melchizedek-agents 1.3.0 → 1.4.0

package/dist/lib/runtime/native/interrupts.js

@@ -58,7 +58,9 @@
  * grantedCalls is that preprocessor, check for check, with one difference
  * in what the answer carries:
  *   1. The answers: the function responses named `adk_request_credential`
- *      in the last event with content, which must be the user's. None:
+ *      in the latest user event, provided this agent has stored nothing
+ *      with content since (at the top that is the last event with content;
+ *      in a walk another node's events may come between, ADR 0128). None:
  *      nothing happens.
  *   2. The requests they answer: `adk_request_credential` calls this agent
  *      made, by id. An answer naming no such request is ignored, as ADK
@@ -102,7 +104,8 @@
  * workflow under the call's name) makes an approval request an agent node
  * raised, or an ask_user node's question, the pause, with the node that
  * asked at the end of the path. The walk stops there: a pause inside a
- * workflow node's own delegation does not run (lib/workflow/agentNode.ts).
+ * workflow node's own delegation does not run (lib/workflow/agentNode.ts),
+ * except an OAuth consent request, which does (ADR 0128, below).
  *
  * NESTED WORKFLOWS AS A ROUTE OR A NODE (ADR 0119). A workflow node that is
  * a nested workflow raises its walk's open requests again on its caller's
@@ -126,6 +129,19 @@
  * call, the route's pause record or the node's raised request, and the
  * nested turn reads it as a message at the top.
  *
+ * CONSENT INSIDE A WALK (ADR 0128). An agent node's own consent request
+ * is an interrupt of the walk like its approval request: the walk's pause
+ * record names it, and walkConsents finds it there for the turn. A node
+ * whose request waits below it (in a call its agent left open, in a nested
+ * walk, in a nested dispatch syndicate's conversation) raises a copy of it
+ * on the walk under the same id (lib/workflow/agentNode.ts,
+ * lib/workflow/turn.ts), and consentBelow follows the copy down to the
+ * agent that asked; workflowPause reads a credential request as it reads
+ * an approval or a question, so a walk nested below a route, a node or a
+ * delegated call is followed the same way. grantedCalls reads the latest
+ * user event unless the agent has written since, so another node's events
+ * between the grant's answer and the node's resume do not hide it.
+ *
  * CONSENT AND SKILL SCRIPTS INSIDE DELEGATED SUBAGENTS (ADR 0118). A skill
  * script run asks for approval through the same `adk_request_confirmation`
  * call a gated tool stores, so the walk and the resume above carry it with
@@ -144,7 +160,7 @@ import { nativeToolOf } from '../../models/schemaNormalize.js';
 import { instructionToolOf, isTool, toolOf } from '../../tools/tool.js';
 import { inputRequestFrom } from '../../workflowConfig.js';
 import { approvalRequestOf, pendingApproval } from '../approvals.js';
-import { pendingConsent } from '../credentials.js';
+import { consentFrom, pendingConsent } from '../credentials.js';
 import { getFunctionCalls, getFunctionResponses } from '../events.js';
 import { ASK_USER, pendingQuestion } from '../questions.js';
 import { childAppName, entryAppName, legacyChild, legacyEntry } from './delegate.js';
@@ -308,11 +324,17 @@ export async function grantedCalls(agent, scope) {
     const events = scope.session.events;
     if (events.length === 0)
         return undefined;
+    // The latest user event, unless this agent has written since (ADR 0128): in a walk, another node's events may
+    // follow the person's answer before this node reads it; at the top only this agent writes after the message.
