tomo-ai 0.6.1 → 0.7.0

package/CHANGELOG.md

@@ -1,5 +1,12 @@
 # Changelog
 
+## 0.7.0 (2026-05-29)
+
+### Features
+
+- **External MCP server support with harness-managed OAuth** (#114, #115). Users can declare additional MCP servers in `~/.tomo/config.json` under `mcpServers` (also accepted as `mcp.servers`) for stdio, HTTP, streamable HTTP, and SSE transports; optional `mcpAllowedTools` restricts the surface, otherwise all configured tools are exposed. For OAuth-protected remotes (GitHub Copilot MCP, Robinhood MCP, etc.), a per-server `oauth` block drives authorization-code + PKCE with dynamic client registration and a localhost callback; the harness refreshes near-expiry tokens and injects `Authorization: Bearer …` into HTTP/SSE headers at session-build time. Tokens live in `~/.tomo/workspace/secrets/mcp-oauth.json` (mode `0600`), kept separate from `keychain.json` so keychain rewrites don't wipe MCP auth, and never reach the agent. Auth failures are isolated per server — a broken server is omitted with a one-line notice and the session still starts. Discovery follows RFC 9728 `WWW-Authenticate` challenges with a `/.well-known/oauth-protected-resource/...` fallback for POST-only endpoints like Robinhood MCP. The bundled `tomo-system` skill now tells the agent that user-configured tools appear as `mcp__<server>__<tool>` and that it should never ask users for tokens.
+- **1M context model options** (#116). New `/model` aliases `sonnet-1m` and `opus-1m` map to `claude-sonnet-4-6[1m]` and `claude-opus-4-8[1m]`. `claude-sonnet-4-6[1m]` is now the default for new/fallback configs. Init/config UI labels, the Telegram command description, README, and `tomo-system/CONFIG.md` are updated to match.
+
 ## 0.6.1 (2026-05-28)
 
 ### Other

package/README.md

@@ -58,7 +58,7 @@ tomo sessions clear    # Reset all sessions
 | Command | Description |
 |---------|-------------|
 | `/new` | Start a new conversation (resets session) |
-| `/model` | Switch model (sonnet/opus/haiku) |
+| `/model` | Switch model (sonnet/sonnet-1m/opus/opus-1m/haiku) |
 | `/restore` | Restore `config.json` from `config.json.bak` and restart |
 | `/status` | Show session info (model, channel, message count) |
 
@@ -119,6 +119,46 @@ Tomo has access to Claude's built-in tools:
 | `send_message` (MCP) | Proactively send a message to another session/identity |
 | `list_sessions` (MCP) | List active identities and group sessions |
 
+### External MCP Servers
+
+Add remote or local MCP servers directly to `~/.tomo/config.json` under `mcpServers`. Tomo passes them through to the Claude Agent SDK and, by default, auto-allows all tools from each configured server with `mcp__<server>__*`.
+
+```json
+{
+  "mcpServers": {
+    "docs": {
+      "type": "http",
+      "url": "https://code.claude.com/docs/mcp"
+    },
+    "github": {
+      "type": "sse",
+      "url": "https://api.example.com/mcp/sse",
+      "headers": {
+        "Authorization": "Bearer ${GITHUB_TOKEN}"
+      }
+    },
+    "github-copilot": {
+      "type": "http",
+      "url": "https://api.githubcopilot.com/mcp/",
+      "oauth": {
+        "scopes": ["read:user"],
+        "tokenStoreKey": "github-copilot"
+      }
+    },
+    "filesystem": {
+      "command": "npx",
+      "args": ["-y", "@modelcontextprotocol/server-filesystem", "${HOME}/Projects"]
+    }
+  }
+}
+```
+
+Use `type: "http"` for streamable HTTP, `type: "sse"` for SSE, or omit `type` for stdio servers. Environment variables in `url`, `headers`, `env`, and `args` are expanded at runtime. To restrict auto-approval, set top-level `mcpAllowedTools`, for example `["mcp__github__list_issues"]`.
+
+Remote HTTP/SSE servers can also use harness-managed OAuth by adding an `oauth` block. Tomo discovers the authorization server from the MCP server's RFC 9728 `WWW-Authenticate` challenge unless `authorizationServer` is set explicitly, uses authorization-code + PKCE, registers a dynamic client when needed, stores tokens in `~/.tomo/workspace/secrets/mcp-oauth.json` with mode `0600`, silently refreshes near-expiry tokens, and injects `Authorization: Bearer <token>` into MCP headers. The agent never sees the tokens.
+
+If browser login is needed, Tomo forwards the authorize URL to your private chat and waits for the localhost callback before starting the agent session.
+
 ### Scheduled Tasks
 
 Tomo can create scheduled tasks on its own — just ask "remind me in 30 minutes to stretch" or "check the weather every morning at 9am." Supports one-shot reminders, recurring intervals, and cron expressions.
