@saadnvd1/agent-os 0.3.662 → 0.3.671

package/lib/chat/mcp-auth.ts

@@ -0,0 +1,193 @@
+/**
+ * Signing in to an MCP server from the browser. The agent starts the
+ * sign-in and gives a link; the provider then sends the browser back to
+ * AgentOS (/api/mcp-auth/callback), which hands that address to the agent.
+ * What ties the return to the attempt is the OAuth `state`, kept in SQLite
+ * (the start and callback routes are separate bundles, so memory isn't
+ * shared), used once, and dropped after PENDING_MS. The agent holds the
+ * tokens; nothing here stores or logs the address it was given.
+ */
+
+import { db } from "../db";
+import { getItem } from "./store";
+import { mcpAuthWorker } from "./runner";
+import type { McpSignInStart } from "./events";
+
+export const PENDING_MS = 15 * 60 * 1000;
+export const CALLBACK_PATH = "/api/mcp-auth/callback";
+
+interface Pending {
+  sessionId: string;
+  itemId: string;
+  server: string;
+  origin: string | null;
+  at: number;
+}
+
+interface PendingRow {
+  session_id: string;
+  item_id: string;
+  server: string;
+  origin: string | null;
+  at: number;
+}
+
+export function resetMcpSignIns(): void {
+  db.prepare(`DELETE FROM mcp_sign_ins`).run();
+}
+
+function sweep(now = Date.now()): void {
+  db.prepare(`DELETE FROM mcp_sign_ins WHERE at < ?`).run(now - PENDING_MS);
+}
+
+function savePending(state: string, p: Pending): void {
+  db.prepare(
+    `DELETE FROM mcp_sign_ins WHERE session_id = ? AND server = ?`
+  ).run(p.sessionId, p.server);
+  db.prepare(
+    `INSERT OR REPLACE INTO mcp_sign_ins (state, session_id, item_id, server, origin, at)
+     VALUES (?, ?, ?, ?, ?, ?)`
+  ).run(state, p.sessionId, p.itemId, p.server, p.origin, p.at);
+}
+
+function peekPending(state: string): Pending | undefined {
+  const r = db
+    .prepare(`SELECT * FROM mcp_sign_ins WHERE state = ?`)
+    .get(state) as PendingRow | undefined;
+  return (
+    r && {
+      sessionId: r.session_id,
+      itemId: r.item_id,
+      server: r.server,
+      origin: r.origin,
+      at: r.at,
+    }
+  );
+}
+
+// Single use: only the caller whose delete changed a row may go on.
+function takePending(state: string): boolean {
+  return (
+    db.prepare(`DELETE FROM mcp_sign_ins WHERE state = ?`).run(state).changes >
+    0
+  );
+}
+
+// `http(s)://host[:port]`, nothing else: the browser's own address for
+// AgentOS, so the provider returns to wherever the user is.
+export function cleanOrigin(value: string | null | undefined): string | null {
+  if (!value) return null;
+  try {
+    const url = new URL(value);
+    if (url.protocol !== "https:" && url.protocol !== "http:") return null;
+    return url.origin === value ? url.origin : null;
+  } catch {
+    return null;
+  }
+}
+
+function serverOf(sessionId: string, itemId: string, server: string) {
+  const item = getItem(sessionId, itemId);
+  if (item?.kind !== "mcp") throw new Error("That list is gone");
+  const view = item.servers.find((s) => s.name === server);
+  if (!view) throw new Error(`${server} isn't in that list`);
+  return view;
+}
+
+export async function startMcpSignIn(
+  sessionId: string,
+  input: { itemId: string; server: string; origin?: string | null }
+): Promise<McpSignInStart> {
+  if (!serverOf(sessionId, input.itemId, input.server).signIn)
+    throw new Error("AgentOS can't sign in to this server");
+  const worker = mcpAuthWorker(sessionId);
+  const origin = cleanOrigin(input.origin);
+  const { start, error } = await worker.mcpAuth(
+    {
+      action: "start",
+      server: input.server,
+      itemId: input.itemId,
+      redirectUri: origin ? `${origin}${CALLBACK_PATH}` : undefined,
+    },
+    30_000
+  );
+  if (error || !start) throw new Error(error ?? "Sign-in didn't start");
+  sweep();
+  const { state, ...result } = start;
+  if (state)
+    savePending(state, {
+      sessionId,
+      itemId: input.itemId,
+      server: input.server,
+      origin,
+      at: Date.now(),
+    });
+  return result;
+}
+
+// The provider returned the browser (or the user pasted the address it
+// ended on). `expect` pins a pasted address to the row it was typed in.
+export async function finishMcpSignIn(
+  callbackUrl: string,
+  expect?: { sessionId: string; server: string }
+): Promise<{ server: string }> {
+  sweep();
+  let state: string | null = null;
+  try {
+    state = new URL(callbackUrl).searchParams.get("state");
+  } catch {
+    throw new Error("That isn't a web address");
+  }
+  const p = state ? peekPending(state) : undefined;
+  if (!state || !p)
+    throw new Error(
+      "That sign-in expired or was already used. Press Sign in again."
+    );
+  if (
+    expect &&
+    (expect.sessionId !== p.sessionId || expect.server !== p.server)
+  )
+    throw new Error("That address belongs to a different sign-in");
+  if (!takePending(state))
+    throw new Error(
+      "That sign-in expired or was already used. Press Sign in again."
+    );
+  const { error } = await mcpAuthWorker(p.sessionId).mcpAuth({
+    action: "submit",
+    server: p.server,
+    itemId: p.itemId,
+    url: callbackUrl,
+  });
+  if (error) throw new Error(error);
+  return { server: p.server };
+}
+
+// The provider's redirect reached our callback route. Rebuild the address
+// from the origin the sign-in started with, not from the request (behind the
+// custom server Next may derive it from Host), so it matches the
+// redirect_uri the provider was given exactly.
+export async function finishMcpSignInFromRedirect(
+  search: string
+): Promise<{ server: string }> {
+  sweep();
+  const state = new URLSearchParams(search).get("state");
+  const origin = state ? peekPending(state)?.origin : null;
+  if (!origin)
+    throw new Error(
+      "That sign-in expired or was already used. Press Sign in again."
+    );
+  return finishMcpSignIn(`${origin}${CALLBACK_PATH}${search}`);
+}
+
+// "Check again": reconnect and refresh the list.
+export async function reconnectMcpServer(
+  sessionId: string,
+  input: { itemId: string; server: string }
+): Promise<void> {
+  serverOf(sessionId, input.itemId, input.server);
+  const { error } = await mcpAuthWorker(sessionId).mcpAuth(
+    { action: "reconnect", ...input },
+    30_000
+  );
+  if (error) throw new Error(error);
+}

