@moretea-labs/forge 1.5.0-rc.1

package/src/cli/mcp/multi-repository.ts

@@ -0,0 +1,423 @@
+import { loadMcpLocalConfig, loadMcpServiceLocalConfig } from './auth';
+import { getMcpPolicy, parseMcpProfile } from './policy';
+import { buildMcpToolDefinitions, callMcpTool, type CallToolResult, type McpToolContext, type McpToolDefinition } from './tools';
+import { DEFAULT_AGENT_TIMEOUT_MS, MAX_AGENT_TIMEOUT_MS, normalizeAgentTimeoutMs } from '../controller/runtime-config';
+import type { McpAgentRunnerName, McpToolset } from './types';
+import { configuredControllerToolset } from './toolset-selection';
+import { realpathSync } from 'fs';
+import { resolve } from 'path';
+import { ensureRepoPreferredControllerHome } from '../repositories/controller-home';
+import { bindRepositoryEntities } from '../repositories/entity-migration';
+import { withControllerLockAsync } from '../repositories/locks';
+import { listRepositories, registerRepository, repositorySummary, resolveRepositorySelection, selectRepositoryCheckout } from '../repositories/registry';
+import { ensureRepositoryRuntimeStorage, type RepositoryRuntimeStorageReport } from '../repositories/runtime-storage';
+import type { RepositoryRecord } from '../repositories/types';
+import {
+  compactErrorMessage,
+  compactRepositoryRef,
+  compactRuntimeStorageRef,
+  RESPONSE_BUDGET,
+} from '../../runtime/shared/response-budget';
+
+export interface McpServerOptions {
+  repo?: string;
+  controllerHome?: string;
+  profile?: string;
+  enableChatgptBrowser?: boolean;
+  enableDevRunner?: boolean;
+  devRunnerAgents?: string;
+  devRunnerTimeoutMs?: number;
+  devRunnerMaxTimeoutMs?: number;
+  toolset?: McpToolset | string;
+  sessionId?: string;
+  principalId?: string;
+  controllerInstanceId?: string;
+  /** Canonical Runtime source authority. Internal Runtime MCP only; never an execution repository. */
+  runtimeSourceRoot?: string;
+}
+
+export interface MultiRepositoryMcpToolContext extends McpToolContext {
+  controllerHome: string;
+  explicitRepository?: RepositoryRecord;
+  toolset: McpToolset;
+  toolsetLocked: boolean;
+  runtimeSourceRoot?: string;
+}
+
+type ToolResult = CallToolResult;
+
+const EXECUTION_STORAGE_TOOLS = new Set([
+  'dispatch_task',
+  'launch_issue',
+  'dispatch_ready_tasks',
+  'retry_task_run',
+  'integrate_task_run',
+  'begin_edit_session',
+  'apply_edit_operations',
+  'create_edit_savepoint',
+  'rollback_edit_session',
+  'finalize_edit_session',
+  'finish_edit_session',
+  'verify_edit_session',
+  'submit_local_bridge_job',
+  'execute_local_bridge_job',
+]);
+
+const REPOSITORY_LOCKED_TOOLS = new Set([
+  ...EXECUTION_STORAGE_TOOLS,
+  'create_issue',
+  'update_issue',
+  'plan_issue',
+  'append_task',
+  'split_task',
+  'supersede_task',
+  'set_task_dependencies',
+  'update_task',
+  'record_task_verification',
+  'accept_verified_task',
+  'publish_issue_to_github',
+  'refresh_github_issue',
+  'close_github_issue',
+  'configure_github_plugin',
+]);
+
+
+export function parseMcpToolset(value: unknown, profile: string): McpToolset {
+  if (profile !== 'controller') return 'full';
+  const normalized = typeof value === 'string' ? value.trim().toLowerCase() : '';
+  if (!normalized) return 'advanced';
+  if (normalized === 'core' || normalized === 'advanced' || normalized === 'full') return normalized;
+  throw new Error(`invalid MCP toolset "${String(value)}" (expected: core, advanced, or full)`);
+}
+
+function repositoryForExplicitPath(path: string, controllerHome: string): RepositoryRecord | undefined {
+  const selectedPath = (() => {