@@ -177,7 +217,7 @@ Run `tomo config` for interactive setup, or edit `~/.tomo/config.json` directly:
       "replyPolicy": "last-active"
     }
   ],
-  "model": "claude-sonnet-4-6",
+  "model": "claude-sonnet-4-6[1m]",
   "maxTurns": 50,
   "saveInboundImages": true,
   "groupSecret": "tomo-xxxxxxxx",

package/defaults/skills/system/CONFIG.md

@@ -8,7 +8,7 @@ Before direct edits, copy `~/.tomo/config.json` to `~/.tomo/config.json.bak`. Ch
 
 ```json
 {
-  "model": "claude-sonnet-4-6",
+  "model": "claude-sonnet-4-6[1m]",
   "city": "Seattle",
   "continuity": false,
   "groupSecret": "tomo-a1b2c3d4",
@@ -36,9 +36,23 @@ Before direct edits, copy `~/.tomo/config.json` to `~/.tomo/config.json.bak`. Ch
     }
   ],
   "sessionModelOverrides": {
-    "dm:alice": "claude-opus-4-8"
+    "dm:alice": "claude-opus-4-8[1m]"
   },
   "maxTurns": 50,
+  "mcpServers": {
+    "github-copilot": {
+      "type": "http",
+      "url": "https://api.githubcopilot.com/mcp/",
+      "oauth": {
+        "scopes": ["read:user"],
+        "tokenStoreKey": "github-copilot"
+      }
+    },
+    "filesystem": {
+      "command": "npx",
+      "args": ["-y", "@modelcontextprotocol/server-filesystem", "${HOME}/Projects"]
+    }
+  },
   "lcm": {
     "nudgeAtPct": 70,
     "nudgeResetPct": 60,
@@ -52,7 +66,7 @@ Before direct edits, copy `~/.tomo/config.json` to `~/.tomo/config.json.bak`. Ch
 
 | Field | Type | Allowed values / notes |
 |---|---|---|
-| `model` | string | `claude-sonnet-4-6`, `claude-opus-4-8`, `claude-haiku-4-5`. Default model for every session. |
+| `model` | string | `claude-sonnet-4-6[1m]`, `claude-sonnet-4-6`, `claude-opus-4-8[1m]`, `claude-opus-4-8`, `claude-haiku-4-5`. Default model for every session. |
 | `city` | string \| null | Any city name (e.g. `"Seattle"`). Used for weather in continuity pings. `null` or missing = no weather. |
 | `continuity` | boolean | `true` / `false`. Enables periodic proactive heartbeats. Off by default. |
 | `groupSecret` | string \| null | Passphrase users send in a group chat to activate Tomo there. `null` disables group chats entirely. |
@@ -68,6 +82,9 @@ Before direct edits, copy `~/.tomo/config.json` to `~/.tomo/config.json.bak`. Ch
 | `identities[].replyPolicy` | string | `"last-active"` (reply on whichever channel the identity last messaged from) or a fixed channel name like `"telegram"` / `"imessage"` (always reply there). |
 | `sessionModelOverrides` | object | `{ sessionKey: modelId }` — per-session model override, takes precedence over top-level `model`. Keys are session keys (`dm:alice`, `telegram:12345`, etc.). Written by `/model <name>` for the current chat and by the `tomo config` Sessions menu. |
 | `maxTurns` | number | Max agent turns per single user message (one turn ≈ one tool-use round). Default `50`. Raise if you see "max turns exceeded" on long tool chains. |
+| `mcpServers` | object | External MCP servers keyed by server name. Supports stdio (`command`, `args`, `env`), HTTP (`type: "http"`, `url`, `headers`), and SSE (`type: "sse"`, `url`, `headers`). Environment variables like `${HOME}` expand in `url`, `headers`, `env`, and `args`. |
+| `mcpServers.<name>.oauth` | object | Optional harness-managed OAuth for HTTP/SSE MCP servers. Supports `authorizationServer` (optional; omitted = discover from the MCP server), `clientId` (optional if dynamic registration is available), `scopes`, `tokenStoreKey`, `redirectUri`, and `clientName`. Tokens are stored outside agent context in `workspace/secrets/mcp-oauth.json` (`0600`). |
+| `mcpAllowedTools` | string[] | Auto-allowed external MCP tools. If omitted, Tomo defaults to `mcp__<server>__*` for every configured external server. Set this to narrow tool access, e.g. `["mcp__github__list_issues"]`. |
 | `lcm.nudgeAtPct` | number | Context-usage % at which the harness nudges the agent to run `tomo lcm daily`. Default `70`. Lower = compact earlier and more often. |
 | `lcm.nudgeResetPct` | number | Hysteresis reset threshold — the "already nudged" flag clears once usage drops below this %. Default `60`. Must be less than `nudgeAtPct`; invalid values fall back to defaults. |
 | `lcm.groupCompactStyle` | string | `"sdk"` (default) or `"lcm"`. `"sdk"` lets the SDK auto-compact group sessions; `"lcm"` opts groups into the same hierarchical LCM flow as DMs (disables SDK auto-compact and fires all three harness nudges: 70% daily, 80% safety net, and the periodic rollup runner). DMs always use LCM regardless. |

package/defaults/skills/system/SKILL.md

@@ -107,6 +107,11 @@ In-process MCP tools let you message outside the current conversation:
 
 Pass identity name (`"alice"`) or session key (`"telegram:-1001234567"`) as `target`. Call `list_sessions` first if unsure. Tool result lines (with `is_error` flag) appear in `tomo logs` immediately after the corresponding tool call.
 
+### External MCP tools
+Users may configure additional MCP servers in `~/.tomo/config.json`; their tools appear as `mcp__<server>__<tool>`. Use them normally when relevant.
+
+OAuth/token handling is harness-managed. Never ask the user for bearer tokens, OAuth codes, refresh tokens, or MCP auth headers. If a configured MCP server needs login, Tomo sends the user a private login link and injects tokens outside your context. If a server is unavailable, continue with other tools and explain the limitation only if it affects the answer.
+
 ## Skills
 
 ### Built-in skills (`tomo-*`)

package/dist/agent/sdk-options.d.ts

@@ -1,4 +1,4 @@
-import type { McpSdkServerConfigWithInstance } from "@anthropic-ai/claude-agent-sdk";
+import type { ElicitationRequest, ElicitationResult, McpSdkServerConfigWithInstance, McpServerConfig } from "@anthropic-ai/claude-agent-sdk";
 import { skillsCanUseTool } from "./permissions.js";
 /** True when the session uses our custom LCM compaction (DMs always; groups
  *  unless config.lcm.groupCompactStyle="sdk"). When false, SDK auto-compact is
@@ -27,13 +27,17 @@ export interface SessionContext {
          *  config.passiveGroups. Drives the "stay silent unless useful" rule. */
         isPassive: boolean;
     };
+    onMcpElicitation?: (request: ElicitationRequest) => Promise<ElicitationResult>;
 }
-export declare function sdkOptions(internalMcpServer: McpSdkServerConfigWithInstance, resumeSessionId?: string, model?: string, sessionContext?: SessionContext, turnBudget?: TurnBudget): {
