melchizedek-agents 1.2.0 → 1.3.1

package/config/agents/syndicate.schema.json

@@ -462,7 +462,7 @@
           "deprecated": true
         },
         "mcp_server_url": {
-          "description": "MCP server (SSE) whose tools are discovered at runtime and merged with `tools`.",
+          "description": "MCP server (Streamable HTTP, or legacy SSE) whose tools are discovered at runtime and merged with `tools`. For more than one server, use mcp_servers.",
           "type": "string"
         },
         "mcp_tools": {
@@ -494,15 +494,20 @@
                   ],
                   "description": "authorization_code: each user's own token, granted through the consent pause (ADR 0085). client_credentials: the server's own token, from the token endpoint."
                 },
+                "client_registration": {
+                  "description": "\"dynamic\": an MCP server's authorization_code grant with no pre-issued client. The authorization server is discovered from the MCP server (RFC 9728, RFC 8414) and this deployment registers itself as a public PKCE client (RFC 7591), once per server and redirect URI, sealed in the credential store (ADR 0124). Every discovered host must be on the operator's OAuth host allowlist. MCP servers only; no client id, client secret or endpoint URL beside it.",
+                  "type": "string",
+                  "const": "dynamic"
+                },
                 "authorization_url": {
-                  "description": "The provider's authorization endpoint (https). authorization_code only.",
+                  "description": "The provider's authorization endpoint (https). authorization_code only; discovered with client_registration: dynamic.",
                   "type": "string",
                   "format": "uri"
                 },
                 "token_url": {
+                  "description": "The provider's token endpoint (https). Required, except with client_registration: dynamic, which discovers it.",
                   "type": "string",
-                  "format": "uri",
-                  "description": "The provider's token endpoint (https)."
+                  "format": "uri"
                 },
                 "client_id": {
                   "description": "The OAuth client id, written out (it is not a secret). Or client_id_env.",
@@ -530,7 +535,7 @@
                   }
                 },
                 "authorization_params": {
-                  "description": "Extra authorization parameters (e.g. access_type: offline). authorization_code only; never state, redirect_uri, scope, client_id or the PKCE pair.",
+                  "description": "Extra authorization parameters (e.g. access_type: offline). authorization_code only; never state, redirect_uri, scope, client_id, resource or the PKCE pair.",
                   "type": "object",
                   "propertyNames": {
                     "type": "string",
@@ -544,8 +549,7 @@
               },
               "required": [
                 "provider",
-                "grant",
-                "token_url"
+                "grant"
               ],
               "additionalProperties": false,
               "description": "An OAuth 2 access token sent as a bearer token on every call (lib/tools/oauthTools.ts). Secrets come from environment variable names, never values."
@@ -556,6 +560,147 @@
           ],
           "additionalProperties": false
         },
+        "mcp_transport": {
+          "description": "How mcp_server_url is reached: auto (the default), streamable_http or sse (ADR 0124). Needs mcp_server_url.",
+          "type": "string",
+          "enum": [
+            "auto",
+            "streamable_http",
+            "sse"
+          ]
+        },
+        "mcp_servers": {
+          "description": "Several MCP servers, each with the tools this agent may use from it, its grant and its transport (ADR 0124). Cannot be combined with mcp_server_url.",
+          "minItems": 1,
+          "maxItems": 16,
+          "type": "array",
+          "items": {
+            "type": "object",
+            "properties": {
+              "name": {
+                "type": "string",
+                "pattern": "^[a-z][a-z0-9_-]{0,63}$",
+                "description": "A short name for the server, unique on this agent: logs and errors name it."
+              },
+              "url": {
+                "type": "string",
+                "format": "uri",
+                "description": "The MCP server's URL: its Streamable HTTP endpoint, or a legacy SSE endpoint. Checked by the SSRF guard."
+              },
+              "tools": {
+                "minItems": 1,
+                "type": "array",
+                "items": {
+                  "type": "string",
+                  "minLength": 1
+                },
+                "description": "The server's tools this agent may use, by name; any other tool it lists is not exposed. A name may appear on one server only, and never among the agent's own tools. require_approval may name these."
