llm-cli-gateway 2.13.1 → 2.14.0-rc.1

package/dist/acp/types.js

@@ -57,10 +57,60 @@ export const InitializeRequestSchema = z
     _meta: MetaSchema,
 })
     .passthrough();
+const SessionSubCapabilitySchema = z.object({ _meta: MetaSchema }).passthrough().nullish();
+export const PromptCapabilitiesSchema = z
+    .object({
+    image: z.boolean().optional(),
+    audio: z.boolean().optional(),
+    embeddedContext: z.boolean().optional(),
+    _meta: MetaSchema,
+})
+    .passthrough();
+export const McpCapabilitiesSchema = z
+    .object({
+    http: z.boolean().optional(),
+    sse: z.boolean().optional(),
+    _meta: MetaSchema,
+})
+    .passthrough();
+export const SessionCapabilitiesSchema = z
+    .object({
+    resume: SessionSubCapabilitySchema,
+    list: SessionSubCapabilitySchema,
+    close: SessionSubCapabilitySchema,
+    delete: SessionSubCapabilitySchema,
+    additionalDirectories: SessionSubCapabilitySchema,
+    _meta: MetaSchema,
+})
+    .passthrough();
+export const AgentAuthCapabilitiesSchema = z
+    .object({
+    logout: z.object({ _meta: MetaSchema }).passthrough().nullish(),
+    _meta: MetaSchema,
+})
+    .passthrough();
+export const AgentCapabilitiesSchema = z
+    .object({
+    loadSession: z.boolean().optional(),
+    promptCapabilities: PromptCapabilitiesSchema.optional(),
+    mcpCapabilities: McpCapabilitiesSchema.optional(),
+    sessionCapabilities: SessionCapabilitiesSchema.optional(),
+    auth: AgentAuthCapabilitiesSchema.optional(),
+    _meta: MetaSchema,
+})
+    .passthrough();
+export const AuthMethodSchema = z
+    .object({
+    id: z.string().optional(),
+    name: z.string().optional(),
+    description: z.string().nullish(),
+    _meta: MetaSchema,
+})
+    .passthrough();
 export const InitializeResponseSchema = z
     .object({
     protocolVersion: ProtocolVersionSchema,
-    agentCapabilities: z.record(z.unknown()).optional(),
+    agentCapabilities: AgentCapabilitiesSchema.optional(),
     agentInfo: z
         .object({
         name: z.string().optional(),
@@ -68,10 +118,51 @@ export const InitializeResponseSchema = z
     })
         .passthrough()
         .optional(),
-    authMethods: z.array(z.record(z.unknown())).optional(),
+    authMethods: z.array(AuthMethodSchema).optional(),
     _meta: MetaSchema,
 })
     .passthrough();
+export const BASELINE_ACP_METHODS = [
+    "session/new",
+    "session/prompt",
+    "session/cancel",
+    "session/update",
+];
+function subCapabilityPresent(value) {
+    return value !== null && value !== undefined && typeof value === "object";
+}
+export function deriveAcpMethodAvailability(init) {
+    const methods = new Set(BASELINE_ACP_METHODS);
+    const caps = init.agentCapabilities;
+    if (caps?.loadSession === true) {
+        methods.add("session/load");
+    }
+    const sc = caps?.sessionCapabilities;
+    if (sc) {
+        if (subCapabilityPresent(sc.resume))
+            methods.add("session/resume");
+        if (subCapabilityPresent(sc.list))
+            methods.add("session/list");
+        if (subCapabilityPresent(sc.close))
+            methods.add("session/close");
+        if (subCapabilityPresent(sc.delete))
+            methods.add("session/delete");
+    }
+    if (Array.isArray(init.authMethods) && init.authMethods.length > 0) {
+        methods.add("authenticate");
+    }
+    return methods;
+}
+export function sessionResponseMethods(response) {
