privateer-agent 0.14.6 → 0.15.0

package/src/mcp/catalog.ts

@@ -44,8 +44,8 @@ export interface CatalogEntry {
    * flag rather than falling out of the URL: every other http entry here is a remote
    * service the user authorizes, so "must authenticate" is derived from
    * `transport === "http"` alone. That is false here — there is nothing to authorize
-   * — so the flag is what makes draftFromCatalog emit `auth: "none"`. Without it the
-   * adapter goes hunting for an authorization server that does not exist.
+   * — so the flag is what makes draftFromCatalog emit `auth: "none"`, and the app
+   * doesn't tell the user to sign in to something with no sign-in.
    *
    * Always pair with `hosted: false`: a hosted enclave has no route to the user's
    * loopback, and hostedCapable()'s derived rule keys on `oauth`, not on this.
@@ -199,7 +199,8 @@ export const MCP_CATALOG: CatalogEntry[] = [
     label: "Jira & Confluence",
     blurb: "Atlassian issues and pages. Sign in via browser.",
     transport: "http",
-    url: "https://mcp.atlassian.com/v1/sse",
+    // Streamable HTTP; /v1/sse is the legacy SSE endpoint, which Pi does not speak.
+    url: "https://mcp.atlassian.com/v1/mcp",
     oauth: true,
     needs: "oauth",
   },
@@ -219,7 +220,9 @@ export const MCP_CATALOG: CatalogEntry[] = [
     label: "Asana",
     blurb: "Tasks and projects. Sign in via browser.",
     transport: "http",
-    url: "https://mcp.asana.com/sse",
+    // Streamable HTTP on the same OAuth server as the legacy /sse endpoint, which Pi does
+    // not speak. (/v2/mcp is a separate app-registration flow.)
+    url: "https://mcp.asana.com/mcp",
     oauth: true,
     needs: "oauth",
   },
@@ -453,11 +456,9 @@ export function draftFromCatalog(
     draft.args = (e.args ?? []).map((a) => (e.fill && a === e.fill && filled ? filled : a));
   } else {
     draft.url = input.url?.trim() || e.url;
-    // Emit the adapter's own vocabulary (`auth`) rather than the legacy boolean, so
-    // the projection carries a string and not a bogus boolean in the adapter's
-    // OAuthConfig slot. A localHttp entry authenticates to nothing — saying "oauth"
-    // there would send the adapter looking for an authorization server that does not
-    // exist, which fails at connect time rather than at save time.
+    // Emit our `auth` vocabulary rather than the legacy boolean. A localHttp entry
+    // authenticates to nothing — saying "oauth" there would put a sign-in prompt in
+    // front of a server that has no sign-in.
     draft.auth = e.localHttp ? "none" : (e.oauth ?? true) ? "oauth" : "none";
   }
 