+              },
+              "auth": {
+                "description": "The OAuth grant this server takes (ADR 0112, ADR 0124). Without it, MCP_BEARER_TOKENS applies.",
+                "type": "object",
+                "properties": {
+                  "oauth2": {
+                    "type": "object",
+                    "properties": {
+                      "provider": {
+                        "type": "string",
+                        "pattern": "^[a-z0-9][a-z0-9._-]{0,63}$",
+                        "description": "The credential store's name for the provider (e.g. github). Every tool naming it shares one grant."
+                      },
+                      "grant": {
+                        "type": "string",
+                        "enum": [
+                          "authorization_code",
+                          "client_credentials"
+                        ],
+                        "description": "authorization_code: each user's own token, granted through the consent pause (ADR 0085). client_credentials: the server's own token, from the token endpoint."
+                      },
+                      "client_registration": {
+                        "description": "\"dynamic\": an MCP server's authorization_code grant with no pre-issued client. The authorization server is discovered from the MCP server (RFC 9728, RFC 8414) and this deployment registers itself as a public PKCE client (RFC 7591), once per server and redirect URI, sealed in the credential store (ADR 0124). Every discovered host must be on the operator's OAuth host allowlist. MCP servers only; no client id, client secret or endpoint URL beside it.",
+                        "type": "string",
+                        "const": "dynamic"
+                      },
+                      "authorization_url": {
+                        "description": "The provider's authorization endpoint (https). authorization_code only; discovered with client_registration: dynamic.",
+                        "type": "string",
+                        "format": "uri"
+                      },
+                      "token_url": {
+                        "description": "The provider's token endpoint (https). Required, except with client_registration: dynamic, which discovers it.",
+                        "type": "string",
+                        "format": "uri"
+                      },
+                      "client_id": {
+                        "description": "The OAuth client id, written out (it is not a secret). Or client_id_env.",
+                        "type": "string",
+                        "minLength": 1,
+                        "maxLength": 512
+                      },
+                      "client_id_env": {
+                        "description": "Environment variable holding the client id. Or client_id.",
+                        "type": "string",
+                        "pattern": "^[A-Z_][A-Z0-9_]*$"
+                      },
+                      "client_secret_env": {
+                        "description": "Environment variable NAME holding the client secret, never the value. Required for client_credentials; omit for a public client (PKCE alone).",
+                        "type": "string",
+                        "pattern": "^[A-Z_][A-Z0-9_]*$"
+                      },
+                      "scopes": {
+                        "description": "The scopes the grant asks for.",
+                        "maxItems": 64,
+                        "type": "array",
+                        "items": {
+                          "type": "string",
+                          "pattern": "^[\\x21\\x23-\\x5b\\x5d-\\x7e]{1,256}$"
+                        }
+                      },
+                      "authorization_params": {
+                        "description": "Extra authorization parameters (e.g. access_type: offline). authorization_code only; never state, redirect_uri, scope, client_id, resource or the PKCE pair.",
+                        "type": "object",
+                        "propertyNames": {
+                          "type": "string",
+                          "pattern": "^[A-Za-z0-9_.-]{1,64}$"
+                        },
+                        "additionalProperties": {
+                          "type": "string",
+                          "maxLength": 512
+                        }
+                      }
+                    },
+                    "required": [
+                      "provider",
+                      "grant"
+                    ],
+                    "additionalProperties": false,
+                    "description": "An OAuth 2 access token sent as a bearer token on every call (lib/tools/oauthTools.ts). Secrets come from environment variable names, never values."
+                  }
+                },
+                "required": [
+                  "oauth2"
+                ],
+                "additionalProperties": false
+              },
+              "transport": {
+                "type": "string",
+                "enum": [
+                  "auto",
+                  "streamable_http",
+                  "sse"
+                ],
+                "description": "How the MCP server is reached: auto (the default) tries Streamable HTTP and falls back to the legacy SSE transport on the spec's signal; streamable_http or sse use that one only (ADR 0124)."
+              }
+            },
+            "required": [
+              "name",
+              "url",
+              "tools"
+            ],
+            "additionalProperties": false,
+            "description": "One MCP server among several (ADR 0124)."
