日本語

Tracking: parent #154, under #149. Sub-issues: Issue #165: Contract and request lifecycle, Issue #166: Question cards and scoped permissions, Issue #167: MCP elicitation and authentication recovery, Issue #168: Gateway OAuth and integrated verification.

The extension currently uses Worker contract v19. Start from v19 and allocate the next available version when implementation merges (v20 if no intervening change). Keep the CLI 0.159.1 target, CLI 0.155.1 regression comparison, and current SDK/runtime/package versions.

• Secret-marked requests are refused with a reason before UI projection because there is no isolated safe input route.
• The native user-verification success path is deferred: CLI 0.159.1 is macOS-only for this provider, and this extension client is not upstream-eligible. The implementation rejects requests and declares no capability.
• Local stdio supports Gateway OAuth only after the per-connection read gate. Remote Gateway OAuth is read-only status/guidance.
• MCP UI cancellation does not claim to cancel server authentication. Failed tool calls are never automatically replayed.
• Issue #153 owns bounded attachment metadata recovery; Issue #155 owns attachment actions and presentation. Phase 5 adds no attachment behavior.

Use typed request/response DTOs for questions, permissions, command approvals, MCP elicitation, Gateway OAuth, and unsupported verification. A common registry retains request kind, owner, generation, and original JSON-RPC ID; MCP requests may have no turn ID. Validate before atomic completion. Answer, cancel, timeout, disconnect, resolution, duplicate action, and retired-generation races produce at most one response. Never answer stale/resolved requests or retry uncertain response delivery.

Show concurrent question cards independently of the regular composer. Support blocking/non-blocking questions, free text, and “Other”. Require explicit Submit; selection, default, and focus are display state. Sanitize display text and resolve opaque choice IDs inside the Worker.

Return only requested permission subsets. Turn scope is the default; session persistence is explicit. Reject out-of-request permissions. Show every server command-approval option and permission change; keep rule-changing choices distinct and apply the existing approval policy to destructive actions.

Support string, number, integer, boolean, single-choice, and multi-choice form fields. Validate required/type/length/range/format/choice count in UI and Worker. Refuse unsupported extension schemas without advertising extended-form capability. Validate URLs in Worker and open a browser only after explicit user action.

Integrate mcpServer/oauth/login, mcpServer/oauthLogin/completed, and startup-status notifications. Expiry, revocation, and reauthenticationRequired show guidance and retire stale elicitation. Require a new explicit tool invocation after reauthentication. Do not automatically retry the failed invocation.

For each local stdio connection, advertise explicitGatewayOauth; after initialize, successfully call account/gatewayOAuth/read before any authentication-required RPC. Then support login/cancel/changed notifications and explicit browser launch. Bind notifications to connection and owner; a pending login must not block unrelated RPCs. If unsupported or the read fails, stop authenticated RPCs and do not fall back to automatic browser login.

For remote profiles, expose status and sign-in guidance only. Do not declare the capability or call login/cancel.

Do not advertise or forward native user verification. Reject requests with a visible reason and prevent challenge/proof/credential material from entering UI, transcript, logs, settings, diagnostics, or exceptions.

Test multiple cards and composer independence; explicit Submit; secret refusal before projection; each one-response race; exact permission subset and scope; all command choices; supported/unsupported MCP forms; browser and reauthentication outcomes; zero tool replay; Gateway startup order, notification races, cancel/reconnect, and remote read-only behavior; and user-verification refusal/non-disclosure.

Run Fake App Server and fixed 0.159.1 contract coverage, all Core/UI tests, warning-free Debug/Release builds, VSIX and embedded-XAML inspection. In Experimental Instance verify Light/Dark/High Contrast, narrow width, keyboard/screen reader, multiple question cards, and authentication states. Record screenshots and results; unavailable screenshots remain incomplete.