maka-agent 0.2.0-dev.3.20260830 → 0.2.0-dev.31.20260913

package/node_modules/@maka/runtime-host/dist/protocol/index.js

@@ -25,6 +25,7 @@ import { decodeConfigurationChangedFrame, } from './configuration-change.js';
 import { decodeSessionCatalogChangedFrame, } from './session-catalog-change.js';
 import { decodeScheduledTaskChangedFrame, } from './scheduled-task-change.js';
 import { decodeProjectCatalogChangedFrame, } from './project-catalog-change.js';
+import { decodeConnectionCatalogChangedFrame, } from './connection-catalog-change.js';
 import { decodeRequestFrame, decodeResponseFrame, } from './operations.js';
 import { isCanonicalRuntimeHostWebSocketPath } from './websocket-path.js';
 export * from './access-authority.js';
@@ -33,8 +34,10 @@ export * from './interaction.js';
 export * from './daily-review.js';
 export * from './client-capability.js';
 export * from './configuration-change.js';
+export * from './connection-catalog-change.js';
 export * from './goal.js';
 export * from './hosted-execution.js';
+export * from './host-resources.js';
 export * from './plan.js';
 export * from './peer-mesh.js';
 export * from './project-catalog.js';
@@ -51,7 +54,7 @@ export * from './scheduled-task-change.js';
 export * from './session-retirement.js';
 export * from './session-transcript.js';
 export * from './session-turns.js';
-export * from './task-ledger.js';
+export * from './session-todo.js';
 export * from './workspace.js';
 export * from './workhub-coordination.js';
 export * from './websocket-path.js';
@@ -59,12 +62,205 @@ export const RUNTIME_HOST_REGISTRATION_SCHEMA_VERSION = 1;
 export const RUNTIME_HOST_PROTOCOL_VERSION = 0;
 // Increment when the same protocol version no longer guarantees safe Client-Host
 // interoperability. Mismatches are rejected before domain commands are admitted.
-export const RUNTIME_HOST_COMPATIBILITY_EPOCH = 74;
+export const RUNTIME_HOST_COMPATIBILITY_EPOCH = 151;
+// 151: WorkHub selects and delegates through a durable Host Form interaction.
+// 150: Message admission accepts an empty-text Message that carries a quote or
+// an attachment (#4804). Peers older than this epoch reject that frame at
+// admission, so the pair must refuse each other at the handshake.
+// 149: Connection model overrides retain disabled identities and separate capacity
+// from compaction. Catalog entries carry overrides; clients do not rebuild them.
+// 148: Model catalog entries include image support before a user override.
+// 147: OAuth create targets may carry a caller-selected Connection name and
+// slug, and slug collisions remain a closed typed error before or after
+// authorization. Older peers reject those strict input and output shapes.
+// 146: Code Mode settings and Session tool mode join the epoch-145 Host contract.
+// 145: Combine Antigravity setup with Session bundle Host operations and explicit
+// missing/archived Skill query refusals.
+// 144: Antigravity setup combined with explicit missing/archived Skill query refusals.
+// 143: Session bundle export and import are Host operations. Pre-merge Antigravity
+// builds also advertised 143 without this contract and remain incompatible.
+// 142: Invocable Skill queries expose missing and archived Session refusals explicitly.
+// 141: WorkHub root admissions bind model Intent/Recall decisions before actions.
+// 140: Plugin Platform queries expose scoped Command contribution projections.
+// Epoch-139 peers reject the added query view and result shape.
+// 139: WorkHub recovery preserves the Host-authenticated Desktop capability binding.
+// 138: Removes the unused steering display anchor from canonical MessageContent.
+// 137: Reserved by the former display anchor contract.
+// 136: WorkHub transient proposals distinguish routing dispositions from linked
+// operations. Older peers expect replace/stop_work/resume_work dispositions.
+// 135: WorkHub model Turns replace direct action proposals with active-Turn task tools.
+// 134: Coordination actions own real Runtime Turns. Removes the synthetic record
+// operation, projects typed action receipts and admitted action identities, and
+// distinguishes stale candidate refusals and resumable transcript preparation.
+// 133: WorkHub actions carry attachments and new-Work model/permission defaults.
+// Epoch-132 peers reject these additional fields on strict action shapes.
+// 132: new Tool Result archives use versioned ledger references, not Artifact payloads.
+// 131: Logical model steps bind durable Request Composition identities.