+export declare function sdkOptions(internalMcpServer: McpSdkServerConfigWithInstance, resumeSessionId?: string, model?: string, sessionContext?: SessionContext, turnBudget?: TurnBudget, externalMcpServersOverride?: Record<string, McpServerConfig>): {
     env?: {
         DISABLE_AUTO_COMPACT: string;
     } | undefined;
     resume?: string | undefined;
     hooks: Record<string, unknown>;
+    includePartialMessages: boolean;
+    maxTurns: number;
+    onElicitation?: ((request: ElicitationRequest) => Promise<ElicitationResult>) | undefined;
     model: string;
     cwd: string;
     systemPrompt: string;
@@ -52,14 +56,15 @@ export declare function sdkOptions(internalMcpServer: McpSdkServerConfigWithInst
         };
     };
     canUseTool: typeof skillsCanUseTool;
-    includePartialMessages: boolean;
-    maxTurns: number;
 } | {
     env?: {
         DISABLE_AUTO_COMPACT: string;
     } | undefined;
     resume?: string | undefined;
     hooks?: undefined;
+    includePartialMessages: boolean;
+    maxTurns: number;
+    onElicitation?: ((request: ElicitationRequest) => Promise<ElicitationResult>) | undefined;
     model: string;
     cwd: string;
     systemPrompt: string;
@@ -78,7 +83,5 @@ export declare function sdkOptions(internalMcpServer: McpSdkServerConfigWithInst
         };
     };
     canUseTool: typeof skillsCanUseTool;
-    includePartialMessages: boolean;
-    maxTurns: number;
 };
 //# sourceMappingURL=sdk-options.d.ts.map

package/dist/agent/sdk-options.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sdk-options.d.ts","sourceRoot":"","sources":["../../src/agent/sdk-options.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,gCAAgC,CAAC;AAMrF,OAAO,EAA2B,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAS7E;;6DAE6D;AAC7D,wBAAgB,cAAc,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAG1D;AAED;;;;6EAI6E;AAC7E,MAAM,WAAW,UAAU;IACzB,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,OAAO,CAAC;IACjB,OAAO,EAAE,OAAO,CAAC;CAClB;AAED,wBAAgB,cAAc,IAAI,UAAU,CAE3C;AAED,wBAAgB,eAAe,CAAC,CAAC,EAAE,UAAU,GAAG,IAAI,CAInD;AAED,MAAM,WAAW,cAAc;IAC7B,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,iEAAiE;IACjE,KAAK,CAAC,EAAE;QACN,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;QACxB;iFACyE;QACzE,SAAS,EAAE,OAAO,CAAC;KACpB,CAAC;CACH;AAED,wBAAgB,UAAU,CACxB,iBAAiB,EAAE,8BAA8B,EACjD,eAAe,CAAC,EAAE,MAAM,EACxB,KAAK,CAAC,EAAE,MAAM,EACd,cAAc,CAAC,EAAE,cAAc,EAC/B,UAAU,CAAC,EAAE,UAAU;;;;;;;;;;;;;;;;oBAyDU,CAAC,SAAS,CAAC,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;oBAAb,CAAC,SAAS,CAAC,EAAE;;;;;;;;;;EA0B/C"}
+{"version":3,"file":"sdk-options.d.ts","sourceRoot":"","sources":["../../src/agent/sdk-options.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,8BAA8B,EAAE,eAAe,EAAE,MAAM,gCAAgC,CAAC;AAM7I,OAAO,EAA2B,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAS7E;;6DAE6D;AAC7D,wBAAgB,cAAc,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAG1D;AAED;;;;6EAI6E;AAC7E,MAAM,WAAW,UAAU;IACzB,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,OAAO,CAAC;IACjB,OAAO,EAAE,OAAO,CAAC;CAClB;AAED,wBAAgB,cAAc,IAAI,UAAU,CAE3C;AAED,wBAAgB,eAAe,CAAC,CAAC,EAAE,UAAU,GAAG,IAAI,CAInD;AAED,MAAM,WAAW,cAAc;IAC7B,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,iEAAiE;IACjE,KAAK,CAAC,EAAE;QACN,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;QACxB;iFACyE;QACzE,SAAS,EAAE,OAAO,CAAC;KACpB,CAAC;IACF,gBAAgB,CAAC,EAAE,CAAC,OAAO,EAAE,kBAAkB,KAAK,OAAO,CAAC,iBAAiB,CAAC,CAAC;CAChF;AAED,wBAAgB,UAAU,CACxB,iBAAiB,EAAE,8BAA8B,EACjD,eAAe,CAAC,EAAE,MAAM,EACxB,KAAK,CAAC,EAAE,MAAM,EACd,cAAc,CAAC,EAAE,cAAc,EAC/B,UAAU,CAAC,EAAE,UAAU,EACvB,0BAA0B,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC;;;;;;;;+BAT/B,kBAAkB,KAAK,OAAO,CAAC,iBAAiB,CAAC;;;;;;;;;;;oBA4E7C,CAAC,SAAS,CAAC,EAAE;;;;;;;;;;;;;;;;+BA5EjB,kBAAkB,KAAK,OAAO,CAAC,iBAAiB,CAAC;;;;;;;;;;;oBA4E7C,CAAC,SAAS,CAAC,EAAE;;;;;;;;EA2B/C"}

package/dist/agent/sdk-options.js

@@ -26,7 +26,7 @@ export function resetTurnBudget(b) {
     b.fired75 = false;
     b.fired90 = false;
 }
-export function sdkOptions(internalMcpServer, resumeSessionId, model, sessionContext, turnBudget) {
+export function sdkOptions(internalMcpServer, resumeSessionId, model, sessionContext, turnBudget, externalMcpServersOverride) {
     const isGroup = sessionContext ? isGroupSessionKey(sessionContext.sessionKey) : false;
     let systemPrompt = buildSystemPrompt({ isGroup });
     // Inject session context so the agent can use LCM tools
@@ -57,6 +57,10 @@ export function sdkOptions(internalMcpServer, resumeSessionId, model, sessionCon
         }
         systemPrompt += lines.join("\n");
     }
+    const configuredMcpServers = Object.fromEntries(Object.entries(config.mcpServers ?? {}).map(([name, entry]) => [name, entry.server]));
+    const externalMcpServers = Object.fromEntries(Object.entries(externalMcpServersOverride ?? configuredMcpServers)
+        .filter(([name]) => name !== TOMO_INTERNAL_MCP_NAME));
+    const externalMcpAllowedTools = Array.isArray(config.mcpAllowedTools) ? config.mcpAllowedTools : [];
     return {
         model: model ?? config.model,
         cwd: config.workspaceDir,
@@ -74,6 +78,7 @@ export function sdkOptions(internalMcpServer, resumeSessionId, model, sessionCon
             `mcp__${TOMO_INTERNAL_MCP_NAME}__schedule_create`,
             `mcp__${TOMO_INTERNAL_MCP_NAME}__schedule_list`,
             `mcp__${TOMO_INTERNAL_MCP_NAME}__schedule_remove`,
+            ...externalMcpAllowedTools,
         ],
         // SDK v0.2.133 deprecated passing "Skill" in allowedTools — the new path
         // is the top-level `skills` option. The SDK appends `"Skill"` (or
@@ -81,7 +86,7 @@ export function sdkOptions(internalMcpServer, resumeSessionId, model, sessionCon
         // `skills` is defined, so we set it to "all" to keep every discovered
         // skill invocable (same surface as the old `"Skill"` allowedTools entry).
         skills: "all",
-        mcpServers: { [TOMO_INTERNAL_MCP_NAME]: internalMcpServer },
+        mcpServers: { ...externalMcpServers, [TOMO_INTERNAL_MCP_NAME]: internalMcpServer },
         settingSources: ["project"],
         settings: {
             attribution: {
@@ -92,6 +97,7 @@ export function sdkOptions(internalMcpServer, resumeSessionId, model, sessionCon
         // See ./permissions.ts — canUseTool re-allows `.claude/skills/` writes
         // that bypassPermissions otherwise routes here as denials.