+    const methods = new Set();
+    if (response.modes !== null && response.modes !== undefined) {
+        methods.add("session/set_mode");
+    }
+    if (response.configOptions !== null && response.configOptions !== undefined) {
+        methods.add("session/set_config_option");
+    }
+    return methods;
+}
 export const McpServerSchema = z.record(z.unknown());
 export const SessionNewRequestSchema = z
     .object({
@@ -83,7 +174,8 @@ export const SessionNewRequestSchema = z
 export const SessionNewResponseSchema = z
     .object({
     sessionId: SessionIdSchema,
-    modes: z.record(z.unknown()).optional(),
+    modes: z.record(z.unknown()).nullish(),
+    configOptions: z.array(z.record(z.unknown())).nullish(),
     _meta: MetaSchema,
 })
     .passthrough();
@@ -97,7 +189,124 @@ export const SessionLoadRequestSchema = z
     .passthrough();
 export const SessionLoadResponseSchema = z
     .object({
-    modes: z.record(z.unknown()).optional(),
+    modes: z.record(z.unknown()).nullish(),
+    configOptions: z.array(z.record(z.unknown())).nullish(),
+    _meta: MetaSchema,
+})
+    .passthrough();
+export const SessionResumeRequestSchema = z
+    .object({
+    sessionId: SessionIdSchema,
+    cwd: z.string().min(1),
+    mcpServers: z.array(McpServerSchema).default([]),
+    _meta: MetaSchema,
+})
+    .passthrough();
+export const SessionResumeResponseSchema = z
+    .object({
+    modes: z.record(z.unknown()).nullish(),
+    configOptions: z.array(z.record(z.unknown())).nullish(),
+    _meta: MetaSchema,
+})
+    .passthrough();
+export const SessionModeSchema = z
+    .object({
+    id: z.string().min(1),
+    name: z.string().min(1),
+    description: z.string().nullish(),
+    _meta: MetaSchema,
+})
+    .passthrough();
+export const SessionModeStateSchema = z
+    .object({
+    currentModeId: z.string().min(1),
+    availableModes: z.array(SessionModeSchema),
+    _meta: MetaSchema,
+})
+    .passthrough();
+export const SessionConfigSelectValueSchema = z
+    .object({
+    value: z.string().min(1),
+    label: z.string().nullish(),
+    description: z.string().nullish(),
+    _meta: MetaSchema,
+})
+    .passthrough();
+export const SessionConfigOptionSchema = z.discriminatedUnion("type", [
+    z
+        .object({
+        type: z.literal("select"),
+        id: z.string().min(1),
+        name: z.string().min(1),
+        description: z.string().nullish(),
+        category: z.string().nullish(),
+        currentValue: z.string().min(1),
+        options: z.array(SessionConfigSelectValueSchema),
+        _meta: MetaSchema,
+    })
+        .passthrough(),
+    z
+        .object({
+        type: z.literal("boolean"),
+        id: z.string().min(1),
+        name: z.string().min(1),
+        description: z.string().nullish(),
+        category: z.string().nullish(),
+        currentValue: z.boolean(),
+        _meta: MetaSchema,
+    })
+        .passthrough(),
+]);
+export const SessionInfoSchema = z
+    .object({
+    sessionId: SessionIdSchema,
+    cwd: z.string().min(1),
+    additionalDirectories: z.array(z.string()).optional(),
+    title: z.string().nullish(),
+    updatedAt: z.string().nullish(),
+    _meta: MetaSchema,
+})
+    .passthrough();
+export const ListSessionsRequestSchema = z
+    .object({
+    cursor: z.string().nullish(),
+    _meta: MetaSchema,
+})
+    .passthrough();
+export const ListSessionsResponseSchema = z