package/src/mcp/piMcp.ts

@@ -0,0 +1,139 @@
+/**
+ * Pi's MCP machinery for callers OUTSIDE a session: sign in to a connector, sign out,
+ * ask whether it is signed in, and test that it answers.
+ *
+ * The desktop's connector manager is the caller (treeview desktop/src/main/
+ * mcpService.ts). It used to reach into pi-mcp-adapter's OAuth flow for this; with
+ * Pi's built-in MCP support, the tokens a session uses live in Pi's own store
+ * (`agent/mcp-auth.json`, keyed by server name and URL), so anything that signs in has
+ * to go through Pi or the session will not find the result.
+ *
+ * Sign-in and sign-out run Pi's own `mcp login` / `mcp logout` (runMcpCommand) — the
+ * whole flow: connect, read the server's challenge, browser authorization against a
+ * loopback callback, store, reconnect. The test builds the same McpServerConnection a
+ * session builds, so "the test passed" means what a session will see, stored OAuth
+ * tokens included.
+ *
+ * These are not in pi-coding-agent's package exports, so they are imported by file,
+ * resolved from the package's own entry (which follows a hoisted install). Every deep
+ * import of Pi's MCP internals lives HERE, behind small functions, and
+ * tests/piMcp.test.ts pins each one against the installed Pi.
+ */
+import { homedir } from "node:os";
+import { join } from "node:path";
+import { agentDir } from "../config/paths.ts";
+
+// Pi finds mcp-auth.json, mcp.log and its refresh locks through getAgentDir(), which
+// reads this variable. Every Privateer entrypoint sets it in boot.ts; the desktop's
+// main process, which calls these without running a session, may not have.
+process.env.PI_CODING_AGENT_DIR ??= agentDir();
+
+const PI_ENTRY = import.meta.resolve("@earendil-works/pi-coding-agent");
+const piFile = (rel: string) => import(new URL(rel, PI_ENTRY).href);
+
+export type McpAuthStatus = "not_supported" | "not_authenticated" | "authenticated";
+
+/** Run one `pi mcp …` command against our agent dir; collect what it printed. */
+async function mcpCommand(
+  args: string[],
+  opts: { openUrl?: (url: string) => void } = {},
+): Promise<{ code: number; out: string[]; err: string[] }> {
+  const { runMcpCommand } = await piFile("./extensions/mcp/cli.js");
+  const out: string[] = [];
+  const err: string[] = [];
+  const code = await runMcpCommand(args, {
+    // The user-level config only: these commands manage the connectors the user added,
+    // never a project's.
+    cwd: homedir(),
+    agentDir: agentDir(),
+    openUrl: opts.openUrl,
+    log: (line: string) => out.push(line),
+    error: (line: string) => err.push(line),
+  });
+  return { code, out, err };
+}
+
+/**
+ * Sign in to an OAuth connector from mcp.json. `onUrl` gets the authorization URL —
+ * the caller opens the browser and shows it. Already signed in → ok at once.
+ */
+export async function mcpSignIn(
+  name: string,
+  onUrl: (url: string) => void,
+  timeoutMs = 5 * 60_000,
+): Promise<{ ok: boolean; error?: string }> {
+  const r = await mcpCommand(["login", name, "--timeout", String(Math.round(timeoutMs / 1000))], { openUrl: onUrl });
+  return r.code === 0 ? { ok: true } : { ok: false, error: r.err.join("\n") || r.out.join("\n") || "sign-in failed" };
+}
+
+/** Delete the stored credentials of an OAuth connector. */
+export async function mcpSignOut(name: string): Promise<void> {
+  await mcpCommand(["logout", name]);
+}
+
+/**
+ * Whether a connector has stored OAuth credentials. "not_supported" for a server Pi
+ * would never start OAuth for: stdio, or HTTP carrying its own Authorization header.
+ * A stored but expired access token still counts — Pi refreshes it on the next call.
+ */
+export async function mcpAuthStatus(server: {
+  name: string;
+  url?: string;
+  headers?: Record<string, string>;
+}): Promise<McpAuthStatus> {
+  if (!server.url) return "not_supported";
+  if (Object.keys(server.headers ?? {}).some((h) => h.toLowerCase() === "authorization")) return "not_supported";
+  const { McpOAuthCredentialStore } = await piFile("./extensions/mcp/oauth.js");
+  const tokens = new McpOAuthCredentialStore(undefined, undefined).tokens(server.name, server.url);
+  return tokens ? "authenticated" : "not_authenticated";
+}
+
+export interface McpHandshake {
+  ok: boolean;
+  tools?: Array<{ name: string; description?: string }>;
+  /** True when the server answered but wants a sign-in first. */
+  needsAuth?: boolean;
+  error?: string;
+}
+
+/**
+ * Connect to one server exactly as a session would, list its tools, hang up. `config`
+ * is a Pi `mcpServers` entry — what mcpControl / mcpService project into mcp.json.
+ */
+export async function mcpHandshake(name: string, config: Record<string, unknown>, timeoutMs = 20_000): Promise<McpHandshake> {
+  const { McpServerConnection, createDefaultTransport, McpOAuthCredentialStore, McpServerLog } = await piFile(
+    "./extensions/mcp/runtime.js",
+  );
+  const connection = new McpServerConnection({
+    entry: { name, config, source: join(agentDir(), "mcp.json"), scope: "global" },
+    cwd: homedir(),
+    createTransport: createDefaultTransport,
+    credentials: new McpOAuthCredentialStore(),
+    log: new McpServerLog(join(agentDir(), "mcp.log")),
+    onTools: () => {},
+  });
+  let timer: ReturnType<typeof setTimeout> | undefined;
+  try {
+    await Promise.race([
+      connection.getClient(),
+      new Promise((_, reject) => {
+        timer = setTimeout(() => reject(new Error(`timed out after ${timeoutMs}ms`)), timeoutMs);
+      }),
+    ]);
+    const tools = (connection.tools as Array<{ name: string; description?: string }>).map((t) => ({
+      name: t.name,
+      description: t.description,
+    }));
+    return { ok: true, tools };
+  } catch (e) {
+    if (connection.state === "needs-auth") return { ok: false, needsAuth: true, error: "sign-in required" };
+    return { ok: false, error: connection.error ?? (e instanceof Error ? e.message : String(e)) };
+  } finally {
+    clearTimeout(timer);
+    try {
+      await connection.close();
+    } catch {
+      /* already gone */
+    }
+  }
+}