     let last;
-    for (let i = events.length - 1; i >= 0 && !last; i--)
-        if (events[i]?.content !== undefined)
-            last = events[i];
-    if (!last || last.author !== 'user')
+    for (let i = events.length - 1; i >= 0 && !last; i--) {
+        const event = events[i];
+        if (event.author === agent.name && event.content !== undefined)
+            return undefined;
+        if (event.author === 'user' && event.content !== undefined)
+            last = event;
+    }
+    if (!last)
         return undefined;
     const answers = new Map();
     for (const r of getFunctionResponses(last))
@@ -427,6 +449,7 @@ async function pauseBelow(key, caller, call, depth, seen) {
             callIds: [id],
             ...(walked.approval ? { approval: { ...walked.approval, path } } : {}),
             ...(walked.question ? { question: { ...walked.question, path } } : {}),
+            ...(walked.consent ? { consent: { ...walked.consent, path } } : {}),
         };
     }
     const approval = pendingApproval(child.events);
@@ -540,8 +563,9 @@ function workflowPause(events, name, id) {
     const open = new Set((record.longRunningToolIds ?? []).filter((x) => id === undefined || x === id));
     if (open.size === 0)
         return undefined;
-    // The latest open request the record names, an approval first: the walk stores node inputs as user turns, so a later one may follow it.
-    for (const kind of [REQUEST_CONFIRMATION_CALL, REQUEST_INPUT_CALL]) {
+    // The latest open request the record names, an approval first, then a question, then a consent request (ADR 0128):
+    // the walk stores node inputs as user turns, so a later one may follow it.
+    for (const kind of [REQUEST_CONFIRMATION_CALL, REQUEST_INPUT_CALL, REQUEST_CREDENTIAL_CALL]) {
         for (let i = events.length - 2; i >= 0; i--) {
             const event = events[i];
             if (!event.author || event.author === 'user')
@@ -551,6 +575,12 @@ function workflowPause(events, name, id) {
                     continue;
                 if (kind === REQUEST_CONFIRMATION_CALL)
                     return { asker: event.author, approval: approvalRequestOf(event, call) };
+                if (kind === REQUEST_CREDENTIAL_CALL) {
+                    const consent = consentFrom(event.author, call);
+                    if (consent)
+                        return { asker: event.author, consent };
+                    continue;
+                }
                 const question = inputRequestFrom(event.author, call);
                 if (question && question.id === call.id)
                     return { asker: event.author, question };
@@ -559,6 +589,58 @@ function workflowPause(events, name, id) {
     }
     return undefined;
 }
+/** Whether `asker` made the call `functionCallId` itself in `events`: its consent request is its own, not one it raised again. */
+function madeCall(events, asker, functionCallId) {
+    return events.some((event) => event.author === asker && getFunctionCalls(event).some((call) => call.id === functionCallId && call.name !== REQUEST_CREDENTIAL_CALL));
+}
+/**
+ * The consent request `id` waiting below the node `asker` of a walk whose
+ * session holds `events` (filed under `key.appName`), when the node raised
+ * it again on the walk (ADR 0128): inside the node's own child session (a
+ * nested workflow, or a nested dispatch syndicate's conversation,
+ * nestedWorkflowPause), else inside a call the node left open (a delegated
+ * subagent, delegatedPauses). Its `path` runs from `asker` down to the
+ * agent that asked. Undefined when nothing below holds it.
+ */
+async function consentBelow(key, events, asker, id, depth) {
+    if (depth >= MAX_DELEGATION_DEPTH)
+        return undefined;
+    const nested = await nestedWorkflowPause(key, asker, 'node', id, depth + 1);
+    if (nested?.consent?.id === id)
+        return nested.consent;
+    const below = await delegatedPauses({ ...key, delegated: false }, events, asker, depth + 1);
+    return below.find((pause) => pause.consent?.id === id)?.consent;
+}
+/**
+ * The OAuth consent requests a walk waits on (ADR 0128): the credential
+ * requests among the open interrupts its pause record names (the session's
+ * last event, authored by the workflow at its own path, no content), each
+ * followed down to the agent that asked. A node's own request comes back as
+ * it is, `agent` the node and no `path`, as a node's own approval request
+ * does; one a node raised again on the walk (a delegated subagent's, a
+ * nested walk's, a nested dispatch syndicate's) carries the `path` from the
+ * node down. `key.appName` is the walk session's app. Empty when the walk is
+ * not paused, or waits on no grant.