+    .object({
+    sessions: z.array(SessionInfoSchema),
+    nextCursor: z.string().nullish(),
+    _meta: MetaSchema,
+})
+    .passthrough();
+export const CloseSessionRequestSchema = z
+    .object({ sessionId: SessionIdSchema, _meta: MetaSchema })
+    .passthrough();
+export const CloseSessionResponseSchema = z.object({ _meta: MetaSchema }).passthrough();
+export const DeleteSessionRequestSchema = z
+    .object({ sessionId: SessionIdSchema, _meta: MetaSchema })
+    .passthrough();
+export const DeleteSessionResponseSchema = z.object({ _meta: MetaSchema }).passthrough();
+export const SetSessionModeRequestSchema = z
+    .object({
+    sessionId: SessionIdSchema,
+    modeId: z.string().min(1),
+    _meta: MetaSchema,
+})
+    .passthrough();
+export const SetSessionModeResponseSchema = z.object({ _meta: MetaSchema }).passthrough();
+export const SetSessionConfigOptionRequestSchema = z
+    .object({
+    sessionId: SessionIdSchema,
+    configId: z.string().min(1),
+    value: z.string().min(1),
+    _meta: MetaSchema,
+})
+    .passthrough();
+export const SetSessionConfigOptionResponseSchema = z
+    .object({
+    configOptions: z.array(SessionConfigOptionSchema),
     _meta: MetaSchema,
 })
     .passthrough();
@@ -184,6 +393,13 @@ const UsageUpdate = z
     _meta: MetaSchema,
 })
     .passthrough();
+const ConfigOptionUpdate = z
+    .object({
+    sessionUpdate: z.literal("config_option_update"),
+    configOptions: z.array(SessionConfigOptionSchema),
+    _meta: MetaSchema,
+})
+    .passthrough();
 const KNOWN_UPDATE_SCHEMAS = {
     user_message_chunk: MessageChunkUpdate("user_message_chunk"),
     agent_message_chunk: MessageChunkUpdate("agent_message_chunk"),
@@ -193,6 +409,7 @@ const KNOWN_UPDATE_SCHEMAS = {
     plan: PlanUpdate,
     available_commands_update: AvailableCommandsUpdate,
     current_mode_update: CurrentModeUpdate,
+    config_option_update: ConfigOptionUpdate,
     usage_update: UsageUpdate,
 };
 export const SessionUpdateSchema = z
@@ -227,7 +444,6 @@ export const KNOWN_SESSION_UPDATE_VARIANTS = [
     "available_commands_update",
     "current_mode_update",
     "config_option_update",
-    "session_info_update",
     "usage_update",
 ];
 export function isUnknownSessionUpdate(update) {
@@ -333,3 +549,24 @@ export function parseWriteTextFileRequest(value, provider) {
         provider,
     });
 }
+export function parseSessionResumeResponse(value, provider) {
+    return parseAcp(SessionResumeResponseSchema, value, { method: "session/resume", provider });
+}
+export function parseListSessionsResponse(value, provider) {
+    return parseAcp(ListSessionsResponseSchema, value, { method: "session/list", provider });
+}
+export function parseCloseSessionResponse(value, provider) {
+    return parseAcp(CloseSessionResponseSchema, value, { method: "session/close", provider });
+}
+export function parseDeleteSessionResponse(value, provider) {
+    return parseAcp(DeleteSessionResponseSchema, value, { method: "session/delete", provider });
+}
+export function parseSetSessionModeResponse(value, provider) {
+    return parseAcp(SetSessionModeResponseSchema, value, { method: "session/set_mode", provider });
+}
+export function parseSetSessionConfigOptionResponse(value, provider) {
+    return parseAcp(SetSessionConfigOptionResponseSchema, value, {
+        method: "session/set_config_option",
+        provider,
+    });
+}