+          }
+        },
         "skills": {
           "type": "object",
           "properties": {
@@ -685,15 +830,20 @@
                         ],
                         "description": "authorization_code: each user's own token, granted through the consent pause (ADR 0085). client_credentials: the server's own token, from the token endpoint."
                       },
+                      "client_registration": {
+                        "description": "\"dynamic\": an MCP server's authorization_code grant with no pre-issued client. The authorization server is discovered from the MCP server (RFC 9728, RFC 8414) and this deployment registers itself as a public PKCE client (RFC 7591), once per server and redirect URI, sealed in the credential store (ADR 0124). Every discovered host must be on the operator's OAuth host allowlist. MCP servers only; no client id, client secret or endpoint URL beside it.",
+                        "type": "string",
+                        "const": "dynamic"
+                      },
                       "authorization_url": {
-                        "description": "The provider's authorization endpoint (https). authorization_code only.",
+                        "description": "The provider's authorization endpoint (https). authorization_code only; discovered with client_registration: dynamic.",
                         "type": "string",
                         "format": "uri"
                       },
                       "token_url": {
+                        "description": "The provider's token endpoint (https). Required, except with client_registration: dynamic, which discovers it.",
                         "type": "string",
-                        "format": "uri",
-                        "description": "The provider's token endpoint (https)."
+                        "format": "uri"
                       },
                       "client_id": {
                         "description": "The OAuth client id, written out (it is not a secret). Or client_id_env.",
@@ -721,7 +871,7 @@
                         }
                       },
                       "authorization_params": {
-                        "description": "Extra authorization parameters (e.g. access_type: offline). authorization_code only; never state, redirect_uri, scope, client_id or the PKCE pair.",
+                        "description": "Extra authorization parameters (e.g. access_type: offline). authorization_code only; never state, redirect_uri, scope, client_id, resource or the PKCE pair.",
                         "type": "object",
                         "propertyNames": {
                           "type": "string",
@@ -735,8 +885,7 @@
                     },
                     "required": [
                       "provider",
-                      "grant",
-                      "token_url"
+                      "grant"
                     ],
                     "additionalProperties": false,
                     "description": "An OAuth 2 access token sent as a bearer token on every call (lib/tools/oauthTools.ts). Secrets come from environment variable names, never values."
@@ -1300,7 +1449,7 @@
             "deprecated": true
           },
           "mcp_server_url": {
-            "description": "MCP server (SSE) whose tools are discovered at runtime and merged with `tools`.",
+            "description": "MCP server (Streamable HTTP, or legacy SSE) whose tools are discovered at runtime and merged with `tools`. For more than one server, use mcp_servers.",
             "type": "string"
           },
           "mcp_tools": {
@@ -1332,15 +1481,20 @@
                     ],
                     "description": "authorization_code: each user's own token, granted through the consent pause (ADR 0085). client_credentials: the server's own token, from the token endpoint."
                   },
+                  "client_registration": {
+                    "description": "\"dynamic\": an MCP server's authorization_code grant with no pre-issued client. The authorization server is discovered from the MCP server (RFC 9728, RFC 8414) and this deployment registers itself as a public PKCE client (RFC 7591), once per server and redirect URI, sealed in the credential store (ADR 0124). Every discovered host must be on the operator's OAuth host allowlist. MCP servers only; no client id, client secret or endpoint URL beside it.",
+                    "type": "string",
+                    "const": "dynamic"
+                  },
                   "authorization_url": {
-                    "description": "The provider's authorization endpoint (https). authorization_code only.",
+                    "description": "The provider's authorization endpoint (https). authorization_code only; discovered with client_registration: dynamic.",
                     "type": "string",
                     "format": "uri"
                   },
                   "token_url": {
+                    "description": "The provider's token endpoint (https). Required, except with client_registration: dynamic, which discovers it.",
                     "type": "string",
-                    "format": "uri",
-                    "description": "The provider's token endpoint (https)."
