melchizedek-agents 1.2.0 → 1.3.1

package/dist/lib/tools/oauthTools.d.ts

@@ -61,7 +61,8 @@
  */
 import type { OAuthProvider } from './auth.ts';
 import type { OAuthHostAllowlist } from './oauthHosts.ts';
-import type { OAuthClientConfig } from './oauthConsent.ts';
+import type { OAuthClientConfig, OAuthClientSource } from './oauthConsent.ts';
+import type { DynamicOAuthGrant } from './oauthDiscovery.ts';
 import type { ToolContext } from './tool.ts';
 /** The `oauth2` block of an `auth` (OpenAPI) or an `mcp_auth` (MCP). */
 export interface OAuth2AuthConfig {
@@ -70,8 +71,14 @@ export interface OAuth2AuthConfig {
     grant: 'authorization_code' | 'client_credentials';
     /** The provider's authorization endpoint (authorization_code only). */
     authorization_url?: string;
-    /** The provider's token endpoint. */
-    token_url: string;
+    /** The provider's token endpoint. Absent only with `client_registration: 'dynamic'`, which discovers it. */
+    token_url?: string;
+    /**
+     * `'dynamic'` (MCP servers, authorization_code only, ADR 0124): no
+     * pre-issued client. The authorization server is discovered from the MCP
+     * server and the deployment registers itself (lib/tools/oauthDiscovery.ts).
+     */
+    client_registration?: 'dynamic';
     /** The client id, written out (it is not a secret) … */
     client_id?: string;
     /** … or the environment variable holding it. */
@@ -94,7 +101,7 @@ export interface OAuthGrantUse {
     tools: string;
     oauth2: OAuth2AuthConfig;
 }
-/** An agent's declared OAuth grants, OpenAPI entries first, then its MCP server. */
+/** An agent's declared OAuth grants, OpenAPI entries first, then its MCP server, then each of its `mcp_servers` (ADR 0124). */
 export declare function agentOAuthGrants(agent: {
     name?: string;
     openapi?: Array<{
@@ -107,6 +114,12 @@ export declare function agentOAuthGrants(agent: {
     mcp_auth?: {
         oauth2?: OAuth2AuthConfig;
     };
+    mcp_servers?: Array<{
+        url?: string;
+        auth?: {
+            oauth2?: OAuth2AuthConfig;
+        };
+    }>;
 }, prefix?: string): OAuthGrantUse[];
 /** The environment variables a grant reads, by role. */
 export declare function oauthEnvNames(oauth2: OAuth2AuthConfig): string[];
@@ -187,12 +200,24 @@ interface AgentLike {
     mcp_auth?: {
         oauth2?: OAuth2AuthConfig;
     };
+    mcp_servers?: Array<{
+        url?: string;
+        auth?: {
+            oauth2?: OAuth2AuthConfig;
+        };
+    }>;
     yaml_reference?: string;
 }
 interface SyndicateLike {
     orchestrator?: AgentLike;
     subagents?: AgentLike[];
 }
+/** The options oauthClientsFor and dynamicOAuthGrantsFor share. */
+interface ClientsForOptions {
+    env?: NodeJS.ProcessEnv;
+    load?: (ref: string) => SyndicateLike;
+    allowlist?: OAuthHostAllowlist | null;
+}
 /**
  * The OAuth clients the consent step needs for these syndicates' declared
  * authorization-code grants, by provider: pass them as
@@ -200,13 +225,19 @@ interface SyndicateLike {
  * secrets are read from the variables the YAML names. Two declarations of
  * one provider must agree on its endpoints, client and scopes, or this
  * throws: a provider's grant is one grant, whichever tool asks for it.
- * `load` reads a nested `yaml_reference:` file, when given.
+ * `load` reads a nested `yaml_reference:` file, when given. A grant with
+ * `client_registration: dynamic` has no client until it is registered: it
+ * is in `dynamicOAuthGrantsFor`, not here.
  */
-export declare function oauthClientsFor(configs: readonly SyndicateLike[], options?: {
-    env?: NodeJS.ProcessEnv;
-    load?: (ref: string) => SyndicateLike;
-    allowlist?: OAuthHostAllowlist | null;
-}): Record<string, OAuthClientConfig>;
+export declare function oauthClientsFor(configs: readonly SyndicateLike[], options?: ClientsForOptions): Record<string, OAuthClientConfig>;
+/**
+ * The dynamic grants these syndicates declare (`client_registration:
+ * dynamic`, ADR 0124), by provider, checked as oauthClientsFor checks the
+ * others (one grant per provider, the MCP server on the allowlist): each
+ * becomes a consent client through `dynamicOAuthClient`
+ * (lib/tools/oauthDiscovery.ts).
+ */
+export declare function dynamicOAuthGrantsFor(configs: readonly SyndicateLike[], options?: ClientsForOptions): Record<string, DynamicOAuthGrant>;
 /**
  * Every OAuth grant these syndicates declare, orchestrators and subagents,
  * following a nested `yaml_reference:` through `load` when given (once per
@@ -230,10 +261,11 @@ export declare function syndicateOAuthHostProblems(configs: readonly SyndicateLi
  * (`credentialStore({ providers })`, lib/tools/credentialStore.ts): an
  * expired user token is renewed at the provider's token endpoint with its
  * refresh token (RFC 6749 6) instead of asking the person again. Built from
- * `oauthClientsFor`'s clients; `allowPrivate` lets a private or loopback
+ * `oauthClientsFor`'s clients, and from `dynamicOAuthClient`'s sources (a
+ * discovered client, ADR 0124); `allowPrivate` lets a private or loopback
  * token endpoint through the guard (development).
  */
-export declare function oauthRefreshProviders(clients: Record<string, OAuthClientConfig>, options?: {
+export declare function oauthRefreshProviders(clients: Record<string, OAuthClientConfig | OAuthClientSource>, options?: {
     allowPrivate?: boolean;
     fetch?: typeof fetch;
     timeoutMs?: number;

