[donmasakayan]

Stacked on #2325 — review only the top commit (299660d)

Summary

Document the generic delegated credential contract, host settings, PAT naming, and rollout and rollback behavior. Add the release changeset and emulator-backed local browser/MCP acceptance while keeping one-time secret flows unrecorded and redacting recorded identity credentials at the browser boundary.

This targets v2 following the backlog invitation to resubmit, after the prior closed #1610/#1948.

Verification

All verification below was run locally from the final frozen stack; no public CI run is claimed.

• bun run format:check — 2,226 files, exit 0.
• bun run lint — 1,933 files, zero warnings or errors, including the changeset stub check.
• bun run typecheck — 45/45 tasks, exit 0.
• bun run test — 39/39 workspace tasks; 4,633 tests passed, 45 conditional skips, zero failures.
• e2e — local self-host scenarios delegated-credentials-a-member-key-keeps-an-approved-emulator-connection-scoped- and delegated-credentials-selfhost-issues-masks-and-revokes-a-local-key passed 2 applicable cases with issuance enabled; the default issuance-disabled case also passed. Local trace-redaction coverage passed 3/3, and the local browser/MCP acceptance artifacts include scoped emulator invocation and post-revocation denial checks. Recordings and traces are retained locally and are not publicly linked.

Live IdP and Cloudflare Access login flows were not exercised; coverage for those flows is limited to unit/integration tests.

Checklist

• Added a changeset (bun run changeset).
• Added or updated tests for the new behaviour.
• No secrets, credentials, or private data in the diff.

Stack

• #2322 — delegated credential lifecycle and private storage.
• #2323 — delegated scope enforcement across execution and sessions.
• #2324 — delegated credentials across hosted adapters.
• #2325 — delegated credential account controls.
• #2326 — delegated credential documentation and local rollout verification.

[RhysSullivan]

Thanks for the careful work on this stack (#2322 to #2326). It's built on v1's toolkits, hosts and auth adapters, which v2 replaces, and v1 main now only takes migration work. v2 covers the need with its own model: personal access tokens and scoped connections, which are named, revocable MCP URLs limited to chosen apps, accounts and tools (see connection.ts and the MCP docs). If something you need is still missing there, please open a new issue against v2.

Sent from my Claude