agent-harness 0.25.0 → 0.26.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 1afbed6f9dcafe6c80575c77a128ba73b407f4cd691bd45ce19bfa48b613ccb2
-  data.tar.gz: b158dd410320320093c897795839b20eedea35383784692c0038893dca163123
+  metadata.gz: d5561c80c0a4ccab10925503a30bb20be2c24c929caa58b9d69a4aac2eb27aac
+  data.tar.gz: aae45d0a30105fed84eb442bdbeaaea0c0bc2fc995997bec49bccbed61db4249
 SHA512:
-  metadata.gz: fb7e2eda150529ba550829380171bc432bbe5025de3ad8d7c5f5799354b8a4a1e6209a788ef2fbc9ca90898d24ee4b1769f4f693619d75d90bd47b2021edc12a
-  data.tar.gz: c55f52bf3498750daf7bc4919d1100705e8b5fcb1f8c540852022cd852a28988654cf84771cae0d3bdf08a9f8a7648e7a2514234b5fc06d70e6a54b159ce1ab6
+  metadata.gz: 00eb3ec6f37bbdda7bd430abf55eb09f4f6f79f86b565256c7b287cc2f0b9ef840f108b00a33ba84d457d689784772bb4d307191e08e0aae5941247739ceb651
+  data.tar.gz: 51efc497bd800e2d2ef31886ddeb65c502242dee45cfb40947d35f904f76e9ad215bf57520a779bd42a69e1b04759242c37c6b30a6b98b5a75707c759cd66e2a

data/.release-please-manifest.json

@@ -1,3 +1,3 @@
 {
-  ".": "0.25.0"
+  ".": "0.26.0"
 }

data/CHANGELOG.md

@@ -3,8 +3,16 @@
 ### Features
 
 * add runner model compatibility contract (`AgentHarness.model_compatibility`) with structured `ModelCompatibility::Result` outcomes. Codex exposes static facts for CLI-gated models (e.g. `gpt-5.5` requires Codex CLI `>= 0.116.0`), a baseline supported-model list, supported auth modes, and a `DEFAULT_COMPATIBLE_MODEL_ID` fallback so downstream orchestrators can validate tier/model assignments before scheduling agent runs ([#259](https://github.com/viamin/agent-harness/issues/259)).
+* **auth:** add provider-owned PKCE code-exchange API for Claude OAuth (`AgentHarness::Authentication.exchange_code`). Takes an authorization code plus PKCE verifier (and `redirect_uri`/`client_id`), posts an `authorization_code` grant to the Claude token endpoint, and persists the resulting access/refresh tokens in the native `claudeAiOauth` shape. Adds `exchange_code_supported?` and a `code_exchange` key to `auth_capabilities` ([#266](https://github.com/viamin/agent-harness/issues/266)).
 
 
+## [0.26.0](https://github.com/viamin/agent-harness/compare/agent-harness/v0.25.0...agent-harness/v0.26.0) (2026-06-26)
+
+
+### Features
+
+* **auth:** add PKCE code-exchange API for Claude OAuth ([#272](https://github.com/viamin/agent-harness/issues/272)) ([22f873b](https://github.com/viamin/agent-harness/commit/22f873bb5fe58c67ab94c2a7b0c57b3bcbfe38b9)), closes [#266](https://github.com/viamin/agent-harness/issues/266)
+
 ## [0.25.0](https://github.com/viamin/agent-harness/compare/agent-harness/v0.24.0...agent-harness/v0.25.0) (2026-06-26)
 
 

data/lib/agent_harness/authentication.rb

@@ -52,7 +52,8 @@ module AgentHarness
           auth_type: provider.auth_type,
           auth_url: flow_supported,
           refresh: flow_supported,
-          exchange: flow_supported
+          exchange: flow_supported,
+          code_exchange: flow_supported
         }
       end
 
@@ -172,8 +173,74 @@ module AgentHarness
         end
       end
 
+      # Check whether PKCE authorization-code exchange is supported for a provider.
+      #
+      # @param provider_name [Symbol] the provider name
+      # @return [Boolean] true if exchange_code can be called
+      # @raise [ProviderNotFoundError] if provider is unknown
+      def exchange_code_supported?(provider_name)
+        auth_capabilities(provider_name)[:code_exchange]
+      end
+
+      # Exchange a PKCE authorization code for tokens and persist them in native shape.
+      #
+      # Posts the authorization code and PKCE verifier to the provider's OAuth
+      # token endpoint, then writes the resulting access/refresh tokens to the
+      # credentials store using the provider's native shape (e.g. +claudeAiOauth+
+      # for Claude).
+      #
+      # Serializes through a file lock so that concurrent callers do not race on
+      # credential writes.
+      #
+      # @param provider_name [Symbol] the provider name
+      # @param code [String] authorization code returned from the OAuth redirect (required)
+      # @param code_verifier [String] PKCE code verifier matching the code_challenge sent on the auth URL (required)
+      # @param redirect_uri [String] redirect URI registered with the authorization request (required)
+      # @param client_id [String] OAuth client identifier (required)
+      # @param state [String, nil] optional state parameter echoed from the authorization request
+      # @return [Hash] credential in claudeAiOauth shape for Claude:
+      #   +{ claudeAiOauth: { accessToken:, refreshToken:, expiresAt: } }+
+      # @raise [UnsupportedAuthFlowError] if provider doesn't support PKCE code exchange
+      # @raise [ArgumentError] if any required parameter is blank
+      # @raise [AuthenticationError] if the exchange fails
+      def exchange_code(provider_name, code:, code_verifier:, redirect_uri:, client_id:, state: nil)
+        provider_name = provider_name.to_sym
+        provider = resolve_provider(provider_name)
+
+        unless provider.auth_type == :oauth
+          raise UnsupportedAuthFlowError,
+            "Provider #{provider_name} uses #{provider.auth_type} auth and does not support code exchange"
+        end
+
+        validate_code_exchange_params!(code: code, code_verifier: code_verifier,
+          redirect_uri: redirect_uri, client_id: client_id)
+
+        case provider_name
+        when :claude, :anthropic
+          exchange_claude_code(
+            code: code.strip,
+            code_verifier: code_verifier.strip,
+            redirect_uri: redirect_uri.strip,
+            client_id: client_id.strip,
+            state: state
+          )
+        else
+          raise UnsupportedAuthFlowError,
+            "Code exchange is not yet implemented for provider #{provider_name}"
+        end
+      end
+
       private
 