+ */
+export async function walkConsents(key, events, depth = 0) {
+    const record = events[events.length - 1];
+    const name = record?.author;
+    if (!record || !name || name === 'user' || (record.content?.parts ?? []).length > 0 || record.nodeInfo?.path !== name)
+        return [];
+    const out = [];
+    for (const id of record.longRunningToolIds ?? []) {
+        const walked = workflowPause(events, name, id);
+        const consent = walked?.consent;
+        if (!walked || !consent)
+            continue;
+        if (madeCall(events, walked.asker, consent.functionCallId)) {
+            out.push(consent);
+            continue;
+        }
+        out.push((await consentBelow(key, events, walked.asker, id, depth)) ?? consent);
+    }
+    return out;
+}
 /**
  * The pause the walk of `name` holds in `child` (its child session), with
  * `id` the only interrupt that counts when given: the node that asked, or,
@@ -569,6 +651,14 @@ async function workflowPauseIn(key, child, name, id, depth = 0) {
     const walked = workflowPause(child.events, name, id);
     if (!walked)
         return undefined;
+    if (walked.consent) {
+        // A node's own consent request, else one it raised again: followed down to the agent that asked (ADR 0128).
+        const below = madeCall(child.events, walked.asker, walked.consent.functionCallId)
+            ? undefined
+            : await consentBelow({ ...key, appName: child.appName }, child.events, walked.asker, walked.consent.id, depth + 1);
+        const path = [name, ...(below?.path ?? [walked.asker])];
+        return { path, consent: { ...(below ?? walked.consent), path } };
+    }
     const found = (walked.approval?.id ?? walked.question?.id);
     const deeper = await nestedWorkflowPause({ ...key, appName: child.appName }, walked.asker, 'node', found, depth + 1);
     const path = deeper ? [name, ...deeper.path] : [name, walked.asker];

package/dist/lib/runtime/syndicateTurn.js

@@ -70,7 +70,7 @@ import { traceAgentRun } from '../observability/tracer.js';
 import { ProjectedSessionService, renderTranscriptDigest } from '../session/transcript.js';
 import { approvalDecisionIn, describeApproval, interruptedTurnStart, pendingApproval } from './approvals.js';
 import { pendingQuestion, questionAnswerPart, questionFrom, turnStartOfCall } from './questions.js';
-import { deepestPause, delegatedPauses, nestedWorkflowPause, routePause } from './native/interrupts.js';
+import { deepestPause, delegatedPauses, nestedWorkflowPause, routePause, walkConsents } from './native/interrupts.js';
 import { consentPinnedTo, entrySession } from './native/delegate.js';
 import { workflowPauseEvent } from '../workflow/pause.js';
 import { INPUT_REQUEST } from '../workflowConfig.js';
@@ -485,6 +485,15 @@ async function runTurnInner(opts, control, _runtime, nestedTurn) {
         ev.log?.(`⏸ Authorization needed: ${(pending.path ?? [pending.agent]).join(' → ')} → ${pending.provider}`);
         return finish();
     };
+    /** Whether the grant a consent request waits for is stored (an expired or unreadable one is not). */
+    const grantStored = async (open) => {
+        try {
+            return !!open.provider && !!(await credentialStore?.get({ appName: credentialApp, userId, provider: open.provider }));
+        }
+        catch {
+            return false;
+        }
+    };
     let granting;
     // A call waiting for a grant inside a delegated subagent (ADR 0118): the grant's answer is stored here, and the open call carries it down.
     let grantingBelow;
@@ -508,14 +517,7 @@ async function runTurnInner(opts, control, _runtime, nestedTurn) {
                 result.error = { code: 'CONSENT_UNAVAILABLE', message: `A call waits for a ${open.provider} authorization, but this turn has no credential store.` };
                 return finish();
             }
-            let granted = false;
-            try {
-                granted = !!open.provider && !!(await credentialStore.get({ appName: credentialApp, userId, provider: open.provider }));
-            }
-            catch {
-                // Expired or unreadable: not granted. The request stands.