         canUseTool: skillsCanUseTool,
+        ...(sessionContext?.onMcpElicitation ? { onElicitation: sessionContext.onMcpElicitation } : {}),
         includePartialMessages: true,
         maxTurns: config.maxTurns,
         ...buildHooksOption({

package/dist/agent/sdk-options.js.map

@@ -1 +1 @@
-{"version":3,"file":"sdk-options.js","sourceRoot":"","sources":["../../src/agent/sdk-options.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AACtC,OAAO,EAAE,GAAG,EAAE,MAAM,cAAc,CAAC;AACnC,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAC1D,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,EAAE,sBAAsB,EAAE,MAAM,2BAA2B,CAAC;AACnE,OAAO,EAAE,uBAAuB,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAE7E,2EAA2E;AAC3E,uEAAuE;AACvE,uEAAuE;AACvE,uEAAuE;AACvE,8EAA8E;AAC9E,+CAA+C;AAE/C;;6DAE6D;AAC7D,MAAM,UAAU,cAAc,CAAC,UAAkB;IAC/C,IAAI,CAAC,iBAAiB,CAAC,UAAU,CAAC;QAAE,OAAO,IAAI,CAAC;IAChD,OAAO,MAAM,CAAC,GAAG,CAAC,iBAAiB,KAAK,KAAK,CAAC;AAChD,CAAC;AAaD,MAAM,UAAU,cAAc;IAC5B,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;AACtD,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,CAAa;IAC3C,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC;IACZ,CAAC,CAAC,OAAO,GAAG,KAAK,CAAC;IAClB,CAAC,CAAC,OAAO,GAAG,KAAK,CAAC;AACpB,CAAC;AAeD,MAAM,UAAU,UAAU,CACxB,iBAAiD,EACjD,eAAwB,EACxB,KAAc,EACd,cAA+B,EAC/B,UAAuB;IAEvB,MAAM,OAAO,GAAG,cAAc,CAAC,CAAC,CAAC,iBAAiB,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;IACtF,IAAI,YAAY,GAAG,iBAAiB,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC;IAElD,wDAAwD;IACxD,IAAI,cAAc,EAAE,CAAC;QACnB,MAAM,KAAK,GAAG;YACZ,sCAAsC;YACtC,kBAAkB,cAAc,CAAC,UAAU,EAAE;SAC9C,CAAC;QACF,IAAI,cAAc,CAAC,YAAY,EAAE,CAAC;YAChC,KAAK,CAAC,IAAI,CAAC,qBAAqB,cAAc,CAAC,YAAY,EAAE,CAAC,CAAC;QACjE,CAAC;QACD,IAAI,cAAc,CAAC,KAAK,EAAE,CAAC;YACzB,MAAM,CAAC,GAAG,cAAc,CAAC,KAAK,CAAC;YAC/B,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACf,KAAK,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC;YACpC,IAAI,CAAC,CAAC,SAAS;gBAAE,KAAK,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC,SAAS,GAAG,CAAC,CAAC;YAC/D,IAAI,CAAC,CAAC,YAAY,IAAI,CAAC,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAChD,KAAK,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,+EAA+E,CAAC,CAAC;YAChJ,CAAC;YACD,KAAK,CAAC,IAAI,CAAC,+EAA+E,CAAC,CAAC;YAC5F,IAAI,CAAC,CAAC,SAAS,EAAE,CAAC;gBAChB,KAAK,CAAC,IAAI,CAAC,sRAAsR,CAAC,CAAC;YACrS,CAAC;iBAAM,CAAC;gBACN,KAAK,CAAC,IAAI,CAAC,uHAAuH,CAAC,CAAC;YACtI,CAAC;QACH,CAAC;QACD,YAAY,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACnC,CAAC;IAED,OAAO;QACL,KAAK,EAAE,KAAK,IAAI,MAAM,CAAC,KAAK;QAC5B,GAAG,EAAE,MAAM,CAAC,YAAY;QACxB,YAAY;QACZ,cAAc,EAAE,mBAA4B;QAC5C,+BAA+B,EAAE,IAAI;QACrC,YAAY,EAAE;YACZ,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM;YAC/C,WAAW,EAAE,UAAU,EAAE,OAAO,EAAE,cAAc;YAChD,YAAY,EAAE,YAAY,EAAE,SAAS,EAAE,UAAU;YACjD,QAAQ,sBAAsB,gBAAgB;YAC9C,QAAQ,sBAAsB,iBAAiB;YAC/C,QAAQ,sBAAsB,qBAAqB;YACnD,QAAQ,sBAAsB,2BAA2B;YACzD,QAAQ,sBAAsB,mBAAmB;YACjD,QAAQ,sBAAsB,iBAAiB;YAC/C,QAAQ,sBAAsB,mBAAmB;SAClD;QACD,yEAAyE;QACzE,kEAAkE;QAClE,2EAA2E;QAC3E,sEAAsE;QACtE,0EAA0E;QAC1E,MAAM,EAAE,KAAc;QACtB,UAAU,EAAE,EAAE,CAAC,sBAAsB,CAAC,EAAE,iBAAiB,EAAE;QAC3D,cAAc,EAAE,CAAC,SAAS,CAAkB;QAC5C,QAAQ,EAAE;YACR,WAAW,EAAE;gBACX,MAAM,EAAE,qDAAqD;gBAC7D,EAAE,EAAE,qDAAqD;aAC1D;SACF;QACD,uEAAuE;QACvE,2DAA2D;QAC3D,UAAU,EAAE,gBAAgB;QAC5B,sBAAsB,EAAE,IAAI;QAC5B,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,GAAG,gBAAgB,CAAC;YAClB,UAAU;YACV,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,UAAU,EAAE,cAAc,EAAE,UAAU;YACtC,kBAAkB,EAAE,OAAO;SAC5B,CAAC;QACF,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvD,yEAAyE;QACzE,uEAAuE;QACvE,sEAAsE;QACtE,GAAG,CAAC,cAAc,IAAI,cAAc,CAAC,cAAc,CAAC,UAAU,CAAC;YAC7D,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,oBAAoB,EAAE,GAAG,EAAE,EAAE;YACxD,CAAC,CAAC,EAAE,CAAC;KACR,CAAC;AACJ,CAAC;AAED;;8EAE8E;AAC9E,SAAS,gBAAgB,CAAC,IAKzB;IACC,MAAM,KAAK,GAA4B,EAAE,CAAC;IAC1C,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;QACpB,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,eAAe,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC;IACzF,CAAC;IACD,IAAI,IAAI,CAAC,kBAAkB,EAAE,CAAC;QAC5B,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,uBAAuB,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC;IACjE,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;AACxD,CAAC;AAED;;;0DAG0D;AAC1D,SAAS,eAAe,CAAC,MAAkB,EAAE,GAAW,EAAE,UAAmB;IAC3E,MAAM,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC;IAC3C,MAAM,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,GAAG,CAAC,CAAC;IAC1C,OAAO;QACL,aAAa,EAAE,CAAC;gBACd,KAAK,EAAE,CAAC,KAAK,IAAI,EAAE;wBACjB,MAAM,CAAC,KAAK,EAAE,CAAC;wBACf,IAAI,MAAM,CAAC,KAAK,IAAI,WAAW,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;4BACnD,MAAM,CAAC,OAAO,GAAG,IAAI,CAAC;4BACtB,GAAG,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,oBAAoB,CAAC,CAAC;4BAC7E,OAAO;gCACL,kBAAkB,EAAE;oCAClB,aAAa,EAAE,eAAwB;oCACvC,iBAAiB,EAAE,yBAAyB,MAAM,CAAC,KAAK,IAAI,GAAG,6CAA6C,GAAG,0EAA0E;iCAC1L;6BACF,CAAC;wBACJ,CAAC;wBACD,IAAI,MAAM,CAAC,KAAK,IAAI,WAAW,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;4BACnD,MAAM,CAAC,OAAO,GAAG,IAAI,CAAC;4BACtB,GAAG,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,oBAAoB,CAAC,CAAC;4BAC7E,OAAO;gCACL,kBAAkB,EAAE;oCAClB,aAAa,EAAE,eAAwB;oCACvC,iBAAiB,EAAE,uBAAuB,MAAM,CAAC,KAAK,IAAI,GAAG,iGAAiG;iCAC/J;6BACF,CAAC;wBACJ,CAAC;wBACD,OAAO,EAAE,CAAC;oBACZ,CAAC,CAAC;aACH,CAAC;KACH,CAAC;AACJ,CAAC"}