package/dist/lib/tools/oauthTools.js

@@ -64,7 +64,7 @@ import { PROVIDER_NAME, ToolCredentialError } from './auth.js';
 import { readCredentialEnv } from './credentialEnv.js';
 import { CLIENT_SECRET_ENV, clientSecretEnvOf, credentialCallProblem, credentialHostProblem } from './credentialHosts.js';
 import { oauthHostProblem, oauthHosts } from './oauthHosts.js';
-/** An agent's declared OAuth grants, OpenAPI entries first, then its MCP server. */
+/** An agent's declared OAuth grants, OpenAPI entries first, then its MCP server, then each of its `mcp_servers` (ADR 0124). */
 export function agentOAuthGrants(agent, prefix = '') {
     const name = `${prefix}${agent.name ?? ''}`;
     const out = [];
@@ -74,6 +74,10 @@ export function agentOAuthGrants(agent, prefix = '') {
     }
     if (agent.mcp_auth?.oauth2)
         out.push({ agent: name, tools: `mcp ${agent.mcp_server_url ?? ''}`, oauth2: agent.mcp_auth.oauth2 });
+    for (const server of agent.mcp_servers ?? []) {
+        if (server?.auth?.oauth2)
+            out.push({ agent: name, tools: `mcp ${server.url ?? ''}`, oauth2: server.auth.oauth2 });
+    }
     return out;
 }
 /** The environment variables a grant reads, by role. */
@@ -110,7 +114,9 @@ export function tokenTransportProblem(raw) {
 export function oauthGrantHostProblems(oauth2, servers, allowlist) {
     const list = allowlist === undefined ? oauthHosts() ?? null : allowlist;
     const urls = servers.map((s) => ['server', s]);
-    urls.push(['token_url', oauth2.token_url]);
+    // A dynamic grant names no endpoint: discovery checks each one it finds (lib/tools/oauthDiscovery.ts).
+    if (oauth2.token_url)
+        urls.push(['token_url', oauth2.token_url]);
     if (oauth2.authorization_url)
         urls.push(['authorization_url', oauth2.authorization_url]);
     const out = new Set();
@@ -285,22 +291,25 @@ export function oauthTokenSource(oauth2, where, server, options = {}) {
     const env = options.env ?? process.env;
     if (!oauth2.client_secret_env)
         throw new Error(`${where}: a client_credentials grant needs client_secret_env`);
-    const transport = tokenTransportProblem(oauth2.token_url);
+    const tokenUrl = oauth2.token_url;
+    if (!tokenUrl)
+        throw new Error(`${where}: a client_credentials grant needs token_url`);
+    const transport = tokenTransportProblem(tokenUrl);
     if (transport)
         throw new Error(`${where}: token_url: ${transport}`);
     if (options.allowPrivate !== true) {
-        const blocked = blockedHostReason(new URL(oauth2.token_url).hostname);
+        const blocked = blockedHostReason(new URL(tokenUrl).hostname);
         if (blocked)
-            throw new Error(`${where}: refusing token endpoint ${new URL(oauth2.token_url).hostname}: ${blocked}`);
+            throw new Error(`${where}: refusing token endpoint ${new URL(tokenUrl).hostname}: ${blocked}`);
     }
     // The client secret goes only to a host the operator binds its variable to (ADR 0122).
     const secretEnv = oauth2.client_secret_env;
-    const unbound = credentialHostProblem(secretEnv, oauth2.token_url, 'token_url');
+    const unbound = credentialHostProblem(secretEnv, tokenUrl, 'token_url');
     if (unbound)
         throw new Error(`${where}: ${unbound}`);
     const grant = clientCredentialsGrant({
         provider,
-        tokenUrl: oauth2.token_url,
+        tokenUrl,
         clientId: oauth2.client_id ?? readCredentialEnv(oauth2.client_id_env ?? '', where, env),
         clientSecret: readCredentialEnv(oauth2.client_secret_env, where, env),
         ...(oauth2.scopes?.length ? { scopes: [...oauth2.scopes] } : {}),