package/lib/chat/registry.ts

@@ -38,6 +38,8 @@ export interface Live {
   canFresh?: boolean;
   // Whether it takes "background_task" (an older worker drops it).
   canBackground?: boolean;
+  // Whether it takes "mcp_auth" (sign in to an MCP server).
+  canMcpAuth?: boolean;
   // From an older build and idle: retired once its guess at the next
   // message is in, or this fires.
   retiring?: NodeJS.Timeout;

package/lib/chat/runner.ts

@@ -87,6 +87,7 @@ import {
 } from "./worker/client";
 import { buildId, isStaleWorker } from "../build";
 import type { WorkerEvent } from "./worker/protocol";
+import type { WorkerClient } from "./worker/client";
 import { DEMO_REFUSAL, demoMode } from "../security/demo";
 import { chatHold, chatRefusal } from "./hold";
 import { getHost } from "../hosts";
@@ -363,6 +364,7 @@ async function ensureLive(sessionId: string, spawn = true): Promise<Live> {
       canQueue: !!hello.caps?.includes("queue"),
       canFresh: !!hello.caps?.includes("fresh"),
       canBackground: !!hello.caps?.includes("background"),
+      canMcpAuth: !!hello.caps?.includes("mcp_auth"),
     };
     // From an older build and busy, or running background work: it goes at
     // its next turn boundary, by itself if it can. Messages meanwhile wait
@@ -932,6 +934,22 @@ export async function backgroundChatTask(
   });
 }
 