-            }
-            if (!granted)
+            if (!(await grantStored(open)))
                 return consentPause(open);
             // The route's own turn carries the grant's answer down to its call; the message goes to it as it came.
             if (routeWaits)
@@ -527,6 +529,28 @@ async function runTurnInner(opts, control, _runtime, nestedTurn) {
             ev.log?.(`✓ Authorization granted: ${(open.path ?? [open.agent]).join(' → ')} → ${open.provider}`);
         }
     }
+    // A walk waiting for grants (ADR 0128): a node's own consent request, or one a node raised again from below it. Once every
+    // grant is stored, the message becomes their answers and the walk resumes those nodes; until then it repeats the first
+    // request still missing and stores nothing, as at the top.
+    if (!decision && isWorkflowSyndicate(config)) {
+        const waiting = await walkConsents(pauseKey, existing?.events ?? []);
+        if (waiting.length > 0) {
+            if (!credentialStore) {
+                result.status = 'failed';
+                result.error = { code: 'CONSENT_UNAVAILABLE', message: `A call waits for a ${waiting[0].provider} authorization, but this turn has no credential store.` };
+                return finish();
+            }
+            for (const open of waiting)
+                if (!(await grantStored(open)))
+                    return consentPause(open);
+            granting = waiting[0];
+            parts = waiting.map((open) => credentialResponsePart(open.id, open.provider));
+            for (const open of waiting)
+                ev.log?.(`✓ Authorization granted: ${(open.path ?? [open.agent]).join(' → ')} → ${open.provider}`);
+        }
+    }
+    /** The parts a paused workflow route's walk resumes on once its grant is stored (ADR 0128): the grant's answer to its credential request. */
+    const routeGrant = consentRoute?.consent ? [credentialResponsePart(consentRoute.consent.id, consentRoute.consent.provider)] : undefined;
     // ── Questions (lib/runtime/questions.ts) ───────────────────────────────────
     // While an agent's `ask_user` call is open, a plain-text message is its
     // answer: it becomes that call's response, and the agent that asked
@@ -651,6 +675,8 @@ async function runTurnInner(opts, control, _runtime, nestedTurn) {
                 memory: nativeMemory(opts.memoryService),
                 ...(selfCorrection ? { selfCorrection } : {}),
                 ...(credentialStore ? { credentials: credentialStore } : {}),
+                // The consent step, its flows bound to the app the grants are read under, wherever the walk's session is filed (ADR 0128).
+                ...(consentStep ? { consent: consentPinnedTo(consentStep, credentialApp) } : {}),
                 ...(compileOpts.log ? { log: compileOpts.log } : {}),
             });
         }
@@ -747,7 +773,7 @@ async function runTurnInner(opts, control, _runtime, nestedTurn) {
             throw new Error(`Session not found: ${sessionId} (appName=${appName}, userId=${userId})`);
         const kept = (state) => Object.fromEntries(Object.entries(state ?? {}).filter(([k]) => !k.startsWith(TEMP_STATE_PREFIX)));
         // Filed under the agent path (ADR 0119), else continued under the route's name alone where ADR 0106 filed it.