@@ -311,33 +320,47 @@ export function oauthTokenSource(oauth2, where, server, options = {}) {
         refuse(destination);
         // The client secret goes to the token endpoint: held to the same rule,
         // and to the credential host allowlist (ADR 0122).
-        refuse(oauth2.token_url);
-        if (credentialCallProblem(secretEnv, oauth2.token_url))
+        refuse(tokenUrl);
+        if (credentialCallProblem(secretEnv, tokenUrl))
             throw new ToolCredentialError('host_refused', provider, 'credential');
         return grant.token(ctx?.signal);
     };
 }
-/**
- * The OAuth clients the consent step needs for these syndicates' declared
- * authorization-code grants, by provider: pass them as
- * `oauthConsent({ providers })` (lib/tools/oauthConsent.ts). Client ids and
- * secrets are read from the variables the YAML names. Two declarations of
- * one provider must agree on its endpoints, client and scopes, or this
- * throws: a provider's grant is one grant, whichever tool asks for it.
- * `load` reads a nested `yaml_reference:` file, when given.
- */
-export function oauthClientsFor(configs, options = {}) {
+/** Every declared authorization-code grant, by provider: configured clients and dynamic grants, one grant per provider. */
+function collectOAuthClients(configs, options) {
     const env = options.env ?? process.env;
     const allowlist = options.allowlist === undefined ? oauthHosts(env) ?? null : options.allowlist;
     const clients = {};
+    const dynamic = {};
     const signature = new Map();
     for (const use of syndicateOAuthGrants(configs, options.load)) {
         const o = use.oauth2;
         if (o.grant !== 'authorization_code')
             continue;
         const where = `${use.agent} · ${use.tools} · oauth2`;
+        if (o.client_registration === 'dynamic') {
+            // Discovered and registered when first needed (ADR 0124): the MCP server is all the YAML names.
+            const server = use.tools.startsWith('mcp ') && use.tools.length > 4 ? use.tools.slice(4) : '';
+            if (!server)
+                throw new Error(`${where}: client_registration: dynamic is for an MCP server's grant`);
+            const hostProblems = oauthGrantHostProblems(o, [server], allowlist);
+            if (hostProblems.length)
+                throw new Error(`${where}: ${hostProblems.join('; ')}`);
+            const sig = JSON.stringify(['dynamic', server, [...(o.scopes ?? [])].sort(), o.authorization_params ?? {}]);
+            const before = signature.get(o.provider);
+            if (before !== undefined) {
+                if (before !== sig)
+                    throw new Error(`${where}: provider "${o.provider}" is declared twice with different endpoints, client or scopes`);
+                continue;
+            }
+            signature.set(o.provider, sig);
+            dynamic[o.provider] = { provider: o.provider, server, scopes: [...(o.scopes ?? [])], ...(o.authorization_params ? { authorizationParams: { ...o.authorization_params } } : {}) };
+            continue;
+        }
         if (!o.authorization_url)
             throw new Error(`${where}: an authorization_code grant needs authorization_url`);
+        if (!o.token_url)
+            throw new Error(`${where}: an authorization_code grant needs token_url`);
         // The consent step sends the client secret, the code and later the refresh token to these endpoints (ADR 0114).
         const hostProblems = oauthGrantHostProblems(o, [], allowlist);
         if (hostProblems.length)
