agent-engine-runner-shared 0.11.11__tar.gz → 0.11.13__tar.gz

{agent_engine_runner_shared-0.11.11 → agent_engine_runner_shared-0.11.13}/CHANGELOG.md

@@ -7,6 +7,23 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+### Changed
+- **Breaking:** the connector `tool.yaml` `auth` block no longer takes `type`.
+  It names exactly one credential: `bearer: <secret>`, `basic: {username,
+  password}`, `api_keys: [{env, location, name, prefix}]`, or
+  `provider: <OAuth app>` with optional `scopes`, plus optional `headers`; omit
+  the block for no credential. A block that still uses `type` or its fields
+  fails validation and names the key to use instead. `compile_catalog` and
+  `scaffold_tool_yaml` propose the block from the document's security schemes
+  and derive secret names from the connector name; `auth` now takes `none`,
+  `bearer`, `basic` or `api_keys`, and an OAuth document needs `provider`.
+  Generated catalogs record the credential kind without `type`.
+  `Auth.header_name()` and `Auth.credential_bindings()` are removed; read
+  `Auth.api_keys`. Regenerating a connector with no `auth` block compiles every
+  operation anonymously instead of from the OpenAPI document's security, so
+  operations the first compile skipped can appear as tools; they send no
+  credential.
+
 ### Removed
 - Removed the unused pre-materialized connector bundle override
   (`AGENTIC_CONNECTOR_BUNDLE_PATH`) and the `load_connector_bundle` /

{agent_engine_runner_shared-0.11.11 → agent_engine_runner_shared-0.11.13}/Dockerfile

@@ -5,7 +5,7 @@
 # Usage: docker buildx build -t runner:latest -f packages/python/packages/agent-engine-runner-shared/Dockerfile .
 
 ARG BASE_TARGETPLATFORM=linux/amd64
-ARG RUNNER_BASE_IMAGE=664315256653.dkr.ecr.us-east-1.amazonaws.com/base/amazonlinux2023-python:v3.11-202610191636-2ff39c3@sha256:30ecac067fceafe43a5f0f5e80d1725b60708204dcd2fe3f176363417e2a2402
+ARG RUNNER_BASE_IMAGE=664315256653.dkr.ecr.us-east-1.amazonaws.com/base/amazonlinux2023-python:v3.11-202611021131-0cb5df7@sha256:059f4396b31473f85e83c9219255b37f7b24e3caaef1c129363d50bc50383ceb
 
 FROM --platform=${BASE_TARGETPLATFORM} ghcr.io/astral-sh/uv@sha256:ff07b86af50d4d9391d9daf4ff89ce427bc544f9aae87057e69a1cc0aa369946 AS uv
 

{agent_engine_runner_shared-0.11.11 → agent_engine_runner_shared-0.11.13}/PKG-INFO

@@ -1,12 +1,12 @@
 Metadata-Version: 2.5
 Name: agent-engine-runner-shared
-Version: 0.11.11
+Version: 0.11.13
 Summary: Runner SDK - Framework-agnostic agent runtime
 License: Apache-2.0
 License-File: LICENSE
 Requires-Python: >=3.11
-Requires-Dist: agent-engine-sdk-memory==0.11.11
-Requires-Dist: agent-engine-sdk==0.11.11
+Requires-Dist: agent-engine-sdk-memory==0.11.13
+Requires-Dist: agent-engine-sdk==0.11.13
 Requires-Dist: fastapi>=0.141.1
 Requires-Dist: filelock>=3.0.0
 Requires-Dist: httpx-sse>=0.4.0

{agent_engine_runner_shared-0.11.11 → agent_engine_runner_shared-0.11.13}/docs/api.md