package/src/mcp/toolNames.ts

@@ -1,8 +1,7 @@
 /**
- * Translating a routine's MCP selectors into the tool names Pi will actually honour.
+ * Translating a routine's MCP selectors into the tool names Pi registers.
  *
- * There are TWO vocabularies here and conflating them is why per-routine connector
- * allow-lists silently granted nothing:
+ * There are TWO vocabularies here:
  *
  *  • The SELECTOR vocabulary — "<server>__<tool>" exact, or "<server>__*" for a whole
  *    server. This is what a routine stores, what the app writes, and what the AI
@@ -10,100 +9,50 @@
  *    splitRoutineTools can tell a connector selector from a builtin name without a
  *    lookup table. This vocabulary is STABLE — routines on disk depend on it.
  *
- *  • The REGISTERED vocabulary — what pi-mcp-adapter actually names a tool when it
- *    registers it with Pi: `formatToolName()` → "<serverPrefix>_<tool>", ONE
- *    underscore, with dashes in the server name folded to underscores. And Pi's
- *    `tools:` option is an exact-match Set (`allowedToolNames`), so a literal
- *    "github__*" or even "github__create_issue" handed to it matches nothing at all.
+ *  • The REGISTERED vocabulary — what Pi's built-in MCP support names a tool:
+ *    "mcp__<server>__<tool>", with every character other than letters, digits and "_"
+ *    replaced by "_" (pi-coding-agent docs/mcp.md, "Configuration rules").
  *
- * This module is the translation layer, mirroring pi-mcp-adapter's `getServerPrefix`
- * / `formatToolName` rather than importing them — the adapter ships as .ts in
- * node_modules and pulling it into our typecheck is the thing `harbor/index.ts`
- * already dodges with a variable import specifier. The mirror is four lines and is
+ * Pi's `tools:` option takes `*` patterns, and once any entry starts with "mcp__" it
+ * keeps ONLY the MCP tools that match — so a selector translates to one allow-list
+ * entry, wildcard included, with no tool inventory to consult and nothing to warm.
+ * Mirrors Pi's naming rather than importing it so this stays Pi-free and testable;
  * pinned by tests/toolSelect.test.ts.
- *
- * The other half of the problem: per-tool names only EXIST when direct tools are
- * enabled. Otherwise the adapter exposes MCP through a single proxy tool named "mcp"
- * — all servers, all tools, one grant, which is precisely what a per-routine
- * allow-list is meant to avoid. So callers pair `names` with `directToolsEnv`, which
- * scopes MCP_DIRECT_TOOLS to exactly the selected server/tool pairs for that one run.
  */
-import { readFileSync } from "node:fs";
-import { join } from "node:path";
-import { agentDir } from "../config/paths.ts";
-
-export type PrefixMode = "server" | "none" | "short";
-
-/** Mirrors pi-mcp-adapter's getServerPrefix. */
-export function serverPrefix(serverName: string, mode: PrefixMode): string {
-  if (mode === "none") return "";
-  if (mode === "short") {
-    const short = serverName.replace(/-?mcp$/i, "").replace(/-/g, "_");
-    return short || "mcp";
-  }
-  return serverName.replace(/-/g, "_");
-}
 
-/** Mirrors pi-mcp-adapter's formatToolName. */
-export function formatToolName(toolName: string, serverName: string, mode: PrefixMode): string {
-  const p = serverPrefix(serverName, mode);
-  return p ? `${p}_${toolName}` : toolName;
-}
+import { createHash } from "node:crypto";
 