+// 130: Turn contributions carry the optional bounded `failureMessage` diagnostic.
+// Epoch-129 peers reject this added field on the strict contribution shape.
+// 129: Turn states and Turn records drop `partialOutputRetained`. The fact was
+// derived twice — once from the Turn's output rows, once off the state message
+// — and read by nothing; older peers require the field on both.
+// 128: Session transcript bootstraps drop `durableCoverage`. A durable sequence
+// is an event ordinal times its stride, so no projection has contiguous
+// sequences any more and the claim the field made is unavailable to make.
+// 127: Session Turn contributions carry only the Turn's recorded state. Older
+// peers require the derived shape booleans this projection no longer sends.
+// 126: Durable transcript cursors seek Session event ordinals instead of run indexes.
+// 125: Live Turn snapshots carry an optional `rootExecutionKind:'context_compact'`
+// so a running context-compaction Turn can render a transcript row. Epoch-124
+// peers reject the added optional field on the strict live snapshot shape.
+// 124: PTY delivery is independent of the ordered Session state stream. A
+// bounded PTY overflow requests terminal-only snapshot recovery.
+// 123: Failed turns carry canonical retry decisions through bounded projections.
+// 122: Authenticated physical handoff continuations retain logical Turn identity.
+// Older peers cannot decode the handoff source and sealed invocation facts.
+// 121: Host diagnostics report `upgradeBlockingActivity`, the Host's
+// authoritative activity answer for maintenance probes, computed by the same
+// authority that gates `host.upgrade.prepare`. Older Clients reject the
+// unknown key when decoding diagnostics, so the pair must refuse each other
+// at the handshake.
+// 120: WorkHub admits named resume proposals with an explicit resumesActionId
+// and returns a transient resume outcome. Older peers cannot decode this action.
+// 119: Session Guest principals expose optional display names and an owner-only
+// rename command. Older peers reject named principal projections.
+// 118: External-session import publishes distinct `model_unavailable` and
+// `source_unreadable` error codes so the shell classifies failures by code
+// instead of the redacted message. Older peers cannot decode the new codes.
+// 117: WorkHub exposes only one correction linkage per bounded candidate and
+// no longer returns the Host's complete active-link set.
+// 116: User deletion rejects workflow-owned Artifacts with operation_conflict.
+// 115: Artifact creation requires explicit source ownership.
+// 114: Artifacts are physically deleted and no longer expose tombstone status.
+// 113: Client Capability tool schemas add `patternProperties` and draft-07 tuple
+// `additionalItems`; validation and projection share one per-keyword shape table.
+// Older peers reject these keywords and fail the handshake.
+// 112: Owners can query the Host execution environment through an extensible,
+// bounded resource-envelope contract. Older Hosts do not implement the query.
+// 111: Client Capability tool schemas may use draft-07 tuple additionalItems.
+// Older Hosts reject the keyword, so peers must agree before capabilities are admitted.
+// 110: Runtime Host is the sole schema-migration authority for its State Root.
+// Epoch 109 Desktop builds could migrate the event-only AgentRun schema while
+// an older service Host still held the root, leaving that Host querying a
+// removed column. Reject the affected mixed generation before either process
+// admits domain work; the installation owner can then replace the Host.
+// 109: accepted Client Capability invocations may carry one bounded nested form
+// Interaction request/result round trip.
+// 108: Session Interaction snapshots, forwarded Runtime events, and Agent Graph
+// activity may carry the provider-neutral `form` request/answer contract.
+// 107: `token_usage` anchors record the model and connection that produced
+// them. The record decodes against a closed allowlist, so an older client
+// rejects the two new keys and, with them, the Session that carries them.
+// 106: Session transcripts gain five `system_note` kinds
+// (`context_provider_dropping`, `context_window_suggestion`,
+// `context_window_overrun`, `context_reported_window_exceeded`,
+// `context_overflow_after_compaction`) and
+// `token_usage` records reshape `lastRequestAnchor` to
+// `{ inputTokens, outputTokens }`, all behind closed allowlists in
+// @maka/core. An older client that handshakes would fail
+// `decodeStoredMessage` on the first transcript carrying them, so the pair
+// must refuse each other at the handshake instead (#4559).
+// 105: Usage summaries may carry the recorded call-time total and per-Session
+// tool-invocation totals. Older Clients reject the unknown fields, so a newer
+// Host's usage summary is unreadable to them.