@@ -183,6 +183,7 @@
   * [PolicyDeniedException](#agent_engine_runner_shared.secure_wrapper.PolicyDeniedException)
   * [OERetryAfterError](#agent_engine_runner_shared.secure_wrapper.OERetryAfterError)
   * [ToolExecutionError](#agent_engine_runner_shared.secure_wrapper.ToolExecutionError)
+  * [ToolOutcomeUnknownError](#agent_engine_runner_shared.secure_wrapper.ToolOutcomeUnknownError)
   * [ToolPlatformError](#agent_engine_runner_shared.secure_wrapper.ToolPlatformError)
   * [TerminalExecutionError](#agent_engine_runner_shared.secure_wrapper.TerminalExecutionError)
   * [raise\_for\_oe\_rejection](#agent_engine_runner_shared.secure_wrapper.raise_for_oe_rejection)
@@ -2436,9 +2437,9 @@ return parse(html)
 Runtime-transparent custom-event emission across Atlas Agent Engine runtimes.
 
 Authors call :func:`emit_custom_event` without knowing which runtime is
-hosting the code (AER agent process vs Tool Pod / function mode). The active
-runtime installs exactly one :class:`CustomEventTransport` before invoking
-tenant code; the helper dispatches to that transport.
+hosting the code (AER agent process vs Tool Pod). The active runtime installs
+exactly one :class:`CustomEventTransport` before invoking tenant code; the
+helper dispatches to that transport.
 
 Atlas Agent Engine transports an opaque author-final JSON object as ``custom_event``.
 It does not interpret keys — customers who need a shaped vocabulary (e.g.
@@ -2570,7 +2571,7 @@ no transport is installed (outside an execution context).
 class OEHTTPCustomEventTransport()
 ```
 
-Tool Pod / function-mode transport: POST final ``custom_event`` chunks to OE.
+Tool Pod transport: POST final ``custom_event`` chunks to OE.
 
 Delivery is awaited with a bounded timeout and is non-fatal: delivery
 failures are logged and swallowed so a progress event cannot fail the tool.
@@ -2586,10 +2587,10 @@ class FeatureOffCustomEventTransport()
 Fail closed when ``use_custom_parser`` is disabled.
 
 Runtime-neutral rejecting transport shared by AER streaming (when Atlas Agent Engine
-does not subscribe to LangGraph ``custom``) and Tool Pod / function mode
-(when OE POSTs would otherwise succeed while Gateway strips client
-delivery). Authors must not observe a successful emit when the workspace
-cannot deliver custom events to clients.
+does not subscribe to LangGraph ``custom``) and the Tool Pod (when OE POSTs
+would otherwise succeed while Gateway strips client delivery). Authors
+must not observe a successful emit when the workspace cannot deliver custom
+events to clients.
 
 <a id="agent_engine_runner_shared.custom_events.install_tool_custom_event_transport"></a>
 
@@ -2600,7 +2601,7 @@ def install_tool_custom_event_transport(
         *, enabled: bool = True) -> Token[Optional[CustomEventTransport]]
 ```
 
-Install Tool Pod / function-mode custom-event transport; return reset token.
+Install the Tool Pod custom-event transport; return reset token.
 
 When ``enabled`` is false (workspace does not have ``use_custom_parser``),
 install a rejecting transport so emit fails closed instead of POSTing an
@@ -2855,6 +2856,19 @@ class ToolExecutionError(Exception)
 
 Raised when tool execution fails.
 
+<a id="agent_engine_runner_shared.secure_wrapper.ToolOutcomeUnknownError"></a>
+
+## ToolOutcomeUnknownError
+
+```python
+class ToolOutcomeUnknownError(ToolExecutionError)
+```
+
+The runner was lost while this durable tool call was in flight.
+
+It may have taken effect and OE did not run it again. ``error`` is OE's
+message, written for the model reading it.
+
 <a id="agent_engine_runner_shared.secure_wrapper.ToolPlatformError"></a>
 