@@ -365,7 +388,31 @@ export function oauthClientsFor(configs, options = {}) {
             ...(o.client_secret_env ? { [CLIENT_SECRET_ENV]: o.client_secret_env } : {}),
         };
     }
-    return clients;
+    return { clients, dynamic };
+}
+/**
+ * The OAuth clients the consent step needs for these syndicates' declared
+ * authorization-code grants, by provider: pass them as
+ * `oauthConsent({ providers })` (lib/tools/oauthConsent.ts). Client ids and
+ * secrets are read from the variables the YAML names. Two declarations of
+ * one provider must agree on its endpoints, client and scopes, or this
+ * throws: a provider's grant is one grant, whichever tool asks for it.
+ * `load` reads a nested `yaml_reference:` file, when given. A grant with
+ * `client_registration: dynamic` has no client until it is registered: it
+ * is in `dynamicOAuthGrantsFor`, not here.
+ */
+export function oauthClientsFor(configs, options = {}) {
+    return collectOAuthClients(configs, options).clients;
+}
+/**
+ * The dynamic grants these syndicates declare (`client_registration:
+ * dynamic`, ADR 0124), by provider, checked as oauthClientsFor checks the
+ * others (one grant per provider, the MCP server on the allowlist): each
+ * becomes a consent client through `dynamicOAuthClient`
+ * (lib/tools/oauthDiscovery.ts).
+ */
+export function dynamicOAuthGrantsFor(configs, options = {}) {
+    return collectOAuthClients(configs, options).dynamic;
 }
 /**
  * Every OAuth grant these syndicates declare, orchestrators and subagents,
@@ -415,14 +462,22 @@ export function syndicateOAuthHostProblems(configs, options = {}) {
  * (`credentialStore({ providers })`, lib/tools/credentialStore.ts): an
  * expired user token is renewed at the provider's token endpoint with its
  * refresh token (RFC 6749 6) instead of asking the person again. Built from
- * `oauthClientsFor`'s clients; `allowPrivate` lets a private or loopback
+ * `oauthClientsFor`'s clients, and from `dynamicOAuthClient`'s sources (a
+ * discovered client, ADR 0124); `allowPrivate` lets a private or loopback
  * token endpoint through the guard (development).
  */
 export function oauthRefreshProviders(clients, options = {}) {
     const providers = {};
-    for (const [name, client] of Object.entries(clients)) {
+    for (const [name, entry] of Object.entries(clients)) {
         providers[name] = {
             refresh: async (refreshToken, context) => {
+                let client;
+                try {
+                    client = typeof entry === 'function' ? await entry() : entry;
+                }
+                catch {
+                    throw new ToolCredentialError('refresh_failed', name);
+                }
                 // A refresh token goes only to a token endpoint the allowlist binds to its provider (ADR 0114).
                 if (oauthCallProblem({ provider: name, grant: 'authorization_code' }, client.tokenUrl))
                     throw new ToolCredentialError('host_refused', name, 'oauth');
@@ -433,6 +488,8 @@ export function oauthRefreshProviders(clients, options = {}) {
                 const body = new URLSearchParams({ grant_type: 'refresh_token', refresh_token: refreshToken, client_id: client.clientId });
                 if (client.clientSecret)
                     body.set('client_secret', client.clientSecret);
+                if (client.resource)
+                    body.set('resource', client.resource);
                 return tokenRequest(client.tokenUrl, body, name, {
                     allowPrivate: options.allowPrivate === true,
                     doFetch: options.fetch ?? fetch,