+// 104: WorkHub Coordination actions add closed direct-stop proposals,
+// confirmations, expected-state preconditions, and outcomes. Older peers
+// reject these strict shapes.
+// 103: `github-copilot` joins `OAUTH_LOGIN_PROVIDERS`, the Host answers the
+// closed `oauth.enrollment.query`, and `connection.onboarding.save` admits
+// canonical OAuth material with an empty enable-all-discovered selection.
+// Older peers reject these wire values, so incompatible pairs must fail the
+// handshake. Re-derived from current `main`; epoch 102 is claimed by open PRs.
+// 101: Session Turn requests can carry regeneration intents and Guests can
+// atomically withdraw pending requests. Older peers do not share this command
+// vocabulary or the expanded Guest operation grant.
+// 100: `session.branch.create` makes `sourceTurnId` optional, so a side
+// conversation can fork with an empty context (no copied messages, no
+// fabricated `branchOfTurnId`) instead of requiring a settled turn. An older
+// Host's required-field check rejects the request that omits `sourceTurnId`;
+// the handshake keeps mixed-version peers apart. `session.revision.create`
+// still requires `sourceTurnId`, and its wire shape and fingerprint are
+// unchanged.
+// 99: ScheduledTask Agent execution templates carry immutable Connection
+// identity. Older peers cannot preserve the ID/slug/model binding and could
+// silently route a deleted Connection to a same-slug replacement.
+// 98: Peer Mesh invitations carry signed reachability leases and member route
+// projections use the convergent recovery state machine. Older peers decode a
+// different strict wire shape.
+// 97: Host status replaces unsigned route arrays with a self-signed, bounded
+// reachability lease. Older peers cannot validate the locator revision or its
+// target identity before retaining it for reconnect.
+// 96: Read image tool results may carry durable `session_context` refs.
+// 95: Catalog entries carry `describedByMetadata`, so a client asks the
+// Host-resolved entry — not its own bundled table — whether a model needs a
+// hand-written capability declaration. The field is required, so a newer Host's
+// entry fails an older client's strict decoder, and an older Host's entry
+// (lacking it) fails a newer client's.
+// 94: A failed Turn snapshot no longer carries contextBudgetExhaustedDetail; the
+// retired outcome reads as context_overflow at the ledger boundary, and an older
+// Host still sending the field fails a newer client's closed snapshot decode.
+// 93: Configuration credential transfer binds proxy destinations and
+// Connection credentials to exact Host-owned targets before secret access.
+// Proxy policy and credentials commit through one recoverable Host command;
+// older peers can split the writes and violate the shared credential basis.
+// 92: Owners can query their complete pending Session Turn-request inbox.
+// 91: Host status publishes the live Direct peer endpoint so newly issued
+// connection invitations do not preserve stale startup routes.
+// 90: `session.create.mode` accepts the Bot session mode. A Host that predates
+// it rejects the value as an invalid Session start mode.
+// 89: The Host refreshes its models.dev catalog at startup and announces the
+// swap with a `connection.catalog.changed` frame, which an older client's
+// strict frame decoder rejects as an unknown kind.
+// 88: Catalog model modalities admit video on either side and pdf as output.
+// models.dev declares both, and the modality decoder rejects any value it does
+// not name, so a newer Host describing such a model fails an older client's
+// catalog decode outright rather than losing one field. The handshake keeps
+// that pairing from forming; a newer client simply never sees the new values
+// from an older Host.
+// 87: The connection catalog projects each model as the Host resolved it —
+// a `catalog_entry` item per model, counted by the connection header. Clients
+// render those entries instead of merging the stored row against their own
+// bundled model metadata, so a Desktop and a TUI attached to one Host cannot
+// describe the same model differently. An older client ignores the new items
+// but would still resolve locally; an older Host sends none, leaving a newer
+// client with an empty catalog. Both are rejected at the handshake.
+// 86: Client Capability accepted frames carry typed admission evidence used to
+// enforce Session Grant scopes. Older peers cannot preserve that boundary.
+// 85: Plugin package and Entry composition operations become Host-owned protocol
+// surfaces. Older peers cannot safely exchange these strict operation shapes.
+// 84: Message content carries Host-bound directory references. Older peers
+// reject this field and cannot preserve its identity through admission/replay.
+// 83: WorkHub Coordination actions add linked replacement proposals,
+// destructive user confirmation, and replacement results. Older peers reject
+// these closed action and result shapes.