+// The session's running worker, when it can sign in to MCP servers; why not
+// otherwise (a chat on another machine, an idle one, one from an older build).
+export function mcpAuthWorker(sessionId: string): WorkerClient {
+  checkChattable(getSession(sessionId));
+  const live = registry.live.get(sessionId);
+  if (!live || live.retiring)
+    throw new Error(
+      "This chat's agent isn't running. Send /mcp again to wake it, then sign in."
+    );
+  if (!live.canMcpAuth)
+    throw new Error(
+      "This chat's agent is from an older AgentOS build. Send it a message or reopen the chat, then try again."
+    );
+  return live.worker;
+}
+
 export function chatTaskOutput(
   sessionId: string,
   taskId: string

package/lib/chat/worker/client.ts

@@ -12,7 +12,8 @@ import path from "path";
 import { promisify } from "util";
 import { endTmuxSession } from "../../tmux/end";
 import type { UndoResult } from "../driver";
-import type { FileSuggestion } from "../events";
+import type { FileSuggestion, McpSignInStart } from "../events";
+import type { McpAuthCommand } from "./mcp-auth";
 import {
   envPath,
   lineReader,
@@ -47,6 +48,11 @@ export class WorkerClient {
     (r: { ok?: boolean; error?: string }) => void
   >();
 
+  private mcpAuths = new Map<
+    string,
+    (r: { start?: McpSignInStart & { state?: string }; error?: string }) => void
+  >();
+
   private constructor(
     private socket: net.Socket,
     private handlers: WorkerHandlers
@@ -115,6 +121,11 @@ export class WorkerClient {
       this.backgrounds.delete(e.reqId);
       return;
     }
+    if (e.type === "mcp_auth_result") {
+      this.mcpAuths.get(e.reqId)?.({ start: e.start, error: e.error });
+      this.mcpAuths.delete(e.reqId);
+      return;
+    }
     if (e.type === "files_result") {
       this.files.get(e.reqId)?.(e.files ?? null);
       this.files.delete(e.reqId);
@@ -155,6 +166,29 @@ export class WorkerClient {
     });
   }
 
+  // Signs in to an MCP server (start, finish or reconnect): what it came back
+  // with, or why not (an error, or no answer in time).
+  mcpAuth(
+    cmd: Omit<McpAuthCommand, "type" | "reqId">,
+    timeoutMs = 60_000
+  ): Promise<{
+    start?: McpSignInStart & { state?: string };
+    error?: string;
+  }> {
+    const reqId = randomUUID();
+    return new Promise((resolve) => {
+      const timer = setTimeout(() => {
+        this.mcpAuths.delete(reqId);
+        resolve({ error: "The agent didn't answer in time" });
+      }, timeoutMs);
+      this.mcpAuths.set(reqId, (r) => {
+        clearTimeout(timer);
+        resolve(r);
+      });
+      this.command({ type: "mcp_auth", reqId, ...cmd });
+    });
+  }
+
   // The agent's own matches for an @mention; null when it can't say (an
   // older worker, an error, no answer in time).
   fileSuggestions(

package/lib/chat/worker/host.ts

@@ -25,10 +25,12 @@ import {
   itemsOfKind,
   flushItems,
   moveToEnd,
+  getItem,
   queueItem,
   runningTools,
   settle,
 } from "../store";
+import { handleMcpAuth, stopMcpWatches } from "./mcp-auth";
 import { claimNext, enqueue, listQueue, moveToFront } from "../queued";
 import { isHeld } from "../hold";
 import {
@@ -804,6 +806,12 @@ export class ChatHost {
           });
         }
         return;
+      case "mcp_auth":
+        return handleMcpAuth(cmd, this.conversation, {
+          emit: (e) => this.emit(e),
+          record: (item) => this.record(item),
+          item: (id) => getItem(this.session.id, id),
+        });
       case "undo":
         try {
           const result = await this.conversation.undo(
@@ -1051,6 +1059,7 @@ export class ChatHost {
     this.setCompacting(false);
     flushItems();
     this.onClose();
+    stopMcpWatches(this.conversation.mcpAuth);
     this.conversation.close();
   }
 }