package/dist/async-job-manager.d.ts

@@ -69,6 +69,8 @@ export interface AsyncJobResult extends AsyncJobSnapshot {
     responseId?: string | null;
     model?: string;
     errorBody?: string;
+    providerSessionId?: string;
+    stopReason?: string;
 }
 export interface StartJobOptions {
     cwd?: string;

package/dist/async-job-manager.js

@@ -5,6 +5,7 @@ import { ProcessMonitor } from "./process-monitor.js";
 import { computeRequestKey, isValidationRunStore } from "./job-store.js";
 import { NoopFlightRecorder, } from "./flight-recorder.js";
 import { codexFrResponse } from "./codex-json-parser.js";
+import { extractProviderOutputMetadata } from "./provider-output-metadata.js";
 import { getRequestContext, resolveOwnerPrincipal, principalCanAccess } from "./request-context.js";
 import { runApiRequest, ApiHttpError, } from "./api-provider.js";
 export function extractApiHttpStatus(error) {
@@ -681,6 +682,9 @@ export class AsyncJobManager {
         const errorMessage = isFailure
             ? (overrideErrorMessage ?? job.error ?? job.stderr ?? `Exit code ${exitCode}`)
             : undefined;
+        const providerMeta = finalStatus === "completed" && job.transport === "process"
+            ? extractProviderOutputMetadata(job.cli, job.stdout, job.outputFormat)
+            : undefined;
         try {
             this.flightRecorder.logComplete(job.correlationId, {
                 response,
@@ -697,6 +701,8 @@ export class AsyncJobManager {
                 cacheReadTokens: usage.cacheReadTokens,
                 cacheCreationTokens: usage.cacheCreationTokens,
                 costUsd: usage.costUsd,
+                providerSessionId: providerMeta?.sessionId,
+                stopReason: providerMeta?.stopReason,
             });
             job.flightRecorderComplete = true;
             job.flightRecorderEntry = undefined;
@@ -1136,12 +1142,17 @@ export class AsyncJobManager {
         }
         const stdout = truncateText(job.stdout, maxChars);
         const stderr = truncateText(job.stderr, maxChars);
+        const providerMeta = job.transport === "process" && job.status === "completed"
+            ? extractProviderOutputMetadata(job.cli, job.stdout, job.outputFormat)
+            : undefined;
         return {
             ...this.snapshot(job),
             stdout: stdout.text,
             stderr: stderr.text,
             stdoutTruncated: stdout.truncated,
             stderrTruncated: stderr.truncated,
+            ...(providerMeta?.sessionId ? { providerSessionId: providerMeta.sessionId } : {}),
+            ...(providerMeta?.stopReason ? { stopReason: providerMeta.stopReason } : {}),
             ...(job.transport === "http"
                 ? {
                     apiUsage: job.apiUsage,

package/dist/codex-json-parser.d.ts

@@ -9,6 +9,7 @@ export interface CodexJsonParseResult {
     usage?: CodexUsage;
     error?: string;
     threadId?: string;
+    stopReason?: string;
     finalMessage?: string;
     sawEvent?: boolean;
 }

package/dist/codex-json-parser.js

@@ -47,6 +47,12 @@ export function parseCodexJsonStream(stdout) {
                     }
                     result.usage = usage;
                 }
+                if (typeof parsed.stop_reason === "string") {
+                    result.stopReason = parsed.stop_reason;
+                }
+                else if (typeof parsed.reason === "string") {
+                    result.stopReason = parsed.reason;
+                }
                 break;
             }
             case "turn.failed": {

package/dist/config.d.ts

@@ -155,6 +155,7 @@ export interface AcpConfig {
     promptTimeoutMs: number;
     allowWriteHostServices: boolean;
     allowTerminalHostServices: boolean;
+    allowMutatingSessionOps: boolean;
     fallbackToCliWhenUnhealthy: boolean;
     providers: Record<string, AcpProviderConfig>;
     sources: {
@@ -162,4 +163,19 @@ export interface AcpConfig {
     };
 }
 export declare function loadAcpConfig(logger?: Logger): AcpConfig;
+export interface AdminConfig {
+    allowMutatingCliAdminOps: boolean;
+    sources: {
+        configFile: string | null;
+    };
+}
+export declare function loadAdminConfig(logger?: Logger): AdminConfig;
+export type RemoteOAuthConfigStatus = "absent" | "disabled" | "enabled" | "malformed";
+export interface RemoteOAuthConfigDiagnostics {
+    config: RemoteOAuthConfig;
+    status: RemoteOAuthConfigStatus;
+    configured: boolean;
+    issues: string[];
+}
+export declare function diagnoseRemoteOAuthConfig(logger?: Logger, env?: NodeJS.ProcessEnv): RemoteOAuthConfigDiagnostics;
 export declare function loadRemoteOAuthConfig(logger?: Logger, env?: NodeJS.ProcessEnv): RemoteOAuthConfig;