+                    "format": "uri"
                   },
                   "client_id": {
                     "description": "The OAuth client id, written out (it is not a secret). Or client_id_env.",
@@ -1368,7 +1522,7 @@
                     }
                   },
                   "authorization_params": {
-                    "description": "Extra authorization parameters (e.g. access_type: offline). authorization_code only; never state, redirect_uri, scope, client_id or the PKCE pair.",
+                    "description": "Extra authorization parameters (e.g. access_type: offline). authorization_code only; never state, redirect_uri, scope, client_id, resource or the PKCE pair.",
                     "type": "object",
                     "propertyNames": {
                       "type": "string",
@@ -1382,8 +1536,7 @@
                 },
                 "required": [
                   "provider",
-                  "grant",
-                  "token_url"
+                  "grant"
                 ],
                 "additionalProperties": false,
                 "description": "An OAuth 2 access token sent as a bearer token on every call (lib/tools/oauthTools.ts). Secrets come from environment variable names, never values."
@@ -1394,6 +1547,147 @@
             ],
             "additionalProperties": false
           },
+          "mcp_transport": {
+            "description": "How mcp_server_url is reached: auto (the default), streamable_http or sse (ADR 0124). Needs mcp_server_url.",
+            "type": "string",
+            "enum": [
+              "auto",
+              "streamable_http",
+              "sse"
+            ]
+          },
+          "mcp_servers": {
+            "description": "Several MCP servers, each with the tools this agent may use from it, its grant and its transport (ADR 0124). Cannot be combined with mcp_server_url.",
+            "minItems": 1,
+            "maxItems": 16,
+            "type": "array",
+            "items": {
+              "type": "object",
+              "properties": {
+                "name": {
+                  "type": "string",
+                  "pattern": "^[a-z][a-z0-9_-]{0,63}$",
+                  "description": "A short name for the server, unique on this agent: logs and errors name it."
+                },
+                "url": {
+                  "type": "string",
+                  "format": "uri",
+                  "description": "The MCP server's URL: its Streamable HTTP endpoint, or a legacy SSE endpoint. Checked by the SSRF guard."
+                },
+                "tools": {
+                  "minItems": 1,
+                  "type": "array",
+                  "items": {
+                    "type": "string",
+                    "minLength": 1
+                  },
+                  "description": "The server's tools this agent may use, by name; any other tool it lists is not exposed. A name may appear on one server only, and never among the agent's own tools. require_approval may name these."
+                },
+                "auth": {
+                  "description": "The OAuth grant this server takes (ADR 0112, ADR 0124). Without it, MCP_BEARER_TOKENS applies.",
+                  "type": "object",
+                  "properties": {
+                    "oauth2": {
+                      "type": "object",
+                      "properties": {
+                        "provider": {
+                          "type": "string",
+                          "pattern": "^[a-z0-9][a-z0-9._-]{0,63}$",
+                          "description": "The credential store's name for the provider (e.g. github). Every tool naming it shares one grant."
+                        },
+                        "grant": {
+                          "type": "string",
+                          "enum": [
+                            "authorization_code",
+                            "client_credentials"
+                          ],
+                          "description": "authorization_code: each user's own token, granted through the consent pause (ADR 0085). client_credentials: the server's own token, from the token endpoint."