 ## ToolPlatformError
@@ -2977,7 +2991,7 @@ def request_oe_approval(
         is_local: bool = True,
         metadata: Optional[Dict[str, Any]] = None,
         redact_fields: Optional[list[str]] = None,
-        provider_type: Optional[str] = None,
+        provider: Optional[str] = None,
         scopes: Optional[list[str]] = None,
         tool_call_id: Optional[str] = None,
         custom_headers: Optional[Dict[str, str]] = None,
@@ -3163,22 +3177,22 @@ Clean up resources owned by this execution's wrapper.
 #### execute\_tool
 
 ```python
-def execute_tool(
-        tool_name: str,
-        arguments: Dict[str, Any],
-        *,
-        metadata: Optional[Dict[str, Any]] = None,
-        provider_type: Optional[str] = None,
-        scopes: Optional[list[str]] = None,
-        tool_call_id: Optional[str] = None,
-        raw_on_interrupt: bool = False,
-        redact_fields: Optional[list[str]] = None,
-        is_local: bool = True,
-        local_executor: Optional[Callable[[], Any]] = None,
-        is_framework_control_flow: Optional[Callable[[BaseException],
-                                                     bool]] = None,
-        call_channel_expected: bool = False,
-        on_unknown_outcome: Optional[UnknownOutcomePolicy] = None) -> Any
+def execute_tool(tool_name: str,
+                 arguments: Dict[str, Any],
+                 *,
+                 metadata: Optional[Dict[str, Any]] = None,
+                 provider: Optional[str] = None,
+                 scopes: Optional[list[str]] = None,
+                 tool_call_id: Optional[str] = None,
+                 raw_on_interrupt: bool = False,
+                 redact_fields: Optional[list[str]] = None,
+                 is_local: bool = True,
+                 local_executor: Optional[Callable[[], Any]] = None,
+                 is_framework_control_flow: Optional[Callable[[BaseException],
+                                                              bool]] = None,
+                 call_channel_expected: bool = False,
+                 on_unknown_outcome: Optional[UnknownOutcomePolicy] = None,
+                 owning_tool_call: Optional[OwningToolCall] = None) -> Any
 ```
 
 Execute a tool call through OE.
@@ -3206,6 +3220,10 @@ Its consent answer never becomes a tool result or Memory content.
 - `on_unknown_outcome` - What a retry does when the runner was lost while
   this tool was in flight in a durable workflow: ``"rerun"`` runs it
   again, ``"fail"`` refuses the retry.
+- `owning_tool_call` - The tool call or subagent this operation is performed
+  for, when it is not itself a tool the model requested. In a durable
+  workflow it runs alongside other activities, at a position derived
+  from that call.
 
 
 **Returns**:
@@ -3233,7 +3251,7 @@ def create_secure_tool_function(
         allow_direct: bool = False,
         metadata: Optional[Dict[str, Any]] = None,
         is_local: bool = True,
-        provider_type: Optional[str] = None,
+        provider: Optional[str] = None,
         scopes: Optional[list[str]] = None,
         response_format: Literal["content",
                                  "content_and_artifact"] = "content",
@@ -3929,7 +3947,7 @@ stdout output so the Local Dev UI can read the agent's logs.
 **Arguments**:
 
 - `app_name` - Application name for log file naming
-- `mode` - Runtime mode (aer, tool, tool_function)
+- `mode` - Runtime mode (aer, tool)
 - `log_dir` - Directory for log files (default: ./logs)
 - `log_level` - Log level (default: from LOG_LEVEL env or INFO)
 - `backup_count` - Number of rotated backup files to keep

{agent_engine_runner_shared-0.11.11 → agent_engine_runner_shared-0.11.13}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "agent-engine-runner-shared"
-version = "0.11.11"
+version = "0.11.13"
 description = "Runner SDK - Framework-agnostic agent runtime"
 readme = "README.md"
 license = {text = "Apache-2.0"}
@@ -27,9 +27,9 @@ dependencies = [
     "jsonschema>=4.26.0",
     "sentry-sdk>=2.27.0",
     # BaseAgent protocol and AgentInput/AgentEvent models
-    "agent-engine-sdk==0.11.11",
+    "agent-engine-sdk==0.11.13",
     # Memory models and the MemoryClient HTTP client
-    "agent-engine-sdk-memory==0.11.11",
+    "agent-engine-sdk-memory==0.11.13",
     # Required for checkpoint message decoding (query/sessions endpoints)
     "msgpack>=1.0.0",
     # Required by guardrails_evaluator/regex.py for advanced regex matching