-        const resumingWalk = resumingRoute !== undefined || routeAnswer !== undefined;
+        const resumingWalk = resumingRoute !== undefined || routeAnswer !== undefined || consentRoute !== undefined;
         const child = await entrySession(store, { appName, userId, sessionId, events: shared.events }, route, 'route', kept(shared.state), resumingWalk);
         const childKey = { appName: child.appName, userId, sessionId };
         const before = new Map(Object.entries(kept(child.state)).map(([k, v]) => [k, JSON.stringify(v)]));
@@ -760,7 +786,7 @@ async function runTurnInner(opts, control, _runtime, nestedTurn) {
         };
         let walked;
         try {
-            walked = await runAgent({ agent, sid: sessionId, appName: child.appName, userParts: routeAnswer ?? parts, sessions: sessionService, stage: 'dispatch', route: resolution, publishToolStatus: true, errorPolicy: 'collect' });
+            walked = await runAgent({ agent, sid: sessionId, appName: child.appName, userParts: routeAnswer ?? routeGrant ?? parts, sessions: sessionService, stage: 'dispatch', route: resolution, publishToolStatus: true, errorPolicy: 'collect' });
         }
         catch (err) {
             const last = control.stopReason ? undefined : err;
@@ -1087,6 +1113,10 @@ async function runTurnInner(opts, control, _runtime, nestedTurn) {
         const pending = pendingApproval(after?.events ?? []);
         if (pending)
             return pause(await deepen(pending));
+        // A node waiting for a grant (ADR 0128): its own request, or one from below it, with the path from the node down.
+        const [consent] = await walkConsents(pauseKey, after?.events ?? []);
+        if (consent)
+            return consentPause(consent);
         if (answer.inputRequests.length)
             return question(await deepen(answer.inputRequests[answer.inputRequests.length - 1]));
         result.text = answer.text;

package/dist/lib/syndicateSchema.js

@@ -1153,12 +1153,30 @@ function workflowProblems(raw, subs) {
         if (typeof agent.name === 'string' && mapped.has(agent.name) && isObj(agent.skills) && agent.skills.scripts === 'local') {
             out.push({ path: [...path, 'skills', 'scripts'], message: 'skill scripts (an approval pause) are not supported on an agent a map node runs: a map item cannot pause the walk' });
         }
+        // An authorization_code grant pauses for consent (ADR 0128): allowed on a node, not on a map item.
+        if (typeof agent.name === 'string' && mapped.has(agent.name)) {
+            for (const where of authorizationCodeGrants(agent)) {
+                out.push({ path: [...path, ...where], message: 'an authorization_code grant (a consent pause) is not supported on an agent a map node runs: a map item cannot pause the walk' });
+            }
+        }
         if (typeof agent.a2a_agent_url === 'string') {
             out.push({ path: [...path, 'a2a_agent_url'], message: 'a remote agent cannot be a workflow node yet' });
         }
     }
     return out;
 }
+/** Where an agent declares an authorization_code grant (mcp_auth, mcp_servers[].auth, openapi[].auth), by its path below the agent. */
+function authorizationCodeGrants(agent) {
+    const out = [];
+    const isCode = (auth) => isObj(auth) && isObj(auth.oauth2) && auth.oauth2.grant === 'authorization_code';
+    if (isCode(agent.mcp_auth))
+        out.push(['mcp_auth', 'oauth2', 'grant']);
+    if (Array.isArray(agent.mcp_servers))
+        agent.mcp_servers.forEach((e, i) => isObj(e) && isCode(e.auth) && out.push(['mcp_servers', i, 'auth', 'oauth2', 'grant']));
+    if (Array.isArray(agent.openapi))
+        agent.openapi.forEach((e, i) => isObj(e) && isCode(e.auth) && out.push(['openapi', i, 'auth', 'oauth2', 'grant']));
+    return out;
+}
 // ── Public API ───────────────────────────────────────────────────────────────
 /**
  * Thrown by validateSyndicateConfig. `problems` holds one `<file>: <path> —

package/dist/lib/tools/mcpToolFactory.js

@@ -5,8 +5,9 @@
  * An agent's `mcp_server_url:` (or each entry of `mcp_servers:`, ADR 0124)
  * connects here over Streamable HTTP, falling back to the legacy SSE
  * transport when the server answers the initialize POST with the spec's
- * fallback signal (a 4xx other than 401/403), or over the transport the YAML
- * names. Every tool the server lists becomes an own Tool whose declaration is the server's
+ * fallback signal (a 4xx other than 401/403), or with a 401 when no OAuth
+ * grant is configured for the connection, or over the transport the YAML
+ * names; the transport that worked is remembered per URL. Every tool the server lists becomes an own Tool whose declaration is the server's
  * description (bounded) and input schema, and whose execute calls the
  * server and returns its text (bounded). loadMcpTools returns them;
  * createMcpTools is the name the compiler calls.