+{"version":3,"file":"sdk-options.js","sourceRoot":"","sources":["../../src/agent/sdk-options.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AACtC,OAAO,EAAE,GAAG,EAAE,MAAM,cAAc,CAAC;AACnC,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAC1D,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,EAAE,sBAAsB,EAAE,MAAM,2BAA2B,CAAC;AACnE,OAAO,EAAE,uBAAuB,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAE7E,2EAA2E;AAC3E,uEAAuE;AACvE,uEAAuE;AACvE,uEAAuE;AACvE,8EAA8E;AAC9E,+CAA+C;AAE/C;;6DAE6D;AAC7D,MAAM,UAAU,cAAc,CAAC,UAAkB;IAC/C,IAAI,CAAC,iBAAiB,CAAC,UAAU,CAAC;QAAE,OAAO,IAAI,CAAC;IAChD,OAAO,MAAM,CAAC,GAAG,CAAC,iBAAiB,KAAK,KAAK,CAAC;AAChD,CAAC;AAaD,MAAM,UAAU,cAAc;IAC5B,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;AACtD,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,CAAa;IAC3C,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC;IACZ,CAAC,CAAC,OAAO,GAAG,KAAK,CAAC;IAClB,CAAC,CAAC,OAAO,GAAG,KAAK,CAAC;AACpB,CAAC;AAgBD,MAAM,UAAU,UAAU,CACxB,iBAAiD,EACjD,eAAwB,EACxB,KAAc,EACd,cAA+B,EAC/B,UAAuB,EACvB,0BAA4D;IAE5D,MAAM,OAAO,GAAG,cAAc,CAAC,CAAC,CAAC,iBAAiB,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;IACtF,IAAI,YAAY,GAAG,iBAAiB,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC;IAElD,wDAAwD;IACxD,IAAI,cAAc,EAAE,CAAC;QACnB,MAAM,KAAK,GAAG;YACZ,sCAAsC;YACtC,kBAAkB,cAAc,CAAC,UAAU,EAAE;SAC9C,CAAC;QACF,IAAI,cAAc,CAAC,YAAY,EAAE,CAAC;YAChC,KAAK,CAAC,IAAI,CAAC,qBAAqB,cAAc,CAAC,YAAY,EAAE,CAAC,CAAC;QACjE,CAAC;QACD,IAAI,cAAc,CAAC,KAAK,EAAE,CAAC;YACzB,MAAM,CAAC,GAAG,cAAc,CAAC,KAAK,CAAC;YAC/B,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACf,KAAK,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC;YACpC,IAAI,CAAC,CAAC,SAAS;gBAAE,KAAK,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC,SAAS,GAAG,CAAC,CAAC;YAC/D,IAAI,CAAC,CAAC,YAAY,IAAI,CAAC,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAChD,KAAK,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,+EAA+E,CAAC,CAAC;YAChJ,CAAC;YACD,KAAK,CAAC,IAAI,CAAC,+EAA+E,CAAC,CAAC;YAC5F,IAAI,CAAC,CAAC,SAAS,EAAE,CAAC;gBAChB,KAAK,CAAC,IAAI,CAAC,sRAAsR,CAAC,CAAC;YACrS,CAAC;iBAAM,CAAC;gBACN,KAAK,CAAC,IAAI,CAAC,uHAAuH,CAAC,CAAC;YACtI,CAAC;QACH,CAAC;QACD,YAAY,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACnC,CAAC;IAED,MAAM,oBAAoB,GAAG,MAAM,CAAC,WAAW,CAC7C,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAClD,CAAC;IACrC,MAAM,kBAAkB,GAAG,MAAM,CAAC,WAAW,CAC3C,MAAM,CAAC,OAAO,CAAC,0BAA0B,IAAI,oBAAoB,CAAC;SAC/D,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,IAAI,KAAK,sBAAsB,CAAC,CACvD,CAAC;IACF,MAAM,uBAAuB,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,CAAC;IAEpG,OAAO;QACL,KAAK,EAAE,KAAK,IAAI,MAAM,CAAC,KAAK;QAC5B,GAAG,EAAE,MAAM,CAAC,YAAY;QACxB,YAAY;QACZ,cAAc,EAAE,mBAA4B;QAC5C,+BAA+B,EAAE,IAAI;QACrC,YAAY,EAAE;YACZ,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM;YAC/C,WAAW,EAAE,UAAU,EAAE,OAAO,EAAE,cAAc;YAChD,YAAY,EAAE,YAAY,EAAE,SAAS,EAAE,UAAU;YACjD,QAAQ,sBAAsB,gBAAgB;YAC9C,QAAQ,sBAAsB,iBAAiB;YAC/C,QAAQ,sBAAsB,qBAAqB;YACnD,QAAQ,sBAAsB,2BAA2B;YACzD,QAAQ,sBAAsB,mBAAmB;YACjD,QAAQ,sBAAsB,iBAAiB;YAC/C,QAAQ,sBAAsB,mBAAmB;YACjD,GAAG,uBAAuB;SAC3B;QACD,yEAAyE;QACzE,kEAAkE;QAClE,2EAA2E;QAC3E,sEAAsE;QACtE,0EAA0E;QAC1E,MAAM,EAAE,KAAc;QACtB,UAAU,EAAE,EAAE,GAAG,kBAAkB,EAAE,CAAC,sBAAsB,CAAC,EAAE,iBAAiB,EAAE;QAClF,cAAc,EAAE,CAAC,SAAS,CAAkB;QAC5C,QAAQ,EAAE;YACR,WAAW,EAAE;gBACX,MAAM,EAAE,qDAAqD;gBAC7D,EAAE,EAAE,qDAAqD;aAC1D;SACF;QACD,uEAAuE;QACvE,2DAA2D;QAC3D,UAAU,EAAE,gBAAgB;QAC5B,GAAG,CAAC,cAAc,EAAE,gBAAgB,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,cAAc,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/F,sBAAsB,EAAE,IAAI;QAC5B,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,GAAG,gBAAgB,CAAC;YAClB,UAAU;YACV,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,UAAU,EAAE,cAAc,EAAE,UAAU;YACtC,kBAAkB,EAAE,OAAO;SAC5B,CAAC;QACF,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvD,yEAAyE;QACzE,uEAAuE;QACvE,sEAAsE;QACtE,GAAG,CAAC,cAAc,IAAI,cAAc,CAAC,cAAc,CAAC,UAAU,CAAC;YAC7D,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,oBAAoB,EAAE,GAAG,EAAE,EAAE;YACxD,CAAC,CAAC,EAAE,CAAC;KACR,CAAC;AACJ,CAAC;AAED;;8EAE8E;AAC9E,SAAS,gBAAgB,CAAC,IAKzB;IACC,MAAM,KAAK,GAA4B,EAAE,CAAC;IAC1C,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;QACpB,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,eAAe,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC;IACzF,CAAC;IACD,IAAI,IAAI,CAAC,kBAAkB,EAAE,CAAC;QAC5B,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,uBAAuB,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC;IACjE,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;AACxD,CAAC;AAED;;;0DAG0D;AAC1D,SAAS,eAAe,CAAC,MAAkB,EAAE,GAAW,EAAE,UAAmB;IAC3E,MAAM,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC;IAC3C,MAAM,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,GAAG,CAAC,CAAC;IAC1C,OAAO;QACL,aAAa,EAAE,CAAC;gBACd,KAAK