package/lib/chat/worker/main.ts

@@ -76,7 +76,7 @@ async function main(sessionId: string) {
         state: host.state,
         compacting: host.compactingNow,
         streaming: [...host.streaming.values()],
-        caps: ["plan", "queue", "retire", "fresh", "background"],
+        caps: ["plan", "queue", "retire", "fresh", "background", "mcp_auth"],
       } satisfies WorkerEvent)}\n`
     );
     client.on(

package/lib/chat/worker/mcp-auth.ts

@@ -0,0 +1,119 @@
+/**
+ * Signing in to an MCP server from a chat: the worker owns the agent, so it
+ * starts the sign-in, hands over the address the provider returned to, and
+ * reconnects. The /mcp item it came from is rewritten in place (same id) so
+ * its row turns connected. A sign-in the browser can't finish by itself (it
+ * happens on another machine, or on claude.ai) is watched until the server
+ * stops needing it.
+ */
+
+import type { ChatConversation, McpAuth } from "../driver";
+import type { ChatItem, McpSignInStart } from "../events";
+import { cleanMcpError } from "../drivers/claude";
+import type { WorkerCommand, WorkerEvent } from "./protocol";
+
+export type McpAuthCommand = Extract<WorkerCommand, { type: "mcp_auth" }>;
+
+export const WATCH_EVERY_MS = 2000;
+export const WATCH_FOR_MS = 10 * 60 * 1000;
+
+interface Host {
+  emit(e: WorkerEvent): void;
+  record(item: ChatItem): void;
+  item(id: string): ChatItem | undefined;
+}
+
+const watches = new WeakMap<object, Map<string, NodeJS.Timeout>>();
+
+function stopWatch(owner: object, server: string): void {
+  const timer = watches.get(owner)?.get(server);
+  if (timer) clearInterval(timer);
+  watches.get(owner)?.delete(server);
+}
+
+// The conversation is closing: no watch outlives it.
+export function stopMcpWatches(auth: object | undefined): void {
+  if (!auth) return;
+  for (const timer of watches.get(auth)?.values() ?? []) clearInterval(timer);
+  watches.delete(auth);
+}
+
+// Rewrites the /mcp item with the servers as they are now.
+async function refresh(auth: McpAuth, host: Host, itemId: string) {
+  const item = host.item(itemId);
+  if (item?.kind !== "mcp") return;
+  host.record({ ...item, servers: await auth.servers() });
+}
+
+function watch(auth: McpAuth, host: Host, itemId: string, server: string) {
+  const owner = auth;
+  stopWatch(owner, server);
+  const timers = watches.get(owner) ?? new Map();
+  watches.set(owner, timers);
+  const started = Date.now();
+  let busy = false;
+  const timer = setInterval(async () => {
+    if (busy) return;
+    busy = true;
+    try {
+      const now = (await auth.servers()).find((s) => s.name === server);
+      if (now && now.status !== "needs-auth") {
+        stopWatch(owner, server);
+        await refresh(auth, host, itemId);
+      } else if (Date.now() - started > WATCH_FOR_MS) stopWatch(owner, server);
+    } catch {
+      stopWatch(owner, server);
+    } finally {
+      busy = false;
+    }
+  }, WATCH_EVERY_MS);
+  timer.unref?.();
+  timers.set(server, timer);
+}
+
+export async function handleMcpAuth(
+  cmd: McpAuthCommand,
+  conversation: Pick<ChatConversation, "mcpAuth">,
+  host: Host
+): Promise<void> {
+  const auth = conversation.mcpAuth;
+  const reply = (r: { start?: McpSignInStart; error?: string }) =>
+    host.emit({ type: "mcp_auth_result", reqId: cmd.reqId, ...r });
+  if (!auth) return reply({ error: "This agent can't sign in to MCP servers" });
+  try {
+    if (cmd.action === "start") {
+      const { state, ...start } = await auth.start(cmd.server, cmd.redirectUri);
+      if (start.mode === "done") {
+        await auth.reconnect(cmd.server);
+        await refresh(auth, host, cmd.itemId);
+      } else if (start.mode !== "callback")
+        watch(auth, host, cmd.itemId, cmd.server);
+      // The state ties the provider's return to this attempt; the server
+      // keeps it, the browser never needs it.
+      return reply({ start: { ...start, ...(state && { state }) } });
+    }
+    stopWatch(auth, cmd.server);
+    let failure: unknown;
+    try {
+      if (cmd.action === "submit") {
+        if (!cmd.url) throw new Error("No address to finish with");
+        await auth.submit(cmd.server, cmd.url);
+      }
+      await auth.reconnect(cmd.server);
+    } catch (error) {
+      failure = error;
+    }
+    await refresh(auth, host, cmd.itemId).catch(() => {});
+    reply(failure ? { error: message(failure) } : {});
+  } catch (error) {
+    reply({ error: message(error) });
+  }
+}
+
+// An error can quote the server's URL, and a key in it.
+function message(error: unknown): string {
+  return (
+    cleanMcpError(error instanceof Error ? error.message : String(error)) ??
+    "Sign-in failed"
+  );
+}

