unity-mcp-cli 0.86.3 → 0.88.0

package/dist/lib/types.d.ts

@@ -558,11 +558,20 @@ export interface RunToolOptions {
     fetchImpl?: typeof fetch;
     /**
      * Optional injection point for the Cloud-mode Bearer credential read from the shared machine
-     * credential store (`~/.ai-game-dev/credentials.json`). Only consulted when the resolved project
-     * config is in Cloud mode and neither `url` nor `token` was supplied. Defaults to reading the real
-     * per-machine store; tests inject a deterministic value.
+     * credential store. Only consulted when the resolved project config is in Cloud mode and neither
+     * `url` nor `token` was supplied. Defaults to cli-core's `MachineCredentialProvider` (proactive
+     * refresh under the cross-process lock — never a raw on-disk read); tests inject a deterministic
+     * value. Sync or async both work.
      */
-    readCloudToken?: () => string | undefined;
+    readCloudToken?: () => Promise<string | undefined> | string | undefined;
+    /**
+     * Optional injection point for the REACTIVE Cloud-mode refresh: invoked at most once per call
+     * when the server answers 401 to a machine-store Bearer (revocation / clock skew). Returns the
+     * rotated access token, or `undefined` when the credential family is dead (the call then fails
+     * with the original 401). Defaults to cli-core's `MachineCredentialProvider.refresh`. Never
+     * consulted for an explicit `token` / `url` override.
+     */
+    refreshCloudToken?: () => Promise<string | undefined> | string | undefined;
 }
 /** Successful `runTool` / `runSystemTool` outcome. Narrow with `kind === 'success'`. */
 export interface RunToolSuccess {

package/dist/utils/cloud-credentials.d.ts

@@ -0,0 +1,43 @@
+import { MachineCredentialProvider, MachineCredentialStore } from '@baizor/gamedev-cli-core';
+/**
+ * The CLI's single seam onto cli-core's `MachineCredentialProvider` (unified-machine-auth 02/04,
+ * task d2 / W2). Every Cloud-mode Bearer the CLI presents comes through here — the provider owns
+ * proactive refresh (inside the 60 s expiry skew), reactive refresh (driven by a hub 401), the
+ * cross-process credential lock, and the family-aware machine-store view. The CLI never reads
+ * `accessToken` raw off disk: a raw read returns a token that may be seconds from expiry (or past
+ * it) with nobody refreshing, which is exactly the defect this module replaces
+ * (the pre-d2 `readMachineStoreCloudToken`).
+ */
+/** Injectable construction options — tests point the provider at a temp store + a fake AS. */
+export interface CloudCredentialProviderOptions {
+    /** The credential store to serve from; defaults to the shared per-machine store. */
+    store?: MachineCredentialStore;
+    /** Authorization-server base for the refresh endpoint; defaults to the hosted cloud. */
+    serverBaseUrl?: string;
+    /** Injectable `fetch` for the refresher (tests). */
+    fetchImpl?: typeof fetch;
+}
+/**
+ * Build a `MachineCredentialProvider` wired the way this CLI consumes it:
+ * `HttpTokenRefresher` against the AS root, and `unity-mcp-cli` as the component-default client
+ * id — used ONLY for `families.legacy` (a stored family's own `clientId` always wins, 04 §3).
+ */
+export declare function createCloudCredentialProvider(options?: CloudCredentialProviderOptions): MachineCredentialProvider;
+/** TEST-ONLY: drop the cached default provider (e.g. after re-pointing HOME). */
+export declare function resetCloudCredentialProviderForTests(): void;
+/**
+ * Read a valid plugin-plane access token for a Cloud-mode call, PROACTIVELY refreshing under the
+ * cross-process lock when the stored token is within the expiry skew. Returns `undefined` when the
+ * machine is effectively not signed in — no credential, a dead family, an unreadable store, or a
+ * lock that stayed contended — so callers surface their actionable "not logged in" error instead
+ * of issuing a silent unauthenticated request (defect E / D11). The precise reason is logged via
+ * `verbose()` (never token bytes).
+ */
+export declare function readCloudAccessToken(options?: CloudCredentialProviderOptions): Promise<string | undefined>;
+/**
+ * REACTIVELY refresh the plugin-plane family now — the hub answered 401 while the local expiry
+ * still looked fine (revocation, clock skew). Runs the same locked critical section as the
+ * proactive path. Returns the fresh access token, or `undefined` when the family is dead /
+ * signed out (the caller falls back to its "not logged in" error).
+ */
+export declare function refreshCloudAccessToken(options?: CloudCredentialProviderOptions): Promise<string | undefined>;

package/dist/utils/cloud-credentials.js

@@ -0,0 +1,84 @@
+// Copyright (c) 2024 Ivan Murzak. All rights reserved.
+// Licensed under the Apache License, Version 2.0.
+import { MachineCredentialProvider, MachineCredentialStore, MachineCredentialStoreUnreadableError, CredentialLockBusyError, HttpTokenRefresher, LoginRequiredError, unityAdapter, } from '@baizor/gamedev-cli-core';
+import { verbose } from './ui.js';
+import { CLOUD_SERVER_BASE_URL } from './config.js';
+/**
+ * Build a `MachineCredentialProvider` wired the way this CLI consumes it:
+ * `HttpTokenRefresher` against the AS root, and `unity-mcp-cli` as the component-default client
+ * id — used ONLY for `families.legacy` (a stored family's own `clientId` always wins, 04 §3).
+ */
+export function createCloudCredentialProvider(options = {}) {
+    const store = options.store ?? new MachineCredentialStore();
+    const refresher = new HttpTokenRefresher({
+        defaultServerBaseUrl: options.serverBaseUrl ?? CLOUD_SERVER_BASE_URL,
+        ...(options.fetchImpl ? { fetchImpl: options.fetchImpl } : {}),
+    });
+    return new MachineCredentialProvider(store, refresher, {
+        defaultClientId: unityAdapter.clientId, // unity-mcp-cli
+        onWarning: (message) => verbose(`[credential-provider] ${message}`),
+        onTelemetry: (event) => verbose(`[credential-provider] ${event.type}: ${event.family} (${event.reason})`),
+    });
+}
+/** Lazy singleton for the default (real per-machine) store — one provider per CLI process. */
+let defaultProvider;
+function resolveProvider(options) {
+    if (options?.store || options?.serverBaseUrl || options?.fetchImpl) {
+        return createCloudCredentialProvider(options);
+    }
+    defaultProvider ?? (defaultProvider = createCloudCredentialProvider());
+    return defaultProvider;
+}
+/** TEST-ONLY: drop the cached default provider (e.g. after re-pointing HOME). */
+export function resetCloudCredentialProviderForTests() {
+    defaultProvider = undefined;
+}
+/**
+ * Read a valid plugin-plane access token for a Cloud-mode call, PROACTIVELY refreshing under the
+ * cross-process lock when the stored token is within the expiry skew. Returns `undefined` when the
+ * machine is effectively not signed in — no credential, a dead family, an unreadable store, or a
+ * lock that stayed contended — so callers surface their actionable "not logged in" error instead
+ * of issuing a silent unauthenticated request (defect E / D11). The precise reason is logged via
+ * `verbose()` (never token bytes).
+ */
+export async function readCloudAccessToken(options) {
+    const provider = resolveProvider(options);
+    try {
+        return await provider.getAccessToken({ family: 'plugin' });
+    }
+    catch (err) {
+        return degradeToSignedOut(err, 'read');
+    }
+}
+/**
+ * REACTIVELY refresh the plugin-plane family now — the hub answered 401 while the local expiry
+ * still looked fine (revocation, clock skew). Runs the same locked critical section as the
+ * proactive path. Returns the fresh access token, or `undefined` when the family is dead /
+ * signed out (the caller falls back to its "not logged in" error).
+ */
+export async function refreshCloudAccessToken(options) {
+    const provider = resolveProvider(options);
+    try {
+        const document = await provider.refresh({ family: 'plugin' });
+        return document.accessToken ?? document.families?.plugin?.accessToken ?? undefined;
+    }
+    catch (err) {
+        return degradeToSignedOut(err, 'refresh');
+    }
+}
+function degradeToSignedOut(err, operation) {
+    if (err instanceof LoginRequiredError) {
+        verbose(`Cloud credential ${operation}: login required (${err.message})`);
+        return undefined;
+    }
+    if (err instanceof MachineCredentialStoreUnreadableError) {
+        verbose(`Cloud credential ${operation}: store unreadable — sign in again to replace it (${err.message})`);
+        return undefined;
+    }
+    if (err instanceof CredentialLockBusyError) {
+        verbose(`Cloud credential ${operation}: credential store busy — retry shortly (${err.message})`);
+        return undefined;
+    }
+    throw err;
+}
+//# sourceMappingURL=cloud-credentials.js.map

