@agent-native/core 0.105.0 → 0.106.0

package/corpus/core/src/connections/catalog.ts

@@ -27,6 +27,8 @@ export type WorkspaceConnectionProviderId =
   | "gmail"
   | "google_drive"
   | "hubspot"
+  | "jira"
+  | "sentry"
   | "granola"
   | "clips"
   | "generic";
@@ -91,12 +93,18 @@ export const WORKSPACE_CONNECTION_PROVIDERS = [
     credentialKeys: [
       {
         key: "GITHUB_TOKEN",
-        label: "GitHub token",
+        label: "GitHub token (fallback)",
         description:
-          "Fine-grained token or app credential scoped to the repositories the workspace should access.",
-        required: true,
+          "Optional fine-grained token fallback. OAuth is preferred for new connections.",
+        required: false,
       },
     ],
+    oauth: {
+      provider: "github",
+      authorizationUrl: "https://github.com/login/oauth/authorize",
+      tokenUrl: "https://github.com/login/oauth/access_token",
+      scopes: ["repo", "read:org", "read:user", "user:email"],
+    },
     capabilities: ["search", "import", "code", "docs"],
     recommendedTemplateUses: ["brain", "analytics", "dispatch"],
   }),
@@ -199,15 +207,108 @@ export const WORKSPACE_CONNECTION_PROVIDERS = [
     credentialKeys: [
       {
         key: "HUBSPOT_PRIVATE_APP_TOKEN",
-        label: "HubSpot private app token",
+        label: "HubSpot private app token (fallback)",
         description:
-          "Private app token scoped to the CRM objects the workspace needs.",
-        required: true,
+          "Optional private app token fallback. OAuth is preferred for new connections.",
+        required: false,
+      },
+      {
+        key: "HUBSPOT_ACCESS_TOKEN",
+        label: "HubSpot access token (fallback)",
+        description:
+          "Optional legacy access token fallback for existing HubSpot setups.",
+        required: false,
       },
     ],
+    oauth: {
+      provider: "hubspot",
+      authorizationUrl: "https://app.hubspot.com/oauth/authorize",
+      tokenUrl: "https://api.hubapi.com/oauth/v3/token",
+      refreshUrl: "https://api.hubapi.com/oauth/v3/token",
+      scopes: [
+        "oauth",
+        "crm.objects.contacts.read",
+        "crm.objects.companies.read",
+        "crm.objects.deals.read",
+        "crm.objects.tickets.read",
+        "crm.schemas.contacts.read",
+        "crm.schemas.companies.read",
+        "crm.schemas.deals.read",
+        "crm.schemas.tickets.read",
+      ],
+    },
     capabilities: ["search", "import", "crm"],
     recommendedTemplateUses: ["analytics", "brain", "mail", "dispatch"],
   }),
+  defineWorkspaceConnectionProvider({
+    id: "jira",
+    label: "Jira Cloud",
+    description:
+      "Projects, issues, sprints, and delivery context for engineering analytics and product workflows.",
+    credentialKeys: [
+      {
+        key: "JIRA_BASE_URL",
+        label: "Jira base URL (fallback)",
+        description:
+          "Optional site URL for API-token fallback connections. OAuth connections discover their site automatically.",
+        required: false,
+      },
+      {
+        key: "JIRA_USER_EMAIL",
+        label: "Jira email (fallback)",
+        description:
+          "Optional Atlassian account email for API-token fallback connections.",
+        required: false,
+      },
+      {
+        key: "JIRA_API_TOKEN",
+        label: "Jira API token (fallback)",
+        description:
+          "Optional API token fallback for existing Jira Cloud setups. OAuth is preferred for new connections.",
+        required: false,
+      },
+    ],
+    oauth: {
+      provider: "jira",
+      authorizationUrl: "https://auth.atlassian.com/authorize",
+      tokenUrl: "https://auth.atlassian.com/oauth/token",
+      refreshUrl: "https://auth.atlassian.com/oauth/token",
+      scopes: ["read:jira-work", "read:jira-user", "offline_access"],
+    },
+    capabilities: ["search", "import", "code", "docs"],
+    recommendedTemplateUses: ["analytics", "brain", "dispatch"],
+  }),
+  defineWorkspaceConnectionProvider({
+    id: "sentry",
+    label: "Sentry",
+    description:
+      "Error tracking, performance issues, projects, and release context for engineering analytics.",
+    credentialKeys: [
+      {
+        key: "SENTRY_AUTH_TOKEN",
+        label: "Sentry auth token (fallback)",
+        description:
+          "Optional auth token fallback for self-hosted or local Sentry setups. OAuth is preferred for sentry.io.",
+        required: false,
+      },
+      {
+        key: "SENTRY_SERVER_TOKEN",
+        label: "Sentry server token (fallback)",
+        description:
+          "Optional server token fallback for existing Sentry deployments.",
+        required: false,
+      },
+    ],
+    oauth: {
+      provider: "sentry",
+      authorizationUrl: "https://sentry.io/oauth/authorize/",
+      tokenUrl: "https://sentry.io/oauth/token/",
+      refreshUrl: "https://sentry.io/oauth/token/",
+      scopes: ["org:read", "project:read", "event:read", "team:read"],
+    },
+    capabilities: ["search", "import", "docs"],
+    recommendedTemplateUses: ["analytics", "brain", "dispatch"],
+  }),
   defineWorkspaceConnectionProvider({
     id: "granola",
     label: "Granola",