package/lib/chat/worker/protocol.ts

@@ -3,8 +3,8 @@
  * worker's Unix socket: one JSON message per line.
  */
 
+import { agentosHome } from "../../agentos-home";
 import crypto from "crypto";
-import os from "os";
 import path from "path";
 import type {
   ApprovalDecision,
@@ -15,6 +15,7 @@ import type {
   Compacting,
   DriverEvent,
   FileSuggestion,
+  McpSignInStart,
   ChatOrigin,
   PeerMessage,
 } from "../events";
@@ -56,6 +57,18 @@ export type WorkerCommand =
   | { type: "undo"; reqId: string; checkpoint: string; dryRun: boolean }
   | { type: "stop_task"; taskId: string }
   | { type: "background_task"; reqId: string; toolUseId?: string }
+  // Sign in to an MCP server listed in the /mcp item `itemId`: start it
+  // (redirectUri: where the provider should return the browser), finish it
+  // with the address it returned to (url), or just reconnect.
+  | {
+      type: "mcp_auth";
+      reqId: string;
+      action: "start" | "submit" | "reconnect";
+      server: string;
+      itemId: string;
+      redirectUri?: string;
+      url?: string;
+    }
   // It runs an older build: it takes no new message into its agent (they
   // wait in the queue) and closes at its next turn boundary, so a current
   // worker resumes the conversation with today's tools.
@@ -101,6 +114,12 @@ export type WorkerEvent =
   | { type: "suggestion"; text: string | null }
   | { type: "undo_result"; reqId: string; result?: UndoResult; error?: string }
   | { type: "background_result"; reqId: string; ok?: boolean; error?: string }
+  | {
+      type: "mcp_auth_result";
+      reqId: string;
+      start?: McpSignInStart & { state?: string };
+      error?: string;
+    }
   | {
       type: "files_result";
       reqId: string;
@@ -116,7 +135,7 @@ export function workerDir(): string {
     process.env.DB_PATH || path.join(process.cwd(), "agent-os.db")
   );
   const key = crypto.createHash("sha1").update(db).digest("hex").slice(0, 8);
-  return path.join(os.homedir(), ".agent-os", "chat", key);
+  return agentosHome("chat", key);
 }
 
 export const socketPath = (sessionId: string) =>

package/lib/connect/config.ts

@@ -11,8 +11,8 @@
  * each time the tunnel starts.
  */
 
+import { agentosHome } from "../agentos-home";
 import fs from "fs";
-import os from "os";
 import path from "path";
 