package/dist/utils/cloud-credentials.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cloud-credentials.js","sourceRoot":"","sources":["../../src/utils/cloud-credentials.ts"],"names":[],"mappings":"AAAA,uDAAuD;AACvD,kDAAkD;AAElD,OAAO,EACL,yBAAyB,EACzB,sBAAsB,EACtB,qCAAqC,EACrC,uBAAuB,EACvB,kBAAkB,EAClB,kBAAkB,EAClB,YAAY,GACb,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AAsBpD;;;;GAIG;AACH,MAAM,UAAU,6BAA6B,CAC3C,UAA0C,EAAE;IAE5C,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,IAAI,sBAAsB,EAAE,CAAC;IAC5D,MAAM,SAAS,GAAG,IAAI,kBAAkB,CAAC;QACvC,oBAAoB,EAAE,OAAO,CAAC,aAAa,IAAI,qBAAqB;QACpE,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC/D,CAAC,CAAC;IACH,OAAO,IAAI,yBAAyB,CAAC,KAAK,EAAE,SAAS,EAAE;QACrD,eAAe,EAAE,YAAY,CAAC,QAAQ,EAAE,gBAAgB;QACxD,SAAS,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,yBAAyB,OAAO,EAAE,CAAC;QACnE,WAAW,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,yBAAyB,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,GAAG,CAAC;KAC1G,CAAC,CAAC;AACL,CAAC;AAED,8FAA8F;AAC9F,IAAI,eAAsD,CAAC;AAE3D,SAAS,eAAe,CAAC,OAAwC;IAC/D,IAAI,OAAO,EAAE,KAAK,IAAI,OAAO,EAAE,aAAa,IAAI,OAAO,EAAE,SAAS,EAAE,CAAC;QACnE,OAAO,6BAA6B,CAAC,OAAO,CAAC,CAAC;IAChD,CAAC;IACD,eAAe,KAAf,eAAe,GAAK,6BAA6B,EAAE,EAAC;IACpD,OAAO,eAAe,CAAC;AACzB,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,oCAAoC;IAClD,eAAe,GAAG,SAAS,CAAC;AAC9B,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,OAAwC;IAExC,MAAM,QAAQ,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;IAC1C,IAAI,CAAC;QACH,OAAO,MAAM,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;IAC7D,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,kBAAkB,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IACzC,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,OAAwC;IAExC,MAAM,QAAQ,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;IAC1C,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;QAC9D,OAAO,QAAQ,CAAC,WAAW,IAAI,QAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE,WAAW,IAAI,SAAS,CAAC;IACrF,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,kBAAkB,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;IAC5C,CAAC;AACH,CAAC;AAED,SAAS,kBAAkB,CAAC,GAAY,EAAE,SAAiB;IACzD,IAAI,GAAG,YAAY,kBAAkB,EAAE,CAAC;QACtC,OAAO,CAAC,oBAAoB,SAAS,qBAAqB,GAAG,CAAC,OAAO,GAAG,CAAC,CAAC;QAC1E,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,GAAG,YAAY,qCAAqC,EAAE,CAAC;QACzD,OAAO,CAAC,oBAAoB,SAAS,qDAAqD,GAAG,CAAC,OAAO,GAAG,CAAC,CAAC;QAC1G,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,GAAG,YAAY,uBAAuB,EAAE,CAAC;QAC3C,OAAO,CAAC,oBAAoB,SAAS,4CAA4C,GAAG,CAAC,OAAO,GAAG,CAAC,CAAC;QACjG,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,GAAG,CAAC;AACZ,CAAC"}

package/dist/utils/cloud-login.d.ts

@@ -1,23 +1,39 @@
 import { MachineCredentialStore } from './machine-credentials.js';
-import { type DeviceLoginResult, type DeviceLoginOptions } from '@baizor/gamedev-cli-core';
-/**
- * The device-flow login now runs on `@baizor/gamedev-cli-core`'s OAuth 2.1 Device Authorization
- * Grant (RFC 8628) — client_id `unity-mcp-cli`, scope `mcp:plugin` — which mints an ES256 hub JWT
- * plus a rotating refresh token and NEVER mints a PAT (auth-fixes T1, closing B2/B3). The FULL
- * credential set (accessToken, refreshToken, expiresAt, serverTarget, subject) is persisted to the
- * shared machine credential store — the legacy flow dropped refresh/expiry/subject on the floor.
- */
-/** Injection seam so the login flow can be exercised offline in tests without the network. */
-export interface RunCloudLoginDeps {
+import { type DeviceLoginResult, type DeviceLoginOptions, type RevokeTokenFn, type TokenExchangeClient } from '@baizor/gamedev-cli-core';
+/** Injection seams so the login flow can be exercised offline in tests without the network. */
+export interface RunCloudLoginOptions {
+    /** O10/F10: mint `scope=mcp:plugin` and commit a plugin-only store (no agent family). */
+    toolsOnly?: boolean;
+    /** F7: auto-confirm the account-switch prompt (the `--yes` flag). */
+    assumeYes?: boolean;
     /** Authorization-server base; defaults to the hosted `CLOUD_SERVER_BASE_URL`. */
     serverBaseUrl?: string;
     /** The device-login implementation; defaults to cli-core's `deviceLogin`. */
     login?: (options: DeviceLoginOptions) => Promise<DeviceLoginResult>;
+    /** The RFC 8693 exchange client; defaults to cli-core's `HttpTokenExchangeClient`. */
+    exchangeClient?: TokenExchangeClient;
+    /** The D6/F7 confirmation; defaults to an interactive prompt (auto-confirmed by `assumeYes`). */
+    confirmAccountSwitch?: (info: {
+        storedSubject: string;
+        newSubject: string;
+    }) => boolean | Promise<boolean>;
+    /** Injectable best-effort RFC 7009 revoker (tests). */
+    revokeToken?: RevokeTokenFn;
+    /** Injectable backoff sleep (tests make it a no-op). */
+    sleep?: (ms: number) => Promise<void>;
 }
+/**
+ * Finish a previously interrupted agent login (F1 `partial`: agent family committed, plugin
+ * derivation missing) using a FRESH agent access token supplied by the caller. Returns true when
+ * the plugin family is committed.
+ */
+export declare function completePluginDerivation(store: MachineCredentialStore, agentAccessToken: string, options?: Pick<RunCloudLoginOptions, 'serverBaseUrl' | 'exchangeClient' | 'revokeToken' | 'sleep'>): Promise<boolean>;
 /**
  * Run the cloud device-auth flow: initiate, display the user code + verification URL, open the
- * browser, poll, and persist the FULL credential to the shared machine credential store.
+ * browser, poll, then commit through cli-core's login-commit machinery (two-lock-hold agent
+ * commit + exchange-derived plugin family, or the tools-only plugin commit — never a raw
+ * `store.write`).
  *
- * Returns the access token on success, or null on failure (errors are printed).
+ * Returns the plugin-plane access token on success, or null on failure (errors are printed).
  */
-export declare function runCloudLogin(store: MachineCredentialStore, deps?: RunCloudLoginDeps): Promise<string | null>;
+export declare function runCloudLogin(store: MachineCredentialStore, options?: RunCloudLoginOptions): Promise<string | null>;