+// 82: Session removal reports how many linked subtasks it archived, and adds a
+// `session.remove.preview` query for that count before the delete. Older peers
+// reject the extra removed-result field and the unknown operation.
+// 81: SessionTodo replaces the Task Ledger protocol and continuity domain with
+// one bounded current-state snapshot. Older peers cannot decode the operation
+// or preserve the new invalidation vocabulary.
+// 80: Runtime Policy catalog models gained validated user-overridden fact
+// provenance. Older peers reject this projected model shape, so they must be
+// refused during the handshake before catalog admission.
+// 79: Every `turn.message.submit` disposition carries the exact Skill
+// invocation outcome. Durable queued replays may omit the previous Host
+// Epoch's transient queue revision; older strict peers reject either shape.
+// 78: OAuth login targets explicit create/existing Connection entities and
+// returns their canonical identity. Older peers reject both closed wire shapes.
+// 77: LLM and tool usage-log projections carry an optional `sessionTitle` (the
+// Host-resolved session name for the usage Task column). Older Clients reject
+// the unknown field, so a newer Host's usage logs are unreadable to them.
+// 76: Peer Mesh endpoint and Mesh display names are signed, persisted facts
+// managed through Host operations rather than local-only Client labels.
+// 75: Peer Mesh routes identify whether a peer is a Client or Runtime Host so
+// management surfaces can present the endpoint authority boundary accurately.
 // 74: Capability-provider credentials may carry one Host-authenticated owner
 // identity. Older peers cannot preserve the association and could select an
 // unrelated provider for an interactive Session.
 // 73: Transcript pages carry a Host-owned Turn range boundary. Older peers
 // cannot preserve both the complete edge Turn and the bounded projection.
+// 72: Collaboration Turn request query results require `canRequestTurns`.
+// Older peers reject the new closed result shape.
 // 71: Session Guests can submit durable exact Turn access requests and Owners
 // can decide them. Older peers do not understand this execution-authority flow.
 // 70: Session Guest connections receive resource-scoped shared catalog and
@@ -209,6 +405,7 @@ export function decodeClientFrame(value) {
         }
         return {
             kind: 'hello',
+            ...(frame.activitySnapshotVersion === 2 ? { activitySnapshotVersion: 2 } : {}),
             clientInstanceId: requireClientInstanceId(frame.clientInstanceId),
             protocolMin,
             protocolMax,
@@ -226,8 +423,12 @@ export function decodeClientFrame(value) {
 export function decodeHostFrame(value) {
     const frame = requireRecord(value, 'host frame');
     if (frame.kind === 'accepted') {
+        if (frame.cooperativeHandoff !== undefined && frame.cooperativeHandoff !== true) {
+            throw invalidProtocolFrame('Invalid Runtime Host cooperative handoff capability');
+        }
         return {
             kind: 'accepted',
+            ...(frame.cooperativeHandoff === true ? { cooperativeHandoff: true } : {}),
             rootId: requireHostRootId(frame.rootId),
             hostEpoch: requireId(frame.hostEpoch, 'hostEpoch'),
             connectionId: requireId(frame.connectionId, 'connectionId'),
@@ -275,6 +476,9 @@ export function decodeHostFrame(value) {
     }
     if (frame.kind === 'configuration.changed')
         return decodeConfigurationChangedFrame(frame);
+    if (frame.kind === 'connection.catalog.changed') {
+        return decodeConnectionCatalogChangedFrame(frame);
+    }
     if (frame.kind === 'project.catalog.changed')
         return decodeProjectCatalogChangedFrame(frame);
     if (frame.kind === 'session.catalog.changed')

package/node_modules/@maka/runtime-host/dist/protocol/message.js

@@ -19,7 +19,7 @@
 import { invalidProtocolFrame } from './errors.js';
 import { assertExactKeys, requireCount, requireEntityId, requireExactRecord, requireId, requireRecord, requireShapedRecord, requireUtf8String, } from './codec.js';
 import { defineOperation } from './operation-spec.js';
-import { decodeMessageContent, decodeMessageAdmissionContent, decodeSkillIds, decodeTurnOrchestration, decodeTurnSnapshot, TURN_MESSAGE_TEXT_MAX_BYTES, } from './turn.js';