package/corpus/core/src/localization/default-messages.ts

@@ -690,6 +690,7 @@ const messages = {
     connected: "Connected",
     configure: "Configure",
     connect: "Connect",
+    connectWithOAuth: "Connect with OAuth",
     backToIntegrations: "Back to integrations",
     customTitle: "Add custom MCP server",
     configureTitle: "Configure {{name}}",
@@ -705,6 +706,7 @@ const messages = {
     organization: "Organization",
     orgNoOrg: "Join an organization to share MCP servers",
     orgAdminOnly: "Only owners and admins can add org-scope servers",
+    serverNameRequired: "Enter a server name before connecting with OAuth.",
     serverName: "Server name",
     url: "URL",
     fieldDescription: "Description",

package/corpus/core/src/mcp/actions/call-mcp-tool.ts

@@ -0,0 +1,18 @@
+import { z } from "zod";
+
+import { defineAction } from "../../action.js";
+import { callMcpTool } from "../../mcp-client/app-api.js";
+
+export default defineAction({
+  description:
+    "Call an MCP tool visible to the authenticated app request by server id and original tool name. Server credentials and tokens are never exposed.",
+  agentTool: false,
+  requiresAuth: true,
+  schema: z.object({
+    serverId: z.string().trim().min(1),
+    toolName: z.string().trim().min(1),
+    arguments: z.record(z.string(), z.unknown()).default({}),
+  }),
+  run: ({ serverId, toolName, arguments: args }) =>
+    callMcpTool(serverId, toolName, args),
+});

package/corpus/core/src/mcp/actions/list-mcp-tools.ts

@@ -0,0 +1,18 @@
+import { z } from "zod";
+
+import { defineAction } from "../../action.js";
+import { listVisibleMcpTools } from "../../mcp-client/app-api.js";
+
+export default defineAction({
+  description:
+    "List MCP tools visible to the authenticated app request. Returns tool contracts only; server credentials and tokens are never exposed.",
+  agentTool: false,
+  requiresAuth: true,
+  schema: z.object({
+    serverId: z.string().trim().min(1).optional(),
+  }),
+  http: { method: "GET" },
+  readOnly: true,
+  parallelSafe: true,
+  run: ({ serverId }) => listVisibleMcpTools({ serverId }),
+});