package/dist/config.js

@@ -537,6 +537,7 @@ const AcpConfigSchema = z
     prompt_timeout_ms: z.number().int().positive().default(DEFAULT_ACP_PROMPT_TIMEOUT_MS),
     allow_write_host_services: z.boolean().default(false),
     allow_terminal_host_services: z.boolean().default(false),
+    allow_mutating_session_ops: z.boolean().default(false),
     fallback_to_cli_when_unhealthy: z.boolean().default(true),
     providers: z.record(z.string(), AcpProviderSchema).default({}),
 })
@@ -552,6 +553,7 @@ function defaultAcpConfig(sourcePath) {
         promptTimeoutMs: DEFAULT_ACP_PROMPT_TIMEOUT_MS,
         allowWriteHostServices: false,
         allowTerminalHostServices: false,
+        allowMutatingSessionOps: false,
         fallbackToCliWhenUnhealthy: true,
         providers: {},
         sources: { configFile: sourcePath },
@@ -608,11 +610,56 @@ export function loadAcpConfig(logger = noopLogger) {
         promptTimeoutMs: parsed.prompt_timeout_ms,
         allowWriteHostServices: parsed.allow_write_host_services,
         allowTerminalHostServices: parsed.allow_terminal_host_services,
+        allowMutatingSessionOps: parsed.allow_mutating_session_ops,
         fallbackToCliWhenUnhealthy: parsed.fallback_to_cli_when_unhealthy,
         providers,
         sources: { configFile: sourcePath },
     };
 }
+const AdminConfigSchema = z
+    .object({
+    allow_mutating_cli_admin_ops: z.boolean().default(false),
+})
+    .strict();
+function defaultAdminConfig(sourcePath) {
+    return { allowMutatingCliAdminOps: false, sources: { configFile: sourcePath } };
+}
+function readAdminFile(configPath, logger) {
+    if (!existsSync(configPath)) {
+        return { raw: undefined, sourcePath: null };
+    }
+    try {
+        const require = createRequire(import.meta.url);
+        const TOML = require("smol-toml");
+        const text = readFileSync(configPath, "utf-8");
+        const parsed = TOML.parse(text);
+        return { raw: parsed?.admin, sourcePath: configPath };
+    }
+    catch (err) {
+        logger.error(`Failed to parse gateway config at ${configPath}; using admin defaults`, err);
+        return { raw: undefined, sourcePath: null };
+    }
+}
+export function loadAdminConfig(logger = noopLogger) {
+    const configPath = defaultGatewayConfigPath();
+    const { raw, sourcePath } = readAdminFile(configPath, logger);
+    if (raw === undefined) {
+        return defaultAdminConfig(sourcePath);
+    }
+    let parsed;
+    try {
+        parsed = AdminConfigSchema.parse(raw);
+    }
+    catch (err) {
+        throw new Error(`Invalid [admin] config: ${err instanceof Error ? err.message : String(err)}`, {
+            cause: err,
+        });
+    }
+    return {
+        allowMutatingCliAdminOps: parsed.allow_mutating_cli_admin_ops,
+        sources: { configFile: sourcePath },
+    };
+}
 const OAuthRegistrationPolicySchema = z.enum(["static_clients", "shared_secret", "open_dev"]);
 const OAuthClientSchema = z
     .object({
@@ -663,11 +710,7 @@ function disabledOAuthConfig(sourcePath = null, envOverrides = []) {
 function isSafeRedirectUri(uri) {
     return isHttpsOrLoopbackUrl(uri);
 }
-export function loadRemoteOAuthConfig(logger = noopLogger, env = process.env) {
-    const configPath = defaultGatewayConfigPath();
-    const { parsed: configFile, sourcePath } = readGatewayTomlFile(configPath, logger, "OAuth");
-    const rawHttp = configFile?.http ?? {};
-    const rawOAuth = rawHttp.oauth ?? {};
+function mergeOAuthEnvOverrides(rawOAuth, env) {
     const envOverrides = [];
     const merged = { ...rawOAuth };
     if (env.LLM_GATEWAY_OAUTH_ENABLED !== undefined) {
@@ -695,43 +738,43 @@ export function loadRemoteOAuthConfig(logger = noopLogger, env = process.env) {
         merged.require_consent = merged.require_consent ?? true;
         envOverrides.push("LLM_GATEWAY_OAUTH_CONSENT_SECRET");
     }
-    const parsed = OAuthConfigSchema.safeParse(merged);
-    if (!parsed.success) {
-        logWarn(logger, "Invalid [http.oauth] config; remote OAuth disabled", {
-            error: parsed.error.message,
-        });
-        return disabledOAuthConfig(sourcePath, envOverrides);
-    }
-    const data = parsed.data;
+    return { merged, envOverrides };
+}
+function validateParsedOAuthConfig(data, env, sourcePath, envOverrides, logger, issues) {
     if (data.issuer !== "auto" && !isHttpsOrLoopbackUrl(data.issuer)) {
         logWarn(logger, "Invalid [http.oauth].issuer; remote OAuth disabled");
-        return disabledOAuthConfig(sourcePath, envOverrides);
+        issues.push("OAuth issuer must be an https:// URL (or a loopback URL for local testing).");
+        return null;
     }
     for (const client of data.clients) {
