[saucam]

Stacked on #461 (W0). Review that first; this one retargets to main once it merges.

What changes for a user

W1 makes a session's workstream decide what it is given. This is phase 2 of 5 (design). Nothing changes until you configure it, and the server isolation stays off until you set workstreams.isolateGlobalServers: true.

• Named credentials. credentials[] declares a credential's id and kind (bearer, header, env, oauth), never its value. Values live in a pluggable secret store:
  • env-file (the default) reads CODEOID_CRED_<ID> from the daemon's environment or ~/.codeoid/.env;
  • dir reads one file per id, for example a mounted Kubernetes Secret or a Vault sink.
    Every reference is checked when the config loads.
• A workstream's env and git identity reach its sessions' backend: for example GH_TOKEN from a credential, and commits as bot@acme.example.
• MCP isolation (isolateGlobalServers: true). A session reaches built-ins, the servers its workstream names, and its folder's own servers only when the folder belongs to that workstream. A server can be shared across workstreams, with the same or a separate credential each.
  • Claude runs with a strict MCP config: nothing from ~/.claude.json, a .mcp.json, plugins or agents. Every HTTP server is called by the daemon through a bridge. A stdio server that needs no secret is still run by the CLI, inside the sandbox as before.
  • Codex has every server its own configs declare turned off, and its apps and plugins off.
  • Gemini CLI and Qwen are started with only codeoid's server names allowed.
  • opencode turns are refused under isolation for now.
  • No secret on any backend. No backend holds a credential, whether in a header, an env value, a URL or a command line. Servers that need one go through the daemon's relay, or are withheld, and the session is told.
  • Mid-turn revocation. A server removed from a workstream fails on the next call, mid-turn.
• A second OAuth sign-in to one server, one per workstream (codeoid mcp signin <server> --credential <id>). This is how two Slack workspaces stay apart.
• Confirmed overrides. Choosing a workstream for a folder another workstream holds exclusively shows what would change. codeoid new asks before going ahead, or --override confirms. The token is single use, bound to the request, needs session:approve, and is audited.
• The folder record. If a repository's origin later matches another workstream, the next session there must choose. An agent editing .git/config can't silently re-home a folder.
• codeoid workstream import proposes workstreams from your repositories' remotes and lists your global servers to assign. It writes nothing.

Decisions for reviewers

• The daemon holds every workstream secret (G1). Backends get references, proxies and bridges. A credential's value is read per request (upstreamFetch), so it never lands in a spec, a settings view, argv or a transcript.
• No backend can be kept to codeoid's servers? Then it is refused, not trusted. This is opencode for now. Codex fails to start rather than run with a server it can't name.
• A server config can't name ${CODEOID_CRED_*}. One workstream's secret must not reach a server of another. The rule is deliberately narrow: your own CODEOID_* variables keep working.
• mcp_oauth_credentials gains a credential slot in its primary key. The table is rebuilt once, in one transaction, and existing rows become the default slot.
• Not isolated, nothing changes. The relay reaches exactly what it did. There's no strict mode, no new arguments, and the bridges stay as they were.
• Deferred (design §15): skillDirs (accepted but not applied, with a warning), workstream env on opencode, and MCP prompts and resources through Claude's bridge.

Audit

Two rounds, each with a security lane and a correctness lane. Every fix is folded in with a regression test.

• Round 1:
  • Codex, the Gemini CLI and Qwen loaded their own MCP configs under isolation.
  • A .mcp.json could read any workstream's credential via ${CODEOID_CRED_*}.
  • A token in a URL or in stdio args counted as secret-free.
  • The folder record stored the chosen home and poisoned later creates.
  • A delegated token could edit an origin and then choose.
  • The relay kept a stale credential.
  • A slot sign-in left that slot's hub client connected.
  • Claude under isolation would have run a repository's stdio server on the host.
• Round 2:
  • Codex plugins still brought servers. Plugins are now off.
  • Rejecting a changed origin still recorded the new match.
  • A symlinked Codex config.toml (every account overlay) failed isolation.
  • Codex merged a same-named user entry's headers into codeoid's server.
  • The daemon-variable rule was too broad.