+    try { return realpathSync(path); } catch { return resolve(path); }
+  })();
+  for (const repository of listRepositories(controllerHome, { includeRemoved: true })) {
+    const checkout = repository.checkouts.find((candidate) => {
+      const candidatePath = (() => {
+        try { return realpathSync(candidate.canonicalRoot); } catch { return resolve(candidate.canonicalRoot); }
+      })();
+      return candidatePath === selectedPath && candidate.lifecycle !== 'removed';
+    });
+    if (checkout) return selectRepositoryCheckout(repository, checkout.checkoutId);
+  }
+  return undefined;
+}
+
+function parseBooleanSetting(value: string | undefined): boolean | undefined {
+  if (value === undefined) return undefined;
+  const normalized = value.trim().toLowerCase();
+  if (['1', 'true', 'yes', 'on'].includes(normalized)) return true;
+  if (['0', 'false', 'no', 'off'].includes(normalized)) return false;
+  return undefined;
+}
+
+function parseAgentList(value: unknown): McpAgentRunnerName[] {
+  const raw = Array.isArray(value) ? value : typeof value === 'string' ? value.split(',') : [];
+  return Array.from(new Set(raw
+    .map((entry) => String(entry).trim().toLowerCase())
+    .filter((entry): entry is McpAgentRunnerName => entry === 'codex' || entry === 'claude')));
+}
+
+export function runtimePolicy(repoRoot: string, opts: McpServerOptions) {
+  const profile = parseMcpProfile(opts.profile ?? 'controller');
+  const config = profile === 'controller' && opts.controllerHome
+    ? loadMcpServiceLocalConfig(opts.controllerHome, repoRoot)
+    : loadMcpLocalConfig(repoRoot);
+  const envDevRunner = parseBooleanSetting(process.env.FORGE_MCP_DEV_RUNNER);
+  const configuredDevRunner = envDevRunner ?? config?.devMode?.agentRunner === true;
+  const devAgentRunner = opts.enableDevRunner === true || configuredDevRunner;
+  const allowedAgents = parseAgentList(
+    opts.devRunnerAgents ?? process.env.FORGE_MCP_DEV_RUNNER_AGENTS ?? config?.devMode?.allowedAgents,
+  );
+  const runnerMaxTimeoutMs = normalizeAgentTimeoutMs(
+    opts.devRunnerMaxTimeoutMs ?? process.env.FORGE_MCP_DEV_RUNNER_MAX_TIMEOUT_MS ?? config?.devMode?.maxTimeoutMs,
+    { defaultMs: MAX_AGENT_TIMEOUT_MS, maxMs: MAX_AGENT_TIMEOUT_MS, label: 'dev runner max timeout' },
+  );
+  const runnerTimeoutMs = normalizeAgentTimeoutMs(
+    opts.devRunnerTimeoutMs ?? process.env.FORGE_MCP_DEV_RUNNER_TIMEOUT_MS ?? config?.devMode?.timeoutMs,
+    { defaultMs: DEFAULT_AGENT_TIMEOUT_MS, maxMs: runnerMaxTimeoutMs, label: 'dev runner timeout' },
+  );
+  return getMcpPolicy(profile, {
+    devAgentRunner,
+    allowedAgents,
+    runnerTimeoutMs,
+    runnerMaxTimeoutMs,
+    repoRoot,
+  });
+}
+
+function injectRepositoryContext(tool: McpToolDefinition): McpToolDefinition {
+  const schema = tool.inputSchema as {
+    type?: unknown;
+    properties?: Record<string, unknown>;
+    [key: string]: unknown;
+  };
+  if (schema.type !== 'object') return tool;
+  return {
+    ...tool,
+    inputSchema: {
+      ...schema,
+      properties: {
+        repo_id: {
+          type: 'string',
+          description: 'Stable repoId. Required when more than one repository is enabled.',
+        },
+        checkout_id: {
+          type: 'string',
+          description: 'Checkout identity for repositories with multiple local clones.',
+        },
+        ...(schema.properties ?? {}),
+      },
+    },
+  };
+}
+
+export function buildMultiRepositoryToolDefinitions(
+  ctx: MultiRepositoryMcpToolContext,
+): McpToolDefinition[] {
+  return buildMcpToolDefinitions(ctx.policy, {
+    enableChatgptBrowser: ctx.enableChatgptBrowser === true,