+                        },
+                        "client_registration": {
+                          "description": "\"dynamic\": an MCP server's authorization_code grant with no pre-issued client. The authorization server is discovered from the MCP server (RFC 9728, RFC 8414) and this deployment registers itself as a public PKCE client (RFC 7591), once per server and redirect URI, sealed in the credential store (ADR 0124). Every discovered host must be on the operator's OAuth host allowlist. MCP servers only; no client id, client secret or endpoint URL beside it.",
+                          "type": "string",
+                          "const": "dynamic"
+                        },
+                        "authorization_url": {
+                          "description": "The provider's authorization endpoint (https). authorization_code only; discovered with client_registration: dynamic.",
+                          "type": "string",
+                          "format": "uri"
+                        },
+                        "token_url": {
+                          "description": "The provider's token endpoint (https). Required, except with client_registration: dynamic, which discovers it.",
+                          "type": "string",
+                          "format": "uri"
+                        },
+                        "client_id": {
+                          "description": "The OAuth client id, written out (it is not a secret). Or client_id_env.",
+                          "type": "string",
+                          "minLength": 1,
+                          "maxLength": 512
+                        },
+                        "client_id_env": {
+                          "description": "Environment variable holding the client id. Or client_id.",
+                          "type": "string",
+                          "pattern": "^[A-Z_][A-Z0-9_]*$"
+                        },
+                        "client_secret_env": {
+                          "description": "Environment variable NAME holding the client secret, never the value. Required for client_credentials; omit for a public client (PKCE alone).",
+                          "type": "string",
+                          "pattern": "^[A-Z_][A-Z0-9_]*$"
+                        },
+                        "scopes": {
+                          "description": "The scopes the grant asks for.",
+                          "maxItems": 64,
+                          "type": "array",
+                          "items": {
+                            "type": "string",
+                            "pattern": "^[\\x21\\x23-\\x5b\\x5d-\\x7e]{1,256}$"
+                          }
+                        },
+                        "authorization_params": {
+                          "description": "Extra authorization parameters (e.g. access_type: offline). authorization_code only; never state, redirect_uri, scope, client_id, resource or the PKCE pair.",
+                          "type": "object",
+                          "propertyNames": {
+                            "type": "string",
+                            "pattern": "^[A-Za-z0-9_.-]{1,64}$"
+                          },
+                          "additionalProperties": {
+                            "type": "string",
+                            "maxLength": 512
+                          }
+                        }
+                      },
+                      "required": [
+                        "provider",
+                        "grant"
+                      ],
+                      "additionalProperties": false,
+                      "description": "An OAuth 2 access token sent as a bearer token on every call (lib/tools/oauthTools.ts). Secrets come from environment variable names, never values."
+                    }
+                  },
+                  "required": [
+                    "oauth2"
+                  ],
+                  "additionalProperties": false
+                },
+                "transport": {
+                  "type": "string",
+                  "enum": [
+                    "auto",
+                    "streamable_http",
+                    "sse"
+                  ],
+                  "description": "How the MCP server is reached: auto (the default) tries Streamable HTTP and falls back to the legacy SSE transport on the spec's signal; streamable_http or sse use that one only (ADR 0124)."
+                }
+              },
+              "required": [
+                "name",
+                "url",
+                "tools"
+              ],
+              "additionalProperties": false,
+              "description": "One MCP server among several (ADR 0124)."
+            }
+          },
           "skills": {
             "type": "object",
             "properties": {
@@ -1523,15 +1817,20 @@
                           ],
                           "description": "authorization_code: each user's own token, granted through the consent pause (ADR 0085). client_credentials: the server's own token, from the token endpoint."
                         },
+                        "client_registration": {
+                          "description": "\"dynamic\": an MCP server's authorization_code grant with no pre-issued client. The authorization server is discovered from the MCP server (RFC 9728, RFC 8414) and this deployment registers itself as a public PKCE client (RFC 7591), once per server and redirect URI, sealed in the credential store (ADR 0124). Every discovered host must be on the operator's OAuth host allowlist. MCP servers only; no client id, client secret or endpoint URL beside it.",
+                          "type": "string",
+                          "const": "dynamic"
+                        },
                         "authorization_url": {
-                          "description": "The provider's authorization endpoint (https). authorization_code only.",
+                          "description": "The provider's authorization endpoint (https). authorization_code only; discovered with client_registration: dynamic.",
                           "type": "string",
                           "format": "uri"
                         },
                         "token_url": {
+                          "description": "The provider's token endpoint (https). Required, except with client_registration: dynamic, which discovers it.",
                           "type": "string",
-                          "format": "uri",
-                          "description": "The provider's token endpoint (https)."
+                          "format": "uri"
                         },
                         "client_id": {
                           "description": "The OAuth client id, written out (it is not a secret). Or client_id_env.",
@@ -1559,7 +1858,7 @@
                           }
                         },
                         "authorization_params": {
-                          "description": "Extra authorization parameters (e.g. access_type: offline). authorization_code only; never state, redirect_uri, scope, client_id or the PKCE pair.",
+                          "description": "Extra authorization parameters (e.g. access_type: offline). authorization_code only; never state, redirect_uri, scope, client_id, resource or the PKCE pair.",
                           "type": "object",
                           "propertyNames": {
                             "type": "string",
@@ -1573,8 +1872,7 @@
                       },
                       "required": [
                         "provider",
-                        "grant",
-                        "token_url"
+                        "grant"
                       ],
                       "additionalProperties": false,
                       "description": "An OAuth 2 access token sent as a bearer token on every call (lib/tools/oauthTools.ts). Secrets come from environment variable names, never values."