@@ -134,14 +135,56 @@ export function isSseFallbackSignal(error) {
     const code = error.code;
     return typeof code === 'number' && code >= 400 && code < 500 && code !== 401 && code !== 403;
 }
+/**
+ * True when a Streamable HTTP connect failed with a 401: the server refused
+ * the request's credential (or its absence). Where the connection carries no
+ * OAuth grant, an SSE-only server behind a bearer can answer the initialize
+ * POST to its stream URL that way, so connectMcp tries SSE once (ADR 0124's
+ * note of 2026-10-11).
+ */
+const isUnauthorized = (error) => error instanceof StreamableHTTPError && error.code === 401;
+/** Server URLs whose transport `auto` has learned, at most; the least recently used is forgotten first. */
+const MAX_REMEMBERED_MCP_TRANSPORTS = 256;
+/**
+ * The transport that last connected to each server URL under `auto`, for the
+ * life of the process, so a later connection skips the probe. It holds a URL
+ * and a transport name, never a credential.
+ */
+const rememberedTransports = new Map();
+function rememberTransport(href, kind) {
+    rememberedTransports.delete(href);
+    rememberedTransports.set(href, kind);
+    while (rememberedTransports.size > MAX_REMEMBERED_MCP_TRANSPORTS) {
+        const oldest = rememberedTransports.keys().next().value;
+        rememberedTransports.delete(oldest);
+    }
+}
+const STREAMABLE_PREFIX = 'Streamable HTTP error: ';
+/** `message` with the credential header's value, and its token, cut out. */
+function withoutCredential(message, headers) {
+    const auth = headers.Authorization;
+    if (!auth)
+        return message;
+    const token = auth.startsWith('Bearer ') ? auth.slice('Bearer '.length) : undefined;
+    return redact(redact(message, auth), token);
+}
 /**
  * A client connected to `url` over `kind`, every request through `fetchFn`
  * (the redirect rule, and the credential when there is one). A transport
  * that fails to connect is closed before the error leaves, so nothing keeps
- * reconnecting; with `auto`, a failed Streamable HTTP attempt carrying the
- * fallback signal is closed and the SSE transport tried once.
+ * reconnecting. With `auto`:
+ *   - a transport remembered for this URL is tried first; if it fails, it is
+ *     forgotten and the probe runs;
+ *   - the probe posts over Streamable HTTP. On the spec's fallback signal, or
+ *     on a 401 when the connection has no OAuth grant (`MCP_BEARER_TOKENS`
+ *     or no credential), it closes that attempt and tries SSE once with the
+ *     same fetch and headers. When SSE fails after a 401, the 401 is what is
+ *     thrown, naming both attempts and no credential. A 401 under an OAuth
+ *     grant (its consent and discovery path, ADR 0112 and 0124), a 403, a 5xx
+ *     and a network failure do not fall back;
+ *   - the transport that connected is remembered for this URL.
  */
-async function connectMcp(url, kind, fetchFn, headers = {}) {
+async function connectMcp(url, kind, fetchFn, headers = {}, options = {}) {
     const attempt = async (which) => {
         const requestInit = Object.keys(headers).length ? { requestInit: { headers } } : {};
         const transport = which === 'sse' ? new SSEClientTransport(url, { ...requestInit, fetch: fetchFn }) : new StreamableHTTPClientTransport(url, { ...requestInit, fetch: fetchFn });
@@ -160,14 +203,43 @@ async function connectMcp(url, kind, fetchFn, headers = {}) {
         return attempt('sse');
     if (kind === 'streamable_http')
         return attempt('streamable_http');
+    const href = url.href;
+    const known = rememberedTransports.get(href);
+    if (known) {
+        try {
+            const conn = await attempt(known);
+            rememberTransport(href, known);
+            return conn;
+        }
+        catch {
+            // The server may have changed: forget it and probe as if new.