+  }).map(injectRepositoryContext);
+}
+
+function errorResult(error: unknown): ToolResult {
+  const message = compactErrorMessage(error);
+  const code = message.includes(':') ? message.slice(0, message.indexOf(':')) : 'TOOL_FAILED';
+  const value = {
+    error: {
+      code,
+      message,
+      retryable: /(?:^|_)(?:502|503|429|ECONNRESET|ETIMEDOUT|EAI_AGAIN)|server_busy|session_capacity|gateway.*unavailable|transient/i.test(message),
+    },
+  };
+  return {
+    content: [{ type: 'text', text: JSON.stringify(value) }],
+    structuredContent: value,
+    isError: true,
+  };
+}
+
+function compactEnvelopePayload(
+  repository: RepositoryRecord,
+  runtimeStorage: RepositoryRuntimeStorageReport,
+): { repoId: string; repository: Record<string, unknown>; runtimeStorage: Record<string, unknown> } {
+  const summary = repositorySummary(repository);
+  return {
+    repoId: repository.repoId,
+    repository: compactRepositoryRef({
+      repoId: summary.repoId,
+      checkoutId: summary.checkoutId,
+      displayName: summary.displayName,
+      defaultBranch: summary.defaultBranch,
+    }),
+    runtimeStorage: compactRuntimeStorageRef({
+      readyForExecution: runtimeStorage.readyForExecution,
+      usesStableRoot: runtimeStorage.usesStableRoot,
+      warningCount: runtimeStorage.warnings.length,
+      warnings: runtimeStorage.warnings,
+    }),
+  };
+}
+
+function withRepositoryEnvelope(
+  result: ToolResult,
+  repository: RepositoryRecord,
+  runtimeStorage: RepositoryRuntimeStorageReport,
+): ToolResult {
+  const envelope = compactEnvelopePayload(repository, runtimeStorage);
+  if (result.structuredContent && typeof result.structuredContent === 'object' && !Array.isArray(result.structuredContent)) {
+    const existing = result.structuredContent as Record<string, unknown>;
+    const omitHeavyEnvelope = existing.omitEnvelope === true
+      || existing.mode === 'process_direct'
+      || existing.route === 'process_direct'
+      || (existing.detailLevel === 'summary' && existing.endpointConfigured !== undefined)
+      || existing.localBridgeSummary === true;
+    // Compact fast-path / status summaries: keep repoId only (no repository/runtimeStorage dump).
+    if (omitHeavyEnvelope) {
+      const { omitEnvelope: _omit, localBridgeSummary: _summary, ...rest } = existing;
+      const structuredContent: Record<string, unknown> = {
+        ...rest,
+        repoId: typeof rest.repoId === 'string' ? rest.repoId : envelope.repoId,
+      };
+      return {
+        ...result,
+        structuredContent,
+        content: [{ type: 'text', text: JSON.stringify(structuredContent) }],
+      };
+    }
+    // Avoid re-nesting full repository/runtimeStorage when the tool already
+    // returned a compact or authoritative payload for those keys.
+    const structuredContent: Record<string, unknown> = {
+      ...existing,
+      repoId: typeof existing.repoId === 'string' ? existing.repoId : envelope.repoId,
+      repository: existing.repository && typeof existing.repository === 'object'
+        ? existing.repository
+        : envelope.repository,
+      runtimeStorage: existing.runtimeStorage && typeof existing.runtimeStorage === 'object'
+        ? existing.runtimeStorage
+        : envelope.runtimeStorage,
+    };
+    // Prefer compact JSON without pretty-print bloat for default responses.
+    let text = JSON.stringify(structuredContent);
+    if (Buffer.byteLength(text, 'utf8') > RESPONSE_BUDGET.successBytes && result.isError !== true) {
+      // Keep structuredContent authoritative; only shrink the text channel when oversized.