package/dist/lib/tools/xApiSearchTool.js

@@ -442,7 +442,7 @@ async function lookupPost(id, token, input, deps) {
     const picked = wantImages ? pickImages(posts, imageMax(deps.env)) : [];
     const readings = picked.length ? await readImages(picked, deps) : new Map();
     const imagesRead = [...readings.values()].filter((r) => r.ok).length;
-    console.log(`[x_api_search] lookup ${id} → ${posts.length} post (≈$${PRICE.postRead.toFixed(3)}), ${imagesRead}/${picked.length} image(s) transcribed on ${visionModel(deps.env)}${imageFailures(readings)}`);
+    console.log(`[x_api_search] lookup → ${posts.length} post (≈$${PRICE.postRead.toFixed(3)}), ${imagesRead}/${picked.length} image(s) transcribed on ${visionModel(deps.env)}${imageFailures(readings)}`);
     const photos = (posts[0].media ?? []).filter((m) => m.type === 'photo').length;
     return [
         `${head} — the post itself, as the API returns it.${photos ? ` ${photos} photo${photos === 1 ? '' : 's'} attached, ${imagesRead} transcribed beneath it.` : ''} For the replies and quotes around it, search conversation_id:${id}.`,
@@ -523,7 +523,7 @@ export async function runXApiSearch(input, deps = DEFAULT_DEPS) {
     const picked = wantImages ? pickImages(posts, imageMax(deps.env)) : [];
     const readings = picked.length ? await readImages(picked, deps) : new Map();
     const imagesRead = [...readings.values()].filter((r) => r.ok).length;
-    console.log(`[x_api_search] "${query}" → ${posts.length} post(s) (≈$${(max * PRICE.postRead).toFixed(3)} at the ${max}-slot ceiling), ` +
+    console.log(`[x_api_search] search (${query.length} chars) → ${posts.length} post(s) (≈$${(max * PRICE.postRead).toFixed(3)} at the ${max}-slot ceiling), ` +
         `${imagesRead}/${picked.length} image(s) transcribed on ${visionModel(deps.env)}${imageFailures(readings)}`);
     return renderBlock({ ...outcome, ok: true, posts }, readings, new Set(picked.map((p) => p.media.key)), imagesRead);
 }

package/dist/scripts/a2a_server.js

@@ -108,6 +108,7 @@ import { redisRateLimitStore } from '../lib/a2a/redisLimits.js';
 import { dbSchema } from '../lib/storage/schema.js';
 import { postgresStorage } from '../lib/storage/postgres/index.js';
 import { isPlaceholderValue, loadEnv } from '../lib/loadEnv.js';
+import { refuseChatGptSignInOnServedSurface } from '../lib/chatgpt/state.js';
 import { flushTracing } from '../lib/observability/tracer.js';
 import { setLogLevel } from '../lib/runtime/logging.js';
 import { loadSyndicate } from '../lib/loadSyndicate.js';
@@ -246,6 +247,13 @@ export async function startServer(syndicateName = 'syndicate.yaml', extensions =
         process.env.OTEL_CONSOLE_SPANS = 'false';
     // The engine's level: INFO/DEBUG lines carry raw event JSON, so keep them quiet.
     setLogLevel('warn');
+    // Sign in with ChatGPT is local only (ADR 0126): stop before anything else starts.
+    try {
+        refuseChatGptSignInOnServedSurface('melchizedek-serve');
+    }
+    catch (err) {
+        fatal(err instanceof Error ? err.message : String(err));
+    }
     const publicUrl = process.env.PUBLIC_URL?.trim() || undefined;
     const port = envInt('PORT', 4000);
     // ── Authentication posture ─────────────────────────────────────────────────