+            rememberedTransports.delete(href);
+        }
+    }
+    let conn;
     try {
-        return await attempt('streamable_http');
+        conn = await attempt('streamable_http');
     }
     catch (error) {
-        if (!isSseFallbackSignal(error))
+        if (isSseFallbackSignal(error)) {
+            conn = await attempt('sse');
+        }
+        else if (isUnauthorized(error) && !options.oauth) {
+            try {
+                conn = await attempt('sse');
+            }
+            catch (sseError) {
+                const original = error.message.startsWith(STREAMABLE_PREFIX) ? error.message.slice(STREAMABLE_PREFIX.length) : error.message;
+                const sseMessage = sseError instanceof Error ? sseError.message : String(sseError);
+                throw new StreamableHTTPError(401, withoutCredential(`${original} (Streamable HTTP answered 401; the SSE transport was tried once after it and failed too: ${sseMessage})`, headers));
+            }
+        }
+        else {
             throw error;
-        return attempt('sse');
+        }
     }
+    rememberTransport(href, conn.kind);
+    return conn;
 }
 /**
  * Close every open MCP connection. A connection otherwise lives as long as
@@ -180,6 +252,7 @@ export async function closeMcpConnections() {
     openTransports.clear();
     for (const pool of userPools)
         pool.clear();
+    rememberedTransports.clear();
     await Promise.all(all.map((t) => t.close().catch(() => { })));
 }
 /**
@@ -265,7 +338,7 @@ export async function loadMcpTools(mcpServerUrl, options = {}) {
     try {
         const url = await assertSafeMcpUrl(mcpServerUrl);
         conn = tokenSource
-            ? await connectMcp(url, kind, bearerFetch(oauth2, (destination) => tokenSource(undefined, destination)))
+            ? await connectMcp(url, kind, bearerFetch(oauth2, (destination) => tokenSource(undefined, destination)), {}, { oauth: true })
             : await connectMcp(url, kind, mcpFetch, mcpAuthHeaders(url));
         const client = conn.client;
         // Fetch available tools from the MCP server
@@ -335,7 +408,7 @@ function userGrantMcpTools(mcpServerUrl, oauth2, names, kind) {
         conn.holder = holder;
         conn.ready = (async () => {
             const url = await assertSafeMcpUrl(mcpServerUrl);
-            const { client, transport } = await connectMcp(url, kind, bearerFetch(oauth2, async () => holder.token));
+            const { client, transport } = await connectMcp(url, kind, bearerFetch(oauth2, async () => holder.token), {}, { oauth: true });
             conn.transport = transport;
             if (!listed) {
                 const offered = await client.listTools();

package/dist/lib/tools/mcpTransports.d.ts

@@ -5,8 +5,10 @@
  *
  * `auto` (the default) posts the initialize request over Streamable HTTP, the
  * spec's current transport, and falls back to the legacy HTTP+SSE transport
- * on the spec's signal (lib/tools/mcpToolFactory.ts isSseFallbackSignal);
- * `streamable_http` and `sse` use that one transport only.
+ * on the spec's signal (lib/tools/mcpToolFactory.ts isSseFallbackSignal), or
+ * on a 401 when the connection carries no OAuth grant, remembering per URL
+ * the transport that worked; `streamable_http` and `sse` use that one
+ * transport only.
  */
 export declare const MCP_TRANSPORTS: readonly ['auto', 'streamable_http', 'sse'];
 export type McpTransportKind = (typeof MCP_TRANSPORTS)[number];

package/dist/lib/tools/mcpTransports.js

@@ -5,7 +5,9 @@
  *
  * `auto` (the default) posts the initialize request over Streamable HTTP, the
  * spec's current transport, and falls back to the legacy HTTP+SSE transport
- * on the spec's signal (lib/tools/mcpToolFactory.ts isSseFallbackSignal);
- * `streamable_http` and `sse` use that one transport only.