+      text = JSON.stringify({
+        repoId: structuredContent.repoId,
+        summary: typeof structuredContent.summary === 'string' ? structuredContent.summary : undefined,
+        status: structuredContent.status ?? structuredContent.phase,
+        jobId: structuredContent.jobId,
+        next: structuredContent.next,
+        truncatedTextChannel: true,
+        message: 'Text channel truncated to response budget; use structuredContent or detail APIs.',
+      });
+    }
+    return {
+      ...result,
+      structuredContent,
+      content: [{ type: 'text', text }],
+    };
+  }
+  return {
+    ...result,
+    content: [
+      ...result.content,
+      { type: 'text', text: JSON.stringify(envelope) },
+    ],
+  };
+}
+
+export function repositoryScopedToolArgs(
+  name: string,
+  input: Record<string, unknown>,
+  repository: RepositoryRecord,
+): Record<string, unknown> {
+  // Preserve resolved repository/checkout identity for every downstream call.
+  // Deleting these fields forced re-resolution and allowed silent route drift.
+  const args: Record<string, unknown> = {
+    ...input,
+    repo_id: repository.repoId,
+    checkout_id: repository.activeCheckoutId,
+  };
+
+  const github = repository.github;
+  const githubRepo = github ? `${github.owner}/${github.repo}` : undefined;
+  if (githubRepo && ['github_status', 'publish_issue_to_github'].includes(name) && args.repo === undefined) {
+    args.repo = githubRepo;
+  }
+  if (githubRepo && ['dispatch_task', 'launch_issue', 'dispatch_ready_tasks'].includes(name) && args.github_repo === undefined) {
+    args.github_repo = githubRepo;
+  }
+  if (repository.defaultBranch
+    && ['dispatch_task', 'launch_issue', 'dispatch_ready_tasks'].includes(name)
+    && args.base_ref === undefined) {
+    args.base_ref = repository.defaultBranch;
+  }
+  if (name === 'publish_issue_to_github' && github) {
+    if (args.labels === undefined && github.labels?.length) args.labels = [...github.labels];
+    if (args.project_owner === undefined && github.projectOwner) args.project_owner = github.projectOwner;
+    if (args.project_number === undefined && github.projectNumber !== undefined) args.project_number = github.projectNumber;
+  }
+  return args;
+}
+
+export function createMcpToolContext(opts: McpServerOptions): MultiRepositoryMcpToolContext {
+  const controllerHome = ensureRepoPreferredControllerHome(opts.repo, opts.controllerHome);
+  const explicitRepository = opts.repo?.trim()
+    ? repositoryForExplicitPath(opts.repo, controllerHome)
+      ?? (() => {
+        // Fresh registration is an install-time migration boundary. Run the
+        // one-time legacy entity bind here; repeat connects and ordinary reads
+        // never rescan historical state.
+        const repository = registerRepository({ path: opts.repo, controllerHome });
+        bindRepositoryEntities(repository);
+        return repository;
+      })()
+    : undefined;
+  const policyRoot = explicitRepository?.canonicalRoot ?? controllerHome;
+  const policy = runtimePolicy(policyRoot, { ...opts, controllerHome });
+  const config = policy.profile === 'controller'
+    ? loadMcpServiceLocalConfig(controllerHome, explicitRepository?.canonicalRoot)
+    : loadMcpLocalConfig(policyRoot);
+  const toolsetOverride = opts.toolset ?? process.env.FORGE_MCP_TOOLSET;
+  const configuredToolset = policy.profile === 'controller'
+    ? configuredControllerToolset(config)
+    : config?.toolset;
+  const toolset = parseMcpToolset(
+    toolsetOverride ?? configuredToolset,
+    policy.profile,
+  );
+  return {
+    controllerHome,
+    explicitRepository,
+    repoRoot: policyRoot,
+    policy,
+    toolset,
+    toolsetLocked: toolsetOverride !== undefined || configuredToolset !== undefined,
+    enableChatgptBrowser: opts.enableChatgptBrowser === true,
+    sessionId: opts.sessionId,