package/dist/utils/cloud-login.js

@@ -1,24 +1,151 @@
 // Copyright (c) 2024 Ivan Murzak. All rights reserved.
 // Licensed under the Apache License, Version 2.0.
+import * as readline from 'readline/promises';
 import * as ui from './ui.js';
 import { CLOUD_SERVER_BASE_URL } from './config.js';
 import { openBrowser } from './browser.js';
-import { deviceLogin, unityAdapter, DEFAULT_PLUGIN_SCOPE, } from '@baizor/gamedev-cli-core';
+import { deviceLogin, unityAdapter, commitAgentLogin, commitToolsOnlyLogin, derivePluginFamily, HttpTokenExchangeClient, DEFAULT_PLUGIN_SCOPE, MCP_AGENT_SCOPE, } from '@baizor/gamedev-cli-core';
+/**
+ * The cloud sign-in flow (unified-machine-auth 03 F1/F7/F10, task d2). The device grant
+ * (RFC 8628, client_id `unity-mcp-cli`) now mints at **agent scope** (`mcp:agent`) by default and
+ * the commit goes through cli-core's login-commit machinery — the two-lock-hold sequence: agent
+ * family under the first hold, RFC 8693 token exchange with the lock released, derived plugin
+ * family (+ v1 mirror) under the second hold. A failed exchange leaves a valid committed agent
+ * family (`partial`) and the derivation alone is retried.
+ *
+ * `--tools-only` (O10/F10) mints at `mcp:plugin` scope and commits a plugin family ONLY — the
+ * store then holds no agent family, so App pickup is impossible by design and the runner appears
+ * as its own revocable device group.
+ *
+ * The D6/F7 account-switch guard runs before ANY write: a subject mismatch prompts
+ * (`--yes`-gated); decline revokes the just-minted family (best effort, RFC 7009) and aborts with
+ * the store untouched.
+ */
+/** How many times the F1 `partial` state retries the derivation leg within one login run. */
+const DERIVE_RETRY_ATTEMPTS = 3;
+/** Base backoff between derivation retries (doubles per attempt). */
+const DERIVE_RETRY_BASE_MS = 500;
+const defaultSleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
+/**
+ * The D6/F7 account-switch confirmation used when no callback is injected:
+ * - `--yes` ⇒ confirmed without prompting (F7 "`--yes`-gated");
+ * - interactive TTY ⇒ y/N prompt (default No);
+ * - non-interactive without `--yes` ⇒ DECLINED (fail closed) with an actionable hint.
+ */
+function buildAccountSwitchConfirm(assumeYes) {
+    return async (info) => {
+        ui.warn(`This machine is currently signed in as "${info.storedSubject}"; you are signing in as "${info.newSubject}".`);
+        ui.info('Switching replaces the stored credential and signs the previous account out on this machine.');
+        if (assumeYes) {
+            ui.info('--yes given: switching accounts.');
+            return true;
+        }
+        if (!process.stdin.isTTY) {
+            ui.error('Account switch requires confirmation. Re-run with --yes to switch accounts.');
+            return false;
+        }
+        const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
+        try {
+            const answer = (await rl.question('Switch this machine to the new account? [y/N] ')).trim();
+            return answer.toLowerCase() === 'y' || answer.toLowerCase() === 'yes';
+        }
+        finally {
+            rl.close();
+        }
+    };
+}
+/** The v2 document's plugin-plane access token (v1 mirror first — it IS the plugin family's). */
+function pluginPlaneToken(document) {
+    return (document.accessToken ??
+        document.families?.plugin?.accessToken ??
+        document.families?.legacy?.accessToken ??
+        null);
+}
+/**
+ * Retry the F1.4 derivation leg alone (the `partial` state): RFC 8693 exchange → plugin family +
+ * v1 mirror under one lock hold. Returns the committed document, or null when every attempt
+ * failed or the store changed underneath (aborts are terminal — retrying cannot help).
+ */
+async function retryDerivePluginFamily(params) {
+    const attempts = params.attempts ?? DERIVE_RETRY_ATTEMPTS;
+    for (let attempt = 1; attempt <= attempts; attempt++) {
+        const result = await derivePluginFamily({
+            store: params.store,
+            exchangeClient: params.exchangeClient,
+            clientId: unityAdapter.clientId,
+            agentAccessToken: params.agentAccessToken,
+            ...(params.expectedSubject !== undefined ? { expectedSubject: params.expectedSubject } : {}),
+            ...(params.serverTarget !== undefined ? { serverTarget: params.serverTarget } : {}),
+            ...(params.revokeToken ? { revokeToken: params.revokeToken } : {}),
+            onWarning: ui.warn,
+        });
+        if (result.status === 'derived') {
+            return result.document;
+        }
+        if (result.status === 'aborted') {
+            // Store-missing / subject-changed / store-unreadable: a concurrent flow changed the world;
+            // the orphaned derived family was already revoked best-effort by cli-core. Terminal.
+            ui.error(`Could not finish authorization: ${result.reason}. Run \`unity-mcp-cli login\` again.`);
+            return null;
+        }
+        ui.warn(`Deriving the tools credential failed (${result.reason}) — attempt ${attempt}/${attempts}.`);
+        if (attempt < attempts) {
+            await params.sleep(DERIVE_RETRY_BASE_MS * 2 ** (attempt - 1));
+        }
+    }
+    return null;
+}
+/**
+ * Finish a previously interrupted agent login (F1 `partial`: agent family committed, plugin
+ * derivation missing) using a FRESH agent access token supplied by the caller. Returns true when
+ * the plugin family is committed.
+ */
+export async function completePluginDerivation(store, agentAccessToken, options = {}) {
+    const serverBaseUrl = options.serverBaseUrl ?? CLOUD_SERVER_BASE_URL;
+    const exchangeClient = options.exchangeClient ?? new HttpTokenExchangeClient({ defaultServerBaseUrl: serverBaseUrl });
+    const stored = safeRead(store);
+    const document = await retryDerivePluginFamily({
+        store,
+        exchangeClient,
+        agentAccessToken,
+        expectedSubject: stored?.subject,
+        serverTarget: stored?.serverTarget,
+        revokeToken: options.revokeToken,
+        sleep: options.sleep ?? defaultSleep,
+    });
+    if (document) {
+        ui.success('Authorization completed: tools credential derived.');
+        return true;
+    }
+    return false;
+}
+function safeRead(store) {
+    try {
+        return store.read();
+    }
+    catch {
+        return null;
+    }
+}
 /**
  * Run the cloud device-auth flow: initiate, display the user code + verification URL, open the
- * browser, poll, and persist the FULL credential to the shared machine credential store.
+ * browser, poll, then commit through cli-core's login-commit machinery (two-lock-hold agent
+ * commit + exchange-derived plugin family, or the tools-only plugin commit — never a raw
+ * `store.write`).
  *
- * Returns the access token on success, or null on failure (errors are printed).
+ * Returns the plugin-plane access token on success, or null on failure (errors are printed).
  */
-export async function runCloudLogin(store, deps = {}) {
-    const serverBaseUrl = deps.serverBaseUrl ?? CLOUD_SERVER_BASE_URL;
-    const login = deps.login ?? deviceLogin;
+export async function runCloudLogin(store, options = {}) {
+    const serverBaseUrl = options.serverBaseUrl ?? CLOUD_SERVER_BASE_URL;
+    const login = options.login ?? deviceLogin;
+    const sleep = options.sleep ?? defaultSleep;
     let spinner;
     try {
         const result = await login({
             serverBaseUrl,
             clientId: unityAdapter.clientId, // unity-mcp-cli
-            scope: DEFAULT_PLUGIN_SCOPE, // mcp:plugin
+            // Agent scope by default (03 §F1); plugin scope only for --tools-only (O10/F10).
+            scope: options.toolsOnly ? DEFAULT_PLUGIN_SCOPE : MCP_AGENT_SCOPE,
             onUserCode: (userCode, verificationUri) => {
                 ui.info('Open this URL to authorize:');
                 console.log();
@@ -31,17 +158,71 @@ export async function runCloudLogin(store, deps = {}) {
             },
             openBrowser,
         });
-        if (result.ok) {
-            spinner?.success('Authorized');
-            // Persist the FULL credential set (accessToken + refreshToken + expiresAt + serverTarget +
-            // subject) — never a project config file. This closes B3 (the legacy flow stored only
-            // accessToken + serverTarget, losing the refresh/expiry needed for proactive refresh).
-            store.write(result.credentials);
-            return result.credentials.accessToken ?? null;
+        if (!result.ok) {
+            spinner?.stop();
+            ui.error(result.message);
+            return null;
+        }
+        spinner?.success('Authorized');
+        const confirmAccountSwitch = options.confirmAccountSwitch ?? buildAccountSwitchConfirm(options.assumeYes ?? false);
+        if (options.toolsOnly) {
+            const commit = await commitToolsOnlyLogin({
+                store,
+                clientId: unityAdapter.clientId,
+                credentials: result.credentials,
+                confirmAccountSwitch,
+                ...(options.revokeToken ? { revokeToken: options.revokeToken } : {}),
+                onWarning: ui.warn,
+            });
+            switch (commit.status) {
+                case 'committed':
+                    return pluginPlaneToken(commit.document);
+                case 'switch-declined':
+                    ui.error('Account switch declined — nothing was changed. The new sign-in was revoked.');
+                    return null;
+                case 'aborted':
+                    ui.error('The credential store changed while signing in. Run `unity-mcp-cli login` again.');
+                    return null;
+            }
+        }
+        const exchangeClient = options.exchangeClient ?? new HttpTokenExchangeClient({ defaultServerBaseUrl: serverBaseUrl });
+        const commit = await commitAgentLogin({
+            store,
+            exchangeClient,
+            clientId: unityAdapter.clientId,
+            credentials: result.credentials,
+            confirmAccountSwitch,
+            ...(options.revokeToken ? { revokeToken: options.revokeToken } : {}),
+            onWarning: ui.warn,
+        });
+        switch (commit.status) {
+            case 'committed':
+                return pluginPlaneToken(commit.document);
+            case 'partial': {
+                // F1 failure path: the agent family IS committed; retry the derivation leg alone.
+                ui.warn(`Partially authorized (${commit.exchangeFailure}). Retrying the tools credential...`);
+                const document = await retryDerivePluginFamily({
+                    store,
+                    exchangeClient,
+                    agentAccessToken: result.credentials.accessToken ?? '',
+                    expectedSubject: result.credentials.subject,
+                    serverTarget: result.credentials.serverTarget,
+                    revokeToken: options.revokeToken,
+                    sleep,
+                });
+                if (document) {
+                    return pluginPlaneToken(document);
+                }
+                ui.error('Signed in, but deriving the tools credential failed. Run `unity-mcp-cli login` again to finish authorization.');
+                return null;
+            }
+            case 'switch-declined':
+                ui.error('Account switch declined — nothing was changed. The new sign-in was revoked.');
+                return null;
+            case 'aborted':
+                ui.error('The credential store changed while signing in. Run `unity-mcp-cli login` again.');
+                return null;
         }
-        spinner?.stop();
-        ui.error(result.message);
-        return null;
     }
     catch (err) {
         spinner?.stop();