+import { decodeMessageAdmissionContent, decodeSkillIds, decodeTurnOrchestration, decodeTurnSnapshot, TURN_MESSAGE_TEXT_MAX_BYTES, } from './turn.js';
 import { decodeSkillInvocationResult } from '@maka/core/skill-invocation';
 export const MESSAGE_QUEUE_MAX_ENTRIES = 64;
 export const MESSAGE_QUEUE_PROJECTION_MAX_BYTES = 52 * 1024;
@@ -224,13 +224,15 @@ function decodeTurnMessageExecutionQueryResult(value) {
 function decodeTurnMessageSubmitResult(value) {
     const record = requireRecord(value, 'turn.message.submit result');
     if (record.disposition === 'turn_started') {
-        const shaped = requireShapedRecord(record, 'turn.message.submit turn_started result', ['disposition', 'turnId'], ['skillInvocation']);
+        assertExactKeys(record, 'turn.message.submit turn_started result', [
+            'disposition',
+            'turnId',
+            'skillInvocation',
+        ]);
         return {
             disposition: 'turn_started',
-            turnId: requireEntityId(shaped.turnId, 'turnId'),
-            ...(shaped.skillInvocation !== undefined
-                ? { skillInvocation: decodeSubmitSkillInvocation(shaped.skillInvocation) }
-                : {}),
+            turnId: requireEntityId(record.turnId, 'turnId'),
+            skillInvocation: decodeSubmitSkillInvocation(record.skillInvocation),
         };
     }
     if (record.disposition === 'blocked') {
@@ -245,10 +247,13 @@ function decodeTurnMessageSubmitResult(value) {
         return { disposition: 'blocked', skillInvocation };
     }
     if (record.disposition === 'steering' || record.disposition === 'followup') {
-        assertExactKeys(record, 'turn.message.submit queued result', ['disposition', 'queueRevision']);
+        const shaped = requireShapedRecord(record, 'turn.message.submit queued result', ['disposition', 'skillInvocation'], ['queueRevision']);
         return {
             disposition: record.disposition,
-            queueRevision: requireCount(record.queueRevision, 'queueRevision'),
+            ...(shaped.queueRevision !== undefined
+                ? { queueRevision: requireCount(shaped.queueRevision, 'queueRevision') }
+                : {}),
+            skillInvocation: decodeSubmitSkillInvocation(shaped.skillInvocation),
         };
     }
     throw invalidProtocolFrame('Invalid turn.message.submit disposition');
@@ -427,7 +432,7 @@ function decodeMessageQueueEntrySnapshot(value) {
     const base = {
         entryId: requireEntityId(record.entryId, 'entryId'),
         messageId: requireEntityId(record.messageId, 'messageId'),
-        content: decodeMessageContent(record.content),
+        content: decodeMessageAdmissionContent(record.content),
         placement: requireMessagePlacement(record.placement),
     };
     if (record.state === 'queued' || record.state === 'retracted') {

package/node_modules/@maka/runtime-host/dist/protocol/network-proxy.js

@@ -19,7 +19,6 @@
 import { requireEncodedByteLimit, requireExactRecord, requireShapedRecord, requireUtf8String, } from './codec.js';
 import { invalidProtocolFrame } from './errors.js';
 import { defineOperation } from './operation-spec.js';
-const SECRET_MAX_BYTES = 16 * 1024;
 const RESULT_MAX_BYTES = 8 * 1024;
 const ERRORS = [
     'host_not_ready',
@@ -38,16 +37,11 @@ export const NETWORK_PROXY_OPERATION_SPECS = {
     }),
 };
 function decodeNetworkProxyTestInput(value) {
-    const input = requireShapedRecord(value, 'network proxy test input', [], ['networkProxy', 'password', 'url', 'timeoutMs']);
+    const input = requireShapedRecord(value, 'network proxy test input', [], ['networkProxy', 'url', 'timeoutMs']);
     return {
         ...(input.networkProxy === undefined
             ? {}
             : { networkProxy: decodeNetworkProxy(input.networkProxy) }),
-        ...(input.password === undefined
-            ? {}
-            : {
-                password: requireUtf8String(input.password, 'network proxy password', SECRET_MAX_BYTES),
-            }),
         ...(input.url === undefined ? {} : { url: decodeProbeUrl(input.url) }),
         ...(input.timeoutMs === undefined
             ? {}

package/node_modules/@maka/runtime-host/dist/protocol/oauth.js

@@ -16,6 +16,7 @@
  * specific language governing permissions and limitations
  * under the License.