,EAAE,CAAC,KAAK,IAAI,EAAE;wBACjB,MAAM,CAAC,KAAK,EAAE,CAAC;wBACf,IAAI,MAAM,CAAC,KAAK,IAAI,WAAW,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;4BACnD,MAAM,CAAC,OAAO,GAAG,IAAI,CAAC;4BACtB,GAAG,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,oBAAoB,CAAC,CAAC;4BAC7E,OAAO;gCACL,kBAAkB,EAAE;oCAClB,aAAa,EAAE,eAAwB;oCACvC,iBAAiB,EAAE,yBAAyB,MAAM,CAAC,KAAK,IAAI,GAAG,6CAA6C,GAAG,0EAA0E;iCAC1L;6BACF,CAAC;wBACJ,CAAC;wBACD,IAAI,MAAM,CAAC,KAAK,IAAI,WAAW,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;4BACnD,MAAM,CAAC,OAAO,GAAG,IAAI,CAAC;4BACtB,GAAG,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,oBAAoB,CAAC,CAAC;4BAC7E,OAAO;gCACL,kBAAkB,EAAE;oCAClB,aAAa,EAAE,eAAwB;oCACvC,iBAAiB,EAAE,uBAAuB,MAAM,CAAC,KAAK,IAAI,GAAG,iGAAiG;iCAC/J;6BACF,CAAC;wBACJ,CAAC;wBACD,OAAO,EAAE,CAAC;oBACZ,CAAC,CAAC;aACH,CAAC;KACH,CAAC;AACJ,CAAC"}

package/dist/agent.d.ts

@@ -30,6 +30,7 @@ export declare class Agent {
     private latestInboundMessages;
     private restoringConfig;
     private readonly internalMcpServer;
+    private readonly mcpOAuthManager;
     constructor();
     /** Look up a channel by name */
     private getChannel;
@@ -71,6 +72,11 @@ export declare class Agent {
     private restoreConfigAndRestart;
     private handleCommand;
     private getOrCreateLiveSession;
+    private forwardMcpAuthorizeUrl;
+    private handleMcpAuthFailure;
+    private handleMcpElicitation;
+    private resolvePrivateReplyTarget;
+    private findPrivateReplyTarget;
     private closeLiveSession;
     private hashString;
     /**

package/dist/agent.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"agent.d.ts","sourceRoot":"","sources":["../src/agent.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,OAAO,EAAmB,eAAe,EAAoB,MAAM,qBAAqB,CAAC;AAkBvG,MAAM,MAAM,UAAU,GAAG;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAErE,MAAM,WAAW,cAAc;IAC7B,UAAU,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACpC,MAAM,EAAE,KAAK,CAAC;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,YAAY,CAAC,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC,CAAC;CACzE;AAED,qBAAa,KAAK;IAChB,OAAO,CAAC,QAAQ,CAAiB;IACjC,OAAO,CAAC,QAAQ,CAAe;IAC/B,OAAO,CAAC,MAAM,CAAiB;IAC/B,OAAO,CAAC,YAAY,CAAkC;IACtD,OAAO,CAAC,aAAa,CAAoC;IAIzD,OAAO,CAAC,cAAc,CAA4E;IAClG,OAAO,CAAC,iBAAiB,CAAkC;IAC3D,OAAO,CAAC,cAAc,CAA6B;IACnD,OAAO,CAAC,cAAc,CAAc;IAGpC,OAAO,CAAC,aAAa,CAA8B;IAInD,OAAO,CAAC,YAAY,CAA+B;IACnD,OAAO,CAAC,qBAAqB,CAAiF;IAC9G,OAAO,CAAC,eAAe,CAAS;IAChC,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAiC;;IAanE,gCAAgC;IAChC,OAAO,CAAC,UAAU;IAIlB;;;;;OAKG;IACH,OAAO,CAAC,oBAAoB;IAK5B,sFAAsF;IACtF,OAAO,CAAC,iBAAiB;IAazB,oEAAoE;YACtD,aAAa;IAsB3B,UAAU,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI;IAMlC,8EAA8E;IAC9E,kBAAkB,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE;IAIxC;;;;;OAKG;IACH,OAAO,CAAC,iBAAiB;IAWzB;;;;;;;;OAQG;YACW,cAAc;IAuC5B,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,gBAAgB,CAItC;IAEF,OAAO,CAAC,YAAY;IAMpB,OAAO,CAAC,gBAAgB;IAKxB,OAAO,CAAC,oBAAoB;YAed,uBAAuB;YAqCvB,aAAa;IAwF3B,OAAO,CAAC,sBAAsB;IA8B9B,OAAO,CAAC,gBAAgB;IAQxB,OAAO,CAAC,UAAU;IAQlB;;;;;;;;;;;;;;OAcG;YACW,eAAe;IAwB7B;;;;;OAKG;YACW,oBAAoB;IAelC;;;;;;;OAOG;IACH,OAAO,CAAC,gBAAgB;IAexB;;;;OAIG;IACH,OAAO,CAAC,iBAAiB;YAeX,aAAa;IAoG3B;;;;OAIG;YACW,qBAAqB;YAqFrB,YAAY;IAqF1B;;;;4BAIwB;IACxB,OAAO,CAAC,kBAAkB;IAW1B,OAAO,CAAC,eAAe;IAYvB,+DAA+D;IACzD,iBAAiB,CAAC,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;YAO7D,kBAAkB;IAyEhC,mFAAmF;IAC7E,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;YAqBvC,iBAAiB;IAgD/B;2EACuE;IACvE,OAAO,CAAC,eAAe;IAcvB,OAAO,CAAC,cAAc;IAStB;;;;OAIG;IACG,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC;IA2BtE;;;;;;;;;;;OAWG;IACG,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC;IAuB7E,uFAAuF;IACjF,eAAe,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC;IAqCzE,8EAA8E;IACxE,oBAAoB,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,eAAe,EAAE,MAAM,UAAQ,GAAG,OAAO,CAAC,UAAU,CAAC;IA8B1G,mGAAmG;IACnG,OAAO,CAAC,iBAAiB;IAoBzB;sFACkF;IAClF,OAAO,CAAC,kBAAkB;IAU1B,gHAAgH;IAChH,kBAAkB,IAAI,cAAc;IAepC,OAAO,CAAC,0BAA0B;IAWlC,OAAO,CAAC,gBAAgB;IAMxB,+FAA+F;IAC/F,OAAO,CAAC,iBAAiB;IAOzB,2EAA2E;IACrE,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IA0B7C,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAkBtB,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;CAM5B"}
+{"version":3,"file":"agent.d.ts","sourceRoot":"","sources":["../src/agent.