         if (!data.allow_public_clients && !client.client_secret_hash) {
             logWarn(logger, "OAuth client secret hash is required when public clients are disabled", {
                 client_id: client.client_id,
             });
-            return disabledOAuthConfig(sourcePath, envOverrides);
+            issues.push("An OAuth client is missing a client_secret_hash (required when public clients are disabled). Recreate it with `llm-cli-gateway oauth client add`.");
+            return null;
         }
         if (client.client_secret_hash && !isSecretHash(client.client_secret_hash)) {
             logWarn(logger, "Invalid OAuth client secret hash; remote OAuth disabled", {
                 client_id: client.client_id,
             });
-            return disabledOAuthConfig(sourcePath, envOverrides);
+            issues.push("An OAuth client secret hash is not a valid scrypt hash. Rotate it with `llm-cli-gateway oauth client rotate`.");
+            return null;
         }
         if (client.allowed_redirect_uris.length === 0 ||
             client.allowed_redirect_uris.some(uri => !isSafeRedirectUri(uri))) {
             logWarn(logger, "Invalid OAuth client redirect URI; remote OAuth disabled", {
                 client_id: client.client_id,
             });
-            return disabledOAuthConfig(sourcePath, envOverrides);
+            issues.push("An OAuth client has a missing or non-https/loopback redirect URI. Re-add the client with a valid --redirect-uri.");
+            return null;
         }
     }
     if (data.shared_secret?.enabled) {
         if (!data.shared_secret.secret_hash || !isSecretHash(data.shared_secret.secret_hash)) {
             logWarn(logger, "Invalid [http.oauth.shared_secret] secret_hash; remote OAuth disabled");
-            return disabledOAuthConfig(sourcePath, envOverrides);
+            issues.push("The OAuth shared-secret hash is missing or invalid. Reset it with `llm-cli-gateway oauth shared-secret set`.");
+            return null;
         }
     }
     if (data.registration_policy === "open_dev" && env.LLM_GATEWAY_OAUTH_OPEN_DEV !== "1") {
@@ -740,7 +783,8 @@ export function loadRemoteOAuthConfig(logger = noopLogger, env = process.env) {
     if (data.require_consent) {
         if (!data.consent_secret_hash || !isSecretHash(data.consent_secret_hash)) {
             logWarn(logger, "[http.oauth].require_consent is set but consent_secret_hash is missing/invalid; remote OAuth disabled");
-            return disabledOAuthConfig(sourcePath, envOverrides);
+            issues.push("require_consent is set but the consent secret hash is missing or invalid. Set it with `llm-cli-gateway oauth shared-secret set` or LLM_GATEWAY_OAUTH_CONSENT_SECRET.");
+            return null;
         }
     }
     return {
@@ -769,3 +813,45 @@ export function loadRemoteOAuthConfig(logger = noopLogger, env = process.env) {
         sources: { configFile: sourcePath, envOverrides },
     };
 }
+export function diagnoseRemoteOAuthConfig(logger = noopLogger, env = process.env) {
+    const configPath = defaultGatewayConfigPath();
+    const { parsed: configFile, sourcePath } = readGatewayTomlFile(configPath, logger, "OAuth");
+    const rawHttp = configFile?.http ?? {};
+    const rawOAuth = rawHttp.oauth ?? {};
+    const { merged, envOverrides } = mergeOAuthEnvOverrides(rawOAuth, env);
+    const configured = Object.keys(rawOAuth).length > 0 || envOverrides.length > 0;
+    const parsed = OAuthConfigSchema.safeParse(merged);
+    if (!parsed.success) {
+        logWarn(logger, "Invalid [http.oauth] config; remote OAuth disabled", {
+            error: parsed.error.message,
+        });
+        return {
+            config: disabledOAuthConfig(sourcePath, envOverrides),
+            status: "malformed",
+            configured: true,
+            issues: [
+                "The [http.oauth] config is invalid (schema validation failed); remote OAuth is disabled.",
+            ],
+        };
+    }
+    const data = parsed.data;
+    const issues = [];
+    const built = validateParsedOAuthConfig(data, env, sourcePath, envOverrides, logger, issues);
+    if (!built) {
+        return {
+            config: disabledOAuthConfig(sourcePath, envOverrides),
+            status: data.enabled ? "malformed" : configured ? "disabled" : "absent",
+            configured,
+            issues: data.enabled ? issues : [],
+        };
+    }
+    const status = built.enabled
+        ? "enabled"
+        : configured
+            ? "disabled"
+            : "absent";
+    return { config: built, status, configured, issues: [] };
+}
+export function loadRemoteOAuthConfig(logger = noopLogger, env = process.env) {
+    return diagnoseRemoteOAuthConfig(logger, env).config;
+}

