleep ?? ((ms: number) => new Promise<void>((resolve) => setTimeout(resolve, ms)));
+  let attempts = 0;
+  while (now() < deadline) {
+    if (++attempts > Math.ceil(Math.min(seconds, 900)) + 1) throw new McpOAuthError('device', 'device authorization polling limit exceeded');
+    await sleep(Math.min(interval, deadline - now()));
+    if (now() >= deadline) break;
+    const polled = await post(metadata.tokenEndpoint, {
+      grant_type: 'urn:ietf:params:oauth:grant-type:device_code',
+      device_code: deviceCode,
+      client_id: registration.clientId,
+      client_secret: registration.clientSecret,
+      resource: opts.resource,
+    });
+    if (polled.status >= 200 && polled.status < 300) {
+      const accessToken = stringField(polled.body, 'access_token');
+      if (!accessToken) throw new McpOAuthError('token', 'device token response is missing access_token');
+      const tokens: OAuthTokens = {
+        accessToken,
+        refreshToken: stringField(polled.body, 'refresh_token') ?? '',
+        expiresAt: expiresAtFromSeconds(polled.body.expires_in),
+        tokenType: stringField(polled.body, 'token_type') ?? 'Bearer',
+        ...(stringField(polled.body, 'scope') ? { scope: stringField(polled.body, 'scope') } : {}),
+      };
+      persistTokens(metadata.issuer, tokens, registration, storePath(opts));
+      return tokens;
+    }
+    const error = stringField(polled.body, 'error');
+    if (error === 'slow_down') interval += 5000;
+    else if (error !== 'authorization_pending') throw new McpOAuthError('device', `device token request returned HTTP ${polled.status} (${error ?? 'unknown'})`);
+  }
+  throw new McpOAuthError('device', 'device authorization expired before approval');
+}
+
 export async function exchangeAuthorizationCode(
   metadata: AuthorizationServerMetadata,
   request: AuthorizationRequest,
@@ -688,7 +802,10 @@ export async function exchangeAuthorizationCode(
 ): Promise<OAuthTokens> {
   const code = verifyAuthorizationCallback(request, callback);
   const path = storePath(opts);
-  const registration = loadStoredRegistration(metadata.issuer, { storePath: path });
+  const pending = request.pendingRegistration;
+  const registration: ClientRegistration | null = pending
+    ? { clientId: request.clientId, ...(pending.clientSecret ? { clientSecret: pending.clientSecret } : {}), redirectUri: request.redirectUri }
+    : loadStoredRegistration(metadata.issuer, { storePath: path });
   const tokens = await postToken(
     metadata.tokenEndpoint,
     {
@@ -703,7 +820,9 @@ export async function exchangeAuthorizationCode(
     fetchImpl(opts),
     'token',
   );
-  persistTokens(
+  // A pending registration is committed together with the tokens it just earned.
+  if (pending) persistRegistration(metadata.issuer, registration!, path, tokens);
+  else persistTokens(
     metadata.issuer,
     tokens,
     registration ?? { clientId: request.clientId },