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,OAAO,EAAmB,eAAe,EAAoB,MAAM,qBAAqB,CAAC;AAmBvG,MAAM,MAAM,UAAU,GAAG;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAErE,MAAM,WAAW,cAAc;IAC7B,UAAU,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACpC,MAAM,EAAE,KAAK,CAAC;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,YAAY,CAAC,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC,CAAC;CACzE;AAED,qBAAa,KAAK;IAChB,OAAO,CAAC,QAAQ,CAAiB;IACjC,OAAO,CAAC,QAAQ,CAAe;IAC/B,OAAO,CAAC,MAAM,CAAiB;IAC/B,OAAO,CAAC,YAAY,CAAkC;IACtD,OAAO,CAAC,aAAa,CAAoC;IAIzD,OAAO,CAAC,cAAc,CAA4E;IAClG,OAAO,CAAC,iBAAiB,CAAkC;IAC3D,OAAO,CAAC,cAAc,CAA6B;IACnD,OAAO,CAAC,cAAc,CAAc;IAGpC,OAAO,CAAC,aAAa,CAA8B;IAInD,OAAO,CAAC,YAAY,CAA+B;IACnD,OAAO,CAAC,qBAAqB,CAAiF;IAC9G,OAAO,CAAC,eAAe,CAAS;IAChC,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAiC;IACnE,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAkB;;IAiBlD,gCAAgC;IAChC,OAAO,CAAC,UAAU;IAIlB;;;;;OAKG;IACH,OAAO,CAAC,oBAAoB;IAK5B,sFAAsF;IACtF,OAAO,CAAC,iBAAiB;IAazB,oEAAoE;YACtD,aAAa;IAsB3B,UAAU,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI;IAMlC,8EAA8E;IAC9E,kBAAkB,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE;IAIxC;;;;;OAKG;IACH,OAAO,CAAC,iBAAiB;IAWzB;;;;;;;;OAQG;YACW,cAAc;IAuC5B,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,gBAAgB,CAMtC;IAEF,OAAO,CAAC,YAAY;IAMpB,OAAO,CAAC,gBAAgB;IAKxB,OAAO,CAAC,oBAAoB;YAed,uBAAuB;YAqCvB,aAAa;YAwFb,sBAAsB;YAmCtB,sBAAsB;YAkBtB,oBAAoB;YAepB,oBAAoB;IAmClC,OAAO,CAAC,yBAAyB;IAgBjC,OAAO,CAAC,sBAAsB;IAa9B,OAAO,CAAC,gBAAgB;IAQxB,OAAO,CAAC,UAAU;IAQlB;;;;;;;;;;;;;;OAcG;YACW,eAAe;IAwB7B;;;;;OAKG;YACW,oBAAoB;IAelC;;;;;;;OAOG;IACH,OAAO,CAAC,gBAAgB;IAexB;;;;OAIG;IACH,OAAO,CAAC,iBAAiB;YAeX,aAAa;IAoG3B;;;;OAIG;YACW,qBAAqB;YAqFrB,YAAY;IAqF1B;;;;4BAIwB;IACxB,OAAO,CAAC,kBAAkB;IAW1B,OAAO,CAAC,eAAe;IAYvB,+DAA+D;IACzD,iBAAiB,CAAC,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;YAO7D,kBAAkB;IAyEhC,mFAAmF;IAC7E,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;YAqBvC,iBAAiB;IAgD/B;2EACuE;IACvE,OAAO,CAAC,eAAe;IAcvB,OAAO,CAAC,cAAc;IAStB;;;;OAIG;IACG,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC;IA2BtE;;;;;;;;;;;OAWG;IACG,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC;IAuB7E,uFAAuF;IACjF,eAAe,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC;IAqCzE,8EAA8E;IACxE,oBAAoB,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,eAAe,EAAE,MAAM,UAAQ,GAAG,OAAO,CAAC,UAAU,CAAC;IA8B1G,mGAAmG;IACnG,OAAO,CAAC,iBAAiB;IAoBzB;sFACkF;IAClF,OAAO,CAAC,kBAAkB;IAU1B,gHAAgH;IAChH,kBAAkB,IAAI,cAAc;IAepC,OAAO,CAAC,0BAA0B;IAWlC,OAAO,CAAC,gBAAgB;IAMxB,+FAA+F;IAC/F,OAAO,CAAC,iBAAiB;IAOzB,2EAA2E;IACrE,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IA0B7C,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAkBtB,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;CAM5B"}

package/dist/agent.js

@@ -5,6 +5,7 @@ import { checkAndClearCompactTrigger } from "./lcm/index.js";
 import { isGroupSessionKey } from "./lcm/blocks.js";
 import { IdentityRouter } from "./router.js";
 import { createTomoInternalMcpServer } from "./mcp/internal-server.js";
+import { McpOAuthManager } from "./mcp/oauth.js";
 import { log } from "./logger.js";
 import { LiveSession } from "./agent/live-session.js";
 import { makeTurnBudget, sdkOptions, usesLcmCompact } from "./agent/sdk-options.js";
@@ -36,10 +37,15 @@ export class Agent {
     latestInboundMessages = new Map();
     restoringConfig = false;
     internalMcpServer;
+    mcpOAuthManager;
     constructor() {
         this.sessions = new SessionStore(config.sessionsDir, config.historyLimit);
         this.router = new IdentityRouter(config.identities, this.sessions, config.channelAllowlists);
         this.internalMcpServer = createTomoInternalMcpServer(this);
+        this.mcpOAuthManager = new McpOAuthManager({
+            workspaceDir: config.workspaceDir,
+            onServerAuthError: (serverName, err) => this.handleMcpAuthFailure(serverName, err),
+        });
         // Load persistent per-session model overrides
         for (const [key, model] of Object.entries(config.sessionModelOverrides)) {
             this.modelOverrides.set(key, model);
@@ -166,7 +172,9 @@ export class Agent {
     }
     static AVAILABLE_MODELS = {
         "sonnet": "claude-sonnet-4-6",
+        "sonnet-1m": "claude-sonnet-4-6[1m]",
         "opus": "claude-opus-4-8",
+        "opus-1m": "claude-opus-4-8[1m]",
         "haiku": "claude-haiku-4-5",
     };
     backupConfig() {
@@ -300,7 +308,7 @@ export class Agent {
             return;
         }
     }
-    getOrCreateLiveSession(key) {
+    async getOrCreateLiveSession(key) {
         let session = this.liveSessions.get(key);
         if (session?.isAlive())
             return session;
@@ -317,16 +325,108 @@ export class Agent {
         const resumeId = this.sessions.getSdkSessionId(key);
         const model = this.modelOverrides.get(key);
         const turnBudget = makeTurnBudget();
+        const externalMcpServers = await this.mcpOAuthManager.buildServersWithAuth(config.mcpServers ?? {}, (serverName, url) => this.forwardMcpAuthorizeUrl(key, serverName, url));
         const opts = sdkOptions(this.internalMcpServer, resumeId ?? undefined, model, {
             sessionKey: key,
             sdkSessionId: resumeId ?? undefined,
             group: this.buildGroupContext(key),
-        }, turnBudget);
+            onMcpElicitation: (request) => this.handleMcpElicitation(key, request),
+        }, turnBudget, externalMcpServers);
         session = new LiveSession(opts, key, turnBudget);
         this.liveSessions.set(key, session);
         log.info({ key, resume: !!resumeId, model: opts.model }, "Live session created");
         return session;
     }
+    async forwardMcpAuthorizeUrl(key, serverName, url) {