+    principalId: opts.principalId,
+    controllerInstanceId: opts.controllerInstanceId,
+    runtimeSourceRoot: opts.runtimeSourceRoot,
+  };
+}
+
+export async function callMultiRepositoryTool(
+  ctx: MultiRepositoryMcpToolContext,
+  name: string,
+  args: Record<string, unknown> = {},
+): Promise<ToolResult> {
+  try {
+    const repository = resolveRepositorySelection({
+      repoId: typeof args.repo_id === 'string' ? args.repo_id : undefined,
+      checkoutId: typeof args.checkout_id === 'string' ? args.checkout_id : undefined,
+      explicitPath: ctx.explicitRepository?.canonicalRoot,
+      controllerHome: ctx.controllerHome,
+      allowSoleRepository: true,
+    });
+    const scopedArgs = repositoryScopedToolArgs(name, args, repository);
+    const runtimeStorage = ensureRepositoryRuntimeStorage(repository, ctx.controllerHome);
+    if (EXECUTION_STORAGE_TOOLS.has(name) && !runtimeStorage.readyForExecution) {
+      throw new Error(`RUNTIME_STORAGE_NOT_READY: ${runtimeStorage.warnings.join('; ')}`);
+    }
+
+    // Legacy entity migration belongs to writes/registration, never to the
+    // ordinary read hot path (search / read / list / context). Only mutation
+    // tools rebind entities so newly created issues/tasks/sessions stay bound.
+    const rebindEntities = REPOSITORY_LOCKED_TOOLS.has(name);
+    if (rebindEntities) bindRepositoryEntities(repository);
+    const scopedContext: McpToolContext = {
+      repoRoot: repository.canonicalRoot,
+      policy: runtimePolicy(repository.canonicalRoot, {
+        profile: ctx.policy.profile,
+        enableChatgptBrowser: ctx.enableChatgptBrowser,
+        enableDevRunner: ctx.policy.execution.agentRunner,
+        devRunnerAgents: ctx.policy.execution.allowedAgents.join(','),
+        devRunnerTimeoutMs: ctx.policy.execution.runnerTimeoutMs,
+        devRunnerMaxTimeoutMs: ctx.policy.execution.runnerMaxTimeoutMs,
+      }),
+      enableChatgptBrowser: ctx.enableChatgptBrowser,
+      sessionId: ctx.sessionId,
+      principalId: ctx.principalId,
+      controllerInstanceId: ctx.controllerInstanceId,
+      repoId: repository.repoId,
+      checkoutId: repository.activeCheckoutId,
+    };
+    const invoke = async () => await callMcpTool(scopedContext, name, scopedArgs) as ToolResult;
+    const result = REPOSITORY_LOCKED_TOOLS.has(name)
+      ? await withControllerLockAsync(
+        ctx.controllerHome,
+        { scope: 'repository', repoId: repository.repoId },
+        `mcp:${name}`,
+        invoke,
+        60_000,
+      )
+      : await invoke();
+    if (rebindEntities) bindRepositoryEntities(repository);
+    return withRepositoryEnvelope(result, repository, runtimeStorage);
+  } catch (error) {
+    return errorResult(error);
+  }
+}

package/src/cli/mcp/oauth.ts

@@ -0,0 +1,226 @@
+import { randomUUID } from 'crypto';
+import { existsSync, mkdirSync, readFileSync, writeFileSync, chmodSync } from 'fs';
+import { dirname } from 'path';
+import type { OAuthRegisteredClientsStore } from '@modelcontextprotocol/sdk/server/auth/clients.js';
+import { InvalidGrantError, InvalidTokenError } from '@modelcontextprotocol/sdk/server/auth/errors.js';
+import type { AuthorizationParams, OAuthServerProvider } from '@modelcontextprotocol/sdk/server/auth/provider.js';
+import type { AuthInfo } from '@modelcontextprotocol/sdk/server/auth/types.js';
+import type {
+  OAuthClientInformationFull,
+  OAuthTokenRevocationRequest,
+  OAuthTokens,
+} from '@modelcontextprotocol/sdk/shared/auth.js';
+
+interface TokenData {
+  accessTokens?: Record<string, AuthInfo>;
+  refreshTokens?: Record<string, string>;
+  clients?: Record<string, OAuthClientInformationFull>;
+}
+
+function nowSeconds(): number {
+  return Math.floor(Date.now() / 1000);
+}
+
+function issueToken(): string {
+  return randomUUID();
+}
+