package/dist/utils/cloud-login.js.map

@@ -1 +1 @@
-{"version":3,"file":"cloud-login.js","sourceRoot":"","sources":["../../src/utils/cloud-login.ts"],"names":[],"mappings":"AAAA,uDAAuD;AACvD,kDAAkD;AAElD,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AACpD,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAE3C,OAAO,EACL,WAAW,EACX,YAAY,EACZ,oBAAoB,GAGrB,MAAM,0BAA0B,CAAC;AAkBlC;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,KAA6B,EAC7B,OAA0B,EAAE;IAE5B,MAAM,aAAa,GAAG,IAAI,CAAC,aAAa,IAAI,qBAAqB,CAAC;IAClE,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,WAAW,CAAC;IACxC,IAAI,OAAuD,CAAC;IAE5D,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC;YACzB,aAAa;YACb,QAAQ,EAAE,YAAY,CAAC,QAAQ,EAAE,gBAAgB;YACjD,KAAK,EAAE,oBAAoB,EAAE,aAAa;YAC1C,UAAU,EAAE,CAAC,QAAQ,EAAE,eAAe,EAAE,EAAE;gBACxC,EAAE,CAAC,IAAI,CAAC,6BAA6B,CAAC,CAAC;gBACvC,OAAO,CAAC,GAAG,EAAE,CAAC;gBACd,OAAO,CAAC,GAAG,CAAC,KAAK,eAAe,EAAE,CAAC,CAAC;gBACpC,OAAO,CAAC,GAAG,EAAE,CAAC;gBACd,EAAE,CAAC,KAAK,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;YAC7B,CAAC;YACD,SAAS,EAAE,GAAG,EAAE;gBACd,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,8BAA8B,CAAC,CAAC;YAC5D,CAAC;YACD,WAAW;SACZ,CAAC,CAAC;QAEH,IAAI,MAAM,CAAC,EAAE,EAAE,CAAC;YACd,OAAO,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC;YAE/B,2FAA2F;YAC3F,sFAAsF;YACtF,uFAAuF;YACvF,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;YAEhC,OAAO,MAAM,CAAC,WAAW,CAAC,WAAW,IAAI,IAAI,CAAC;QAChD,CAAC;QAED,OAAO,EAAE,IAAI,EAAE,CAAC;QAChB,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACzB,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,EAAE,IAAI,EAAE,CAAC;QAChB,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjE,IAAI,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC;YACzE,EAAE,CAAC,KAAK,CAAC,gCAAgC,aAAa,EAAE,CAAC,CAAC;QAC5D,CAAC;aAAM,CAAC;YACN,EAAE,CAAC,KAAK,CAAC,0BAA0B,OAAO,EAAE,CAAC,CAAC;QAChD,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC"}
+{"version":3,"file":"cloud-login.js","sourceRoot":"","sources":["../../src/utils/cloud-login.ts"],"names":[],"mappings":"AAAA,uDAAuD;AACvD,kDAAkD;AAElD,OAAO,KAAK,QAAQ,MAAM,mBAAmB,CAAC;AAC9C,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AACpD,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAE3C,OAAO,EACL,WAAW,EACX,YAAY,EACZ,gBAAgB,EAChB,oBAAoB,EACpB,kBAAkB,EAClB,uBAAuB,EACvB,oBAAoB,EACpB,eAAe,GAMhB,MAAM,0BAA0B,CAAC;AAElC;;;;;;;;;;;;;;;GAeG;AAEH,6FAA6F;AAC7F,MAAM,qBAAqB,GAAG,CAAC,CAAC;AAChC,qEAAqE;AACrE,MAAM,oBAAoB,GAAG,GAAG,CAAC;AAyBjC,MAAM,YAAY,GAAG,CAAC,EAAU,EAAiB,EAAE,CAAC,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;AAEtG;;;;;GAKG;AACH,SAAS,yBAAyB,CAChC,SAAkB;IAElB,OAAO,KAAK,EAAE,IAAI,EAAE,EAAE;QACpB,EAAE,CAAC,IAAI,CACL,2CAA2C,IAAI,CAAC,aAAa,6BAA6B,IAAI,CAAC,UAAU,IAAI,CAC9G,CAAC;QACF,EAAE,CAAC,IAAI,CAAC,8FAA8F,CAAC,CAAC;QACxG,IAAI,SAAS,EAAE,CAAC;YACd,EAAE,CAAC,IAAI,CAAC,kCAAkC,CAAC,CAAC;YAC5C,OAAO,IAAI,CAAC;QACd,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;YACzB,EAAE,CAAC,KAAK,CAAC,6EAA6E,CAAC,CAAC;YACxF,OAAO,KAAK,CAAC;QACf,CAAC;QACD,MAAM,EAAE,GAAG,QAAQ,CAAC,eAAe,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;QACtF,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,gDAAgD,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YAC5F,OAAO,MAAM,CAAC,WAAW,EAAE,KAAK,GAAG,IAAI,MAAM,CAAC,WAAW,EAAE,KAAK,KAAK,CAAC;QACxE,CAAC;gBAAS,CAAC;YACT,EAAE,CAAC,KAAK,EAAE,CAAC;QACb,CAAC;IACH,CAAC,CAAC;AACJ,CAAC;AAED,iGAAiG;AACjG,SAAS,gBAAgB,CAAC,QAA4B;IACpD,OAAO,CACL,QAAQ,CAAC,WAAW;QACpB,QAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE,WAAW;QACtC,QAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE,WAAW;QACtC,IAAI,CACL,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,uBAAuB,CAAC,MAStC;IACC,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,IAAI,qBAAqB,CAAC;IAC1D,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,IAAI,QAAQ,EAAE,OAAO,EAAE,EAAE,CAAC;QACrD,MAAM,MAAM,GAAG,MAAM,kBAAkB,CAAC;YACtC,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,cAAc,EAAE,MAAM,CAAC,cAAc;YACrC,QAAQ,EAAE,YAAY,CAAC,QAAQ;YAC/B,gBAAgB,EAAE,MAAM,CAAC,gBAAgB;YACzC,GAAG,CAAC,MAAM,CAAC,eAAe,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,MAAM,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC5F,GAAG,CAAC,MAAM,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACnF,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAClE,SAAS,EAAE,EAAE,CAAC,IAAI;SACnB,CAAC,CAAC;QACH,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAChC,OAAO,MAAM,CAAC,QAAQ,CAAC;QACzB,CAAC;QACD,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAChC,2FAA2F;YAC3F,qFAAqF;YACrF,EAAE,CAAC,KAAK,CAAC,mCAAmC,MAAM,CAAC,MAAM,sCAAsC,CAAC,CAAC;YACjG,OAAO,IAAI,CAAC;QACd,CAAC;QACD,EAAE,CAAC,IAAI,CAAC,yCAAyC,MAAM,CAAC,MAAM,eAAe,OAAO,IAAI,QAAQ,GAAG,CAAC,CAAC;QACrG,IAAI,OAAO,GAAG,QAAQ,EAAE,CAAC;YACvB,MAAM,MAAM,CAAC,KAAK,CAAC,oBAAoB,GAAG,CAAC,IAAI,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC;QAChE,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,KAA6B,EAC7B,gBAAwB,EACxB,UAAoG,EAAE;IAEtG,MAAM,aAAa,GAAG,OAAO,CAAC,aAAa,IAAI,qBAAqB,CAAC;IACrE,MAAM,cAAc,GAClB,OAAO,CAAC,cAAc,IAAI,IAAI,uBAAuB,CAAC,EAAE,oBAAoB,EAAE,aAAa,EAAE,CAAC,CAAC;IACjG,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC/B,MAAM,QAAQ,GAAG,MAAM,uBAAuB,CAAC;QAC7C,KAAK;QACL,cAAc;QACd,gBAAgB;QAChB,eAAe,EAAE,MAAM,EAAE,OAAO;QAChC,YAAY,EAAE,MAAM,EAAE,YAAY;QAClC,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,KAAK,EAAE,OAAO,CAAC,KAAK,IAAI,YAAY;KACrC,CAAC,CAAC;IACH,IAAI,QAAQ,EAAE,CAAC;QACb,EAAE,CAAC,OAAO,CAAC,oDAAoD,CAAC,CAAC;QACjE,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,QAAQ,CAAC,KAA6B;IAC7C,IAAI,CAAC;QACH,OAAO,KAAK,CAAC,IAAI,EAAE,CAAC;IACtB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,KAA6B,EAC7B,UAAgC,EAAE;IAElC,MAAM,aAAa,GAAG,OAAO,CAAC,aAAa,IAAI,qBAAqB,CAAC;IACrE,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,WAAW,CAAC;IAC3C,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,YAAY,CAAC;IAC5C,IAAI,OAAuD,CAAC;IAE5D,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC;YACzB,aAAa;YACb,QAAQ,EAAE,YAAY,CAAC,QAAQ,EAAE,gBAAgB;YACjD,iFAAiF;YACjF,KAAK,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,eAAe;YACjE,UAAU,EAAE,CAAC,QAAQ,EAAE,eAAe,EAAE,EAAE;gBACxC,EAAE,CAAC,IAAI,CAAC,6BAA6B,CAAC,CAAC;gBACvC,OAAO,CAAC,GAAG,EAAE,CAAC;gBACd,OAAO,CAAC,GAAG,CAAC,KAAK,eAAe,EAAE,CAAC,CAAC;gBACpC,OAAO,CAAC,GAAG,EAAE,CAAC;gBACd,EAAE,CAAC,KAAK,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;YAC7B,CAAC;YACD,SAAS,EAAE,GAAG,EAAE;gBACd,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,8BAA8B,CAAC,CAAC;YAC5D,CAAC;YACD,WAAW;SACZ,CAAC,CAAC;QAEH,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YACf,OAAO,EAAE,IAAI,EAAE,CAAC;YAChB,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;YACzB,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC;QAE/B,MAAM,oBAAoB,GACxB,OAAO,CAAC,oBAAoB,IAAI,yBAAyB,CAAC,OAAO,CAAC,SAAS,IAAI,KAAK,CAAC,CAAC;QAExF,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC;YACtB,MAAM,MAAM,GAAG,MAAM,oBAAoB,CAAC;gBACxC,KAAK;gBACL,QAAQ,EAAE,YAAY,CAAC,QAAQ;gBAC/B,WAAW,EAAE,MAAM,CAAC,WAAW;gBAC/B,oBAAoB;gBACpB,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACpE,SAAS,EAAE,EAAE,CAAC,IAAI;aACnB,CAAC,CAAC;YACH,QAAQ,MAAM,CAAC,MAAM,EAAE,CAAC;gBACtB,KAAK,WAAW;oBACd,OAAO,gBAAgB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;gBAC3C,KAAK,iBAAiB;oBACpB,EAAE,CAAC,KAAK,CAAC,6EAA6E,CAAC,CAAC;oBACxF,OAAO,IAAI,CAAC;gBACd,KAAK,SAAS;oBACZ,EAAE,CAAC,KAAK,CAAC,iFAAiF,CAAC,CAAC;oBAC5F,OAAO,IAAI,CAAC;YAChB,CAAC;QACH,CAAC;QAED,MAAM,cAAc,GAClB,OAAO,CAAC,cAAc,IAAI,IAAI,uBAAuB,CAAC,EAAE,oBAAoB,EAAE,aAAa,EAAE,CAAC,CAAC;QAEjG,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC;YACpC,KAAK;YACL,cAAc;YACd,QAAQ,EAAE,YAAY,CAAC,QAAQ;YAC/B,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,oBAAoB;YACpB,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACpE,SAAS,EAAE,EAAE,CAAC,IAAI;SACnB,CAAC,CAAC;QAEH,QAAQ,MAAM,CAAC,MAAM,EAAE,CAAC;YACtB,KAAK,WAAW;gBACd,OAAO,gBAAgB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YAC3C,KAAK,SAAS,CAAC,CAAC,CAAC;gBACf,kFAAkF;gBAClF,EAAE,CAAC,IAAI,CAAC,yBAAyB,MAAM,CAAC,eAAe,qCAAqC,CAAC,CAAC;gBAC9F,MAAM,QAAQ,GAAG,MAAM,uBAAuB,CAAC;oBAC7C,KAAK;oBACL,cAAc;oBACd,gBAAgB,EAAE,MAAM,CAAC,WAAW,CAAC,WAAW,IAAI,EAAE;oBACtD,eAAe,EAAE,MAAM,CAAC,WAAW,CAAC,OAAO;oBAC3C,YAAY,EAAE,MAAM,CAAC,WAAW,CAAC,YAAY;oBAC7C,WAAW,EAAE,OAAO,CAAC,WAAW;oBAChC,KAAK;iBACN,CAAC,CAAC;gBACH,IAAI,QAAQ,EAAE,CAAC;oBACb,OAAO,gBAAgB,CAAC,QAAQ,CAAC,CAAC;gBACpC,CAAC;gBACD,EAAE,CAAC,KAAK,CACN,+GAA+G,CAChH,CAAC;gBACF,OAAO,IAAI,CAAC;YACd,CAAC;YACD,KAAK,iBAAiB;gBACpB,EAAE,CAAC,KAAK,CAAC,6EAA6E,CAAC,CAAC;gBACxF,OAAO,IAAI,CAAC;YACd,KAAK,SAAS;gBACZ,EAAE,CAAC,KAAK,CAAC,iFAAiF,CAAC,CAAC;gBAC5F,OAAO,IAAI,CAAC;QAChB,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,EAAE,IAAI,EAAE,CAAC;QAChB,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjE,IAAI,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC;YACzE,EAAE,CAAC,KAAK,CAAC,gCAAgC,aAAa,EAAE,CAAC,CAAC;QAC5D,CAAC;aAAM,CAAC;YACN,EAAE,CAAC,KAAK,CAAC,0BAA0B,OAAO,EAAE,CAAC,CAAC;QAChD,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC"}