+      def validate_code_exchange_params!(code:, code_verifier:, redirect_uri:, client_id:)
+        {code: code, code_verifier: code_verifier,
+         redirect_uri: redirect_uri, client_id: client_id}.each do |name, value|
+          unless non_blank?(value)
+            raise ArgumentError, "#{name} must be a non-empty string"
+          end
+        end
+      end
+
       def claude_oauth_flow_provider?(requested_name, canonical_name)
         [:claude, :anthropic].include?(requested_name) || canonical_name == :claude
       end
@@ -356,6 +423,103 @@ module AgentHarness
         end
       end
 
+      def exchange_claude_code(code:, code_verifier:, redirect_uri:, client_id:, state:)
+        credentials_path = claude_credentials_path
+        lock_path = "#{credentials_path}.lock"
+
+        dir = File.dirname(credentials_path)
+        FileUtils.mkdir_p(dir, mode: 0o700)
+
+        File.open(lock_path, File::RDWR | File::CREAT, 0o600) do |lock|
+          lock.flock(File::LOCK_EX)
+
+          response_body = post_code_exchange(
+            code: code,
+            code_verifier: code_verifier,
+            redirect_uri: redirect_uri,
+            client_id: client_id,
+            state: state
+          )
+
+          access_token = response_body["access_token"]
+          new_refresh_token = response_body["refresh_token"]
+          expires_in = response_body["expires_in"]
+
+          unless non_blank?(access_token)
+            raise AuthenticationError.new(
+              "Code exchange response did not include an access_token",
+              provider: :claude
+            )
+          end
+
+          expires_at = expires_in ? (Time.now + expires_in).iso8601 : nil
+
+          oauth_block = {
+            "accessToken" => access_token,
+            "refreshToken" => new_refresh_token,
+            "expiresAt" => expires_at
+          }
+
+          credentials = read_claude_credentials
+          credentials = {} unless credentials.is_a?(Hash)
+          credentials["claudeAiOauth"] = oauth_block
+          credentials["oauth_token"] = access_token
+          credentials.delete("expires_at")
+          credentials["expiresAt"] = expires_at
+
+          tmpfile = Tempfile.new(".credentials", dir)
+          begin
+            tmpfile.write(JSON.pretty_generate(credentials))
+            tmpfile.close
+            File.chmod(0o600, tmpfile.path)
+            File.rename(tmpfile.path, credentials_path)
+          rescue
+            tmpfile.close!
+            raise
+          end
+
+          {claudeAiOauth: oauth_block.transform_keys(&:to_sym)}
+        end
+      end
+
+      def post_code_exchange(code:, code_verifier:, redirect_uri:, client_id:, state:)
+        payload = {
+          grant_type: "authorization_code",
+          code: code,
+          code_verifier: code_verifier,
+          redirect_uri: redirect_uri,
+          client_id: client_id
+        }
+        payload[:state] = state if non_blank?(state)
+
+        http = Net::HTTP.new(CLAUDE_TOKEN_ENDPOINT.host, CLAUDE_TOKEN_ENDPOINT.port)
+        http.use_ssl = true
+        http.open_timeout = 10
+        http.read_timeout = 10
+
+        request = Net::HTTP::Post.new(CLAUDE_TOKEN_ENDPOINT.path)
+        request["Content-Type"] = "application/json"
+        request.body = JSON.generate(payload)
+
+        response = http.request(request)
+
+        body = begin
+          JSON.parse(response.body)
+        rescue JSON::ParserError
+          {}
+        end
+
+        unless response.is_a?(Net::HTTPSuccess)
+          error_description = body["error_description"] || body["error"] || body["message"] || response.body
+          raise AuthenticationError.new(
+            "Code exchange failed (HTTP #{response.code}): #{error_description}",
+            provider: :claude
+          )
+        end
+
+        body
+      end
+
       def post_token_exchange(refresh_token)
         http = Net::HTTP.new(CLAUDE_TOKEN_ENDPOINT.host, CLAUDE_TOKEN_ENDPOINT.port)
         http.use_ssl = true

data/lib/agent_harness/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module AgentHarness
-  VERSION = "0.25.0"
+  VERSION = "0.26.0"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: agent-harness
 version: !ruby/object:Gem::Version
-  version: 0.25.0
+  version: 0.26.0
 platform: ruby
 authors:
 - Bart Agapinan