+        const target = this.resolvePrivateReplyTarget(key);
+        if (!target)
+            throw new Error(`No private reply target is available for MCP OAuth login (${serverName})`);
+        const channel = this.getChannel(target.channelName);
+        if (!channel)
+            throw new Error(`Channel "${target.channelName}" is not connected for MCP OAuth login (${serverName})`);
+        await channel.send({
+            chatId: target.chatId,
+            text: [
+                `MCP login required for ${serverName}.`,
+                "",
+                url,
+                "",
+                "Open the link and finish login. Tomo will continue after the browser callback completes.",
+            ].join("\n"),
+        });
+    }
+    async handleMcpAuthFailure(serverName, err) {
+        const detail = err instanceof Error ? err.message : String(err);
+        log.warn({ serverName, err }, "External MCP server omitted after OAuth failure");
+        const target = this.findPrivateReplyTarget();
+        if (!target)
+            return;
+        const channel = this.getChannel(target.channelName);
+        if (!channel)
+            return;
+        await channel.send({
+            chatId: target.chatId,
+            text: `MCP server "${serverName}" is unavailable because OAuth failed or timed out: ${detail}. Continuing without that server.`,
+        });
+    }
+    async handleMcpElicitation(key, request) {
+        const target = this.resolvePrivateReplyTarget(key);
+        if (!target) {
+            log.warn({ key, server: request.serverName }, "MCP elicitation requested but no private reply target is available");
+            return { action: "decline" };
+        }
+        const channel = this.getChannel(target.channelName);
+        if (!channel) {
+            log.warn({ key, channelName: target.channelName, server: request.serverName }, "MCP elicitation requested but channel is not connected");
+            return { action: "decline" };
+        }
+        if (request.mode === "url" && request.url) {
+            const lines = [
+                `MCP login required for ${request.serverName}.`,
+                request.message,
+                "",
+                request.url,
+                "",
+                "Open the link and finish login. If Tomo does not continue automatically, retry your request after login completes.",
+            ];
+            await channel.send({ chatId: target.chatId, text: lines.filter(Boolean).join("\n") });
+            log.info({ key, server: request.serverName }, "Forwarded MCP login URL to user");
+            return { action: "accept" };
+        }
+        await channel.send({
+            chatId: target.chatId,
+            text: `MCP server ${request.serverName} requested additional input, but Tomo can only forward browser login links right now.`,
+        });
+        log.warn({ key, server: request.serverName, mode: request.mode }, "Declined unsupported MCP elicitation");
+        return { action: "decline" };
+    }
+    resolvePrivateReplyTarget(key) {
+        if (key.startsWith("dm:")) {
+            return this.router.getReplyTarget(key) ?? this.router.deriveReplyTargetFromConfig(key.slice(3));
+        }
+        if (!isGroupSessionKey(key)) {
+            return this.parseChannelKey(key);
+        }
+        for (const identity of config.identities) {
+            const target = this.router.deriveReplyTargetFromConfig(identity.name);
+            if (target)
+                return target;
+        }
+        return undefined;
+    }
+    findPrivateReplyTarget() {
+        for (const [key] of this.sessions.listSdkSessionIds()) {
+            const target = this.resolvePrivateReplyTarget(key);
+            if (target)
+                return target;
+        }
+        for (const identity of config.identities) {
+            const target = this.router.deriveReplyTargetFromConfig(identity.name);
+            if (target)
+                return target;
+        }
+        return undefined;
+    }
     closeLiveSession(key) {
         const session = this.liveSessions.get(key);
         if (session) {
@@ -568,7 +668,7 @@ export class Agent {
     }
     async runWithRetry(key, prompt, onText, images, onBlockComplete, documents) {
         try {
-            const session = this.getOrCreateLiveSession(key);
+            const session = await this.getOrCreateLiveSession(key);
             const response = await session.send(prompt, onText, images, onBlockComplete, documents);
             // Capture session ID if new
             const sid = session.getSessionId();
@@ -627,7 +727,7 @@ export class Agent {
                 log.warn({ err }, "Session error, resetting and retrying");
                 this.closeLiveSession(key);
                 this.sessions.clearSdkSessionId(key);
-                const session = this.getOrCreateLiveSession(key);
+                const session = await this.getOrCreateLiveSession(key);
                 return session.send(prompt, onText, images, onBlockComplete, documents);
             }
             throw err;