package/dist/utils/config.d.ts

@@ -56,37 +56,31 @@ export declare function updateFeatures(config: UnityConnectionConfig, featureTyp
 export declare function isCloudMode(config: UnityConnectionConfig): boolean;
 export declare const CLOUD_SERVER_BASE_URL = "https://ai-game.dev";
 export declare const CLOUD_SERVER_URL = "https://ai-game.dev/mcp";
-/**
- * Read the Cloud-mode Bearer credential from the shared machine credential store
- * (`~/.ai-game-dev/credentials.json`, managed by `@baizor/gamedev-cli-core`).
- *
- * Post-T9 the Unity plugin no longer writes `cloudToken` into the project config — the cloud auth
- * token now lives once per machine in the shared store (written by `unity-mcp-cli login`). Returns the
- * stored `accessToken`, or `undefined` when the user is not logged in OR the store is unreadable — a
- * corrupt/undecryptable store must degrade to "not logged in", never crash a tool call.
- */
-export declare function readMachineStoreCloudToken(): string | undefined;
 /** Options for {@link resolveConnectionFromConfig}. */
 export interface ResolveConnectionFromConfigOptions {
     /**
-     * Reads the Cloud-mode Bearer credential from the shared machine credential store. Injectable so
-     * tests (and advanced callers) can supply a deterministic value without touching the real
-     * per-machine store. Defaults to {@link readMachineStoreCloudToken}.
+     * Supplies the Cloud-mode Bearer credential. REQUIRED (no built-in default): the production
+     * value is `readCloudAccessToken` from `cloud-credentials.ts` — cli-core's
+     * `MachineCredentialProvider`, which proactively refreshes an expiring token under the
+     * cross-process lock (unified-machine-auth 04 §3). A raw on-disk `accessToken` read must never
+     * reappear here: it returns a token nobody refreshes (the pre-d2 defect). Tests inject a
+     * deterministic value; sync or async both work.
      */
-    readCloudToken?: () => string | undefined;
+    readCloudToken: () => Promise<string | undefined> | string | undefined;
 }
 /**
  * Resolve the server URL and auth token from a project config based on connectionMode.
  * - Custom mode (string "Custom" or integer 0): uses `host` and `token` (self-host / derived-port).
  * - Cloud mode (string "Cloud" or integer 1): uses the hardcoded cloud URL and the Bearer credential
- *   from the shared machine credential store (`~/.ai-game-dev/credentials.json`) — NOT the on-disk
- *   `cloudToken`, which the plugin stopped writing post-T9 (defect E / D11).
+ *   supplied by `options.readCloudToken` (production: the shared machine credential store via
+ *   cli-core's refreshing `MachineCredentialProvider`) — NOT the on-disk `cloudToken`, which the
+ *   plugin stopped writing post-T9 (defect E / D11).
  * In Custom mode, `url` and `token` may be undefined if the corresponding config fields are not set.
- * In Cloud mode, `url` is always the hardcoded cloud URL, while `token` is the stored credential and is
- * `undefined` when the user is not logged in — the caller surfaces an actionable "not logged in" error
- * rather than issuing a silent unauthenticated request.
+ * In Cloud mode, `url` is always the hardcoded cloud URL, while `token` is the provided credential and
+ * is `undefined` when the user is not logged in — the caller surfaces an actionable "not logged in"
+ * error rather than issuing a silent unauthenticated request.
  */
-export declare function resolveConnectionFromConfig(config: UnityConnectionConfig, options?: ResolveConnectionFromConfigOptions): {
+export declare function resolveConnectionFromConfig(config: UnityConnectionConfig, options: ResolveConnectionFromConfigOptions): Promise<{
     url: string | undefined;
     token: string | undefined;
-};
+}>;