-/** The cached tool inventory the adapter builds after connecting: server → tool names. */
-export type McpInventory = Record<string, string[]>;
+const NON_IDENT = /[^A-Za-z0-9_]/g;
+// Pi's cap (extensions/mcp/tools.js MAX_TOOL_NAME_LENGTH); longer names get a hash.
+const MAX_TOOL_NAME_LENGTH = 64;
 
-export interface ResolveInput {
-  /** "<server>__<tool>" / "<server>__*" selectors, as stored on the routine. */
-  selectors: string[];
-  /** Server → the tool names it exposes, from the adapter's metadata cache. */
-  inventory: McpInventory;
-  /** The adapter's tool-prefix mode (mcp.json → settings.toolPrefix). */
-  prefix: PrefixMode;
+/**
+ * Pi's registered name for one MCP tool — createMcpToolName, including its shortening
+ * of a name over 64 characters to a prefix plus a hash of server and tool. (Pi also
+ * hashes two tools whose sanitized names collide; that depends on the live tool list
+ * and can't be predicted from a selector.)
+ */
+export function mcpToolName(server: string, tool: string): string {
+  const name = `mcp__${server}__${tool}`.replace(NON_IDENT, "_");
+  if (name.length <= MAX_TOOL_NAME_LENGTH) return name;
+  const hash = createHash("sha256").update(`${server}\0${tool}`).digest("hex").slice(0, 8);
+  return `${name.slice(0, MAX_TOOL_NAME_LENGTH - hash.length - 1)}_${hash}`;
 }
 
 export interface ResolvedMcpTools {
-  /** Exact registered tool names to hand to Pi's `tools:` allow-list. */
-  names: string[];
-  /** Servers touched by the selectors — the set that must be reachable this run. */
+  /** Entries for Pi's `tools:` allow-list — exact names, or "mcp__<server>__*". */
+  patterns: string[];
+  /** Servers touched by the selectors, in selector order. */
   servers: string[];
-  /** MCP_DIRECT_TOOLS entries ("server/tool", or bare "server" for a wildcard). */
-  directToolsEnv: string[];
-  /**
-   * Servers a selector named that the metadata cache knows nothing about. A wildcard
-   * over one of these expands to NOTHING, so the caller must warm the cache before
-   * building the session — see harbor/index.ts. Never silently ignore this.
-   */
-  coldServers: string[];
-  /**
-   * Exact selectors whose server DID report an inventory that doesn't contain that
-   * tool — a typo, or a tool the connector dropped. The name is still granted (it
-   * simply never registers), but the caller should say so rather than let the run
-   * quietly come back thinner than asked for.
-   */
-  unknownTools: string[];
 }
 
-/**
- * Expand selectors against a known inventory. Pure — the file reads live in
- * `resolveMcpSelection` below so this stays trivially testable.
- *
- * An EXACT selector resolves without the inventory (we can compute the registered
- * name from the server + tool alone), so a connector whose cache entry is stale still
- * works. A WILDCARD needs the inventory to enumerate, which is why `coldServers`
- * exists.
- */
-export function resolveMcpTools({ selectors, inventory, prefix }: ResolveInput): ResolvedMcpTools {
-  const names: string[] = [];
+/** Translate stored selectors into Pi allow-list patterns. Pure. */
+export function resolveMcpTools(selectors: string[]): ResolvedMcpTools {
+  const patterns: string[] = [];
   const servers: string[] = [];
-  const directToolsEnv: string[] = [];
-  const coldServers: string[] = [];
-  const unknownTools: string[] = [];
-
-  const push = <T>(arr: T[], v: T) => {
+  const push = (arr: string[], v: string) => {
     if (!arr.includes(v)) arr.push(v);
   };
-
   for (const selector of selectors) {
     const sep = selector.indexOf("__");
     if (sep <= 0) continue; // not a selector; splitRoutineTools already routed it
@@ -111,67 +60,17 @@ export function resolveMcpTools({ selectors, inventory, prefix }: ResolveInput):
     const tool = selector.slice(sep + 2);
     if (!tool) continue;
     push(servers, server);
-
-    if (tool === "*") {
-      const known = inventory[server];
-      if (!known || known.length === 0) {
-        push(coldServers, server);
-        continue;
-      }
-      // Bare server name = "every tool on this server" to MCP_DIRECT_TOOLS.
-      push(directToolsEnv, server);
-      for (const t of known) push(names, formatToolName(t, server, prefix));
-      continue;
-    }
-
-    push(names, formatToolName(tool, server, prefix));
-    // MCP_DIRECT_TOOLS matches the ORIGINAL (unprefixed) tool name.
-    push(directToolsEnv, `${server}/${tool}`);
-    const known = inventory[server];
-    if (!known || known.length === 0) push(coldServers, server);
-    else if (!known.includes(tool)) push(unknownTools, selector);
+    push(patterns, tool === "*" ? `${serverPrefix(server)}*` : mcpToolName(server, tool));
   }
-
-  return { names, servers, directToolsEnv, coldServers, unknownTools };
+  return { patterns, servers };
 }
 