package/dist/connector-setup.d.ts

@@ -0,0 +1,39 @@
+import { type RemoteHttpOAuthReadiness } from "./doctor.js";
+import type { RemoteOAuthConfig } from "./auth.js";
+export declare const CONNECTOR_SETUP_SECRET_WARNING = "Never paste gateway bearer tokens, OAuth client secrets, OAuth access tokens, consent/shared secrets, tunnel tokens, or provider credentials into a remote chat transcript. Only the fields in this packet are safe to paste into a connector UI.";
+export interface ConnectorSetupOptions {
+    clientId?: string;
+    includeLegacyNoAuth?: boolean;
+}
+export interface ConnectorSetupPacket {
+    ok: boolean;
+    schema: "remote-connector-setup.v1";
+    ready: boolean;
+    stage: RemoteHttpOAuthReadiness["stage"];
+    auth_mode: RemoteHttpOAuthReadiness["auth_mode"];
+    connector: {
+        mcp_url: string | null;
+        authorization_url: string | null;
+        token_url: string | null;
+        client_id: string | null;
+        client_secret_required: boolean;
+        client_secret_source: string | null;
+    };
+    workspace: RemoteHttpOAuthReadiness["workspace"];
+    next_actions: string[];
+    warnings: string[];
+    legacy_no_auth?: {
+        deprecated: true;
+        connector_url: string | null;
+        note: string;
+    };
+}
+export declare function buildConnectorSetupPacket(input: {
+    readiness: RemoteHttpOAuthReadiness;
+    oauth: RemoteOAuthConfig;
+    options?: ConnectorSetupOptions;
+    legacyNoAuthUrl?: string | null;
+}): ConnectorSetupPacket;
+export declare function legacyNoAuthConnectorUrl(env?: NodeJS.ProcessEnv): string | null;
+export declare function gatherConnectorSetupPacket(options?: ConnectorSetupOptions, env?: NodeJS.ProcessEnv): ConnectorSetupPacket;
+export declare function renderConnectorSetupSummary(packet: ConnectorSetupPacket): string;