package/dist/utils/config.js

@@ -1,7 +1,6 @@
 import * as fs from 'fs';
 import * as path from 'path';
 import { generatePortFromDirectory } from './port.js';
-import { MachineCredentialStore } from './machine-credentials.js';
 const CONFIG_RELATIVE_PATH = 'UserSettings/AI-Game-Developer-Config.json';
 function getConfigPath(projectPath) {
     return path.join(projectPath, CONFIG_RELATIVE_PATH);
@@ -126,38 +125,21 @@ export function isCloudMode(config) {
 }
 export const CLOUD_SERVER_BASE_URL = 'https://ai-game.dev';
 export const CLOUD_SERVER_URL = 'https://ai-game.dev/mcp';
-/**
- * Read the Cloud-mode Bearer credential from the shared machine credential store
- * (`~/.ai-game-dev/credentials.json`, managed by `@baizor/gamedev-cli-core`).
- *
- * Post-T9 the Unity plugin no longer writes `cloudToken` into the project config — the cloud auth
- * token now lives once per machine in the shared store (written by `unity-mcp-cli login`). Returns the
- * stored `accessToken`, or `undefined` when the user is not logged in OR the store is unreadable — a
- * corrupt/undecryptable store must degrade to "not logged in", never crash a tool call.
- */
-export function readMachineStoreCloudToken() {
-    try {
-        return new MachineCredentialStore().read()?.accessToken ?? undefined;
-    }
-    catch {
-        return undefined;
-    }
-}
 /**
  * Resolve the server URL and auth token from a project config based on connectionMode.
  * - Custom mode (string "Custom" or integer 0): uses `host` and `token` (self-host / derived-port).
  * - Cloud mode (string "Cloud" or integer 1): uses the hardcoded cloud URL and the Bearer credential
- *   from the shared machine credential store (`~/.ai-game-dev/credentials.json`) — NOT the on-disk
- *   `cloudToken`, which the plugin stopped writing post-T9 (defect E / D11).
+ *   supplied by `options.readCloudToken` (production: the shared machine credential store via
+ *   cli-core's refreshing `MachineCredentialProvider`) — NOT the on-disk `cloudToken`, which the
+ *   plugin stopped writing post-T9 (defect E / D11).
  * In Custom mode, `url` and `token` may be undefined if the corresponding config fields are not set.
- * In Cloud mode, `url` is always the hardcoded cloud URL, while `token` is the stored credential and is
- * `undefined` when the user is not logged in — the caller surfaces an actionable "not logged in" error
- * rather than issuing a silent unauthenticated request.
+ * In Cloud mode, `url` is always the hardcoded cloud URL, while `token` is the provided credential and
+ * is `undefined` when the user is not logged in — the caller surfaces an actionable "not logged in"
+ * error rather than issuing a silent unauthenticated request.
  */
-export function resolveConnectionFromConfig(config, options = {}) {
+export async function resolveConnectionFromConfig(config, options) {
     if (isCloudMode(config)) {
-        const readCloudToken = options.readCloudToken ?? readMachineStoreCloudToken;
-        return { url: CLOUD_SERVER_URL, token: readCloudToken() };
+        return { url: CLOUD_SERVER_URL, token: await options.readCloudToken() };
     }
     return { url: config.host, token: config.token };
 }