package/corpus/core/src/mcp-client/app-api.ts

@@ -0,0 +1,136 @@
+import { isToolVisibilityModelOnly } from "@modelcontextprotocol/ext-apps/app-bridge";
+
+import { getGlobalMcpManager } from "../server/agent-chat/mcp-glue.js";
+import { getRequestContext } from "../server/request-context.js";
+import {
+  buildMcpToolName,
+  type McpClientManager,
+  type McpTool,
+} from "./manager.js";
+import { parseMergedKey } from "./remote-store.js";
+import { isMcpToolAllowedForRequest } from "./visibility.js";
+
+export interface AppMcpTool {
+  /** Configured MCP server id. */
+  serverId: string;
+  /** Original, unprefixed name reported by the MCP server. */
+  name: string;
+  title?: string;
+  description: string;
+  inputSchema: Record<string, unknown>;
+  outputSchema?: Record<string, unknown>;
+  annotations?: Record<string, unknown>;
+  _meta?: Record<string, unknown>;
+}
+
+export interface ListVisibleMcpToolsOptions {
+  /** Restrict the result to one configured server. */
+  serverId?: string;
+}
+
+export class McpAppApiError extends Error {
+  readonly statusCode: 401 | 403 | 503;
+
+  constructor(message: string, statusCode: 401 | 403 | 503) {
+    super(message);
+    this.name = "McpAppApiError";
+    this.statusCode = statusCode;
+  }
+}
+
+/**
+ * List MCP tools that the authenticated request may expose to an app.
+ *
+ * The manager owns connection state and credentials; this API deliberately
+ * projects only the tool contract and never returns server configuration.
+ */
+export async function listVisibleMcpTools(
+  options: ListVisibleMcpToolsOptions = {},
+): Promise<AppMcpTool[]> {
+  const context = requireAuthenticatedRequest();
+  const manager = requireMcpManager();
+  const tools = options.serverId
+    ? manager.getToolsForServer(options.serverId)
+    : manager.getTools();
+
+  return tools
+    .filter((tool) => isToolVisibleToApp(tool, context))
+    .map(toAppMcpTool);
+}
+
+/**
+ * Call an app-visible MCP tool by server id and its original server-reported
+ * name. The prefixed manager name is built only after the tool is found in
+ * that server's current, request-visible tool list.
+ */
+export async function callMcpTool(
+  serverId: string,
+  originalToolName: string,
+  args: Record<string, unknown> = {},
+): Promise<unknown> {
+  const context = requireAuthenticatedRequest();
+  const manager = requireMcpManager();
+  const tool = manager
+    .getToolsForServer(serverId)
+    .find((candidate) => candidate.originalName === originalToolName);
+
+  if (!tool || !isToolVisibleToApp(tool, context)) {
+    throw new McpAppApiError(
+      "MCP tool is not available in this request scope.",
+      403,
+    );
+  }
+
+  return manager.callTool(buildMcpToolName(serverId, originalToolName), args);
+}
+
+function requireAuthenticatedRequest() {
+  const context = getRequestContext();
+  if (!context?.userEmail?.trim()) {
+    throw new McpAppApiError("Authentication required.", 401);
+  }
+  return context;
+}
+
+function requireMcpManager(): McpClientManager {
+  const manager = getGlobalMcpManager();
+  if (!manager) {
+    throw new McpAppApiError("MCP client is not configured.", 503);
+  }
+  return manager;
+}
+
+function isToolVisibleToApp(
+  tool: McpTool,
+  context: ReturnType<typeof getRequestContext>,
+): boolean {
+  if (!context) return false;
+
+  // `isMcpToolAllowedForRequest` intentionally permits missing identity in
+  // development for CLI/startup enumeration. App calls are stricter: an
+  // active org-scoped tool requires an active org even in development.
+  if (!isMcpToolAllowedForRequest(tool.name)) return false;
+  const merged = parseMergedKey(tool.name);
+  if (merged?.scope === "user" && !context.userEmail?.trim()) return false;
+  if (merged?.scope === "org" && !context.orgId?.trim()) return false;
+
+  try {
+    // A malformed visibility declaration is not safe to expose to an app.
+    return !isToolVisibilityModelOnly(tool.raw as any);
+  } catch {
+    return false;
+  }
+}
+
+function toAppMcpTool(tool: McpTool): AppMcpTool {
+  return {
+    serverId: tool.source,
+    name: tool.originalName,
+    ...(tool.title ? { title: tool.title } : {}),
+    description: tool.description,
+    inputSchema: tool.inputSchema,
+    ...(tool.outputSchema ? { outputSchema: tool.outputSchema } : {}),
+    ...(tool.annotations ? { annotations: tool.annotations } : {}),
+    ...(tool._meta ? { _meta: tool._meta } : {}),
+  };
+}

package/corpus/core/src/mcp-client/index.ts

@@ -24,6 +24,7 @@ export {
 export {
   listRemoteServers,
   addRemoteServer,
+  addOAuthRemoteServer,
   addFirstPartyRemoteServer,
   isFirstPartyRemoteEndpointTrusted,
   removeRemoteServer,
@@ -39,6 +40,19 @@ export {
   type StoredRemoteMcpServer,
 } from "./remote-store.js";
 
+export {
+  finishMcpOAuthAuthorization,
+  getMcpOAuthAccessToken,
+  readMcpOAuthCredentials,
+  saveMcpOAuthCredentials,
+  startMcpOAuthAuthorization,
+  type McpOAuthCallbackResult,
+  type McpOAuthCredentialBundle,
+  type McpOAuthDiscoveryState,
+  type McpOAuthProviderOptions,
+  type McpOAuthStartResult,
+} from "./oauth-client.js";
+
 export {
   areBuiltinMcpCapabilitiesSupported,
   BUILTIN_MCP_CAPABILITIES,
@@ -80,6 +94,13 @@ export {
 export { fetchHubServers } from "./hub-client.js";
 
 export { isMcpToolAllowedForRequest } from "./visibility.js";
+export {
+  callMcpTool,
+  listVisibleMcpTools,
+  McpAppApiError,
+  type AppMcpTool,
+  type ListVisibleMcpToolsOptions,
+} from "./app-api.js";
 import { isMcpToolAllowedForRequest } from "./visibility.js";
 export {
   classifyMcpToolCall,