package/dist/lib/a2a/app.js

@@ -46,6 +46,7 @@ import { duplicateInterfacesForLegacy } from '@a2a-js/sdk/compat/v0_3';
 import { agentCardHandler, jsonRpcHandler, restHandler } from '@a2a-js/sdk/server/express';
 import { InProcessSessionService } from '../runtime/sessions.js';
 import { runtimeSetting } from '../runtime/runtimeFlag.js';
+import { refuseChatGptSignInOnServedSurface } from '../chatgpt/state.js';
 import { geminiAdapterSetting } from '../models/adapterResolver.js';
 import { loadSyndicate, loadSyndicateFromRegistry, nestedLoader } from '../loadSyndicate.js';
 import { providerForModel, resolveModel } from '../models/registry.js';
@@ -264,6 +265,8 @@ export async function createA2AApp(options) {
     // A deployment still configured for the removed adk runtime fails here, naming 1.0.0 (ADR 0107).
     runtimeSetting();
     geminiAdapterSetting();
+    // Sign in with ChatGPT is local only (ADR 0126): a served app never runs OpenAI ids on it.
+    refuseChatGptSignInOnServedSurface('The A2A server');
     const log = options.log ?? ((m) => console.log(`[A2A] ${m}`));
     const warn = options.warn ?? ((m) => console.warn(`[A2A] ⚠ ${m}`));
     const bindings = options.bindings ?? (() => ({

package/dist/lib/a2a/oauthSetup.js

@@ -26,8 +26,9 @@
 import { CREDENTIAL_KEY_ENV, credentialCipherFromEnv } from '../tools/credentialCipher.js';
 import { credentialStore, memoryCredentialRows } from '../tools/credentialStore.js';
 import { oauthConsent } from '../tools/oauthConsent.js';
+import { dynamicOAuthClient, oauthClientRegistry } from '../tools/oauthDiscovery.js';
 import { OAUTH_HOSTS_ENV, oauthHosts } from '../tools/oauthHosts.js';
-import { oauthClientsFor, oauthGrantHostProblems, oauthRefreshProviders, syndicateOAuthGrants, syndicateOAuthHostProblems } from '../tools/oauthTools.js';
+import { dynamicOAuthGrantsFor, oauthClientsFor, oauthGrantHostProblems, oauthRefreshProviders, syndicateOAuthGrants, syndicateOAuthHostProblems } from '../tools/oauthTools.js';
 import { CREDENTIAL_HOSTS_ENV, credentialHosts } from '../tools/credentialHosts.js';
 import { syndicateCredentialHostProblems, syndicateCredentialUses, unboundCredentialEnvs } from '../tools/credentialUses.js';
 /** The consent callback's URL, exactly as registered at every provider. */
@@ -224,11 +225,25 @@ export function oauthServerSetup(options) {
         return { summary: `off (${CREDENTIAL_KEY_ENV} unset) · ${hostsLabel}`, credentialSummary, warnings };
     }
     const clients = oauthClientsFor(options.configs, { env, ...(options.load ? { load: options.load } : {}), allowlist: allowlist ?? null });
-    const providers = Object.keys(clients);
+    const rows = options.rows ?? memoryCredentialRows();
+    // A grant with client_registration: dynamic (ADR 0124): its client is
+    // discovered and registered when first needed, for the configured redirect
+    // URI, and kept sealed beside the users' tokens. Without a redirect URI it
+    // cannot register, and is named in the warning below.