{agent_engine_runner_shared-0.11.11 → agent_engine_runner_shared-0.11.13}/src/agent_engine_runner_shared/__init__.py

@@ -96,6 +96,7 @@ from agent_engine_runner_shared.secure_wrapper import (
     TerminalExecutionError,
     ToolCallTimeoutError,
     ToolExecutionError,
+    ToolOutcomeUnknownError,
     ToolPlatformError,
     extract_usage,
 )
@@ -191,6 +192,7 @@ __all__ = [
     "TerminalExecutionError",
     "ToolCallTimeoutError",
     "ToolExecutionError",
+    "ToolOutcomeUnknownError",
     "ToolPlatformError",
     "ExternalAPICallError",
     # Utilities

agent_engine_runner_shared-0.11.13/src/agent_engine_runner_shared/__main__.py

@@ -0,0 +1,12 @@
+"""Generic platform entrypoint for the runner-shared image.
+
+Dispatches via RUNNER_MODE (aer | tool) through
+TenantRuntime.register_and_run(). Tool mode does not need a graph builder; aer
+mode does, so user agents provide their own __main__.py for that case
+(App.run() enforces the builder check there).
+"""
+
+from agent_engine_runner_shared.runtime import TenantRuntime
+
+if __name__ == "__main__":
+    TenantRuntime().register_and_run()

{agent_engine_runner_shared-0.11.11 → agent_engine_runner_shared-0.11.13}/src/agent_engine_runner_shared/agent_config.py

@@ -340,7 +340,20 @@ class RuntimeMCPServerConfig(BaseModel):
         default="streamable_http",
         description="MCP transport used to connect to the server.",
     )
-    url: NonEmptyString = Field(description="Streamable HTTP endpoint for the MCP server.")
+    url: NonEmptyString | None = Field(
+        default=None,
+        description=(
+            "Streamable HTTP endpoint for the MCP server. An entry with no url names "
+            "a project OAuth app with its key, and the app's resource is the endpoint."
+        ),
+    )
+    scopes: list[NonEmptyString] = Field(
+        default_factory=list,
+        description=(
+            "Scopes requested from the OAuth app the entry names, instead of the "
+            "app's defaults. Refused beside a url."
+        ),
+    )
     headers: dict[str, str] = Field(
         default_factory=dict,
         description="Static non-secret HTTP headers sent to the MCP server.",
@@ -361,11 +374,25 @@ class RuntimeMCPServerConfig(BaseModel):
 
     @model_validator(mode="after")
     def validate_server_config(self) -> "RuntimeMCPServerConfig":
-        parsed = urlparse(self.url)
-        if parsed.scheme not in {"http", "https"} or parsed.hostname is None:
-            raise ValueError("mcp server url must be an absolute http(s) URL")
-        if parsed.scheme == "http" and self.auth.type != "none":
-            raise ValueError("mcp server url must be https when auth.type is set")
+        if self.url is None:
+            # The app supplies the credential, so an auth block here could only
+            # disagree with it. auth has a default, so ask whether it was written.
+            if "auth" in self.model_fields_set:
+                raise ValueError(
+                    "mcp server auth is not allowed without url; "
+                    "an entry with no url names an OAuth app"
+                )
+        else:
+            if "scopes" in self.model_fields_set:
+                raise ValueError(
+                    "mcp server scopes is not allowed with url; "
+                    "scopes apply to an entry that names an OAuth app"
+                )
+            parsed = urlparse(self.url)
+            if parsed.scheme not in {"http", "https"} or parsed.hostname is None:
+                raise ValueError("mcp server url must be an absolute http(s) URL")
+            if parsed.scheme == "http" and self.auth.type != "none":
+                raise ValueError("mcp server url must be https when auth.type is set")
 