  */
+import { decodeConnectionName, decodeConnectionSlug, RuntimePolicyDomainDecodeError, } from '@maka/core/runtime-policy';
 import { requireEntityId, requireExactRecord, requireRecord, requireShapedRecord, requireString, } from './codec.js';
 import { invalidProtocolFrame } from './errors.js';
 import { defineOperation } from './operation-spec.js';
@@ -23,7 +24,7 @@ export const OAUTH_PRESENTATION_SERVICE_ID = 'oauth_presentation';
 export const OAUTH_PRESENTATION_SERVICE_VERSION = '1';
 export const OAUTH_PRESENTATION_URL_MAX_LENGTH = 8_192;
 export const OAUTH_PRESENTATION_STATE_HINT_MAX_LENGTH = 1_024;
-export const OAUTH_LOGIN_PROVIDERS = ['openai-codex', 'xai-oauth'];
+export const OAUTH_LOGIN_PROVIDERS = ['openai-codex', 'xai-oauth', 'github-copilot'];
 export const OAUTH_LOGIN_PHASES = [
     'awaiting_authorization',
     'exchanging',
@@ -36,7 +37,9 @@ export const OAUTH_LOGIN_FAILURE_CODES = [
     'capability_unavailable',
     'authorization_failed',
     'provider_rejected',
+    'slug_taken',
     'credential_changed',
+    'connection_changed',
     'persistence_failed',
     'internal_failure',
 ];
@@ -50,11 +53,12 @@ const COMMON_ERRORS = [
 const START_ERRORS = [
     ...COMMON_ERRORS,
     'operation_conflict',
+    'slug_taken',
     'capability_unavailable',
     'not_found',
     'persistence_failed',
 ];
-const ATTEMPT_ERRORS = [...COMMON_ERRORS, 'not_found'];
+const ATTEMPT_ERRORS = [...COMMON_ERRORS, 'not_found', 'persistence_failed'];
 export const OAUTH_OPERATION_SPECS = {
     'oauth.login.start': defineOperation({
         mode: 'command',
@@ -62,6 +66,7 @@ export const OAUTH_OPERATION_SPECS = {
         errors: START_ERRORS,
         decodeInput: decodeOAuthLoginStartInput,
         decodeOutput: decodeOAuthLoginProjection,
+        assertOutputForInput: assertOAuthStartOutput,
     }),
     'oauth.login.query': defineOperation({
         mode: 'query',
@@ -69,6 +74,7 @@ export const OAUTH_OPERATION_SPECS = {
         errors: ATTEMPT_ERRORS,
         decodeInput: decodeOAuthLoginAttemptInput,
         decodeOutput: decodeOAuthLoginProjection,
+        assertOutputForInput: assertOAuthAttemptOutput,
     }),
     'oauth.login.cancel': defineOperation({
         mode: 'control',
@@ -76,33 +82,123 @@ export const OAUTH_OPERATION_SPECS = {
         errors: ATTEMPT_ERRORS,
         decodeInput: decodeOAuthLoginAttemptInput,
         decodeOutput: decodeOAuthLoginProjection,
+        assertOutputForInput: assertOAuthAttemptOutput,
+    }),
+    'oauth.enrollment.query': defineOperation({
+        mode: 'query',
+        availability: 'ready',
+        errors: COMMON_ERRORS,
+        decodeInput: decodeOAuthEnrollmentQueryInput,
+        decodeOutput: decodeOAuthEnrollmentProjection,
     }),
 };
 export function decodeOAuthLoginStartInput(value) {
-    const input = requireExactRecord(value, 'OAuth login start input', ['attemptId', 'connectionId']);
+    const input = requireExactRecord(value, 'OAuth login start input', ['attemptId', 'target']);
     return {
         attemptId: requireEntityId(input.attemptId, 'attemptId'),
-        connectionId: requireEntityId(input.connectionId, 'connectionId'),
+        target: decodeOAuthLoginTarget(input.target),
     };
 }
 export function decodeOAuthLoginAttemptInput(value) {
     const input = requireExactRecord(value, 'OAuth login attempt input', ['attemptId']);
     return { attemptId: requireEntityId(input.attemptId, 'attemptId') };
 }
+export function decodeOAuthEnrollmentQueryInput(value) {
+    const input = requireExactRecord(value, 'OAuth enrollment query input', ['provider']);
+    return { provider: oauthLoginProvider(input.provider) };
+}
+export function decodeOAuthEnrollmentProjection(value) {
+    const projection = requireExactRecord(value, 'OAuth enrollment projection', [
+        'provider',
+        'enabled',
+    ]);
+    if (typeof projection.enabled !== 'boolean') {
+        throw invalidProtocolFrame('Invalid OAuth enrollment projection');
+    }
+    return {