-/** The adapter's metadata cache, as it lands on disk (agent/mcp-cache.json). */
-export function readMcpInventory(dir: string = agentDir()): McpInventory {
-  const out: McpInventory = {};
-  try {
-    const raw = JSON.parse(readFileSync(join(dir, "mcp-cache.json"), "utf8"));
-    for (const [server, entry] of Object.entries<any>(raw?.servers ?? {})) {
-      const tools = Array.isArray(entry?.tools)
-        ? entry.tools.map((t: any) => String(t?.name ?? "")).filter(Boolean)
-        : [];
-      out[server] = tools;
-    }
-  } catch {
-    /* no cache yet — every selected server is cold */
-  }
-  return out;
-}
-
-/**
- * The adapter's prefix mode. `mcpControl.project()` pins "server" into the file it
- * writes, so this is really a guard for a hand-written mcp.json.
- */
-export function readPrefixMode(dir: string = agentDir()): PrefixMode {
-  try {
-    const raw = JSON.parse(readFileSync(join(dir, "mcp.json"), "utf8"));
-    const mode = raw?.settings?.toolPrefix;
-    if (mode === "server" || mode === "none" || mode === "short") return mode;
-  } catch {
-    /* no config — the adapter's own default */
-  }
-  return "server";
+/** "mcp__<server>__", the start of every tool name of `server`. */
+function serverPrefix(server: string): string {
+  return `mcp__${server.replace(NON_IDENT, "_")}__`;
 }
 
-/** Read-from-disk wrapper around resolveMcpTools. */
-export function resolveMcpSelection(selectors: string[], dir: string = agentDir()): ResolvedMcpTools {
-  return resolveMcpTools({
-    selectors,
-    inventory: readMcpInventory(dir),
-    prefix: readPrefixMode(dir),
-  });
+/** Does a registered tool name belong to `server`? */
+export function isToolOfServer(registered: string, server: string): boolean {
+  return registered.startsWith(serverPrefix(server));
 }

package/src/permissions/classify.ts

@@ -235,6 +235,10 @@ const MEDIA_TITLES: Record<string, string> = {
 const RESUME_VIDEO_TITLE = "Save a video already generated (nothing further is billed)";
 const RESUME_SPRITE_TITLE = "Save a sprite animation already generated (nothing further is billed)";
 
+// Pi's MCP resource tools (core/mcp-servers.js). They list and read resources from
+// every connected server — network reads from connectors the user configured.
+const MCP_RESOURCE_TOOLS = new Set(["list_mcp_resources", "list_mcp_resource_templates", "read_mcp_resource"]);
+
 export function classifyToolCall(
   toolName: string,
   input: unknown,
@@ -246,6 +250,41 @@ export function classifyToolCall(
 
   if (NON_GATED.has(name)) return null;
 