         forbidden_headers = sorted(
             header for header in self.headers if header.lower() in _FORBIDDEN_MCP_HEADER_KEYS
@@ -452,8 +479,8 @@ class RuntimeAgentConfig(BaseModel):
     a2a: A2AConfig = Field(default_factory=A2AConfig)
     mcp: RuntimeMCPConfig = Field(default_factory=RuntimeMCPConfig)
     required_secrets: SecretsConfig = Field(default_factory=SecretsConfig)
-    # Python/LangGraph only: connector authoring files materialized at startup.
-    # The shared Go parser rejects the key for TypeScript agents.
+    # LangGraph only: connector authoring files materialized at startup.
+    # The shared Go parser rejects the key for other frameworks.
     connectors: list[RuntimeConnectorReference] = Field(default_factory=list)
 
     def feature_enabled(

{agent_engine_runner_shared-0.11.11 → agent_engine_runner_shared-0.11.13}/src/agent_engine_runner_shared/connectors/README.md

@@ -1,8 +1,10 @@
 # Compiled connector core
 
-This Python-only package implements definition loading, synchronous HTTP execution and
-opt-in registration. It is not exposed through the CLI. Connector tools use the existing
-AER → OE → Tool Pod execution path.
+The Python and TypeScript Runner SDKs share this connector contract. The Python
+implementation covers definition loading, synchronous HTTP execution, and opt-in
+registration; the TypeScript implementation mirrors the same materialization,
+registration, and execution contract. It is not exposed through the CLI. Connector
+tools use the existing AER → OE → Tool Pod execution path.
 
 Runtime integration follows the platform's config → discover → register flow: each
 process derives its own view from the same manifest. Resolution in
@@ -35,24 +37,26 @@ source:
 expose:
   allow: [jiradc_getComments]
 auth:
-  type: bearer
-  env: JIRA_TOKEN
+  bearer: JIRA_TOKEN
 ```
 
-For delegated OAuth, replace that auth block with an explicit provider binding:
+The block names exactly one of `bearer`, `basic`, `api_keys` or `provider`, by
+workspace secret name or OAuth app; no block means no credential. For OAuth,
+bind the project's OAuth app instead:
 