+ * on the spec's signal (lib/tools/mcpToolFactory.ts isSseFallbackSignal), or
+ * on a 401 when the connection carries no OAuth grant, remembering per URL
+ * the transport that worked; `streamable_http` and `sse` use that one
+ * transport only.
  */
 export const MCP_TRANSPORTS = ['auto', 'streamable_http', 'sse'];

package/dist/lib/workflow/agentNode.d.ts

@@ -44,7 +44,8 @@
  *      run's `error`, and the scheduler fails the attempt with
  *      NodeReportedError, ADK's message, retried or stopping the walk as
  *      ADK's does, and reported once (by the node's own event). A run the turn stopped throws. A run that pauses on
- *      an ask_user tool call is refused by name.
+ *      an ask_user tool call, or on an approval or a question inside its
+ *      delegation, is refused by name.
  *   8. APPROVALS (ADR 0098). A run that pauses on approval requests (a tool
  *      in the agent's `require_approval`) resolves with their ids as the
  *      node's interrupts: the node waits and the walk ends paused, as an
@@ -62,6 +63,20 @@
  *      from its input on. ADK's runLlmAgentAsNode stores the input again and
  *      starts the agent afresh, so the pinned call never runs there; ADK
  *      turns refuse gates on workflow nodes instead.
+ *   9. OAUTH CONSENT (ADR 0128). The node's loop gets the turn's consent
+ *      step, its flows bound to the turn's app. A tool whose grant is
+ *      missing stores its `adk_request_credential` call as the node's event
+ *      (stamped, its id in longRunningToolIds) and the run ends paused: that
+ *      id is the node's interrupt, as an approval request's is. A delegated
+ *      call whose child waits for a grant (ADR 0118) leaves the call open;
+ *      the node raises a copy of the child's request on one event of its own
+ *      (`pausedOn`), under the same id. On the resume, a grant's answer
+ *      (`{ credentialKey, granted: true }`, never plain text) lets the run
+ *      continue as rule 8 lets an approval's: the loop's auth preprocessor
+ *      (interrupts.ts grantedCalls) runs the paused call again, or its
+ *      delegation resume carries the answer down the open call. Without one
+ *      the node waits again, its request raised again (`waitAgain`). A map
+ *      item runs without the consent step: it cannot pause the walk.
  *
  * `agentNodeRuntime` puts it together for the scheduler: a `runNode` for
  * agent nodes and map items, and an `onEvent` that stores the event ADK
@@ -69,7 +84,8 @@
  * (lib/workflow/nodeEvents.ts), so a session the native walk writes holds
  * what ADK's holds, in the same order.
  *
- * NOT HERE: an ask_user tool call inside a node, a pause inside a map item,
+ * NOT HERE: an ask_user tool call inside a node, an approval or a question
+ * inside a node's own delegation, a pause inside a map item,
  * tool nodes (lib/workflow/toolNode.ts) and ask_user nodes
  * (lib/workflow/pause.ts). It imports nothing from ADK.
  */
@@ -119,7 +135,7 @@ export interface AgentNodeContext {
  * one with no output. Throws NodeStoppedError when the turn stopped it, and
  * an Error when it paused on a person.
  */
-export declare function runAgentNode(agent: NativeAgent, run: Pick<NodeRun, 'input' | 'path' | 'branch' | 'signal' | 'resumeInputs' | 'resumedInterruptIds'>, ctx: AgentNodeContext): Promise<NodeResult>;
+export declare function runAgentNode(agent: NativeAgent, run: Pick<NodeRun, 'input' | 'path' | 'branch' | 'signal' | 'resumeInputs' | 'resumedInterruptIds'> & Partial<Pick<NodeRun, 'target'>>, ctx: AgentNodeContext): Promise<NodeResult>;
 export interface AgentNodeRuntimeOptions extends Omit<AgentNodeContext, 'appendInput'> {
     /** Every agent of the syndicate, compiled for native, by YAML name. */
     agents: ReadonlyMap<string, NativeAgent>;