Verified

• Unit: credentials and the secret store, the isolation view, credential references, per-call refusal, Claude strict and bridges, the relay with the session's view, grantFor, Codex isolation, overrides, the folder record, OAuth slots and the slot migration, env reaching the backend, the opencode refusal.
• Measured against real Codex 0.166: disabling servers by name, placeholder transports, merge semantics, features.plugins.
• Full daemon suite: 6,092 pass. The 1 failure (inside real bubblewrap > conversations are the session's own) fails identically on main on this machine.
• e2e: 19 passed, including the new journey: no home under isolation is refused, an override is confirmed with --override, and credentials show by name only.
• Typecheck (daemon, protocol, core, e2e, web) and lint are clean.

For agents

• src/daemon/credentials/: schema.ts (credentialDeclSchema, secretStoreSchema, credentialProblems run from RootSchema.superRefine), store.ts (SecretStore, EnvFileSecretStore, DirSecretStore, credentialEnvName).
• workstreams/grant.ts (McpGrant, grantRefusal), service.ts (grantFor, envFor, #overrideChanges, forCreate(..., required, overridden)), override.ts (OverrideTokens), import.ts (proposeWorkstreams).
• mcp/session-view.ts: grant option, applyGrant, isolated, relayFor, withheldFromNative, secretFree (URL and args too); registry.ts McpServerView.relayFor/isolated.
• mcp/types.ts: McpHttpTransport.credential (a reference), isDaemonOwnedEnvName (CODEOID_CRED_); upstream.ts (secrets lookup, McpCredentialMissing); hub.ts (secrets, setPermit, dropTenant with variants); proxy.ts (McpProxyBinding.view, Relay.variant, credential-ref relays); oauth.ts (slotOf, withSlot, slot-aware keyOf, pending slot).
• store.ts: mcp_oauth_credentials.credential (rebuild migration), workstream_folders.
• Providers: Claude strictMcpConfig + HTTP bridges (oauth-bridge.ts), stdioOnly; codex isolation.ts (codexIsolationArgs, placeholders, plugins/apps off); acp --allowed-mcp-server-names / qwen allowedMcpServerNames via allowedMcpNames; opencode refused in Session#sendInner.
• Session: workstreamEnv (merged under extraEnv; GIT_IDENTITY_ENV), mcpGrant, #noteWithheldServers.
• SessionManager#create: override redeem, workstream_required, the folder record (folderMatch, written after create, only when the match is accepted, never delegated).

🤖 Generated with Claude Code

[saucam]

pr-shepherd: stopped at iteration 1 (test failure, nothing pushed)

• Failing: daemon-check. 1 of 6239 tests fails: src/daemon/providers/codex/isolation.test.ts:43, "codex under workstream isolation > fails closed: a name it can't write as a key, invalid TOML, or one server declared as both kinds".
• Passing: web-check, e2e, Socket Security (both).
• Not one of the known main failures. This test is new in this PR.
• Cause: CI runs Bun 1.3.13 (from .bun-version). On that version Bun.TOML.parse("[mcp_servers.x\n") returns {"mcp_servers":{"x":{}}} instead of throwing. Bun 1.4.4 throws, so the test passes locally. The fixture isn't invalid TOML for the pinned runtime. The codex config is then treated as declaring server x (it gets disabled) and no fail-closed error is raised.
• Why I stopped: this is a test failure, and fixing it is a judgment call. One option is a fixture that 1.3.13 also rejects. Another is to bump .bun-version. A third is to decide whether the fail-closed guarantee needs a stricter check than Bun.TOML.parse on 1.3.x.

[saucam]

CI is green after one follow-up commit (770753e6). The pinned Bun 1.3.13 parses an unclosed TOML table header such as [mcp_servers.x as a table, where 1.4 refuses it. So on our runtime, a malformed codex config would have started codex instead of being refused. Codex isolation now checks the config's table headers itself (tomlStructureProblem) before it parses. The full unit suite at the top of the stack also passes under 1.3.13.