 ```yaml
 auth:
-  type: oauth
-  provider_type: github
+  provider: github
   scopes: [repo]
 ```
 
-`provider_type` is the key of a provider configured for the project, independent
+`provider` names an OAuth app configured for the project, independent
 of the resource API's base URL. The scopes apply to every exposed operation in
 this connector. Registration carries this policy outside the model's argument
-schema. The Orchestration Engine resolves a credential for the saved application
-user and passes it to the Tool Pod for that invocation. A missing or invalid token
+schema. The Orchestration Engine resolves a credential and passes it to the Tool
+Pod for that invocation. The app's grant decides whose: an authorization code app
+gives the saved application user's token, and a client credentials app gives the
+project's shared token with no user and no consent. A missing or invalid token
 stops the HTTP call; OAuth never falls back to a tenant environment secret.
 Existing static auth modes continue to use their configured environment bindings.
 Catalog regeneration preserves the authored OAuth binding and records only

{agent_engine_runner_shared-0.11.11 → agent_engine_runner_shared-0.11.13}/src/agent_engine_runner_shared/connectors/__init__.py

@@ -8,6 +8,7 @@ from agent_engine_runner_shared.connectors.bundle import (
 )
 from agent_engine_runner_shared.connectors.definitions import (
     Auth,
+    BasicAuth,
     Credential,
     ToolDefinitions,
     load_tool_defs,
@@ -43,6 +44,7 @@ __all__ = [
     "GenerateError",
     "MaterializeError",
     "Auth",
+    "BasicAuth",
     "ToolDefinitions",
     "compile_catalog",
     "load_tool_defs",

{agent_engine_runner_shared-0.11.11 → agent_engine_runner_shared-0.11.13}/src/agent_engine_runner_shared/connectors/bundle.py

@@ -62,13 +62,13 @@ class BundledTool:
         """Return detached AER/Tool Pod policy, with delegated binding outside the schema."""
         operation = self.operation
         auth = self.connector.definitions.auth
-        delegated = auth if auth is not None and auth.type == "oauth" else None
+        provider = auth.provider if auth is not None else None
         return {
             "name": operation.name,
             "description": operation.description.strip() or f"REST connector tool {operation.name}",
             "is_local": False,
-            "provider_type": delegated.provider_type if delegated else None,
-            "scopes": list(delegated.scopes) if delegated else [],
+            "provider": provider,
+            "scopes": list(auth.scopes or []) if auth is not None and provider else [],
             "network": self.network,
             "timeout_seconds": DEFAULT_EXECUTION_TIMEOUT_SECONDS,
             "redact_fields": [],

{agent_engine_runner_shared-0.11.11 → agent_engine_runner_shared-0.11.13}/src/agent_engine_runner_shared/connectors/create_tool.py

@@ -16,13 +16,13 @@ import sys
 
 from pydantic import ValidationError
 
-from agent_engine_runner_shared.connectors.definitions import Auth
 from agent_engine_runner_shared.connectors.generate import (
     GenerateError,
     compile_catalog,
     regenerate_catalog,
     scaffold_tool_yaml,
 )
+from agent_engine_runner_shared.connectors.generate.authoring import AUTH_CHOICES
 
 __all__ = ["RESULT_PREFIX", "main"]
 
@@ -47,23 +47,21 @@ def _parser() -> argparse.ArgumentParser:
         "--config",
         help="Existing tool.yaml that declares source.spec; regenerates its catalog",
     )
-    parser.add_argument("--name", help="Connector name (compile mode)")
-    parser.add_argument("--base-url", help="Tenant API base URL recorded in the authoring file")
     parser.add_argument(
-        "--auth",
-        choices=("none", "bearer", "api_key", "oauth"),
-        help="Credential presentation; the authority over the spec's own security schemes",
+        "name",
+        nargs="?",
+        help="Connector name; required with --spec, defaults to the catalog's with --tool-defs",
     )
+    parser.add_argument("--base-url", help="Tenant API base URL recorded in the authoring file")
     parser.add_argument(
-        "--auth-env", help="Workspace secret environment reference for the credential"
-    )
-    parser.add_argument("--auth-header", help="Header name for API key credentials")
-    parser.add_argument(
-        "--provider-type",
-        help="Credential provider key registered in the project (with --auth oauth)",
+        "--auth",
+        choices=AUTH_CHOICES,
+        help="Credential to present instead of the one the document proposes",
     )
+    parser.add_argument("--provider", help="Project OAuth app whose token each call presents")
     parser.add_argument(
-        "--scopes", help="Comma-separated delegated OAuth scopes (with --auth oauth)"
+        "--scopes",
+        help="Comma-separated OAuth scopes (with --provider) instead of the document's",
     )
     parser.add_argument("--allow", help="Comma-separated operation allow list (default: allow_all)")
     parser.add_argument(
@@ -79,36 +77,11 @@ def _parser() -> argparse.ArgumentParser:
     return parser
 
 
-def _auth(args: argparse.Namespace) -> Auth | None:
-    """Build the credential presentation the flags select, or None to let the