+  // codemode runs a model-written script in a QuickJS sandbox with no file system, no
+  // network and no timers: everything it does to the world is a tool call, and Pi
+  // sends each one through tool_call like a direct call (parentToolCallId set). Those
+  // nested calls ARE the actions, and each is classified on its own merits right here.
+  // Gating the script as well would put two prompts in front of every action, the
+  // outer one showing only source code. (Its `models` global is turned off where we
+  // create it — config/moat.ts and extensions/privateer-codemode.ts.)
+  //
+  // tool_search only changes which tools are declared to the model; it calls nothing.
+  if (name === "codemode" || name === "tool_search") return null;
+
+  if (MCP_RESOURCE_TOOLS.has(name)) {
+    return {
+      tool: toolName,
+      kind: "fetch",
+      title: name === "read_mcp_resource" ? `Read a resource from ${str(obj.server) || "a connector"}` : "List connector resources",
+      detail: str(obj.uri) || str(obj.server) || "all connectors",
+    };
+  }
+
+  // An MCP server tool, "mcp__<server>__<tool>". Matched before the name heuristics
+  // below, which would otherwise read a tool called fetch_url or web_search on some
+  // server as a plain network fetch. Bash-kind, exactly as every MCP call was before
+  // (asks in default, denies in plan, allows under bypass). Not reclassified from the
+  // server's own readOnlyHint: that hint is self-reported, and a fetch-kind "always"
+  // relaxes the whole session to acceptEdits (ModeGate) rather than remembering the
+  // one call.
+  if (name.startsWith("mcp__")) {
+    const rest = toolName.slice("mcp__".length);
+    const sep = rest.indexOf("__");
+    const server = sep > 0 ? rest.slice(0, sep) : "a connector";
+    const tool = sep > 0 ? rest.slice(sep + 2) : rest;
+    return { tool: toolName, kind: "bash", title: `Run ${tool} on ${server}`, detail: safeJson(obj) };
+  }
+
   // Creating a routine is a persistent mutation; surface the trigger + delivery, and
   // force a human decision (alwaysAsk) when it grants off-machine egress.
   if (name === "create_routine" || name === "routine") {
@@ -688,10 +727,9 @@ export function classifyToolCall(
     };
   }
 
-  // Unknown / custom / MCP tool: we can't prove it's side-effect-free, so
-  // safe-by-default is to prompt. Classified as a bash-kind action (asks in
-  // default/acceptEdits, denies in plan, allows only under bypass). Phase 5 refines
-  // this with MCP destructiveHint → alwaysAsk and a per-tool policy map.
+  // Unknown / custom tool: we can't prove it's side-effect-free, so safe-by-default
+  // is to prompt. Classified as a bash-kind action (asks in default/acceptEdits,
+  // denies in plan, allows only under bypass). MCP tools are handled above.
   return {
     tool: toolName,
     kind: "bash",

package/src/permissions/protected.ts

@@ -26,8 +26,15 @@ function looksSensitive(name: string): boolean {
   return /^\.env(\..+)?$/.test(name) || /secret|credential/i.test(name);
 }
 
+// A project's own MCP config: Pi reads `.pi/mcp.json` once the project is trusted and
+// launches every stdio `command` in it, and expands `!command` values in env and
+// headers — so a write there is code that runs at the next session start, not a
+// settings tweak.
+const PROJECT_CONFIG_DIRS = new Set([".pi", ".privateer"]);
+
 export function isProtectedPath(p: string): boolean {
   const name = basename(p);
+  if (name === "mcp.json" && PROJECT_CONFIG_DIRS.has(basename(dirname(p)))) return true;
   return PROTECTED_BASENAMES.has(name) || looksSensitive(name);
 }
 

package/src/providers/account.ts

@@ -872,7 +872,12 @@ export function registerAccountModels(pi: {
 // after the picker built its list, and privateer models would be missing until reopen.
 // registerProvider replaces the provider's models on the second call, and the picker's
 // refresh() re-applies registered providers, so the full list appears once fetched.
-export function makeAccountProvider() {
+// `armOnStart: false` is for a host that owns the credential itself. The harbor leases
+// ONE account credential across its concurrent runs (harbor/accountLease.ts) and now
+// binds every run's extensions — Pi's MCP support connects servers on session_start —
+// so the launch seed below would mint a second credential per daemon for runs that
+// never use the account channel, a device nothing revokes.
+export function makeAccountProvider(opts: { armOnStart?: boolean } = {}) {
   return (pi: {
     registerProvider?: (name: string, config: unknown) => void;
     on?: (event: string, handler: (e: unknown, ctx: unknown) => unknown) => void;
@@ -918,7 +923,7 @@ export function makeAccountProvider() {
     // all, and the first prompt dead-ends on "No API key found for privateer." — even
     // though the banner says "connected". The REPL (cli/chat.ts) and the harbor
     // already spawn one at startup; this gives the TUI the same seed.
-    pi.on?.("session_start", (_e, ctx) => void armAccountCredential(ctx));
+    if (opts.armOnStart !== false) pi.on?.("session_start", (_e, ctx) => void armAccountCredential(ctx));
 
     // Two safety nets around the account channel, both OUTSIDE the request path —
     // they read Pi's in-memory auth map and its finished messages, and never touch the