+export class McpOAuthTokenStore implements OAuthRegisteredClientsStore {
+  private accessTokens = new Map<string, AuthInfo>();
+  private refreshTokens = new Map<string, string>();
+  private clients = new Map<string, OAuthClientInformationFull>();
+
+  constructor(private readonly path: string, private readonly fallbackPaths: string[] = []) {}
+
+  load(): void {
+    let loaded = false;
+    let mergedFallback = false;
+    for (const [index, path] of [this.path, ...this.fallbackPaths].entries()) {
+      if (!existsSync(path)) continue;
+      try {
+        const data = JSON.parse(readFileSync(path, 'utf-8')) as TokenData;
+        const refreshTargets = new Set(Object.values(data.refreshTokens ?? {}));
+        for (const [token, info] of Object.entries(data.accessTokens ?? {})) {
+          if (!info.expiresAt || info.expiresAt > nowSeconds() || refreshTargets.has(token)) {
+            if (index > 0 && !this.accessTokens.has(token)) mergedFallback = true;
+            if (index > 0 && this.accessTokens.has(token)) continue;
+            this.accessTokens.set(token, info);
+          }
+        }
+        for (const [token, accessToken] of Object.entries(data.refreshTokens ?? {})) {
+          if (index > 0 && !this.refreshTokens.has(token)) mergedFallback = true;
+          if (index > 0 && this.refreshTokens.has(token)) continue;
+          this.refreshTokens.set(token, accessToken);
+        }
+        for (const [clientId, client] of Object.entries(data.clients ?? {})) {
+          if (index > 0 && !this.clients.has(clientId)) mergedFallback = true;
+          if (index > 0 && this.clients.has(clientId)) continue;
+          this.clients.set(clientId, client);
+        }
+        loaded = true;
+      } catch (_error) {
+        // Corrupt local auth state should not prevent starting the server.
+      }
+    }
+    if (loaded && mergedFallback) this.flush();
+  }
+
+  flush(): void {
+    mkdirSync(dirname(this.path), { recursive: true, mode: 0o700 });
+    chmodSync(dirname(this.path), 0o700);
+    const data: TokenData = {
+      accessTokens: Object.fromEntries(this.accessTokens),
+      refreshTokens: Object.fromEntries(this.refreshTokens),
+      clients: Object.fromEntries(this.clients),
+    };
+    writeFileSync(this.path, `${JSON.stringify(data, null, 2)}\n`, { encoding: 'utf-8', mode: 0o600 });
+    chmodSync(this.path, 0o600);
+  }
+
+  getClient(clientId: string): OAuthClientInformationFull | undefined {
+    return this.clients.get(clientId);
+  }
+
+  registerClient(client: Omit<OAuthClientInformationFull, 'client_id' | 'client_id_issued_at'>): OAuthClientInformationFull {
+    const candidate = client as Partial<OAuthClientInformationFull>;
+    const full: OAuthClientInformationFull = {
+      ...client,
+      client_id: candidate.client_id ?? randomUUID(),
+      client_id_issued_at: candidate.client_id_issued_at ?? nowSeconds(),
+    };
+    this.clients.set(full.client_id, full);
+    this.flush();
+    return full;
+  }
+
+  getAccessToken(token: string): AuthInfo | undefined {
+    return this.accessTokens.get(token);
+  }
+
+  setAccessToken(token: string, info: AuthInfo): void {
+    this.accessTokens.set(token, info);
+    this.flush();
+  }
+
+  deleteAccessToken(token: string): void {
+    this.accessTokens.delete(token);
+    this.flush();
+  }
+
+  getRefreshToken(token: string): string | undefined {
+    return this.refreshTokens.get(token);
+  }
+
+  setRefreshToken(token: string, accessToken: string): void {
+    this.refreshTokens.set(token, accessToken);
+    this.flush();
+  }
+
+  deleteRefreshToken(token: string): void {
+    this.refreshTokens.delete(token);
+    this.flush();
+  }
+
+  findRefreshTokenByAccessToken(accessToken: string): string | undefined {
+    for (const [refreshToken, storedAccessToken] of this.refreshTokens) {
+      if (storedAccessToken === accessToken) return refreshToken;