package/dist/scripts/assistant_worker.js

@@ -48,6 +48,7 @@ import { loadEnv } from '../lib/loadEnv.js';
 import { loadSyndicate } from '../lib/loadSyndicate.js';
 import { runDurableTurn } from '../lib/runtime/native/checkpoint.js';
 import { runtimeSetting } from '../lib/runtime/runtimeFlag.js';
+import { refuseChatGptSignInOnServedSurface } from '../lib/chatgpt/state.js';
 import { setLogLevel } from '../lib/runtime/logging.js';
 import { PROVIDERS, providerForModel, providerKeyPresent, } from '../lib/models/registry.js';
 import { CHECKPOINT_MAX_BYTES_ENV, applyInterrupted, checkpointMaxBytesSetting, fileTaskBackendWith, getTaskBackend, setTaskBackend, taskStorePath, } from '../lib/tools/taskTools.js';
@@ -58,6 +59,14 @@ loadEnv(import.meta.url);
 setLogLevel('warn');
 // MELCHIZEDEK_RUNTIME=adk (removed in 1.0.0) stops the worker here, naming the release.
 runtimeSetting();
+// Sign in with ChatGPT is local only (ADR 0126): the worker runs jobs unattended, so it never runs on it.
+try {
+    refuseChatGptSignInOnServedSurface('melchizedek-worker');
+}
+catch (err) {
+    console.error(`✗ ${err instanceof Error ? err.message : String(err)}`);
+    process.exit(1);
+}
 // ── CLI ──────────────────────────────────────────────────────────────────────
 const argv = process.argv.slice(2).filter((a) => a !== '--');
 const flag = (name) => {
@@ -178,7 +187,8 @@ async function drain() {
         ran += 1;
         const started = Date.now();
         const label = job.owner ? `${job.id} (${job.owner})` : job.id;
-        log(`${label} started: ${job.title}`);
+        // The title is the person's words: the log names the job, never its text.
+        log(`${label} started (${(job.instruction ?? job.title).length.toLocaleString()} chars)`);
         // Renew the lease while the job runs, so no other worker takes it back;
         // a renewal that finds the claim gone (the job was cancelled) stops the run.
         const held = job;

package/dist/scripts/doctor.d.ts

@@ -22,7 +22,7 @@
  * Usage:
  *   npm run doctor
  *   npm run doctor -- --json          # machine-readable
- *   npm run doctor -- --check         # exit 1 on a blocked syndicate, a runtime problem, or an OAuth or credential host problem
+ *   npm run doctor -- --check         # exit 1 on a blocked syndicate, a runtime problem, an unrecognised MODEL_GATEWAY, or an OAuth or credential host problem
  *   npm run doctor -- --matrix        # the provider × capability matrix
  *   npm run doctor -- --fix-namespaces [file…]   # give long-term syndicates a memory_namespace
  *   MELCHIZEDEK_AGENTS_DIR=/path npm run doctor

package/dist/scripts/doctor.js

@@ -22,7 +22,7 @@
  * Usage:
  *   npm run doctor
  *   npm run doctor -- --json          # machine-readable
- *   npm run doctor -- --check         # exit 1 on a blocked syndicate, a runtime problem, or an OAuth or credential host problem
+ *   npm run doctor -- --check         # exit 1 on a blocked syndicate, a runtime problem, an unrecognised MODEL_GATEWAY, or an OAuth or credential host problem
  *   npm run doctor -- --matrix        # the provider × capability matrix
  *   npm run doctor -- --fix-namespaces [file…]   # give long-term syndicates a memory_namespace
  *   MELCHIZEDEK_AGENTS_DIR=/path npm run doctor

package/dist/scripts/mcp_server.d.ts

@@ -0,0 +1,12 @@
+#!/usr/bin/env node
+export interface McpCliArgs {
+    syndicates: string[];
+    agentsDir?: string;
+    http: boolean;
+    host?: string;
+    port?: number;
+    help: boolean;
+}
+/** The bin's flags. Throws, naming the flag, on one it does not know. */
+export declare function parseMcpArgs(argv: string[]): McpCliArgs;
+export declare function startMcpServer(argv?: string[]): Promise<void>;