-    spec's own security schemes govern. Flag-combination refusals live here;
-    the shared ``Auth`` model validates the values themselves."""
-    if args.auth != "oauth" and (args.provider_type is not None or args.scopes is not None):
-        raise GenerateError("--provider-type and --scopes require --auth oauth")
-    if args.auth == "oauth":
-        if args.auth_env or args.auth_header:
-            raise GenerateError("--auth oauth cannot take --auth-env or --auth-header")
-        if not args.provider_type:
-            raise GenerateError("--auth oauth requires --provider-type")
-        return Auth(type="oauth", provider_type=args.provider_type, scopes=_scopes(args.scopes))
-    if args.auth == "none":
-        if args.auth_env or args.auth_header:
-            raise GenerateError("--auth none cannot take --auth-env or --auth-header")
-        return Auth(type="none")
-    if args.auth is None:
-        if args.auth_env or args.auth_header:
-            raise GenerateError("--auth-env and --auth-header require --auth")
-        return None
-    if not args.auth_env:
-        raise GenerateError(f"--auth {args.auth} requires --auth-env")
-    return Auth(type=args.auth, env=args.auth_env, header=args.auth_header)
-
-
-def _scopes(raw: str | None) -> list[str]:
-    """Split ``--scopes``; omitted means no scopes. An empty entry is refused
-    rather than dropped, so a typo cannot silently narrow the grant."""
+def _scopes(raw: str | None) -> list[str] | None:
+    """Split ``--scopes``; omitted means the document's scopes. An empty entry
+    is refused rather than dropped, so a typo cannot silently narrow the grant."""
     if raw is None:
-        return []
+        return None
     scopes = [scope.strip() for scope in raw.split(",")]
     if not all(scopes):
         raise GenerateError("--scopes must not contain empty entries")
@@ -149,44 +122,40 @@ def main(argv: list[str] | None = None) -> int:
         return EXIT_OK if exc.code in (None, 0) else EXIT_FAILED
     skipped: tuple[str, ...] = ()
     try:
-        auth = _auth(args)
+        scopes = _scopes(args.scopes)
         allow = _allow(args.allow)
         if args.config is not None:
             if (
-                args.auth
-                or args.auth_env
-                or args.auth_header
-                or args.provider_type is not None
+                args.name is not None
+                or args.auth
+                or args.provider is not None
                 or args.scopes is not None
                 or args.allow is not None
                 or args.base_url
-                or args.name
                 or args.out_dir
             ):
                 raise GenerateError(
-                    "--config regeneration preserves the authored settings from "
-                    "tool.yaml and writes beside it; --auth, --auth-env, --auth-header, "
-                    "--provider-type, --scopes, --allow, --base-url, --name and --out-dir "
-                    "do not apply"
+                    "--config regeneration keeps the name and settings written in "
+                    "tool.yaml and writes beside it; a name, --auth, --provider, "
+                    "--scopes, --allow, --base-url and --out-dir do not apply"
                 )
             result = regenerate_catalog(args.config, skip_unsupported=args.skip_unsupported)
             written = [str(result.catalog)]
             skipped = result.skipped
         elif args.spec is not None:
             if not args.name:
-                raise GenerateError("--name is required with --spec")
+                raise GenerateError("a connector name is required with --spec")
             if not args.out_dir:
                 raise GenerateError("--out-dir is required with --spec")
-            # The consumer's --auth is the authority over the spec's own
-            # security-scheme definitions: the generator derives the catalog
-            # override from the credential the developer chose (e.g. the
-            # official Jira document declares basic; a DC PAT is Bearer).
-            # An explicit Auth(type="none") is the anonymous override.
+            # --auth and --provider override the document's own security (e.g.
+            # the official Jira document declares basic; a DC PAT is Bearer).
             result = compile_catalog(
                 args.spec,
                 name=args.name,
                 base_url=args.base_url,
-                auth=auth,
+                auth=args.auth,
+                provider=args.provider,
+                scopes=scopes,
                 allow=allow,
                 skip_unsupported=args.skip_unsupported,
                 out_dir=args.out_dir,
@@ -212,8 +181,11 @@ def main(argv: list[str] | None = None) -> int:
                 str(
                     scaffold_tool_yaml(
                         args.tool_defs,
+                        name=args.name,
                         base_url=args.base_url,
-                        auth=auth,
+                        auth=args.auth,
+                        provider=args.provider,
+                        scopes=scopes,
                         allow=allow,
                         out_dir=args.out_dir,
                     )