 export interface ConnectConfig {
@@ -32,8 +32,7 @@ export interface ConnectFiles {
 export const MACHINE_HOST = /^m-[0-9a-f]{16}\.runagentos\.com$/;
 
 export const connectDir = () =>
-  process.env.AGENTOS_CONNECT_DIR ||
-  path.join(os.homedir(), ".agent-os", "connect");
+  process.env.AGENTOS_CONNECT_DIR || agentosHome("connect");
 
 export type ConnectRead =
   | { ok: true; files: ConnectFiles; enabled: boolean }

package/lib/db/backup.ts

@@ -1,13 +1,13 @@
+import { agentosHome } from "../agentos-home";
 import type Database from "better-sqlite3";
 import Sqlite from "better-sqlite3";
 import { randomBytes } from "crypto";
 import fs from "fs";
-import os from "os";
 import path from "path";
 import { refuseRealStateUnderTest } from "../test-home-guard";
 
 export const backupsDir = (): string =>
-  refuseRealStateUnderTest(path.join(os.homedir(), ".agent-os", "backups"));
+  refuseRealStateUnderTest(agentosHome("backups"));
 
 // A full copy of the database (VACUUM INTO) under ~/.agent-os/backups, taken
 // before a destructive migration. Throws, and the migration must stop, unless

package/lib/db/migrations/20261018T1600_health_boot_deploys.ts

@@ -0,0 +1,13 @@
+import type { Migration } from "../migration-types";
+
+export default {
+  key: "20261018T1600_health_boot_deploys",
+  up: (db) => {
+    const cols = (
+      db.prepare(`PRAGMA table_info(health_boots)`).all() as { name: string }[]
+    ).map((c) => c.name);
+    // 1 when autodeploy planned the restart that started this boot.
+    if (!cols.includes("deploy"))
+      db.exec(`ALTER TABLE health_boots ADD COLUMN deploy INTEGER`);
+  },
+} satisfies Migration;

package/lib/db/migrations/20261018T1730_mcp_sign_ins.ts

@@ -0,0 +1,22 @@
+import type { Migration } from "../migration-types";
+
+export default {
+  key: "20261018T1730_mcp_sign_ins",
+  up: (db) => {
+    // MCP sign-ins waiting for the provider to send the browser back, keyed by
+    // the OAuth state. Short-lived and single use; no tokens are stored.
+    // Additive.
+    db.exec(`
+      CREATE TABLE IF NOT EXISTS mcp_sign_ins (
+        state TEXT PRIMARY KEY,
+        session_id TEXT NOT NULL,
+        item_id TEXT NOT NULL,
+        server TEXT NOT NULL,
+        origin TEXT,
+        at INTEGER NOT NULL
+      );
+      CREATE INDEX IF NOT EXISTS idx_mcp_sign_ins_session
+        ON mcp_sign_ins(session_id, server);
+    `);
+  },
+} satisfies Migration;

package/lib/db/migrations/20261018T2100_orch_full_access.ts

@@ -0,0 +1,16 @@
+import type { Migration } from "../migration-types";
+
+export default {
+  key: "20261018T2100_orch_full_access",
+  up: (db) => {
+    // Whether the workspace's orchestrator runs with its shell and file
+    // guards off (orchestrator/full-access.ts). On by default. Additive.
+    const cols = db.prepare(`PRAGMA table_info(workspaces)`).all() as {
+      name: string;
+    }[];
+    if (!cols.some((c) => c.name === "orch_full_access"))
+      db.exec(
+        `ALTER TABLE workspaces ADD COLUMN orch_full_access INTEGER NOT NULL DEFAULT 1`
+      );
+  },
+} satisfies Migration;

package/lib/db/types.ts

@@ -296,6 +296,9 @@ export interface Workspace {
   // Tasks are messaged about failing checks and reviews on their PRs
   // (orchestrator/pr-wake.ts).
   wake_tasks_on_pr: boolean;
+  // Its orchestrator's shell and file writes aren't checked, and it may merge
+  // directly (orchestrator/full-access.ts).
+  orch_full_access: boolean;
   created_at: string;
 }