+    }
+    return undefined;
+  }
+}
+
+export function createMcpOAuthProvider(store: McpOAuthTokenStore): OAuthServerProvider {
+  const authCodes = new Map<string, { challenge: string; clientId: string }>();
+
+  return {
+    get clientsStore(): OAuthRegisteredClientsStore {
+      return store;
+    },
+
+    async authorize(client: OAuthClientInformationFull, params: AuthorizationParams, res): Promise<void> {
+      const code = issueToken();
+      authCodes.set(code, {
+        challenge: params.codeChallenge,
+        clientId: client.client_id,
+      });
+      const redirectUrl = new URL(params.redirectUri);
+      redirectUrl.searchParams.set('code', code);
+      if (params.state) redirectUrl.searchParams.set('state', params.state);
+      res.redirect(302, redirectUrl.toString());
+    },
+
+    async challengeForAuthorizationCode(_client: OAuthClientInformationFull, authorizationCode: string): Promise<string> {
+      const stored = authCodes.get(authorizationCode);
+      if (!stored) throw new InvalidGrantError('Invalid authorization code');
+      return stored.challenge;
+    },
+
+    async exchangeAuthorizationCode(
+      client: OAuthClientInformationFull,
+      authorizationCode: string,
+      _codeVerifier?: string,
+    ): Promise<OAuthTokens> {
+      const stored = authCodes.get(authorizationCode);
+      if (!stored || stored.clientId !== client.client_id) {
+        throw new InvalidGrantError('Invalid authorization code');
+      }
+      authCodes.delete(authorizationCode);
+      const accessToken = issueToken();
+      const refreshToken = issueToken();
+      const expiresIn = 30 * 24 * 60 * 60;
+      const expiresAt = nowSeconds() + expiresIn;
+      store.setAccessToken(accessToken, {
+        token: accessToken,
+        clientId: client.client_id,
+        scopes: ['forge'],
+        expiresAt,
+      });
+      store.setRefreshToken(refreshToken, accessToken);
+      return {
+        access_token: accessToken,
+        token_type: 'Bearer',
+        expires_in: expiresIn,
+        refresh_token: refreshToken,
+        scope: 'forge',
+      };
+    },
+
+    async exchangeRefreshToken(client: OAuthClientInformationFull, refreshToken: string): Promise<OAuthTokens> {
+      const accessToken = store.getRefreshToken(refreshToken);
+      const existing = accessToken ? store.getAccessToken(accessToken) : undefined;
+      if (!accessToken || !existing || existing.clientId !== client.client_id) {
+        throw new InvalidGrantError('Invalid refresh token');
+      }
+      store.deleteRefreshToken(refreshToken);
+      const nextRefreshToken = issueToken();
+      const expiresIn = 30 * 24 * 60 * 60;
+      store.setAccessToken(accessToken, { ...existing, expiresAt: nowSeconds() + expiresIn });
+      store.setRefreshToken(nextRefreshToken, accessToken);
+      return {
+        access_token: accessToken,
+        token_type: 'Bearer',
+        expires_in: expiresIn,
+        refresh_token: nextRefreshToken,
+        scope: existing.scopes.join(' '),
+      };
+    },
+
+    async verifyAccessToken(token: string): Promise<AuthInfo> {
+      const info = store.getAccessToken(token);
+      if (!info) throw new InvalidTokenError('Token not found');
+      if (info.expiresAt && info.expiresAt < nowSeconds()) {
+        if (!store.findRefreshTokenByAccessToken(token)) {
+          store.deleteAccessToken(token);
+        }
+        throw new InvalidTokenError('Token has expired');
+      }
+      return info;
+    },
+
+    async revokeToken(_client: OAuthClientInformationFull, request: OAuthTokenRevocationRequest): Promise<void> {
+      store.deleteAccessToken(request.token);
+      const refreshToken = store.findRefreshTokenByAccessToken(request.token);
+      if (refreshToken) store.deleteRefreshToken(refreshToken);
+    },
+  };
+}