+    const dynamicGrants = dynamicOAuthGrantsFor(options.configs, { env, ...(options.load ? { load: options.load } : {}), allowlist: allowlist ?? null });
+    const registry = oauthClientRegistry({ rows, cipher });
+    const dynamicClients = redirect
+        ? Object.fromEntries(Object.entries(dynamicGrants).map(([name, grant]) => [
+            name,
+            dynamicOAuthClient(grant, { redirectUri: redirect, registry, ...(options.allowPrivate ? { allowPrivate: true } : {}), ...(options.fetch ? { fetch: options.fetch } : {}) }),
+        ]))
+        : {};
+    const allClients = { ...clients, ...dynamicClients };
+    const providers = [...Object.keys(clients), ...Object.keys(dynamicGrants)];
     const store = credentialStore({
-        rows: options.rows ?? memoryCredentialRows(),
+        rows,
         cipher,
-        providers: oauthRefreshProviders(clients, { ...(options.allowPrivate ? { allowPrivate: true } : {}), ...(options.fetch ? { fetch: options.fetch } : {}) }),
+        providers: oauthRefreshProviders(allClients, { ...(options.allowPrivate ? { allowPrivate: true } : {}), ...(options.fetch ? { fetch: options.fetch } : {}) }),
         ...(options.audit ? { audit: options.audit } : {}),
     });
     if (!options.rows)
@@ -244,7 +259,7 @@ export function oauthServerSetup(options) {
         return { toolCredentials: { store }, summary: `sealed (key ${cipher.keyId}) in ${where}; no consent step · ${hostsLabel}`, credentialSummary, warnings };
     }
     const consent = oauthConsent({
-        providers: clients,
+        providers: allClients,
         redirectUri: redirect,
         credentials: store,
         ...(options.audit ? { audit: options.audit } : {}),

package/dist/lib/chatgpt/adapter.d.ts

@@ -0,0 +1,50 @@
+/**
+ * lib/chatgpt/adapter.ts — GPT on the person's ChatGPT plan, through Sign in
+ * with ChatGPT, on their own machine only (ADR 0126).
+ *
+ * It is GptAdapter (the Responses API) with a different credential and the
+ * request shape OpenAI documents for plan usage
+ * (developers.openai.com/siwc/token-sharing-open-source/models-and-inference
+ * and …/preview-limitations):
+ *   - always `POST https://api.openai.com/v1/responses`, never a proxy or a
+ *     platform, with the stored access token as the bearer, refreshed as it
+ *     nears expiry (lib/chatgpt/oauth.ts freshAccessToken), and no
+ *     organization or project header;
+ *   - `stream: true` and `store: false` on every request; a call that did
+ *     not ask to stream is streamed and folded back into one final;
+ *   - none of the parameters the preview refuses: `max_output_tokens`,
+ *     `temperature`, `top_p`;
+ *   - no SDK retries: a plan-usage limit (429) is reported, not hammered.
+ * The provider id stays `openai`, so reasoning replay and the stored events
+ * are the same as on a key.
+ *
+ * On a served surface (lib/chatgpt/state.ts markServedSurface) every call
+ * ends in a CHATGPT_SIGNIN_LOCAL_ONLY final before any token is read.
+ */
+import type { ModelRequest, ModelResponse } from '../models/contract.ts';
+import type { ProviderEndpoint } from '../models/endpoints.ts';
+import { GptAdapter } from '../models/gptAdapter.ts';
+import type { OAuthOptions } from './oauth.ts';
+export interface ChatGptSignInAdapterOptions extends OAuthOptions {
+    model: string;
+    /** The credential file; default signInFile(). */
+    file?: string;
+}
+export declare class ChatGptSignInAdapter extends GptAdapter {
+    #private;
+    protected readonly label: string;
+    constructor(options: ChatGptSignInAdapterOptions);
+    protected endpoint(): ProviderEndpoint;
+    protected baseURL(): string;
+    protected missingKeyMessage(): string;
+    /** The token source: read (and refreshed) on every request, never held in the adapter. */
+    protected clientAuth(): {
+        apiKey: () => Promise<string>;
+        baseURL: string;
+    };
+    protected clientOptions(): Record<string, unknown>;
+    /** The preview takes none of the sampling fields. */
+    protected acceptsSampling(): boolean;
+    requestBody(request: ModelRequest, model?: string, endpoint?: ProviderEndpoint): Record<string, unknown>;
+    generate(request: ModelRequest): AsyncGenerator<ModelResponse, void>;
+}