package/dist/utils/config.js.map

@@ -1 +1 @@
-{"version":3,"file":"config.js","sourceRoot":"","sources":["../../src/utils/config.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AACzB,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAC7B,OAAO,EAAE,yBAAyB,EAAE,MAAM,WAAW,CAAC;AACtD,OAAO,EAAE,sBAAsB,EAAE,MAAM,0BAA0B,CAAC;AAElE,MAAM,oBAAoB,GAAG,4CAA4C,CAAC;AAwB1E,SAAS,aAAa,CAAC,WAAmB;IACxC,OAAO,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,oBAAoB,CAAC,CAAC;AACtD,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,mBAAmB,CAAC,WAAmB;IACrD,MAAM,IAAI,GAAG,yBAAyB,CAAC,WAAW,CAAC,CAAC;IACpD,OAAO;QACL,IAAI,EAAE,oBAAoB,IAAI,EAAE;QAChC,aAAa,EAAE,KAAK;QACpB,QAAQ,EAAE,CAAC;QACX,SAAS,EAAE,KAAK;QAChB,iBAAiB,EAAE,KAAK;QACxB,eAAe,EAAE,gBAAgB;QACjC,UAAU,EAAE,MAAM;QAClB,cAAc,EAAE,QAAQ;QACxB,KAAK,EAAE,EAAE;QACT,OAAO,EAAE,EAAE;QACX,SAAS,EAAE,EAAE;KACd,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,UAAU,CAAC,WAAmB;IAC5C,MAAM,UAAU,GAAG,aAAa,CAAC,WAAW,CAAC,CAAC;IAC9C,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QAC/B,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,IAAI,GAAG,EAAE,CAAC,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;IAClD,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAA0B,CAAC;IACnD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,WAAW,EAAE,CAAC;YAC/B,MAAM,IAAI,WAAW,CAAC,kCAAkC,UAAU,KAAK,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;QACxF,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,WAAW,CAAC,WAAmB,EAAE,MAA6B;IAC5E,MAAM,UAAU,GAAG,aAAa,CAAC,WAAW,CAAC,CAAC;IAC9C,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IACrC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACxB,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACzC,CAAC;IACD,EAAE,CAAC,aAAa,CAAC,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;AACvE,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,iBAAiB,CAAC,WAAmB;IACnD,IAAI,EAAE,CAAC,UAAU,CAAC,aAAa,CAAC,WAAW,CAAC,CAAC,EAAE,CAAC;QAC9C,OAAO,UAAU,CAAC,WAAW,CAA0B,CAAC;IAC1D,CAAC;IAED,MAAM,MAAM,GAAG,mBAAmB,CAAC,WAAW,CAAC,CAAC;IAChD,WAAW,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;IACjC,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAC5B,MAA6B,EAC7B,WAA8C,EAC9C,OAKC;IAED,MAAM,WAAW,GAAG,MAAM,CAAC,WAAW,CAAC,CAAC;IACxC,MAAM,QAAQ,GAAiB,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC;QACvD,CAAC,CAAC,WAAW,CAAC,MAAM,CAChB,CAAC,CAAC,EAAmB,EAAE,CACrB,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI,IAAI,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,OAAO,KAAK,SAAS,CACtG;QACH,CAAC,CAAC,EAAE,CAAC;IAEP,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC;QACtB,KAAK,MAAM,CAAC,IAAI,QAAQ;YAAE,CAAC,CAAC,OAAO,GAAG,IAAI,CAAC;QAC3C,MAAM,CAAC,WAAW,CAAC,GAAG,QAAQ,CAAC;QAC/B,OAAO;IACT,CAAC;IAED,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;QACvB,KAAK,MAAM,CAAC,IAAI,QAAQ;YAAE,CAAC,CAAC,OAAO,GAAG,KAAK,CAAC;QAC5C,MAAM,CAAC,WAAW,CAAC,GAAG,QAAQ,CAAC;QAC/B,OAAO;IACT,CAAC;IAED,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC;QACxB,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC;YACvC,MAAM,QAAQ,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;YACvD,IAAI,QAAQ,EAAE,CAAC;gBACb,QAAQ,CAAC,OAAO,GAAG,IAAI,CAAC;YAC1B,CAAC;iBAAM,CAAC;gBACN,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;YACzC,CAAC;QACH,CAAC;IACH,CAAC;IAED,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC;QACzB,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC;YACxC,MAAM,QAAQ,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;YACvD,IAAI,QAAQ,EAAE,CAAC;gBACb,QAAQ,CAAC,OAAO,GAAG,KAAK,CAAC;YAC3B,CAAC;iBAAM,CAAC;gBACN,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;YAC1C,CAAC;QACH,CAAC;IACH,CAAC;IAED,MAAM,CAAC,WAAW,CAAC,GAAG,QAAQ,CAAC;AACjC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,WAAW,CAAC,MAA6B;IACvD,MAAM,IAAI,GAAG,MAAM,CAAC,cAAc,CAAC;IACnC,OAAO,IAAI,KAAK,OAAO,IAAI,IAAI,KAAK,CAAC,CAAC;AACxC,CAAC;AAED,MAAM,CAAC,MAAM,qBAAqB,GAAG,qBAAqB,CAAC;AAC3D,MAAM,CAAC,MAAM,gBAAgB,GAAG,yBAAyB,CAAC;AAE1D;;;;;;;;GAQG;AACH,MAAM,UAAU,0BAA0B;IACxC,IAAI,CAAC;QACH,OAAO,IAAI,sBAAsB,EAAE,CAAC,IAAI,EAAE,EAAE,WAAW,IAAI,SAAS,CAAC;IACvE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAYD;;;;;;;;;;GAUG;AACH,MAAM,UAAU,2BAA2B,CACzC,MAA6B,EAC7B,UAA8C,EAAE;IAKhD,IAAI,WAAW,CAAC,MAAM,CAAC,EAAE,CAAC;QACxB,MAAM,cAAc,GAAG,OAAO,CAAC,cAAc,IAAI,0BAA0B,CAAC;QAC5E,OAAO,EAAE,GAAG,EAAE,gBAAgB,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE,CAAC;IAC5D,CAAC;IAED,OAAO,EAAE,GAAG,EAAE,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC;AACnD,CAAC"}
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../../src/utils/config.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AACzB,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAC7B,OAAO,EAAE,yBAAyB,EAAE,MAAM,WAAW,CAAC;AAEtD,MAAM,oBAAoB,GAAG,4CAA4C,CAAC;AAwB1E,SAAS,aAAa,CAAC,WAAmB;IACxC,OAAO,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,oBAAoB,CAAC,CAAC;AACtD,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,mBAAmB,CAAC,WAAmB;IACrD,MAAM,IAAI,GAAG,yBAAyB,CAAC,WAAW,CAAC,CAAC;IACpD,OAAO;QACL,IAAI,EAAE,oBAAoB,IAAI,EAAE;QAChC,aAAa,EAAE,KAAK;QACpB,QAAQ,EAAE,CAAC;QACX,SAAS,EAAE,KAAK;QAChB,iBAAiB,EAAE,KAAK;QACxB,eAAe,EAAE,gBAAgB;QACjC,UAAU,EAAE,MAAM;QAClB,cAAc,EAAE,QAAQ;QACxB,KAAK,EAAE,EAAE;QACT,OAAO,EAAE,EAAE;QACX,SAAS,EAAE,EAAE;KACd,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,UAAU,CAAC,WAAmB;IAC5C,MAAM,UAAU,GAAG,aAAa,CAAC,WAAW,CAAC,CAAC;IAC9C,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QAC/B,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,IAAI,GAAG,EAAE,CAAC,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;IAClD,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAA0B,CAAC;IACnD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,WAAW,EAAE,CAAC;YAC/B,MAAM,IAAI,WAAW,CAAC,kCAAkC,UAAU,KAAK,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;QACxF,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,WAAW,CAAC,WAAmB,EAAE,MAA6B;IAC5E,MAAM,UAAU,GAAG,aAAa,CAAC,WAAW,CAAC,CAAC;IAC9C,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IACrC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACxB,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACzC,CAAC;IACD,EAAE,CAAC,aAAa,CAAC,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;AACvE,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,iBAAiB,CAAC,WAAmB;IACnD,IAAI,EAAE,CAAC,UAAU,CAAC,aAAa,CAAC,WAAW,CAAC,CAAC,EAAE,CAAC;QAC9C,OAAO,UAAU,CAAC,WAAW,CAA0B,CAAC;IAC1D,CAAC;IAED,MAAM,MAAM,GAAG,mBAAmB,CAAC,WAAW,CAAC,CAAC;IAChD,WAAW,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;IACjC,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAC5B,MAA6B,EAC7B,WAA8C,EAC9C,OAKC;IAED,MAAM,WAAW,GAAG,MAAM,CAAC,WAAW,CAAC,CAAC;IACxC,MAAM,QAAQ,GAAiB,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC;QACvD,CAAC,CAAC,WAAW,CAAC,MAAM,CAChB,CAAC,CAAC,EAAmB,EAAE,CACrB,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI,IAAI,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,OAAO,KAAK,SAAS,CACtG;QACH,CAAC,CAAC,EAAE,CAAC;IAEP,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC;QACtB,KAAK,MAAM,CAAC,IAAI,QAAQ;YAAE,CAAC,CAAC,OAAO,GAAG,IAAI,CAAC;QAC3C,MAAM,CAAC,WAAW,CAAC,GAAG,QAAQ,CAAC;QAC/B,OAAO;IACT,CAAC;IAED,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;QACvB,KAAK,MAAM,CAAC,IAAI,QAAQ;YAAE,CAAC,CAAC,OAAO,GAAG,KAAK,CAAC;QAC5C,MAAM,CAAC,WAAW,CAAC,GAAG,QAAQ,CAAC;QAC/B,OAAO;IACT,CAAC;IAED,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC;QACxB,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC;YACvC,MAAM,QAAQ,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;YACvD,IAAI,QAAQ,EAAE,CAAC;gBACb,QAAQ,CAAC,OAAO,GAAG,IAAI,CAAC;YAC1B,CAAC;iBAAM,CAAC;gBACN,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;YACzC,CAAC;QACH,CAAC;IACH,CAAC;IAED,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC;QACzB,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC;YACxC,MAAM,QAAQ,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;YACvD,IAAI,QAAQ,EAAE,CAAC;gBACb,QAAQ,CAAC,OAAO,GAAG,KAAK,CAAC;YAC3B,CAAC;iBAAM,CAAC;gBACN,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;YAC1C,CAAC;QACH,CAAC;IACH,CAAC;IAED,MAAM,CAAC,WAAW,CAAC,GAAG,QAAQ,CAAC;AACjC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,WAAW,CAAC,MAA6B;IACvD,MAAM,IAAI,GAAG,MAAM,CAAC,cAAc,CAAC;IACnC,OAAO,IAAI,KAAK,OAAO,IAAI,IAAI,KAAK,CAAC,CAAC;AACxC,CAAC;AAED,MAAM,CAAC,MAAM,qBAAqB,GAAG,qBAAqB,CAAC;AAC3D,MAAM,CAAC,MAAM,gBAAgB,GAAG,yBAAyB,CAAC;AAe1D;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAC/C,MAA6B,EAC7B,OAA2C;IAK3C,IAAI,WAAW,CAAC,MAAM,CAAC,EAAE,CAAC;QACxB,OAAO,EAAE,GAAG,EAAE,gBAAgB,EAAE,KAAK,EAAE,MAAM,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC;IAC1E,CAAC;IAED,OAAO,EAAE,GAAG,EAAE,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC;AACnD,CAAC"}

package/dist/utils/connection.d.ts

@@ -31,13 +31,16 @@ export declare function resolveAndValidateProjectPath(positionalPath: string | u
 export interface ResolveConnectionDeps {
     /**
      * Injection point for the Cloud-mode machine-store credential read. Forwarded to
-     * `resolveConnectionFromConfig`; defaults to the real per-machine store. Tests inject a
-     * deterministic value.
+     * `resolveConnectionFromConfig`; defaults to `readCloudAccessToken` — cli-core's
+     * `MachineCredentialProvider` (proactive refresh under the cross-process lock, never a raw
+     * on-disk read). Tests inject a deterministic value.
      */
-    readCloudToken?: () => string | undefined;
+    readCloudToken?: () => Promise<string | undefined> | string | undefined;
 }
-export declare function resolveConnection(projectPath: string, options: ConnectionOptions, deps?: ResolveConnectionDeps): {
+export declare function resolveConnection(projectPath: string, options: ConnectionOptions, deps?: ResolveConnectionDeps): Promise<{
     url: string;
     token: string | undefined;
     cloudAuthMissing: boolean;
-};
+    /** True when the Bearer came from the shared machine store (Cloud mode, no --token override). */
+    tokenFromCloudStore: boolean;
+}>;