+        provider: oauthLoginProvider(projection.provider),
+        enabled: projection.enabled,
+    };
+}
 export function decodeOAuthLoginProjection(value) {
     const projection = requireRecord(value, 'OAuth login projection');
     const phase = oauthLoginPhase(projection.phase);
     const exact = requireExactRecord(projection, 'OAuth login projection', phase === 'failed'
-        ? ['attemptId', 'connectionId', 'provider', 'phase', 'failure']
-        : ['attemptId', 'connectionId', 'provider', 'phase']);
+        ? ['attemptId', 'connection', 'phase', 'failure']
+        : ['attemptId', 'connection', 'phase']);
     return {
         attemptId: requireEntityId(exact.attemptId, 'attemptId'),
-        connectionId: requireEntityId(exact.connectionId, 'connectionId'),
-        provider: oauthLoginProvider(exact.provider),
+        connection: decodeOAuthConnectionIdentity(exact.connection),
         phase,
         ...(phase === 'failed' ? { failure: oauthLoginFailure(exact.failure) } : {}),
     };
 }
+function decodeOAuthLoginTarget(value) {
+    const target = requireRecord(value, 'OAuth login target');
+    if (target.kind === 'create') {
+        const exact = requireShapedRecord(target, 'OAuth create target', ['kind', 'providerType'], ['slug', 'name']);
+        const providerType = oauthLoginProvider(exact.providerType);
+        if (providerType !== 'openai-codex') {
+            if (exact.slug !== undefined || exact.name !== undefined) {
+                throw invalidProtocolFrame('Custom OAuth Connection identity is only supported for openai-codex');
+            }
+            return { kind: 'create', providerType };
+        }
+        return {
+            kind: 'create',
+            providerType,
+            ...(exact.slug === undefined
+                ? {}
+                : { slug: decodeDomain(() => decodeConnectionSlug(exact.slug)) }),
+            ...(exact.name === undefined
+                ? {}
+                : { name: decodeDomain(() => decodeConnectionName(exact.name)) }),
+        };
+    }
+    if (target.kind === 'existing') {
+        const exact = requireExactRecord(target, 'OAuth existing target', ['kind', 'connectionId']);
+        return { kind: 'existing', connectionId: requireEntityId(exact.connectionId, 'connectionId') };
+    }
+    throw invalidProtocolFrame('Invalid OAuth login target');
+}
+function decodeOAuthConnectionIdentity(value) {
+    const connection = requireExactRecord(value, 'OAuth connection identity', [
+        'connectionId',
+        'slug',
+        'providerType',
+    ]);
+    return {
+        connectionId: requireEntityId(connection.connectionId, 'connectionId'),
+        slug: decodeDomain(() => decodeConnectionSlug(connection.slug)),
+        providerType: oauthLoginProvider(connection.providerType),
+    };
+}
+function assertOAuthStartOutput(input, output) {
+    assertOAuthAttemptOutput(input, output);
+    if ((input.target.kind === 'create' &&
+        (output.connection.providerType !== input.target.providerType ||
+            (input.target.slug !== undefined && output.connection.slug !== input.target.slug))) ||
+        (input.target.kind === 'existing' &&
+            output.connection.connectionId !== input.target.connectionId)) {
+        throw invalidProtocolFrame('OAuth login start changed Connection identity');
+    }
+}
+function assertOAuthAttemptOutput(input, output) {
+    if (input.attemptId !== output.attemptId) {
+        throw invalidProtocolFrame('OAuth login changed attempt identity');
+    }
+}
+function decodeDomain(operation) {
+    try {
+        return operation();
+    }
+    catch (error) {
+        if (error instanceof RuntimePolicyDomainDecodeError) {
+            throw invalidProtocolFrame(error.message);
+        }
+        throw error;
+    }
+}
 export function decodeOAuthPresentationRequest(method, value) {
     if (method === 'open_external') {
         const input = requireShapedRecord(value, 'OAuth presentation input', ['url'], ['stateHint']);